joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000a490
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x40
xor r10d, r10d
mov rbx, rdx
xor edx, edx
mov rbp, r9
mov r13d, r8d
mov rsi, rcx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x34], r10d
mov dword [rsp + 0x38], r10d
test rcx, rcx
je 0x18000a4e5
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdx, rcx
mov dword [rsp + 0x30], ecx
test rbx, rbx
je 0x18000a503
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r10d, ecx
mov dword [rsp + 0x34], ecx
lea eax, [r10 + rdx]
lea eax, [rax + rax + 0x10]
mov ecx, eax
mov r12d, eax
call fcn.1800a1b44
mov rdi, rax
test rax, rax
je 0x18000a5b1
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1800a1250
lea rcx, [rsp + 0x30]
mov eax, dword [rcx]
mov dword [rdi], eax
mov eax, dword [rcx + 4]
mov dword [rdi + 4], eax
mov eax, dword [rcx + 8]
mov dword [rdi + 8], eax
cmp dword [rsp + 0x30], 0
jbe 0x18000a559
mov r8d, dword [rdi]
lea rcx, [rdi + 0xc]
mov rdx, rsi
call fcn.1800a11c4
cmp dword [rsp + 0x34], 0
jbe 0x18000a573
mov eax, dword [rdi]
mov r8d, dword [rdi + 4]
mov rdx, rbx
lea rcx, [rdi + rax*2 + 0xe]
call fcn.1800a11c4
lea rax, [rsp + 0x60]
mov dword [rdi + 8], r13d
lea r8, [0x18000a460]
mov qword [rsp + 0x28], rax
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rbp, rbp
je 0x18000a5b1
mov ecx, dword [rsp + 0x60]
mov dword [rbp], ecx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x18000b3a0
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0xe70
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xe80], rbx
mov rax, qword [0x1801aef28]
xor rax, rsp
mov qword [rsp + 0xe60], rax
cmp dword [0x1801c1c2c], 0
jne 0x18000b62e
mov dword [0x1801c1c2c], 1
mov byte [rsp + 0x260], 0
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rsp + 0x261]
call fcn.1800a1250
xor edi, edi
mov dword [rsp + 0x30], edi
mov word [rsp + 0x660], di
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0x662]
call fcn.1800a1250
mov word [rsp + 0x50], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x52]
call fcn.1800a1250
call fcn.180010140
mov r8, rax
lea r9, str.OAgent.ini
lea rdx, [0x18013fb48]
lea rcx, [rsp + 0x50]
call fcn.1800a218c
lea r11, [rsp + 0x50]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x660]
lea r8, [0x18013ce7c]
lea rdx, [0x18013f9e0]
lea rcx, str.AgentConfig
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x18000b4c1
cmp word [rsp + 0xe5e], di
jne 0x18000b4c1
mov r8d, 0x400
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x660]
call fcn.1800dcb60
mov r11d, eax
mov dword [rsp + 0x30], eax
jmp 0x18000b4c6
mov r11d, dword [rsp + 0x30]
test r11d, r11d
jne 0x18000b5f0
lea rcx, [rsp + 0x38]
call fcn.18008a120
nop
mov ebx, 0x20019
call fcn.1800dba60
mov ecx, 0x20219
test eax, eax
cmovne ebx, ecx
mov r9d, ebx
lea r8, str.SOFTWAREClassesCLSIDAFFAEF68_CDC5_4aad_9D3F_997C0D55927BProgID
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x38]
call fcn.180089b20
test rax, rax
je 0x18000b558
lea r8, [rsp + 0x30]
lea rdx, [0x18013f9e8]
lea rcx, [rsp + 0x38]
call fcn.1800888f0
mov rbx, rax
test rax, rax
je 0x18000b558
mov eax, dword [rsp + 0x30]
cmp eax, 0x400
jae 0x18000b54c
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x260]
call fcn.1800a1360
jmp 0x18000b550
mov dword [rsp + 0x30], edi
mov rcx, rbx
call fcn.1800a133c
lea rcx, [rsp + 0x38]
call fcn.1800887a0
nop
lea rcx, [rsp + 0x38]
call fcn.180089aa0
mov r11d, dword [rsp + 0x30]
test r11d, r11d
jne 0x18000b5f0
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x660]
call fcn.1800a1250
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x660]
lea r8, [0x18013ce7c]
lea rdx, [0x18013f9e8]
lea rcx, str.ED30_8AC4_11D5_8930_A730
call qword [sym.imp.KERNEL32.dll_GetProfileStringW]
test eax, eax
je 0x18000b5e6
cmp word [rsp + 0xe5e], 0
jne 0x18000b5e6
mov r8d, 0x400
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x660]
call fcn.1800dcb60
mov r11d, eax
jmp 0x18000b5eb
mov r11d, dword [rsp + 0x30]
test r11d, r11d
je 0x18000b62e
cmp r11d, 4
jbe 0x18000b62e
cmp dword [rsp + 0x260], 1
je 0x18000b62e
movzx eax, word [rsp + 0x27c]
lea eax, [rax + rax + 0x22]
test eax, eax
je 0x18000b62e
mov edx, r11d
sub rdx, 4
mov ecx, dword [0x1801c1c28]
cmp rax, rdx
cmovbe ecx, dword [rsp + 0x268]
mov dword [0x1801c1c28], ecx
mov rcx, qword [rsp + 0xe60]
xor rcx, rsp
call fcn.1800a1220
mov rbx, qword [rsp + 0xe80]
add rsp, 0xe70
pop rdi
ret
Function at 0x18000e2d0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp ecx, 0x100
ja 0x18000e368
je 0x18000e362
dec ecx
cmp ecx, 0x7f
ja case.0x18000e306.3
lea rdx, [0x180000000]
movzx eax, byte [rdx + rcx + 0xe4c4]
mov ecx, dword [rdx + rax*4 + 0xe478]
add rcx, rdx
jmp rcx
mov eax, 3
ret
mov eax, 4
ret
mov eax, 8
ret
mov eax, 9
ret
mov eax, SafeArrayCreate
ret
mov eax, SafeArrayCreate
ret
mov eax, reloc.OLEAUT32.dll_SafeArrayCreate
ret
mov eax, send
ret
mov eax, 0x1c
ret
mov eax, 0x20
ret
mov eax, 0x1d
ret
mov eax, 0x1e
ret
mov eax, 0x1f
ret
mov eax, 7
ret
mov eax, 6
ret
mov eax, 2
ret
cmp ecx, 0x400000
ja 0x18000e3fa
je 0x18000e3f4
cmp ecx, 0x8000
ja 0x18000e3be
je 0x18000e3b8
cmp ecx, 0x800
je case.0x18000e306.2
cmp ecx, 0x1000
je case.0x18000e306.1
cmp ecx, 0x2000
je 0x18000e3b2
cmp ecx, 0x4000
jne case.0x18000e306.3
mov eax, reloc.WS2_32.dll_recv
ret
mov eax, reloc.WS2_32.dll_listen
ret
mov eax, 0xa
ret
cmp ecx, 0x10000
je 0x18000e3ee
cmp ecx, 0x40000
je 0x18000e3e8
cmp ecx, 0x80000
je case.0x18000e306.2
cmp ecx, 0x100000
jne case.0x18000e306.3
mov eax, reloc.WS2_32.dll_setsockopt
ret
mov eax, reloc.WS2_32.dll_send
ret
mov eax, reloc.WS2_32.dll_recvfrom
ret
mov eax, reloc.WS2_32.dll_socket
ret
cmp ecx, 0x8000000
ja 0x18000e43c
je 0x18000e436
cmp ecx, 0x800000
je case.0x18000e306.48
cmp ecx, 0x1000000
je case.0x18000e306.1
cmp ecx, 0x2000000
je 0x18000e42a
cmp ecx, 0x4000000
jne case.0x18000e306.3
mov eax, reloc.WS2_32.dll_shutdown
ret
mov eax, reloc.WS2_32.dll_ntohs
ret
mov eax, 0x18
ret
mov eax, 0x19
ret
cmp ecx, 0x10000000
je case.0x18000e306.2
cmp ecx, 0x20000000
je case.0x18000e306.1
cmp ecx, 0x40000000
je 0x18000e465
cmp ecx, 0x80000000
je 0x18000e45f
xor eax, eax
ret
mov eax, 0x1b
ret
mov eax, 0x1a
ret
mov eax, 5
ret
mov eax, 1
ret
Function at 0x18000f0b0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp qword [0x1801c2238], 0
jne 0x18000f209
lea rcx, [0x180140e40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1801c2238], rax
test rax, rax
je 0x18000f209
lea rdx, str._GetPublicName_Contact_Util__YA_AVCTXStringW__K_Z
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801c2238]
lea rdx, str._GetMsgAbstract_Msg_Util__YA_AVCTXStringW__PAUITXMsgPack___Z
mov qword [0x1801c2240], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801c2238]
lea rdx, str._IsMsgOffline_Msg_Util__YAHPAUITXMsgPack___Z
mov qword [0x1801c2248], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801c2238]
lea rdx, str._GetSelfUin_Contact_Util__YAKXZ
mov qword [0x1801c2250], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801c2238]
lea rdx, str._GetMsgTime_Msg_Util__YA_JPAUITXMsgPack___Z
mov qword [0x1801c2258], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801c2238]
lea rdx, str._GetGroupAnonymousName_Group_Util__YA_AVCTXStringW__PAUITXMsgPack___Z
mov qword [0x1801c2260], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801c2238]
lea rdx, str._GetGroupMemShowNameInMsgPack_Group_Util__YA_AVCTXStringW__PAUITXMsgPack___Z
mov qword [0x1801c2268], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801c2238]
lea rdx, str._TransformMsg_Msg_Util__YAXPAUITXMsgPack__PAPAU3_K_Z
mov qword [0x1801c2270], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801c2238]
lea rdx, str._GetDiscussName_Group_Util__YA_AVCTXStringW__K_Z
mov qword [0x1801c2278], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801c2238]
lea rdx, str._GetGroupName_Group_Util__YA_AVCTXStringW__K_Z
mov qword [0x1801c2280], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1801c2288], rax
test rax, rax
jne 0x18000f209
mov rcx, qword [0x1801c2238]
lea rdx, str._GetGroupName_Group_Util__YA_AVCTXStringW__KH_Z
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1801c2288], rax
add rsp, 0x28
ret

Function at 0x18000f2d0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1801c2508], 0
jne 0x18000f307
lea rbx, [0x1801c2300]
mov edx, 0x104
mov dword [0x1801c2508], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x1801c2300]
add rsp, 0x20
pop rbx
ret

Function at 0x18000f840
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1801c3588], 0
jne 0x18000f877
lea rbx, [0x1801c3380]
mov edx, 0x104
mov dword [0x1801c3588], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x1801c3380]
add rsp, 0x20
pop rbx
ret
Function at 0x180010010
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1801c4e48], 0
jne 0x1800100ad
mov dword [0x1801c4e48], 1
call fcn.1800dba60
test eax, eax
je 0x18001008f
lea rbx, [0x1801c4c40]
xor r8d, r8d
mov edx, 0x104
mov rcx, rbx
call fcn.18009bf10
test eax, eax
je 0x1800100a4
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x30], rdi
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
mov rcx, qword [str.SysWow64]
mov rax, rbx
mov qword [rdi - 2], rcx
mov rcx, qword [0x1801411f0]
mov qword [rdi + 6], rcx
mov ecx, dword [0x1801411f8]
mov dword [rdi + 0xe], ecx
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
lea rbx, [0x1801c4c40]
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x1801c4c40]
add rsp, 0x20
pop rbx
ret

Function at 0x180010660
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1801c5ec8], 0
jne 0x1800106fd
mov dword [0x1801c5ec8], 1
call fcn.1800dba60
test eax, eax
je 0x1800106df
lea rbx, [0x1801c5cc0]
xor r8d, r8d
mov edx, 0x104
mov rcx, rbx
call fcn.180095550
test eax, eax
je 0x1800106f4
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x30], rdi
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
mov rcx, qword [str.SysWow64]
mov rax, rbx
mov qword [rdi - 2], rcx
mov rcx, qword [0x1801411f0]
mov qword [rdi + 6], rcx
mov ecx, dword [0x1801411f8]
mov dword [rdi + 0xe], ecx
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
lea rbx, [0x1801c5cc0]
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x1801c5cc0]
add rsp, 0x20
pop rbx
ret
Function at 0x180017d70
Capabilities:
Copy file

Disassembly:
mov dword [rsp + 0x20], r9d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov ebp, r9d
mov r14, r8
mov rdi, rdx
mov r12, rcx
mov eax, dword [rdx + 8]
test eax, eax
je 0x180017fd8
cmp eax, dword [rcx + 8]
jne 0x180017fd8
cmp dword [0x1801df0a0], 0
je 0x180017de0
mov qword [rsp + 0x20], r8
lea r9, str.CopyDifferentFilesToPath_1___s_
lea r8, str.UpLoadFile
or edx, 0xffffffff
lea rcx, [0x1801de7b8]
call fcn.18008da50
mov rax, qword [0x1801617a0]
mov qword [rsp + 0xa8], rax
xor esi, esi
lea r13d, [rsi + 1]
cmp dword [rdi + 8], esi
jle 0x180017fc6
mov rbx, rsi
mov r15d, dword [rsp + 0xc0]
