joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180011220
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x240
mov rax, qword [0x18004a010]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, str.environment
mov rsi, rcx
call fcn.1800209ac
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r15d, r15d
mov rdi, rax
test rax, rax
je 0x18001131d
mov rbx, rax
cmp word [rax], r15w
je 0x180011314
mov edx, 0x3d
mov rcx, rbx
call fcn.180022bc0
xor edx, edx
mov rbp, rax
test rax, rax
je 0x1800112fb
mov rcx, rax
call fcn.180022bc0
mov r9, rbp
lea rcx, [rsp + 0x20]
sub r9, rbx
mov r8, rbx
sar r9, 1
mov edx, 0x104
mov r14, rax
call fcn.180029e1c
lea rdx, str.variable
mov rcx, rsi
call fcn.1800209ac
lea r8, [rsp + 0x20]
mov rcx, rsi
lea rdx, str.name
call fcn.180020c9c
lea r8, [rbp + 2]
mov rcx, rsi
lea rdx, str.value
call fcn.180020c9c
mov rcx, rsi
call fcn.180020a74
jmp 0x180011306
mov rcx, rbx
call fcn.180022bc0
mov r14, rax
lea rbx, [r14 + 2]
cmp word [rbx], r15w
jne 0x18001127e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rcx, rsi
call fcn.180020a74
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180021cb0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x180011cac
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
cmp qword [rcx + 0xb88], 0
mov rbp, r8
mov r15, rdx
mov rdi, rcx
je 0x180011db1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
and dword [rsp + 0x50], 0
lea r8, [rsp + 0x50]
mov edx, eax
mov rcx, rbp
mov r14d, eax
call fcn.18000db10
jmp 0x180011da9
cmp dword [rsp + 0x50], r12d
sete al
cmp qword [rdi + 0x18], 0
je 0x180011d1a
test al, al
jne 0x180011d99
mov r8d, dword [rsp + 0x50]
test al, al
je 0x180011d3f
lea rax, str.Active_Thread
xor r9d, r9d
mov rdx, r15
mov qword [rsp + 0x20], rax
mov rcx, rdi
call fcn.18001195c
jmp 0x180011d99
xor edx, edx
lea ecx, [rdx + 0x4a]
call qword [rdi + 0xb88]
mov rsi, rax
test rax, rax
je 0x180011d99
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, dword [rsp + 0x50]
lea rdx, str.Suspended_Thread
test eax, eax
lea rcx, str.Running_Thread
mov r9, rsi
cmovne rcx, rdx
mov rdx, r15
mov qword [rsp + 0x20], rcx
mov rcx, rdi
call fcn.18001195c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0x50]
mov edx, r14d
mov rcx, rbp
call fcn.18000dbc8
test eax, eax
jne 0x180011d07
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x180011dcc
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
cmp qword [rcx + 0xb88], 0
mov rbp, r8
mov r15, rdx
mov rdi, rcx
je 0x180011ed1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
and dword [rsp + 0x50], 0
lea r8, [rsp + 0x50]
mov edx, eax
mov rcx, rbp
mov r14d, eax
call fcn.18000db10
jmp 0x180011ec9
cmp dword [rsp + 0x50], r12d
sete al
cmp qword [rdi + 0x18], 0
je 0x180011e3a
test al, al
jne 0x180011eb9
mov r8d, dword [rsp + 0x50]
test al, al
je 0x180011e5f
lea rax, str.active
xor r9d, r9d
mov rdx, r15
mov qword [rsp + 0x20], rax
mov rcx, rdi
call fcn.180011a98
jmp 0x180011eb9
xor edx, edx
lea ecx, [rdx + 0x4a]
call qword [rdi + 0xb88]
mov rsi, rax
test rax, rax
je 0x180011eb9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, dword [rsp + 0x50]
lea rdx, str.suspended
test eax, eax
lea rcx, str.running
mov r9, rsi
cmovne rcx, rdx
mov rdx, r15
mov qword [rsp + 0x20], rcx
mov rcx, rdi
call fcn.180011a98
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0x50]
mov edx, r14d
mov rcx, rbp
call fcn.18000dbc8
test eax, eax
jne 0x180011e27
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret

Function at 0x180011eec
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov dword [rax + 0x18], r8d
push rsi
push rdi
push r14
sub rsp, 0x50
mov r14, rdx
xor ebx, ebx
mov word [rdx], bx
mov rbp, rcx
lea rdx, [rax + 0x18]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test eax, eax
je 0x180011fb8
mov ecx, esi
call fcn.180021c94
mov rdi, rax
test rax, rax
je 0x180011fb8
mov edx, dword [rsp + 0x80]
mov r9, rax
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x180011fac
lea r9, [rsp + 0x88]
mov rcx, rdi
lea r8, [rsp + 0x40]
lea rdx, [0x180042528]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x180011fac
mov r8, qword [rsp + 0x40]
movzx ecx, word [r8 + 0xe]
movzx edx, word [r8 + 8]
movzx eax, word [r8 + 0xc]
movzx r9d, word [r8 + 0xa]
lea r8, str._lu._lu._lu._lu
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov rcx, r14
mov dword [rsp + 0x20], edx
lea edx, [rbx + 0x40]
call fcn.180003f3c
mov ebx, 1
mov rcx, rdi
call fcn.180021cd4
mov eax, ebx
jmp 0x180011fba
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x180011fd0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x18004a010]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov r12, rcx
mov edi, 0x100
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.180021a70
mov ebx, 2
lea rdx, [rsp + 0x50]
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x180012143
mov edx, edi
lea rcx, [rbp + 0xf0]
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x18001213d
lea rcx, [rbp + 0xf0]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rsi, rax
test rax, rax
je 0x18001213d
cmp word [rax + 0x10], bx
jne 0x18001213d
mov rcx, qword [rax + 0x18]
xor r14d, r14d
mov rax, qword [rcx]
jmp 0x180012134
movsx r8, word [rsi + 0x12]
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.180025930
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r15, rax
test r14d, r14d
je 0x1800120b1
mov r8, rbx
lea rdx, [0x180041ec4]
lea rcx, [rsp + 0x38]
call fcn.180021bf0
test r15, r15
je 0x180012129
cmp byte [r15], 0
je 0x180012129
and dword [rsp + 0x28], 0
or r9d, 0xffffffff
and qword [rsp + 0x20], 0
mov r8, r15
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov r8b, 1
mov rdi, rbx
lea rcx, [rsp + 0x38]
add rdi, qword [rsp + 0x40]
mov rdx, rdi
call fcn.180021ae8
mov rdx, qword [rsp + 0x40]
or r9d, 0xffffffff
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x28], ebx
lea r8, [rcx + rdx*2]
xor edx, edx
mov qword [rsp + 0x20], r8
xor ecx, ecx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rdi - 1]
mov ebx, 2
mov qword [rsp + 0x40], rax
mov rax, qword [rsi + 0x18]
inc r14d
mov rax, qword [rax + r14*8]
test rax, rax
jne 0x180012079
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rbx, qword [rsp + 0x38]
lea rdx, [0x180041418]
test rbx, rbx
mov rcx, r12
cmovne rdx, rbx
call fcn.18001cc98
mov rcx, rbx
call fcn.180021cd4
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.180021cb0
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x180012194
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x330
mov rax, qword [0x18004a010]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov rdi, rcx
lea rdx, [rsp + 0x40]
mov esi, 2
mov ecx, esi
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1800122a4
mov edx, 0x100
lea rcx, [rsp + 0x220]
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x18001229e
lea rcx, [rsp + 0x220]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rbx, rax
test rax, rax
je 0x18001229e
cmp word [rax + 0x10], si
jne 0x18001229e
lea rdx, [0x180042550]
mov rcx, rdi
call fcn.1800209ac
mov rcx, qword [rbx + 0x18]
xor esi, esi
mov rax, qword [rcx]
jmp 0x180012291
movsx r8, word [rbx + 0x12]
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.180025930
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rcx, [rsp + 0x1e0]
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], rcx
or r9d, 0xffffffff
xor ecx, ecx
mov r8, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [rsp + 0x1e0]
mov rcx, rdi
lea rdx, [0x180042558]
call fcn.180020c9c
mov rax, qword [rbx + 0x18]
inc esi
mov rax, qword [rax + rsi*8]
test rax, rax
jne 0x18001222e
mov rcx, rdi
call fcn.180020a74
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.180021cb0
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18001325c
Capabilities:
Get memory capacity

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov rax, qword [0x18004a010]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor eax, eax
mov dword [rsp + 0x20], 0x40
mov rbx, rdx
mov word [rbp - 0x49], ax
xor edx, edx
mov word [rbp - 0x39], ax
lea rcx, [rsp + 0x24]
mov word [rbp - 0x19], ax
lea r8d, [rax + 0x3c]
mov word [rbp + 7], ax
mov word [rbp + 0x27], ax
call fcn.180023140
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [rsp + 0x24]
lea rdx, [rbp - 0x49]
mov esi, 0xa
mov r9d, esi
lea r8d, [rsi - 2]
call fcn.1800261dc
mov rcx, qword [rsp + 0x28]
lea edi, [rsi + 6]
mov r8d, edi
lea rdx, [rbp - 0x39]
mov r9d, esi
call fcn.1800261b4
mov rcx, qword [rbp - 0x79]
lea rdx, [rbp - 0x19]
mov r9d, esi
mov r8d, edi
call fcn.1800261b4
mov rcx, qword [rbp - 0x71]
lea rdx, [rbp + 7]
mov r9d, esi
mov r8d, edi
call fcn.1800261b4
mov rcx, qword [rbp - 0x69]
lea rdx, [rbp + 0x27]
mov r9d, esi
mov r8d, edi
call fcn.1800261b4
lea rdx, str.memory
mov rcx, rbx
call fcn.1800209ac
lea r8, [rbp - 0x49]
mov rcx, rbx
lea rdx, str.load
call fcn.180020c9c
lea r8, [rbp - 0x39]
mov rcx, rbx
lea rdx, str.totalphys
call fcn.180020c9c
lea r8, [rbp - 0x19]
mov rcx, rbx
lea rdx, str.availphys
call fcn.180020c9c
lea r8, [rbp + 7]
mov rcx, rbx
lea rdx, str.totalpage
call fcn.180020c9c
lea r8, [rbp + 0x27]
mov rcx, rbx
lea rdx, str.availpage
call fcn.180020c9c
mov rcx, rbx
call fcn.180020a74
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180021cb0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180013828
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
cmp qword [rcx + 0xb80], 0
mov rsi, rdx
mov rbx, rcx
je 0x180013919
and qword [rax - 0x28], 0
xor r9d, r9d
mov dword [rax - 0x30], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rax - 0x38], 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180013919
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp qword [rbx + 0x18], 0
mov r14d, eax
je 0x1800138d5
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
and qword [rsp + 0x30], 0
mov rcx, qword [rbx + 0x18]
and qword [rsp + 0x28], 0
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x44], rcx
mov dword [rsp + 0x4c], 1
jmp 0x1800138e7
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov r9d, dword [0x180174134]
mov r8, rdi
mov edx, r14d
mov rcx, rbp
call qword [rbx + 0xb80]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x180013915
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, ebx
jmp 0x18001391b
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x180015990
Capabilities:
Get token privileges

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ebx, ebx
test eax, eax
je 0x180015a74
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x48], ebx
lea edx, [rbx + 3]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x180015a69
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x180015a69
mov ecx, dword [rsp + 0x48]
call fcn.180021c94
mov rdi, rax
test rax, rax
je 0x180015a69
mov r9d, dword [rsp + 0x48]
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
lea edx, [rbx + 3]
mov r8, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x180015a61
mov ecx, ebx
cmp dword [rdi], ebx
jbe 0x180015a44
mov eax, ecx
inc ecx
inc rax
lea rax, [rax + rax*2]
or dword [rdi + rax*4], 2
cmp ecx, dword [rdi]
jb 0x180015a31
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, rdi
call fcn.180021cd4
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov cl, 1
call fcn.180015740
cmp qword [0x180176998], rbx
jne 0x180015aab
mov ecx, 0x750
call fcn.180021c64
test rax, rax
je 0x180015aa4
mov rcx, rax
call fcn.18000d30c
mov qword [0x180176998], rax
jmp 0x180015aab
mov qword [0x180176998], rbx
mov rcx, qword [0x180176bb8]
test rcx, rcx
jne 0x180015add
mov ecx, 0xb90
call fcn.180021c64
test rax, rax
je 0x180015ad4
mov rdx, rsi
mov rcx, rax
call fcn.18000ee98
mov rbx, rax
mov qword [0x180176bb8], rbx
jmp 0x180015ae5
mov rdx, rsi
call fcn.18000edc8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180015e8c
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x18004a010]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rax, qword [rcx]
cmp dword [rax], 0xc00000fd
je 0x180015eed
mov r8d, edx
mov rdx, rcx
lea rcx, [rbp - 0x29]
call fcn.18000ecf0
lea rcx, [rbp - 0x29]
call fcn.180015cec
lea rcx, [rbp - 1]
mov ebx, eax
call fcn.180013fe4
mov rcx, qword [rbp - 0x21]
test ebx, ebx
jne 0x180015f0c
test rcx, rcx
je 0x180015eed
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180021cb0
mov rbx, qword [rsp + 0x100]
add rsp, 0xf0
pop rbp
ret
test rcx, rcx
je 0x180015f17
mov rax, qword [rcx]
call qword [rax + 0x10]
test dword [0x180176dc8], 0x200
je 0x180015fa1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor edx, edx
lea rcx, [rbp - 0x25]
mov rbx, rax
lea r8d, [rdx + 0x64]
call fcn.180023140
xor eax, eax
mov dword [rbp - 0x29], 0x68
mov qword [rbp - 0x49], rax
xor r9d, r9d
mov qword [rbp - 0x41], rax
xor r8d, r8d
mov qword [rbp - 0x39], rax
mov rdx, rbx
lea rax, [rbp - 0x49]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x180015fa1
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x180176fd8]
sub ecx, 1
je 0x180015eed
cmp ecx, 1
je 0x180015fcc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x180015eed
mov eax, 1
jmp 0x180015eef

Function at 0x18001611c
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x458
mov rax, qword [0x18004a010]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov r9d, 1
lea rdx, [rsp + 0x230]
xor ecx, ecx
lea r8d, [r9 + 0x19]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x180016196
mov r8d, 1
lea rcx, [rsp + 0x20]
call fcn.18001be50
test rax, rax
je 0x180016196
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x230]
lea rcx, [0x180177a30]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rdx, str.reports
lea rcx, [0x180177a30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180021cb0
add rsp, 0x458
ret
Function at 0x1800164cc
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov edx, 1
jmp fcn.180015e8c

Function at 0x1800164d8
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
mov edx, 2
jmp fcn.180015e8c

Function at 0x1800170cc
Capabilities:
Get common file path

Disassembly:
xor eax, eax
test rcx, rcx
je 0x1800170ec
cmp word [rcx], ax
je 0x1800170ec
mov r8, rcx
mov edx, 0x104
lea rcx, [0x180177a30]
jmp fcn.180029998
jmp fcn.18001611c
Function at 0x1800176b0
Capabilities:
Get file version info
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x18004a010]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov r8d, 0x104
lea rdx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r14d, r14d
test eax, eax
je 0x180017881
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x50]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test eax, eax
je 0x180017881
mov ecx, ebx
call fcn.180021c94
mov rdi, rax
test rax, rax
je 0x180017881
mov edx, dword [rsp + 0x30]
lea rcx, [rbp + 0x50]
mov r9, rax
mov r8d, ebx
mov esi, r14d
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x180017875
lea r9, [rsp + 0x34]
mov rcx, rdi
lea r8, [rsp + 0x48]
lea rdx, str.VarFileInfoTranslation
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x180017875
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov r8d, dword [rsp + 0x34]
or r10, 0xffffffffffffffff
mov r9, qword [rsp + 0x48]
mov rbx, r10
shr r8, 2
mov rdx, r10
mov ecx, r14d
test r8, r8
je 0x1800177c2
cmp word [r9 + rcx*4], ax
jne 0x180017798
mov rbx, rcx
jmp 0x1800177a1
cmp word [r9 + rcx*4], r14w
cmove rdx, rcx
inc rcx
cmp rcx, r8
jb 0x18001778c
cmp rbx, r10
jne 0x1800177ce
cmp rdx, r10
je 0x1800177b8
mov rbx, rdx
jmp 0x1800177c5
test r8, r8
je 0x1800177c2
mov rbx, r14
jmp 0x1800177ce
mov rbx, r10
cmp rbx, r10
je 0x180017875
movzx eax, word [r9 + rbx*4 + 2]
lea r8, str.StringFileInfo_04x_04xProductName
movzx r9d, word [r9 + rbx*4]
lea rcx, [rsp + 0x50]
mov edx, 0x80
mov dword [rsp + 0x20], eax
call fcn.180003f3c
lea r9, [rsp + 0x38]
mov rcx, rdi
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x180017875
mov rcx, qword [rsp + 0x40]
mov esi, 1
call sym.mi.dll_BT_SetAppName
mov rcx, qword [rsp + 0x48]
lea r8, str.StringFileInfo_04x_04xProductVersion
lea edx, [rsi + 0x7f]
movzx eax, word [rcx + rbx*4 + 2]
movzx r9d, word [rcx + rbx*4]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], eax
call fcn.180003f3c
lea r9, [rsp + 0x38]
mov rcx, rdi
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x18001786d
mov rcx, qword [rsp + 0x40]
call sym.mi.dll_BT_SetAppVersion
jmp 0x180017875
mov word [0x180176dd0], r14w
mov rcx, rdi
call fcn.180021cd4
mov eax, esi
jmp 0x180017883
xor eax, eax
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.180021cb0
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x1800179f4
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov r8d, edx
mov rdx, rcx
xor r9d, r9d
mov rdi, rcx
call fcn.180018fcc
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
call fcn.180018c64
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800188fc
Function at 0x180017b08
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov r8d, dword [rcx + 0xa18]
mov rbx, rcx
test r8d, r8d
je 0x180017b46
and qword [rsp + 0x20], 0
lea rdx, [rcx + 0x218]
mov rcx, qword [rcx + 0x210]
lea r9, [rsp + 0x40]
add r8d, r8d
call qword [sym.imp.KERNEL32.dll_WriteFile]
and dword [rbx + 0xa18], 0
add rsp, 0x30
pop rbx
ret

Function at 0x180017cb8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov eax, dword [rcx + 0xa2c]
lea r14, [rcx + 0xa28]
xor esi, esi
mov dword [r14], eax
mov rax, qword [rcx + 0xa20]
lea r15, [rcx + 0xc38]
mov r13, rdx
mov dword [r15], 0x104
mov rdi, rcx
lea rbp, [rcx + 0xa30]
mov r12d, esi
xor edx, edx
jmp 0x180017e7e
cmp eax, 0xea
jne 0x180017d81
mov ebx, dword [r14]
add ebx, 0x3ff
and ebx, 0xfffffc00
mov ecx, ebx
call fcn.180025dd4
mov rsi, rax
test rax, rax
je 0x180017e5f
mov rcx, qword [rdi + 0xa20]
call fcn.1800297a0
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rsi
mov r9, r15
mov qword [rdi + 0xa20], rsi
mov r8, rbp
xor esi, esi
mov qword [rsp + 0x28], rax
mov edx, r12d
mov qword [rsp + 0x20], rsi
mov rcx, r13
mov dword [rdi + 0xa2c], ebx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x180017e61
mov rcx, rdi
cmp word [rbp], si
je 0x180017dc0
lea rdx, [0x1800435a4]
call fcn.180017b4c
mov rdx, rbp
mov rcx, rdi
mov ebx, eax
call fcn.180017b4c
lea rdx, [0x1800435a8]
mov rcx, rdi
add ebx, eax
call fcn.180017b4c
add ebx, eax
jmp 0x180017dce
lea rdx, [0x1800435b0]
call fcn.180017b4c
mov ebx, eax
mov edx, dword [rsp + 0x70]
mov eax, edx
sub eax, 1
je 0x180017e21
sub eax, 1
je 0x180017e14
sub eax, 1
je 0x180017e12
sub eax, 1
jne 0x180017e14
mov rax, qword [rdi + 0xa20]
lea rbx, [rdi + 0xc3c]
lea r8, str.dword:_08x
mov edx, 0x80
mov rcx, rbx
mov r9d, dword [rax]
call fcn.180003f3c
mov rdx, rbx
jmp 0x180017e46
xor edx, edx
mov r8d, ebx
mov rcx, rdi
call fcn.180017bc8
jmp 0x180017e4e
lea rdx, [0x1800435a4]
mov rcx, rdi
call fcn.180017b4c
mov rdx, qword [rdi + 0xa20]
mov rcx, rdi
call fcn.180017b4c
lea rdx, [0x1800435a4]
mov rcx, rdi
call fcn.180017b4c
lea rdx, [0x180041994]
mov rcx, rdi
call fcn.180017b4c
jmp 0x180017e61
xor esi, esi
mov dword [r15], 0x104
inc r12d
mov eax, dword [rdi + 0xa2c]
mov edx, r12d
mov dword [r14], eax
mov rax, qword [rdi + 0xa20]
mov qword [rsp + 0x38], r14
mov r9, r15
mov qword [rsp + 0x30], rax
mov r8, rbp
lea rax, [rsp + 0x70]
mov rcx, r13
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x180017d12
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret