joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18028d4de
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0xa
mov edx, dword [rcx + rax*4]
bswap edx
mov dword [rcx + rax*4], edx
inc rax
cmp rax, 0x1a
jne 0x18028d4ef
mov eax, 0x1a
mov edx, dword [rcx + rax*4 - 0x20]
xor edx, dword [rcx + rax*4 - 0xc]
xor edx, dword [rcx + rax*4 - 0x38]
xor edx, dword [rcx + rax*4 - 0x40]
rol edx, 1
mov dword [rcx + rax*4], edx
inc rax
cmp rax, 0x5a
jne 0x18028d505
mov r10d, dword [rcx + 0x14]
mov r9d, dword [rcx + 0x18]
mov r8d, dword [rcx + 0x1c]
mov edx, dword [rcx + 0x20]
mov eax, dword [rcx + 0x24]
xor r14d, r14d
mov ebp, r10d
mov r12d, edx
mov r13d, r8d
mov ebx, r9d
mov r11d, eax
jmp 0x18028d57f
mov ebp, edi
and ebp, esi
mov r13d, edi
not r13d
and r13d, r11d
add r13d, r12d
add ebp, r15d
add ebp, r13d
add ebp, dword [rcx + r14*4 + 0x28]
mov r13d, 0x5a827999
add ebp, r13d
rol edi, 0x1e
inc r14
mov r12d, esi
mov r13d, edi
cmp r14, 0x50
je 0x18028d5f2
mov r15d, r11d
mov edi, ebx
mov esi, r13d
mov r11d, r12d
mov ebx, ebp
mov r12d, ebp
rol r12d, 5
cmp r14, 0x14
jb 0x18028d549
cmp r14, 0x28
jae 0x18028d5b9
mov ebp, esi
xor ebp, r11d
xor ebp, edi
add ebp, r12d
add ebp, r15d
add ebp, dword [rcx + r14*4 + 0x28]
mov r13d, 0x6ed9eba1
jmp 0x18028d56a
cmp r14, 0x3b
ja 0x18028d5e3
mov r13d, esi
or r13d, r11d
and r13d, edi
mov ebp, esi
and ebp, r11d
or ebp, r13d
mov r13d, 0x8f1bbcdc
add ebp, r15d
add ebp, r12d
add ebp, dword [rcx + r14*4 + 0x28]
jmp 0x18028d56a
mov ebp, esi
xor ebp, r11d
xor ebp, edi
mov r13d, 0xca62c1d6
jmp 0x18028d5d6
mov dword [rcx], ebp
mov dword [rcx + 0xc], esi
mov dword [rcx + 8], edi
mov dword [rcx + 4], ebx
mov dword [rcx + 0x10], r11d
add r10d, ebp
mov dword [rcx + 0x14], r10d
add r9d, ebx
mov dword [rcx + 0x18], r9d
add r8d, edi
mov dword [rcx + 0x1c], r8d
add edx, esi
mov dword [rcx + 0x20], edx
add eax, r11d
mov dword [rcx + 0x24], eax
mov dword [rcx + 0x168], 0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x18028d8f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r15, [rsp + 0x34]
mov dword [r15], 0xaaaaaaaa
mov qword [rsp + 0x20], r15
mov r8, r9
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x18028d99b
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r12, [rsp + 0x28]
mov qword [r12], rax
mov qword [rsp + 0x20], r12
mov rcx, rbx
mov rdx, rdi
mov r8, r14
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebp, eax
mov r14, qword [r12]
mov r9d, dword [rsp + 0x34]
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x18028d99b
test ebp, ebp
setne al
cmp r14, rsi
sete sil
and sil, al
jmp 0x18028d99d
xor esi, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1801e6610
mov eax, esi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1802b1360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x1802b14ae
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x60], 0
je 0x1802b150a
mov edi, dword [rsi + 0x5c]
test bl, bl
je 0x1802b14ea
mov dword [rsi + 0x5c], 0xffffffff
mov byte [rsi + 0x60], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1801e6610
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp byte [rsi + 0x61], 0
je 0x1802b154d
mov rcx, qword [rsi + 0x40]
call fcn.180204da4
mov edi, 0xffffffff
cmp eax, 0xffffffff
je 0x1802b14ea
test bl, bl
je 0x1802b1531
movzx ebx, al
mov dword [rsi + 0x5c], ebx
mov edi, ebx
jmp 0x1802b14ea
mov rdx, qword [rsi + 0x40]
movzx ebx, al
mov ecx, ebx
call fcn.1802081b4
cmp eax, 0xffffffff
jne 0x1802b152d
jmp 0x1802b14ea
mov edi, 0xffffffff
jmp 0x1802b14ea
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], rdi
mov eax, dword [rsi + 0x58]
cmp eax, 2
mov r15d, 1
cmovge r15d, eax
xor r14d, r14d
mov rcx, qword [rsi + 0x40]
call fcn.180204da4
cmp eax, 0xffffffff
je 0x1802b1546
mov byte [rsp + r14 + 0x58], al
inc r14
cmp r15, r14
jne 0x1802b156f
lea rax, [rsp + 0x58]
mov byte [rax - 1], 0xaa
lea rax, [rsp + 0x48]
mov qword [rax], rdi
lea rbp, [rsp + 0x40]
mov qword [rbp], rdi
mov edi, 0xffffffff
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r14d, dword [rdx]
movzx r12d, word [rdx + 4]
movzx r13d, word [rdx + 6]
lea r9, [rsp + r15 + 0x58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], rbp
lea r8, [rsp + 0x58]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x57]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x58]
call qword [0x1803f5008]
cmp eax, 1
jne 0x1802b1637
mov rax, qword [rsi + 0x50]
mov dword [rax], r14d
mov word [rax + 4], r12w
mov word [rax + 6], r13w
cmp r15d, 8
je 0x1802b14ea
mov rcx, qword [rsi + 0x40]
call fcn.180204da4
cmp eax, 0xffffffff
je 0x1802b14ea
mov byte [rsp + r15 + 0x58], al
inc r15
jmp 0x1802b15a9
cmp eax, 2
je 0x1802b14ea
cmp eax, 3
jne 0x1802b164d
mov al, byte [rsp + 0x58]
mov byte [rsp + 0x57], al
test bl, bl
je 0x1802b1668
movzx edi, byte [rsp + 0x57]
mov dword [rsi + 0x5c], edi
jmp 0x1802b14ea
movzx edi, byte [rsp + 0x57]
jmp 0x1802b14ea
test r15, r15
jle 0x1802b165e
mov rdx, qword [rsi + 0x40]
dec r15
mov eax, r15d
movzx ecx, byte [rsp + rax + 0x58]
call fcn.1802081b4
cmp eax, 0xffffffff
jne 0x1802b1668
jmp 0x1802b14ea

Function at 0x1802b1f60
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1802b1f97
movabs rcx, 0xf000000000000000
shl rax, 4
movsx r9, byte [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
inc rdx
cmp rdx, r8
jne 0x1802b1f71
ret
Function at 0x1802b2010
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1802b2048
movabs rcx, 0xf000000000000000
shl rax, 4
movzx r9d, word [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
add rdx, 2
cmp rdx, r8
jne 0x1802b2021
ret

Function at 0x1802b7eb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x1802b7f1d
movzx edx, word [rbp + 0x60]
movzx r8d, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], r8d
mov word [rsp + 0x20], dx
mov rdx, rsi
mov r8, rdi
call qword [0x1803f5008]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov qword [rsi], rdi
test al, al
jns 0x1802b7eff
call fcn.1801e4f44
jmp 0x1802b7eff
lea rbx, [rbp - 0x20]
mov rcx, r9
mov rdx, rbx
call fcn.1800f65ea
lea rdx, [0x1803d27d8]
mov rcx, rbx
call fcn.1800f90ac
mov r14, rax
mov rcx, qword [rbp - 0x20]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x1802b7f5d
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1803f5008]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x1803467d0]
movaps xmmword [rbx], xmm0
mov rax, qword [r14]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, rbx
call qword [0x1803f5008]
movzx eax, byte [rbx + 0x17]
mov r8d, eax
and r8d, 0x7f
test al, al
mov rcx, qword [rbx]
mov rdx, qword [rbx + 8]
cmovs r8, rdx
test r8, r8
je 0x1802b7f0f
test al, al
mov r14, rbx
cmovs r14, rcx
jmp 0x1802b8008
xor edi, edi
jmp 0x1802b7fdf
lea rdx, [rcx + 2]
mov qword [rdi + 0x30], rdx
mov word [rcx], ax
cmp ax, 0xffff
jne 0x1802b7fd4
xor edi, edi
mov al, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add r14, 2
mov r8d, eax
and r8b, 0x7f
test al, al
mov r9, rbx
cmovs r9, rcx
movzx r8d, r8b
cmovs r8, rdx
lea r8, [r9 + r8*2]
cmp r14, r8
je 0x1802b7f0f
test rdi, rdi
je 0x1802b7fbd
movzx eax, word [r14]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
jne 0x1802b7fc1
mov rcx, qword [rdi]
mov r8, qword [rcx + 0x60]
mov rcx, rdi
mov edx, eax
mov rax, r8
call qword [0x1803f5008]
jmp 0x1802b7fcc
Function at 0x1802c7a99
Capabilities:
Set registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rdi, r9
mov esi, r8d
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x40], rax
cmp byte [0x1803d3468], 0
je 0x1802c7b23
mov ebp, dword [rsp + 0xa0]
xorps xmm0, xmm0
lea r15, [rsp + 0x30]
movaps xmmword [r15], xmm0
mov rcx, r15
mov rdx, r14
call sub.ntdll.dll_RtlInitUnicodeString
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rdi
mov rcx, rbx
mov rdx, r15
xor r8d, r8d
mov r9d, esi
call sub.ntdll.dll_NtSetValueKey
test eax, eax
setns sil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e6610
mov eax, esi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.18016b198
test al, al
jne 0x1802c7ac9
xor esi, esi
jmp 0x1802c7b07
Function at 0x1802c8600
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdx, qword [0x1803d3a78]
test rdx, rdx
je 0x1802c8680
mov rcx, rdi
call fcn.1800d2c38
mov dil, 1
test rsi, rsi
je 0x1802c8658
mov rdx, qword [0x1803d3a80]
mov rcx, rsi
call fcn.1800d2c38
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1801e6610
mov eax, edi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 0x18
call fcn.1801e4f08
mov rbx, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
xor r15d, r15d
mov qword [rax + 0x10], r15
mov qword [0x1803d3a78], rax
mov ecx, 0x18
call fcn.1801e4f08
mov r14, rax
movups xmmword [rax], xmm6
mov qword [rax + 0x10], r15
mov qword [0x1803d3a80], rax
call fcn.18016d6da
mov rax, qword [rax + 8]
mov r15, qword [rax + 0x10]
lea r12, [0x18035a6c8]
mov rcx, r12
call fcn.180206ad4
lea r13, [rsp + 0x38]
mov rcx, r13
mov rdx, r12
mov r8, rax
call fcn.1800fa5f4
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r12, [rsp + 0x20]
mov rcx, r12
mov rdx, rax
call fcn.1801447b6
lea rbp, [rsp + 0x50]
mov rcx, rbp
mov rdx, r12
mov r8, r13
call fcn.18016cc1c
mov rcx, rbp
mov rdx, r15
mov r8, rbx
mov r9, r14
call fcn.1802c7fb4
mov ebx, eax
cmp byte [rbp + 0x17], 0
jns 0x1802c8737
mov rcx, qword [rsp + 0x50]
call fcn.1801e4f44
cmp byte [rsp + 0x37], 0
jns 0x1802c8748
mov rcx, qword [rsp + 0x20]
call fcn.1801e4f44
cmp byte [rsp + 0x4f], 0
jns 0x1802c8759
mov rcx, qword [rsp + 0x38]
call fcn.1801e4f44
test bl, bl
je 0x1802c8769
mov rdx, qword [0x1803d3a78]
jmp 0x1802c8639
xor edi, edi
jmp 0x1802c8658
Function at 0x1802c8cb4
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1802c8d0c
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e6610
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ebx, eax
mov edx, eax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x20]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [0x1803467d0]
movaps xmmword [r14], xmm0
mov rcx, r14
xor r8d, r8d
call fcn.18016a9fe
cmp byte [r14 + 0x17], 0
jns 0x1802c8d45
mov r14, qword [rsp + 0x20]
mov rcx, rdi
mov rdx, r14
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1802c8d72
mov edx, eax
movzx eax, byte [rsp + 0x37]
test al, al
js 0x1802c8d68
and eax, 0x7f
jmp 0x1802c8d6d
mov rax, qword [rsp + 0x28]
cmp rax, rdx
ja 0x1802c8d9a
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
cmp byte [rsp + 0x37], 0
jns 0x1802c8cf2
mov rcx, qword [rsp + 0x20]
call fcn.1801e4f44
jmp 0x1802c8cf2
lea rdi, [rsp + 0x20]
mov rcx, rdi
xor r8d, r8d
call fcn.1800faeb0
mov rax, qword [rdi + 0x10]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
xorps xmm0, xmm0
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
jmp 0x1802c8d80

Function at 0x1802c8dc8
Capabilities:
Set environment variable

Disassembly:
sub rsp, 0x28
cmp byte [rdx + 0x17], 0
jns 0x1802c8dd5
mov rdx, qword [rdx]
cmp byte [rcx + 0x17], 0
jns 0x1802c8dde
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x1802c8dee
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x17], 0
jns 0x1802c8dfb
mov rcx, qword [rcx]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x1802c8e10
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp byte [r8 + 0x17], 0
js 0x1802c8f9f
mov word [rsi], 0
mov byte [rsi + 0x17], 0
test rbx, rbx
je 0x1802c8fb4
lea r8, [rsp + 0x50]
mov qword [r8], 0
lea r9, [rsp + 0x260]
mov dword [r9], 0
lea rdx, str.VarFileInfoTranslation
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1802c8fb4
lea r14, [rsp + 0x50]
mov rax, qword [r14]
movzx ebp, word [rax]
movzx r15d, word [rax + 2]
mov word [rsp + 0x260], bp
mov word [rsp + 0x262], r15w
mov r12, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call r12
mov word [rsp + 0x264], ax
mov word [rsp + 0x266], r15w
mov word [rsp + 0x268], bp
mov bp, 0x4e4
mov word [rsp + 0x26a], bp
call r12
mov word [rsp + 0x26c], ax
mov word [rsp + 0x26e], bp
mov r12, 0xfffffffffffffffe
lea r13, [rsp + 0x44]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.1801e8860
cmp byte [rdi + 0x17], 0
mov rax, rdi
jns 0x1802c8f18
mov rax, qword [rdi]
movzx ecx, word [rsp + r12*2 + 0x264]
movzx edx, word [rsp + r12*2 + 0x266]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], ecx
mov edx, 0x104
mov r8d, 0x104
mov rcx, r14
lea r9, str.StringFileInfo_04hx_04hx_ls
call fcn.1802c97c3
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x44], 0
mov rcx, rbx
mov rdx, r14
lea r8, [rsp + 0x48]
mov r9, r13
call sub.VERSION.dll_VerQueryValueW
test eax, eax
setne al
mov r15, qword [rsp + 0x48]
test r15, r15
setne bpl
and bpl, al
cmp bpl, 1
je 0x1802c8fdc
add r12, 2
cmp r12, 5
jbe 0x1802c8efc
jmp 0x1802c8fb6
mov rax, qword [rsi]
mov word [rax], 0
mov qword [rsi + 8], 0
jmp 0x1802c8e52
xor ebp, ebp
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1801e6610
mov eax, ebp
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r15
call fcn.180206ad4
mov rcx, rsi
mov rdx, r15
mov r8, rax
call fcn.18016a8b2
jmp 0x1802c8fb6
Function at 0x1802c8ff4
Capabilities:
Get file version info

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r9
mov r14, r8
mov rdi, rdx
mov r15, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rdx + 0x17], 0
js 0x1802c902e
mov byte [rdi + 0x17], 6
mov rax, rdi
jmp 0x1802c9039
mov qword [rdi + 8], 6
mov rax, qword [rdi]
movabs rcx, 0x6400450053004d
mov qword [rax], rcx
mov dword [rax + 8], 0x650067
mov word [rax + 0xc], 0
lea rdx, str.0.0.0.0_devel
mov r8d, 0xd
mov rcx, r14
call fcn.18016a8b2
cmp byte [rsi + 0x17], 0
js 0x1802c9079
mov word [rsi], 0
mov byte [rsi + 0x17], 0
jmp 0x1802c9089
mov rax, qword [rsi]
mov word [rax], 0
mov qword [rsi + 8], 0
mov dword [rsp + 0x5c], 0
cmp byte [r15 + 0x17], 0
mov rcx, r15
jns 0x1802c909e
mov rcx, qword [r15]
mov r13, qword [rsp + 0xd0]
lea rdx, [rsp + 0x5c]
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x1802c9228
mov ebp, eax
mov ecx, eax
call fcn.1801e4f7c
mov rbx, rax
mov edx, dword [rsp + 0x5c]
cmp byte [r15 + 0x17], 0
jns 0x1802c90d2
mov r15, qword [r15]
mov rcx, r15
mov r8d, ebp
mov r9, rbx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1802c921b
lea rdx, [0x18035a846]
lea r15, [rsp + 0x40]
mov r8d, 0xe
mov rcx, r15
call fcn.1800fa5f4
mov rcx, rbx
mov rdx, r15
mov r8, r14
call fcn.1802c8e10
cmp byte [r15 + 0x17], 0
jns 0x1802c9121
mov rcx, qword [rsp + 0x40]
call fcn.1801e4f44
xorps xmm0, xmm0
lea r15, [rsp + 0x40]
movaps xmmword [r15], xmm0
mov qword [r15 + 0x10], 0
lea rdx, [0x18035a864]
lea r12, [rsp + 0x28]
mov r8d, 0xe
mov rcx, r12
call fcn.1800fa5f4
mov rcx, rbx
mov rdx, r12
mov r8, r15
call fcn.1802c8e10
cmp byte [r12 + 0x17], 0
jns 0x1802c916f
mov rcx, qword [rsp + 0x28]
call fcn.1801e4f44
lea rdx, [0x18035a882]
lea rcx, [rsp + 0x40]
call fcn.18014d840
test al, al
jne 0x1802c9199
lea rdx, str._devel
mov r8d, 6
mov rcx, r14
call fcn.1800fa7f6
lea rdx, [0x18035a894]
lea r14, [rsp + 0x28]
mov r8d, 0x10
mov rcx, r14
call fcn.1800fa5f4
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call fcn.1802c8e10
cmp byte [r14 + 0x17], 0
jns 0x1802c91d2
mov rcx, qword [rsp + 0x28]
call fcn.1801e4f44
lea rdx, str.SpecialBuild
lea rdi, [rsp + 0x28]
mov r8d, 0xc
mov rcx, rdi
call fcn.1800fa5f4
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.1802c8e10
cmp byte [rdi + 0x17], 0
jns 0x1802c920a
mov rcx, qword [rsp + 0x28]
call fcn.1801e4f44
cmp byte [rsp + 0x57], 0
jns 0x1802c921b
mov rcx, qword [rsp + 0x40]
call fcn.1801e4f44
test rbx, rbx
je 0x1802c9228
mov rcx, rbx
call fcn.1801e4f84
lea rcx, [rsp + 0x40]
mov dl, 1
call fcn.18016ce4b
cmp byte [r13 + 0x17], 0
jns 0x1802c9244
mov rcx, qword [r13]
call fcn.1801e4f44
mov rax, qword [rsp + 0x50]
mov qword [r13 + 0x10], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r13], xmm0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1801e6610
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1802c94ef
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rdi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp byte [rcx + 0x17], 0
mov rsi, rcx
jns 0x1802c9517
mov rsi, qword [rdi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1802c957b
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
lea rdx, [0x18035a9a4]
mov rcx, rdi
mov r8, 0xffffffffffffffff
call fcn.1802c970c
cmp rax, 0xffffffffffffffff
jne 0x1802c95cc
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
je 0x1802c961a
cmp byte [rsp + 0x57], 0
jns 0x1802c95b2
mov rcx, qword [rsp + 0x40]
call fcn.1801e4f44
jmp 0x1802c95b2
test al, 0x10
je 0x1802c959a
lea rcx, str._hs___ls_directory_exists___n
lea rdx, str.RecursiveDirectoryCreate
mov r8, rsi
call fcn.1802c9692
mov dil, 1
jmp 0x1802c95b2
lea rcx, str._hs___ls_directory_conflicts_with_an_existing_file.___n
lea rdx, str.RecursiveDirectoryCreate
mov r8, rsi
call fcn.1802c9692
xor edi, edi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1801e6610
mov eax, edi
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea rcx, [rsp + 0x67]
mov qword [rsp + 0x20], rcx
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rax
call fcn.1800fab02
movups xmm0, xmmword [rbx]
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
mov rax, qword [rbx + 0x10]
mov qword [rcx + 0x10], rax
call fcn.1802c94ef
test al, al
jne 0x1802c9552
lea rcx, str.Failed_to_create_one_of_the_parent_directories
call fcn.1802c9692
jmp 0x1802c968b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xb7
jne 0x1802c9679
lea r14, [rsp + 0x28]
mov rcx, r14
mov rdx, rsi
call fcn.1801447b6
cmp byte [r14 + 0x17], 0
jns 0x1802c9645
mov r14, qword [rsp + 0x28]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
setne al
and ebp, 0x10
shr ebp, 4
and bpl, al
cmp byte [rsp + 0x3f], 0
jns 0x1802c9670
mov rcx, qword [rsp + 0x28]
call fcn.1801e4f44
test bpl, bpl
jne 0x1802c9568
lea rcx, str.Failed_to_create_directory__ls__last_error_is__d_n
mov rdx, rsi
mov r8d, ebx
call fcn.1802c9692
xor edi, edi
jmp 0x1802c9568

Function at 0x1802c9692
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
lea rdi, [rsp + 0x68]
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r9
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
call fcn.1800d3aa0
mov rcx, qword [rax]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdi, [0x1803d3aa0]
mov r8d, 0x400
mov rdx, rdi
mov r9, rsi
call fcn.1801e9c00
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e6610
nop
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x1802c9e44
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test r8, r8
je 0x1802c9ea8
mov rbx, rcx
mov rcx, qword [rcx + 8]
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax + 0x84], 0
je 0x1802c9ea8
add rcx, rax
xor eax, eax
cmp word [rcx + 0x14], 0x78
jb 0x1802c9eaa
add rcx, 0x88
je 0x1802c9eaa
mov rsi, r8
mov rdi, rdx
mov edx, dword [rcx]
mov rcx, rbx
call fcn.1800fb690
test rax, rax
je 0x1802c9ea8
cmp rdi, 0xffff
ja 0x1802c9edb
mov word [rsi], di
mov al, 1
jmp 0x1802c9eaa
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edx, dword [r14 + 0x24]
mov rcx, rbx
call fcn.1800fb690
sub r12, qword [rsp + 0x20]
sar r12, 1
movzx edi, word [rax + r12]
add di, word [r14 + 0x10]
jmp 0x1802c9ea1
mov r14, rax
mov edx, dword [rax + 0x20]
mov rcx, rbx
call fcn.1800fb690
mov rbp, rax
mov eax, dword [r14 + 0x18]
lea r15, [rax*4]
add r15, rbp
lea r13, [rdi + 1]
mov qword [rsp + 0x20], rbp
jmp 0x1802c9f2c
xor ecx, ecx
lea r12, [r12*2]
add r12, rbp
movzx ecx, cl
movzx eax, byte [rax]
lea rdx, [r12 + 4]
cmp ecx, eax
cmovg rbp, rdx
cmovs r15, r12
cmp cl, al
je 0x1802c9ebb
cmp rbp, r15
je 0x1802c9ea8
mov r12, r15
sub r12, rbp
mov rax, r12
sar rax, 2
shr r12, 0x3f
add r12, rax
and r12, 0xfffffffffffffffe
mov edx, dword [rbp + r12*2]
mov rcx, rbx
call fcn.1800fb690
mov cl, byte [rdi]
test cl, cl
je 0x1802c9f06
mov rdx, r13
cmp cl, byte [rax]
jne 0x1802c9f08
inc rax
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x1802c9f63
jmp 0x1802c9f06

Function at 0x1802cc440
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov edi, edx
mov rsi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x1802cc4b1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1802cc4bb
mov dil, 1
test bl, bl
je 0x1802cc49a
cmp byte [rsi + 8], 0
je 0x1802cc4b6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1801e6610
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rsi]
jmp 0x1802cc46d
mov rcx, qword [rsi]
jmp 0x1802cc48f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rsi + 8], 0
je 0x1802cc4e3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1802cc4e8
xor edi, edi
jmp 0x1802cc49a
mov rcx, qword [rsi]
jmp 0x1802cc4d0
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rsi + 8], 0
je 0x1802cc50f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dil, 1
jmp 0x1802cc49a
mov rcx, qword [rsi]
jmp 0x1802cc4ff