nop dword [rax]
test r13d, r13d
je 0x180017fc6
cmp dword [0x1801df0a0], 0
je 0x180017e5f
movsxd rdx, esi
mov rax, qword [rdi]
mov rcx, qword [r12]
mov rax, qword [rax + rdx*8]
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + rdx*8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
lea r9, str.CopyDifferentFilesToPath_2___d___s___s_
lea r8, str.UpLoadFile
or edx, 0xffffffff
lea rcx, [0x1801de7b8]
call fcn.18008da50
mov rcx, qword [r12]
mov rcx, qword [rbx + rcx]
call fcn.18006b540
cmp eax, 0xffffffff
je 0x180017fc6
test al, 0x10
je 0x180017ea5
mov rcx, qword [r12]
mov rax, qword [rcx + rbx]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r14
lea r8, [rsp + 0x50]
lea rdx, [0x1800178d0]
mov rcx, qword [rcx + rbx]
call fcn.18006d610
jmp 0x180017fb7
test ebp, ebp
je 0x180017fb7
movsxd rbp, esi
mov rax, qword [rdi]
lea rcx, [rax + rbp*8]
mov rdx, r14
call fcn.180083070
test eax, eax
jne 0x180017ede
mov rax, qword [rdi]
xor edx, edx
mov rcx, qword [rbx + rax]
call fcn.180096b60
test eax, eax
je 0x180017ede
test r15d, r15d
je 0x180017fb0
mov rcx, qword [r12]
mov rcx, qword [rbx + rcx]
call fcn.18006ba80
mov r9, rax
mov r8, r14
lea rdx, [0x18013fb48]
lea rcx, [rsp + 0xa8]
call fcn.18007e340
test r15d, r15d
jne 0x180017f38
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0x40]
call fcn.18009da50
nop
mov rdx, rax
lea rcx, [rsp + 0xa8]
call fcn.18007d3b0
nop
lea rcx, [rsp + 0x40]
call fcn.18007d270
mov rax, qword [r12]
xor r8d, r8d
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rbx + rax]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov r13d, eax
test eax, eax
je 0x180017f6c
mov rcx, qword [rdi]
lea rcx, [rcx + rbp*8]
lea rdx, [rsp + 0xa8]
call fcn.18007d3b0
cmp dword [0x1801df0a0], 0
je 0x180017fa7
mov rcx, qword [rdi]
mov rcx, qword [rcx + rbp*8]
mov qword [rsp + 0x20], rcx
lea r9, str.CopyDifferentFilesToPath_3_CopyFileW__s_
lea r8, str.UpLoadFile
or edx, 0xffffffff
lea rcx, [0x1801de7b8]
call fcn.18008da50
mov ebp, dword [rsp + 0xb8]
jmp 0x180017fb7
mov ebp, dword [rsp + 0xb8]
jmp 0x180017fb7
mov ebp, dword [rsp + 0xb8]
inc esi
add rbx, 8
cmp esi, dword [rdi + 8]
jl 0x180017e10
lea rcx, [rsp + 0xa8]
call fcn.18007d270
mov eax, r13d
jmp 0x180017fda
xor eax, eax
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180018450
Capabilities:
Delete file

Disassembly:
push rbp
push rsi
sub rsp, 0x78
mov rsi, rdx
mov rbp, rcx
test rcx, rcx
je 0x1800185e6
test rdx, rdx
je 0x1800185e6
mov qword [rsp + 0x98], rbx
xor ebx, ebx
neg r8d
sbb eax, eax
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 7]
add eax, 4
xor r9d, r9d
mov edx, 0xc0000000
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800185af
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x90]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x900c4
mov rcx, rdi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x90], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1800185af
xor eax, eax
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x44]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x5c]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov rcx, rbp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], ebx
call fcn.18006adf0
test eax, eax
je 0x1800185af
mov edx, dword [rsp + 0x60]
xor eax, eax
lea r8, [rsp + 0xac]
mov dword [rsp + 0xac], eax
mov eax, dword [rsp + 0x5c]
xor r9d, r9d
mov rcx, rdi
mov dword [rsp + 0xa8], edx
mov dword [rsp + 0xac], eax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea r9, [rsp + 0x54]
lea r8, [rsp + 0x4c]
lea rdx, [rsp + 0x44]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov ebx, 1
test rdi, rdi
