joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800385f0
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0xb8], rbx
mov r13d, r8d
mov r14, rdx
mov qword [rsp + 0x50], rcx
xor ebx, ebx
mov qword [rsp + 0x48], rbx
or rdi, 0xffffffffffffffff
cmp r8d, 0x3fe
jbe 0x180038694
lea ecx, [r13 + 2]
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.180097720
mov r14, rax
mov rbx, rax
mov qword [rsp + 0x48], rax
xor ecx, ecx
call fcn.180099070
mov rdx, rbx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x180038685
cmp eax, r13d
ja 0x180038685
mov ecx, eax
mov word [rbx + rcx*2], 0
lea ecx, [rax + 1]
mov word [rbx + rcx*2], 0
mov r13d, eax
jmp 0x1800386a5
mov rcx, r14
call fcn.180099070
xor al, al
jmp 0x1800387e6
mov word [rdx + r13*2], 0
lea eax, [r13 + 1]
mov word [rdx + rax*2], 0
xor eax, eax
xor ebp, ebp
test r13d, r13d
je 0x1800387dc
mov r12, r14
movabs r9, 0x7ffffffffffffffe
mov rbx, qword [rsp + 0x50]
cmp word [r12], 0
jne 0x1800387c7
cmp eax, ebp
je 0x1800387c7
lea r15, [r14 + rax*2]
mov edx, 7
mov qword [rsp + 0x40], rdx
xor r8d, r8d
mov qword [rsp + 0x38], r8
mov word [rsp + 0x28], r8w
xor eax, eax
mov rcx, rdi
mov rdi, r15
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rsi, rcx
cmp rcx, r9
jbe 0x18003871d
call fcn.180097730
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
cmp rdx, rsi
jae 0x180038736
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.180003d30
mov rdx, qword [rsp + 0x40]
jmp 0x180038754
test rsi, rsi
jne 0x180038754
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x28]
cmp rdx, 8
cmovae rax, qword [rsp + 0x28]
mov word [rax], si
jmp 0x180038796
test rsi, rsi
je 0x180038796
lea rcx, [rsp + 0x28]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x28]
lea rdi, [rsi + rsi]
add rdx, rdx
mov r9, rdi
mov r8, r15
call fcn.180098b20
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rax, qword [rsp + 0x28]
mov word [rdi + rax], 0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180004fc0
nop
cmp qword [rsp + 0x40], 8
jb 0x1800387b6
mov rcx, qword [rsp + 0x28]
call fcn.180098980
lea eax, [rbp + 1]
movabs r9, 0x7ffffffffffffffe
or rdi, 0xffffffffffffffff
add ebp, 1
add r12, 2
cmp ebp, r13d
jb 0x1800386c4
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.180099070
mov al, 1
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800397b0
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
cmp qword [rcx + 0x18], 0
jne 0x1800397e2
xor al, al
jmp 0x180039904
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], 0
mov word [rsp + 0x58], 0
xor r8d, r8d
mov dx, 0x5c
call fcn.1800180c0
cmp rax, 0xffffffffffffffff
je 0x180039847
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180001a10
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1800030f0
nop
cmp qword [rsp + 0x48], 8
jb 0x18003985b
mov rcx, qword [rsp + 0x30]
call fcn.180098980
jmp 0x18003985b
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1800030f0
cmp qword [rsp + 0x68], 0
je 0x1800398ed
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
cmp eax, 3
je 0x1800398de
cmp eax, 2
jne 0x1800398f7
lea rax, [rsp + 0x58]
cmp rdx, 8
cmovae rax, rcx
cmp word [rax], 0x41
je 0x1800398f7
lea rax, [rsp + 0x58]
cmp rdx, 8
cmovae rax, rcx
cmp word [rax], 0x42
je 0x1800398f7
lea rax, [rsp + 0x58]
cmp rdx, 8
cmovae rax, rcx
cmp word [rax], 0x61
je 0x1800398f7
lea rax, [rsp + 0x58]
cmp rdx, 8
cmovae rax, rcx
cmp word [rax], 0x62
je 0x1800398f7
cmp rdx, 8
jb 0x1800398e9
call fcn.180098980
mov al, 1
jmp 0x180039904
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x180039902
call fcn.180098980
xor al, al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180099050
add rsp, 0x80
pop rbx
ret
Function at 0x18003ac70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx esi, r8b
mov rdi, rdx
mov rbx, rcx
mov qword [r11 - 0x20], 7
mov qword [r11 - 0x28], 0
mov word [rsp + 0x50], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [r11 - 0x40]
call fcn.1800030f0
nop
mov edx, 0x24
lea rcx, [rsp + 0x48]
call fcn.180015170
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18003ad14
test al, 0x10
jne 0x18003ad14
cmp qword [rsp + 0x68], 8
jb 0x18003ad8a
mov rcx, qword [rsp + 0x50]
call fcn.180098980
jmp 0x18003ad8a
cmp qword [rsp + 0x68], 8
jb 0x18003ad26
mov rcx, qword [rsp + 0x50]
call fcn.180098980
test sil, sil
jne 0x18003ad32
xor al, al
jmp 0x18003adc5
lea rsi, [0x1800cdd88]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], 0xffffffffffffffff
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov r9d, 2
mov r8d, 0x40000000
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.18003fee0
test al, al
je 0x18003adad
mov qword [rsp + 0x30], rsi
mov rcx, qword [rsp + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x18003ad8a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rdi
mov rcx, qword [rbx]
call fcn.180039f80
test al, al
jne 0x18003ada2
mov rax, qword [rbx]
mov byte [rax + 0x68], 0
jmp 0x18003ada9
mov rax, qword [rbx]
mov byte [rax + 0x68], 1
mov al, 1
jmp 0x18003adc5
mov qword [rsp + 0x30], rsi
mov rcx, qword [rsp + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x18003adc3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180099050
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18003fee0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0xa0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov r12d, r9d
mov ebp, r8d
mov rbx, rdx
mov rdi, rcx
lea rcx, [rsp + 0x70]
call fcn.1800158b0
nop
mov esi, dword [rsp + 0xf0]
cmp esi, 2
jne 0x18003ffeb
cmp qword [rsp + 0x88], 0
je 0x18003ffeb
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], 0
mov word [rsp + 0x50], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1800030f0
nop
lea edx, [rsi + 0x22]
lea rcx, [rsp + 0x48]
call fcn.180015170
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18003ffb0
test al, 0x10
je 0x18003ffb0
cmp qword [rsp + 0x68], 8
jb 0x18003ffeb
mov rcx, qword [rsp + 0x50]
call fcn.180098980
jmp 0x18003ffeb
cmp qword [rsp + 0x68], 8
jb 0x18003ffc2
mov rcx, qword [rsp + 0x50]
call fcn.180098980
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1800158b0
nop
mov rcx, rax
call fcn.180004490
nop
cmp qword [rsp + 0x68], 8
jb 0x18003ffeb
mov rcx, qword [rsp + 0x50]
call fcn.180098980
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
cmp qword [rbx + 0x20], 8
jb 0x180040001
mov rcx, qword [rbx + 8]
jmp 0x180040005
lea rcx, [rbx + 8]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, r12d
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x18004004b
cmp qword [rsp + 0x90], 8
jb 0x180040047
mov rcx, qword [rsp + 0x78]
call fcn.180098980
xor al, al
jmp 0x180040062
cmp qword [rsp + 0x90], 8
jb 0x180040060
mov rcx, qword [rsp + 0x78]
call fcn.180098980
mov al, 1
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.180099050
add rsp, 0xa0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180043770
Capabilities:
Check os version

Disassembly:
mov r11, rsp
push rbx
push r12
sub rsp, 0x158
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov rbx, rcx
lea rcx, [rsp + 0x20]
xor r12d, r12d
xor edx, edx
mov r8d, VarUI4FromDisp
mov qword [r11 + 0x20], rdi
mov esi, r12d
call fcn.180099ff0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], VarUI4FromDisp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov rcx, rbx
mov ebp, r12d
mov rdi, r12
call fcn.180043920
test rax, rax
je 0x180043824
nop
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800437f9
mov rax, qword [rbx + 0x10]
sub rax, rcx
sar rax, 3
cmp rdi, rax
jb 0x1800437fe
call fcn.18009a780
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + rdi*8]
call fcn.180098980
mov rcx, rbx
add ebp, 1
add rdi, 1
call fcn.180043920
mov r11, rax
mov eax, ebp
cmp rax, r11
jb 0x1800437e0
mov rdi, qword [rbx + 0x10]
cmp qword [rbx + 8], rdi
jbe 0x180043833
call fcn.18009a780
mov rbp, qword [rbx + 8]
cmp rbp, qword [rbx + 0x10]
jbe 0x180043842
call fcn.18009a780
cmp rbp, rdi
je 0x180043885
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x150], r13
sub rax, rdi
sar rax, 3
test rax, rax
lea rdx, [rax*8]
lea r13, [rdx + rbp]
jle 0x180043879
mov r9, rdx
mov r8, rdi
mov rcx, rbp
call fcn.18009a280
mov qword [rbx + 0x10], r13
mov r13, qword [rsp + 0x150]
cmp dword [rsp + 0x30], 2
mov rbp, qword [rsp + 0x178]
jne 0x1800438ae
mov rcx, rbx
call fcn.180042e60
mov rcx, rbx
call fcn.180043390
mov rcx, rbx
call fcn.180042cc0
jmp 0x1800438c7
mov edi, r12d
test esi, esi
jne 0x1800438c7
mov rcx, rbx
call fcn.180043070
add edi, 1
cmp edi, 0xa
mov esi, eax
jl 0x1800438b1
mov rcx, qword [rbx + 8]
mov rdi, qword [rsp + 0x188]
mov rsi, qword [rsp + 0x180]
test rcx, rcx
jne 0x1800438e5
mov rax, r12
jmp 0x1800438f0
mov rax, qword [rbx + 0x10]
sub rax, rcx
sar rax, 3
test rax, rax
setne al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180099050
add rsp, 0x158
pop r12
pop rbx
ret
Function at 0x1800611b0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x1800611f0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x30
test r8, r8
mov rsi, r8
mov rbp, rdx
mov r12, rcx
jne 0x180061219
mov ecx, 0x80004005
call fcn.18000fe60
int3
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
xor edi, edi
mov rbx, r8
nop
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 1
lea rbx, [rbx + rax*2]
lea edi, [rdi + rax*2]
jne 0x180061230
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x1800615f0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rcx
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
xor ebp, ebp
mov r9d, 0x2001f
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x50], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x40]
test eax, eax
mov ebx, eax
jne 0x180061729
test rcx, rcx
mov ebx, ebp
je 0x18006165d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
test ebx, ebx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x40], rcx
jne 0x180061729
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x48], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180061701
nop
nop
nop
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1800615f0
mov rcx, qword [rsp + 0x40]
test eax, eax
mov ebx, eax
jne 0x180061729
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x48], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1800616b0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180061716
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
mov rcx, qword [rdi]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test rcx, rcx
je 0x180061734
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180099050
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x270
pop rdi
pop rsi
pop rbp
ret
Function at 0x180064470
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r13, r9
mov r12, r8
mov rdi, rdx
mov rbx, rcx
call qword [0x1800f07a8]
xor r11d, r11d
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x70], r11
xor edx, edx
lea r8d, [r11 + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1800644eb
call fcn.180061180
mov ebx, eax
jmp 0x180064631
mov r8, r13
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x18006450e
call fcn.180061180
mov ebx, eax
jmp 0x180064627
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x180064533
call fcn.180061180
mov ebx, eax
jmp 0x180064627
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
add eax, 1
cmp eax, edi
jae 0x18006456d
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x180064563
lea rcx, [rsp + 0x70]
call fcn.180061580
nop
mov eax, 0x8007000e
jmp 0x18006464a
mov ecx, eax
test eax, eax
je 0x1800645aa
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x1800645a0
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x1800645aa
lea rcx, [rsp + 0x70]
call fcn.180061590
mov rbx, qword [rsp + 0x70]
jmp 0x1800645b4
mov ecx, 0x80070057
call fcn.18000fe60
lea rbx, [rsp + 0x78]
mov qword [rsp + 0x70], rbx
jmp 0x1800645c9
test rbx, rbx
jne 0x1800645d5
mov ebx, 0x8007000e
jmp 0x180064627
call qword [0x1800f07a8]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
mov r9d, edi
mov r8, r12
xor edx, edx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x180064601
call fcn.180061180
mov ebx, eax
jmp 0x180064627
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], 0
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.180064270
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x180064648
lea rcx, [rsp + 0x70]
call fcn.180061580
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.180099050
add rsp, 0x490
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x180065f80
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0xc0], 0
mov edi, edx
mov rbx, rcx
jne 0x180065fee
lea r8, str.K8ShellWorkEvent
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
test rax, rax
mov qword [rbx + 0xc0], rax
je 0x18006601f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180066012
mov rcx, qword [rbx + 0xc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.K8ShellWorkEvent
