joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800326a0
Capabilities:
Read file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x60], 0
je 0x1800326cc
mov rax, qword [rsp + 0x60]
mov qword [rax], 0
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.180032810
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1800326ef
xor eax, eax
jmp 0x180032808
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180032730
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
je 0x180032730
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
je 0x180032742
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
jmp 0x180032808
movsxd rax, dword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movsxd rax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180035570
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x180032783
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
jmp 0x180032808
mov r9, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov edx, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, qword [rsp + 0x30]
je 0x1800327bd
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rsp + 0x38]
call fcn.1800355d0
xor eax, eax
jmp 0x180032808
cmp dword [rsp + 0x68], 0
jle 0x1800327e3
movsxd rax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rdx, rcx
mov rcx, rdx
mov r8, rax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
cmp qword [rsp + 0x60], 0
je 0x180032803
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x38]
add rsp, 0x48
ret

Function at 0x180032b10
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x180067960]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x180032b9e
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x180032b42
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret
Function at 0x180032bb0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x180067960]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x180032cb4
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x180032caf
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x180032c84
cmp qword [rsp + 0x38], 2
jb 0x180032c84
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180032c84
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180032c84
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x180032bf7
jmp 0x180032d46
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x180032d46
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x180032d1c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180032d1c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180032d1c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x180032cb4
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x18003d700
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x180075028]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
xorps xmm0, xmm0
movss dword [rax + 0x2f28], xmm0
cmp qword [rsp + 0x50], 0
jne 0x18003d72f
jmp 0x18003d78c
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x28]
call fcn.18003d7a0
mov qword [rsp + 0x38], rax
lea rdx, [0x1800673bc]
mov rcx, qword [rsp + 0x50]
call fcn.180032810
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x18003d767
jmp 0x18003d78c
mov r9, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov edx, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add rsp, 0x48
ret
Function at 0x1800621f0
Capabilities:
Create directory
Delete directory
Get common file path
Move file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2f0
lea rax, [rsp + 0xb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rcx, [rsp + 0x20]
call fcn.1800131c0
lea rcx, [rsp + 0x50]
call fcn.1800131c0
lea rcx, [rsp + 0x90]
call fcn.1800131c0
lea rcx, [rsp + 0x70]
call fcn.1800131c0
lea rdx, [rsp + 0xd0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.1800139c0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, 0xa
lea rdx, [rsp + 0x1e0]
mov ecx, eax
call fcn.180062700
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1800602f0
lea rcx, [rsp + 0x20]
call fcn.180003850
lea rdx, [rsp + 0xb0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.180060050
lea rdx, str....._
lea rcx, [rsp + 0x50]
call fcn.1800602f0
lea rcx, [rsp + 0x50]
call fcn.180003850
lea rdx, [rsp + 0xb0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x90]
call fcn.180060050
lea rdx, str.....TemporaryFile
lea rcx, [rsp + 0x90]
call fcn.1800602f0
lea rcx, [rsp + 0x90]
call fcn.180003850
mov rdx, rax
mov rcx, qword [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x70]
call fcn.180060050
lea rdx, str.TemporaryFile
lea rcx, [rsp + 0x70]
call fcn.1800602f0
lea rcx, [rsp + 0x70]
call fcn.180003850
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
call fcn.180003850
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea rcx, [rsp + 0x20]
call fcn.180003850
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea rcx, [rsp + 0x70]
call fcn.180002d50
lea rcx, [rsp + 0x90]
call fcn.180002d50
lea rcx, [rsp + 0x50]
call fcn.180002d50
lea rcx, [rsp + 0x20]
call fcn.180002d50
add rsp, 0x2f0
pop rdi
ret
Function at 0x180062ae0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xe8
mov eax, dword [rsp + 0xf8]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
je 0x180062b0c
jmp 0x180062ca8
lea rdx, str.TslGame.exe
lea rcx, [rsp + 0x47]
call fcn.1800120f0
mov rcx, rax
call fcn.180024570
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180062ca1
lea rdx, [0x18006ca90]
lea rcx, [rsp + 0x93]
call fcn.18000dfc0
mov rcx, rax
call fcn.180023cb0
mov rdx, rax
lea rcx, [0x180076170]
call fcn.1800139c0
mov edx, 6
lea rcx, [rsp + 0x58]
call fcn.180062980
mov rdx, rax
lea rcx, [0x180076170]
call fcn.1800602c0
lea rcx, [rsp + 0x58]
call fcn.180002d50
lea rdx, str..dll
lea rcx, [rsp + 0x38]
call fcn.180012900
mov rcx, rax
call fcn.180024810
mov rdx, rax
lea rcx, [0x180076170]
call fcn.1800602f0
lea rcx, [0x180076170]
call fcn.180003850
mov qword [0x18006f7c8], rax
lea rdx, str.C:UsersPublicDownloads_nt.dll
lea rcx, [rsp + 0xb4]
call fcn.18000dfc0
mov rcx, rax
call fcn.180023cb0
mov rdx, rax
lea rcx, [0x180076138]
call fcn.1800139c0
lea rcx, [0x180076138]
call fcn.180003850
mov qword [0x18006f7d0], rax
mov rdx, qword [0x18006f7c8]
mov rcx, qword [0x18006f7d0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
mov rcx, qword [0x18006f7c8]
call fcn.1800621f0
mov rcx, qword [rsp + 0xf0]
call fcn.180062aa0
lea rdx, str.ZwCreateSymbolicLinkObject
lea rcx, [rsp + 0x78]
call fcn.18005f4a0
mov rcx, rax
call fcn.180062110
mov qword [rsp + 0x28], rax
lea rdx, str.Ntdll.dll
lea rcx, [rsp + 0x3d]
call fcn.180012450
mov rcx, rax
call fcn.180024650
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [rax + 4]
inc eax
mov eax, eax
mov qword [0x180075568], rax
xor edx, edx
lea rcx, [0x180061370]
call fcn.180061010
mov eax, 1
jmp 0x180062cad
mov eax, 1
add rsp, 0xe8
ret
Function at 0x1800184f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x18007c0b0]
xor ebx, ebx
lea rcx, [0x18007ad70]
lea r8d, [rbx + 0x60]
xor edx, edx
mov dword [0x18007b940], ebx
mov dword [0x180076d50], ebx
mov dword [0x18007b894], ebx
mov dword [0x18007b970], ebx
mov dword [0x18007b890], ebx
mov dword [0x18007b060], ebx
mov dword [0x18007ad60], ebx
mov dword [0x18007b968], ebx
mov dword [0x18007adf0], ebx
mov dword [0x18007ad6c], ebx
mov dword [0x18007b874], ebx
mov dword [0x180048620], 1
mov dword [0x18004861c], 1
mov dword [0x18007b948], ebx
mov dword [0x180076d54], ebx
mov dword [0x180048624], 1
mov dword [0x18007b03c], ebx
mov dword [0x18007b064], ebx
mov dword [0x18007b934], ebx
mov qword [0x180076d48], rbx
mov qword [0x18007b888], rbx
mov qword [0x18007b040], rbx
mov qword [0x18007b928], rbx
mov dword [0x180048618], 1
mov dword [0x180048610], 1
mov dword [0x18007b05c], ebx
mov dword [0x18007b8b4], ebx
mov dword [0x18007b8ac], ebx
mov qword [0x180076d38], rbx
mov qword [0x18007c0b8], rax
call fcn.180008040
lea r8d, [rbx + 0x60]
lea rcx, [0x18007b8c0]
xor edx, edx
call fcn.180008040
mov dword [0x18007b04c], ebx
mov dword [0x18007ad64], ebx
movsd xmm0, qword [0x180041638]
movsd qword [0x180048628], xmm0
mov dword [0x180076d44], ebx
mov dword [0x18007b8a4], ebx
mov dword [0x18007b870], ebx
mov dword [0x18007adf8], ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [0x180076d58]
mov dword [0x18007b930], eax
mov dword [0x18007b8b0], eax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x180076d58]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x6d6e6977
mov dword [rbp - 0x1c], 0x6c642e6d
mov word [rbp - 0x18], 0x6c
mov qword [0x180076d30], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800186bb
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x10], 0x656d6974
mov dword [rbp - 0xc], 0x54746547
mov dword [rbp - 8], 0x656d69
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800186bb
call rax
mov dword [0x18007adfc], eax
mov dword [0x18007b058], eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1800186d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18007add0]
mov rbx, rdx
mov rdi, rcx
test rax, rax
jne 0x180018756
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x6c64746e
mov dword [rbp - 0x2c], 0x6c642e6c
mov word [rbp - 0x28], 0x6c
mov dword [rbp - 0x20], 0x466c7452
mov dword [rbp - 0x1c], 0x6873756c
mov dword [rbp - 0x18], 0x75636553
mov dword [rbp - 0x14], 0x654d6572
mov dword [rbp - 0x10], 0x79726f6d
mov dword [rbp - 0xc], 0x68636143
mov word [rbp - 8], 0x65
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007add0], rax
mov rdx, rbx
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x180019f60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
cmp qword [0x18007b9c8], 0
je 0x180019f7e
mov eax, 1
add rsp, 0x50
pop rbp
ret
mov rcx, qword [sym.imp.USER32.dll_GetCursorPos]
mov r8d, 0x14
call fcn.18001a420
mov rcx, qword [sym.imp.USER32.dll_GetCursorPos]
mov r8d, 0xa
mov qword [0x18007b9c8], rax
call fcn.18001a320
mov dword [0x18007b998], eax
call fcn.18001a060
test eax, eax
jne 0x18001a03c
mov rcx, qword [sym.imp.USER32.dll_SetCursorPos]
lea r8d, [rax + 0xd]
call fcn.18001a320
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x72657375
mov dword [rbp - 0x2c], 0x642e3233
mov word [rbp - 0x28], 0x6c6c
mov byte [rbp - 0x26], 0
mov dword [0x18007b9a8], eax
mov dword [rbp - 0x20], 0x50746553
mov dword [rbp - 0x1c], 0x69737968
mov dword [rbp - 0x18], 0x436c6163
mov dword [rbp - 0x14], 0x6f737275
mov dword [rbp - 0x10], 0x736f5072
mov byte [rbp - 0xc], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8d, 0xd
mov rcx, rax
call fcn.18001a320
mov dword [0x18007b978], eax
xor eax, eax
cmp qword [0x18007b9c8], rax
setne al
add rsp, 0x50
pop rbp
ret

Function at 0x18001a060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
cmp qword [0x18007b9a0], 0
jne 0x18001a18b
cmp qword [0x18007b980], 0
jne 0x18001a18b
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x336e6977
mov dword [rbp - 0x4c], 0x642e7532
mov word [rbp - 0x48], 0x6c6c
mov byte [rbp - 0x46], 0
mov dword [rbp - 0x20], 0x7355744e
mov dword [rbp - 0x1c], 0x65537265
mov dword [rbp - 0x18], 0x72754374
mov dword [rbp - 0x14], 0x50726f73
mov word [rbp - 0x10], 0x736f
mov byte [rbp - 0xe], 0
mov dword [rbp - 0x40], 0x72657375
mov dword [rbp - 0x3c], 0x642e3233
mov word [rbp - 0x38], 0x6c6c
mov byte [rbp - 0x36], 0
mov dword [rbp - 0x30], 0x43746553
mov dword [rbp - 0x2c], 0x6f737275
mov dword [rbp - 0x28], 0x736f5072
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001a16f
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp byte [rax], 0xff
jne 0x18001a125
cmp byte [rax + 1], 0x25
je 0x18001a131
cmp byte [rax + 1], 0xff
jne 0x18001a151
cmp byte [rax + 2], 0x25
jne 0x18001a151
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007b980], rax
jmp 0x18001a16f
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007b9a0], rax
cmp qword [0x18007b9a0], 0
jne 0x18001a18b
cmp qword [0x18007b980], 0
jne 0x18001a18b
xor eax, eax
add rsp, 0x70
pop rbp
ret
mov eax, 1
add rsp, 0x70
pop rbp
ret
Function at 0x18001aea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
xor r13d, r13d
mov r15, rcx
lea rcx, [rsp + 0x50]
mov edi, r13d
mov r12, rdx
mov dword [rsp + 0x50], 0x6c64746e
mov dword [rsp + 0x54], 0x6c642e6c
mov dword [rsp + 0x58], 0x6c
mov dword [rsp + 0x30], 0x7551775a
mov byte [rsp + 0x5c], dil
mov dword [rsp + 0x48], edi
mov byte [rsp + 0x4c], dil
mov dword [rsp + 0x34], 0x56797265
mov dword [rsp + 0x38], 0x75747269
mov dword [rsp + 0x3c], 0x654d6c61
mov qword [rsp + 0x40], 0x79726f6d
mov ebx, r13d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x18001b03e
mov qword [rsp + 0x360], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rsi, rax
test rax, rax
je 0x18001b034
lea rcx, [rbp - 0x60]
xor edx, edx
mov r8d, 0x80
call fcn.180008040
lea rax, [rbp - 0x60]
or r9d, 0xffffffff
mov r8, r15
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x3c
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r15d, 0x80000000
nop dword [rax + rax]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x30
call r14
test eax, eax
js 0x18001b024
cmp dword [rbp - 0x68], 0x1000000
jne 0x18001b024
cmp qword [rsp + 0x78], rdi
je 0x18001b024
lea r9, [rbp + 0x20]
mov r8d, 2
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x20c
call r14
test eax, eax
js 0x18001b024
mov rcx, qword [rbp + 0x28]
mov edx, 0x5c
call fcn.1800038b4
lea rcx, [rbp - 0x60]
lea rdx, [rax + 2]
call fcn.180003740
test eax, eax
jne 0x18001b024
cmp rbx, r12
jne 0x18001b05b
test rdi, rdi
jne 0x18001b05b
mov rdi, qword [rsp + 0x78]
add rbx, 0x10000
cmp rbx, r15
jb 0x18001afa0
xor eax, eax
mov rsi, qword [rsp + 0x360]
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rax, rbx
jmp 0x18001b036
Function at 0x18001d180
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6778645c
mov dword [rsp + 0x24], 0x6c642e69
mov word [rsp + 0x28], 0x6c
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d1f8
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d1ed
add rax, rbx
add rsp, 0x230
pop rbx
ret

Function at 0x18001d210
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6e69645c
mov dword [rsp + 0x24], 0x2e747570
mov dword [rsp + 0x28], 0x6c6c64
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d289
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d27e
add rax, rbx
add rsp, 0x230
pop rbx
ret

Function at 0x18001d2a0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6e69645c
mov dword [rsp + 0x24], 0x2e747570
mov dword [rsp + 0x28], 0x6c6c64
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d319
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d30e
add rax, rbx
add rsp, 0x230
pop rbx
ret

Function at 0x18001d330
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6e69645c
mov dword [rsp + 0x24], 0x38747570
mov dword [rsp + 0x28], 0x6c6c642e
mov byte [rsp + 0x2c], 0
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d3ae
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d3a3
add rax, rbx
add rsp, 0x230
pop rbx
ret
Function at 0x18001d3d0
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6e69645c
mov dword [rsp + 0x24], 0x38747570
mov dword [rsp + 0x28], 0x6c6c642e
mov byte [rsp + 0x2c], 0
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d44e
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d443
add rax, rbx
add rsp, 0x230
pop rbx
ret

Function at 0x18001d470
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x7264645c
mov dword [rsp + 0x24], 0x642e7761
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x2a], 0
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d4ed
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d4e2
add rax, rbx
add rsp, 0x230
pop rbx
ret

Function at 0x18001d510
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6433645c
mov dword [rsp + 0x24], 0x6c642e39
mov word [rsp + 0x28], 0x6c
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d588
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d57d
add rax, rbx
add rsp, 0x230
pop rbx
ret