je 0x1800185d0
cmp rdi, 0xffffffffffffffff
je 0x1800185d0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x1800185d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x98]
add rsp, 0x78
pop rsi
pop rbp
ret
xor eax, eax
add rsp, 0x78
pop rsi
pop rbp
ret
Function at 0x18001aca0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
jne 0x18001acb6
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rcx + 0x50]
call fcn.18001abe0
test eax, eax
je 0x18001acf4
cmp word [0x1801cc140], 0
mov qword [rsp + 0x40], rdi
lea rdi, [0x1801cc140]
jne 0x18001aceb
xor r9d, r9d
mov rdx, rdi
xor ecx, ecx
lea r8d, [r9 + 0x10]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov qword [rbx + 0x50], rdi
mov rdi, qword [rsp + 0x40]
cmp dword [0x1801df0a0], 0
je 0x18001ad2a
mov rax, qword [rbx + 0x50]
lea r9, str.ReplaceInitFolder______08x____s_
lea r8, str.updlfile
mov qword [rsp + 0x28], rax
mov eax, dword [rbx + 0x60]
lea rcx, [0x1801de7b8]
or edx, 0xffffffff
mov dword [rsp + 0x20], eax
call fcn.18008da50
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x18001be20
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x290
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1801aef28]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor ebp, ebp
mov edi, ebp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
test rcx, rcx
je 0x18001c020
mov rax, qword [rcx]
lea r8, [rsp + 0x38]
lea rdx, [0x180160bc8]
call qword [rax]
test eax, eax
js 0x18001bfde
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x18001bfde
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x68]
test eax, eax
js 0x18001bfde
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18001bfde
mov rax, qword [rcx]
lea r8, [rsp + 0x30]
mov edx, 0x80058000
call qword [rax + 0x28]
test eax, eax
js 0x18001bfde
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x18001bff3
cmp dword [0x1801df0a0], ebp
je 0x18001bf0b
mov qword [rsp + 0x20], rcx
lea r9, str.ReplaceInitFolder_1__CurFoldPath:_s_
lea r8, str.updlfile
or edx, 0xffffffff
lea rcx, [0x1801de7b8]
call fcn.18008da50
mov rcx, qword [rsp + 0x30]
call fcn.18001abe0
test eax, eax
je 0x18001bfde
mov word [rsp + 0x70], bp
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x72]
call fcn.1800a1250
xor r9d, r9d
lea r8d, [r9 + 0x10]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rcx, [rsp + 0x48]
call fcn.18007ec60
nop
lea r8, [rsp + 0x70]
mov edx, dword [rsp + 0x50]
lea rcx, [rsp + 0x48]
call fcn.180081840
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea ecx, [r8 + 4]
call fcn.18001af60
mov rsi, rax
cmp dword [0x1801df0a0], 0
je 0x18001bfa0
mov qword [rsp + 0x20], rax
lea r9, str.ReplaceInitFolder_2___p_
lea r8, str.updlfile
or edx, 0xffffffff
lea rcx, [0x1801de7b8]
call fcn.18008da50
test rsi, rsi
jne 0x18001bfb1
lea rcx, [rsp + 0x48]
call fcn.180081610
jmp 0x18001bfde
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x60]
mov ebx, eax
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx + reloc.WS2_32.dll_recv]
mov eax, 1
test ebx, ebx
cmovns edi, eax
lea rcx, [rsp + 0x48]
call fcn.180081610
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x18001bff3
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x30], rbp
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18001c008
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov qword [rsp + 0x40], rbp
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x18001c01c
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov eax, edi
jmp 0x18001c022
mov eax, edi
jmp 0x18001c022
mov eax, edi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1800a1220
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1800338e0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
test rcx, rcx
je 0x180033a41
mov qword [rsp + 0x60], rsi
xor esi, esi
test byte [rcx + 0x18], 2
mov dword [rsp + 0x50], esi
jne 0x18003393d
cmp dword [0x1801df0a0], esi
je 0x180033934
mov qword [rsp + 0x20], r8
lea r9, str.FilterGdipSaveImageToFile_1___s_
lea rcx, [0x1801de7b8]
lea r8, str.gdi
or edx, 0xffffffff
call fcn.18008da50
or dword [rbx + 0x18], 4
jmp 0x180033a0d
cmp dword [0x1801df0a0], esi
je 0x180033967
mov qword [rsp + 0x20], r8
lea r9, str.FilterGdipSaveImageToFile_2___s_
lea rcx, [0x1801de7b8]
lea r8, str.gdi
or edx, 0xffffffff
call fcn.18008da50
cmp dword [rbx + 0x28], esi
jne 0x180033a0d
mov rcx, rdi
call fcn.180033740
test eax, eax
je 0x180033a03
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x30], rsi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbp, rax
call qword [sym.imp.USER32.dll_GetFocus]
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov rcx, rbp
mov rsi, rax
call fcn.18002ac50
test eax, eax
jne 0x1800339c0
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov rcx, rsi
call fcn.18002ac50
mov rax, qword [rsp + 0x30]
mov ecx, dword [0x1801c958c]
mov rdx, rdi
test rax, rax
mov qword [rsp + 0x20], 0xffffffffffffffff
cmovne rbp, rax
xor r9d, r9d
mov r8, rbp
call fcn.180062780
mov rbp, qword [rsp + 0x58]
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x180033a03
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.180018f70
xor edx, edx
mov rcx, rdi
call fcn.180061610
cmp dword [rsp + 0x50], 0
mov rsi, qword [rsp + 0x60]
je 0x180033a41
mov dword [rbx + 0x1c], 1
mov qword [rbx + 0x28], 1
mov eax, dword [0x1801c958c]
cmp eax, 0x24
je 0x180033a38
cmp eax, 0x18
jne 0x180033a41
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x180039010
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov ebx, r8d
movsxd rsi, edx
mov rdi, rcx
test rcx, rcx
jne 0x180039030
xor eax, eax
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
cmp dword [0x1801df0a0], 0
mov qword [rsp + 0x88], rbp
je 0x180039066
lea r9, str.RadarIt__d__d
lea r8, str.imhookapi
lea rcx, [0x1801de7b8]
or edx, 0xffffffff
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], esi
call fcn.18008da50
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x408
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdx, qword [rdi]
lea r8, [rsp + 0x30]
mov rcx, rax
mov r9d, 0x30
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp rax, 0x30
je 0x1800390ae
xor eax, eax
mov rbp, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
mov r9d, 0x40
lea rax, [rsp + 0x80]
mov qword [rsp + 0x90], r12
mov r12, qword [rsp + 0x30]
lea r8d, [r9 - 0x38]
mov rcx, rbp
mov rdx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x18003918e
cmp ebx, 1
jne 0x180039110
lea r8, [0x180038cb0]
mov qword [0x1801cd2c8], r8
mov rax, qword [rdi]
mov rcx, qword [rax + rsi*8]
mov qword [0x1801cd2c0], rcx
mov rax, qword [rdi]
mov qword [rax + rsi*8], r8
jmp 0x180039162
cmp ebx, 2
jne 0x18003913a
lea r8, [0x180038e70]
mov qword [0x1801cd2e0], r8
mov rax, qword [rdi]
mov rcx, qword [rax + rsi*8]
mov qword [0x1801cd2d8], rcx
mov rax, qword [rdi]
mov qword [rax + rsi*8], r8
jmp 0x180039162
cmp ebx, 3
jne 0x180039162
lea rdx, [0x180038dc0]
mov qword [0x1801cd2f0], rdx
mov rax, qword [rdi]
mov rcx, qword [rax + rsi*8]
mov qword [0x1801cd2e8], rcx
mov rax, qword [rdi]
mov qword [rax + rsi*8], rdx
mov r9d, dword [rsp + 0x80]
lea rax, [rsp + 0x98]
mov r8d, 8
mov rdx, r12
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, 1
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret