joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1407e4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407e41df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407e4089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407e406f
add dl, dl
jne 0x1407e4096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407e40f6
xor eax, eax
add dl, dl
jne 0x1407e40a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407e41ad
add dl, dl
jne 0x1407e40b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407e40c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407e40d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407e40dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407e40ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407e407e
mov eax, 1
add dl, dl
jne 0x1407e4106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407e4113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407e40fb
sub eax, ebx
mov ebx, 1
jne 0x1407e414c
mov ecx, 1
add dl, dl
jne 0x1407e412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407e413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407e4123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407e407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407e4168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407e4175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407e415d
cmp eax, 0x7d00
jae 0x1407e419b
cmp eax, 0x500
jb 0x1407e4196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407e407e
cmp eax, 0x7f
ja 0x1407e419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407e407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407e41d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407e407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1800010f0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1800e8604], 0
jne 0x180001127
lea rbx, [0x1800e8500]
mov edx, 0x104
mov dword [0x1800e8604], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x1800e8500]
add rsp, 0x20
pop rbx
ret

Function at 0x1800015f0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1800e8f88], 0
jne 0x180001627
lea rbx, [0x1800e8d80]
mov edx, 0x104
mov dword [0x1800e8f88], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x1800e8d80]
add rsp, 0x20
pop rbx
ret

Function at 0x180001d90
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1800ea744], 0
jne 0x180001e10
mov dword [0x1800ea744], 1
call fcn.18001c770
lea rbx, [0x1800ea640]
mov edx, 0x104
mov rcx, rbx
test eax, eax
je 0x180001e01
xor r8d, r8d
call fcn.180024ce0
test eax, eax
je 0x180001e07
mov qword [rsp + 0x30], rdi
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
mov rcx, qword [0x1800a5cd8]
mov rax, rbx
mov qword [rdi - 1], rcx
movzx ecx, word [0x1800a5ce0]
mov word [rdi + 7], cx
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x1800ea640]
add rsp, 0x20
pop rbx
ret

Function at 0x180002350
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1800eb0c8], 0
jne 0x1800023da
mov dword [0x1800eb0c8], 1
call fcn.18001c770
lea rbx, [0x1800eaec0]
mov edx, 0x104
mov rcx, rbx
test eax, eax
je 0x1800023cb
xor r8d, r8d
call fcn.18001e2e0
test eax, eax
je 0x1800023d1
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x30], rdi
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
mov rcx, qword [str.SysWow64]
mov rax, rbx
mov qword [rdi - 2], rcx
mov rcx, qword [0x1800a5d78]
mov qword [rdi + 6], rcx
mov ecx, dword [0x1800a5d80]
mov dword [rdi + 0xe], ecx
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x1800eaec0]
add rsp, 0x20
pop rbx
ret

Function at 0x1800036a0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, r8
lea r8, [rsp + 0x30]
xor edi, edi
mov rcx, 0xffffffff80000002
mov rbx, r9
mov qword [rsp + 0x30], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x180003715
test rbx, rbx
je 0x1800036ea
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx + rcx]
mov rcx, qword [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180003730
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
push rbx
sub rsp, 0x40
mov rbx, r8
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x180003790
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x68]
mov r9d, 4
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x40
pop rbx
ret

Function at 0x1800037a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
lea r8, [rsp + 0x38]
xor ebx, ebx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x180003868
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, dword [rsp + 0x68]
cmp r11d, 2
jb 0x18000385d
add r11d, 2
mov eax, 2
mov dword [rsp + 0x68], r11d
shr r11d, 1
mov ecx, r11d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180029d7c
mov rbx, rax
test rax, rax
je 0x18000385d
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x180003880
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
lea r8, [rsp + 0x38]
xor ebx, ebx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x180003929
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18000391e
mov eax, dword [rsp + 0x68]
cmp eax, 1
jb 0x18000391e
inc eax
mov ecx, eax
mov dword [rsp + 0x68], eax
call fcn.180029d7c
mov rbx, rax
test rax, rax
je 0x18000391e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180003940
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, r8
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x68], 0
mov qword [rsp + 0x38], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1800039b1
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x68]
add rsp, 0x40
pop rbx
ret
Function at 0x180006a20
Capabilities:
Read .ini file

Disassembly:
push rbp
lea rbp, [rsp - 0x870]
sub rsp, 0x970
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x980], rbx
mov rax, qword [0x1800d7110]
xor rax, rsp
mov qword [rbp + 0x860], rax
cmp dword [0x1800eeb10], 0
jne 0x180006c83
mov dword [0x1800eeb10], 1
mov byte [rbp + 0x460], 0
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rbp + 0x461]
call fcn.180029630
mov dword [rsp + 0x30], 0
mov byte [rbp + 0x60], 0
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rbp + 0x61]
call fcn.180029630
mov byte [rsp + 0x50], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x51]
call fcn.180029630
call fcn.180001e90
mov r8, rax
lea r9, str.OAgent.ini
lea rdx, [0x1800a5a04]
lea rcx, [rsp + 0x50]
call fcn.18002971c
lea r11, [rsp + 0x50]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0x400
lea r9, [rbp + 0x60]
lea r8, [0x1800a82b8]
lea rdx, [0x1800a81dc]
lea rcx, str.AgentConfig
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x180006b36
cmp byte [rbp + 0x45f], 0
jne 0x180006b36
mov r8d, 0x400
lea rdx, [rbp + 0x460]
lea rcx, [rbp + 0x60]
call fcn.18005b230
mov r11d, eax
mov dword [rsp + 0x30], eax
jmp 0x180006b3b
mov r11d, dword [rsp + 0x30]
test r11d, r11d
jne 0x180006c48
lea rcx, [rsp + 0x38]
call fcn.18001bd20
nop
mov r9d, 0x20219
lea r8, str.SOFTWAREClassesCLSIDAFFAEF68_CDC5_4aad_9D3F_997C0D55927BProgID
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x38]
call fcn.18001b720
test rax, rax
je 0x180006bbf
lea r8, [rsp + 0x30]
lea rdx, [0x1800a8228]
lea rcx, [rsp + 0x38]
call fcn.18001a4b0
mov rbx, rax
test rax, rax
je 0x180006bbf
mov eax, dword [rsp + 0x30]
cmp eax, 0x400
jae 0x180006baf
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x460]
call fcn.18002a1e0
jmp 0x180006bb7
mov dword [rsp + 0x30], 0
mov rcx, rbx
call fcn.180029a70
lea rcx, [rsp + 0x38]
call fcn.18001a360
nop
lea rcx, [rsp + 0x38]
call fcn.18001b6a0
mov r11d, dword [rsp + 0x30]
test r11d, r11d
jne 0x180006c48
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x60]
call fcn.180029630
mov dword [rsp + 0x20], 0x400
lea r9, [rbp + 0x60]
lea r8, [0x1800a82b8]
lea rdx, [0x1800a8228]
lea rcx, str.ED30_8AC4_11D5_8930_A730
call qword [sym.imp.KERNEL32.dll_GetProfileStringA]
test eax, eax
je 0x180006c3e
cmp byte [rbp + 0x45f], 0
jne 0x180006c3e
mov r8d, 0x400
lea rdx, [rbp + 0x460]
lea rcx, [rbp + 0x60]
call fcn.18005b230
mov r11d, eax
jmp 0x180006c43
mov r11d, dword [rsp + 0x30]
test r11d, r11d
je 0x180006c83
cmp r11d, 4
jbe 0x180006c83
cmp dword [rbp + 0x460], 1
je 0x180006c83
movzx eax, word [rbp + 0x47c]
lea eax, [rax + rax + 0x22]
test eax, eax
je 0x180006c83
mov edx, r11d
sub rdx, 4
mov ecx, dword [0x1800eeb0c]
cmp rax, rdx
cmovbe ecx, dword [rbp + 0x468]
mov dword [0x1800eeb0c], ecx
mov rcx, qword [rbp + 0x860]
xor rcx, rsp
call fcn.180029600
mov rbx, qword [rsp + 0x980]
add rsp, 0x970
pop rbp
ret
Function at 0x180007b10
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
mov rbx, rcx
lea rdx, [rcx + 8]
mov r8d, 1
lea rcx, [rsp + 0x38]
call fcn.180019470
nop
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
test eax, eax
je 0x180007b9f
test rsi, rsi
je 0x180007b9f
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor r11d, r11d
mov dword [rsp + 0x60], r11d
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx + rcx - 2]
mov qword [rsp + 0x20], r11
lea r9, [rsp + 0x60]
mov rdx, rsi
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
lea rcx, [rsp + 0x38]
call fcn.1800194f0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1800099b0
Capabilities:
Set global application hook

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movsxd rbx, ecx
mov rdi, rdx
lea rcx, [0x1800eee00]
mov edx, 0x7530
call fcn.18000e800
lea rcx, [0x1800eee00]
call fcn.18000e980
mov r8, qword [0x1800ee6c8]
xor r9d, r9d
imul rbx, rbx, 0x260
lea rsi, [0x180100010]
lea ecx, [r9 + 3]
mov rdx, qword [rbx + rsi + 0x30]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
lea rcx, [0x1800eee00]
mov qword [rbx + rsi + 8], rax
call fcn.18000e9b0
lea rcx, [0x1800eee00]
call fcn.18000e840
cmp qword [rbx + rsi + 8], 0
je 0x180009a65
lea rcx, [rbx + rsi + 0x58]
mov r8d, 0x103
mov rdx, rdi
mov dword [rbx + rsi], 1
mov dword [rbx + rsi + 4], 1
call fcn.180029944
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x18000d450
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rbp, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
mov rbx, r9
mov rsi, rdx
repne scasb al, byte [rdi]
mov eax, 0x1f3
not rcx
dec rcx
sub eax, ecx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
mov rcx, rbp
mov dword [rsp + 0x24], eax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, rax
mov qword [rsp + 0x28], rax
cmp rax, 0xffffffffffffffff
jne 0x18000d4ba
lea eax, [rcx + 2]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov edx, 1
movsxd rdi, edi
mov dword [rsp + 0x20], edx
mov qword [rsp + 0x30], rdi
nop dword [rax + rax]
test byte [rsi], 0x10
je 0x18000d5f8
cmp byte [rsi + 0x2c], 0x2e
jne 0x18000d4f9
movzx eax, byte [rsi + 0x2d]
cmp al, 0x2e
jne 0x18000d4f1
cmp byte [rsi + 0x2e], 0
je 0x18000d630
test al, al
je 0x18000d630
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsi + 0x2c]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov qword [rsp + 0x38], rcx
lea eax, [rcx + 1]
cmp dword [rsp + 0x24], eax
jb 0x18000d626
mov rax, qword [rsp + 0x30]
mov r9, qword [rsp + 0x88]
lea rdx, [rsi + 0x2c]
mov r8d, 0x10002
mov rcx, rbp
mov byte [rax + rbp - 1], 0
call qword [rsp + 0x80]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
xor ecx, ecx
movzx eax, byte [rsi + rcx + 0x2c]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x18000d550
mov r9, qword [rsp + 0x88]
mov r8, qword [rsp + 0x80]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
mov rdx, rsi
repne scasb al, byte [rdi]
movzx eax, word [0x1800a93dc]
mov rcx, rbp
mov word [rdi - 1], ax
movzx eax, byte [0x1800a93de]
mov byte [rdi + 1], al
call fcn.18000d450
lea rcx, [rsi + 0x2c]
xor edx, edx
mov r8d, 0x104
call fcn.180029630
mov eax, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x38]
lea rdx, [rax + rbp - 1]
lea rcx, [rsi + 0x2c]
call fcn.180029fd0
mov rdi, qword [rsp + 0x30]
mov r9, qword [rsp + 0x88]
lea rdx, [rsi + 0x2c]
mov r8d, 0x20002
mov rcx, rbp
mov byte [rdi + rbp - 1], 0
call qword [rsp + 0x80]
mov word [rdi + rbp - 1], 0x2a
mov edx, eax
mov dword [rsp + 0x20], eax
jmp 0x18000d62b
lea rdx, [rsi + 0x2c]
mov r9, rbx
mov r8d, 1
mov rcx, rbp
mov byte [rdi + rbp - 1], 0
call qword [rsp + 0x80]
mov rcx, qword [rsp + 0x28]
mov byte [rdi + rbp - 1], 0x2a
mov edx, eax
mov dword [rsp + 0x20], eax
jmp 0x18000d638
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x88]
test edx, edx
je 0x18000d656
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
test eax, eax
jne 0x18000d4d0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x20]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000d680
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
mov rdi, qword [rsp + 0x70]
mov eax, 0x1f3
not rcx
mov rbx, r9
mov rsi, rdx
dec rcx
sub eax, ecx
mov qword [rsp + 0x38], rcx
mov rcx, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, rax
mov qword [rsp + 0x28], rax
cmp rax, 0xffffffffffffffff
jne 0x18000d6e5
lea eax, [rcx + 2]
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
movsxd rdx, dword [rsp + 0x38]
mov qword [rsp + 0x78], rbp
xor r8d, r8d
mov qword [rsp + 0x30], rdx
mov ebp, 1
nop dword [rax]
test byte [rsi], 0x10
je 0x18000d8a2
cmp word [rsi + 0x2c], 0x2e
jne 0x18000d72e
movzx eax, word [rsi + 0x2e]
cmp ax, 0x2e
jne 0x18000d725
cmp word [rsi + 0x30], 0
je 0x18000d85b
test ax, ax
je 0x18000d85b
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsi + 0x2c]
repne scasw ax, word [rdi]
mov rdi, qword [rsp + 0x70]
not rcx
dec rcx
mov qword [rsp + 0x40], rcx
lea eax, [rcx + 1]
cmp dword [rsp + 0x20], eax
jb 0x18000d856
mov r9, qword [rsp + 0x88]
mov word [rdi + rdx*2 - 2], r8w
lea rdx, [rsi + 0x2c]
mov r8d, 0x10002
mov rcx, rdi
call qword [rsp + 0x80]
mov ebp, eax
test eax, eax
je 0x18000d888
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
xor ecx, ecx
nop
movzx eax, word [rsi + rcx + 0x2c]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x18000d790
mov rdi, qword [rsp + 0x70]
mov r9, qword [rsp + 0x88]
mov r8, qword [rsp + 0x80]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdx, rsi
repne scasw ax, word [rdi]
mov eax, dword [0x1800a93e0]
mov dword [rdi - 2], eax
movzx eax, word [0x1800a93e4]
mov word [rdi + 2], ax
mov rdi, qword [rsp + 0x70]
mov rcx, rdi
call fcn.18000d680
mov ebp, eax
test eax, eax
je 0x18000d888
lea rcx, [rsi + 0x2c]
xor edx, edx
mov r8d, 0x208
call fcn.180029630
mov eax, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x40]
lea rdx, [rdi + rax*2 - 2]
lea rcx, [rsi + 0x2c]
call fcn.180029944
mov rax, qword [rsp + 0x30]
mov r9, qword [rsp + 0x88]
xor ecx, ecx
lea rdx, [rsi + 0x2c]
mov r8d, 0x20002
mov word [rdi + rax*2 - 2], cx
mov rcx, rdi
call qword [rsp + 0x80]
mov rdx, qword [rsp + 0x30]
mov ebp, eax
mov eax, 0x2a
mov word [rdi + rdx*2 - 2], ax
xor eax, eax
mov word [rdi + rdx*2], ax
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x88]
test ebp, ebp
je 0x18000d888
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov r8d, 0
test eax, eax
jne 0x18000d700
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebp
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
mov word [rdi + rdx*2 - 2], r8w
lea rdx, [rsi + 0x2c]
mov r9, rbx
mov r8d, 1
mov rcx, rdi
call qword [rsp + 0x80]
mov ecx, 0x2a
mov ebp, eax
mov rax, qword [rsp + 0x30]
mov word [rdi + rax*2 - 2], cx
mov rcx, qword [rsp + 0x28]
jmp 0x18000d863
Function at 0x18000f130
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
shr edx, 4
mov rsi, r9
inc dx
movzx r9d, r8w
mov rdi, rcx
movzx r8d, dx
mov edx, 6
and ebx, 0xf
call qword [sym.imp.KERNEL32.dll_FindResourceExA]
test rax, rax
je 0x18000f193
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18000f193
xor edx, edx
nop dword [rax + rax]
movzx ecx, word [rax]
cmp ebx, edx
je 0x18000f1a5
inc edx
lea rax, [rax + rcx*2 + 2]
cmp edx, 0x10
jl 0x18000f180
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rbx, dword [rsp + 0x50]
lea rdx, [rax + 2]
mov rcx, rsi
mov r8, rbx
call fcn.18000f020
test eax, eax
jne 0x18000f1c3
mov byte [rbx + rsi - 1], al
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
dec eax
add rsp, 0x20
pop rdi
ret

Function at 0x18000f680
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
shr edx, 4
mov rsi, r9
inc dx
movzx r9d, r8w
mov rdi, rcx
movzx r8d, dx
mov edx, 6
and ebx, 0xf
call qword [sym.imp.KERNEL32.dll_FindResourceExA]
test rax, rax
je 0x18000f6eb
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rax
test rax, rax
je 0x18000f6eb
xor ebp, ebp
mov eax, ebp
movzx ecx, word [rdx]
add rdx, 2
cmp ebx, eax
je 0x18000f702
inc eax
lea rdx, [rdx + rcx*2]
cmp eax, 0x10
jl 0x18000f6d5
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov edi, dword [rsp + 0x50]
dec edi
cmp ecx, edi
cmovle edi, ecx
movsxd rcx, edi
lea rbx, [rcx + rcx]
mov rcx, rsi
mov r8, rbx
call fcn.18002a1e0
mov word [rbx + rsi], bp
mov eax, edi
jmp 0x18000f6ed

Function at 0x180019750
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, r8
mov rdi, rcx
test rdx, rdx
je 0x18001977e
or r9d, 0x20019
mov r8d, r9d
call fcn.1800196b0
mov rbx, rax
jmp 0x180019781
mov rbx, rcx
test rbx, rbx
je 0x180019827
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18001981a
cmp dword [rsp + 0x30], 4
jne 0x18001981a
mov eax, dword [rsp + 0x58]
mov ecx, 4
mov rdx, rsi
cmp eax, ecx
cmova eax, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x58]
mov rcx, rbx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18001981a
cmp rbx, rdi
je 0x180019805
mov rcx, rbx
call fcn.180019730
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
cmp rbx, rdi
je 0x180019827
mov rcx, rbx
call fcn.180019730
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x40
pop rdi
ret