joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180013ea0
Capabilities:
Check if file exists
Create shortcut via ishelllink
Get file attributes

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rbp, r9
mov rbx, r8
mov r13, rdx
mov rdi, rcx
test rcx, rcx
je 0x1800140a9
test rdx, rdx
je 0x1800140a9
xor r14d, r14d
mov r12d, r14d
mov esi, r14d
mov qword [rax + 8], r14
mov qword [rax - 0x48], r14
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x18001406a
mov esi, 1
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [0x1800de620]
mov r8d, esi
xor edx, edx
lea rcx, [0x1800e0b50]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18001406a
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 0xa0]
test eax, eax
js 0x18001406a
test rbx, rbx
je 0x180013f80
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x180013f80
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x58]
test eax, eax
js 0x18001406a
test rbp, rbp
je 0x180013fb2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180013fb2
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, rbp
call qword [rax + 0x88]
test eax, eax
js 0x18001406a
mov rdi, qword [rsp + 0xa0]
test rdi, rdi
je 0x180013fe6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180013fe6
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 0x48]
test eax, eax
js 0x18001406a
mov rdx, qword [rsp + 0xa8]
test rdx, rdx
je 0x180014019
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x180014019
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x38]
test eax, eax
js 0x18001406a
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
lea r8, [rsp + 0x30]
lea rdx, [0x1800dfa10]
call qword [rax]
test eax, eax
js 0x18001406a
mov rdx, r13
lea rcx, [rsp + 0x38]
call fcn.18002bea0
nop
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov r8d, esi
mov rdx, qword [rsp + 0x38]
call qword [rax + 0x30]
test eax, eax
jns 0x18001405d
jmp 0x180014060
mov r12d, esi
lea rcx, [rsp + 0x38]
call fcn.180029530
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x18001407f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x30], r14
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x18001409a
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov qword [rsp + 0x80], r14
test esi, esi
je 0x1800140a4
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, r12d
jmp 0x1800140ab
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180015b00
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Get file attributes
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rsi, rcx
mov rcx, rdx
mov ebp, r8d
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp eax, 0xffffffff
je 0x180015bed
test al, 1
je 0x180015b50
and ebx, 0xfffffffe
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test bl, 0x10
je 0x180015bed
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x20], 0
call fcn.180043ef0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, str._s.bak_08X
lea rcx, [rsp + 0x20]
mov r9d, eax
mov r8, rdi
call fcn.180043b88
lea rcx, [rsp + 0x20]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x180015bdf
nop
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, str._s.bak_08X
lea rcx, [rsp + 0x20]
mov r9d, eax
mov r8, rdi
call fcn.180043b88
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc ebx
cmp ebx, 0xa
jge 0x180015c2b
cmp eax, 0xffffffff
jne 0x180015ba0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rcx, rdi
mov ebx, eax
call fcn.18000fa20
mov eax, ebx
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.180043ec0
mov rbx, qword [rsp + 0x268]
add rsp, 0x230
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
jmp 0x180015c08
Function at 0x1800169b0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 8], 0
mov rbx, rcx
jne 0x1800169d1
lea rcx, str.wintrust.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbx + 8], rax
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180016a46
cmp qword [rbx + 0x18], 0
jne 0x1800169f2
lea rdx, str.WinVerifyTrustEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x18], rax
cmp qword [rbx + 0x20], 0
jne 0x180016a0e
mov rcx, qword [rbx + 8]
lea rdx, str.WTHelperProvDataFromStateData
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x28], 0
jne 0x180016a2a
mov rcx, qword [rbx + 8]
lea rdx, str.WTHelperGetProvSignerFromChain
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x28], rax
cmp qword [rbx + 0x30], 0
jne 0x180016a46
mov rcx, qword [rbx + 8]
lea rdx, str.WTHelperGetProvCertFromChain
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x30], rax
cmp qword [rbx + 0x10], 0
jne 0x180016a5e
lea rcx, str.crypt32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbx + 0x10], rax
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x180016a7f
cmp qword [rbx + 0x38], 0
jne 0x180016a7f
lea rdx, str.CertNameToStrW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x38], rax
add rsp, 0x20
pop rbx
ret
Function at 0x180017040
Capabilities:
Get user security identifier

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x48
mov qword [rsp + 0x40], r13
xor r13d, r13d
mov rsi, rdx
mov r12, rcx
mov ebx, r13d
mov edi, r13d
mov qword [rdx], r13
test rcx, rcx
jne 0x18001706e
lea edi, [rcx + 1]
jmp 0x180017189
lea rax, [rsp + 0x80]
mov rdx, rcx
lea r9, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x78], r13d
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x70], r13d
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x1800170c0
cmp eax, 0x7a
je 0x1800170c0
lea edi, [rbx + 2]
jmp 0x180017179
mov ecx, dword [rsp + 0x78]
mov qword [rsp + 0x88], rbp
call fcn.180045488
mov ecx, dword [rsp + 0x70]
mov qword [rsi], rax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180045488
mov rcx, qword [rsi]
mov rbp, rax
test rcx, rcx
je 0x18001715b
test rax, rax
je 0x18001715b
mov r8d, dword [rsp + 0x78]
xor edx, edx
call fcn.180043ef0
mov r8d, dword [rsp + 0x70]
xor edx, edx
add r8, r8
mov rcx, rbp
call fcn.180043ef0
mov r8, qword [rsi]
lea r11, [rsp + 0x80]
mov qword [rsp + 0x30], r11
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rdx, r12
xor ecx, ecx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test eax, eax
jne 0x180017160
lea edi, [rax + 4]
jmp 0x180017160
mov edi, 3
test rbp, rbp
je 0x18001716d
mov rcx, rbp
call fcn.180045904
mov rbp, qword [rsp + 0x88]
test ebx, ebx
jne 0x180017189
mov rcx, qword [rsi]
test rcx, rcx
je 0x180017189
call fcn.180045904
mov qword [rsi], r13
cmp dword [0x1801340b0], 0
mov r13, qword [rsp + 0x40]
je 0x1800171d9
mov rax, qword [rsi]
test r12, r12
lea rcx, str.NULL
mov qword [rsp + 0x38], rax
cmovne rcx, r12
lea r9, str.CKSecurity::GetSid_____ret:__d___myerror:__d___Name:__s___Sid:__08x_
mov qword [rsp + 0x30], rcx
lea r8, [0x1800d5c98]
lea rcx, [0x180133ff8]
mov edx, 0xf
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call fcn.18001ab50
mov eax, ebx
add rsp, 0x48
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x180017a60
Capabilities:
Compare security identifiers

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x70
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor r14d, r14d
mov r13d, r8d
mov r12, rdx
mov rbp, rcx
mov esi, r14d
mov edi, r14d
mov ebx, r14d
test rcx, rcx
jne 0x180017aa0
lea edi, [rcx + 1]
jmp 0x180017b5c
xor eax, eax
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x58], r14d
mov qword [rsp + 0x5c], rax
lea r9d, [rax + 2]
lea r8d, [rax + 0xc]
mov qword [rsp + 0x5c], 8
call qword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x180017ad4
lea edi, [rax + 2]
jmp 0x180017b5c
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x180017b5c
lea r8, [rsp + 0x50]
mov edx, ebx
mov rcx, rbp
mov qword [rsp + 0x50], r14
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x180017b57
mov rdx, qword [rsp + 0x50]
test byte [rdx + 1], 0x10
jne 0x180017b50
add rdx, 8
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x180017b1f
inc ebx
cmp ebx, dword [rsp + 0x58]
jb 0x180017ae0
jmp 0x180017b5c
mov esi, 1
cmp r13d, 0x10000000
jne 0x180017b5c
mov rax, qword [rsp + 0x50]
cmp byte [rax], dil
jne 0x180017b46
mov eax, dword [rax + 4]
and eax, 0x1f0000
cmp eax, 0x1f0000
je 0x180017b5c
mov edi, 5
mov esi, r14d
jmp 0x180017b5c
mov edi, 4
jmp 0x180017b5c
mov edi, 3
cmp dword [0x1801340b0], r14d
je 0x180017b9f
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rbp
lea r9, str.CKSecurity::IsInAcl_____Inner___ret:__d___myerror:__d___Acl:__08x___Sid:__08x___Mask:__08x___Index:__d_
lea r8, [0x1800d5c98]
lea rcx, [0x180133ff8]
mov edx, 0xf
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call fcn.18001ab50
mov eax, esi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x70
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1800185b0
Capabilities:
Check os version
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jbe 0x180018611
lea rcx, [0x1800d45c0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x180018611
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800185f5
call rax
movzx ebx, ax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test bx, bx
je 0x180018611
movzx eax, bx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
Function at 0x180019ea0
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
mov rbx, rcx
lea rdx, [rcx + 8]
mov r8d, 1
lea rcx, [rsp + 0x38]
call fcn.180031080
nop
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
test eax, eax
je 0x180019f2f
test rsi, rsi
je 0x180019f2f
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor r11d, r11d
mov dword [rsp + 0x60], r11d
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx + rcx - 2]
mov qword [rsp + 0x20], r11
lea r9, [rsp + 0x60]
mov rdx, rsi
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
lea rcx, [rsp + 0x38]
call fcn.180031100
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x18001c000
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push r12
mov eax, 0x2870
call fcn.1800470d0
sub rsp, rax
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x2850], rax
mov rbx, r8
mov r12, rdx
mov rbp, rcx
test rcx, rcx
jne 0x18001c039
xor eax, eax
jmp 0x18001c160
mov qword [rsp + 0x28a8], rsi
mov qword [rsp + 0x2868], rdi
xor edi, edi
mov dword [r8], edi
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 3]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18001c13d
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x2860], r13
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r13d, eax
test eax, eax
jne 0x18001c0a0
mov dword [rbx], 2
jmp 0x18001c105
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x27ff
mov byte [rsp + 0x50], dil
call fcn.180043ef0
mov r8d, 0x2800
cmp r13d, r8d
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, rsi
cmovb r8d, r13d
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18001c0ff
lea rcx, [rsp + 0x50]
mov edx, 0x2800
call fcn.18001bde0
test eax, eax
jne 0x18001c105
mov dword [rbx], 3
jmp 0x18001c105
mov dword [rbx], 5
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x2860]
cmp dword [rbx], edi
jne 0x18001c14e
test r12, r12
je 0x18001c136
mov rdx, r12
mov rcx, rbp
call fcn.18001be40
test eax, eax
jne 0x18001c136
mov dword [rbx], 4
jmp 0x18001c14e
mov edi, 1
jmp 0x18001c14e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x18001c14e
mov dword [rbx], 1
mov rsi, qword [rsp + 0x28a8]
mov eax, edi
mov rdi, qword [rsp + 0x2868]
mov rcx, qword [rsp + 0x2850]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x2870
pop r12
pop rbp
pop rbx
ret
Function at 0x18001d3d0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
xor r14d, r14d
mov r12, r8
mov r13, rdx
mov dword [rdx], r14d
mov rsi, rcx
mov dword [r8], r14d
mov ebx, r14d
test rcx, rcx
je 0x18001d52e
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x18001d52e
xor edx, edx
mov rcx, rsi
call fcn.180040fd0
test eax, eax
je 0x18001d52e
mov qword [rsp + 0x30], r14
lea r8d, [r14 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rsi
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x18001d495
cmp dword [0x1801340b0], ebx
je 0x18001d55a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.GetFileSizeAndCrc_1___08x_
lea r8, str.Update
lea edx, [rbp + 0x10]
lea rcx, [0x180133ff8]
mov dword [rsp + 0x20], eax
call fcn.18001ab50
jmp 0x18001d52e
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [r13], eax
mov r13d, 0x10000
mov edi, eax
mov ecx, r13d
call fcn.180045488
mov rsi, rax
test rax, rax
je 0x18001d525
mov r8d, r13d
xor edx, edx
mov rcx, rax
call fcn.180043ef0
mov ebx, 1
test edi, edi
je 0x18001d51d
mov r8d, edi
cmp edi, r13d
lea r9, [rsp + 0x70]
mov rdx, rsi
mov rcx, rbp
cmova r8d, r13d
mov dword [rsp + 0x70], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8d, dword [rsp + 0x70]
test r8d, r8d
je 0x18001d51a
mov ecx, dword [r12]
mov rdx, rsi
sub edi, r8d
call fcn.18007ba30
mov dword [r12], eax
test edi, edi
jne 0x18001d4d2
jmp 0x18001d51d
mov ebx, r14d
mov rcx, rsi
call fcn.180045904
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1801340b0], r14d
je 0x18001d55a
lea r9, str.GetFileSizeAndCrc____d_
lea r8, str.Update
lea rcx, [0x180133ff8]
mov edx, 0xf
mov dword [rsp + 0x20], ebx
call fcn.18001ab50
mov rbp, qword [rsp + 0x80]
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x18001da80
Capabilities:
Check mutex on windows

Disassembly:
sub rsp, 0x148
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.180043ef0
lea rdx, [rsp + 0x20]
lea rcx, str.TEC_OCULAR__AGENT_V3_MUTEX_AGENT
mov r8d, 0x104
call fcn.18000a7d0
lea r8, [rsp + 0x20]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
test rax, rax
jne 0x18001db06
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 5
sete cl
mov eax, ecx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x148
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x148
ret
Function at 0x18001dc40
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x18001dc70
movzx eax, al
shr eax, 4
and eax, 1
jmp 0x18001dda2
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.18002b2f0
nop
mov r8d, 1
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x48]
call fcn.18002b910
lea rdx, [0x1800d1cbc]
mov rcx, qword [rax]
call fcn.1800473c4
test eax, eax
sete bl
lea rcx, [rsp + 0x50]
call fcn.180027bd0
test bl, bl
je 0x18001dce9
mov rax, qword [rsp + 0x48]
mov r8d, dword [rax - 8]
dec r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x48]
call fcn.18002b9a0
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.180027ce0
nop
lea rcx, [rsp + 0x50]
call fcn.180027bd0
mov dl, 0x5c
lea rcx, [rsp + 0x48]
call fcn.180028110
cmp eax, 2
jge 0x18001dd0b
lea rcx, [rsp + 0x48]
call fcn.180027bd0
xor eax, eax
jmp 0x18001dda2
mov r8d, eax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x48]
call fcn.18002b9a0
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.180027ce0
nop
lea rcx, [rsp + 0x50]
call fcn.180027bd0
mov rcx, qword [rsp + 0x48]
cmp dword [rcx - 8], 2
jg 0x18001dd52
mov dl, 0x5c
lea rcx, [rsp + 0x48]
call fcn.180027ee0
mov rcx, qword [rsp + 0x48]
call fcn.18001dc40
test eax, eax
jne 0x18001dd69
lea rcx, [rsp + 0x48]
call fcn.180027bd0
xor eax, eax
jmp 0x18001dda2
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x18001dd93
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x18001dd93
lea rcx, [rsp + 0x48]
call fcn.180027bd0
xor eax, eax
jmp 0x18001dda2
lea rcx, [rsp + 0x48]
call fcn.180027bd0
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18001e030
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov qword [rbp + 0x37], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x18001e197
test rdx, rdx
je 0x18001e197
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x18001e197
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x18001e197
mov r12d, 1
mov rax, qword [0x1800e0ed8]
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rax
mov qword [rbp + 0x27], rax
xor r13d, r13d
mov qword [rbp - 0x29], r13
mov qword [rbp - 0x21], r13
mov dword [rbp - 0x19], r13d
mov qword [rbp - 0x71], rax
mov qword [rbp - 0x69], rax
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x39], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r13
mov dword [rbp - 0x79], r13d
xor r8d, r8d
lea rdx, [rbp - 0x29]
mov rcx, rdi
call fcn.180088a30
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180088a30
mov r11d, dword [rbp - 0x21]
mov edx, dword [rsp + 0x38]
mov eax, dword [rbp - 0x25]
mov ecx, dword [rsp + 0x34]
cmp eax, ecx
jne 0x18001e134
cmp r11d, edx
je 0x18001e137
mov r12d, r13d
mov dword [rsi], r13d
cmp ecx, eax
ja 0x18001e145
jne 0x18001e14b
cmp edx, r11d
jbe 0x18001e14b
mov dword [rsi], 1
cmp dword [0x1801340b0], 0
je 0x18001e17e
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, str.CUpAgentFileMgr::CheckFilesVer___s___s_
lea r8, str.Update
mov edx, 0xf
lea rcx, [0x180133ff8]
call fcn.18001ab50
nop
lea rcx, [rsp + 0x30]
call fcn.18001db30
nop
lea rcx, [rbp - 0x29]
call fcn.18001db30
mov eax, r12d
jmp 0x18001e199
xor eax, eax
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rbp
ret
Function at 0x180020b90
Capabilities:
Query service configuration

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rcx
test rcx, rcx
jne 0x180020bc2
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x60
pop rsi
ret
lea rax, [rsp + 0x30]
mov qword [rsp + 0x78], rbx
xor ebx, ebx
lea edx, [rbx + 2]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfig2A]
test eax, eax
jne 0x180020d3c
mov qword [rsp + 0x88], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x1801340b0], ebx
mov edi, eax
je 0x180020c2f
mov eax, dword [rsp + 0x30]
lea r9, str.CheckServConf_1___d____d_
lea r8, str.SrcSer
mov dword [rsp + 0x28], eax
lea edx, [rbx + 0xf]
lea rcx, [0x180133ff8]
mov dword [rsp + 0x20], edi
call fcn.18001ab50
cmp edi, 0x7a
jne 0x180020d34
mov qword [rsp + 0x80], rbp
mov ebp, dword [rsp + 0x30]
test ebp, ebp
je 0x180020d2c
mov edx, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x180020d2c
lea rax, [rsp + 0x30]
mov r9d, ebp
mov r8, rdi
mov edx, 2
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfig2A]
test eax, eax
je 0x180020d23
cmp dword [0x1801340b0], ebx
je 0x180020cbc
mov eax, dword [rdi + 0x18]
lea r9, str.CheckServConf_2___d____d_
lea r8, str.SrcSer
mov dword [rsp + 0x28], eax
mov eax, dword [rdi]
lea rcx, [0x180133ff8]
mov edx, 0xf
mov dword [rsp + 0x20], eax
call fcn.18001ab50
cmp dword [rdi], 0x3f480
jne 0x180020d23
cmp dword [rdi + 0x18], 3
jne 0x180020d23
mov rax, qword [rdi + 0x20]
mov r8d, 1
lea rcx, [rsp + 0x38]
mov rdx, qword [rax]
mov dword [rsp + 0x3c], 0xea60
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x44], 0x1d4c0
mov dword [rsp + 0x40], r8d
mov qword [rsp + 0x48], rbx
cmp rdx, qword [rcx]
jne 0x180020d18
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x180020d18
mov rdx, qword [rax + 0x10]
cmp rdx, qword [rcx + 0x10]
jne 0x180020d18
mov eax, ebx
jmp 0x180020d1d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
cmove ebx, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
cmp dword [0x1801340b0], 0
je 0x180020d68
lea r9, str.CheckServConf____d_
lea r8, str.SrcSer
lea rcx, [0x180133ff8]
mov edx, 0xf
mov dword [rsp + 0x20], ebx
call fcn.18001ab50
mov eax, ebx
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x60
pop rsi
ret