joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002a410
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [0x1800ba730]
call fcn.18008622c
test rax, rax
je 0x18002a445
mov rcx, qword [0x1800f3ea0]
call fcn.180001f70
call qword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov ecx, 0x800
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov rcx, qword [0x1800ef018]
xor esi, esi
mov rbx, qword [0x1800ef010]
cmp rbx, rcx
jae 0x18002a4b7
mov qword [rsp + 0x38], rdi
mov rdi, qword [rbx]
test rdi, rdi
je 0x18002a4a9
mov ecx, 1
call qword [rdi + 8]
mov esi, eax
test eax, eax
js 0x18002a4b2
call qword [rdi + 0x30]
mov rcx, qword [rdi]
mov r8d, 1
mov rdx, rax
call fcn.180029af0
mov esi, eax
test eax, eax
js 0x18002a4b2
mov rcx, qword [0x1800ef018]
add rbx, 8
cmp rbx, rcx
jb 0x18002a472
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
test esi, esi
js 0x18002a4d7
mov rax, qword [0x1800f3da0]
test rax, rax
je 0x18002a4d7
mov rcx, qword [0x180104ab8]
call rax
mov esi, eax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov rbp, qword [rsp + 0x40]
mov eax, esi
add rsp, 0x20
pop rsi
ret

Function at 0x18002b830
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1800ef3c8]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp byte [0x1800ef321], 0
mov rsi, r8
mov rdi, rdx
je 0x18002b94a
cmp byte [0x1800fb6cf], 0
je 0x18002b94a
xor ebx, ebx
test ecx, ecx
je 0x18002b886
cmp ecx, 1
je 0x18002b881
lea eax, [rcx - 2]
cmp eax, 1
ja 0x18002b886
mov ebx, 1
jmp 0x18002b886
mov ebx, 3
test ebx, ebx
je 0x18002b94a
mov qword [rsp + 0x60], rbp
mov ecx, 0xfffffff4
mov qword [rsp + 0x78], r14
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx r14d, word [rsp + 0x28]
mov ecx, 2
call fcn.180093264
mov rcx, rax
call fcn.180093708
sub ebx, 1
je 0x18002b8f0
sub ebx, 1
je 0x18002b8e9
cmp ebx, 1
je 0x18002b8e2
mov eax, 8
jmp 0x18002b8f5
mov eax, 0xe
jmp 0x18002b8f5
mov eax, 0xa
jmp 0x18002b8f5
mov eax, 0xc
movzx edx, ax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 2
call fcn.180093264
mov r9, rax
mov r8d, 1
mov rdx, rsi
mov rcx, rdi
call fcn.18009423c
mov ecx, 2
call fcn.180093264
mov rcx, rax
call fcn.180093708
movzx edx, r14w
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r14, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x60]
jmp 0x18002b968
mov ecx, 2
call fcn.180093264
mov r9, rax
mov r8d, 1
mov rdx, rsi
mov rcx, rdi
call fcn.18009423c
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180067630
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18002c020
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1800ef3c8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x10
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x18002c08a
lea rax, [rsp + 0x28]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x18002c060
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.180016ee0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180067630
add rsp, 0x40
pop rbx
ret
mov qword [rbx + 0x10], 0
cmp qword [rbx + 0x18], 0x10
jb 0x18002c09c
mov rbx, qword [rbx]
mov byte [rbx], 0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180067630
add rsp, 0x40
pop rbx
ret
Function at 0x18002c3a0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1800ef3c8]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov rbx, rcx
mov r8, rcx
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
call fcn.18002a700
mov rax, qword [rbx]
mov qword [rbx + 8], rax
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, 0xf
test eax, eax
je 0x18002c4ae
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x20], 0
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18002c420
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180016ee0
nop
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x18002c464
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rdx + 0x10], xmm1
mov rdx, rdi
mov byte [rsp + 0x20], 0
add qword [rbx + 8], 0x20
jmp 0x18002c476
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.18002a790
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18002c4ae
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002c4a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002c607
call fcn.1800670f8
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x20], 0
mov r8d, 7
lea rdx, str.C:_tmp_
lea rcx, [rsp + 0x20]
call fcn.180016ee0
nop
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x18002c503
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rdx + 0x10], xmm1
mov rdx, rdi
mov byte [rsp + 0x20], 0
add qword [rbx + 8], 0x20
jmp 0x18002c515
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.18002a790
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18002c54d
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002c548
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002c607
call fcn.1800670f8
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x20], 0
mov r8d, 8
lea rdx, str.C:_temp_
lea rcx, [rsp + 0x20]
call fcn.180016ee0
nop
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x18002c59f
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rdx + 0x10], xmm1
mov byte [rsp + 0x20], 0
add qword [rbx + 8], 0x20
jmp 0x18002c5b1
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.18002a790
mov rdi, qword [rsp + 0x38]
cmp rdi, 0x10
jb 0x18002c5e6
lea rdx, [rdi + 1]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002c5e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002c607
call fcn.1800670f8
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.180067630
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.18008a97c
int3
Function at 0x180033e80
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x150
mov rax, qword [0x1800ef3c8]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbp, r8
mov rsi, rdx
mov r14, rcx
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x40]
call fcn.180085fa0
mov qword [rsp + 0x38], 0
mov r8d, 0x100
lea rdx, [rsp + 0x40]
lea rcx, [0x1800bb928]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x180033f26
lea r9d, [rax + 2]
lea r8d, [rax + 0x41]
lea rdx, str.Z:01.NewDevelopment018.Game6.0OpenSourceEmbeddingSarAsio_DLL__VS2019mmwrapper.cpp
lea rcx, [rsp + 0x20]
call fcn.18002b060
nop
mov rcx, rax
call fcn.18002fc40
mov rcx, rax
lea rdx, str.Failed_to_get_MMDEVAPI_PATH
call fcn.1800069c0
nop
lea rcx, [rsp + 0x20]
call fcn.18002b390
mov ebx, 0x80004005
jmp 0x180034085
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180033f7f
lea r9d, [rax + 2]
lea r8d, [rax + 0x48]
lea rdx, str.Z:01.NewDevelopment018.Game6.0OpenSourceEmbeddingSarAsio_DLL__VS2019mmwrapper.cpp
lea rcx, [rsp + 0x20]
call fcn.18002b060
nop
mov rcx, rax
call fcn.18002fc40
mov rcx, rax
lea rdx, str.Failed_to_load_MMDevAPI
call fcn.1800069c0
nop
lea rcx, [rsp + 0x20]
call fcn.18002b390
mov ebx, 0x80004005
jmp 0x180034085
lea rdx, [0x1800bb9e0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x180033fe6
lea r9d, [rax + 2]
lea r8d, [rax + 0x50]
lea rdx, str.Z:01.NewDevelopment018.Game6.0OpenSourceEmbeddingSarAsio_DLL__VS2019mmwrapper.cpp
lea rcx, [rsp + 0x20]
call fcn.18002b060
nop
mov rcx, rax
call fcn.18002fc40
mov rcx, rax
lea rdx, str.Failed_to_get_DllClassObject_from_MMDevAPI
call fcn.1800069c0
nop
lea rcx, [rsp + 0x20]
call fcn.18002b390
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, 0x80004005
jmp 0x180034085
lea r8, [rsp + 0x30]
mov rdx, rdi
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
lea r8, [rsp + 0x30]
lea rdx, [sym.SarAsio.dll_DllGetClassObject]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x38]
lea rdx, [0x1800bcf90]
mov rcx, r14
call rdi
mov ebx, eax
test eax, eax
jns 0x180034070
mov r9d, 2
lea r8d, [r9 + 0x66]
lea rdx, str.Z:01.NewDevelopment018.Game6.0OpenSourceEmbeddingSarAsio_DLL__VS2019mmwrapper.cpp
lea rcx, [rsp + 0x20]
call fcn.18002b060
nop
mov rcx, rax
call fcn.18002fc40
mov rcx, rax
lea rdx, str.Failed_to_instantiate_class_factory
call fcn.1800069c0
nop
lea rcx, [rsp + 0x20]
call fcn.18002b390
jmp 0x180034085
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
mov r9, rbp
mov r8, rsi
xor edx, edx
call qword [rax + 0x18]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x180034095
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180067630
add rsp, 0x150
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800340c0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x180034175
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x180034141
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180034160
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180034160
mov rdx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je 0x180034160
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x1800f3f00], 0
jne 0x1800341c0
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800341b0
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800f3ef8], rax
mov byte [0x1800f3f00], 1
jmp 0x1800341c7
mov rax, qword [0x1800f3ef8]
mov byte [0x1800f3f00], 1
jmp 0x1800341c7
mov rax, qword [0x1800f3ef8]
mov rcx, qword [rbx]
mov rdx, rsi
test rax, rax
je 0x18003414a
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp rax
Function at 0x180034a10
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1800ef3c8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov qword [rsp + 0x48], rbp
mov r8, rdx
mov qword [rsp + 0x40], rbp
mov rdx, qword [rcx]
mov rdi, rcx
or r9d, 0x2001f
mov qword [rsp + 0x50], rbp
lea rcx, [rsp + 0x40]
call fcn.18002a020
mov ebx, eax
test eax, eax
jne 0x180034b27
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x58], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180034b01
nop dword [rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.180034a10
mov ebx, eax
test eax, eax
jne 0x180034b27
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x58], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x180034ab0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180034b16
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
mov rdx, rsi
mov dword [rsp + 0x48], ebp
mov rcx, rdi
call fcn.1800340c0
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180034b37
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180067630
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x180035040
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x1800ef3c8]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], r14
xor edx, edx
mov r8d, 0x408
lea rcx, [rsp + 0x60]
call fcn.180085fa0
mov qword [rsp + 0x60], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1800350d7
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1800350d7
call fcn.1800335e0
mov ebx, eax
jmp 0x1800351fc
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x1800350f8
call fcn.1800335e0
jmp 0x1800351eb
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x18003511b
call fcn.1800335e0
jmp 0x1800351eb
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x18003513d
mov ebx, 0x8007000e
jmp 0x1800351ed
mov ecx, eax
test eax, eax
je 0x180035172
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x180035234
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x180035172
lea rcx, [rsp + 0x60]
call fcn.180033430
jmp 0x18003517c
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x18003518f
cmp qword [rsp + 0x60], 0
jne 0x18003519e
mov ebx, 0x8007000e
jmp 0x1800351ed
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1800351c8
call fcn.1800335e0
jmp 0x1800351eb
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.180034b60
mov ebx, eax
test rdi, rdi
je 0x1800351fc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x180035213
lea rcx, [rsp + 0x60]
call fcn.1800341f0
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.180067630
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.180005ca0
int3
Function at 0x18003a970
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x1800ef3c8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rdx
mov qword [rsp + 0x30], rcx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.180085fa0
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x18003aa03
lea rdx, str.SynchronousAudioRouter_
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp qword [rdi + 0x18], 8
jb 0x18003a9f5
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor eax, eax
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rax
mov r8, 0xffffffffffffffff
mov word [rbx], ax
lea rax, [rsp + 0x40]
inc r8
cmp word [rax + r8*2], 0
jne 0x18003aa20
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180017040
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180067630
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret

Function at 0x18003aa60
Capabilities:
Create directory
Get common file path

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x1800ef3c8]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor r9d, r9d
mov qword [rsp + 0x30], rcx
mov rbx, rcx
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x18003aae1
lea rdx, str.SynchronousAudioRouter_
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, str.logs_
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rax
mov r8, 0xffffffffffffffff
mov word [rbx], ax
lea rax, [rsp + 0x40]
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x18003ab00
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180017040
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180067630
add rsp, 0x260
pop rbx
ret
Function at 0x18003c3e0
Capabilities:
Get file version info

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x1800ef3c8]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0x38], rcx
mov rbx, rcx
cmp qword [rdx + 0x18], 8
mov rdi, rdx
mov rcx, rdx
jb 0x18003c415
mov rcx, qword [rdx]
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test eax, eax
jne 0x18003c44a
xor edi, edi
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
lea rdx, [0x1800b8f28]
xor r8d, r8d
mov word [rbx], di
mov rcx, rbx
call fcn.180017040
jmp 0x18003c588
mov rcx, rsi
mov qword [rsp + 0x120], rbp
call fcn.1800989a4
cmp qword [rdi + 0x18], 8
mov rbp, rax
jb 0x18003c467
mov rdi, qword [rdi]
mov r9, rbp
mov r8d, esi
xor edx, edx
mov rcx, rdi
call sub.VERSION.dll_GetFileVersionInfoW
mov rcx, rbp
test eax, eax
je 0x18003c49b
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x38]
lea rdx, str.VarFileInfoTranslation
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x18003c4c8
mov rcx, rbp
call fcn.18008aacc
xor edi, edi
lea rdx, [0x1800b8f28]
mov qword [rbx + 0x10], rdi
xor r8d, r8d
mov qword [rbx + 0x18], 7
mov rcx, rbx
mov word [rbx], di
call fcn.180017040
jmp 0x18003c580
cmp dword [rsp + 0x40], 4
mov rcx, rbp
jb 0x18003c49b
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x30]
lea rdx, str.StringFileInfo00000000FileDescription
call sub.VERSION.dll_VerQueryValueW
mov rsi, 0xffffffffffffffff
test eax, eax
jne 0x18003c537
mov rax, qword [rsp + 0x38]
lea r8, str.StringFileInfo_04x_04xFileDescription
mov rdx, rsi
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x70]
call fcn.180039de0
lea r9, [rsp + 0x44]
mov rcx, rbp
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x18003c498
mov rdx, qword [rsp + 0x30]
xor edi, edi
mov qword [rsp + 0x58], rdi
mov word [rsp + 0x48], di
mov qword [rsp + 0x60], 7
inc rsi
cmp word [rdx + rsi*2], di
jne 0x18003c551
mov r8, rsi
lea rcx, [rsp + 0x48]
call fcn.180017040
mov rcx, rbp
call fcn.18008aacc
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov rbp, qword [rsp + 0x120]
mov rax, rbx
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.180067630
add rsp, 0xf0
pop rdi
pop rsi
pop rbx
ret

Function at 0x18005e670
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x180049982
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x180049965
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x180049950

Function at 0x180066e18
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x1801042b0]
mov ebx, r9d
mov rdi, r8
mov esi, edx
test rax, rax
je 0x180066e43
call qword [case.0x1800704ce.0]
jmp 0x180066e58
call fcn.180066de4
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18006989c
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1800698af
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.180069eb0
lea rdx, [0x1800ec168]
lea rcx, [rsp + 0x20]
call fcn.180084a54
int3

Function at 0x180075468
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x180104bc0]
xor edx, edx
jmp fcn.18006989c

Function at 0x180075de0
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x180104bc0]
jmp fcn.18006989c

Function at 0x180081610
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1800816cc]
mov r9, qword [r9 + 8]
jmp fcn.180071a48

Function at 0x1800816a4
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1800816dc]
mov r9, qword [r9 + 8]
jmp fcn.180071a48

Function at 0x18008ad78
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x18008ac4f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18008ac4f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18008ac4f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18008ac4f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18008ac4f
cmp dword [rcx + 0x84], 0xe
jbe 0x18008ac4f
cmp dword [rcx + 0xf8], 0
je 0x18008ac4f
mov ecx, ebx
call fcn.18008acf0
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.18008aae0
cmp dword [rbp + 0x20], 0
je 0x18008ac9c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.18008aca4
int3
xor r8d, r8d
xor edx, edx
jmp 0x18008abe8

Function at 0x1800abea4
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1800abec4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180094784
or eax, 0xffffffff
jmp 0x1800abec6
xor eax, eax
add rsp, 0x28
ret