joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180085680
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rdi, rdx
mov rsi, rcx
mov dword [rax - 0x38], 0
xor edx, edx
lea r8d, [rdx + 0x2c]
lea rcx, [rax - 0x34]
call fcn.1800f4fb0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x50]
cmp ax, 9
je 0x1800856d8
cmp ax, 6
je 0x1800856d8
xor ebx, ebx
jmp 0x1800856dd
mov ebx, 1
lea rcx, [0x180152c40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802611a0], rax
xor ecx, ecx
mov dword [rsp + 0xa0], ecx
test rax, rax
je 0x180085723
lea rdx, [rsp + 0xa0]
mov rcx, rsi
call rax
mov ecx, dword [rsp + 0xa0]
test ebx, ebx
je 0x180085794
test ecx, ecx
jne 0x180085794
lea r8d, [rcx + 1]
lea rdx, str.prthook64.dll
lea rcx, [rsp + 0x28]
call fcn.18001f690
nop
cmp qword [rax + 0x20], 0x10
jb 0x18008574e
mov r8, qword [rax + 8]
jmp 0x180085752
lea r8, [rax + 8]
lea rdx, [0x180153a08]
mov rcx, rdi
call fcn.1800f509c
nop
cmp qword [rsp + 0x48], 0x10
jb 0x180085774
mov rcx, qword [rsp + 0x30]
call fcn.1800f4b9c
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x30], 0
mov eax, dword [rsp + 0xa0]
jmp 0x1800857fd
mov r8d, 1
lea rdx, str.prthook.dll
lea rcx, [rsp + 0x28]
call fcn.18001f690
nop
cmp qword [rax + 0x20], 0x10
jb 0x1800857b9
mov r8, qword [rax + 8]
jmp 0x1800857bd
lea r8, [rax + 8]
lea rdx, [0x180153a08]
mov rcx, rdi
call fcn.1800f509c
nop
cmp qword [rsp + 0x48], 0x10
jb 0x1800857df
mov rcx, qword [rsp + 0x30]
call fcn.1800f4b9c
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x30], 0
mov eax, dword [rsp + 0xa0]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180089500
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x660
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x650], rax
mov rbx, rcx
mov edi, edx
lea rcx, [rsp + 0x28]
xor esi, esi
xor edx, edx
mov r8d, 0x208
mov qword [rsp + 0x20], rsi
call fcn.1800f4fb0
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x410
mov word [rsp + 0x230], si
call fcn.1800f4fb0
mov rdx, rsi
lea rcx, str.XLMAIN
nop dword [rax]
movzx eax, word [rdx + rcx]
add rdx, 2
mov word [rsp + rdx + 0x26], ax
test ax, ax
jne 0x180089570
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r8, [rsp + 0x20]
lea rdx, [0x180064ff0]
mov ecx, eax
call qword [sym.imp.USER32.dll_EnumThreadWindows]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x180089725
lea r8, str.XLDESK
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
test rax, rax
je 0x180089636
lea r8, str.EXCEL7
xor r9d, r9d
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowExW]
test rax, rax
je 0x180089725
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x180089725
mov edx, 0x2e
mov rcx, rbx
call fcn.1800fb920
test rax, rax
jne 0x18008962f
mov rdi, rbx
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str..xls]
mov qword [rdi - 2], rax
movzx eax, word [0x180160778]
mov word [rdi + 6], ax
mov al, 1
jmp 0x180089727
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x230]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, str.Microsoft_Excel__
lea rcx, [rsp + 0x230]
call fcn.1800fb870
lea rcx, [rsp + 0x230]
cmp rcx, rax
jne 0x180089725
lea r8, [0x180160738]
mov edx, 0x45c
xor ecx, ecx
call fcn.1800893c0
lea rdx, str.____
lea rcx, [rsp + 0x254]
call fcn.1800fb870
test rax, rax
je 0x1800896a3
mov word [rax], si
lea rcx, [rsp + 0x254]
mov edx, 0x2e
call fcn.1800fb920
test rax, rax
je 0x1800896d3
lea rdx, str..xls
mov r8d, 4
mov rcx, rax
call fcn.1800fcd4c
test eax, eax
je 0x1800896fa
xor eax, eax
lea rdi, [rsp + 0x254]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str..xls]
mov qword [rdi - 2], rax
movzx eax, word [0x180160778]
mov word [rdi + 6], ax
lea rax, [rsp + 0x254]
lea rcx, [rsp + 0x254]
sub rbx, rax
nop dword [rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rbx + rcx - 2], ax
test ax, ax
jne 0x180089710
mov al, 1
jmp 0x180089727
xor al, al
mov rcx, qword [rsp + 0x650]
xor rcx, rsp
call fcn.1800f4f80
lea r11, [rsp + 0x660]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1800897e0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov edi, edx
lea rcx, [rsp + 0x28]
xor ebp, ebp
xor edx, edx
mov r8d, 0x208
mov qword [rsp + 0x20], rbp
call fcn.1800f4fb0
lea r8, [0x180150c60]
mov edx, 0x45e
xor ecx, ecx
call fcn.1800893c0
mov rdx, rbp
lea rsi, [0x1801607d0]
nop dword [rax]
movzx eax, word [rdx + rsi]
add rdx, 2
mov word [rsp + rdx + 0x26], ax
test ax, ax
jne 0x180089840
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r8, [rsp + 0x20]
lea rdx, [0x180065160]
mov ecx, eax
call qword [sym.imp.USER32.dll_EnumThreadWindows]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x180089948
mov r8d, edi
mov rdx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x180089948
mov rdx, rsi
mov rcx, rbx
call fcn.1800fb870
mov r11, rax
test rax, rax
je 0x180089912
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea rdx, [r11 + rcx*2 - 2]
cmp word [rdx], 0x5b
jne 0x1800898f7
add rdx, 2
mov rcx, rbx
sub rcx, rdx
nop word [rax + rax]
movzx eax, word [rdx]
add rdx, 2
mov word [rcx + rdx - 2], ax
test ax, ax
jne 0x1800898d0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
mov word [rbx + rcx*2 - 4], bp
jmp 0x180089912
mov r8, rbx
sub r8, rdx
nop dword [rax]
movzx eax, word [rdx]
add rdx, 2
mov word [r8 + rdx - 2], ax
test ax, ax
jne 0x180089900
mov edx, 0x2e
mov rcx, rbx
call fcn.1800fb920
test rax, rax
jne 0x180089944
mov rdi, rbx
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str..sep]
mov qword [rdi - 2], rax
movzx eax, word [0x1801607c8]
mov word [rdi + 6], ax
mov al, 1
jmp 0x18008994a
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800f4f80
mov rbx, qword [rsp + 0x270]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret
Function at 0x18008b280
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov edi, edx
lea rcx, [rsp + 0x28]
xor ebp, ebp
xor edx, edx
mov r8d, 0x208
mov qword [rsp + 0x20], rbp
call fcn.1800f4fb0
lea r8, str.___Windows_
mov edx, 0x45a
xor ecx, ecx
call fcn.1800893c0
mov r11, rbp
lea rsi, [0x180160ba8]
nop dword [rax]
movzx eax, word [r11 + rsi]
add r11, 2
mov word [rsp + r11 + 0x26], ax
test ax, ax
jne 0x18008b2e0
lea rdx, [rsp + 0x20]
lea rcx, [0x180065220]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x18008b337
mov r8d, edi
mov rdx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x18008b337
mov rdx, rsi
mov rcx, rbx
call fcn.1800fb870
test rax, rax
je 0x18008b333
mov word [rax], bp
mov al, 1
jmp 0x18008b339
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800f4f80
mov rbx, qword [rsp + 0x270]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret

Function at 0x18008b360
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov edi, edx
lea rcx, [rsp + 0x28]
xor ebp, ebp
xor edx, edx
mov r8d, 0x208
mov qword [rsp + 0x20], rbp
call fcn.1800f4fb0
lea r8, [0x180150c98]
mov edx, 0x45b
xor ecx, ecx
call fcn.1800893c0
mov r11, rbp
lea rsi, str.___Windows
nop dword [rax]
movzx eax, word [r11 + rsi]
add r11, 2
mov word [rsp + r11 + 0x26], ax
test ax, ax
jne 0x18008b3c0
lea rdx, [rsp + 0x20]
lea rcx, [0x180065220]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x18008b417
mov r8d, edi
mov rdx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x18008b417
mov rdx, rsi
mov rcx, rbx
call fcn.1800fb870
test rax, rax
je 0x18008b413
mov word [rax], bp
mov al, 1
jmp 0x18008b419
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800f4f80
mov rbx, qword [rsp + 0x270]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret
Function at 0x18008e4b0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x1a0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp dword [0x1801f6410], 1
jne 0x18008e641
cmp qword [0x1801e1bc8], 0
jne 0x18008e641
xor ebp, ebp
mov dword [rsp + 0x40], ebp
mov byte [rsp + 0x80], bpl
xor edx, edx
mov r8d, 0x103
lea rcx, [r11 - 0x127]
call fcn.1800f4fb0
lea r8d, [rbp + 1]
lea rdx, str.HttpWebList.dat
lea rcx, [rsp + 0x48]
call fcn.18001f690
nop
cmp qword [rax + 0x20], 0x10
jb 0x18008e542
mov rcx, qword [rax + 8]
jmp 0x18008e546
lea rcx, [rax + 8]
lea rdx, [rsp + 0x80]
nop
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x18008e550
cmp qword [rsp + 0x68], 0x10
jb 0x18008e571
mov rcx, qword [rsp + 0x50]
call fcn.1800f4b9c
mov qword [rsp + 0x68], 0xf
mov qword [rsp + 0x60], rbp
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18008e5da
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x80]
lea rcx, [0x1801611a0]
call fcn.18005ce60
xor eax, eax
jmp 0x18008e646
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
lea ebx, [rax + 1]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, ebx
mov ecx, ebx
call fcn.1800f3cdc
mov qword [0x1801e1bc8], rax
test rax, rax
je 0x18008e638
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.1800f4fb0
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rdx, qword [0x1801e1bc8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1800f4f80
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18008e670
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x90
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rsi, rcx
test rcx, rcx
je 0x18008e844
cmp byte [rcx], 0
je 0x18008e844
xor ebp, ebp
mov dword [rax + 8], ebp
xor r8d, r8d
lea rdx, str..Pipe_vrvrf_c64Pipe
lea rcx, [rax - 0x30]
call fcn.180085540
nop
cmp qword [rax + 0x20], 0x10
jb 0x18008e6cb
mov rcx, qword [rax + 8]
jmp 0x18008e6cf
lea rcx, [rax + 8]
mov edx, 0xbb8
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
test eax, eax
sete dil
cmp qword [rsp + 0x88], 0x10
jb 0x18008e6f5
mov rcx, qword [rsp + 0x70]
call fcn.1800f4b9c
mov qword [rsp + 0x88], 0xf
mov qword [rsp + 0x80], rbp
mov byte [rsp + 0x70], 0
test dil, dil
je 0x18008e71a
xor eax, eax
jmp 0x18008e846
xor r8d, r8d
lea rdx, str..Pipe_vrvrf_c64Pipe
lea rcx, [rsp + 0x68]
call fcn.180085540
nop
cmp qword [rax + 0x20], 0x10
jb 0x18008e73c
mov rcx, qword [rax + 8]
jmp 0x18008e740
lea rcx, [rax + 8]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x40000080
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp qword [rsp + 0x88], 0x10
jb 0x18008e77f
mov rcx, qword [rsp + 0x70]
call fcn.1800f4b9c
mov qword [rsp + 0x88], 0xf
mov qword [rsp + 0x80], rbp
mov byte [rsp + 0x70], 0
cmp rbx, 0xffffffffffffffff
jne 0x18008e7a5
xor eax, eax
jmp 0x18008e846
mov qword [rsp + 0x48], rbp
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsp + 0x60], rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa0]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test eax, eax
jne 0x18008e837
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x18008e82c
mov edx, 0x1388
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x18008e82c
lea edi, [rax + 1]
jmp 0x18008e837
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CancelIo]
mov edi, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x18008e846
xor eax, eax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18009c370
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x180
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rsi, rdx
mov r12, rcx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x38], 0
lea rcx, [0x1801dc900]
mov rax, qword [0x1801dc900]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
or rbp, 0xffffffffffffffff
test rsi, rsi
je 0x18009c41a
test rsi, 0xffffffffffff0000
jne 0x18009c408
movzx edi, si
xor edx, edx
mov ecx, edi
call fcn.180001960
test rax, rax
je 0x18009c431
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180003400
mov rbx, qword [rsp + 0x30]
jmp 0x18009c431
xor eax, eax
mov rcx, rbp
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
dec rcx
jmp 0x18009c41c
xor ecx, ecx
mov r8d, ecx
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.180003320
mov rbx, qword [rsp + 0x30]
mov edx, 0x5c
mov rcx, rbx
call fcn.1800f6344
test rax, rax
je 0x18009c4ea
sub eax, ebx
cmp eax, 0xffffffff
je 0x18009c4ea
lea r8d, [rax + 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.18000afd0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x18009c4bf
cmp dword [rbx + 0x10], 0
jl 0x18009c4b0
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x18009c4b0
call fcn.180002880
mov rdi, rax
mov ecx, ebp
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x18009c4a5
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x30], rax
jmp 0x18009c4bf
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.180003320
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18009c4e5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x30]
jmp 0x18009c4ea
mov rbx, qword [rsp + 0x30]
mov byte [rsp + 0x60], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x61]
call fcn.1800f4fb0
lea rdx, [rsp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor eax, eax
mov rcx, rbp
lea rdi, [rsp + 0x60]
repne scasb al, byte [rdi]
not rcx
lea rax, [rcx - 1]
cdqe
cmp byte [rsp + rax + 0x5f], 0x5c
je 0x18009c532
mov byte [rsp + rax + 0x5f], 0x5c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
lea rcx, [0x1801dc900]
mov rdx, qword [0x1801dc900]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [r12], rax
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x20], rbx
mov r9d, edi
lea r8, [rsp + 0x60]
lea rdx, str._s_d__s
mov rcx, r12
call fcn.1800041d0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], ebp
dec ebp
test ebp, ebp
jg 0x18009c595
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, r12
jmp 0x18009c598
mov rax, r12
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1800f4f80
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1800b1560
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x4b0
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov rbp, rcx
mov rsi, r8
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x391]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x390], 0
call fcn.1800f4fb0
lea rcx, [rsp + 0x281]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x280], 0
call fcn.1800f4fb0
lea rcx, [rsp + 0x280]
mov rdx, rsi
sub rcx, rsi
nop word [rax + rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rcx + rdx - 1], al
test al, al
jne 0x1800b15e0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rsi - 2], 0x5c
je 0x1800b161c
lea rdi, [rsp + 0x280]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x180151570]
mov word [rdi - 1], ax
xor ecx, ecx
nop
movzx eax, byte [rsp + rcx + 0x280]
inc rcx
mov byte [rsp + rcx + 0x38f], al
test al, al
jne 0x1800b1620
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x390]
repne scasb al, byte [rdi]
mov eax, dword [0x18015d30c]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x390]
mov dword [rdi - 1], eax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800b17ca
nop
test byte [rsp + 0x30], 0x10
je 0x1800b172e
lea rsi, [rsp + 0x5c]
lea rdi, [0x180151958]
mov ecx, 2
repe cmpsb byte [rsi], byte [rdi]
je 0x1800b17ab
lea rsi, [rsp + 0x5c]
lea rdi, [0x18015d308]
mov ecx, 3
repe cmpsb byte [rsi], byte [rdi]
je 0x1800b17ab
lea rcx, [rsp + 0x171]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x170], 0
call fcn.1800f4fb0
xor edx, edx
nop dword [rax]
movzx eax, byte [rsp + rdx + 0x280]
inc rdx
mov byte [rsp + rdx + 0x16f], al
test al, al
jne 0x1800b16d0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x170]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x5c]
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1800b1700
mov rdx, qword [rsp + 0x20]
lea r8, [rsp + 0x170]
mov rcx, rbp
call fcn.1800b1560
test eax, eax
je 0x1800b17da
jmp 0x1800b17ab
lea rcx, [rsp + 0x171]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x170], 0
call fcn.1800f4fb0
xor edx, edx
nop dword [rax]
movzx eax, byte [rsp + rdx + 0x280]
inc rdx
mov byte [rsp + rdx + 0x16f], al
test al, al
jne 0x1800b1750
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x170]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x5c]
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1800b1780
mov rdx, qword [rsp + 0x20]
lea r8, [rsp + 0x170]
xor r9d, r9d
mov rcx, rbp
call fcn.18009b1e0
test eax, eax
je 0x1800b17d1
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1800b1670
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
jmp 0x1800b17dc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.1800f4f80
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x4b0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800b20b0
Capabilities:
Read .ini file

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x90
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbp, r8
mov r12d, edx
mov rsi, rcx
mov qword [r11 - 0x58], rcx
mov r13, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xe8]
mov qword [r11 - 0x40], rbx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov qword [rcx + 0x20], 0xf
mov qword [rcx + 0x18], r14
mov byte [rcx + 8], r14b
xor r8d, r8d
lea rdx, [0x180152644]
call fcn.180003700
mov dword [rsp + 0x30], 1
lea r8d, [r14 + 1]
lea rdx, str.EdpBigData.ini
lea rcx, [rsp + 0x38]
call fcn.18001f690
nop
cmp qword [rax + 0x20], 0x10
jb 0x1800b2158
mov r9, qword [rax + 8]
jmp 0x1800b215c
lea r9, [rax + 8]
mov r8d, 1
lea rdx, str.CustomName
lea rcx, str.CUSTOMERS
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edi, eax
cmp qword [rsp + 0x58], 0x10
jb 0x1800b218a
mov rcx, qword [rsp + 0x40]
call fcn.1800f4b9c
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], r14
mov byte [rsp + 0x40], 0
cmp edi, 2
jne 0x1800b225f
lea rdx, [0x180259780]
mov rcx, qword [str._WPS.EXE_NOTEPAD.EXE_WINWORD.EXE_EXCEL.EXE_POWERPNT.EXE_]
call fcn.1800f4d08
test rax, rax
je 0x1800b225f
test r12d, r12d
je 0x1800b220f
mov rdx, rbp
lea rcx, [rsp + 0x38]
call fcn.180083610
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call fcn.1800035e0
nop
cmp qword [rsp + 0x58], 0x10
jb 0x1800b21fa
mov rcx, qword [rsp + 0x40]
call fcn.1800f4b9c
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], r14
mov byte [rsp + 0x40], 0
jmp 0x1800b225f
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], r14
mov byte [rsp + 0x40], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.1800035e0
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9, r13
mov r8, rbp
mov rdx, rbp
mov ecx, 4
call fcn.1800a33e0
nop
cmp qword [rbx + 0x20], 0x10
jb 0x1800b226f
mov rcx, qword [rbx + 8]
call fcn.1800f4b9c
mov qword [rbx + 0x20], 0xf
mov qword [rbx + 0x18], r14
mov byte [rbx + 8], 0
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800f4f80
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1800cc1c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0xa58
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0xa40], rax
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x40], 0
call fcn.1800f4fb0
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareKLive
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0x200
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1800cc2d6
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea rdx, str.MonitorPath
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x1800cc27a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0xa40]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0xa58
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r11d, r11d
lea rcx, [rsp + 0x242]
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x240], r11w
call fcn.1800f4fb0
lea rax, [rsp + 0x240]
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rsp + 0x240]
call fcn.1800cbb20
mov rcx, qword [rsp + 0xa40]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0xa58
ret