xor edx, edx
mov ecx, 0x80100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rbx + 0xc0], rax
mov rcx, qword [rbx + 0xc0]
test rcx, rcx
je 0x18006601f
mov edx, edi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
sete al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18006ebc0
Capabilities:
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
mov ecx, 8
call fcn.180099da0
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18006ebfa
mov r8, rbx
lea rdx, [0x18006e6c0]
mov rcx, rax
call fcn.180015dc0
jmp 0x18006ebfc
xor eax, eax
mov qword [rbx + 0x80], rax
mov rcx, rax
add rsp, 0x30
pop rbx
jmp fcn.180015e90
Function at 0x180071660
Capabilities:
Read .ini file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rdi, rcx
mov qword [rcx + 0x20], 7
xor esi, esi
mov qword [rcx + 0x18], rsi
mov word [rcx + 8], si
mov qword [rcx + 0x48], 7
mov qword [rcx + 0x40], rsi
mov word [rcx + 0x30], si
mov qword [rcx + 0x70], 7
mov qword [rcx + 0x68], rsi
mov word [rcx + 0x58], si
mov qword [rcx + 0x98], 7
mov qword [rcx + 0x90], rsi
mov word [rcx + 0x80], si
lea rbx, [rcx + 0xb8]
mov qword [rax + 0x10], rbx
mov qword [rbx], rsi
lea rcx, [rbx + 8]
call fcn.18002e810
nop
lea rcx, [rbx + 0x20]
mov rdx, qword [str.GMUsersMutex]
call fcn.18002e8c0
nop
mov qword [rdi + 0xe8], rsi
mov qword [rdi + 0xf0], rsi
lea rcx, [rdi + 0xf8]
call fcn.1800062f0
nop
mov qword [rdi + 0xa0], rsi
mov qword [rdi + 0x128], rsi
mov dword [rdi + 0x130], esi
mov word [rdi + 0xe0], si
mov word [rdi + 0xe2], si
mov word [rdi + 0xe4], si
mov word [rdi + 0xe6], si
mov dword [rdi + 0xb4], 0xfffffffe
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rdi + 0xf8]
call fcn.180006370
lea rcx, [rsp + 0x38]
call fcn.180075210
cmp qword [rax + 0x20], 8
jb 0x180071779
mov r9, qword [rax + 8]
jmp 0x18007177d
lea r9, [rax + 8]
xor r8d, r8d
lea rdx, [0x1800c30c4]
lea rcx, str.GUEST
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov r11d, eax
mov qword [rdi + 0xa8], r11
cmp qword [rsp + 0x58], 8
jb 0x1800717b0
mov rcx, qword [rsp + 0x40]
call fcn.180098980
mov byte [rdi + 0x144], 0
mov qword [rdi + 0x138], rsi
mov dword [rdi + 0x140], esi
mov rax, rdi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18009761c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1800f0938]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.180099ff0
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x180000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.180099ff0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x1800976af
cmp dword [rsp + 0x24], 5
jb 0x1800976c9
jmp 0x1800976c5
cmp dword [rsp + 0x30], esi
jne 0x1800976c9
cmp dword [rsp + 0x24], 4
ja 0x1800976c5
jne 0x1800976c9
cmp dword [rsp + 0x28], 0
jbe 0x1800976c9
mov byte [rbx + 0x18], sil
lea rax, [0x1800c6780]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.180061120
movzx ecx, byte [0x1800f6e81]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x1800f6e81], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180099050
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x18009a670
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x5b0
mov rbp, rcx
mov rcx, qword [0x1800f5b30]
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.1800a4590
test rax, rax
je 0x18009a6c4
mov r10, qword [rsp + 0x5e0]
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r10
call rax
jmp 0x18009a759
mov ecx, 2
call fcn.1800a5000
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.180099ff0
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x18009a745
test ebx, ebx
jne 0x18009a745
lea ecx, [rax + 2]
call fcn.1800a5000
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18009a780
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x5b8
mov rcx, qword [0x1800f5b30]
call fcn.1800a4590
test rax, rax
je 0x18009a7b5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call rax
add rsp, 0x5b8
ret
mov ecx, 2
mov qword [rsp + 0x5b0], rbx
call fcn.1800a5000
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.180099ff0
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x18009a83e
test ebx, ebx
jne 0x18009a83e
lea ecx, [rax + 2]
call fcn.1800a5000
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rbx, qword [rsp + 0x5b0]
add rsp, 0x5b8
ret