joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000b2f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push r12
push r15
sub rsp, 0x178
mov rax, qword [0x180043040]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rsi, qword [rsp + 0x1a0]
xor ebp, ebp
test dword [0x180046490], 0x40000
mov r15, rsi
mov r12, rsi
jne 0x18000b338
mov rax, rsi
jmp 0x18000b546
mov qword [rsp + 0x1b0], rdi
xor al, al
mov qword [rsp + 0x1b8], r13
mov qword [rsp + 0x170], r14
mov r14, rsi
shr r14, 0x10
mov byte [rsp + 0x50], al
test r14w, r14w
jne 0x18000b395
mov ecx, 0xbfff
cmp si, cx
jbe 0x18000b474
mov rax, qword [0x180047c50]
lea rdx, [rsp + 0x50]
movzx ecx, si
mov r8d, 0x104
call rax
test eax, eax
je 0x18000b46f
lea rsi, [rsp + 0x50]
mov r13, 0xffffffffffffffff
lea rdi, [0x1800478a0]
mov r8, r13
inc r8
cmp byte [rdi + r8], bpl
jne 0x18000b3a6
mov rdx, rdi
mov rcx, rsi
call fcn.180025eb8
test eax, eax
je 0x18000b46f
mov rdx, rsi
mov qword [rsp + 0x1a8], rbx
lea rcx, [rsp + 0x40]
call qword [0x180047d98]
mov r8b, 1
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [0x180047d90]
mov rcx, qword [rsp + 0x38]
call fcn.18000bfe0
lea rcx, [rsp + 0x30]
mov ebx, eax
call qword [0x180047d78]
test ebx, ebx
mov rbx, qword [rsp + 0x1a8]
jne 0x18000b46f
mov rcx, r13
inc rcx
cmp byte [rdi + rcx], bpl
jne 0x18000b411
movzx eax, word [rsp + 0x40]
add rcx, rax
add rcx, 1
cmovb rcx, r13
call fcn.180025480
mov rbp, rax
test rax, rax
je 0x18000b46f
sub rax, rdi
nop word [rax + rax]
movzx ecx, byte [rdi]
mov byte [rax + rdi], cl
lea rdi, [rdi + 1]
test cl, cl
jne 0x18000b440
lea rcx, [rbp - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18000b452
xor edx, edx
nop
movzx eax, byte [rsi + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x18000b460
movzx eax, byte [rsp + 0x50]
test dword [0x180046490], 0x80000
mov r13, qword [rsp + 0x1b8]
mov rdi, qword [rsp + 0x1b0]
je 0x18000b534
lea rcx, [0x180046090]
test r14w, r14w
je 0x18000b4ca
mov r8, rsi
test rbp, rbp
je 0x18000b4bb
mov r9, rbp
lea rdx, str.HooksWnd_GetNewClassA____S______S__n
call qword [0x1800477f0]
jmp 0x18000b527
lea rdx, str.HooksWnd_GetNewClassA____s__n
call qword [0x1800477f0]
jmp 0x18000b527
movzx r8d, r12w
test rbp, rbp
je 0x18000b502
test al, al
je 0x18000b4f0
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rbp
lea rdx, str.HooksWnd_GetNewClassA____d___S_______S__n
call qword [0x1800477f0]
jmp 0x18000b527
mov r9, rbp
lea rdx, str.HooksWnd_GetNewClassA____d______S__n
call qword [0x1800477f0]
jmp 0x18000b527
test al, al
je 0x18000b51a
lea r9, [rsp + 0x50]
lea rdx, str.HooksWnd_GetNewClassA____d___S___n
call qword [0x1800477f0]
jmp 0x18000b527
lea rdx, str.HooksWnd_GetNewClassA____d__n
call qword [0x1800477f0]
lea rcx, [0x180046090]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov r14, qword [rsp + 0x170]
test rbp, rbp
cmovne r15, rbp
mov rax, r15
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.18001e5f0
add rsp, 0x178
pop r15
pop r12
pop rsi
pop rbp
ret
Function at 0x18000b570
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
push r15
sub rsp, 0x258
mov rax, qword [0x180043040]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, qword [rsp + 0x280]
xor esi, esi
test dword [0x180046490], 0x40000
movzx eax, si
mov word [rsp + 0x30], ax
mov r14, rdi
mov r15, rdi
jne 0x18000b5c0
mov rax, rdi
jmp 0x18000b7aa
mov qword [rsp + 0x288], rbx
mov qword [rsp + 0x290], rbp
mov rbp, rdi
shr rbp, 0x10
mov qword [rsp + 0x250], r12
test bp, bp
jne 0x18000b616
mov ecx, 0xbfff
cmp di, cx
jbe 0x18000b6d7
mov rax, qword [0x180047c48]
lea rdx, [rsp + 0x30]
movzx ecx, di
mov r8d, 0x208
call rax
test eax, eax
je 0x18000b6d2
lea rdi, [rsp + 0x30]
mov r12, 0xffffffffffffffff
lea rbx, [0x180047800]
mov r8, r12
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], si
jne 0x18000b630
mov rdx, rbx
mov rcx, rdi
call fcn.180025a60
test eax, eax
je 0x18000b6d2
mov rcx, rdi
call fcn.18000bfe0
test eax, eax
jne 0x18000b6d2
mov rax, r12
nop dword [rax]
inc rax
cmp word [rdi + rax*2], si
jne 0x18000b660
mov rcx, r12
nop dword [rax]
inc rcx
cmp word [rbx + rcx*2], si
jne 0x18000b670
inc rax
add rcx, rax
mov eax, 2
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.180025480
mov rsi, rax
test rax, rax
je 0x18000b6d2
sub rax, rbx
nop
movzx ecx, word [rbx]
mov word [rax + rbx], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x18000b6a0
lea rcx, [rsi - 2]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x18000b6b4
xor edx, edx
movzx eax, word [rdi + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x18000b6c1
movzx eax, word [rsp + 0x30]
test dword [0x180046490], 0x80000
mov r12, qword [rsp + 0x250]
mov rbx, qword [rsp + 0x288]
je 0x18000b798
lea rcx, [0x180046090]
test bp, bp
je 0x18000b72c
mov r8, rdi
test rsi, rsi
je 0x18000b71d
mov r9, rsi
lea rdx, str.HooksWnd_GetNewClassW____s______s__n
call qword [0x1800477f0]
jmp 0x18000b78b
lea rdx, str.HooksWnd_GetNewClassW____s__n
call qword [0x1800477f0]
jmp 0x18000b78b
movzx r8d, r15w
test rsi, rsi
je 0x18000b765
test ax, ax
je 0x18000b753
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rsi
lea rdx, str.HooksWnd_GetNewClassW____d___s_______s__n
call qword [0x1800477f0]
jmp 0x18000b78b
mov r9, rsi
lea rdx, str.HooksWnd_GetNewClassW____d______s__n
call qword [0x1800477f0]
jmp 0x18000b78b
test ax, ax
je 0x18000b77e
lea r9, [rsp + 0x30]
lea rdx, str.HooksWnd_GetNewClassW____d___s___n
call qword [0x1800477f0]
jmp 0x18000b78b
lea rdx, str.HooksWnd_GetNewClassW____d__n
call qword [0x1800477f0]
lea rcx, [0x180046090]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rbp, qword [rsp + 0x290]
test rsi, rsi
cmovne r14, rsi
mov rax, r14
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18001e5f0
add rsp, 0x258
pop r15
pop r14
pop rdi
pop rsi
ret
Function at 0x18000caa0
Capabilities:
Print debug messages

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x38
xor ebp, ebp
xor r14d, r14d
lea ecx, [rbp + 0x60]
call fcn.180025480
mov rdi, rax
test rax, rax
je 0x18000cca0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [rsp + 0x70]
mov dword [rdi + 0x30], eax
mov rax, qword [rsp + 0x78]
mov qword [rdi + 0x38], rax
mov rax, qword [rsp + 0x80]
mov qword [rdi + 0x40], rax
mov eax, dword [rsp + 0x88]
mov dword [rdi + 0x48], eax
lea rax, [rdi + 0x50]
mov qword [rax + 8], rax
mov qword [rax], rax
mov ecx, 0x7d4
call fcn.180025480
mov rsi, rax
test rax, rax
jne 0x18000cb59
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, rdi
call fcn.180025488
lea ecx, [rbp + 8]
jmp 0x18000cc9a
xor edx, edx
mov r8d, 0x7d4
mov rcx, rsi
call fcn.18002f4f0
mov ecx, dword [0x180047a54]
test ecx, ecx
je 0x18000cb7a
call fcn.180004860
jmp 0x18000cb81
mov rax, qword [0x180047fa0]
mov rdx, rsi
lea rcx, [0x18000ce60]
call rax
mov r9, rdi
mov r8d, dword [rsi]
lea rdx, str.Hooks_SetWindowsHookExAW__found__d_threads__pSWE__x__n
lea rcx, [0x180046090]
call qword [0x1800477f0]
lea rcx, [0x180046090]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor ebx, ebx
cmp dword [rsi], ebx
jbe 0x18000cbe6
nop word [rax + rax]
mov edx, dword [rsi + rbx*4 + 4]
mov rcx, rdi
call fcn.18000ccc0
test eax, eax
je 0x18000cbd7
mov ebp, 1
jmp 0x18000cbe0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
inc ebx
cmp ebx, dword [rsi]
jb 0x18000cbc0
mov rcx, rsi
call fcn.180025488
test ebp, ebp
je 0x18000cc85
lea rcx, [0x180046040]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x180047740]
mov rbx, qword [rax]
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [0x180047748], rax
je 0x18000ccaf
lea rax, [0x180047740]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov ecx, 0x18
call fcn.18001e9ac
mov qword [rax + 0x10], rdi
inc qword [0x180047748]
mov rdx, qword [rbx + 8]
mov qword [rax], rbx
mov qword [rax + 8], rdx
mov qword [rbx + 8], rax
mov qword [rdx], rax
lea rcx, [0x180046040]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
add rsp, 0x38
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, rdi
call fcn.180025488
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x38
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, str.list_too_long
call fcn.18001e5b4
int3
Function at 0x18000ccc0
Capabilities:
Print debug messages

Disassembly:
mov dword [rsp + 0x10], edx
mov r11, rsp
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x180043040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ebx, dword [r11 + 0x10]
xor edx, edx
mov rsi, rcx
mov r8d, ebx
lea ecx, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18000ce41
lea rax, [rsp + 0x38]
mov qword [rsp + 0x90], rbp
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x48]
mov qword [rsp + 0x98], r14
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsi + 0x50]
lea rdi, [rsi + 0x50]
cmp rcx, rdi
je 0x18000cd7b
mov rax, qword [rsp + 0x30]
mov edx, dword [rsp + 0x34]
nop dword [rax]
cmp dword [rcx + 0x10], ebx
jne 0x18000cd73
cmp dword [rcx + 0x18], edx
jne 0x18000cd73
cmp dword [rcx + 0x14], eax
je 0x18000ce22
mov rcx, qword [rcx]
cmp rcx, rdi
jne 0x18000cd60
cmp dword [rsi + 0x48], 0
mov ecx, dword [0x1800479fc]
jne 0x18000cd8d
mov ecx, dword [0x1800479f8]
call fcn.180004860
mov r8, qword [rsi + 0x40]
mov r9d, ebx
mov rdx, qword [rsi + 0x38]
mov ecx, dword [rsi + 0x30]
call rax
mov rbp, rax
test rax, rax
je 0x18000ce22
mov ecx, 0x28
call fcn.180025480
mov rdx, rax
test rax, rax
jne 0x18000cdd5
lea rcx, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18000ce31
mov dword [rax + 0x10], ebx
lea rcx, [0x180046090]
mov eax, dword [rsp + 0x34]
mov r9d, ebx
mov dword [rdx + 0x18], eax
mov r8, rsi
mov eax, dword [rsp + 0x30]
mov dword [rdx + 0x14], eax
mov rax, qword [rdi]
mov qword [rdx + 0x20], rbp
mov qword [rdx], rax
mov qword [rdx + 8], rdi
mov qword [rax + 8], rdx
mov qword [rdi], rdx
lea rdx, str.Hooks_SetWindowsHookExAW_InsertThread__pSWE__x__threadId__x_n
call qword [0x1800477f0]
lea rcx, [0x180046090]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov rbp, qword [rsp + 0x90]
mov r14, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18001e5f0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x18000e680
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x830
mov rax, qword [0x180043040]
xor rax, rsp
mov qword [rsp + 0x820], rax
xor esi, esi
lea r8, [0x1800465d0]
mov edx, 0x400
lea rcx, [rsp + 0x20]
call fcn.1800260b8
mov edi, esi
nop
mov edx, 0x5c
lea rcx, [rsp + 0x20]
call fcn.180020574
mov rbx, rax
test rax, rax
je 0x18000e737
lea rcx, [rsp + 0x20]
mov edx, 0x400
sub rax, rcx
lea r8, str._setup_setup.ini
sar rax, 1
mov rcx, rbx
sub rdx, rax
call fcn.1800260b8
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x18000e715
inc edi
mov word [rbx], si
cmp edi, 2
jl 0x18000e6c0
jmp 0x18000e737
lea r9, [rsp + 0x20]
xor r8d, r8d
lea rdx, str.ais_shl_web
lea rcx, str.parts.program.groups
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
setne sil
mov eax, esi
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.18001e5f0
lea r11, [rsp + 0x830]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x18000f430
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
test dword [0x180046490], 0x20000
mov rdi, qword [rsp + 0x30]
je 0x18000f487
mov qword [rsp + 0x38], rbx
mov rcx, rdi
mov rbx, qword [0x1800477f0]
call fcn.18000ac60
mov r9d, eax
lea rdx, str.HFunc_CloseServiceHandle__h_x__bValid_d__n
mov r8, rdi
lea rcx, [0x180046090]
call rbx
lea rcx, [0x180046090]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rbx, qword [rsp + 0x38]
mov eax, 0xee070000
cmp rdi, rax
jne 0x18000f4a4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call fcn.18000ac60
test eax, eax
jne 0x18000f4c1
lea ecx, [rax + 6]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call fcn.18000a4b0
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1800104d0
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
mov dword [r11 + 0x18], r8d
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x60
mov rax, qword [0x180043040]
xor rax, rsp
mov qword [rsp + 0x58], rax
test dword [0x180046490], 0x20000
mov rdi, rcx
mov rbx, rdx
mov eax, r8d
je 0x180010537
mov r9, rdx
mov dword [rsp + 0x20], eax
mov r8, rcx
lea rdx, str.HFunc_OpenServiceW__h_x__name_ws__desiredAccess_x__n
lea rcx, [0x180046090]
call qword [0x1800477f0]
lea rcx, [0x180046090]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, 0xee070000
cmp rdi, rax
je 0x18001054b
mov ecx, 6
jmp 0x18001062e
test rbx, rbx
je 0x180010629
cmp word [rbx], 0
je 0x180010629
mov rcx, rbx
call fcn.18000a9c0
mov rcx, rbx
test eax, eax
je 0x1800105ad
call fcn.18000a380
test dword [0x180046490], 0x20000
mov rbx, rax
je 0x1800105a5
mov r8, rax
lea rdx, str.___already_exist__got_h_x_n
lea rcx, [0x180046090]
call qword [0x1800477f0]
lea rcx, [0x180046090]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, rbx
jmp 0x180010636
xor eax, eax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call fcn.180008f00
test eax, eax
jne 0x180010622
cmp dword [rsp + 0x50], eax
je 0x180010622
mov rcx, rbx
call fcn.18000a380
test dword [0x180046490], 0x20000
mov rbx, rax
je 0x1800105a5
mov r8, rax
lea rdx, str.___got_h_x_n
lea rcx, [0x180046090]
call qword [0x1800477f0]
lea rcx, [0x180046090]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, rbx
jmp 0x180010636
mov ecx, 0x424
jmp 0x18001062e
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18001e5f0
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
Function at 0x180012d00
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push rsi
sub rsp, 0x98
mov rax, qword [0x180043040]
xor rax, rsp
mov qword [rsp + 0x80], rax
test dword [0x180046490], 0x20000
mov rsi, rcx
mov rbp, rdx
je 0x180012d68
mov r8, rcx
mov dword [rsp + 0x20], 0x24
lea rcx, [0x180046090]
lea r9, [r11 - 0x50]
lea rdx, str.HFunc_QueryServiceStatusEx__h_x__buf_x__cbSize_x__n
call qword [0x1800477f0]
lea rcx, [0x180046090]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rsi
mov qword [rsp + 0xc0], rbx
call fcn.18000ac60
test eax, eax
jne 0x180012d8c
lea ecx, [rax + 6]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x180012e51
mov rcx, qword [rsi + 8]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
xor ebx, ebx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x20], rbx
call fcn.180008f00
mov ecx, eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test dword [0x180046490], 0x20000
je 0x180012e25
lea rcx, [0x180046090]
test edi, edi
jne 0x180012e04
mov r9d, dword [rsp + 0x5c]
lea rdx, str.___ok__type:__x__state:__x__n
mov r8d, dword [rsp + 0x58]
call qword [0x1800477f0]
jmp 0x180012e18
mov r8, qword [rsi + 8]
lea rdx, str.___failed__name:__ws__err:__d__n
mov r9d, edi
call qword [0x1800477f0]
lea rcx, [0x180046090]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test edi, edi
sete bl
test edi, edi
mov rdi, qword [rsp + 0x90]
jne 0x180012e51
movups xmm0, xmmword [rsp + 0x58]
mov eax, dword [rsp + 0x70]
movsd xmm1, qword [rsp + 0x68]
movups xmmword [rbp], xmm0
movsd qword [rbp + 0x10], xmm1
mov dword [rbp + 0x18], eax
mov eax, ebx
mov rbx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18001e5f0
add rsp, 0x98
pop rsi
pop rbp
ret
Function at 0x18001ced0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov eax, dword [0x180047ed0]
test eax, eax
jne 0x18001d03b
lea rcx, [0x18003d000]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x180048030], rax
test rax, rax
je 0x18001d03b
lea rdx, str.ExtCreatePen
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180048030]
lea rdx, str.CreatePen
mov qword [0x180047f50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180048030]
lea rdx, str.DeleteObject
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180048030]
lea rdx, str.SelectObject
mov qword [0x180047eb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180048030]
lea rdx, str.GetStockObject
mov qword [0x180047f20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180048030]
lea rdx, str.LineTo
mov qword [0x180047e58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180048030]
lea rdx, str.MoveToEx
mov qword [0x180047e98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180048030]
lea rdx, str.BitBlt
mov qword [0x180047ea0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180048030]
lea rdx, str.CreateCompatibleDC
mov qword [0x180047e90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180048030]
lea rdx, str.GetObjectW
mov qword [0x180047f28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180048030]
lea rdx, str.CreateCompatibleBitmap
mov qword [0x180047f30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180048030]
lea rdx, str.CreateDCW
mov qword [0x180047fe0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x180047ed0], 1
add rsp, 0x28
ret
Function at 0x18001d5c0
Capabilities:
Get common file path

Disassembly:
push rdi
mov eax, 0x1030
call fcn.18002f2e0
sub rsp, rax
mov rax, qword [0x180043040]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov r8d, 0x400
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, eax
test eax, eax
je 0x18001d870
mov edx, 0x5c
mov qword [rsp + 0x1040], rbx
lea rcx, [rsp + 0x20]
call fcn.180020574
lea rbx, [rax + 2]
test rax, rax
jne 0x18001d623
lea rbx, [rsp + 0x20]
lea rdx, str.iexplore.exe
mov rcx, rbx
call fcn.180025c38
test eax, eax
jne 0x18001d64c
or dword [0x180047fd8], 8
mov dword [0x180047fc0], 1
jmp 0x18001d868
lea rdx, str.chrome.exe
mov rcx, rbx
call fcn.180025c38
test eax, eax
jne 0x18001d675
or dword [0x180047fd8], 8
mov dword [0x180047fc0], 2
jmp 0x18001d868
lea rdx, str.opera.exe
mov rcx, rbx
call fcn.180025c38
test eax, eax
jne 0x18001d69e
or dword [0x180047fd8], 8
mov dword [0x180047fc0], 3
jmp 0x18001d868
lea rdx, str.firefox.exe
mov rcx, rbx
call fcn.180025c38
test eax, eax
jne 0x18001d6c7
or dword [0x180047fd8], 8
mov dword [0x180047fc0], 4
jmp 0x18001d868
lea rdx, str.seamonkey.exe
mov rcx, rbx
call fcn.180025c38
test eax, eax
jne 0x18001d6f0
or dword [0x180047fd8], 8
mov dword [0x180047fc0], 6
jmp 0x18001d868
lea rdx, str.waterfox.exe
mov rcx, rbx
call fcn.180025c38
test eax, eax
jne 0x18001d719
or dword [0x180047fd8], 8
mov dword [0x180047fc0], 7
jmp 0x18001d868
lea rdx, str.thunderbird.exe
mov rcx, rbx
call fcn.180025c38
test eax, eax
jne 0x18001d742
or dword [0x180047fd8], 8
mov dword [0x180047fc0], 8
jmp 0x18001d868
lea rdx, str.safari.exe
mov rcx, rbx
call fcn.180025c38
test eax, eax
jne 0x18001d76b
or dword [0x180047fd8], 8
mov dword [0x180047fc0], 5
jmp 0x18001d868
lea rdx, str.msedge.exe
mov rcx, rbx
call fcn.180025c38
test eax, eax
jne 0x18001d794
or dword [0x180047fd8], 8
mov dword [0x180047fc0], 9
jmp 0x18001d868
lea rdx, str.Acrobat.exe
mov rcx, rbx
call fcn.180025c38
test eax, eax
jne 0x18001d7b3
or dword [0x180047fd8], 0x10
jmp 0x18001d868
lea rdx, str.wscript.exe
mov rcx, rbx
call fcn.180025c38
test eax, eax
je 0x18001d7ff
lea rdx, str.cscript.exe
mov rcx, rbx
call fcn.180025c38
test eax, eax
je 0x18001d7ff
lea rdx, str.mshta.exe
mov rcx, rbx
call fcn.180025c38
test eax, eax
je 0x18001d7ff
lea rdx, str.scrcons.exe
mov rcx, rbx
call fcn.180025c38
test eax, eax
jne 0x18001d808
or dword [0x180047fd8], 0x20
jmp 0x18001d868
mov edx, 0x400
lea rcx, [rsp + 0x820]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [rax - 1]
cmp ecx, 0x3fe
ja 0x18001d868
cmp eax, edi
jae 0x18001d868
mov r8d, eax
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x820]
mov ebx, eax
call fcn.180025a60
test eax, eax
jne 0x18001d868
lea rcx, [rsp + 0x20]
lea rcx, [rcx + rbx*2]
lea rdx, str.conhost.exe
call fcn.180025c38
test eax, eax
jne 0x18001d868
or dword [0x180047fd8], 0x80
mov rbx, qword [rsp + 0x1040]
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.18001e5f0
add rsp, 0x1030
pop rdi
ret
Function at 0x18001f030
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x228
mov byte [rsp + 0x60], 0x43
mov byte [rsp + 0x61], 0x58
mov byte [rsp + 0x62], 0x34
mov byte [rsp + 0x63], 0x67
mov byte [rsp + 0x64], 0x59
mov byte [rsp + 0x65], 0x3c
mov byte [rsp + 0x66], 0x37
mov byte [rsp + 0x67], 0x42
mov byte [rsp + 0x68], 0x77
mov byte [rsp + 0x69], 0x56
mov byte [rsp + 0x6a], 0x57
mov byte [rsp + 0x6b], 0x64
mov byte [rsp + 0x6c], 0x77
mov byte [rsp + 0x6d], 0x78
mov byte [rsp + 0x6e], 0x57
mov byte [rsp + 0x6f], 0x52
mov byte [rsp + 0x70], 0x79
mov byte [rsp + 0x71], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x7c], 0
mov eax, 0x6b
mov word [rsp + 0xa0], ax
mov eax, 0x65
mov word [rsp + 0xa2], ax
mov eax, 0x72
mov word [rsp + 0xa4], ax
mov eax, 0x6e
mov word [rsp + 0xa6], ax
mov eax, 0x65
mov word [rsp + 0xa8], ax
mov eax, 0x6c
mov word [rsp + 0xaa], ax
mov eax, 0x33
mov word [rsp + 0xac], ax
mov eax, 0x32
mov word [rsp + 0xae], ax
mov eax, 0x2e
mov word [rsp + 0xb0], ax
mov eax, 0x64
mov word [rsp + 0xb2], ax
mov eax, 0x6c
mov word [rsp + 0xb4], ax
mov eax, 0x6c
mov word [rsp + 0xb6], ax
xor eax, eax
mov word [rsp + 0xb8], ax
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0x138], 0
mov qword [rsp + 0x100], 0
mov dword [rsp + 0x1a0], 0x70
mov dword [rsp + 0xc8], 0x3d0918
mov dword [rsp + 0x78], 0
jmp 0x18001f19b