joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140060be0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov edi, r8d
mov r13, rdx
mov r14, rcx
call fcn.1400548f0
xor ebx, ebx
cmp qword [0x140249378], rbx
mov rbp, rax
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x30], ebx
jne 0x140060d0c
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x140060e1f
lea rdx, [0x14006b510]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140060e1f
mov rcx, rax
call fcn.140054820
lea rdx, [0x14006b500]
mov rcx, rsi
mov qword [0x140249378], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140054820
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140249380], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140054820
lea rcx, [rsp + 0x98]
mov qword [0x140249388], rax
call fcn.140051f30
test eax, eax
je 0x140060cbf
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140050e40
cmp dword [rsp + 0x98], 2
jne 0x140060d0c
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140054820
test rax, rax
mov qword [0x140249398], rax
je 0x140060d0c
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140054820
mov qword [0x140249390], rax
mov rcx, qword [0x140249390]
mov qword [rsp + 0x80], r12
cmp rcx, rbp
je 0x140060db8
cmp qword [0x140249398], rbp
je 0x140060db8
call fcn.1400549e0
mov rcx, qword [0x140249398]
mov rsi, rax
call fcn.1400549e0
test rsi, rsi
mov r12, rax
je 0x140060db8
test rax, rax
je 0x140060db8
call rsi
test rax, rax
je 0x140060d83
lea rcx, [rsp + 0x34]
mov r9d, SafeArrayGetDim
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140060d83
test byte [rsp + 0x40], 1
jne 0x140060db8
lea rcx, [rsp + 0x30]
call fcn.140051f80
test eax, eax
je 0x140060da5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140050e40
cmp dword [rsp + 0x30], 4
jb 0x140060db2
bts edi, 0x15
jmp 0x140060df6
bts edi, 0x12
jmp 0x140060df6
mov rcx, qword [0x140249380]
cmp rcx, rbp
je 0x140060df6
call fcn.1400549e0
test rax, rax
je 0x140060df6
call rax
test rax, rax
mov rbx, rax
je 0x140060df6
mov rcx, qword [0x140249388]
cmp rcx, rbp
je 0x140060df6
call fcn.1400549e0
test rax, rax
je 0x140060df6
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140249378]
call fcn.1400549e0
mov r12, qword [rsp + 0x80]
test rax, rax
je 0x140060e1f
mov r9d, edi
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140060e21
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400637f0
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1400940c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140063837
or eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400503a0
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.140052760
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400503a0
add rsp, 0x38
ret
Function at 0x1400672f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x20
xor ebx, ebx
test rcx, rcx
mov r14, rdx
mov rbp, rcx
je 0x1400673a4
movsxd rax, dword [rcx + 0x3c]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov edi, dword [rax + rcx + 0x88]
mov esi, ebx
add rdi, rcx
cmp dword [rdi + 0x18], ebx
jbe 0x14006739f
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r13
mov r13, rbx
mov r12, rbx
nop
nop
mov eax, dword [rdi + 0x20]
mov rdx, r14
add rax, r13
mov ecx, dword [rax + rbp]
add rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x14006736f
mov eax, dword [rdi + 0x24]
mov ecx, dword [rdi + 0x1c]
add rax, r12
add rcx, rbp
movzx edx, word [rax + rbp]
mov ebx, dword [rcx + rdx*4]
add rbx, rbp
add esi, 1
add r13, 4
add r12, 2
cmp esi, dword [rdi + 0x18]
jb 0x140067340
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov rax, rbx
