joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140029be4
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001d184
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001d184
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140029d34
cmp rax, 0xffffffffffffffff
je 0x140029d34
xor edi, edi
test rbp, rbp
jle 0x140029cdf
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001fe04
mov rbx, rax
test rax, rax
jne 0x140029c6c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140029cd5
mov edx, 0x8000
mov ecx, r14d
call fcn.14001ab20
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001de60
cmp eax, 0xffffffff
je 0x140029cb5
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029c7c
mov edx, r15d
mov ecx, r14d
call fcn.14001ab20
jmp 0x140029cd5
cmp byte [rsi + 0x38], dil
je 0x140029ccc
cmp dword [rsi + 0x34], 5
jne 0x140029ccc
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140029cd5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b464
jmp 0x140029d48
jns 0x140029d48
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001d184
cmp rax, 0xffffffffffffffff
jne 0x140029d00
cmp byte [rsi + 0x30], dil
je 0x140029d48
mov edi, dword [rsi + 0x2c]
jmp 0x140029d48
mov ecx, r14d
call fcn.140019658
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
jne 0x140029d48
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029d48
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029d41
mov eax, dword [rsi + 0x2c]
jmp 0x140029d46
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001d184
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002ae40
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002ae68
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002ae68
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180002200
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor r10d, r10d
or r8d, 0xffffffff
mov rbx, rcx
cmp dword [0x1800c75d4], r10d
lea rdi, [0x1800c71d0]
jne 0x180002269
mov r9d, r10d
mov r11, rdi
nop word [rax + rax]
mov eax, r9d
mov ecx, 8
test al, 1
je 0x180002245
shr eax, 1
xor eax, 0xedb88320
jmp 0x180002247
shr eax, 1
dec rcx
jne 0x180002238
inc r9d
mov dword [r11], eax
add r11, 4
cmp r9d, 0x100
jl 0x180002230
mov dword [0x1800c75d4], 1
movsxd rdx, edx
test rdx, rdx
jle 0x180002294
movzx ecx, byte [r10 + rbx]
mov eax, r8d
inc r10
xor rcx, rax
movzx eax, cl
mov ecx, r8d
mov r8d, dword [rdi + rax*4]
shr ecx, 8
xor r8d, ecx
cmp r10, rdx
jl 0x180002271
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov eax, r8d
ret
Function at 0x180003870
Capabilities:
Copy file
Delete file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x140
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rbp, rdx
mov rdi, rcx
mov rax, qword [rcx + 0x10]
test rax, rax
jne 0x1800038a6
xor eax, eax
jmp 0x180003980
cmp qword [rdx + 0x10], 0
jbe 0x18000389f
xor esi, esi
test rax, rax
je 0x18000397e
cmp qword [rcx + 0x18], 8
jb 0x1800038c4
mov rdx, qword [rcx]
jmp 0x1800038c7
mov rdx, rcx
mov r8d, 1
lea rcx, [rsp + 0x30]
call fcn.1800055b0
mov r11, qword [rsp + 0x30]
movsxd rax, dword [r11 + 4]
mov ebx, esi
cmp dword [rsp + rax + 0x40], ebx
sete bl
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x150], rcx
lea rcx, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rax + 0x30], rcx
lea rcx, [rsp + 0x40]
call fcn.180005710
nop
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x30], rax
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0xe0], rax
lea rcx, [rsp + 0xe0]
call fcn.18003a1fc
test ebx, ebx
je 0x18000397e
mov rcx, rbp
call fcn.1800051b0
mov rbx, rax
mov rcx, rdi
call fcn.1800051b0
mov rcx, rax
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
test eax, eax
je 0x18000397e
mov rcx, rdi
call fcn.1800051b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, esi
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180004290
Capabilities:
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x1c8], rbx
mov rax, qword [0x1800b37f0]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov qword [rsp + 0x28], r8
mov r12, rdx
mov r13, rcx
xor r15d, r15d
mov esi, r15d
mov dword [rsp + 0x20], r15d
test rcx, rcx
je 0x18000446f
test rdx, rdx
je 0x18000446f
mov edi, r15d
lea r14, vtable.std::ios_base.0
lea rbx, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
lea rdx, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
lea rcx, [0x180089ab0]
mov qword [rsp + 0x40], rcx
or esi, 1
mov dword [rsp + 0x20], esi
mov qword [rbp - 0x38], rdx
lea rcx, [rbp - 0x38]
call fcn.180001ce0
lea r11, [rsp + 0x48]
mov qword [rbp + 0x10], r11
mov qword [rbp + 0x18], r15
lea rcx, [rbp - 0x38]
call fcn.18000b2c0
mov word [rbp + 0x20], ax
cmp qword [rbp + 0x10], 0
jne 0x18000435b
mov edx, dword [rbp - 0x28]
or edx, 4
xor r8d, r8d
lea rcx, [rbp - 0x38]
call fcn.180001b70
nop
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + rcx + 0x40], rax
lea rcx, [rsp + 0x48]
call fcn.1800094b0
nop
mov qword [rsp + 0x48], rbx
mov qword [rbp - 0x48], r15
mov dword [rbp - 0x40], 4
mov rdx, r13
lea rcx, [rsp + 0x40]
call fcn.18000c3c0
mov rcx, rax
test edi, edi
je 0x1800043b1
call fcn.18000c620
mov rcx, rax
mov edx, edi
call fcn.180004920
mov rcx, rax
lea rdx, [0x180089780]
call fcn.18000c3c0
mov rdx, r12
mov rcx, rax
call fcn.18000c3c0
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.180006350
cmp qword [rax + 0x18], 8
jb 0x1800043e0
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp qword [rbp + 0x48], 8
jb 0x1800043fb
mov rcx, qword [rbp + 0x30]
call fcn.18003ad20
cmp ebx, 0xffffffff
je 0x18000441d
inc edi
lea rcx, [rbp - 0x38]
call fcn.1800062a0
mov qword [rbp - 0x38], r14
lea rcx, [rbp - 0x38]
call fcn.18003a1fc
jmp 0x1800042f9
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.180006350
nop
mov rdx, rax
mov rcx, qword [rsp + 0x28]
call fcn.180007280
nop
cmp qword [rbp + 0x48], 8
jb 0x18000444b
mov rcx, qword [rbp + 0x30]
call fcn.18003ad20
nop
lea rcx, [rbp - 0x38]
call fcn.1800062a0
lea rax, vtable.std::ios_base.0
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x38]
call fcn.18003a1fc
mov eax, 1
jmp 0x180004471
xor eax, eax
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.18003aad0
mov rbx, qword [rsp + 0x1c8]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180004660
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1800b37f0]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edi, edi
xor r9d, r9d
mov edx, 0x80000000
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800046b2
xor eax, eax
jmp 0x1800047e7
lea rdx, [rsp + 0x44]
mov rcx, rax
mov dword [rsp + 0x44], edi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 8
jae 0x1800046dd
cmp dword [rsp + 0x44], edi
jne 0x1800046dd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800047e5
xor eax, eax
mov qword [rsp + 0x78], rbx
mov ebx, edi
mov qword [rsp + 0x48], rax
nop dword [rax + rax]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, rsi
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, ebx
mov r8d, 8
lea r9, [rsp + 0x40]
lea rdx, [rsp + rax + 0x48]
mov rcx, rsi
sub r8d, ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180004735
add ebx, dword [rsp + 0x40]
cmp ebx, 8
jb 0x1800046f0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x48]
call fcn.180004240
lea rcx, [rsp + 0x4c]
mov ebx, eax
call fcn.180004240
mov r11d, eax
mov eax, ebx
shr eax, 0x10
cmp eax, 0x8950
ja 0x1800047a7
je 0x180004798
cmp eax, 0x2550
je 0x180004789
cmp eax, 0x424d
je 0x1800047c3
cmp eax, 0x504b
jne 0x1800047e0
cmp ebx, 0x504b0304
jne 0x1800047e0
mov edi, 4
jmp 0x1800047e0
cmp ebx, 0x25504446
jne 0x1800047e0
mov edi, 2
jmp 0x1800047e0
cmp ebx, 0x89504e47
jne 0x1800047e0
mov edi, 3
jmp 0x1800047e0
cmp eax, 0xd0cf
je 0x1800047ca
cmp eax, 0xffd8
jne 0x1800047e0
and ebx, 0xffffff00
cmp ebx, 0xffd8ff00
jne 0x1800047e0
mov edi, 3
jmp 0x1800047e0
cmp ebx, 0xd0cf11e0
jne 0x1800047e0
cmp r11d, 0xa1b11ae1
jne 0x1800047e0
mov edi, 1
mov rbx, qword [rsp + 0x78]
mov eax, edi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18003aad0
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x1800113a0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1800b37f0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rdx
mov rdi, rcx
mov qword [r11 - 0x48], rdx
call fcn.1800110e0
xor esi, esi
test eax, eax
je 0x180011453
cmp qword [rbx + 0x10], rsi
je 0x180011453
lea r9d, [rsi + 2]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x30], esi
cmp qword [rbx + 0x18], 8
jb 0x180011409
mov rdx, qword [rbx]
jmp 0x18001140c
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.180011160
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rdx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x58]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rsp + 0x60], 0x10
jb 0x180011453
mov rcx, qword [rsp + 0x48]
call fcn.18003ad20
nop
cmp qword [rbx + 0x18], 8
jb 0x180011462
mov rcx, qword [rbx]
call fcn.18003ad20
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
mov word [rbx], si
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18003aad0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x180011850
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1800c9a80]
test ecx, ecx
jne 0x180011950
mov eax, dword [0x1800c9a84]
cmp eax, 3
jge 0x180011950
lea r8d, [rcx + 8]
inc eax
lea rcx, str.OcpFrame64.dll
xor edx, edx
mov qword [rsp + 0x20], rbx
mov dword [0x1800c9a84], eax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
je 0x180011940
lea rdx, str.OFCInit
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OFCUnInit
mov rcx, rbx
mov qword [0x1800c75e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OFCDoFunc
mov rcx, rbx
mov qword [0x1800c75f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OFFreeReply
mov rcx, rbx
mov qword [0x1800c75f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OFCIsServerStart
mov rcx, rbx
mov qword [0x1800c7600], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OFSSetReqAndWaitReply
mov rcx, rbx
mov qword [0x1800c7608], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov qword [0x1800c7610], rax
mov dword [0x1800c9a80], 1
mov eax, 1
add rsp, 0x28
ret
mov eax, dword [0x1800c9a80]
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret
Function at 0x180011f30
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
ja 0x180011f4b
mov eax, 0xe8030003
add rsp, 0x20
pop rbx
ret
cmp dword [rcx + 0x80], 0
jne 0x180011f5f
mov eax, 0xe8031002
add rsp, 0x20
pop rbx
ret
cmp dword [rcx + 0x7c], 0
jne 0x180011f70
mov eax, 0xe8031004
add rsp, 0x20
pop rbx
ret
mov rax, qword [rcx]
call qword [rax + 0x30]
test ax, ax
je 0x180011f8a
mov rax, qword [rbx]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [rax + 0x30]
cmp dword [rbx + 0x70], 0
jne 0x180011fb3
cmp qword [rbx + 0x18], 0
lea rcx, [rbx + 8]
ja 0x180011f9f
xor eax, eax
jmp 0x180011fb0
lea r9, [rbx + 0x68]
lea r8, [rbx + 0x60]
lea rdx, [rbx + 0x58]
call fcn.180002f20
mov dword [rbx + 0x70], eax
cmp dword [rbx + 0x74], 0
jne 0x180012015
cmp qword [rbx + 0x20], 8
mov qword [rsp + 0x30], rdi
lea rdi, [rbx + 8]
jb 0x180011fce
mov rcx, qword [rdi]
jmp 0x180011fd1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180012010
mov dword [rbx + 0x8c], eax
mov dword [rbx + 0x74], 1
test al, 1
je 0x180012010
cmp qword [rdi + 0x18], 8
jb 0x180011ff7
mov rdi, qword [rdi]
mov edx, 0x80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x180012010
mov dword [rbx + 0x78], 1
mov rdi, qword [rsp + 0x30]
mov eax, 0xe8030000
add rsp, 0x20
pop rbx
ret
Function at 0x180012020
Capabilities:
Set file attributes
Timestomp file

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x18], 0
mov rbx, rcx
jbe 0x1800121ab
cmp dword [rcx + 0x80], 0
je 0x1800121ab
cmp dword [rcx + 0x7c], 0
je 0x1800121ab
mov qword [rsp + 0x78], rbp
xor ebp, ebp
cmp dword [rcx + 0x70], ebp
je 0x180012170
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x70], rbp
cmp qword [rcx + 0x18], rbp
jbe 0x1800120d2
add rcx, 8
call fcn.1800051b0
mov qword [rsp + 0x30], rbp
lea r8d, [rbp + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
test rax, rax
je 0x1800120d2
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x58]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jne 0x18001210b
lea rdx, [rbx + 0x60]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jne 0x18001210b
lea rdx, [rbx + 0x68]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
je 0x180012166
cmp qword [rbx + 0x18], rbp
jbe 0x180012166
lea rcx, [rbx + 8]
call fcn.1800051b0
xor r9d, r9d
mov qword [rsp + 0x30], rbp
lea r8d, [r9 + 1]
mov edx, 0x100
mov rcx, rax
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
test rax, rax
je 0x180012166
lea r9, [rbx + 0x68]
lea r8, [rbx + 0x60]
lea rdx, [rbx + 0x58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
cmp dword [rbx + 0x74], ebp
je 0x1800121a6
cmp dword [rbx + 0x78], ebp
je 0x1800121a6
cmp qword [rbx + 0x20], 8
lea rcx, [rbx + 8]
jb 0x180012188
mov rcx, qword [rcx]
mov edx, dword [rbx + 0x8c]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1800121a6
mov qword [rbx + 0x74], rbp
mov dword [rbx + 0x8c], 0x80
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop rbx
ret
Function at 0x180021ca0
Capabilities:
Get file size

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x80
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x1800b37f0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, r8
mov r13d, edx
mov r12, rcx
test rcx, rcx
jne 0x180021cf0
test rbx, rbx
je 0x180021ce9
mov dword [r8], 0xe8030003
xor eax, eax
jmp 0x180021e1e
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbp + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x180021d3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
sete bpl
mov ecx, 0xe8031002
add ebp, ecx
mov dword [rbx], ebp
xor eax, eax
jmp 0x180021e1e
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x180021d66
mov dword [rbx], 0xe8030007
xor eax, eax
jmp 0x180021e1e
mov edx, r13d
mov rcx, r12
call fcn.180020430
mov rsi, rax
test rax, rax
je 0x180021db5
cmp dword [rax], 0xa1b2c3df
jne 0x180021db5
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x180021db5
call fcn.180011f30
mov edi, eax
test ax, ax
jne 0x180021da1
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
call qword [rax]
mov edi, eax
test di, di
je 0x180021e14
xor edx, edx
mov rcx, rsi
call fcn.180021e50
mov rsi, rbp
jmp 0x180021e14
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rbp
mov word [rsp + 0x48], bp
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.180007540
nop
lea rcx, [rsp + 0x48]
call fcn.180002960
mov edi, 0xe803ffff
mov ecx, 0xe8031002
test eax, eax
cmove edi, ecx
cmp qword [rsp + 0x60], 8
jb 0x180021e14
mov rcx, qword [rsp + 0x48]
call fcn.18003ad20
test rbx, rbx
je 0x180021e1b
mov dword [rbx], edi
mov rax, rsi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18003aad0
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
jmp 0x180021ca0
Function at 0x180033d40
Capabilities:
Get file size

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x80
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x1800b37f0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, r8
mov r13d, edx
mov r12, rcx
test rcx, rcx
jne 0x180021cf0
test rbx, rbx
je 0x180021ce9
mov dword [r8], 0xe8030003
xor eax, eax
jmp 0x180021e1e
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbp + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x180021d3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
sete bpl
mov ecx, 0xe8031002
add ebp, ecx
mov dword [rbx], ebp
xor eax, eax
jmp 0x180021e1e
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x180021d66
mov dword [rbx], 0xe8030007
xor eax, eax
jmp 0x180021e1e
mov edx, r13d
mov rcx, r12
call fcn.180020430
mov rsi, rax
test rax, rax
je 0x180021db5
cmp dword [rax], 0xa1b2c3df
jne 0x180021db5
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x180021db5
call fcn.180011f30
mov edi, eax
test ax, ax
jne 0x180021da1
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
call qword [rax]
mov edi, eax
test di, di
je 0x180021e14
xor edx, edx
mov rcx, rsi
call fcn.180021e50
mov rsi, rbp
jmp 0x180021e14
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rbp
mov word [rsp + 0x48], bp
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.180007540
nop
lea rcx, [rsp + 0x48]
call fcn.180002960
mov edi, 0xe803ffff
mov ecx, 0xe8031002
test eax, eax
cmove edi, ecx
cmp qword [rsp + 0x60], 8
jb 0x180021e14
mov rcx, qword [rsp + 0x48]
call fcn.18003ad20
test rbx, rbx
je 0x180021e1b
mov dword [rbx], edi
mov rax, rsi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18003aad0
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
jmp 0x180021ca0
Function at 0x180036500
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
shr edx, 4
mov rsi, r9
inc dx
movzx r9d, r8w
mov rdi, rcx
movzx r8d, dx
mov edx, 6
and ebx, 0xf
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x18003656b
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rax
test rax, rax
je 0x18003656b
xor ebp, ebp
mov eax, ebp
movzx ecx, word [rdx]
add rdx, 2
cmp ebx, eax
je 0x180036582
inc eax
lea rdx, [rdx + rcx*2]
cmp eax, 0x10
jl 0x180036555
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov edi, dword [rsp + 0x50]
dec edi
cmp ecx, edi
cmovle edi, ecx
movsxd rcx, edi
lea rbx, [rcx + rcx]
mov rcx, rsi
mov r8, rbx
call fcn.18003ad40
mov word [rbx + rsi], bp
mov eax, edi
jmp 0x18003656d

Function at 0x180036a20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, r8
mov rdi, rcx
test rdx, rdx
je 0x180036a4e
or r9d, 0x20019
mov r8d, r9d
call fcn.1800369d0
mov rbx, rax
jmp 0x180036a51
mov rbx, rcx
test rbx, rbx
je 0x180036af7
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180036aea
cmp dword [rsp + 0x30], 4
jne 0x180036aea
mov eax, dword [rsp + 0x58]
mov ecx, 4
mov rdx, rsi
cmp eax, ecx
cmova eax, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x58]
mov rcx, rbx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180036aea
cmp rbx, rdi
je 0x180036ad5
mov rcx, rbx
call fcn.180036a00
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
cmp rbx, rdi
je 0x180036af7
mov rcx, rbx
call fcn.180036a00
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x180036b10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x40
mov rbp, r8
mov rdi, rcx
test rdx, rdx
je 0x180036b3e
or r9d, 0x20019
mov r8d, r9d
call fcn.1800369d0
mov rbx, rax
jmp 0x180036b41
mov rbx, rcx
mov qword [rsp + 0x50], rsi
test rbx, rbx
je 0x180036c30
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180036c23
mov eax, dword [rsp + 0x30]
cmp eax, 1
je 0x180036b9a
cmp eax, 2
je 0x180036b9a
cmp eax, 6
je 0x180036b9a
cmp eax, 7
jne 0x180036c23
mov ecx, dword [rsp + 0x58]
add ecx, 2
call fcn.18003b1ac
mov r8d, dword [rsp + 0x58]
xor edx, edx
add r8d, 2
mov rcx, rax
mov rsi, rax
call fcn.18003d9a0
lea r11, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x28], r11
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180036c0a
mov rcx, qword [rsp + 0x70]
mov rdx, rsi
call fcn.180035e30
cmp rbx, rdi
je 0x180036bfb
mov rcx, rbx
call fcn.180036a00
mov rcx, rsi
call fcn.18003ad20
mov eax, 1
jmp 0x180036c32
mov rcx, rsi
call fcn.18003ad20
mov rcx, qword [rsp + 0x70]
lea rdx, [0x180089634]
call fcn.180035e30
cmp rbx, rdi
je 0x180036c30
mov rcx, rbx
call fcn.180036a00
xor eax, eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret