joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180069300
Capabilities:
Get common file path

Disassembly:
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x1a0], rdi
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x80], rax
movzx eax, byte [0x180344a50]
test al, al
jne 0x1800694ee
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x70]
call fcn.180233580
mov edi, 1
mov r9d, edi
lea r8d, [rdi + 0x19]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x1800694e7
mov qword [rsp + 0x60], 0xf
mov qword [rsp + 0x58], 0
mov byte [rsp + 0x48], 0
lea r8d, [rdi + 0x13]
lea rdx, str.config_systemprofile
lea rcx, [rsp + 0x48]
call fcn.18005a720
nop
mov qword [rsp + 0x40], 0xf
mov qword [rsp + 0x38], 0
mov byte [rsp + 0x28], 0
cmp byte [rsp + 0x70], 0
jne 0x1800693c5
xor r8d, r8d
jmp 0x1800693da
lea rax, [rsp + 0x70]
or r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1800693d0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.18005a720
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rdx, qword [rsp + 0x48]
mov r9, qword [rsp + 0x58]
xor r8d, r8d
lea rcx, [rsp + 0x28]
call fcn.1800614f0
movzx ecx, byte [0x180344a50]
cmp rax, 0xffffffffffffffff
cmovne ecx, edi
mov byte [0x180344a50], cl
mov rax, qword [rsp + 0x40]
cmp rax, 0x10
jb 0x180069478
inc rax
mov rcx, qword [rsp + 0x28]
cmp rax, 0x1000
jb 0x180069473
test cl, 0x1f
je 0x180069446
call fcn.180234c4c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180069455
call fcn.180234c4c
int3
sub rcx, rax
cmp rcx, 8
jae 0x180069464
call fcn.180234c4c
int3
cmp rcx, 0x27
jbe 0x180069470
call fcn.180234c4c
int3
mov rcx, rax
call fcn.180203788
mov qword [rsp + 0x40], 0xf
mov qword [rsp + 0x38], 0
mov byte [rsp + 0x28], 0
mov rax, qword [rsp + 0x60]
cmp rax, 0x10
jb 0x1800694e7
inc rax
mov rcx, qword [rsp + 0x48]
cmp rax, 0x1000
jb 0x1800694e2
test cl, 0x1f
je 0x1800694b5
call fcn.180234c4c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800694c4
call fcn.180234c4c
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800694d3
call fcn.180234c4c
int3
cmp rcx, 0x27
jbe 0x1800694df
call fcn.180234c4c
int3
mov rcx, rax
call fcn.180203788
movzx eax, byte [0x180344a50]
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1802037a0
mov rdi, qword [rsp + 0x1a0]
add rsp, 0x190
pop rbp
ret
Function at 0x180069510
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov edi, r8d
mov rsi, rdx
xor ebx, ebx
call fcn.180069300
test al, al
jne 0x18006955d
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x18006955d
lea eax, [rbx + 1]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, eax
lea rdx, [rsp + 0x40]
call qword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
je 0x1800695af
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x1800695af
mov r8, qword [rsp + 0x40]
mov r9d, 1
mov edx, edi
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1800695af
lea ebx, [rax + 1]
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x180069d00
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x60
xor ebp, ebp
lea rax, [r11 - 0x10]
mov rbx, r9
mov qword [r11 - 0x10], rbp
mov rsi, r8
mov qword [r11 - 0x18], rbp
mov rdi, rdx
mov qword [r11 + 8], rbp
mov r9d, 0xf013f
mov qword [r11 - 0x48], rax
xor r8d, r8d
lea rdx, str.SoftWare
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180069e43
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rbp
lea rdx, [0x1802abf08]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rbp
xor r8d, r8d
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180069e38
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rbp
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov rdx, rdi
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x180069de6
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
jmp 0x180069e3d
or rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rbx + rax*2 + 2], bp
lea rax, [rax + 1]
jne 0x180069df0
mov rcx, qword [rsp + 0x70]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18006a3a0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x70
xor esi, esi
lea rax, [r11 + 8]
mov rdi, r9
mov qword [r11 + 8], rsi
mov rbx, r8
mov qword [r11 - 0x28], rsi
mov r9d, 0xf013f
mov qword [r11 - 0x20], rsi
xor r8d, r8d
mov qword [r11 - 0x18], rsi
mov rcx, 0xffffffff80000003
mov qword [r11 - 0x58], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18006a511
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x50]
mov r9d, 0xf013f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftWare
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18006a503
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rsi
lea rdx, [0x1802abf08]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18006a4f8
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rsi
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov rdx, rbx
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18006a4ed
mov rcx, qword [rsp + 0xa0]
or rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x18006a4b0
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18006a530
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x798]
sub rsp, 0x890
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x780], rax
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x4c], edi
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rdi
mov word [rsp + 0x58], di
lea r8d, [rdi + 5]
lea rdx, str.guanf
lea rcx, [rsp + 0x58]
call fcn.18005c660
nop
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SoftWare
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18006a600
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
cmp qword [rbx + 0x18], 8
jb 0x18006a5e8
mov rax, qword [rbx]
jmp 0x18006a5eb
mov rax, rbx
mov word [rax], di
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.18005c590
jmp 0x18006a74a
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, [0x1802abf08]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18006a636
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18006a5d0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.AppInfo
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18006a67a
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18006a5d0
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x80]
call fcn.180233580
mov dword [rsp + 0x48], 0x400
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Spreader
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp - 0x80]
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x18006a6f0
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
test eax, eax
je 0x18006a5dc
cmp qword [rbx + 0x18], 8
jb 0x18006a71a
mov rax, qword [rbx]
jmp 0x18006a71d
mov rax, rbx
mov word [rax], di
cmp word [rbp - 0x80], 0
je 0x18006a73a
lea rax, [rbp - 0x80]
or rdi, 0xffffffffffffffff
nop
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18006a730
mov r8, rdi
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.18005c660
nop
mov r8, qword [rsp + 0x70]
cmp r8, 8
jb 0x18006a767
inc r8
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.18005cac0
mov rax, rbx
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x890]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18006a810
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xc0
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
xor ebp, ebp
mov qword [rax - 0x78], rbp
mov qword [rax - 0x70], rbp
mov dword [rax + 0x20], 0x104
lea rcx, [rax - 0x58]
call fcn.1802065c0
nop
lea rcx, [rsp + 0x70]
call fcn.18020663c
xor r8d, r8d
lea rdx, str.SoftWare
mov rcx, 0xffffffff80000002
test eax, eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
je 0x18006a8ae
mov r9d, 0xf013f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18006a933
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0xf013f
jmp 0x18006a8da
mov r9d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18006a933
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18006a927
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x70]
call fcn.1802065e0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18006d570
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x100
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
xor esi, esi
mov dword [rsp + 0x20], esi
mov byte [r11 - 0x1f], sil
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x60], 0x67452301
mov dword [rsp + 0x64], 0xefcdab89
mov dword [rsp + 0x68], 0x98badcfe
mov dword [rsp + 0x6c], 0x10325476
cmp qword [rdx + 0x18], 0x10
jb 0x18006d5e2
mov rdx, qword [rdx]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x60]
call fcn.180058b10
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.180059800
nop
mov rdx, rax
mov rcx, rdi
call fcn.18006cf70
nop
mov rax, qword [rsp + 0x50]
cmp rax, 0x10
jb 0x18006d664
inc rax
mov rcx, qword [rsp + 0x38]
cmp rax, 0x1000
jb 0x18006d65f
test cl, 0x1f
je 0x18006d632
call fcn.180234c4c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18006d641
call fcn.180234c4c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18006d650
call fcn.180234c4c
int3
cmp rcx, 0x27
jbe 0x18006d65c
call fcn.180234c4c
int3
mov rcx, rax
call fcn.180203788
mov qword [rsp + 0x50], 0xf
mov qword [rsp + 0x48], rsi
mov byte [rsp + 0x38], 0
mov rcx, rbx
call fcn.18005ba50
mov rax, rdi
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x18006d6b0
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0xf0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call fcn.18006d140
mov byte [rsp + 0xd9], 0
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x50], 0x67452301
mov dword [rsp + 0x54], 0xefcdab89
mov dword [rsp + 0x58], 0x98badcfe
mov dword [rsp + 0x5c], 0x10325476
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x18006d728
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.180058b10
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x18006d78d
inc rax
mov rcx, qword [rsp + 0x30]
cmp rax, 0x1000
jb 0x18006d788
test cl, 0x1f
je 0x18006d75b
call fcn.180234c4c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18006d76a
call fcn.180234c4c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18006d779
call fcn.180234c4c
int3
cmp rcx, 0x27
jbe 0x18006d785
call fcn.180234c4c
int3
mov rcx, rax
call fcn.180203788
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.180059800
nop
mov rdx, rax
mov rcx, rbx
call fcn.18006cf70
nop
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x18006d801
inc rax
mov rcx, qword [rsp + 0x30]
cmp rax, 0x1000
jb 0x18006d7fc
test cl, 0x1f
je 0x18006d7cf
call fcn.180234c4c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18006d7de
call fcn.180234c4c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18006d7ed
call fcn.180234c4c
int3
cmp rcx, 0x27
jbe 0x18006d7f9
call fcn.180234c4c
int3
mov rcx, rax
call fcn.180203788
mov rax, rbx
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0xf0
pop rbx
ret
Function at 0x18006e0d0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x11c
call fcn.180233580
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [rsp + 0x24]
cmp ecx, 6
jb 0x18006e13b
cmp dword [rsp + 0x28], 2
jb 0x18006e13b
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x158
ret
xor eax, eax
cmp ecx, 0xa
setae al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x158
ret

Function at 0x18006e160
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x11c
call fcn.180233580
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
cmp dword [rsp + 0x24], 0xa
setae al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x158
ret

Function at 0x18006e1c0
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub rsp, 0x188
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x11c
call fcn.180233580
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x54], 5
jg 0x18006e234
cmp dword [rsp + 0x58], 2
jg 0x18006e234
mov eax, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x188
ret
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x188
ret

Function at 0x18006e250
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x11c
call fcn.180233580
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
jne 0x18006e2c3
cmp dword [rsp + 0x28], 1
ja 0x18006e2c3
cmp byte [rsp + 0x13a], 1
jne 0x18006e2c3
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x158
ret
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x158
ret
Function at 0x1800703f0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
call fcn.18008a6f0
xor edx, edx
mov dword [rbx], eax
xor r9d, r9d
lea r8, [rsp + 0x20]
lea ecx, [rdx + 0x30]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [rsp + 0x24]
mov dword [rbx + 8], eax
call fcn.18008a180
mov dword [rbx + 0xc], eax
call fcn.18008ab10
mov dword [rbx + 0x10], eax
call fcn.18008aa10
mov dword [rbx + 0x18], eax
call fcn.18008aa90
mov dword [rbx + 0x1c], eax
lea rcx, [rbx + 0x1d8]
mov eax, dword [rbx]
mov dword [rbx + 4], eax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rbx + 0x1f0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rbx + 0x1e0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rbx + 0x220]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rbx + 0x200]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rbx + 0x210]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [0x180341d3c]
mov dword [rbx + 0x1c8], eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x40
pop rbx
ret

Function at 0x1800704c0
Capabilities:
Check if file exists
Create directory

Disassembly:
push rbx
sub rsp, 0x20
lea rdx, [rcx + 0x48]
lea rbx, [rcx + 0x88]
cmp rbx, rdx
je 0x1800704e5
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rcx, rbx
call fcn.18005cbe0
mov r8d, 5
lea rdx, str.Skin_
mov rcx, rbx
call fcn.18005ffc0
cmp qword [rbx + 0x18], 8
jb 0x180070506
mov rcx, qword [rbx]
jmp 0x180070509
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18007052a
cmp qword [rbx + 0x18], 8
jb 0x18007051d
mov rbx, qword [rbx]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1800675f0
add rsp, 0x20
pop rbx
ret

Function at 0x180070530
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.180233580
cmp qword [rbx + 0x60], 8
lea r8, [rbx + 0x48]
jb 0x18007056e
mov r8, qword [r8]
lea r9, str.AllSkin
lea rdx, [0x1802abd18]
lea rcx, [rsp + 0x20]
call fcn.18005c530
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18007059f
lea rcx, [rsp + 0x20]
call fcn.1800675f0
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x240
pop rbx
ret
Function at 0x1800705c0
Capabilities:
Check if file exists
Create directory

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.180233580
add rbx, 0x28
cmp qword [rbx + 0x18], 8
jb 0x180070600
mov r8, qword [rbx]
jmp 0x180070603
mov r8, rbx
lea r9, [0x1802ac674]
lea rdx, [0x1802abd18]
lea rcx, [rsp + 0x20]
call fcn.18005c530
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180070637
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp qword [rbx + 0x18], 8
jb 0x180070641
mov rbx, qword [rbx]
lea r9, str.Dict
mov r8, rbx
lea rdx, [0x1802abd18]
lea rcx, [rsp + 0x20]
call fcn.18005c530
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180070678
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x240
pop rbx
ret

Function at 0x1800706a0
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp qword [rcx + 0x60], 8
lea r8, [rcx + 0x48]
mov rbx, rcx
jb 0x1800706cc
mov r8, qword [r8]
lea r9, [0x1802abd08]
lea rdx, [0x1802abd18]
lea rcx, [rsp + 0x20]
call fcn.18005c530
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1800706fd
lea rcx, [rsp + 0x20]
call fcn.1800675f0
lea rax, [rsp + 0x20]
sub rax, 2
nop word [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x180070710
mov ecx, dword [0x1802acdd8]
movups xmm0, xmmword [str.Config.ini]
movups xmmword [rax], xmm0
mov dword [rax + 0x10], ecx
movzx ecx, word [0x1802acddc]
mov word [rax + 0x14], cx
cmp word [rsp + 0x20], 0
jne 0x180070746
xor r8d, r8d
jmp 0x18007075b
lea rax, [rsp + 0x20]
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x180070750
lea rcx, [rbx + 0x68]
lea rdx, [rsp + 0x20]
call fcn.18005c660
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x240
pop rbx
ret