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov rax, rbx
jmp 0x14006738c
mov rax, rbx
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
Function at 0x140011262
Capabilities:
Terminate process

Disassembly:
jmp 0x140014d30
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011307
Capabilities:
Parse pe header

Disassembly:
jmp 0x140016080
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400160a0
xor al, al
jmp 0x140016121
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400160b3
xor al, al
jmp 0x140016121
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400160dd
xor al, al
jmp 0x140016121
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400160f1
xor al, al
jmp 0x140016121
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140016103
xor al, al
jmp 0x140016121
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001611f
xor al, al
jmp 0x140016121
mov al, 1
add rsp, 0x38
ret
Function at 0x180045220
Capabilities:
Set current directory

Disassembly:
push rbp
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 0x50], r8
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x40], rcx
mov rax, qword [0x1800950a8]
xor rax, rbp
mov qword [rbp - 8], rax
mov dword [rbp - 0x34], 0x371e74ce
mov eax, dword [rbp - 0x34]
mov dword [rbp - 0x54], eax
sub eax, 0x9c9d2401
je 0x1800453be
jmp 0x180045261
mov eax, dword [rbp - 0x54]
sub eax, 0xc375b5be
je 0x180045355
jmp 0x180045274
mov eax, dword [rbp - 0x54]
sub eax, 0xe76e0ba9
je 0x1800453df
jmp 0x180045287
mov eax, dword [rbp - 0x54]
sub eax, 0xf957ee78
je 0x180045380
jmp 0x18004529a
mov eax, dword [rbp - 0x54]
sub eax, 0x7ef67d7
je 0x180045335
jmp 0x1800452ad
mov eax, dword [rbp - 0x54]
sub eax, 0xf255de6
je 0x180045397
jmp 0x1800452c0
mov eax, dword [rbp - 0x54]
sub eax, 0x371e74ce
je 0x1800452fe
jmp 0x1800452d3
mov eax, dword [rbp - 0x54]
sub eax, 0x4b455517
je 0x1800453a7
jmp 0x1800452e6
mov eax, dword [rbp - 0x54]
sub eax, 0x5b1beb92
je 0x180045369
jmp 0x1800452f9
jmp 0x18004542f
mov eax, 0x10
mov qword [rbp - 0x60], rax
call fcn.18008acc0
sub rsp, rax
mov rax, qword [rbp - 0x60]
mov rcx, rsp
mov qword [rbp - 0x28], rcx
call fcn.18008acc0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x34], 0x7ef67d7
jmp 0x18004542f
mov eax, 0x10
call fcn.18008acc0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x34], 0xc375b5be
jmp 0x18004542f
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x34], 0x5b1beb92
jmp 0x18004542f
mov rcx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x28]
mov qword [rax], rcx
mov dword [rbp - 0x34], 0xf957ee78
jmp 0x18004542f
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x20]
mov qword [rax], rcx
mov dword [rbp - 0x34], 0xf255de6
jmp 0x18004542f
mov rax, qword [rbp - 0x20]
mov dword [rbp - 0x34], 0x4b455517
jmp 0x18004542f
mov rax, qword [rbp - 0x28]
mov rax, qword [rax]
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x34], 0x9c9d2401
jmp 0x18004542f
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
call fcn.180025f80
add rsp, 0x20
mov dword [rbp - 0x34], 0xe76e0ba9
jmp 0x18004542f
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.1800459b0
add rsp, 0x20
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
add rsp, 0x20
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.1800243c0
add rsp, 0x20
xor eax, eax
mov dword [rbp - 0x64], eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
sub rsp, 0x20
call fcn.18008ac40
mov eax, dword [rbp - 0x64]
mov rsp, rbp
pop rbp
ret
jmp 0x18004524b
Function at 0x180068d30
Capabilities:
Delete file

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x30], rcx
mov rax, qword [0x1800950a8]
xor rax, rbp
mov qword [rbp - 8], rax
mov dword [rbp - 0x28], 0x66e8577d
mov eax, dword [rbp - 0x28]
mov dword [rbp - 0x34], eax
sub eax, 0x851b0722
je 0x180068ec4
jmp 0x180068d69
mov eax, dword [rbp - 0x34]
sub eax, 0x95f1a300
je 0x180068e7a
jmp 0x180068d7c
mov eax, dword [rbp - 0x34]
sub eax, 0x9967feb7
je 0x180068f21
jmp 0x180068d8f
mov eax, dword [rbp - 0x34]
sub eax, 0xa6b57a63
je 0x180068e63
jmp 0x180068da2
mov eax, dword [rbp - 0x34]
sub eax, 0xdbe70bc1
je 0x180068e96
jmp 0x180068db5
mov eax, dword [rbp - 0x34]
sub eax, 0xdec22af5
je 0x180068f0f
jmp 0x180068dc8
mov eax, dword [rbp - 0x34]
sub eax, 0xe157cb15
je 0x180068ed0
jmp 0x180068ddb
mov eax, dword [rbp - 0x34]
sub eax, 0xfc2d3b15
je 0x180068eb1
jmp 0x180068dee
mov eax, dword [rbp - 0x34]
sub eax, 0x20dd2a24
je 0x180068f03
jmp 0x180068e01
mov eax, dword [rbp - 0x34]
sub eax, 0x66e8577d
je 0x180068e2c
jmp 0x180068e14
mov eax, dword [rbp - 0x34]
sub eax, 0x76f6cc77
je 0x180068e4c
jmp 0x180068e27
jmp 0x180068f3f
mov eax, 0x10
call fcn.18008acc0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x28], 0x76f6cc77
jmp 0x180068f3f
mov rcx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x20]
mov qword [rax], rcx
mov dword [rbp - 0x28], 0xa6b57a63
jmp 0x180068f3f
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x28], 0x95f1a300
jmp 0x180068f3f
mov rax, qword [rbp - 0x18]
cmp rax, 0
sete al
and al, 1
mov byte [rbp - 0xd], al
mov dword [rbp - 0x28], 0xdbe70bc1
jmp 0x180068f3f
mov dl, byte [rbp - 0xd]
mov eax, 0xe157cb15
mov ecx, 0xfc2d3b15
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x180068f3f
mov dword [rbp - 0x24], 0xffffffff
mov dword [rbp - 0x28], 0x851b0722
jmp 0x180068f3f
mov dword [rbp - 0x28], 0xdec22af5
jmp 0x180068f3f
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
add rsp, 0x20
mov edx, eax
mov eax, 0xffffffff
xor ecx, ecx
cmp edx, 1
cmove eax, ecx
mov dword [rbp - 0x24], eax
mov dword [rbp - 0x28], 0x20dd2a24
jmp 0x180068f3f
mov dword [rbp - 0x28], 0xdec22af5
jmp 0x180068f3f
mov eax, dword [rbp - 0x24]
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x28], 0x9967feb7
jmp 0x180068f3f
mov eax, dword [rbp - 0xc]
mov dword [rbp - 0x38], eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
sub rsp, 0x20
call fcn.18008ac40
mov eax, dword [rbp - 0x38]
mov rsp, rbp
pop rbp
ret
jmp 0x180068d53
Function at 0x180068f50
Capabilities:
Delete directory

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x30], rcx
mov rax, qword [0x1800950a8]
xor rax, rbp
mov qword [rbp - 8], rax
mov dword [rbp - 0x28], 0x68b7730d
mov eax, dword [rbp - 0x28]
mov dword [rbp - 0x34], eax
sub eax, 0x8c6f3e01
je 0x1800690f0
jmp 0x180068f89
mov eax, dword [rbp - 0x34]
sub eax, 0xa8cdb189
je 0x1800690e4
jmp 0x180068f9c
mov eax, dword [rbp - 0x34]
sub eax, 0xa8f9763b
je 0x18006906c
jmp 0x180068faf
mov eax, dword [rbp - 0x34]
sub eax, 0xd00f1ce6
je 0x1800690d1
jmp 0x180068fc2
mov eax, dword [rbp - 0x34]
sub eax, 0xd47da104
je 0x180069083
jmp 0x180068fd5
mov eax, dword [rbp - 0x34]
sub eax, 0xf2326650
je 0x180069150
jmp 0x180068fe8
mov eax, dword [rbp - 0x34]
sub eax, 0x1f89a1ac
je 0x1800690b6
jmp 0x180068ffb
mov eax, dword [rbp - 0x34]
sub eax, 0x2297c358
je 0x18006913e
jmp 0x18006900e
mov eax, dword [rbp - 0x34]
sub eax, 0x24a1f5a0
je 0x18006909a
jmp 0x180069021
mov eax, dword [rbp - 0x34]
sub eax, 0x68b7730d
je 0x18006904c
jmp 0x180069034
mov eax, dword [rbp - 0x34]
sub eax, 0x76254ec0
je 0x18006911f
jmp 0x180069047
jmp 0x18006916e
mov eax, 0x10
call fcn.18008acc0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x28], 0xa8f9763b
jmp 0x18006916e
mov rcx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x20]
mov qword [rax], rcx
mov dword [rbp - 0x28], 0xd47da104
jmp 0x18006916e
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x28], 0x24a1f5a0
jmp 0x18006916e
mov rax, qword [rbp - 0x18]
cmp rax, 0
sete al
and al, 1
mov byte [rbp - 0xe], al
mov dword [rbp - 0x28], 0x1f89a1ac
jmp 0x18006916e
mov dl, byte [rbp - 0xe]
mov eax, 0x8c6f3e01
mov ecx, 0xd00f1ce6
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x18006916e
mov dword [rbp - 0x24], 0xffffffff
mov dword [rbp - 0x28], 0xa8cdb189
jmp 0x18006916e
mov dword [rbp - 0x28], 0x2297c358
jmp 0x18006916e
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
add rsp, 0x20
cmp eax, 1
sete al
and al, 1
mov byte [rbp - 0xd], al
mov al, byte [rbp - 0xd]
mov dword [rbp - 0x28], 0x76254ec0
jmp 0x18006916e
mov dl, byte [rbp - 0xd]
mov eax, 0xffffffff
xor ecx, ecx
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x24], eax
mov dword [rbp - 0x28], 0x2297c358
jmp 0x18006916e
mov eax, dword [rbp - 0x24]
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x28], 0xf2326650
jmp 0x18006916e
mov eax, dword [rbp - 0xc]
mov dword [rbp - 0x38], eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
sub rsp, 0x20
call fcn.18008ac40
mov eax, dword [rbp - 0x38]
mov rsp, rbp
pop rbp
ret
jmp 0x180068f73
Function at 0x180069180
Capabilities:
Create directory

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x30], rcx
mov rax, qword [0x1800950a8]
xor rax, rbp
mov qword [rbp - 8], rax
mov dword [rbp - 0x28], 0x39aa467c
mov eax, dword [rbp - 0x28]
mov dword [rbp - 0x34], eax
sub eax, 0x8d967160
je 0x180069314
jmp 0x1800691b9
mov eax, dword [rbp - 0x34]
sub eax, 0x9aadf6d0
je 0x180069353
jmp 0x1800691cc
mov eax, dword [rbp - 0x34]
sub eax, 0xa135e40a
je 0x1800692ca
jmp 0x1800691df
mov eax, dword [rbp - 0x34]
sub eax, 0xa1b5d40c
je 0x1800692e6
jmp 0x1800691f2
mov eax, dword [rbp - 0x34]
sub eax, 0xe8ee853f
je 0x180069372
jmp 0x180069205
mov eax, dword [rbp - 0x34]
sub eax, 0xf66648c5
je 0x180069320
jmp 0x180069218
mov eax, dword [rbp - 0x34]
sub eax, 0x3b095c
je 0x180069384
jmp 0x18006922b
mov eax, dword [rbp - 0x34]
sub eax, 0x1ade1ee0
je 0x18006929c
jmp 0x18006923e
mov eax, dword [rbp - 0x34]
sub eax, 0x1ecc25fb
je 0x1800692b3
jmp 0x180069251
mov eax, dword [rbp - 0x34]
sub eax, 0x39aa467c
je 0x18006927c
jmp 0x180069264
mov eax, dword [rbp - 0x34]
sub eax, 0x7cc22f2b
je 0x180069301
jmp 0x180069277
jmp 0x1800693a2
mov eax, 0x10
call fcn.18008acc0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x28], 0x1ade1ee0
jmp 0x1800693a2
mov rcx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x20]
mov qword [rax], rcx
mov dword [rbp - 0x28], 0x1ecc25fb
jmp 0x1800693a2
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x28], 0xa135e40a
jmp 0x1800693a2
mov rax, qword [rbp - 0x18]
cmp rax, 0
sete al
and al, 1
mov byte [rbp - 0xe], al
mov dword [rbp - 0x28], 0xa1b5d40c
jmp 0x1800693a2
mov dl, byte [rbp - 0xe]
mov eax, 0xf66648c5
mov ecx, 0x7cc22f2b
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x1800693a2
mov dword [rbp - 0x24], 0xffffffff
mov dword [rbp - 0x28], 0x8d967160
jmp 0x1800693a2
mov dword [rbp - 0x28], 0xe8ee853f
jmp 0x1800693a2
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
xor eax, eax
mov edx, eax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add rsp, 0x20
cmp eax, 1
sete al
and al, 1
mov byte [rbp - 0xd], al
mov al, byte [rbp - 0xd]
mov dword [rbp - 0x28], 0x9aadf6d0
jmp 0x1800693a2
mov dl, byte [rbp - 0xd]
mov eax, 0xffffffff
xor ecx, ecx
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x24], eax
mov dword [rbp - 0x28], 0xe8ee853f
jmp 0x1800693a2
mov eax, dword [rbp - 0x24]
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x28], 0x3b095c
jmp 0x1800693a2
mov eax, dword [rbp - 0xc]
mov dword [rbp - 0x38], eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
sub rsp, 0x20
call fcn.18008ac40
mov eax, dword [rbp - 0x38]
mov rsp, rbp
pop rbp
ret
jmp 0x1800691a3
Function at 0x18006aac0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x34], 0xc5c2c496
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x24], eax
sub eax, 0xc5c2c496
je 0x18006ab7a
jmp 0x18006aae9
mov eax, dword [rsp + 0x24]
sub eax, 0xcfd9ac09
je 0x18006ac25
jmp 0x18006aafd
mov eax, dword [rsp + 0x24]
sub eax, 0xe184dea3
je 0x18006abe4
jmp 0x18006ab11
mov eax, dword [rsp + 0x24]
sub eax, 0xe5feb11f
je 0x18006abfb
jmp 0x18006ab25
mov eax, dword [rsp + 0x24]
sub eax, 0x51d306f
je 0x18006aba8
jmp 0x18006ab39
mov eax, dword [rsp + 0x24]
sub eax, 0x16a65b34
je 0x18006abc7
jmp 0x18006ab4d
mov eax, dword [rsp + 0x24]
sub eax, 0x468f88ab
je 0x18006ac18
jmp 0x18006ab61
mov eax, dword [rsp + 0x24]
sub eax, 0x7ca860fd
je 0x18006ab91
jmp 0x18006ab75
jmp 0x18006ac2a
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], 0x7ca860fd
jmp 0x18006ac2a
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x34], 0x51d306f
jmp 0x18006ac2a
mov rax, qword [rsp + 0x40]
cmp rax, 0
setne al
and al, 1
mov byte [rsp + 0x4f], al
mov dword [rsp + 0x34], 0x16a65b34
jmp 0x18006ac2a
mov dl, byte [rsp + 0x4f]
mov eax, 0xcfd9ac09
mov ecx, 0xe184dea3
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x34], eax
jmp 0x18006ac2a
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x34], 0xe5feb11f
jmp 0x18006ac2a
mov rdx, qword [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x34], 0x468f88ab
jmp 0x18006ac2a
mov dword [rsp + 0x34], 0xcfd9ac09
jmp 0x18006ac2a
add rsp, 0x58
ret
jmp 0x18006aad1
Function at 0x18007f260
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x1800950a8]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rax, [0x18007f100]
xor r14d, r14d
mov qword [r11 - 0x78], rax
mov edi, 5
lea rax, [0x18007f140]
mov rbp, rcx
mov qword [r11 - 0x70], rax
mov ebx, r14d
lea rax, [0x18007f180]
mov esi, edi
mov qword [r11 - 0x68], rax
lea rax, [0x18007f1e0]
mov qword [r11 - 0x60], rax
lea rax, [0x18007f230]
mov qword [r11 - 0x58], rax
nop
mov r8, qword [rsp + rbx + 0x30]
xor edx, edx
mov r9, r8
mov qword [rsp + 0x28], r14
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + rbx + 0x58], rax
lea rbx, [rbx + 8]
sub rsi, 1
jne 0x18007f2d0
mov r9d, 0xffffffff
lea r8d, [rsi + 1]
lea rdx, [rsp + 0x58]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
lea rbx, [rsp + 0x58]
mov rcx, qword [rbx]
test rcx, rcx
je 0x18007f325
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 8
sub rdi, 1
jne 0x18007f317
lea ecx, [rdi + 0x38]
call fcn.18008ac6c
xor ecx, ecx
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov qword [rax + 0x30], rcx
mov rcx, qword [0x1817f6440]
mov r9, qword [0x1817f6448]
mov r8, qword [0x1817f6428]
mov rdx, qword [0x1817f6430]
mov qword [rsp + 0x28], rcx
mov rcx, qword [0x1817f6438]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call section..text
mov rdx, rbp
mov rcx, rax
call fcn.180001d70
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18008ac40
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x18007f5a0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rdi
sub rsp, 0x68
mov rdi, rcx
mov dword [rax - 0x38], 0
mov qword [rax - 0x30], rcx
mov qword [rax - 0x28], r8
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov eax, dword [rdx + 0x118]
shl eax, 0x10
or eax, dword [rdx + 0x11c]
cmp eax, 0x60000
jb 0x18007f618
call sub.msvcrt.dll__errno
lea rbx, [rax - 0x10]
mov rcx, qword [rbx + 8]
dec rcx
cmp rcx, 0xfffffffffffffffd
ja 0x18007f60f
xor ebx, ebx
lea ecx, [rbx + 0x10]
call qword [sym.imp.msvcrt.dll__amsg_exit]
mov rax, qword [rbx + 0xe0]
jmp 0x18007f640
call sub.msvcrt.dll__errno
lea rbx, [rax - 0x10]
mov rcx, qword [rbx + 8]
dec rcx
cmp rcx, 0xfffffffffffffffd
ja 0x18007f639
xor ebx, ebx
lea ecx, [rbx + 0x10]
call qword [sym.imp.msvcrt.dll__amsg_exit]
mov rax, qword [rbx + 0xd8]
lea rdx, [rsp + 0x48]
mov ecx, dword [rdi]
call rax
mov dword [rsp + 0x40], 0
jmp 0x18007f653
mov eax, dword [rsp + 0x40]
add rsp, 0x68
pop rdi
pop rbx
ret
Function at 0x1800815c0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov rax, qword gs:[0x30]
mov rsi, r9
mov r14, r8
mov rbp, rdx
mov rbx, rcx
mov r10, qword [rax + 0x60]
mov eax, dword [r10 + 0x118]
shl eax, 0x10
or eax, dword [r10 + 0x11c]
cmp eax, 0x60000
jb 0x180081634
call sub.msvcrt.dll__errno
lea rdi, [rax - 0x10]
mov rax, qword [rax - 8]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x18008162c
xor edi, edi
lea ecx, [rdi + 0x10]
call qword [sym.imp.msvcrt.dll__amsg_exit]
mov eax, dword [rdi + 0x2c0]
jmp 0x180081641
mov ecx, 1
call fcn.180086dc0
mov eax, dword [rax + 0x28]
mov rdi, qword [rsp + 0xa0]
test eax, eax
jne 0x18008167d
mov eax, dword [rbx]
cmp eax, 0xe06d7363
je 0x18008167d
cmp eax, 0x80000029
jne 0x18008166d
cmp dword [rbx + 0x18], 0xf
jne 0x180081674
cmp qword [rbx + 0x60], 0x19930520
je 0x18008167d
cmp eax, 0x80000026
je 0x18008167d
test byte [rdi], 0x20
jne 0x18008180a
mov r8d, dword [rbx + 4]
test r8b, 0x66
je 0x180081743
movsxd rax, dword [rdi + 8]
test eax, eax
je 0x18008180a
mov rdx, rax
lea r9, [0x180000000]
add rdx, qword [rsi + 8]
movzx ecx, byte [rdx]
and ecx, 0xf
movsx rax, byte [rcx + r9 + 0x8ce58]
movzx ecx, byte [rcx + r9 + 0x8ce68]
sub rdx, rax
mov eax, dword [rdx - 4]
shr eax, cl
test eax, eax
je 0x18008180a
cmp dword [rsp + 0xa8], 0
jne 0x18008180a
test r8b, 0x20
je 0x180081730
mov ecx, dword [rbx]
cmp ecx, 0x80000026
jne 0x180081710
mov r8, qword [rsi + 0x20]
mov rdx, rsi
mov rcx, rdi
call fcn.180082930
mov r9d, eax
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.180082020
jmp 0x18008180a
cmp ecx, 0x80000029
jne 0x180081730
mov r9d, dword [rbx + 0x38]
mov r8, rdi
mov rcx, qword [rbx + 0x28]
mov rdx, rsi
call fcn.180082020
jmp 0x18008180a
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.18007f7a0
jmp 0x18008180a
mov r8, qword [rsi + 8]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.180081830
cmp dword [rsp + 0x40], 0
jne 0x180081764
test byte [rdi], 0x40
je 0x18008180a
cmp dword [rbx], 0xe06d7363
jne 0x1800817d0
cmp dword [rbx + 0x18], 3
jb 0x1800817d0
cmp dword [rbx + 0x20], 0x19930522
jbe 0x1800817d0
mov rax, qword [rbx + 0x30]
cmp dword [rax + 8], 0
je 0x1800817d0
call fcn.1800800a0
mov rcx, qword [rbx + 0x30]
movsxd rdx, dword [rcx + 8]
add rax, rdx
je 0x1800817d0
movzx ecx, byte [rsp + 0xb8]
mov r9, rsi
mov dword [rsp + 0x38], ecx
mov r8, r14
mov rcx, qword [rsp + 0xb0]
mov rdx, rbp
mov qword [rsp + 0x30], rcx
mov ecx, dword [rsp + 0xa8]
mov dword [rsp + 0x28], ecx
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call rax
jmp 0x18008180f
mov rax, qword [rsp + 0xb0]
mov r9, rsi
mov qword [rsp + 0x38], rax
mov r8, r14
mov eax, dword [rsp + 0xa8]
mov rdx, rbp
mov dword [rsp + 0x30], eax
mov rcx, rbx
movzx eax, byte [rsp + 0xb8]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], rdi
call fcn.180080750
mov eax, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret