joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800126d0
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
cmp rax, rdi
je 0x1800127ed
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x1800127ed
test rbx, rbx
jne 0x180012721
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
xor eax, eax
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x38], eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea rdx, [rsp + 0x38]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r10d, dword [0x180069c80]
mov esi, eax
lea r9d, [r10 + 1]
mov eax, 0x2aaaaaab
mov r8d, r9d
imul r8d, r10d
imul r8d
mov eax, 0x2aaaaaab
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
shl ecx, 3
sub r8d, ecx
cmp r8d, 0x17
cmove r10d, r9d
mov dword [0x180069c80], r10d
lea ecx, [r10 + 1]
imul ecx, r10d
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
cmp ecx, 3
jne 0x1800127b3
dec r10d
mov dword [0x180069c80], r10d
mov r8d, 1
mov edx, esi
mov ecx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x1800127e0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
xor r8d, r8d
mov edx, esi
mov ecx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x180015100
Capabilities:
Capture webcam image

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [0x180069c80]
mov rbx, rcx
lea eax, [rdx + 1]
lea r8d, [rdx + 2]
imul r8d, eax
mov eax, 0x2e8ba2e9
imul r8d, edx
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub r8d, edx
cmp r8d, 7
jne 0x180015147
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x180069c80], eax
call fcn.180007750
mov rcx, qword [rbx + 0x28]
xor r9d, r9d
add eax, 0xc000
mov edx, 0x419
movsxd r8, eax
call qword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x180015173
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx + 0x28]
mov r8d, eax
xor r9d, r9d
mov edx, 0x416
call qword [sym.imp.USER32.dll_SendMessageA]
xor ecx, ecx
test rax, rax
setne cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x1800175f0
Capabilities:
Create directory
Move file

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rbx, rdx
mov rdi, rcx
call fcn.18001ad40
test al, al
je 0x180017791
cmp dword [rdi + 0x58], 1
jne 0x180017791
lea rdx, [rdi + 0x48]
lea r8, [0x180055dd0]
lea rcx, [rsp + 0x78]
call fcn.180001c40
nop
mov ecx, dword [rdi + 0x58]
add rcx, 0x10
lea r8, [rdi + rcx*8]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.180001b80
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x18001766e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov esi, 1
cmp dword [0x18006a9a8], 0
jne 0x180017694
mov rax, qword [rdi + 0x40]
cmp dword [rax - 0x10], 0
je 0x180017694
mov dword [0x18006a9a8], esi
mov rcx, rdi
call fcn.180018100
mov rcx, qword [rsp + 0x70]
mov rdx, rcx
call fcn.18002b470
test eax, eax
jns 0x1800176f7
mov r9d, dword [0x180069c80]
lea r8d, [r9 + 1]
mov ecx, r8d
imul ecx, r9d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 0xa
cmove r9d, r8d
mov dword [0x180069c80], r9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, esi
ja 0x1800176f7
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea r8, str._setev
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.180001c40
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x180017757
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rVariantCopy + 8]
cmp rdi, 0xffffffffffffffff
je 0x180017771
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180017773
xor esi, esi
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x18001778d
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rVariantCopy + 8]
mov eax, esi
jmp 0x18001779a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x180017dd0
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
push rdi
sub rsp, 0x3a0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x3b0], rbx
mov rax, qword [0x180066180]
xor rax, rsp
mov qword [rsp + 0x398], rax
mov rdi, rdx
mov r8d, dword [0x180069c80]
lea r9d, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, r9d
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xe
jne 0x180017e5a
test r8d, r8d
je 0x180017e50
dec r8d
je 0x180017e44
mov dword [0x180069c80], r9d
jmp 0x180017e5a
mov dword [0x180069c80], 0
jmp 0x180017e5a
mov dword [0x180069c80], 2
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r8d, dword [0x180069c80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
cmp ecx, 4
jne 0x180017e96
dec r8d
mov dword [0x180069c80], r8d
mov r8, qword [rdi]
mov edx, 0x104
lea rcx, [rsp + 0x170]
call fcn.18002b14c
lea r8, [0x180056a10]
mov edx, 0x104
lea rcx, [rsp + 0x170]
call fcn.18002b3f4
mov r8, qword [rdi]
mov edx, 0x104
lea rcx, [rsp + 0x280]
call fcn.18002b14c
lea r8, [0x180055dd0]
mov edx, 0x104
lea rcx, [rsp + 0x280]
call fcn.18002b3f4
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180017f57
lea r8, [rsp + 0x280]
mov edx, 0x104
lea rcx, [rsp + 0x170]
call fcn.18002b14c
nop dword [rax + rax]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180017f30
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
cmp eax, 0x12
je 0x180017f77
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x180017f73
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor al, al
jmp 0x180017fac
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
cmp eax, 1
sete bl
mov rdx, qword [rdi]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x180017fa9
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rVariantCopy + 8]
movzx eax, bl
mov rcx, qword [rsp + 0x398]
xor rcx, rsp
call fcn.1800289d0
mov rbx, qword [rsp + 0x3b0]
add rsp, 0x3a0
pop rdi
ret
Function at 0x180017fd0
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rsi, rdx
mov rdi, rcx
call fcn.18001ad40
test al, al
je 0x1800180e1
cmp dword [rdi + 0x58], 0
jne 0x1800180e1
mov dword [rsp + 0x70], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rdi + 0x60], rax
mov eax, dword [rdi + 0x58]
add rax, 0x10
lea rdx, [rdi + rax*8]
lea rcx, [rdi + 0x30]
call fcn.180001e20
lea rdx, [rdi + 0x48]
lea r8, [0x180055dd0]
lea rcx, [rsp + 0x30]
call fcn.180001c40
nop
lea r8, [rdi + 0x30]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.180001b80
nop
mov rdx, rax
lea rcx, [rdi + 0x50]
call fcn.180001e20
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x180018088
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1800180a1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
lea rdx, [rdi + 0x50]
mov rcx, rdi
call fcn.180018530
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x1800177b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1800180e1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or edx, 0xffffffff
mov rcx, rsi
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_WaitForSingleObject]

Function at 0x180018530
Capabilities:
Create directory
Move file

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x18006a9a8], 0
mov rbx, rdx
jne 0x18001855b
mov rax, qword [rcx + 0x40]
cmp dword [rax - 0x10], 0
je 0x18001855b
mov dword [0x18006a9a8], 1
call fcn.180018100
mov rcx, qword [rbx]
mov rdx, rcx
call fcn.18002b470
test eax, eax
jns 0x1800185c1
mov r9d, dword [0x180069c80]
mov eax, 0x2aaaaaab
lea r8d, [r9 + 1]
mov ecx, r8d
imul ecx, r9d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 0xa
cmove r9d, r8d
mov dword [0x180069c80], r9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 1
ja 0x1800185c1
mov rcx, qword [rbx]
xor edx, edx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add rsp, 0x20
pop rbx
ret
Function at 0x18001aca0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, dword [0x180069c80]
movzx edi, al
shr ax, 8
movzx esi, al
imul ecx, ecx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0xb
jne 0x18001ad0d
mov ecx, 4
mov qword [rsp + 0x30], rbx
call fcn.180029700
mov rbx, rax
call fcn.1800289f8
mov rcx, rbx
mov dword [rbx], eax
mov dword [0x180069c80], eax
call fcn.1800289b0
mov rbx, qword [rsp + 0x30]
cmp edi, 6
ja 0x18001ad26
jne 0x18001ad19
cmp esi, 1
ja 0x18001ad26
xor al, al
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18001adb0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
mov r8d, dword [0x180069c80]
mov eax, 0x38e38e39
lea ecx, [r8 + 1]
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 8
jne 0x18001ae22
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1800289f0
mov rcx, rax
call fcn.180028a24
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
setb al
add rsp, 0x28
ret
Function at 0x18001cdd0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x30
mov r10d, dword [0x180069c80]
mov rbx, rdx
mov eax, 0x2e8ba2e9
mov r9d, r10d
mov r11, r8
mov rdi, rcx
mov esi, 1
imul r9d, r10d
imul r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r9d, edx
cmp r9d, 7
jne 0x18001ce2c
test r10d, r10d
cmove r10d, esi
mov dword [0x180069c80], r10d
mov rdx, qword [r11]
lea rax, [rsp + 0x58]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x18001ce65
xor al, al
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx]
mov rdx, qword [rdi]
mov r9d, esi
mov eax, dword [rcx - 0x10]
xor r8d, r8d
mov qword [rsp + 0x40], rbp
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov r8d, dword [0x180069c80]
xor esi, esi
mov ebp, eax
mov eax, 0x66666667
imul r8d, r8d
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 0xd
jne 0x18001cef9
lea ecx, [rsi + 0x28]
call fcn.1800289f0
mov ebx, esi
mov rdi, rax
nop dword [rax]
call fcn.1800289f8
inc rbx
add eax, dword [0x180069c80]
mov dword [rdi + rbx*4 - 4], eax
cmp rbx, 0xa
jl 0x18001ced0
mov ecx, dword [rdi + 0x24]
mov dword [0x180069c80], ecx
mov rcx, rdi
call fcn.180028a24
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
test ebp, ebp
mov rbp, qword [rsp + 0x40]
sete al
add rsp, 0x30
pop rdi
ret
Function at 0x18001dc20
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rbx, rcx
xor eax, eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x68]
lea rcx, str.iexplore.exe
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov esi, eax
lea rcx, [0x180066048]
mov rdx, qword [0x180066048]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x30], 1
test esi, esi
je 0x18001dd0f
mov ecx, esi
call fcn.1800289f0
mov rdi, rax
mov r9, rax
mov r8d, esi
mov edx, dword [rsp + 0x68]
lea rcx, str.iexplore.exe
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x18001dd07
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x78]
lea rdx, [0x180055dd0]
mov rcx, rdi
call qword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x18001dd07
cmp dword [rsp + 0x70], 0
je 0x18001dd07
mov rdx, qword [rsp + 0x78]
cmp dword [rdx], 0xfeef04bd
jne 0x18001dd07
movzx eax, word [rdx + 0xc]
movzx ecx, word [rdx + 0xe]
movzx r9d, word [rdx + 8]
movzx r8d, word [rdx + 0xa]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str._d._d._d._d
mov rcx, rbx
call fcn.180003840
mov rcx, rdi
call fcn.180028a24
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180020030
Capabilities:
Get file version info

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rsi, rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x38]
call fcn.18001fba0
nop
mov rcx, qword [rsp + 0x38]
cmp dword [rcx - 0x10], ebx
jne 0x180020078
lea rdx, [0x180056ee0]
mov rcx, rsi
call fcn.180001aa0
jmp 0x18002024a
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x80], ebx
mov qword [rsp + 0x40], rbx
mov edx, dword [0x180069c80]
mov eax, edx
imul eax, edx
imul eax, edx
and eax, 0x8000000f
jge 0x1800200a4
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 0xc
jne 0x1800200b1
inc edx
mov dword [0x180069c80], edx
lea rdx, [rsp + 0x78]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov ebp, eax
lea rcx, [0x180066048]
mov rdx, qword [0x180066048]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x88], rax
lea rdx, [0x180056ee0]
test rdx, 0xffffffffffff0000
jne 0x18002010f
movzx edi, dx
mov ecx, edi
call fcn.180002840
test rax, rax
je 0x180020123
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.1800023e0
jmp 0x180020123
mov r8d, 3
lea rcx, [rsp + 0x88]
call fcn.180002020
nop
test ebp, ebp
je 0x18002021c
mov eax, dword [0x180069c80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 8
jne 0x18002018a
mov ecx, 0x28
call fcn.1800289f0
mov rdi, rax
call fcn.1800289f8
add eax, dword [0x180069c80]
mov dword [rdi + rbx*4], eax
inc rbx
cmp rbx, 0xa
jl 0x180020162
mov ecx, dword [rdi + 0x24]
mov dword [0x180069c80], ecx
mov rcx, rdi
call fcn.180028a24
mov rcx, rbp
call fcn.1800289f0
mov rbx, rax
mov r9, rax
mov r8d, ebp
mov edx, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x180020214
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x40]
lea rdx, [0x180055dd0]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x180020214
cmp dword [rsp + 0x80], 0
je 0x180020214
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0xfeef04bd
jne 0x180020214
movzx r8d, word [rax + 0xa]
movzx r9d, word [rax + 8]
movzx ecx, word [rax + 0xe]
movzx eax, word [rax + 0xc]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str._d._d._d._d
lea rcx, [rsp + 0x88]
call fcn.180003840
mov rcx, rbx
call fcn.180028a24
mov rdi, qword [rsp + 0x88]
lea rcx, [rdi - 0x18]
call fcn.180002110
add rax, 0x18
mov qword [rsi], rax
lock add dword [rdi - 8], 0xffffffff
jg 0x18002024a
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x180020263
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, rsi
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800203f0
Capabilities:
Check os version

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov rdi, rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx esi, al
movzx edx, ax
shr dx, 8
movzx ebp, dl
cmp eax, 0x80000000
jae 0x180020436
mov ebx, eax
shr ebx, 0x10
cmp esi, 6
jb 0x18002044a
cmp ebp, 2
jb 0x18002044a
mov rcx, rdi
call fcn.1800206d0
jmp 0x1800204a9
lea rcx, [0x180066048]
mov rax, qword [0x180066048]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], ebx
mov r9d, ebp
mov r8d, esi
lea rdx, str._d._d___d_
lea rcx, [rsp + 0x58]
call fcn.180003840
mov rbx, qword [rsp + 0x58]
lea rcx, [rbx - 0x18]
call fcn.180002110
add rax, 0x18
mov qword [rdi], rax
lock add dword [rbx - 8], 0xffffffff
jg 0x1800204a9
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + VariantCopy]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x180020c20
Capabilities:
Check os version

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x180066180]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r8d, dword [0x180069c80]
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x30c30c31
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 8
jne 0x180020c74
dec r8d
mov dword [0x180069c80], r8d
mov eax, dword [0x1800682e0]
cmp eax, 0xffffffff
jne 0x180020cb4
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x90
call fcn.18002c930
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [rsp + 0x24], 5
seta al
mov dword [0x1800682e0], eax
test eax, eax
setne al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800289d0
add rsp, 0xd8
ret
Function at 0x180025470
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x60
mov rax, qword [0x180066048]
mov r14, rcx
lea rcx, [0x180066048]
mov rdi, r9
mov rsi, r8
mov rbp, rdx
call qword [rax + 0x18]
lea rdx, [0x180057728]
add rax, 0x18
mov qword [rsp + 0x50], rax
test rdx, 0xffffffffffff0000
jne 0x1800254e1
movzx ebx, dx
mov ecx, ebx
call fcn.180002840
test rax, rax
je 0x1800254f1
lea rcx, [rsp + 0x50]
mov r8d, ebx
mov rdx, rax
call fcn.1800023e0
jmp 0x1800254f1
lea rcx, [rsp + 0x50]
mov r8d, 0x1e
call fcn.180002020
mov rax, qword [0x180066048]
lea rcx, [0x180066048]
call qword [rax + 0x18]
lea rdx, str.DllMain
add rax, 0x18
mov qword [rsp + 0x48], rax
test rdx, 0xffffffffffff0000
jne 0x18002553c
movzx ebx, dx
mov ecx, ebx
call fcn.180002840
test rax, rax
je 0x18002554c
lea rcx, [rsp + 0x48]
mov r8d, ebx
mov rdx, rax
call fcn.1800023e0
jmp 0x18002554c
lea rcx, [rsp + 0x48]
mov r8d, 7
call fcn.180002020
mov rax, qword [0x180066048]
lea rcx, [0x180066048]
call qword [rax + 0x18]
lea rdx, str.ButtonUtil.dll
add rax, 0x18
mov qword [rsp + 0x40], rax
test rdx, 0xffffffffffff0000
jne 0x180025597
movzx ebx, dx
mov ecx, ebx
call fcn.180002840
test rax, rax
je 0x1800255a7
lea rcx, [rsp + 0x40]
mov r8d, ebx
mov rdx, rax
call fcn.1800023e0
jmp 0x1800255a7
lea rcx, [rsp + 0x40]
mov r8d, 0xe
call fcn.180002020
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
call fcn.1800247b0
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1800255d4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1800255ed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x180025606
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r9, rdi
mov r8, rsi
mov rdx, rbp
mov rcx, r14
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
jmp qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
Function at 0x140005760
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140005797
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x1400057b8
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400057ba
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140005813
test ecx, ecx
jle 0x1400057f3
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140005813
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140005813
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret