joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800892c0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x460
mov rax, qword [0x180161180]
xor rax, rsp
mov qword [rsp + 0x458], rax
mov byte [rsp + 0x50], 0
lea rdi, [rsp + 0x51]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov qword [rsp + 0x450], 0
mov dword [rsp + 0x30], 0
cmp dword [0x180163d5c], 0
jne 0x180089323
jmp 0x180089447
lea rax, [rsp + 0x478]
mov qword [rsp + 0x38], rax
lea rdi, [rsp + 0x50]
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x470]
lea rcx, [rsp + 0x50]
call fcn.1800eb8d0
mov eax, dword [0x180163d5c]
and eax, 1
test eax, eax
je 0x18008936d
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x180163d5c]
and eax, 2
test eax, eax
je 0x1800893d3
lea rdx, [0x18000e748]
lea rcx, str.C:StarBurn.log
call fcn.1800ed4ac
mov qword [rsp + 0x450], rax
cmp qword [rsp + 0x450], 0
je 0x1800893d3
lea r8, [rsp + 0x50]
lea rdx, [0x180001de4]
mov rcx, qword [rsp + 0x450]
call fcn.1800ed1bc
mov rcx, qword [rsp + 0x450]
call fcn.1800ed160
mov rcx, qword [rsp + 0x450]
call fcn.1800ecf18
mov eax, dword [0x180163d5c]
and eax, 4
test eax, eax
je 0x1800893ea
lea rcx, [rsp + 0x50]
call fcn.1800ecdd0
mov eax, dword [0x180163d5c]
and eax, 8
test eax, eax
je 0x18008943e
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, ecx
lea rdx, [rsp + 0x50]
mov rcx, qword [0x18015e758]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x18015e758]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x458]
xor rcx, rsp
call fcn.1800eb430
add rsp, 0x460
pop rdi
ret
Function at 0x180089b30
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x50
mov dword [rsp + 0x48], 0x80004021
mov dword [rsp + 0x40], 0x78
mov dword [rsp + 0x44], 4
mov dword [rsp + 0x30], 0
movzx eax, byte [0x180163d58]
cmp eax, 1
jne 0x180089b6f
mov dword [rsp + 0x40], 0
jmp 0x180089c3f
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x18000ee70]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
jne 0x180089c30
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [0x180163d5c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [0x18000ee60]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x44], 0x104
lea rdi, str.C:StarBurn.log
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, str.C:StarBurn.log
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [0x18000ee50]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x48], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [0x180163d58], 1
mov dword [rsp + 0x40], 0
jmp 0x180089c63
mov eax, dword [rsp + 0x40]
add rsp, 0x50
pop rdi
ret
Function at 0x180092f00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x80
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x38], 0x1f
mov byte [rsp + 0x34], 0
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov rdx, qword [rsp + 0xa0]
add rdx, rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov byte [rsp + 0x34], al
movzx eax, byte [rsp + 0x34]
test eax, eax
jne 0x180093059
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
lea rcx, [0x180012558]
call fcn.1800892c0
mov ecx, 0x1020
call fcn.1800eb9ac
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x180092ff1
mov r8d, dword [rsp + 0x38]
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x20], eax
lea r9, [0x180012510]
mov edx, 5
mov rcx, qword [rsp + 0x58]
call fcn.18008d120
mov qword [rsp + 0x70], rax
jmp 0x180092ffa
mov qword [rsp + 0x70], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x18009303e
mov rcx, qword [rsp + 0x40]
call fcn.18008d1e0
mov rbx, rax
mov rcx, qword [rsp + 0x40]
call fcn.1800e3fe0
mov r8, rbx
mov edx, eax
lea rcx, [0x1800124a0]
call fcn.1800892c0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
lea rdx, [0x18015a158]
lea rcx, [rsp + 0x60]
call fcn.1800ec370
mov eax, dword [rsp + 0x4c]
cmp dword [rsp + 0x48], eax
je 0x1800930a1
mov rax, qword [rsp + 0x90]
movzx eax, byte [rax + 0x30]
test eax, eax
jne 0x180093075
jmp 0x1800930a1
mov ecx, dword [rsp + 0x48]
mov eax, dword [rsp + 0x30]
add eax, ecx
mov dword [rsp + 0x30], eax
mov ecx, dword [rsp + 0x48]
mov eax, dword [rsp + 0x4c]
sub eax, ecx
mov dword [rsp + 0x4c], eax
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180092f51
add rsp, 0x80
pop rbx
ret
Function at 0x1800a8830
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov dword [rsp + 4], 0
mov dword [rsp + 0xc], 0
mov dword [rsp + 8], 0
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x14], eax
mov byte [rsp + 0x10], 0
mov byte [rsp], 0
mov rax, qword [rsp + 0x48]
movzx edx, byte [rax]
shl edx, 0x11
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax + 1]
shl eax, 9
or edx, eax
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax + 2]
and eax, 0xfffffff8
shl eax, 1
or edx, eax
or edx, 8
mov rax, qword [rsp + 0x48]
movzx ecx, byte [rax + 2]
and ecx, 7
mov eax, edx
or eax, ecx
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
and eax, 0xff
mov ecx, eax
lea rax, [0x18015f7c0]
movzx edx, byte [rax + rcx]
shl edx, 0x11
mov eax, dword [rsp + 4]
shr eax, 8
and eax, 0xff
mov ecx, eax
lea rax, [0x18015f7c0]
movzx eax, byte [rax + rcx]
shl eax, 9
or edx, eax
mov eax, dword [rsp + 4]
shr eax, 0x10
and eax, 0xff
mov ecx, eax
lea rax, [0x18015f7c0]
movzx ecx, byte [rax + rcx]
shl ecx, 1
mov eax, edx
or eax, ecx
mov ecx, dword [rsp + 4]
shr ecx, 0x18
or eax, ecx
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x48]
movzx ecx, byte [rax + 4]
lea rax, [0x18015f7c0]
movzx edx, byte [rax + rcx]
shl edx, 9
or edx, 0x100
mov rax, qword [rsp + 0x48]
movzx ecx, byte [rax + 3]
lea rax, [0x18015f7c0]
movzx ecx, byte [rax + rcx]
mov eax, edx
or eax, ecx
mov dword [rsp + 0xc], eax
mov rax, qword [rsp + 0x18]
add rax, 1
mov qword [rsp + 0x18], rax
mov dword [rsp + 8], 0
mov eax, dword [rsp + 4]
shr eax, 0xc
mov ecx, dword [rsp + 4]
shr ecx, 4
xor eax, ecx
mov ecx, dword [rsp + 4]
shr ecx, 3
xor eax, ecx
xor eax, dword [rsp + 4]
mov byte [rsp + 0x10], al
mov eax, dword [rsp + 0xc]
shr eax, 0xe
and eax, 7
xor eax, dword [rsp + 0xc]
mov byte [rsp], al
movzx ecx, byte [rsp]
shl ecx, 3
movzx eax, byte [rsp]
shl eax, 6
xor ecx, eax
movzx eax, byte [rsp]
xor eax, ecx
mov byte [rsp], al
mov eax, dword [rsp + 0xc]
shr eax, 8
movzx ecx, byte [rsp]
shl ecx, 9
xor eax, ecx
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 4]
shr eax, 8
movzx ecx, byte [rsp + 0x10]
shl ecx, 0x11
xor eax, ecx
mov dword [rsp + 4], eax
movzx eax, byte [rsp + 0x10]
not eax
mov byte [rsp + 0x10], al
movzx eax, byte [rsp]
not eax
mov byte [rsp], al
movzx ecx, byte [rsp + 0x10]
movzx eax, byte [rsp]
add eax, dword [rsp + 8]
add eax, ecx
mov dword [rsp + 8], eax
mov rax, qword [rsp + 0x18]
sub rax, 1
mov qword [rsp + 0x18], rax
mov ecx, dword [rsp + 8]
and ecx, 0xff
mov rax, qword [rsp + 0x18]
mov byte [rax], cl
mov eax, dword [rsp + 8]
sar eax, 8
mov dword [rsp + 8], eax
mov eax, dword [rsp + 0x14]
sub eax, 1
mov dword [rsp + 0x14], eax
cmp dword [rsp + 0x14], 0
jg 0x1800a896d
add rsp, 0x28
ret
Function at 0x1800ab0b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x68
mov edx, 1
mov ecx, 0x800
call fcn.1800ed904
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
jne 0x1800ab131
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x48], eax
mov rcx, qword [rsp + 0x50]
call fcn.1800ecacc
jmp 0x1800ab18c
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov r8d, 0x800
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800ab163
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x48], eax
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x50]
mov ecx, 0x800
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call fcn.1800ecacc
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x1800ab590
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x68
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x48], 0
mov edx, 1
mov ecx, 0x800
call fcn.1800ed904
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
jne 0x1800ab63d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x48], eax
mov r8d, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x90]
lea rcx, [0x180019580]
call fcn.1800892c0
mov rcx, qword [rsp + 0x50]
call fcn.1800ecacc
jmp 0x1800ab6c5
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov r8d, 0x800
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800ab684
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x48], eax
mov r8d, dword [rsp + 0x58]
mov edx, dword [rsp + 0x48]
lea rcx, [0x180019510]
call fcn.1800892c0
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x50]
mov ecx, 0x800
rep movsb byte [rdi], byte [rsi]
mov rdi, qword [rsp + 0x88]
add rdi, 0x11000
xor eax, eax
mov ecx, 0x800
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call fcn.1800ecacc
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x1800be6f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov qword [rsp + 8], rax
mov dword [rsp + 4], 0
mov byte [rsp], 1
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax]
test eax, eax
jne 0x1800be7e7
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 1]
cmp eax, 0xff
jne 0x1800be7e7
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 2]
cmp eax, 0xff
jne 0x1800be7e7
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 3]
cmp eax, 0xff
jne 0x1800be7e7
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 4]
cmp eax, 0xff
jne 0x1800be7e7
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 5]
cmp eax, 0xff
jne 0x1800be7e7
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 6]
cmp eax, 0xff
jne 0x1800be7e7
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 7]
cmp eax, 0xff
jne 0x1800be7e7
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 8]
cmp eax, 0xff
jne 0x1800be7e7
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 9]
cmp eax, 0xff
jne 0x1800be7e7
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 0xa]
cmp eax, 0xff
jne 0x1800be7e7
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 0xb]
test eax, eax
jne 0x1800be7e7
mov dword [rsp + 0x10], 1
jmp 0x1800be7ef
mov dword [rsp + 0x10], 0
cmp dword [rsp + 0x10], 1
jne 0x1800be873
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 0xf]
mov byte [rsp], al
movzx eax, byte [rsp]
and eax, 3
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x1800be873
mov rax, qword [0x180163d48]
add rax, 1
mov qword [0x180163d48], rax
mov dword [rsp + 4], 3
jmp 0x1800be83b
mov eax, dword [rsp + 4]
add eax, 1
mov dword [rsp + 4], eax
cmp dword [rsp + 4], 0x24c
jge 0x1800be873
movsxd r8, dword [rsp + 4]
movsxd rdx, dword [rsp + 4]
lea rax, [0x180160150]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rdx*4]
mov edx, dword [rcx + r8*4]
xor edx, eax
movsxd rcx, dword [rsp + 4]
mov rax, qword [rsp + 8]
mov dword [rax + rcx*4], edx
jmp 0x1800be830
add rsp, 0x28
ret
Function at 0x1800c1a80
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov rax, qword [0x180161180]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0x40], 0
lea rdi, [rsp + 0x44]
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x30], 0x1f
lea rdi, [rsp + 0x40]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov eax, dword [rsp + 0xd0]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0xe0]
movzx eax, byte [rax]
mov byte [rsp + 0x48], al
mov rdx, qword [rsp + 0xe0]
add rdx, 1
mov r8d, 5
lea rcx, [rsp + 0x49]
call fcn.1800eb460
movzx eax, byte [rsp + 0x4e]
or al, 1
mov byte [rsp + 0x4e], al
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, 0x10
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800c1c0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov edx, dword [rsp + 0x30]
lea rcx, [0x180026820]
call fcn.1800892c0
mov ecx, 0x1020
call fcn.1800eb9ac
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x1800c1bd0
mov r8d, dword [rsp + 0x30]
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
lea r9, [0x1800267d0]
mov edx, 5
mov rcx, qword [rsp + 0x68]
call fcn.18008d120
mov qword [rsp + 0x98], rax
jmp 0x1800c1bdc
mov qword [rsp + 0x98], 0
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
lea rdx, [0x18015a158]
lea rcx, [rsp + 0x70]
call fcn.1800ec370
mov eax, dword [rsp + 0x50]
cmp rax, 0x10
je 0x1800c1cca
mov r8d, 0x10
mov edx, dword [rsp + 0x50]
lea rcx, [0x180026760]
call fcn.1800892c0
mov ecx, 0x1020
call fcn.1800eb9ac
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x1800c1c86
mov qword [rsp + 0x28], 0x10
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x20], eax
lea r9, [0x1800266f0]
xor r8d, r8d
mov edx, 0xa
mov rcx, qword [rsp + 0x80]
call fcn.18008d120
mov qword [rsp + 0xa0], rax
jmp 0x1800c1c92
mov qword [rsp + 0xa0], 0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x88], rax
lea rdx, [0x18015a158]
lea rcx, [rsp + 0x88]
call fcn.1800ec370
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1800eb430
add rsp, 0xb0
pop rdi
ret
Function at 0x1800e1c40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x54], 0
mov r8, qword [rsp + 0xb0]
add r8, 0x12a6
lea r9, [rsp + 0x40]
mov edx, 0x104
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
jne 0x1800e1d67
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0xb8]
lea rcx, [0x180035d40]
call fcn.1800892c0
mov ecx, 0x1020
call fcn.1800eb9ac
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x1800e1d29
mov r8d, dword [rsp + 0x50]
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [0x180035cd0]
mov edx, 5
mov rcx, qword [rsp + 0x60]
call fcn.18008d120
mov qword [rsp + 0x90], rax
jmp 0x1800e1d35
mov qword [rsp + 0x90], 0
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x68], rax
lea rdx, [0x18015a158]
lea rcx, [rsp + 0x68]
call fcn.1800ec370
mov rcx, qword [rsp + 0xb0]
add rcx, 0x12a6
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov r11d, eax
mov rax, qword [rsp + 0xb0]
mov dword [rax + 0x34], r11d
mov rax, qword [rsp + 0xb0]
cmp dword [rax + 0x34], 0xffffffff
jne 0x1800e1e62
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
mov r9d, dword [rsp + 0x50]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0xb8]
lea rcx, [0x180035c50]
call fcn.1800892c0
mov ecx, 0x1020
call fcn.1800eb9ac
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
je 0x1800e1e1e
mov r8d, dword [rsp + 0x50]
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [0x180035be0]
mov edx, 5
mov rcx, qword [rsp + 0x78]
call fcn.18008d120
mov qword [rsp + 0x98], rax
jmp 0x1800e1e2a
mov qword [rsp + 0x98], 0
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x80], rax
lea rdx, [0x18015a158]
lea rcx, [rsp + 0x80]
call fcn.1800ec370
mov rax, qword [rsp + 0xb0]
movsx eax, byte [rax + 0x11a6]
test eax, eax
jne 0x1800e1ebf
cmp qword [rsp + 0x40], 0
je 0x1800e1e9e
mov rcx, qword [rsp + 0xb0]
add rcx, 0x11a6
mov r8d, 0xff
mov rdx, qword [rsp + 0x40]
call fcn.1800eb2b0
jmp 0x1800e1ebf
mov rcx, qword [rsp + 0xb0]
add rcx, 0x11a6
mov r8d, 0xff
lea rdx, [0x180035bd8]
call fcn.1800eb2b0
add rsp, 0xa8
ret
Function at 0x1800ea9d0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x180161180]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, r8
cmp edx, 1
jne 0x1800eaad3
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1800eaa15
xor eax, eax
jmp 0x1800eab6f
mov r8d, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x30]
and r8d, 0x7fff
cmp eax, 2
je 0x1800eaa2f
bts r8d, 0xf
mov edx, dword [rsp + 0x24]
mov dword [0x180163db4], eax
mov eax, dword [rsp + 0x28]
mov ecx, edx
mov dword [0x180163dc0], edx
mov dword [0x180163dc4], eax
shl ecx, 8
mov dword [0x180163db8], r8d
add ecx, eax
mov dword [0x180163dbc], ecx
mov ecx, 1
call fcn.1800f06b8
test eax, eax
je 0x1800eaa0e
call fcn.1800efd9c
test eax, eax
jne 0x1800eaa7b
call fcn.1800f072c
jmp 0x1800eaa0e
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x180176b88], rax
call fcn.1800f05bc
mov qword [0x180163d70], rax
call fcn.1800efe24
test eax, eax
jns 0x1800eaaa4
call fcn.1800efa6c
jmp 0x1800eaa74
call fcn.1800f04c0
test eax, eax
js 0x1800eaacc
call fcn.1800f015c
test eax, eax
js 0x1800eaacc
xor ecx, ecx
call fcn.1800ef7d4
test eax, eax
jne 0x1800eaacc
inc dword [0x180163d68]
jmp 0x1800eab6a
call fcn.1800f00e8
jmp 0x1800eaa9d
test edx, edx
jne 0x1800eab10
mov eax, dword [0x180163d68]
test eax, eax
jle 0x1800eaa0e
dec eax
mov dword [0x180163d68], eax
cmp dword [0x180163e10], edx
jne 0x1800eaafa
call fcn.1800ef9c8
test rbx, rbx
jne 0x1800eab6a
call fcn.1800f00e8
call fcn.1800efa6c
call fcn.1800f072c
jmp 0x1800eab6a
cmp edx, 2
jne 0x1800eab5e
call fcn.1800fb824
mov edx, 0x2d8
mov ecx, 1
call fcn.1800ed904
mov rbx, rax
test rax, rax
je 0x1800eaa0e
mov ecx, dword [0x180161798]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
mov rcx, rbx
test eax, eax
je 0x1800eab54
xor edx, edx
call fcn.1800efa98
jmp 0x1800eab6a
call fcn.1800ecacc
jmp 0x1800eaa0e
cmp edx, 3
jne 0x1800eab6a
xor ecx, ecx
call fcn.1800efd58
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800eb430
add rsp, 0x150
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov ebx, edx
mov rsi, rcx
cmp edx, 1
jne 0x1800eabb1
call fcn.1800f0750
mov r8, rdi
mov edx, ebx
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1800ea9d0
Function at 0x1800eab90
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x180161180]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, r8
cmp edx, 1
jne 0x1800eaad3
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1800eaa15
xor eax, eax
jmp 0x1800eab6f
mov r8d, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x30]
and r8d, 0x7fff
cmp eax, 2
je 0x1800eaa2f
bts r8d, 0xf
mov edx, dword [rsp + 0x24]
mov dword [0x180163db4], eax
mov eax, dword [rsp + 0x28]
mov ecx, edx
mov dword [0x180163dc0], edx
mov dword [0x180163dc4], eax
shl ecx, 8
mov dword [0x180163db8], r8d
add ecx, eax
mov dword [0x180163dbc], ecx
mov ecx, 1
call fcn.1800f06b8
test eax, eax
je 0x1800eaa0e
call fcn.1800efd9c
test eax, eax
jne 0x1800eaa7b
call fcn.1800f072c
jmp 0x1800eaa0e
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x180176b88], rax
call fcn.1800f05bc
mov qword [0x180163d70], rax
call fcn.1800efe24
test eax, eax
jns 0x1800eaaa4
call fcn.1800efa6c
jmp 0x1800eaa74
call fcn.1800f04c0
test eax, eax
js 0x1800eaacc
call fcn.1800f015c
test eax, eax
js 0x1800eaacc
xor ecx, ecx
call fcn.1800ef7d4
test eax, eax
jne 0x1800eaacc
inc dword [0x180163d68]
jmp 0x1800eab6a
call fcn.1800f00e8
jmp 0x1800eaa9d
test edx, edx
jne 0x1800eab10
mov eax, dword [0x180163d68]
test eax, eax
jle 0x1800eaa0e
dec eax
mov dword [0x180163d68], eax
cmp dword [0x180163e10], edx
jne 0x1800eaafa
call fcn.1800ef9c8
test rbx, rbx
jne 0x1800eab6a
call fcn.1800f00e8
call fcn.1800efa6c
call fcn.1800f072c
jmp 0x1800eab6a
cmp edx, 2
jne 0x1800eab5e
call fcn.1800fb824
mov edx, 0x2d8
mov ecx, 1
call fcn.1800ed904
mov rbx, rax
test rax, rax
je 0x1800eaa0e
mov ecx, dword [0x180161798]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
mov rcx, rbx
test eax, eax
je 0x1800eab54
xor edx, edx
call fcn.1800efa98
jmp 0x1800eab6a
call fcn.1800ecacc
jmp 0x1800eaa0e
cmp edx, 3
jne 0x1800eab6a
xor ecx, ecx
call fcn.1800efd58
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800eb430
add rsp, 0x150
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov ebx, edx
mov rsi, rcx
cmp edx, 1
jne 0x1800eabb1
call fcn.1800f0750
mov r8, rdi
mov edx, ebx
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1800ea9d0