joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140b3e058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140b3e1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140b3e089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b3e06f
add dl, dl
jne 0x140b3e096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b3e0f6
xor eax, eax
add dl, dl
jne 0x140b3e0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b3e1ad
add dl, dl
jne 0x140b3e0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b3e0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b3e0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b3e0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140b3e0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140b3e07e
mov eax, 1
add dl, dl
jne 0x140b3e106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b3e113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b3e0fb
sub eax, ebx
mov ebx, 1
jne 0x140b3e14c
mov ecx, 1
add dl, dl
jne 0x140b3e12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b3e13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b3e123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b3e07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140b3e168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b3e175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b3e15d
cmp eax, 0x7d00
jae 0x140b3e19b
cmp eax, 0x500
jb 0x140b3e196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b3e07e
cmp eax, 0x7f
ja 0x140b3e19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b3e07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140b3e1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140b3e07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400057a7
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, [0x140007e4d]
call sub.msvcrt.dll_getenv
jmp 0x140006054
lea rcx, [0x140007e51]
lea rdx, [0x140007e49]
mov r8, rax
mov rax, qword [0x1400088de]
call rax
mov rsi, rax
lea rdi, [0x140007e51]
lea r12, [0x140006383]
push r12
push rbp
mov rbp, rsp
sub rsp, 0x80
and qword [rbp - 0x4e], rax
mov r8, qword [rbp - 3]
mov rdx, qword [rbp - 2]
test cx, ax
je 0x1400060c7
mov rdx, 0xe105
mov qword [rbp - 0x64], r10
cmp r9, 0xffffffff90db4ced
je 0x1400060b4
and ecx, dword [rbp - 0x32]
mov ecx, 0xce34
add rcx, 0x6c80
mov qword [rbp - 0x51], rdx
mov eax, dword [rbp - 4]
mov eax, ecx
mov eax, dword [rbp - 0x66]
mov eax, dword [rbp - 0x65]
mov qword [rbp - 0x2d], r10
sub r8, qword [rbp - 0x52]
test edx, 0x9746368b
jae 0x140006101
call fcn.1400061cb
mov qword [section..data], rcx
mov qword [rbp - 0x20], r8
sub dword [rbp - 0x58], edx
mov dword [rbp - 0x2f], ecx
mov qword [rbp - 0x2b], r8
mov qword [rbp - 0x7e], rcx
add r8, qword [rbp - 0x2f]
mov dword [rbp - 0x1e], ecx
mov rax, r9
add dword [rbp - 0x1d], eax
mov ecx, dword [rbp - 6]
mov eax, edx
and ecx, dword [rbp - 4]
mov ecx, ecx
mov byte [rbp - 0x1e], ch
test qword [0x140007007], rcx
je 0x140006156
test edx, 0x1c84866f
jmp 0x140006152
mov qword [rbp - 0x4f], r10
lea rcx, [0x14000700e]
movzx eax, dl
test qword [0x140007004], r9
jo 0x140006181
mov eax, dword [0x140007005]
add eax, dword [rbp - 6]
lea r10, [rbp - 0xc]
mov edx, dword [0x140007004]
mov r10, r8
mov edx, edx
cmp ecx, dword [0x14000700f]
jns 0x14000619b
xor edx, dword [rbp - 0x4e]
mov dword [rbp - 0xd], edx
mov dl, cl
sub r9, qword [rbp - 0x66]
or dword [rbp - 5], eax
add dword [rbp - 0x35], edx
cmp rdx, r11
jne 0x1400061c9
mov rdx, rdx
and r8, qword [rbp - 0x19]
sub r11, 0x25a9
mov qword [rbp - 0x1f], rcx
mov rax, qword [rbp - 0x6a]
sub r10, qword [rbp - 0x59]
mov eax, eax
mov r11, r9
sub dword [rbp - 6], eax
mov r11, rcx
sub qword [rbp - 0x72], r9
leave
ret
Function at 0x1800074f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x1800cc885
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x6e8
mov ecx, 0x6d97a
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov byte [rsp + 0x50], 0x3c
push rax
cmp al, 0x49
lea edx, [rax + 0x640]
mov byte [rsp + 0x51], 0x53
mov byte [rsp + 0x52], 0x4b
mov byte [rsp + 0x53], 0x36
mov byte [rsp + 0x54], 0x5a
mov byte [rsp + 0x55], 0x64
mov byte [rsp + 0x56], 0x49
mov byte [rsp + 0x57], 0x71
mov byte [rsp + 0x58], 0x67
mov byte [rsp + 0x59], 0x61
mov byte [rsp + 0x5a], 0x57
mov byte [rsp + 0x5b], 0x53
mov byte [rsp + 0x5c], 0x54
mov byte [rsp + 0x5d], 0x37
mov byte [rsp + 0x5e], 0x31
mov byte [rsp + 0x5f], 0x45
mov byte [rsp + 0x60], 0x23
mov byte [rsp + 0x61], 0x75
mov byte [rsp + 0x62], 0x44
mov byte [rsp + 0x63], 0x7a
mov byte [rsp + 0x64], 0x67
mov byte [rsp + 0x65], 0x54
mov byte [rsp + 0x66], 0x34
mov byte [rsp + 0x67], 0x52
mov byte [rsp + 0x68], 0
lea rax, [r8 + 0x88]
nop dword [rax + rax]
mov qword [rax], 0xffffffffff64c222
add rax, 8
cmp rax, rdx
jne 0x1800cc945
sub ecx, 1
jne 0x1800cc939
cmp qword [rsp + 0x660], 0xffffffffff64c222
je 0x1800cc989
lea rdx, [0x1800ce7f4]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [0x1800d17fd]
add rsp, 0x6e8
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.1800ccad5
xor r8d, r8d
mov rbx, rax
mov edx, 0x6d92a5e2
mov rcx, rax
lea rsi, [rsp + 0x40]
call fcn.1800cc7f5
mov rcx, rbx
lea rbx, [rsp + 0x38]
xor r8d, r8d
mov edx, 0x3803e5e2
mov rbp, rax
call fcn.1800cc7f5
xor r8d, r8d
mov rdi, rax
mov qword [rsp + 0x40], 0x3b4
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r9, rsi
mov rdx, rbx
mov rcx, 0xffffffffffffffff
call rbp
test eax, eax
js 0x1800cca8e
lea rax, [rsp + 0x48]
mov r9d, 0x40
mov r8, rsi
mov eax, esi
mov rdx, rbx
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
call rdi
test eax, eax
js 0x1800ccab1
xor ecx, ecx
cmp qword [rsp + 0x40], 0
mov eax, 0x3c
movabs r9, resource.1
movabs r8, 0x47ae147ae147ae15
jne 0x1800cca6e
jmp 0x1800cca85
mov rax, rcx
mov rdi, rcx
mul r8
mul eax
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
lea rax, [rax + rax*4]
lea rax, [rax + rax*4]
sub rdi, rax
movzx eax, byte [rsp + rdi + 0x50]
xor al, byte [rcx + r9]
mov rdx, qword [rsp + 0x38]
mov byte [rdx + rcx], al
add rcx, 1
cmp qword [rsp + 0x40], rcx
ja 0x1800cca45
call qword [rsp + 0x38]
jmp 0x1800cc968
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1800ce7c5]
xor ecx, ecx
call qword [0x1800d17fd]
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1800ce7dd]
lea edx, [0x1800ce7dd]
xor ecx, ecx
Function at 0x180008a90
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rbx, rcx
lea rdi, [rcx + 0x48]
cmp byte [rdi], 0
je 0x180008ac9
movzx eax, byte [rcx + 0x49]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov qword [rsp + 0x28], rdi
xor sil, sil
mov byte [rsp + 0x30], sil
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x180008c5a
cmp qword [rcx + 0x38], 0
jne 0x180008b07
lea rcx, str.hid.dll
call qword [case.0x18002b58a.0]
mov qword [rbx + 0x38], rax
mov byte [rbx + 0x40], 1
test rax, rax
setne al
jmp 0x180008b09
xor al, al
mov byte [rbx + 0x42], al
test al, al
je 0x180008c5a
lea rdx, str.HidD_GetHidGuid
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x50], rax
test rax, rax
je 0x180008c5a
lea rdx, str.HidD_GetPreparsedData
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x58], rax
test rax, rax
je 0x180008c5a
lea rdx, str.HidD_FreePreparsedData
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x180008c5a
lea rdx, str.HidD_GetAttributes
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x60], rax
test rax, rax
je 0x180008c5a
lea rdx, str.HidP_GetCaps
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x68], rax
test rax, rax
je 0x180008c5a
lea rdx, str.HidP_GetButtonCaps
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x70], rax
test rax, rax
je 0x180008c5a
lea rdx, str.HidP_GetValueCaps
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x78], rax
test rax, rax
je 0x180008c5a
lea rdx, str.HidP_MaxUsageListLength
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x80], rax
test rax, rax
je 0x180008c5a
lea rdx, str.HidP_GetUsages
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x88], rax
test rax, rax
je 0x180008c5a
lea rdx, str.HidP_GetUsageValue
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x90], rax
test rax, rax
je 0x180008c5a
lea rdx, str.HidP_GetScaledUsageValue
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x98], rax
test rax, rax
je 0x180008c5a
mov byte [rbx + 0x49], 1
movzx eax, byte [rbx + 0x49]
mov cl, 1
mov byte [rdi], cl
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x18000db90
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov r12, rdx
mov r13, rcx
movzx eax, byte [rdx + 0x290]
mov byte [rcx + 0x23a], al
test al, al
je 0x18000ddc1
cmp word [rdx + 0x280], 0
je 0x18000ddc1
xor edi, edi
mov ebx, edi
lea rbp, [rcx + 0x28]
mov r15d, edi
lea rdi, [0x180154fb0]
nop dword [rax]
lea rsi, [r13 + 0x218]
lea rsi, [rsi + r15*8]
lea rax, [r15 + r15*2]
mov rcx, qword [r12 + rax*8 + 0x298]
mov qword [rsi], rcx
mov ecx, 0xd8
call fcn.18003f954
mov r14, rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x38], rdi
mov word [rsp + 0x40], bx
lea rax, [0x1801228e0]
mov qword [r14], rax
mov dword [r14 + 8], 0x1f4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [r14 + 0x10], rax
lea rdi, [r14 + 0x18]
mov qword [rsp + 0x98], rdi
xor eax, eax
mov dword [rdi], eax
mov qword [rdi + 8], rax
mov word [rdi + 0x10], ax
mov qword [rdi + 0x18], rax
mov byte [rdi + 0x20], al
lea rcx, [rdi + 0x28]
mov qword [rsp + 0xa0], rcx
mov edx, 0x102
call fcn.180043484
nop
mov qword [rdi + 0x78], r14
mov byte [rdi + 0x88], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rdi + 0x80], rax
lea rax, [rbp + 0x10]
mov qword [r14 + 0xa8], rax
mov byte [r14 + 0xb0], 0
lea rax, [0x180122560]
mov qword [r14], rax
mov qword [r14 + 0xb8], rsi
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [r14 + 0xc0], xmm0
mov qword [r14 + 0xd0], rbp
mov rcx, qword [r13 + r15*8 + 0x240]
mov qword [r13 + r15*8 + 0x240], r14
test rcx, rcx
je 0x18000dd05
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x18002b58a.0]
inc ebx
movsxd r15, ebx
cmp r15, 4
lea rdi, [0x180154fb0]
jb 0x18000dbf0
lea rbx, [0x18015b7f8]
cmp byte [0x18015b2f8], 0
jne 0x18000dd3d
mov dl, 1
lea rcx, [0x18015b2f0]
call fcn.180012e90
test al, al
je 0x18000dd4b
mov rbx, qword [0x18015b300]
add rbx, 0x194
movzx eax, word [rbx]
mov word [r13 + 0x238], ax
lea rbx, [rbp + 0x28]
mov qword [rsp + 0x90], rbx
mov rcx, rbx
call fcn.1800434b4
test eax, eax
jne 0x18000dde1
cmp qword [rbp + 8], 0
jne 0x18000ddb5
mov word [rbp + 0x10], 1
xor edi, edi
mov dword [rbp], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbp + 0x18], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
mov r9, rbp
lea r8, [0x18003f3d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
mov rcx, rbx
call fcn.180043530
test eax, eax
jne 0x18000ddd9
mov rbx, qword [rsp + 0xa8]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, eax
call fcn.180042d28
int3
mov ecx, eax
call fcn.180042d28
int3
Function at 0x18000f4f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x170
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x180154010]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
cmp byte [rcx + 0x12], 0
jne 0x18000f66b
mov byte [rcx + 0x12], 1
movzx edi, byte [rcx + 0x10]
mov r14, qword [rcx + 8]
mov rsi, qword [rcx]
xor edx, edx
mov r8d, 0x107
lea rcx, [rsp + 0x50]
call fcn.18006cd10
nop
test rsi, rsi
je 0x18000f640
cmp byte [rsi], 0
je 0x18000f640
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18000f5b1
mov rax, rsi
lea r9, [rsp + 0x58]
sub r9, rsi
nop word [rax + rax]
movzx r8d, byte [rax]
movzx edx, byte [rax + r9]
sub r8d, edx
jne 0x18000f595
inc rax
test edx, edx
jne 0x18000f580
test r8d, r8d
je 0x18000f5fa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x18000f5b1
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x58], al
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
sete bpl
test eax, eax
jne 0x18000f5f0
mov r8, rsi
mov edx, 0xff
lea rcx, [rsp + 0x58]
call fcn.180092f08
test bpl, bpl
je 0x18000f640
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x34], 4
test rcx, rcx
je 0x18000f640
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, 0xfffffffd
jne 0x18000f640
cmp dword [rsp + 0x30], 0
setne dil
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18000f661
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x18000f661
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x58], al
mov byte [rbx + 0x11], dil
movzx eax, dil
jmp 0x18000f66f
movzx eax, byte [rcx + 0x11]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.18003f930
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18000fad0
Capabilities:
Terminate thread

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov rdi, rcx
lea rbx, [rcx + 0x28]
mov qword [rsp + 0x40], rbx
mov rcx, rbx
call fcn.1800434b4
test eax, eax
jne 0x18000fbe2
mov byte [rdi + 0x10], al
cmp qword [rdi + 8], 0
je 0x18000fbb2
mov rcx, qword [rdi + 0x80]
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor ebp, ebp
mov eax, dword [0x18015aaf8]
lea esi, [rbp + 1]
test eax, eax
je 0x18000fb65
dec eax
cmp eax, esi
ja 0x18000fb86
xor edx, edx
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, eax
test eax, eax
je 0x18000fb86
cmp byte [rdi + 0x11], 0
jne 0x18000fb7a
mov edx, 0x1388
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, eax
jmp 0x18000fb7a
mov edx, 0x1388
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, eax
test eax, eax
je 0x18000fb86
mov edx, esi
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 8], 0
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
jne 0x18000fba8
xor esi, esi
mov qword [rdi + 0x18], 0
jmp 0x18000fbb7
mov esi, 0xffffffff
mov rcx, rbx
call fcn.180043530
test eax, eax
jne 0x18000fbda
mov eax, esi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov ecx, eax
call fcn.180042d28
int3
mov ecx, eax
call fcn.180042d28
int3
Function at 0x18001c900
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rax, [0x18001c620]
mov rdi, rdx
mov qword [rcx], rax
mov rbx, rcx
mov qword [rcx + 8], rax
lea rax, [0x18001c660]
mov qword [rcx + 0x10], rax
lea rax, [0x18001cea0]
mov qword [rcx + 0x18], rax
lea rax, [0x18001c680]
mov qword [rcx + 0x20], rax
lea rax, [0x18001c650]
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
test rdx, rdx
je 0x18001ca1c
lea rdx, str.XInputGetState
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001c973
mov qword [rbx], rax
mov edx, 0x64
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001c98a
mov qword [rbx + 8], rax
mov edx, 0x65
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001c9a1
mov qword [rbx + 0x10], rax
mov edx, 0x66
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001c9b8
mov qword [rbx + 0x18], rax
lea rdx, str.XInputSetState
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001c9d1
mov qword [rbx + 0x20], rax
lea rdx, str.XInputGetCapabilities
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001c9ea
mov qword [rbx + 0x28], rax
lea rdx, str.XInputGetKeystroke
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001ca03
mov qword [rbx + 0x30], rax
lea rdx, str.XInputGetBatteryInformation
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001ca1c
mov qword [rbx + 0x38], rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180023a20
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
mov esi, edi
test rcx, rcx
je 0x180023aff
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebp, eax
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rbx + rdx*2], si
jne 0x180023a57
lea ecx, [rax + 1]
add rdx, rcx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x180023b02
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r8d, eax
lea ecx, [r8 - 1]
cmp word [rsi + rcx*2], 0x5c
je 0x180023aa6
mov eax, 0x5c
mov word [rsi + r8*2], ax
inc r8d
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], di
jne 0x180023ab0
test rax, rax
je 0x180023aff
lfence
mov rdx, rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rbx + rdx*2]
lea ecx, [rdi + r8]
inc edi
mov word [rsi + rcx*2], ax
mov edx, edi
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x180023af0
cmp rdx, rax
jb 0x180023ad0
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180027ae0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x30
mov rbx, rcx
xor ebp, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x180027d0c
xor edx, edx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], dx
jne 0x180027b10
test rax, rax
je 0x180027b44
xor ecx, ecx
movzx r8d, word [rbx + rcx*2]
cmp r8w, 0x5c
je 0x180027d0c
cmp r8w, 0x2f
je 0x180027d0c
inc edx
mov ecx, edx
cmp rcx, rax
jb 0x180027b20
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x48], rdi
call fcn.180026f80
mov rsi, rax
test rax, rax
je 0x180027c3e
mov qword [rsp + 0x50], r14
call fcn.180028470
mov r14, rax
test rax, rax
je 0x180027c2b
mov rcx, rsi
call fcn.180023d70
test eax, eax
je 0x180027c14
lea rax, str.system32_
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x20]
lea rax, str.SystemRoot_system32_
mov qword [rsp + 0x28], rax
nop word [rax + rax]
mov rdx, qword [rdi]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rdx + rbx*2], bp
jne 0x180027bc0
mov r8, rbx
mov rcx, rsi
call fcn.180092cd0
test eax, eax
je 0x180027be8
add rdi, 8
lea rax, [rsp + 0x30]
cmp rdi, rax
jb 0x180027bb0
jmp 0x180027bf7
lea rdx, [rsi + rbx*2]
mov rcx, r14
call fcn.1800286d0
mov rbp, rax
lea rax, [rsp + 0x30]
cmp rdi, rax
jne 0x180027c22
mov rcx, rsi
call fcn.180023dc0
test eax, eax
je 0x180027c22
mov rbp, rsi
xor esi, esi
jmp 0x180027c22
mov rdx, rsi
mov rcx, r14
call fcn.1800286d0
mov rbp, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0x50]
jmp 0x180027cd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x180027ce1
mov rcx, rbx
call fcn.180029320
mov rdi, rax
test rax, rax
je 0x180027ce1
mov ecx, 0x37e4
call fcn.180028c10
test eax, eax
je 0x180027c76
call fcn.1800280e0
jmp 0x180027c7b
call fcn.180028470
mov rbx, rax
test rax, rax
je 0x180027ccf
mov rdx, rdi
mov rcx, rax
call fcn.1800286d0
mov rbp, rax
test rax, rax
je 0x180027cc6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180027ca8
test al, 0x50
je 0x180027cc6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x180027cbb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ebp, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbp, rbp
je 0x180027ce1
xor ecx, ecx
jmp 0x180027cee
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x180027cf4
lea ecx, [rax + 0x7e]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsp + 0x48]
mov rax, rbp
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop rbp
ret
Function at 0x180028470
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov ecx, 0x40
add rdx, rdx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1800284d2
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1800284c7
cmp edi, eax
jb 0x1800284c7
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret