joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dc1a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dc41c
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rcx
xor edx, edx
xor esi, esi
xor edi, edi
xor r8d, r8d
jmp 0x4dc1d4
lea rdx, [r12 + 1]
mov rcx, r13
cmp rbx, rdx
jle 0x4dc3d8
mov qword [rsp + 0x20], rdx
mov byte [rsp + 0x1f], r8b
mov byte [rsp + 0x1e], dil
mov qword [rsp + 0x28], rsi
movzx r9d, byte [rax + rdx]
test r8b, r8b
je 0x4dc2c0
nop
cmp r9b, 0x3e
jne 0x4dc2b0
mov r9, qword [0x007a3e78]
mov r10, rdx
sub rdx, r9
lea r11, [rdx + 1]
nop dword [rax + rax]
test r11, r11
jl 0x4dc2a5
lea r12, [r10 + 1]
cmp r12, r11
jb 0x4dc410
mov r12, r10
sub r10, rdx
mov r13, rcx
sub rcx, rdx
lea r15, [rcx - 1]
neg r15
sar r15, 0x3f
and r15, r11
lea r11, [rax + r15]
cmp r9, r10
je 0x4dc25d
xor ecx, ecx
jmp 0x4dc295
mov rbx, qword [0x007a3e70]
mov rax, r11
mov rcx, r10
call sym.runtime.memequal
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x28]
movzx edi, byte [rsp + 0x1e]
movzx r8d, byte [rsp + 0x1f]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x50]
mov ecx, eax
mov rax, qword [rsp + 0x40]
test cl, cl
je 0x4dc1cc
xor r8d, r8d
jmp 0x4dc1cc
mov r12, r10
mov r13, rcx
jmp 0x4dc1cc
mov r12, rdx
mov r13, rcx
jmp 0x4dc1cc
test dil, dil
je 0x4dc2d7
cmp dil, r9b
jne 0x4dc2cc
xor edi, edi
mov r12, rdx
mov r13, rcx
jmp 0x4dc1cc
cmp r9b, 0x27
je 0x4dc2e6
nop dword [rax]
cmp r9b, 0x22
jne 0x4dc2f4
mov r12, rdx
mov r13, rcx
mov edi, r9d
jmp 0x4dc1cc
cmp r9b, 0x3c
jne 0x4dc3a7
mov r9, qword [0x007a3e58]
lea r10, [rdx + r9]
cmp rbx, r10
jle 0x4dc399
cmp rcx, r10
jb 0x4dc405
nop dword [rax + rax]
cmp rdx, r10
ja 0x4dc3f7
mov rbx, qword [str.____lt_gt_]
mov rsi, rdx
sub rdx, rcx
sar rdx, 0x3f
and rdx, rsi
add rdx, rax
mov rax, rdx
mov rcx, r9
call sym.runtime.memequal
test al, al
je 0x4dc375
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x48]
movzx edi, byte [rsp + 0x1e]
mov rsi, qword [rsp + 0x28]
mov r8d, 1
jmp 0x4dc39c
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x28]
movzx edi, byte [rsp + 0x1e]
movzx r8d, byte [rsp + 0x1f]
inc rsi
mov r12, rdx
mov r13, rcx
jmp 0x4dc1cc
cmp r9b, 0x3e
jne 0x4dc3c5
test rsi, rsi
je 0x4dc3d0
dec rsi
mov r12, rdx
mov r13, rcx
nop dword [rax + rax]
jmp 0x4dc1cc
mov r12, rdx
mov r13, rcx
jmp 0x4dc1cc
xor eax, eax
add rsp, 0x30
pop rbp
ret
test rsi, rsi
jne 0x4dc3eb
nop dword [rax]
test dil, dil
jne 0x4dc3eb
xor r8d, 1
jmp 0x4dc3ee
xor r8d, r8d
mov eax, r8d
add rsp, 0x30
pop rbp
ret
mov rax, rdx
mov rcx, r10
nop dword [rax]
call sym.runtime.panicSliceB
mov rdx, rcx
mov rcx, r10
call sym.runtime.panicSliceAcap
mov rax, r11
mov rcx, r12
call sym.runtime.panicSliceB
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop
jmp sym.encoding_xml.isValidDirective
Function at 0x509040
Capabilities:
Parse credit card information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5091e6
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
xor ecx, ecx
nop
jmp 0x509065
mov rcx, rsi
cmp rbx, rcx
jle 0x5091dc
movzx edx, byte [rax + rcx]
cmp edx, 0x80
jge 0x509082
lea rsi, [rcx + 1]
nop
jmp 0x5090a0
mov qword [rsp + 0x30], rcx
call sym.runtime.decoderune
mov rcx, qword [rsp + 0x30]
mov edx, eax
mov rsi, rbx
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
cmp edx, 0x20
je 0x509062
cmp edx, 0xd
je 0x509062
cmp edx, 0xa
je 0x509062
cmp edx, 0x27
je 0x509062
cmp edx, 0x2d
je 0x509062
cmp edx, 0x28
je 0x509062
nop
cmp edx, 0x29
je 0x509062
cmp edx, 0x2b
je 0x509062
cmp edx, 0x2c
je 0x509062
cmp edx, 0x2e
je 0x509062
cmp edx, 0x2f
je 0x509062
cmp edx, 0x3a
je 0x509062
nop
cmp edx, 0x3d
je 0x509062
cmp edx, 0x3f
je 0x509062
cmp edx, 0x3b
je 0x509062
nop dword [rax + rax]
cmp edx, 0x21
je 0x509062
cmp edx, 0x2a
je 0x509062
cmp edx, 0x23
je 0x509062
nop dword [rax + rax]
cmp edx, 0x40
je 0x509062
cmp edx, 0x24
je 0x509062
cmp edx, 0x5f
je 0x509062
nop dword [rax + rax]
cmp edx, 0x25
je 0x509062
lea edi, [rdx - 0x41]
cmp edi, 0x19
jbe 0x509062
lea edi, [rdx - 0x61]
nop dword [rax + rax]
cmp edi, 0x19
jbe 0x509062
lea edi, [rdx - 0x30]
cmp edi, 9
jbe 0x509062
mov dword [rsp + 0x2c], edx
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rax, rcx
call sym.runtime.convT64
lea rcx, [0x0056e5c0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x2c]
call sym.runtime.convT32
lea rcx, [0x0056e640]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rax, [0x005b3670]
mov ebx, 0x2b
lea rcx, [rsp + 0x38]
mov edi, 2
mov rsi, rdi
call sym.fmt.Errorf
add rsp, 0x58
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.github.com_shabbyrobe_xmlwriter.CheckPubID
Function at 0x180007db0
Capabilities:
Check mutex on windows

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x28], 0
mov word [rsp + 0x30], 0
mov word [rsp + 0x30], 0
xor bl, bl
cmp qword [rdx + 0x10], 0
je 0x180007df0
cmp qword [rdx + 0x18], 8
jb 0x180007df2
mov rdx, qword [rdx]
jmp 0x180007df2
xor edx, edx
mov r8, rdx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x180007e26
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, bl
mov ecx, 1
cmp eax, 0xb7
cmove ebx, ecx
mov byte [rsp + 0x31], bl
test rdi, rdi
je 0x180007e33
test bl, bl
je 0x180007e33
mov bl, 1
jmp 0x180007e35
xor bl, bl
test rdi, rdi
je 0x180007e4c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], 0
mov word [rsp + 0x30], 0
movzx eax, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x18000c930
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x180267080]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov ecx, 1
call fcn.18017df2c
mov qword [rbx], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
mov byte [rax], 0
call fcn.180180610
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x18000c997
cmp dword [rsp + 0x24], 6
mov rcx, qword [rbx]
setae dl
mov byte [rcx], dl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18017df00
add rsp, 0x150
pop rbx
ret
Function at 0x18000fef0
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [0x180267080]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
lea rcx, [r11 - 0x48]
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18017df00
add rsp, 0x68
ret

Function at 0x18000ff50
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x180267080]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor edx, edx
add rcx, 4
mov r8d, 0x118
call fcn.180180610
mov rcx, rbx
mov dword [rbx], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1800100b2
cmp dword [rbx + 4], 6
mov qword [rsp + 0x188], rdi
ja 0x18000ffb4
jne 0x180010055
cmp dword [rbx + 8], 2
jb 0x180010055
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x180010055
mov edx, 1
mov rcx, rax
lea r8d, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x180010055
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x180010055
movups xmm0, xmmword [0x1801e0cb0]
mov rcx, rax
movups xmm1, xmmword [0x1801e0cc0]
movups xmmword [rsp + 0x140], xmm0
movups xmmword [rsp + 0x150], xmm1
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x180010055
lea rcx, [rax + 6]
lea rdx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x180010055
cmp word [rdi + 2], ax
jbe 0x180010055
movzx edx, word [rdi + 0x32]
movzx eax, word [rdi + 0x30]
movzx ecx, word [rdi + 0x36]
mov dword [rbx + 4], edx
mov dword [rbx + 8], eax
mov dword [rbx + 0xc], ecx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1800100a6
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x118
call fcn.180180610
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call rdi
test eax, eax
jne 0x1800100a6
mov eax, dword [rsp + 0x2c]
mov dword [rbx + 0xc], eax
mov rdi, qword [rsp + 0x188]
mov al, 1
jmp 0x1800100b4
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.18017df00
add rsp, 0x170
pop rbx
ret
Function at 0x180012ce0
Capabilities:
Copy file

Disassembly:
jmp 0x18001c070
push rbp
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x180267080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rdx
mov rbx, rcx
cmp qword [rdx + 0x18], 8
jb 0x18001c0a8
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x18001c0b2
mov rcx, qword [rcx]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x18001c0c6
mov al, 1
jmp 0x18001c211
xor sil, sil
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x1801f3a80]
movdqu xmmword [rsp + 0x58], xmm1
xor ebp, ebp
mov word [rsp + 0x48], bp
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.18001cd00
movzx ebx, sil
mov ecx, 1
test al, al
cmovne ebx, ecx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x1801f3a80]
movdqu xmmword [rsp + 0x38], xmm1
mov word [rsp + 0x28], bp
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.18001cd00
test al, al
jne 0x18001c133
test bl, bl
je 0x18001c166
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x18001c166
mov bl, 1
jmp 0x18001c168
xor bl, bl
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x18001c1aa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c1a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c234
call fcn.18017e41c
movdqa xmm0, xmmword [0x1801f3a80]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], bp
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x18001c1fb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c1f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001c22e
call fcn.18017e41c
movdqa xmm0, xmmword [0x1801f3a80]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], bp
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18017df00
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
call fcn.180182c3c
nop
call fcn.180182c3c
nop
int3
Function at 0x180014ba0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x180267080]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor edi, edi
mov rbx, rcx
cmp qword [rcx + 0x18], 8
mov rax, rcx
mov qword [rcx + 0x10], rdi
jb 0x180014bd5
mov rax, qword [rcx]
xor edx, edx
mov word [rax], di
mov r8d, 0x412
lea rcx, [rsp + 0x20]
call fcn.180180610
lea rdx, [rsp + 0x20]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x180014c02
xor al, al
jmp 0x180014c39
cmp eax, 0x208
jae 0x180014bfe
mov word [rsp + 0x430], di
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], di
jne 0x180014c20
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180009930
mov al, 1
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18017df00
mov rbx, qword [rsp + 0x468]
add rsp, 0x450
pop rdi
ret

Function at 0x180015ee0
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov qword [rcx], 0
mov rbx, rcx
mov word [rcx + 8], 0
cmp qword [rdx + 0x10], 0
je 0x180015f09
cmp qword [rdx + 0x18], 8
jb 0x180015f0b
mov rdx, qword [rdx]
jmp 0x180015f0b
xor edx, edx
mov r8, rdx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
test rax, rax
je 0x180015f3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov rax, rbx
jne 0x180015f3d
mov byte [rbx + 9], 1
add rsp, 0x20
pop rbx
ret
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x180015f90
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x180267080]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor ebp, ebp
test rcx, rcx
je 0x180015fce
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rbp
mov word [rdi + 8], bp
mov qword [rsp + 0x28], rbp
lea rcx, [rsp + 0x28]
call fcn.18001d030
nop
mov rbx, qword [rsp + 0x28]
cmp qword [rbx], 0
lea rcx, [rbx + 0x10]
jne 0x180015ff4
mov rcx, rbp
cmp qword [rsi + 0x10], 0
je 0x180016007
cmp qword [rsi + 0x18], 8
jb 0x18001600a
mov rsi, qword [rsi]
jmp 0x18001600a
mov rsi, rbp
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
test rax, rax
je 0x18001602e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x18001602e
mov byte [rdi + 9], 1
cmp qword [rdi], 0
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x180016055
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180016068
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], rbp
mov edx, 0x58
mov rcx, rbx
call fcn.18017e41c
mov qword [rsp + 0x28], rbp
movzx eax, sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18017df00
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800160a0
Capabilities:
Check mutex on windows

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbp
mov rax, qword [0x180267080]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor r14d, r14d
test rcx, rcx
je 0x1800160e5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], r14
mov word [rdi + 8], r14w
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x28]
call fcn.18001d150
nop
mov rbx, qword [rsp + 0x28]
cmp qword [rbx], 0
lea rbp, [rbx + 0x10]
jne 0x18001610c
mov rbp, r14
cmp qword [rsi + 0x10], 0
je 0x180016122
mov r8, rsi
cmp qword [rsi + 0x18], 8
jb 0x180016125
mov r8, qword [rsi]
jmp 0x180016125
mov r8, r14
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
test rax, rax
jne 0x180016173
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x180016173
lea ecx, [rax + 5]
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [rsi + 0x10], 0
je 0x18001615f
cmp qword [rsi + 0x18], 8
jb 0x180016162
mov rsi, qword [rsi]
jmp 0x180016162
mov rsi, r14
mov r8, rsi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
mov rax, qword [rdi]
test rax, rax
je 0x18001619a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x18001618c
mov byte [rdi + 9], 1
mov rcx, qword [rdi]
call fcn.18000e5c0
mov rax, qword [rdi]
test rax, rax
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x1800161bd
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800161d0
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], r14
mov edx, 0x58
mov rcx, rbx
call fcn.18017e41c
mov qword [rsp + 0x28], r14
movzx eax, sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18017df00
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1800170a0
Capabilities:
Create thread
Resume thread

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rax, qword [0x180267080]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
jne 0x1800170d6
xor al, al
jmp 0x18001718b
mov qword [rsp + 0x38], 0
add rdi, 0x38
mov qword [rsp + 0x38], rdi
je 0x1800170f9
mov rcx, qword [rdi]
test rcx, rcx
je 0x1800170f9
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [rbx + 0x10]
cmp qword [rax + 8], 0
je 0x18001716a
mov eax, 1
lock xadd dword [rbx + 8], eax
mov rcx, qword [rbx + 0x10]
add rcx, 0x14
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 4
mov r9, rbx
lea r8, [0x180016d10]
xor edx, edx
xor ecx, ecx
call fcn.180186fc4
mov rcx, qword [rbx + 0x10]
mov qword [rcx + 0x18], rax
mov rax, qword [rbx + 0x10]
cmp qword [rax + 0x18], 0
jne 0x1800171a3
mov eax, 0xffffffff
lock xadd dword [rbx + 8], eax
sub eax, 1
jne 0x180017161
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbx + 0x10]
call fcn.180016ec0
xor bl, bl
test rdi, rdi
je 0x180017188
mov rcx, qword [rdi]
test rcx, rcx
je 0x18001717f
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0x38], 0
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18017df00
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov byte [rax + 0x10], 1
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx + 0x40]
test rax, rax
je 0x1800171c1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x10]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x180017149
mov bl, 1
jmp 0x18001716c

Function at 0x180017690
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x180267080]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, VarUI4FromDisp
call fcn.180180610
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], VarUI4FromDisp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180017717
cmp dword [rsp + 0x44], 6
jb 0x180017717
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
lea r8, str.Progid
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
call fcn.1800174c0
test al, al
je 0x180017717
cmp word [rbx], 0
jne 0x180017781
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.http_shellopencommand
mov rcx, 0xffffffff80000000
call fcn.1800174c0
test al, al
je 0x18001774c
cmp word [rbx], 0
jne 0x180017781
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareClasses.html
mov rcx, 0xffffffff80000001
call fcn.1800174c0
test al, al
je 0x180017785
cmp word [rbx], 0
je 0x180017785
mov al, 1
jmp 0x180017787
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.18017df00
add rsp, 0x170
pop rbx
ret
Function at 0x18001b6b0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx]
test rax, rax
je 0x18001b6e8
test rdx, rdx
je 0x18001b6e8
cmp qword [rax], 0xffffffffffffffff
je 0x18001b6e8
xor eax, eax
mov dword [r9], eax
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18001b6e8
mov al, 1
add rsp, 0x38
ret
xor al, al
add rsp, 0x38
ret

Function at 0x18001b730
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x180267080]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx]
mov rdi, rdx
test rcx, rcx
je 0x18001b78e
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x18001b78e
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x18001b779
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18001b78e
mov ecx, dword [rsp + 0x20]
mov rax, rbx
shl rcx, 0x20
mov al, 1
add rcx, rbx
mov qword [rdi], rcx
jmp 0x18001b790
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18017df00
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18001b8e0
Capabilities:
Set file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rax, qword [0x180267080]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edi, edx
mov rbx, rcx
and edi, 0xffffb1af
cmp qword [rcx + 0x18], 8
jb 0x18001b91d
mov rcx, qword [rcx]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x18001b930
mov al, 1
jmp 0x18001b9d7
xor esi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.18001cd00
test al, al
je 0x18001b981
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x18001b981
mov bl, 1
jmp 0x18001b983
xor bl, bl
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x18001b9c1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001b9bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001b9f4
call fcn.18017e41c
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18017df00
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
call fcn.180182c3c
int3
Function at 0x18001ba00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x180267080]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x18001ba35
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
jne 0x18001badf
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x1801f3a80]
movdqu xmmword [rsp + 0x38], xmm1
xor esi, esi
mov word [rsp + 0x28], si
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.18001cd00
test al, al
je 0x18001ba8e
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x18001bacc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001bac7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001bafe
call fcn.18017e41c
movdqa xmm0, xmmword [0x1801f3a80]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], si
mov eax, edi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18017df00
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.180182c3c
int3