joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801b2ee0
Capabilities:
Get common file path

Disassembly:
push rdi
push r12
push r14
push r15
sub rsp, 0x48
cmp qword [rcx], 0
mov edi, r9d
mov r12d, r8d
mov r15, rdx
mov r14, rcx
jne 0x1801b312f
cmp dword [rcx + 8], 0xffffffff
jne 0x1801b312f
mov qword [rsp + 0x78], rbx
lea rbx, [rcx + 0x140]
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
sub rbx, 2
nop word [rax + rax]
cmp word [rbx + 2], 0
lea rbx, [rbx + 2]
jne 0x1801b2f30
mov eax, dword [0x180374b30]
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x40], r13
mov dword [rbx], eax
cmp edi, 1
jne 0x1801b2f6c
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, edi
je 0x1801b2f83
mov eax, 0x2000000
jmp 0x1801b3102
lea eax, [rdi - 2]
test eax, 0xfffffffc
jne 0x1801b3128
cmp edi, 4
je 0x1801b3128
xor r13d, r13d
xor bpl, bpl
mov qword [rsp + 0x70], r13
cmp edi, 1
je 0x1801b2fdb
cmp edi, 2
jne 0x1801b3033
mov qword [rsp + 0x30], r13
lea r8d, [r13 + 1]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x70], rax
cmp rax, 0xffffffffffffffff
jne 0x1801b3023
mov eax, 0x200
jmp 0x1801b3102
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x70]
mov rcx, rax
mov dword [rsp + 0x28], r13d
mov r8, rbx
mov dword [rsp + 0x20], r13d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x1801b301e
mov eax, 0x100
jmp 0x1801b3102
mov rax, qword [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
sete bpl
mov ecx, 0x30
mov qword [rsp + 0x88], rsi
call fcn.1802994e4
lea ecx, [rdi - 1]
mov rbx, rax
cmp ecx, 1
jbe 0x1801b3086
mov byte [rax], r13b
lea rsi, [rax + 0x28]
mov dword [rax + 0x24], r13d
mov dword [rax + 0x14], r13d
cmp edi, 5
jne 0x1801b3075
mov byte [rax + 1], r13b
mov qword [rax + 0x18], r13
mov dword [rax + 0x20], r13d
mov qword [rsi], r15
jmp 0x1801b30c3
mov byte [rax + 1], 1
mov qword [rax + 0x18], r15
mov dword [rax + 0x20], r12d
mov qword [rsi], r13
jmp 0x1801b30c3
mov byte [rax], 1
lea rsi, [rbx + 0x28]
mov byte [rax + 1], bpl
mov rax, qword [rsp + 0x70]
mov qword [rbx + 8], rax
mov byte [rbx + 0x10], r13b
mov dword [rbx + 0x14], r13d
mov qword [rsi], r13
test bpl, bpl
je 0x1801b30c3
mov rcx, qword [rsp + 0x70]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbx + 0x14], eax
mov rcx, rbx
call fcn.1801b2000
mov qword [r14], rax
test rax, rax
je 0x1801b3120
cmp edi, 5
jne 0x1801b3120
mov rcx, qword [rsi]
test rcx, rcx
je 0x1801b3120
mov r8, qword [rcx]
mov edx, dword [rax + 0x28]
call qword [r8]
test al, al
jne 0x1801b3120
mov rcx, r14
call fcn.1801b3c50
mov eax, 0x5000000
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov r13, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x78]
add rsp, 0x48
pop r15
pop r14
pop r12
pop rdi
ret
mov eax, dword [0x18048a8f8]
jmp 0x1801b30fa
mov eax, 0x10000
jmp 0x1801b3102
mov eax, 0x1000000
add rsp, 0x48
pop r15
pop r14
pop r12
pop rdi
ret
Function at 0x1801b3680
Capabilities:
Create directory

Disassembly:
test rdx, rdx
je 0x1801b37d7
mov r11, rsp
push rbx
push rsi
sub rsp, 0x458
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x440], rax
movzx eax, word [rdx]
mov rbx, rdx
mov rsi, rcx
test ax, ax
je 0x1801b37be
mov qword [r11 + 0x18], rbp
mov r8, rdx
mov qword [r11 - 0x18], rdi
mov rdi, rdx
cmp ax, 0x2f
je 0x1801b36d3
cmp ax, 0x5c
jne 0x1801b36d6
mov rdi, r8
movzx eax, word [r8 + 2]
add r8, 2
test ax, ax
jne 0x1801b36c7
xor ebp, ebp
cmp rdi, rbx
je 0x1801b3729
sub rdi, rbx
lea rcx, [rsp + 0x230]
sar rdi, 1
mov r8, rdi
call fcn.1802ad0a8
add rdi, rdi
cmp rdi, 0x208
jae 0x1801b37d8
lea rdx, [rsp + 0x230]
mov word [rsp + rdi + 0x230], bp
mov rcx, rsi
call fcn.1801b3680
lea rax, [rsp + 0x20]
mov edx, 0x104
sub rsi, rax
lea rcx, [rsp + 0x20]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1801b3762
movzx eax, word [rsi + rcx]
test ax, ax
je 0x1801b3762
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1801b3740
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
lea rcx, [rsp + 0x20]
sub rcx, 2
mov word [rax], bp
nop dword [rax]
cmp word [rcx + 2], bp
lea rcx, [rcx + 2]
jne 0x1801b3780
xor edx, edx
nop dword [rax]
movzx eax, word [rbx + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1801b3790
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rbp, qword [rsp + 0x480]
mov rdi, qword [rsp + 0x450]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x458
pop rsi
pop rbx
ret
call fcn.180299a68
int3

Function at 0x1801b3689
Capabilities:
Create directory

Disassembly:
test rdx, rdx
je 0x1801b37d7
mov r11, rsp
push rbx
push rsi
sub rsp, 0x458
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x440], rax
movzx eax, word [rdx]
mov rbx, rdx
mov rsi, rcx
test ax, ax
je 0x1801b37be
mov qword [r11 + 0x18], rbp
mov r8, rdx
mov qword [r11 - 0x18], rdi
mov rdi, rdx
cmp ax, 0x2f
je 0x1801b36d3
cmp ax, 0x5c
jne 0x1801b36d6
mov rdi, r8
movzx eax, word [r8 + 2]
add r8, 2
test ax, ax
jne 0x1801b36c7
xor ebp, ebp
cmp rdi, rbx
je 0x1801b3729
sub rdi, rbx
lea rcx, [rsp + 0x230]
sar rdi, 1
mov r8, rdi
call fcn.1802ad0a8
add rdi, rdi
cmp rdi, 0x208
jae 0x1801b37d8
lea rdx, [rsp + 0x230]
mov word [rsp + rdi + 0x230], bp
mov rcx, rsi
call fcn.1801b3680
lea rax, [rsp + 0x20]
mov edx, 0x104
sub rsi, rax
lea rcx, [rsp + 0x20]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1801b3762
movzx eax, word [rsi + rcx]
test ax, ax
je 0x1801b3762
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1801b3740
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
lea rcx, [rsp + 0x20]
sub rcx, 2
mov word [rax], bp
nop dword [rax]
cmp word [rcx + 2], bp
lea rcx, [rcx + 2]
jne 0x1801b3780
xor edx, edx
nop dword [rax]
movzx eax, word [rbx + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1801b3790
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rbp, qword [rsp + 0x480]
mov rdi, qword [rsp + 0x450]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x458
pop rsi
pop rbx
ret
call fcn.180299a68
int3
Function at 0x1801c71e0
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x20
mov r10, rcx
test rcx, rcx
je 0x1801c72cd
mov rcx, qword [rcx]
cmp dword [rcx], 1
jne 0x1801c72cd
lea rdx, [rcx - 8]
xor r9d, r9d
and edx, 0xf
mov eax, 0x10
mov r8d, eax
sub rax, rdx
sub r8, rdx
test rdx, rdx
cmove rax, r9
movzx edi, word [rax + rcx + 0x14e]
shr edi, 3
lea eax, [rdi - 3]
cmp eax, 1
ja 0x1801c72cd
test rdx, rdx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
cmove r8, r9
mov qword [rsp + 0x40], rsi
mov esi, dword [r8 + rcx + 0x148]
mov rcx, r10
call fcn.1801b5290
mov rcx, r10
mov ebp, eax
call fcn.1801b5240
mov rcx, r10
mov ebx, eax
call fcn.1801b8c70
mov rdx, rax
test esi, esi
je 0x1801c72b3
mov r10d, esi
nop dword [rax + rax]
lea r8, [rbx + rdx]
mov rcx, rdx
cmp rdx, r8
jae 0x1801c72aa
mov r9d, edi
nop
movzx eax, byte [rcx + 2]
xor byte [rcx], al
movzx eax, byte [rcx]
xor byte [rcx + 2], al
movzx eax, byte [rcx + 2]
xor byte [rcx], al
add rcx, r9
cmp rcx, r8
jb 0x1801c7290
add rdx, rbp
sub r10, 1
jne 0x1801c7280
mov rsi, qword [rsp + 0x40]
mov eax, 1
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1801d9d60
Capabilities:
Create thread
Resume thread

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
jne 0x1801d9d8d
xor al, al
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov qword [rsp + 0x50], 0
add rdi, 0x38
mov qword [rsp + 0x50], rdi
je 0x1801d9db0
mov rcx, qword [rdi]
test rcx, rcx
je 0x1801d9db0
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [rbx + 0x10]
cmp qword [rax + 8], 0
je 0x1801d9e21
mov eax, 1
lock xadd dword [rbx + 8], eax
mov rcx, qword [rbx + 0x10]
add rcx, 0x14
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 4
mov r9, rbx
lea r8, [0x1801d9870]
xor edx, edx
xor ecx, ecx
call fcn.1802b69a4
mov rcx, qword [rbx + 0x10]
mov qword [rcx + 0x18], rax
mov rax, qword [rbx + 0x10]
cmp qword [rax + 0x18], 0
jne 0x1801d9e4d
mov eax, 0xffffffff
lock xadd dword [rbx + 8], eax
sub eax, 1
jne 0x1801d9e18
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbx + 0x10]
call fcn.1801d9a70
xor bl, bl
test rdi, rdi
je 0x1801d9e3f
mov rcx, qword [rdi]
test rcx, rcx
je 0x1801d9e36
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0x50], 0
movzx eax, bl
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov byte [rax + 0x10], 1
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx + 0x40]
test rax, rax
je 0x1801d9e6b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x10]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x1801d9e00
mov bl, 1
jmp 0x1801d9e23
Function at 0x1801da4a0
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rbp, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rax - 0x28], r15d
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 7
mov word [rcx], r15w
mov dword [rax - 0x28], 1
mov rcx, rdx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1801da565
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x1801da565
lea edi, [rax + rax]
lea eax, [rdi + 1]
movsxd rcx, eax
mov eax, 2
mul rcx
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.18029a0ac
mov r14, rax
mov r8d, edi
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, edi
jg 0x1801da55d
movsxd rcx, eax
mov word [r14 + rcx*2], r15w
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x1801da544
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call fcn.180033930
mov rcx, r14
call fcn.180299904
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1801dd720
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov qword [rcx], 0
mov rbx, rcx
mov word [rcx + 8], 0
cmp qword [rdx + 0x10], 0
je 0x1801dd749
cmp qword [rdx + 0x18], 8
jb 0x1801dd74b
mov rdx, qword [rdx]
jmp 0x1801dd74b
xor edx, edx
mov r8, rdx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
test rax, rax
je 0x1801dd77a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov rax, rbx
jne 0x1801dd77d
mov byte [rbx + 9], 1
add rsp, 0x20
pop rbx
ret
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1801dd7d0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor ebp, ebp
test rcx, rcx
je 0x1801dd80e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rbp
mov word [rdi + 8], bp
mov qword [rsp + 0x28], rbp
lea rcx, [rsp + 0x28]
call fcn.1801efba0
nop
mov rbx, qword [rsp + 0x28]
cmp qword [rbx], 0
lea rcx, [rbx + 0x10]
jne 0x1801dd834
mov rcx, rbp
cmp qword [rsi + 0x10], 0
je 0x1801dd847
cmp qword [rsi + 0x18], 8
jb 0x1801dd84a
mov rsi, qword [rsi]
jmp 0x1801dd84a
mov rsi, rbp
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
test rax, rax
je 0x1801dd86e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1801dd86e
mov byte [rdi + 9], 1
cmp qword [rdi], 0
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x1801dd895
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1801dd8a8
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], rbp
mov edx, 0x58
mov rcx, rbx
call fcn.180299904
mov qword [rsp + 0x28], rbp
movzx eax, sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1802994c0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801dd8e0
Capabilities:
Check mutex on windows

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbp
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor r14d, r14d
test rcx, rcx
je 0x1801dd925
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], r14
mov word [rdi + 8], r14w
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x28]
call fcn.1801efc60
nop
mov rbx, qword [rsp + 0x28]
cmp qword [rbx], 0
lea rbp, [rbx + 0x10]
jne 0x1801dd94c
mov rbp, r14
cmp qword [rsi + 0x10], 0
je 0x1801dd962
mov r8, rsi
cmp qword [rsi + 0x18], 8
jb 0x1801dd965
mov r8, qword [rsi]
jmp 0x1801dd965
mov r8, r14
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
test rax, rax
jne 0x1801dd9b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1801dd9b3
lea ecx, [rax + 5]
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [rsi + 0x10], 0
je 0x1801dd99f
cmp qword [rsi + 0x18], 8
jb 0x1801dd9a2
mov rsi, qword [rsi]
jmp 0x1801dd9a2
mov rsi, r14
mov r8, rsi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
mov rax, qword [rdi]
test rax, rax
je 0x1801dd9da
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1801dd9cc
mov byte [rdi + 9], 1
mov rcx, qword [rdi]
call fcn.1801e3590
mov rax, qword [rdi]
test rax, rax
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x1801dd9fd
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1801dda10
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], r14
mov edx, 0x58
mov rcx, rbx
call fcn.180299904
mov qword [rsp + 0x28], r14
movzx eax, sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1802994c0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x1801df750
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
lea rcx, [r11 - 0x48]
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x68
ret
Function at 0x1801df7b0
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor edx, edx
add rcx, 4
mov r8d, 0x118
call fcn.18029c350
mov rcx, rbx
mov dword [rbx], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1801df912
cmp dword [rbx + 4], 6
mov qword [rsp + 0x188], rdi
ja 0x1801df814
jne 0x1801df8b5
cmp dword [rbx + 8], 2
jb 0x1801df8b5
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x1801df8b5
mov edx, 1
mov rcx, rax
lea r8d, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1801df8b5
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1801df8b5
movups xmm0, xmmword [0x180392b70]
mov rcx, rax
movups xmm1, xmmword [0x180392b80]
movups xmmword [rsp + 0x140], xmm0
movups xmmword [rsp + 0x150], xmm1
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x1801df8b5
lea rcx, [rax + 6]
lea rdx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1801df8b5
cmp word [rdi + 2], ax
jbe 0x1801df8b5
movzx edx, word [rdi + 0x32]
movzx eax, word [rdi + 0x30]
movzx ecx, word [rdi + 0x36]
mov dword [rbx + 4], edx
mov dword [rbx + 8], eax
mov dword [rbx + 0xc], ecx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1801df906
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x118
call fcn.18029c350
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call rdi
test eax, eax
jne 0x1801df906
mov eax, dword [rsp + 0x2c]
mov dword [rbx + 0xc], eax
mov rdi, qword [rsp + 0x188]
mov al, 1
jmp 0x1801df914
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x170
pop rbx
ret
Function at 0x1801e1b80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rcx, qword [rcx]
mov rbx, r9
mov edi, r8d
test rcx, rcx
je 0x1801e1bca
test rdx, rdx
je 0x1801e1bca
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x1801e1bca
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1801e1bca
cmp edi, dword [rbx]
jne 0x1801e1bca
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret

Function at 0x1801e1ea0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov ecx, 1
call fcn.1802994e4
mov qword [rbx], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
mov byte [rax], 0
call fcn.18029c350
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x1801e1f07
cmp dword [rsp + 0x24], 6
mov rcx, qword [rbx]
setae dl
mov byte [rcx], dl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x150
pop rbx
ret
Function at 0x1801e4e70
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c
call fcn.18029c350
mov edx, 0x105
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x1801e4eec
xor eax, eax
mov r8, 0xffffffffffffffff
mov word [rsp + 0x22a], ax
lea rax, [rsp + 0x20]
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1801e4ed0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180033930
mov al, 1
jmp 0x1801e4eee
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x240
pop rbx
ret

Function at 0x1801e4f20
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x670
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x688], rbx
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x660], rax
mov rbx, rcx
xor edi, edi
mov qword [rsp + 0x20], rdi
lea rax, [0x18048a8b0]
mov qword [rsp + 0x20], rax
mov rcx, qword [0x18048a8b0]
test rcx, rcx
je 0x1801e4f75
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov r8, qword [0x180482368]
test r8, r8
je 0x1801e4fbf
lea rdx, [0x180482358]
cmp rbx, rdx
je 0x1801e4fa6
cmp qword [reloc.OLEAUT32.dll_VariantInit], 8
cmovae rdx, qword [0x180482358]
mov rcx, rbx
call fcn.180033930
nop
mov rcx, qword [0x18048a8b0]
test rcx, rcx
je 0x1801e4fb8
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
jmp 0x1801e50ad
xor edx, edx
mov r8d, 0x20c
lea rcx, [rsp + 0x30]
call fcn.18029c350
lea rdx, [rsp + 0x30]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x1801e5099
mov word [rsp + 0x23a], di
xor edx, edx
mov r8d, 0x412
lea rcx, [rsp + 0x240]
call fcn.18029c350
mov r8d, 0x208
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea ecx, [rax - 1]
cmp ecx, 0x207
ja 0x1801e5078
mov eax, eax
add rax, rax
cmp rax, 0x412
jae 0x1801e50d3
mov word [rsp + rax + 0x240], di
lea rax, [rsp + 0x240]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1801e5060
lea rdx, [rsp + 0x240]
jmp 0x1801e4f9d
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1801e5084
lea rdx, [rsp + 0x30]
jmp 0x1801e4f9d
mov rcx, qword [0x18048a8b0]
test rcx, rcx
je 0x1801e50ab
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
mov qword [rsp + 0x20], rdi
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1802994c0
mov rbx, qword [rsp + 0x688]
add rsp, 0x670
pop rdi
ret
call fcn.180299a68
nop
int3
Function at 0x1801e52f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor edi, edi
mov rbx, rcx
cmp qword [rcx + 0x18], 8
mov rax, rcx
mov qword [rcx + 0x10], rdi
jb 0x1801e5325
mov rax, qword [rcx]
xor edx, edx
mov word [rax], di
mov r8d, 0x412
lea rcx, [rsp + 0x20]
call fcn.18029c350
lea rdx, [rsp + 0x20]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1801e5352
xor al, al
jmp 0x1801e5389
cmp eax, 0x208
jae 0x1801e534e
mov word [rsp + 0x430], di
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], di
jne 0x1801e5370
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180033930
mov al, 1
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1802994c0
mov rbx, qword [rsp + 0x468]
add rsp, 0x450
pop rdi
ret

Function at 0x1801e7470
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x460
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rdx
mov r14d, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], rdx
xor esi, esi
mov qword [rdx + 0x10], rsi
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x1801e74b4
mov rax, qword [rdx]
mov word [rax], si
call fcn.1801e7590
movzx edi, al
mov byte [rsp + 0x20], al
jmp 0x1801e74d9
test dil, dil
jne 0x1801e7559
cmp r14d, 0x1a
jne 0x1801e7559
mov qword [rbx + 0x10], rsi
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1801e74f5
mov rax, qword [rbx]
mov word [rax], si
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x40]
call fcn.18029c350
mov r8d, 0x207
lea rdx, [rsp + 0x40]
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1801e7530
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180033930
movzx edi, dil
mov eax, 1
cmp qword [rbx + 0x10], 0
cmovne edi, eax
movzx eax, dil
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1802994c0
mov rbx, qword [rsp + 0x490]
add rsp, 0x460
pop r14
pop rdi
pop rsi
ret