joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180075ac0
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x198]
sub rsp, 0x290
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180146748]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rbx, rdx
mov rdi, rcx
xor esi, esi
mov dword [rsp + 0x20], esi
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.1800bbd80
mov r8d, 0x104
lea rdx, [rsp + 0x70]
lea rcx, [0x180000000]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test rbx, rbx
je 0x180075b51
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
sub rbx, 1
jne 0x180075b40
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], si
jne 0x180075b70
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.18001b240
nop
movdqa xmm0, xmmword [0x1800f68b0]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], si
mov dword [rsp + 0x20], 1
mov rdx, qword [rsp + 0x40]
add rdx, 0x10
lea rcx, [rsp + 0x50]
call fcn.18002e370
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.18001b0c0
mov r8d, 0x10
lea rdx, [0x180105068]
lea rcx, [rsp + 0x50]
call fcn.18001b0c0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x180075c4a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180075c45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180075cf7
call fcn.18008c16c
lea rcx, [rsp + 0x70]
test ebx, ebx
lea rdx, str.ProductInfo.dat
jne 0x180075c61
lea rdx, str.utilsProductInfo.dat
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
lea r8, [rsp + 0x70]
mov rcx, rdi
call fcn.180075d00
movzx ebx, al
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180075cc6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180075cc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180075cf1
call fcn.18008c16c
movzx eax, bl
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.18008c720
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1800beee8
nop
call fcn.1800beee8
nop
int3
Function at 0x180077580
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x1800776b8
test rdx, rdx
je 0x1800776b8
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800776b8
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x1800776b8
xor ebx, ebx
mov dword [rsp + 0x80], ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rax + 5]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x1800776ae
xor eax, eax
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0x88]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800776a5
cmp dword [rsp + 0x8c], ebx
jne 0x1800776a5
mov edx, dword [rsp + 0x88]
xor r8d, r8d
mov rcx, rsi
call fcn.180059a80
nop
mov dword [rsp + 0x70], ebx
xor edx, edx
mov rcx, rsi
call fcn.18006104c
mov rdx, rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x70]
mov r8d, dword [rsp + 0x88]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0x88], eax
jne 0x1800776a5
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x180077e10
Capabilities:
Create thread

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov rax, qword [0x180146748]
xor rax, rsp
mov qword [rbp + 8], rax
mov rbx, r9
mov r13, r8
mov r15, rdx
mov rdi, rcx
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x50], r8
mov qword [rbp], rbx
mov r14d, dword [rbp + 0x80]
xor r12d, r12d
mov dword [rsp + 0x38], r12d
cmp qword [rcx + 0x20128], r12
jne 0x180077e93
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
mov r9, rcx
lea r8, [0x18007a0c0]
xor edx, edx
xor ecx, ecx
call fcn.1800bebdc
mov qword [rdi + 0x20128], rax
mov ecx, 0x28
call fcn.18008c568
mov rsi, rax
mov qword [rbp - 0x48], rax
test rax, rax
je 0x180077ec9
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.180030370
mov r9d, r14d
mov r8, rax
mov rdx, rsi
mov rcx, rdi
call fcn.180078270
mov r12, rax
mov ecx, 0x18
call fcn.18008c568
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180077eea
mov rcx, rax
call fcn.180079220
mov r14, rax
jmp 0x180077eed
xor r14d, r14d
mov rdx, r15
mov rcx, r14
call fcn.18007e410
mov dword [rsp + 0x38], 1
lea rsi, [r13 + 8]
lea rax, [0x180077a80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
xor r14d, r14d
mov qword [rbp - 0x70], r14
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x180077f42
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
call qword [rax]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdi
mov dword [rsp + 0x38], 3
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rbp - 8], r14
lea rcx, [rsp + 0x40]
call fcn.1800784e0
mov qword [rbp - 8], rax
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x180077f88
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp - 0x70], r14
lea rcx, [rdi + 0x200e0]
lea rdx, [rbp - 0x40]
call fcn.18007e6f0
nop
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x180077fb3
mov rax, qword [rcx]
lea rdx, [rbp - 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x180077fcc
mov rax, qword [rcx]
cmp rcx, rsi
setne dl
call qword [rax + 0x20]
mov qword [rsi + 0x38], r14
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x180078002
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180077ffd
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180078034
mov rcx, r8
call fcn.18008c16c
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rax, r15
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.18008c720
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1800beee8
int3
Function at 0x180079950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x180146748]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov rbx, rdx
mov qword [rsp + 0x20], rdx
xor edi, edi
mov dword [rsp + 0x28], 0x4f0053
xor edx, edx
mov word [rsp + 0x4c], di
mov r8d, 0x208
mov dword [rsp + 0x2c], 0x540046
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x30], 0x410057
mov dword [rsp + 0x34], 0x450052
mov dword [rsp + 0x38], 0x43005c
mov dword [rsp + 0x3c], 0x6d006f
mov dword [rsp + 0x40], 0x61004d
mov dword [rsp + 0x44], 0x740073
mov dword [rsp + 0x48], 0x720065
call fcn.1800bbd80
lea r9, [rsp + 0x50]
mov rcx, 0xffffffff80000002
lea r8, str.c_identity
lea rdx, [rsp + 0x28]
call fcn.180092380
mov qword [rbx + 0x10], rdi
lea rax, [rsp + 0x50]
mov qword [rbx + 0x18], 7
mov r8, 0xffffffffffffffff
mov word [rbx], di
nop dword [rax]
inc r8
cmp word [rax + r8*2], di
jne 0x180079a20
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.18001b240
mov rax, rbx
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.18008c720
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18008b890
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [r11 - 0x60], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x180146748]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r14, r9
mov rbx, r8
mov rsi, rdx
mov qword [r11 - 0x58], rdx
mov qword [r11 - 0x50], r9
mov rbp, qword [rsp + 0xc0]
xor r15d, r15d
mov dword [r11 - 0x68], r15d
mov qword [r11 - 0x40], r15
xor eax, eax
mov qword [rdx], rax
call fcn.18000a3f0
mov rcx, rax
test rax, rax
je 0x18008ba60
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [r14]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rdi, [r15 - 1]
test eax, eax
jne 0x18008ba21
mov qword [rsp + 0x60], r15
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18008ba10
mov eax, dword [rsp + 0x64]
test eax, eax
je 0x18008ba21
add eax, 0x10
mov dword [rsp + 0x50], eax
mov ecx, eax
lea rdx, [0x180157090]
call fcn.18008cee4
mov rbx, rax
test rax, rax
je 0x18008ba21
mov r8d, dword [rsp + 0x50]
xor edx, edx
mov rcx, rax
call fcn.1800bbd80
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18008b9d2
mov rcx, rbx
call fcn.18008c16c
jmp 0x18008ba21
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x18008b9d5
test rax, rax
je 0x18008ba08
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x18008b9f0
mov r8d, eax
mov rdx, rbx
mov rcx, rsi
call fcn.18000b310
mov rcx, rbx
call fcn.18008c16c
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18008ba21
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x18008ba3c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rax, rsi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18008c720
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.180009990
int3
Function at 0x18008ba70
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x180146748]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [rsp + 0x90]
mov rbx, 0xffffffffffffffff
mov rax, rbx
mov qword [rsp + 0x30], r8
mov r15, r9
mov r14, r8
mov r10, rdx
nop
cmp word [rdi + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x18008bab0
mov rdx, qword [r14]
lea ebp, [rax*2 + 2]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
test eax, eax
sete sil
test eax, eax
jne 0x18008bb2d
mov rcx, qword [rsp + 0x30]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], ebp
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
xor esi, esi
test eax, eax
sete sil
test rcx, rcx
je 0x18008bb2d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x18008bb48
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18008c720
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x18008e790
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r10d, edx
mov r9, rcx
test rcx, rcx
je 0x18008e8cb
test edx, edx
je 0x18008e8cb
mov qword [rsp], rbx
lea rbx, [0x180107820]
mov eax, 0xffffffff
cmp r10d, 8
jb 0x18008e898
mov r11d, r10d
shr r11, 3
nop dword [rax]
movzx edx, byte [r9]
mov ecx, eax
xor rdx, rcx
shr eax, 8
movzx ecx, dl
add r10d, 0xfffffff8
mov edx, dword [rbx + rcx*4]
movzx ecx, byte [r9 + 1]
xor edx, eax
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 2]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 3]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 4]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 5]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 6]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 7]
add r9, 8
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov eax, dword [rbx + rax*4]
xor eax, edx
sub r11, 1
jne 0x18008e7d0
test r10d, r10d
je 0x18008e8c0
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov ecx, eax
xor rdx, rcx
shr ecx, 8
movzx r8d, dl
mov eax, dword [rbx + r8*4]
xor eax, ecx
add r10d, 0xffffffff
jne 0x18008e8a0
mov rbx, qword [rsp]
not eax
add rsp, 8
ret
xor eax, eax
add rsp, 8
ret
Function at 0x18008ede0
Capabilities:
Check if file exists

Disassembly:
push rsi
push r14
sub rsp, 0x268
mov rax, qword [0x180146748]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov r14, rdx
mov rsi, rcx
test rcx, rcx
je 0x18008efd8
cmp dword [rcx], 2
jne 0x18008efd8
cmp qword [rdx + 0x18], 8
mov qword [rsp + 0x290], rbx
jb 0x18008ee27
mov r14, qword [rdx]
cmp dword [rcx + 0x20], 0
je 0x18008ee3e
xor ebx, ebx
mov eax, ebx
mov rbx, qword [rsp + 0x290]
jmp 0x18008efda
test r14, r14
je 0x18008ee2d
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18008ee5f
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
jne 0x18008ee2d
mov rcx, qword [rsi + 0x38]
xor ebx, ebx
mov qword [rsp + 0x260], rbp
movabs rax, 0xa3d70a3d70a3d70b
mov qword [rsp + 0x258], rdi
mov ebp, 1
mov rdi, qword [rsi + 0x30]
sub rcx, rdi
mov qword [rsp + 0x250], r12
imul rcx
mov r12d, ebx
add rdx, rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x18008efb2
mov qword [rsp + 0x248], r13
lea r13d, [rbp + 0x5b]
mov qword [rsp + 0x240], r15
mov r15d, ebx
nop word [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1800bbd80
lea r8, [rdi + 8]
mov rdx, r14
add r8, r15
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rax, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], bx
jne 0x18008ef03
mov rax, rbx
test rcx, rcx
je 0x18008ef2a
cmp word [rsp + rax*2 + 0x20], 0x2f
jne 0x18008ef22
mov word [rsp + rax*2 + 0x20], r13w
inc rax
cmp rax, rcx
jb 0x18008ef14
mov rax, qword [rsi + 0x30]
mov rcx, qword [rax + r15]
test byte [rcx + 0x26], 0x10
je 0x18008ef47
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
jmp 0x18008ef66
test ebp, ebp
je 0x18008ef64
lea r8, [rsp + 0x20]
mov rdx, r12
mov rcx, rsi
call fcn.18008f000
mov ebp, 1
test eax, eax
jne 0x18008ef66
mov ebp, ebx
mov rdi, qword [rsi + 0x30]
movabs rax, 0xa3d70a3d70a3d70b
mov rcx, qword [rsi + 0x38]
inc r12
sub rcx, rdi
add r15, 0x320
imul rcx
add rdx, rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r12, rdx
jb 0x18008eed0
mov r15, qword [rsp + 0x240]
mov r13, qword [rsp + 0x248]
mov r12, qword [rsp + 0x250]
mov ebx, ebp
mov rdi, qword [rsp + 0x258]
mov eax, ebx
mov rbx, qword [rsp + 0x290]
mov rbp, qword [rsp + 0x260]
jmp 0x18008efda
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18008c720
add rsp, 0x268
pop r14
pop rsi
ret
Function at 0x18008f480
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rdi, rcx
mov ecx, 0xa0
call fcn.18008c568
mov rbx, rax
mov qword [rsp + 0x60], rax
xor esi, esi
test rax, rax
je 0x18008f4d2
xor edx, edx
mov r8d, SHCreateDirectory
mov rcx, rax
call fcn.1800bbd80
mov rcx, rbx
call fcn.18008e4e0
mov rbx, rax
jmp 0x18008f4d5
mov rbx, rsi
cmp qword [rdi + 0x18], 8
jb 0x18008f4df
mov rdi, qword [rdi]
test rdi, rdi
je 0x18008f5b2
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18008f5b2
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x18008f5b2
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbx + 0x24], eax
cmp eax, 0x16
jb 0x18008f5b2
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbx + 0x10], rax
cmp qword [rbx + 8], 0
je 0x18008f5b2
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x18008f5b2
mov r8d, dword [rbx + 0x24]
mov rdx, rax
mov rcx, rbx
call fcn.18008e8e0
test eax, eax
je 0x18008f5b2
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
test rbx, rbx
je 0x18008f5cc
mov rcx, rbx
call fcn.18008e5d0
mov edx, 0xa0
mov rcx, rbx
call fcn.18008c16c
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x180092380
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180146748]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x34], 1
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x34]
mov dword [rsp + 0x30], 0x208
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18008c720
add rsp, 0x48
ret

Function at 0x1800924a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x180146748]
xor rax, rsp
mov qword [rsp + 0x50], rax
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x180092592
nop dword [rax]
lea rax, [rbx - 0x50000000]
cmp rax, 0x30000000
ja 0x1800924f9
mov ebx, 0x4fff0000
jmp 0x180092589
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
lea r8d, [rax + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180092592
cmp dword [rsp + 0x40], 0x10000
jne 0x18009256d
cmp qword [rsp + 0x38], 0x10000
jb 0x18009256d
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x180092594
sub rbx, 0x10000
jmp 0x180092589
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x1800924e0
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18008c720
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1800925b0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x180146748]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x1800925e1
sub rbx, rax
add rbx, 0x10000
mov qword [rsp + 0x78], rsi
cmp rbx, rdi
jae 0x1800926b2
mov esi, 0x80010000
nop dword [rax]
nop dword [rax + rax]
lea rax, [rbx - 0x50000000]
cmp rax, 0x30000000
ja 0x180092617
mov rbx, rsi
jmp 0x1800926a9
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
lea r8d, [rax + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800926b2
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x18009268e
cmp rcx, 0x10000
jb 0x18009268e
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1800926b4
add rbx, 0x10000
jmp 0x1800926a9
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x1800926a9
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x180092600
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18008c720
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret