joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001a090
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x1d8]
sub rsp, 0x2c0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x180075010]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rdi, rcx
xor ebx, ebx
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x70]
call fcn.18002ddc0
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x28], bx
or r14, 0xffffffffffffffff
cmp word [rdi], bx
jne 0x18001a0ff
mov r8d, ebx
jmp 0x18001a10c
mov r8, r14
inc r8
cmp word [rdi + r8*2], bx
jne 0x18001a102
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.18000a8d0
nop
lea rcx, [rsp + 0x28]
call fcn.18001c160
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18001a26a
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x18001a260
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
cmp word [rbp - 0x64], 0
jne 0x18001a177
mov r8, rbx
jmp 0x18001a18b
lea rax, [rbp - 0x64]
mov r8, r14
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x18001a180
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x48]
call fcn.18000a8d0
nop
lea rcx, [rsp + 0x48]
call fcn.18001c160
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x48]
mov rdi, qword [rsp + 0x48]
mov r9, qword [rsp + 0x60]
cmp r9, 8
cmovae rdx, rdi
mov r10, qword [rsp + 0x38]
mov r8, r10
mov r11, qword [rsp + 0x58]
cmp r11, r10
cmovb r8, r11
test r8, r8
jmp 0x18001a20a
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x18001a1fb
add rdx, 2
add rcx, 2
sub r8, 1
jmp 0x18001a20a
mov r8d, 1
cmp word [rdx], ax
cmovb r8d, r14d
jmp 0x18001a20f
jne 0x18001a1e5
mov r8d, ebx
test r8d, r8d
jne 0x18001a21b
cmp r11, r10
jb 0x18001a21b
jbe 0x18001a244
cmp r9, 8
jb 0x18001a232
lea r8, [r9 + 1]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.18000aa20
lea rdx, [rsp + 0x70]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
jmp 0x18001a150
mov ebx, 1
cmp r9, 8
jb 0x18001a260
lea r8, [r9 + 1]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.18000aa20
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x18001a287
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.18000aa20
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.18002bf10
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x18001a2b0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
call fcn.180019e10
test eax, eax
jg 0x18001a2c9
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x30], rdi
mov r8d, eax
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x18001a2ef
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x30]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x18001a320
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rdi, rdx
mov dword [rsp + 0x20], 0x70
xor edx, edx
mov esi, r8d
mov rbx, rcx
mov ebp, r9d
lea rcx, [rsp + 0x24]
lea r8d, [rdx + 0x6c]
call fcn.18002ddc0
mov eax, 0x200
mov qword [rsp + 0x38], rbx
mov ecx, 0x240
mov dword [rsp + 0x50], 1
test esi, esi
mov qword [rsp + 0x40], rdi
cmovne eax, ecx
mov dword [rsp + 0x24], eax
call fcn.18000ec20
test eax, eax
lea rcx, str.runas
cmovne rcx, qword [rsp + 0x30]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x18001a3b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x18001a3cb
test esi, esi
je 0x18001a3c6
mov rcx, qword [rsp + 0x88]
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18001a940
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x1f8]
sub rsp, 0x2e0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x180075010]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
xor ebx, ebx
mov edi, ebx
mov dword [rsp + 0x20], ebx
test rcx, rcx
jne 0x18001a98b
xor eax, eax
jmp 0x18001ab92
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
cmp word [rcx], bx
jne 0x18001a9a8
mov r8, rbx
jmp 0x18001a9ba
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rcx + r8*2], bx
jne 0x18001a9b0
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.18000a8d0
nop
lea rcx, [rsp + 0x50]
call fcn.18001c160
xor edx, edx
mov r8d, 0x238
lea rcx, [rbp - 0x70]
call fcn.18002ddc0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x18001ab73
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x18001ab69
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
cmp word [rbp - 0x44], 0
jne 0x18001aa34
mov r8, rbx
jmp 0x18001aa4b
lea rax, [rbp - 0x44]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001aa40
lea rdx, [rbp - 0x44]
lea rcx, [rsp + 0x30]
call fcn.18000a8d0
nop
lea rcx, [rsp + 0x30]
call fcn.18001c160
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
mov r9, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x40]
call fcn.180014700
test eax, eax
je 0x18001aae3
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.18001c850
or edi, 1
lea r9, [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x18001aab9
mov rax, qword [rax]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov r9, qword [r9]
mov r8, rax
mov rdx, qword [rsp + 0x60]
call fcn.180014700
test eax, eax
je 0x18001aae3
xor sil, sil
jmp 0x18001aae6
mov sil, 1
test dil, 1
je 0x18001ab0b
and edi, 0xfffffffe
mov r8, qword [rbp - 0x78]
cmp r8, 8
jb 0x18001ab0b
inc r8
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.18000aa20
test sil, sil
jne 0x18001ab3e
mov r8, qword [rsp + 0x48]
cmp r8, 8
jb 0x18001ab2d
inc r8
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.18000aa20
lea rdx, [rbp - 0x70]
mov rcx, r14
call sub.KERNEL32.dll_Process32NextW
jmp 0x18001aa0d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp - 0x68]
mov r8, qword [rsp + 0x48]
cmp r8, 8
jb 0x18001ab73
inc r8
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.18000aa20
jmp 0x18001ab73
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rsp + 0x68]
cmp r8, 8
jb 0x18001ab90
inc r8
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.18000aa20
mov eax, ebx
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.18002bf10
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x18001b620
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x70
xor ebp, ebp
lea rax, [r11 - 0x28]
mov rsi, r9
mov qword [r11 - 0x28], rbp
mov rdi, r8
mov qword [r11 - 0x20], rbp
mov rbx, rcx
mov qword [r11 - 0x18], rbp
mov r9d, 0xf013f
mov qword [r11 - 0x10], rbp
xor r8d, r8d
mov qword [r11 - 0x58], rax
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18001b780
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov r9d, 0xf013f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftWare
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18001b775
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rbp
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov rdx, rbx
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18001b76a
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rbp
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov rdx, rdi
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18001b75f
mov rcx, qword [rsp + 0xa0]
or rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 2], bp
lea rax, [rax + 1]
jne 0x18001b722
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rsi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18001b7a0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x70
xor r14d, r14d
lea rax, [r11 - 0x18]
mov rbx, r9
mov qword [r11 - 0x18], r14
mov rbp, r8
mov qword [r11 - 0x20], r14
mov rsi, rdx
mov qword [r11 - 0x28], r14
mov rdi, rcx
mov qword [r11 - 0x58], rax
mov r9d, 0xf013f
lea rdx, str.SoftWare
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18001b8e4
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov rdx, rdi
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18001b8d9
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov rdx, rsi
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x18001b889
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
jmp 0x18001b8de
or rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rbx + rax*2 + 2], r14w
lea rax, [rax + 1]
jne 0x18001b890
lea ecx, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], ecx
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
mov rdx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x18001e990
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x180075010]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
mov rax, qword [0x180076120]
test rax, rax
jne 0x18001e9e4
mov ecx, 0x1a8
call fcn.18002be24
mov qword [rsp + 0x38], rax
test rax, rax
je 0x18001e9da
mov rcx, rax
call fcn.18001ddb0
jmp 0x18001e9dd
mov rax, rbx
mov qword [0x180076120], rax
mov rcx, rax
call fcn.18001dee0
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
cmp word [rax], 0
jne 0x18001ea0a
mov r8, rbx
jmp 0x18001ea1b
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x18001ea10
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.18000a8d0
nop
mov r8d, 0xb
lea rdx, str.TGDmhlp.exe
lea rcx, [rsp + 0x40]
call fcn.18000fca0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18001ea84
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ff2aa7
call fcn.18001a3f0
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x18001eaa1
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.18000aa20
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18002bf10
add rsp, 0x70
pop rbx
ret
Function at 0x18001eac0
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x198]
sub rsp, 0x290
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x180075010]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rdi, rdx
xor ebx, ebx
mov rax, qword [0x180076120]
test rax, rax
jne 0x18001eb2d
mov ecx, 0x1a8
call fcn.18002be24
mov qword [rsp + 0x28], rax
test rax, rax
je 0x18001eb23
mov rcx, rax
call fcn.18001ddb0
jmp 0x18001eb26
mov rax, rbx
mov qword [0x180076120], rax
mov rcx, rax
call fcn.18001dee0
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
cmp word [rax], 0
jne 0x18001eb53
mov r8, rbx
jmp 0x18001eb6b
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001eb60
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.18000a8d0
nop
mov r8d, 0xc
lea rdx, str.GDVCDbus.exe
lea rcx, [rsp + 0x50]
call fcn.18000fca0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18001ed06
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.18002ddc0
lea r8, str.1b6545
lea rdx, [0x18004a710]
lea rcx, [rsp + 0x70]
call fcn.180010140
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
xor r8d, r8d
lea rdx, [0x180049cd0]
lea rcx, [rsp + 0x30]
call fcn.18000a8d0
nop
mov r8d, 1
lea rdx, [0x18004a718]
lea rcx, [rsp + 0x30]
call fcn.18000a8d0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.18000fb70
mov r8d, 2
lea rdx, [0x18004a71c]
lea rcx, [rsp + 0x30]
call fcn.18000fca0
cmp word [rsp + 0x70], 0
jne 0x18001ec52
mov r8, rbx
jmp 0x18001ec6b
lea rax, [rsp + 0x70]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001ec60
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.18000fca0
mov r8d, 2
lea rdx, [0x18004dba8]
lea rcx, [rsp + 0x30]
call fcn.18000fca0
cmp word [rdi], 0
je 0x18001ecaa
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x18001eca0
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.18000fca0
mov r8d, 1
lea rdx, [0x18004a718]
lea rcx, [rsp + 0x30]
call fcn.18000fca0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call fcn.18001a680
nop
mov r8, qword [rsp + 0x48]
cmp r8, 8
jb 0x18001ed06
inc r8
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.18000aa20
nop
mov r8, qword [rsp + 0x68]
cmp r8, 8
jb 0x18001ed23
inc r8
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.18000aa20
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.18002bf10
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18001ed60
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x180075010]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
mov rax, qword [0x180076120]
test rax, rax
jne 0x18001edb4
mov ecx, 0x1a8
call fcn.18002be24
mov qword [rsp + 0x38], rax
test rax, rax
je 0x18001edaa
mov rcx, rax
call fcn.18001ddb0
jmp 0x18001edad
mov rax, rbx
mov qword [0x180076120], rax
mov rcx, rax
call fcn.18001dee0
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
cmp word [rax], 0
jne 0x18001edda
mov r8, rbx
jmp 0x18001edeb
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x18001ede0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.18000a8d0
nop
mov r8d, 0xb
lea rdx, str.TGDmhlp.exe
lea rcx, [rsp + 0x40]
call fcn.18000fca0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18001ee54
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.2c3504
call fcn.18001a3f0
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x18001ee71
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.18000aa20
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18002bf10
add rsp, 0x70
pop rbx
ret
Function at 0x180023570
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x40
mov rax, r8
mov rbx, rdx
mov rdx, rax
mov rcx, rbx
mov r8, r9
mov ebp, 0x8007000e
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x1800237b2
mov rdx, rax
mov qword [rsp + 0x60], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test eax, eax
je 0x1800237ad
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x1800237ad
mov edx, esi
mov qword [rsp + 0x70], r14
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
test rax, rax
je 0x1800237a8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x18002379f
mov r8d, esi
mov qword [rsp + 0x68], r12
mov rdx, rdi
mov rcx, rax
call fcn.18002d8a0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor r12d, r12d
lea r8, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x30], r12
mov rcx, r14
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x18002379a
mov rcx, qword [rsp + 0x30]
xor edx, edx
call fcn.180020870
mov rsi, rax
test rax, rax
je 0x18002378f
mov eax, dword [rax + 0x10]
mov qword [rsp + 0x78], r15
mov dword [rsi + 0x10], r12d
test eax, eax
jne 0x18002377c
cmp byte [rsp + 0x90], r12b
je 0x180023733
lea ecx, [rax + 0x18]
call sub.gdiplus.dll_GdipAlloc
mov edi, dword [rsp + 0x88]
mov rbx, rax
mov r15d, dword [rsp + 0x80]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1800236c2
mov rcx, rsi
call fcn.180020ac0
mov r9d, eax
mov r8d, edi
mov edx, r15d
mov rcx, rbx
call fcn.18001fa80
mov rcx, rax
jmp 0x1800236c5
mov rcx, r12
mov rax, qword [rsp + 0x98]
mov qword [rax], rcx
test rcx, rcx
je 0x18002377c
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], r12
call sub.gdiplus.dll_GdipGetImageGraphicsContext
mov rbx, qword [rsp + 0x38]
mov edx, 4
mov rcx, rbx
call sub.gdiplus.dll_GdipSetSmoothingMode
mov edx, 7
mov rcx, rbx
call sub.gdiplus.dll_GdipSetInterpolationMode
mov rdx, qword [rsi + 8]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov rcx, rbx
mov dword [rsp + 0x20], r15d
call sub.gdiplus.dll_GdipDrawImageRectI
mov rcx, rbx
mov ebp, r12d
call sub.gdiplus.dll_GdipDeleteGraphics
jmp 0x18002377c
mov rcx, rsi
call fcn.180020ac0
mov rcx, rsi
mov edi, eax
call fcn.180020a90
mov rcx, rsi
mov ebx, eax
call fcn.180020cb0
mov r9d, eax
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
mov rcx, rsi
call fcn.180020750
mov rcx, rax
mov rax, qword [rsp + 0x98]
test rcx, rcx
cmovne ebp, r12d
mov qword [rax], rcx
mov r8, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [r8]
mov r15, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov r12, qword [rsp + 0x68]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r14, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x60]
mov eax, ebp
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
Function at 0x180027090
Capabilities:
Check if file exists
Copy file
Read .ini file

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x180077048]
test rax, rax
jne 0x1800270cd
mov ecx, 0x178
call fcn.18002be24
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1800270c6
mov rcx, rax
call fcn.1800275a0
nop
mov qword [0x180077048], rax
mov rcx, rax
add rsp, 0x38
jmp fcn.180029ae0
Function at 0x18002a120
Capabilities:
Read .ini file

Disassembly:
push rbx
push r14
sub rsp, 0x468
mov rax, qword [0x180075010]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov r14, rcx
xor edx, edx
lea rcx, [rsp + 0x240]
mov r8d, 0x208
call fcn.18002ddc0
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.18002ddc0
mov rax, qword [r14 + 0x48]
mov rax, qword [rax]
mov rbx, qword [rax]
cmp rbx, rax
je 0x18002a35b
mov qword [rsp + 0x488], rbp
mov qword [rsp + 0x490], rsi
mov qword [rsp + 0x460], r15
lea r15, str.nothing
mov qword [rsp + 0x498], rdi
mov rbp, qword [rbx + 0x28]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbp + rax*2 + 0x18], 0
jne 0x18002a1b0
test eax, eax
jle 0x18002a2e3
lea r8, [rbp + 0x18]
lea rdx, str.Is_s
lea rcx, [rsp + 0x240]
call fcn.180010140
lea rdi, [r14 + 0xf8]
cmp qword [rdi + 0x18], 8
jb 0x18002a1ee
mov rax, qword [rdi]
jmp 0x18002a1f1
mov rax, rdi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea r8, [0x18004f558]
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x240]
lea rcx, str.HotKey
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx eax, word [rsp + 0x30]
cmp ax, word [0x18004f558]
jne 0x18002a249
movzx eax, word [rsp + 0x32]
cmp ax, word [0x18004f55a]
jne 0x18002a249
movzx eax, word [rsp + 0x34]
cmp ax, word [0x18004f55c]
je 0x18002a259
lea rcx, [rsp + 0x30]
call fcn.180034430
mov rcx, qword [rbp + 8]
mov byte [rcx], al
lea r8, [rbp + 0x18]
lea rdx, str.Use_s
lea rcx, [rsp + 0x240]
call fcn.180010140
cmp qword [rdi + 0x18], 8
jb 0x18002a27b
mov rdi, qword [rdi]
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
mov r8, r15
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x240]
lea rcx, str.HotKey
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
lea rdx, [rsp + 0x30]
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r15 + rcx*2 - 2]
jne 0x18002a2c7
cmp rcx, 8
jne 0x18002a2b0
jmp 0x18002a2e3
mov rdx, qword [rbp + 0x10]
lea rcx, [rsp + 0x30]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x18002a2d0
cmp byte [rbx + 0x19], 0
jne 0x18002a32e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x18002a30e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x18002a32e
nop
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x18002a300
jmp 0x18002a32e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x18002a32b
cmp rbx, qword [rax + 0x10]
jne 0x18002a32b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x18002a318
mov rbx, rax
mov rax, qword [r14 + 0x48]
cmp rbx, qword [rax]
jne 0x18002a1a1
mov r15, qword [rsp + 0x460]
mov rdi, qword [rsp + 0x498]
mov rsi, qword [rsp + 0x490]
mov rbp, qword [rsp + 0x488]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.18002bf10
add rsp, 0x468
pop r14
pop rbx
ret