joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e2d20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4e2d5f
jb 0x4e2d74
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret

Function at 0x4e2de0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4e2e1f
jb 0x4e2e34
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x4e2ea0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4e2f74
jb 0x4e2fd3
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004e2cc0
aeskeygenassist xmm1, xmm0, 1
call fcn.004e2ce0
aeskeygenassist xmm1, xmm2, 2
call fcn.004e2cc0
aeskeygenassist xmm1, xmm0, 2
call fcn.004e2ce0
aeskeygenassist xmm1, xmm2, 4
call fcn.004e2cc0
aeskeygenassist xmm1, xmm0, 4
call fcn.004e2ce0
aeskeygenassist xmm1, xmm2, 8
call fcn.004e2cc0
aeskeygenassist xmm1, xmm0, 8
call fcn.004e2ce0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004e2cc0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004e2ce0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004e2cc0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004e2ce0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004e2cc0
jmp 0x4e3041
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004e2c20
aeskeygenassist xmm1, xmm2, 2
call fcn.004e2c80
aeskeygenassist xmm1, xmm2, 4
call fcn.004e2c20
aeskeygenassist xmm1, xmm2, 8
call fcn.004e2c80
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004e2c20
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004e2c80
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004e2c20
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004e2c80
jmp 0x4e3041
aeskeygenassist xmm1, xmm0, 1
call fcn.004e2be0
aeskeygenassist xmm1, xmm0, 2
call fcn.004e2be0
aeskeygenassist xmm1, xmm0, 4
call fcn.004e2be0
aeskeygenassist xmm1, xmm0, 8
call fcn.004e2be0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004e2be0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004e2be0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004e2be0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004e2be0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004e2be0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004e2be0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4e304e
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x4e33a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e35ab
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x4e34c4
cmp rdx, 0x40
ja 0x4e359d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x4e3434
mov rax, rdx
mov rcx, rsi
call fcn.0046c640
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x4e34a0
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004e3700
xorps xmm15, xmm15
mov r14, qword [0x007d0ec8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x4e3595
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x4e34c7
mov r8, rcx
cmp r8, 0x40
jl 0x4e3545
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.004e3700
xorps xmm15, xmm15
mov r14, qword [0x007d0ec8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x4e3588
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x4e3584
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call fcn.0046c640
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call fcn.0046bd20
mov rax, rdx
mov ecx, 0x40
call fcn.0046bd20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.00469980
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004e33a0
Function at 0x51c4a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51c5ee
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x007371f0]
call fcn.00497b40
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x0051c600]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00403aa0
xorps xmm15, xmm15
mov r14, qword [0x007d0ec8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x51c5b2
mov rdx, qword [rsp + 0x28]
nop dword [rax + rax]
cmp rdx, rcx
jb 0x51c5e8
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x51c5dd
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x38]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call fcn.0046bd20
call fcn.0046bca0
nop
call fcn.00469980
jmp fcn.0051c4a0
Function at 0x554e80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5550b1
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
movsd qword [rsp + 0x70], xmm1
mulsd xmm0, xmm1
movzx ecx, byte [0x007d0c33]
test ecx, ecx
je 0x554eb9
roundsd xmm2, xmm0, 2
jmp 0x554ece
movsd qword [rsp + 0x38], xmm0
nop
call fcn.0047f840
movups xmm2, xmm0
movsd xmm0, qword [rsp + 0x38]
movsd xmm1, qword [0x0060e7d0]
divsd xmm1, xmm0
movsd qword [rsp + 0x20], xmm1
movsd qword [rsp], xmm2
movsd xmm0, qword [0x0060e7d0]
movsd qword [rsp + 8], xmm0
call fcn.0047fd00
xorps xmm15, xmm15
mov r14, qword [0x007d0ec8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
movsd xmm0, qword [rsp + 0x10]
cvttsd2si rax, xmm0
mov rcx, qword [rsp + 0x60]
imul rax, rcx
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x58]
imul rcx, rax
mov qword [rsp + 0x28], rcx
movsd xmm0, qword [rsp + 0x20]
movsd qword [rsp], xmm0
movsd xmm0, qword [0x0060e7d0]
movsd qword [rsp + 8], xmm0
call fcn.0047fda0
xorps xmm15, xmm15
mov r14, qword [0x007d0ec8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
movsd xmm0, qword [rsp + 0x10]
movsd qword [rsp + 0x18], xmm0
lea rax, [0x0058f660]
mov rbx, qword [rsp + 0x28]
mov rcx, rbx
nop dword [rax]
call fcn.0044f060
mov qword [rsp + 0x40], rax
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
lea rax, [0x0058f4a0]
call fcn.0044f060
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x30]
movsd xmm0, qword [rsp + 0x18]
movsd xmm1, qword [rsp + 0x70]
xor edi, edi
jmp 0x554fc8
inc rdi
mov rsi, r9
cmp rbx, rdi
jle 0x555016
xorps xmm2, xmm2
cvtsi2sd xmm2, rdi
movsd xmm3, qword [0x0060e7b0]
addsd xmm2, xmm3
mulsd xmm2, xmm1
subsd xmm2, xmm3
cvttsd2si r10, xmm2
mov r9, rsi
shr rsi, 0x3f
lea r11, [rsi + r9]
sar r11, 1
sub r10, r11
inc r10
mov qword [rax + rdi*8], r10
xorps xmm4, xmm4
cvtsi2sd xmm4, r10
subsd xmm2, xmm4
xor esi, esi
jmp 0x55503a
mov rdi, rax
mov r8, rbx
mov r9, rsi
mov rax, rcx
mov rbx, rdx
mov rcx, rbx
mov rsi, r8
add rsp, 0x48
pop rbp
ret
inc rsi
mov rdi, r10
movups xmm2, xmm5
cmp rsi, r9
jge 0x554fc2
xorps xmm4, xmm4
cvtsi2sd xmm4, rsi
movups xmm5, xmm2
subsd xmm2, xmm4
mulsd xmm2, xmm0
movsd xmm4, qword [0x0060e830]
ucomisd xmm2, xmm4
nop
jb 0x55507f
ucomisd xmm3, xmm2
jbe 0x55507f
mov r10, rdi
imul rdi, r9
lea r11, [rsi + rdi]
cmp rdx, r11
jbe 0x5550a5
mov byte [rcx + r11], 1
jmp 0x555031
mov r10, rdi
imul rdi, r9
lea r11, [rsi + rdi]
cmp rdx, r11
jbe 0x555096
mov byte [rcx + r11], 0
jmp 0x555031
mov rax, r11
mov rcx, rdx
nop dword [rax]
call fcn.0046bc60
mov rax, r11
mov rcx, rdx
call fcn.0046bc60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
movsd qword [rsp + 0x18], xmm0
movsd qword [rsp + 0x20], xmm1
call fcn.00469980
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movsd xmm0, qword [rsp + 0x18]
movsd xmm1, qword [rsp + 0x20]
jmp fcn.00554e80
Function at 0x1406da058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406da1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406da089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406da06f
add dl, dl
jne 0x1406da096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406da0f6
xor eax, eax
add dl, dl
jne 0x1406da0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406da1ad
add dl, dl
jne 0x1406da0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406da0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406da0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406da0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406da0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406da07e
mov eax, 1
add dl, dl
jne 0x1406da106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406da113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406da0fb
sub eax, ebx
mov ebx, 1
jne 0x1406da14c
mov ecx, 1
add dl, dl
jne 0x1406da12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406da13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406da123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406da07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406da168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406da175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406da15d
cmp eax, 0x7d00
jae 0x1406da19b
cmp eax, 0x500
jb 0x1406da196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406da07e
cmp eax, 0x7f
ja 0x1406da19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406da07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406da1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406da07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1800230c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], eax
lea rdx, str.SoftwareMicrosoftNET_Framework_SetupNDP_v2.0.50727
mov dword [rsp + 0x50], eax
mov r9d, 0x20019
lea rax, [rsp + 0x58]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180023142
lea rcx, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x50]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
lea rdx, [0x1800321c0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x58]
test eax, eax
je 0x18002314b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 1
movzx eax, bl
cmp dword [rsp + 0x40], ecx
cmove eax, ecx
add rsp, 0x30
pop rbx
ret

Function at 0x180023b90
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
test edx, edx
je 0x180023bad
mov eax, 1
cmp edx, eax
jne 0x180023bef
mov qword [0x1800734d8], rcx
add rsp, 0x28
ret
cmp qword [0x180073510], 0
je 0x180023bea
cmp qword [0x180073518], 8
lea rcx, [0x180073500]
cmovae rcx, qword [0x180073500]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x1800322cc]
lea rcx, [0x180073500]
call fcn.1800019c0
mov eax, 1
add rsp, 0x28
ret
Function at 0x1800250c0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x490
mov rax, qword [0x18005e030]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov ebp, edx
mov rsi, rcx
lea rdx, [rsp + 0x260]
mov ecx, 0x100
mov r14, r8
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x180025118
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x180025212
movzx eax, ax
or eax, 0x80070000
jmp 0x180025212
cmp eax, 0x100
jbe 0x180025129
mov eax, 0x80020013
jmp 0x180025212
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, [0x180032468]
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1800250fd
mov qword [rsp + 0x488], rbx
lea rcx, [rsp + 0x50]
xor ebx, ebx
mov qword [rsp + 0x480], rdi
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x2100
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov word [rsp + 0x256], bx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800251c2
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbx
mov r8d, ebp
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800251c2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1800251d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x180025202
movzx eax, ax
or eax, 0x80070000
jmp 0x180025202
cmp word [rsp + 0x50], bx
je 0x1800251f0
lea rax, [rsp + 0x50]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1800251e6
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.1800019c0
xor eax, eax
mov rbx, qword [rsp + 0x488]
mov rdi, qword [rsp + 0x480]
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.180012000
add rsp, 0x490
pop r14
pop rsi
pop rbp
ret
Function at 0x180025b70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov r14, rdx
mov r15, rcx
xor ebp, ebp
test r8b, r8b
jne 0x180025c7a
mov rdi, qword [rcx]
test rdi, rdi
jne 0x180025bae
mov ecx, 0x80004003
call fcn.180011d70
int3
mov ecx, 0x18
call fcn.180012024
mov rbx, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x180025bf0
mov qword [rax + 8], rbp
mov dword [rax + 0x10], 1
lea rcx, [0x1800323e0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x180025bf3
mov ecx, 0x8007000e
call fcn.180011d70
int3
mov rbx, rbp
mov qword [rsp + 0x78], rbx
test rbx, rbx
jne 0x180025c08
mov ecx, 0x8007000e
call fcn.180011d70
nop
mov rcx, qword [r14]
test rcx, rcx
je 0x180025c16
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [r14], rbp
mov rax, qword [rdi]
mov r8, r14
mov rdx, qword [rbx]
mov rcx, rdi
call qword [rax + 0x160]
mov edi, eax
or ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x180025c6a
mov rcx, qword [rbx]
test rcx, rcx
je 0x180025c4b
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180025c5d
call fcn.180012068
mov qword [rbx + 8], rbp
mov edx, 0x18
mov rcx, rbx
call fcn.180012068
test edi, edi
js 0x180025c7e
cmp qword [r14], 0
jne 0x180025d90
jmp 0x180025c7e
mov edi, dword [rsp + 0x70]
lea r8, [0x180032400]
lea rdx, [0x180032418]
mov rcx, qword [0x1800734d8]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x180025cbf
mov r9d, edi
mov edx, 0x86
lea ecx, [rdx - 4]
lea r8d, [rax + 0x76]
call fcn.180025240
mov eax, 0x80004005
jmp 0x180025d92
mov rdx, rbx
mov rcx, qword [0x1800734d8]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
mov rdx, rbx
mov rcx, qword [0x1800734d8]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsxd rdi, eax
mov ecx, SafeArrayUnlock
mov r8d, edi
xor edx, edx
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov rbx, rax
mov qword [rsp + 0x28], rax
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnlock]
mov r8, rdi
mov rdx, rsi
mov rcx, qword [rbx + 0x10]
call fcn.1800148d0
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SafeArrayAccessData]
nop
mov rdi, qword [r15]
test rdi, rdi
jne 0x180025d3b
mov ecx, 0x80004003
call fcn.180011d70
int3
mov rcx, qword [r14]
test rcx, rcx
je 0x180025d49
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [r14], rbp
mov rax, qword [rdi]
mov r8, r14
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x168]
test eax, eax
jns 0x180025d87
mov r9d, eax
mov edx, 0x87
lea ecx, [rdx - 5]
lea r8d, [rdx - 0x11]
call fcn.180025240
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
mov eax, 0x80004005
jmp 0x180025d92
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180026bb0
Capabilities:
Load windows common language runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x18005e030]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
lea rcx, [0x1800322a0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
jne 0x180026c03
xor r9d, r9d
lea edx, [rax + 0x72]
lea ecx, [rax + 0x71]
lea r8d, [rax + 0x73]
call fcn.180025240
mov eax, 0x80004005
jmp 0x180026d57
lea rdx, str.CorBindToRuntimeEx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180026c23
xor r9d, r9d
lea edx, [rax + 0x7b]
jmp 0x180026d0a
lea rcx, [0x180032968]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
lea r9, [0x180032988]
lea rcx, [0x1800322d8]
xor r8d, r8d
lea rdx, [0x1800322d0]
call rax
mov ebx, eax
test eax, eax
jns 0x180026cc8
call fcn.1800230c0
test al, al
jne 0x180026c7b
mov edx, 0x7a
mov r9d, ebx
lea r8d, [rdx - 7]
lea ecx, [rdx - 9]
call fcn.180025240
mov ebx, 0x80004005
jmp 0x180026d4c
lea rcx, str.mscorwks
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180026caa
xor r9d, r9d
lea edx, [r9 + 0x78]
lea ecx, [rdx - 7]
lea r8d, [r9 + 0x79]
call fcn.180025240
mov ebx, 0x80004005
jmp 0x180026d4c
mov edx, 0x74
mov r9d, ebx
lea r8d, [rdx + 1]
lea ecx, [rdx - 3]
call fcn.180025240
mov ebx, 0x80004005
jmp 0x180026d4c
lea rdx, str.GetCORVersion
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180026ce5
xor r9d, r9d
lea edx, [rax + 0x7c]
jmp 0x180026d0a
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], 0x104
mov edx, 0x104
lea rcx, [rsp + 0x40]
call rax
test eax, eax
jns 0x180026d20
mov r9d, eax
mov edx, 0x7d
mov r8d, 0x76
lea ecx, [r8 - 5]
call fcn.180025240
mov ebx, 0x80004005
jmp 0x180026d4c
lea rcx, [rsp + 0x40]
call fcn.180022fb0
cmp eax, 2
jge 0x180026d4a
mov edx, 0x81
xor r9d, r9d
lea ecx, [rdx - 0x10]
lea r8d, [rdx - 1]
call fcn.180025240
mov ebx, 0x80004005
jmp 0x180026d4c
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180012000
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret