joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180063b00
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push r12
sub rsp, 0x270
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r12, r8
mov rbp, rcx
mov rbx, rdx
lea r8, [0x180259780]
lea rcx, str.line:_d__MyRegCreateKeyW
mov edx, 0x35cf
call fcn.18005cd20
lea rdx, [sym.vrvhook64.dll_MyRegCreateKeyW]
lea rcx, [0x18028d500]
call fcn.18000dae0
test rax, rax
jne 0x180063b5f
or eax, 0xffffffff
jmp 0x180063d58
mov rcx, rax
mov qword [rsp + 0x268], rsi
call fcn.18000d7e0
cmp dword [0x1801f561c], 0
mov rsi, rax
je 0x180063c01
lea rdx, [0x18025cbc0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [0x18025cbc0]
lea rcx, [0x1801f5620]
call fcn.180061120
test eax, eax
je 0x180063c01
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x207
mov byte [rsp + 0x40], 0
call fcn.1800f4fb0
xor edx, edx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x40]
or r9d, 0xffffffff
mov r8, rbx
xor ecx, ecx
mov dword [rsp + 0x28], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rsp + 0x40]
call fcn.1800fd3f0
or eax, 0xffffffff
jmp 0x180063d50
cmp dword [0x1801f5a20], 1
jne 0x180063d45
lea rdx, [0x18025cbc0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [0x18025cbc0]
call fcn.1800fd3f0
lea rdx, [0x18025cbc0]
lea rcx, [0x1801f5a34]
call fcn.180061120
test eax, eax
jne 0x180063d45
cmp byte [0x180346010], al
jne 0x180063cae
lea rcx, [0x180346010]
mov edx, 0x104
mov qword [rsp + 0x260], rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x180346010]
repne scasb al, byte [rdi]
mov rax, qword [0x18015c9f8]
lea rcx, [0x180346010]
mov qword [rdi - 1], rax
mov eax, dword [0x18015ca00]
mov dword [rdi + 7], eax
movzx eax, word [0x18015ca04]
mov word [rdi + 0xb], ax
call fcn.1800fd3f0
mov rdi, qword [rsp + 0x260]
lea rdx, [0x180346010]
lea rcx, [0x18025cbc0]
call fcn.1800f4d08
test rax, rax
jne 0x180063d45
test rbx, rbx
je 0x180063d45
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x207
mov byte [rsp + 0x40], al
call fcn.1800f4fb0
xor edx, edx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x40]
or r9d, 0xffffffff
mov r8, rbx
xor ecx, ecx
mov dword [rsp + 0x28], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rsp + 0x40]
call fcn.1800fd3f0
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.180061630
test eax, eax
je 0x180063d45
lea r8, [0x180259780]
lea rcx, str.line:_d__MyRegCreateKeyW
mov edx, 0x3610
call fcn.18005cd20
or eax, 0xffffffff
jmp 0x180063d50
mov r8, r12
mov rdx, rbx
mov rcx, rbp
call rsi
mov rsi, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x270
pop r12
pop rbp
pop rbx
ret
Function at 0x180063e90
Capabilities:
Read file via mapping

Disassembly:
push rsi
sub rsp, 0x30
xor edx, edx
lea r8, str.GlobalLinkShareMemVrv
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov rsi, rax
test rax, rax
je 0x180063f3c
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor edx, edx
mov rcx, rax
mov r8d, 0x104
mov rbx, rax
call fcn.1800f4fb0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x18025cbc0]
lea rdx, [0x18025cbc0]
repne scasb al, byte [rdi]
mov eax, 0x103
not rcx
dec rcx
cmp rcx, rax
cmova rcx, rax
mov r8, rcx
mov rcx, rbx
call fcn.1800f6e10
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rsi
ret

Function at 0x180064be0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x260
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x208
mov byte [rsp + 0x40], 0
call fcn.1800f4fb0
xor ebx, ebx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
or r9d, 0xffffffff
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
lea rbp, [0x18025bdf0]
not rcx
cmp rcx, 1
je 0x180064c8f
lea rdi, [rsp + 0x40]
mov rax, rbp
sub rdi, rbp
movzx edx, byte [rax]
movzx ecx, byte [rax + rdi]
sub edx, ecx
jne 0x180064c87
inc rax
test ecx, ecx
jne 0x180064c75
test edx, edx
je 0x180064d45
lea rdx, [0x18015cb98]
lea rcx, [0x18025bce0]
mov qword [rsp + 0x278], rsi
call fcn.1800f7e24
mov rsi, rax
test rax, rax
jne 0x180064cd0
lea rdx, [0x18015cb94]
lea rcx, [0x18025bce0]
call fcn.1800f7e24
mov rsi, rax
test rax, rax
je 0x180064d3d
nop dword [rax]
movzx eax, byte [rsp + rbx + 0x40]
inc rbx
mov byte [rbx + rbp - 1], al
test al, al
jne 0x180064cd0
xor eax, eax
or rcx, 0xffffffffffffffff
xor edx, edx
lea rdi, [rsp + 0x40]
lea r8d, [rdx + 2]
repne scasb al, byte [rdi]
movzx eax, word [0x180154030]
mov rcx, rsi
mov word [rdi - 1], ax
movzx eax, byte [0x180154032]
mov byte [rdi + 1], al
call fcn.1800f7c3c
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
mov r9, rsi
repne scasb al, byte [rdi]
lea r8d, [rax + 1]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x40]
call fcn.1800f7788
mov rcx, rsi
call fcn.1800f7504
mov rsi, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1800f4f80
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180064e20
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0xf8
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor ebx, ebx
mov rdi, rdx
test rcx, rcx
je 0x180064fdb
test rdx, rdx
je 0x180064fdb
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 3]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x120], rbp
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x180064eab
or eax, eax
mov rbp, qword [rsp + 0x120]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0xf8
pop rdi
pop rbx
ret
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x40], eax
test eax, eax
je 0x180064fcb
mov ecx, eax
mov qword [rsp + 0x128], rsi
inc rcx
call fcn.1800f9438
mov rsi, rax
test rax, rax
je 0x180064fc3
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, rax
mov rcx, rbp
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x82
mov byte [rsp + 0x50], bl
call fcn.1800f4fb0
lea rdx, [0x18015cbb0]
lea rcx, [rsp + 0x50]
mov r8, rdi
call fcn.1800f509c
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1800f4d08
mov r12, rax
test rax, rax
je 0x180064fb3
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
lea rdx, [0x18015c608]
not rcx
dec rcx
add rcx, r12
call fcn.1800f4d08
mov rdi, rax
test rax, rax
jne 0x180064f73
mov edi, dword [rsp + 0x40]
add rdi, rsi
lea rdx, str._nPhoneNumber
mov rcx, r12
call fcn.1800f4d08
test rax, rax
je 0x180064fb3
lea rcx, [rax + 0xd]
cmp rax, rdi
jae 0x180064f9d
movzx eax, byte [rcx]
cmp al, 0xd
je 0x180064f9d
cmp al, 0xa
je 0x180064f9d
inc ebx
cmp ebx, 1
jg 0x180064fb3
lea rdx, str._nPhoneNumber
call fcn.1800f4d08
test rax, rax
jne 0x180064f87
mov rcx, rsi
call fcn.1800f93a8
mov r12, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0x128]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x180064e89
or eax, 0xffffffff
jmp 0x180064e91

Function at 0x1800652c0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
lea r8, str.Afx:400000:8
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x18006534e
lea rdx, str.___ACDSee
mov rcx, rbx
call fcn.1800fb870
test rax, rax
je 0x18006530f
xor ecx, ecx
mov word [rax], cx
mov edx, 0x2e
mov rcx, rbx
call fcn.1800fb920
test rax, rax
jne 0x180065341
mov rdi, rbx
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str..jpg]
mov qword [rdi - 2], rax
movzx eax, word [0x18015cbd0]
mov word [rdi + 6], ax
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180065360
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
mov qword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r8, [rsp + 0x40]
lea rdx, [0x1800650b0]
mov ecx, eax
call qword [sym.imp.USER32.dll_EnumThreadWindows]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1800653fa
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowExA]
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, 0x2e
mov rcx, rdi
call fcn.1800fb920
test rax, rax
jne 0x1800653ed
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str..dwg]
mov qword [rdi - 2], rax
movzx eax, word [0x18015cc18]
mov word [rdi + 6], ax
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180065540
Capabilities:
Get storage device properties

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor eax, eax
lea r8, [rsp + 0x48]
mov r9d, 0x11
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov eax, dword [rdx + 4]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov edx, 0x2d1400
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x68
ret
Function at 0x1800655a0
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x180
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
test rcx, rcx
je 0x18006568f
cmp word [rcx], 0
je 0x18006568f
or rcx, 0xffffffffffffffff
mov qword [r11 + 0x10], rdi
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdi, qword [r11 + 0x10]
not rcx
dec rcx
cmp rcx, 0x104
jae 0x180065691
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x60], al
call fcn.1800f4fb0
xor edx, edx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x60]
or r9d, 0xffffffff
mov r8, rbx
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsx r8d, byte [rsp + 0x60]
xor eax, eax
lea rdx, [0x18015ccac]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x51], rax
mov byte [rsp + 0x59], al
call fcn.1800f509c
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x1800656aa
cmp eax, 3
je 0x1800656aa
lea r8, [rsp + 0x50]
lea rcx, [0x18015cc88]
mov edx, 0x78e0
call fcn.18005cd20
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x180
pop rbx
ret
movsx r8d, byte [rsp + 0x60]
xor eax, eax
lea rdx, [0x18015cc84]
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x41], rax
mov byte [rsp + 0x49], al
call fcn.1800f509c
cmp byte [0x1801e00a8], 0
je 0x180065728
lea rcx, [0x1801e00a8]
call fcn.1800fd3f0
lea rcx, [rsp + 0x40]
call fcn.1800fd3f0
lea rdx, [rsp + 0x40]
lea rcx, [0x1801e00a8]
call fcn.1800f4d08
test rax, rax
je 0x180065728
lea r9, [rsp + 0x40]
lea r8, [0x1801e00a8]
lea rcx, [0x18015cc50]
mov edx, 0x78ec
call fcn.18005cd20
jmp 0x18006568f
lea r9, [rsp + 0x40]
lea r8, [0x1801e00a8]
lea rcx, [0x18015cc20]
mov edx, 0x78f0
call fcn.18005cd20
mov eax, 1
jmp 0x180065691
Function at 0x1800658c0
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
test rcx, rcx
je 0x180065934
movzx eax, byte [rcx]
test al, al
je 0x180065934
xor ecx, ecx
lea rdx, [0x18015ccac]
movsx r8d, al
mov qword [rsp + 0x31], rcx
mov byte [rsp + 0x39], cl
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x30], 0
call fcn.1800f509c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x180065949
cmp eax, 3
je 0x180065949
lea r8, [rsp + 0x30]
lea rcx, [0x18015cc88]
mov edx, 0x794e
call fcn.18005cd20
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x50
pop rbx
ret
movsx r8d, byte [rbx]
xor eax, eax
lea rdx, [0x18015cc84]
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x21], rax
mov byte [rsp + 0x29], al
call fcn.1800f509c
cmp byte [0x1801e00a8], 0
je 0x1800659c5
lea rcx, [0x1801e00a8]
call fcn.1800fd3f0
lea rcx, [rsp + 0x20]
call fcn.1800fd3f0
lea rdx, [rsp + 0x20]
lea rcx, [0x1801e00a8]
call fcn.1800f4d08
test rax, rax
je 0x1800659c5
lea r9, [rsp + 0x20]
lea r8, [0x1801e00a8]
lea rcx, [0x18015cc50]
mov edx, 0x795a
call fcn.18005cd20
jmp 0x180065934
lea r9, [rsp + 0x20]
lea r8, [0x1801e00a8]
lea rcx, [0x18015cc20]
mov edx, 0x795e
call fcn.18005cd20
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x50
pop rbx
ret

Function at 0x180065a00
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x60], 0
call fcn.1800f4fb0
movzx eax, word [rbx]
xor r11d, r11d
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x49], r11
mov byte [rsp + 0x51], r11b
mov word [rcx], ax
movzx eax, byte [rbx + 2]
xor ebx, ebx
mov dword [rsp + 0x38], 0xa
mov byte [rcx + 2], al
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x48]
lea r9, [rsp + 0x40]
lea r8d, [r11 + 0xc]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
setne bl
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x170
pop rbx
ret
Function at 0x180065ab0
Capabilities:
Get disk information

Disassembly:
push rdi
sub rsp, 0x60
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
lea rdx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x31], rax
mov qword [rsp + 0x39], rax
mov qword [rsp + 0x41], rax
mov dword [rsp + 0x49], eax
mov byte [rsp + 0x4d], al
mov qword [rsp + 0x20], rax
call fcn.1800fda7c
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
movzx eax, word [0x180151570]
lea rcx, [rsp + 0x30]
mov word [rdi - 1], ax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea r9, [rsp + 0x30]
lea r8, str.GetDriveType:
lea rcx, str.line:_d___s___s___s
cmp eax, 5
jne 0x180065b61
lea rax, str._DRIVE_CDROM_return_TRUE
mov edx, 0x79a0
mov qword [rsp + 0x20], rax
call fcn.18005cd20
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x60
pop rdi
ret
lea rax, str._DRIVE_CDROM_return_FALSE
mov edx, 0x79a3
mov qword [rsp + 0x20], rax
call fcn.18005cd20
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x60
pop rdi
ret

Function at 0x180065b90
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x440], rax
movzx ebx, cx
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.1800f4fb0
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x230], di
call fcn.1800f4fb0
lea rdx, [0x18015cdd0]
lea rcx, [rsp + 0x230]
mov r8d, ebx
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x230]
mov r8d, 0x208
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x180065c72
lea rcx, [rsp + 0x20]
call fcn.1800fcb98
lea rdx, [0x18015cdb8]
lea rcx, [rsp + 0x20]
call fcn.1800fb870
test rax, rax
jne 0x180065c53
lea rdx, [0x18015cdb0]
lea rcx, [rsp + 0x20]
call fcn.1800fb870
test rax, rax
je 0x180065c72
lea r8, str.IsEDPDisk_return_TRUE
lea rcx, [0x180155288]
mov edx, 0x79b4
call fcn.18005cd20
mov eax, 1
jmp 0x180065c8c
lea r8, str.IsEDPDisk_return_FALSE
lea rcx, [0x180155288]
mov edx, 0x79bd
call fcn.18005cd20
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1800f4f80
mov rbx, qword [rsp + 0x468]
add rsp, 0x450
pop rdi
ret
Function at 0x180065cb0
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x240], rax
movsx ebx, cl
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.1800f4fb0
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x130], 0
call fcn.1800f4fb0
lea rdx, [0x18015cdfc]
lea rcx, [rsp + 0x130]
mov r8d, ebx
call fcn.1800f509c
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x130]
mov r8d, 0x208
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x180065d73
lea rcx, [rsp + 0x20]
call fcn.1800fd3f0
lea rdx, str.EDPEDISK
lea rcx, [rsp + 0x20]
call fcn.1800f4d08
test rax, rax
jne 0x180065d6c
lea rdx, [0x18015cdec]
lea rcx, [rsp + 0x20]
call fcn.1800f4d08
test rax, rax
je 0x180065d86
mov eax, 1
jmp 0x180065d88
lea rdx, str.QueryDosDevice_
lea rcx, [0x180153a08]
call fcn.18005cd20
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x250
pop rbx
ret
Function at 0x180065db0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
test rcx, rcx
je 0x180065fc5
mov r11, rsp
push rbx
sub rsp, 0xa80
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0xa70], rax
mov rbx, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
cmp word [rbx + rcx*2 - 4], 0x5c
je 0x180065e0b
mov rdi, rbx
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, dword [0x180155e50]
mov dword [rdi - 2], eax
lea rdx, [rsp + 0x670]
mov rcx, rbx
sub rdx, rbx
nop dword [rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x180065e20
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x670]
repne scasw ax, word [rdi]
mov rax, qword [0x18015ce00]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x670]
mov qword [rdi - 2], rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180065f9d
mov qword [rsp + 0xa98], rbp
xor ebp, ebp
nop word [rax + rax]
cmp word [rsp + 0x4c], 0x2e
je 0x180065f76
test byte [rsp + 0x20], 0x10
je 0x180065f2f
lea rcx, [rsp + 0x272]
xor edx, edx
mov r8d, 0x3fe
mov word [rsp + 0x270], bp
call fcn.1800f4fb0
lea rcx, [rsp + 0x270]
sub rcx, rbx
mov rdx, rbx
nop word [rax + rax]
movzx eax, word [rdx]
add rdx, 2
mov word [rcx + rdx - 2], ax
test ax, ax
jne 0x180065ed0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x270]
repne scasw ax, word [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x4c]
nop dword [rax]
movzx eax, word [rdx + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x180065f00
lea rcx, [rsp + 0x270]
call fcn.180065db0
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x180065f76
lea rcx, [rsp + 0x272]
xor edx, edx
mov r8d, 0x3fe
mov word [rsp + 0x270], bp
call fcn.1800f4fb0
lea r9, [rsp + 0x4c]
lea rdx, str._s_s
lea rcx, [rsp + 0x270]
mov r8, rbx
call fcn.18005d960
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180065e80
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbp, qword [rsp + 0xa98]
mov rsi, qword [rsp + 0xaa0]
mov rdi, qword [rsp + 0xaa8]
mov rcx, qword [rsp + 0xa70]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0xa80
pop rbx
repz ret
Function at 0x180065db9
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
test rcx, rcx
je 0x180065fc5
mov r11, rsp
push rbx
sub rsp, 0xa80
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0xa70], rax
mov rbx, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
cmp word [rbx + rcx*2 - 4], 0x5c
je 0x180065e0b
mov rdi, rbx
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, dword [0x180155e50]
mov dword [rdi - 2], eax
lea rdx, [rsp + 0x670]
mov rcx, rbx
sub rdx, rbx
nop dword [rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x180065e20
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x670]
repne scasw ax, word [rdi]
mov rax, qword [0x18015ce00]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x670]
mov qword [rdi - 2], rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180065f9d
mov qword [rsp + 0xa98], rbp
xor ebp, ebp
nop word [rax + rax]
cmp word [rsp + 0x4c], 0x2e
je 0x180065f76
test byte [rsp + 0x20], 0x10
je 0x180065f2f
lea rcx, [rsp + 0x272]
xor edx, edx
mov r8d, 0x3fe
mov word [rsp + 0x270], bp
call fcn.1800f4fb0
lea rcx, [rsp + 0x270]
sub rcx, rbx
mov rdx, rbx
nop word [rax + rax]
movzx eax, word [rdx]
add rdx, 2
mov word [rcx + rdx - 2], ax
test ax, ax
jne 0x180065ed0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x270]
repne scasw ax, word [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x4c]
nop dword [rax]
movzx eax, word [rdx + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x180065f00
lea rcx, [rsp + 0x270]
call fcn.180065db0
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x180065f76
lea rcx, [rsp + 0x272]
xor edx, edx
mov r8d, 0x3fe
mov word [rsp + 0x270], bp
call fcn.1800f4fb0
lea r9, [rsp + 0x4c]
lea rdx, str._s_s
lea rcx, [rsp + 0x270]
mov r8, rbx
call fcn.18005d960
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180065e80
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbp, qword [rsp + 0xa98]
mov rsi, qword [rsp + 0xaa0]
mov rdi, qword [rsp + 0xaa8]
mov rcx, qword [rsp + 0xa70]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0xa80
pop rbx
repz ret
Function at 0x180065fd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
test rcx, rcx
je 0x180066099
lea r8d, [rbx + 3]
lea rdx, [0x18015ce10]
call fcn.1800fdb0c
test eax, eax
je 0x180066099
lea r8d, [rbx + 3]
lea rdx, [0x18015ce08]
mov rcx, rdi
call fcn.1800fdb0c
test eax, eax
je 0x180066099
lea edx, [rbx + 0x2e]
mov rcx, rdi
call fcn.1800fb920
test rax, rax
je 0x180066073
mov ebx, 1
mov rdx, rax
mov rcx, rbp
lea r8d, [rbx + 4]
call fcn.1800fb8d8
mov rcx, rbp
call fcn.1800fcb98
lea rcx, str..EXE.DLL.COM.BAT.CMD.DAT.DRV.SYS.SCR.CPL.PIF.LNK.ACL.DOT.ICO.TMP.IMD.DIC.EXC.LEX.OLS.INI.PIP.SPL.SHD.TLB.PDB.DBG
mov rdx, rbp
call fcn.1800fb870
test rax, rax
je 0x180066095
bt esi, 0x1f
jae 0x180066095
xor ebx, ebx
mov eax, ebx
jmp 0x18006609b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180066095
test al, 0x10
jne 0x180066095
mov ecx, ebx
mov ebx, 1
bt esi, 0x1e
cmovb ecx, ebx
mov ebx, ecx
mov eax, ebx
jmp 0x18006609b
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret