joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004a680
Capabilities:
Check mutex on windows

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
lea rdx, [rsp + 0x28]
call fcn.180049780
nop
cmp qword [rax + 0x18], 8
jb 0x18004a6a9
mov rax, qword [rax]
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x18004a6f7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004a6f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a738
call fcn.18011e914
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rsp + 0x38], xmm0
xor eax, eax
mov word [rsp + 0x28], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete dil
test rbx, rbx
je 0x18004a729
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, dil
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
call fcn.180146ae4
int3

Function at 0x18004aa40
Capabilities:
Check mutex on windows

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xor bpl, bpl
mov eax, dword [0x180214408]
test al, 1
jne 0x18004aab5
or eax, 1
mov dword [0x180214408], eax
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [0x180214470], xmm0
mov word [0x180214460], bx
lea r8d, [rbx + 0x2f]
lea rdx, str.GlobalRCAVD277DCA8_31E4_4750_8F68_057A8C0F2C93
lea rcx, [0x180214460]
call fcn.180003960
lea rcx, [0x180186570]
call fcn.18011e8fc
nop
lea rdx, [0x180214460]
lea rcx, [rsp + 0x30]
call fcn.180027f70
mov esi, 1
mov dword [rsp + 0x20], esi
cmp qword [rax + 0x18], 8
jb 0x18004aad9
mov rax, qword [rax]
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
mov ecx, esi
and ecx, 0xfffffffe
mov dword [rsp + 0x20], ecx
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18004ab30
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004ab2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004ab7b
call fcn.18011e914
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], bx
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, bpl
cmp eax, 0xb7
cmove ebx, esi
test rdi, rdi
je 0x18004ab63
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.180146ae4
int3
Function at 0x180053190
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rax - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rbx, rdx
mov qword [rax - 0x18], rdx
xor ebp, ebp
mov dword [rax - 0x48], ebp
mov eax, dword [0x1802144a0]
lea rsi, [0x180214480]
test al, 1
jne 0x18005320a
or eax, 1
mov dword [0x1802144a0], eax
mov qword [0x180214490], rbp
mov qword [0x180214498], 7
mov word [0x180214480], bp
xor r8d, r8d
lea rdx, [0x18019e818]
mov rcx, rsi
call fcn.180003960
lea rcx, [0x1801868a0]
call fcn.18011e8fc
nop
mov rcx, rsi
call fcn.180086a60
test al, al
je 0x180053226
mov rdx, rsi
mov rcx, rbx
call fcn.180027f70
jmp 0x1800533cb
lea rcx, [rsp + 0x28]
call fcn.18002f250
mov rdi, rax
cmp rsi, rax
je 0x180053264
mov rcx, rsi
call fcn.1800038e0
movups xmm0, xmmword [rdi]
movups xmmword [0x180214480], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [0x180214490], xmm1
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
mov rax, qword [rsp + 0x40]
cmp rax, 8
jb 0x1800532a6
lea rdx, [rax*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800532a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800533f2
call fcn.18011e914
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], bp
mov rdx, rsi
cmp qword [0x180214490], 0
je 0x1800533c3
lea r8, [0x18020dd30]
lea rcx, [rsp + 0x28]
call fcn.180082d40
mov rdi, rax
cmp rsi, rax
je 0x18005330f
mov rcx, rsi
call fcn.1800038e0
movups xmm0, xmmword [rdi]
movups xmmword [0x180214480], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [0x180214490], xmm1
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x180053351
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005334c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800533ec
call fcn.18011e914
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], bp
mov edx, 0x10
mov rcx, rsi
call fcn.180082900
mov rcx, rsi
call fcn.180086a60
test al, al
jne 0x180053385
mov rcx, rsi
call fcn.180086f00
mov rcx, rsi
cmp qword [0x180214498], 8
cmovae rcx, qword [0x180214480]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 2
je 0x1800533c0
and eax, 0xfffffffd
mov rcx, rsi
cmp qword [0x180214498], 8
cmovae rcx, qword [0x180214480]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rdx, rsi
mov rcx, rbx
call fcn.180027f70
mov dword [rsp + 0x20], 1
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.180146ae4
int3
call fcn.180146ae4
int3
Function at 0x180057a20
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0xc8]
sub rsp, 0x1b0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rsi, rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x24], r14d
mov qword [rsp + 0x58], r14
mov edi, 1
mov ecx, edi
call fcn.18011e4f4
mov rbx, rax
mov qword [rsp + 0x58], rax
mov byte [rax], r14b
xor edx, edx
mov r8d, 0x118
lea rcx, [rbp - 0x7c]
call fcn.18013d3e0
mov dword [rbp - 0x80], 0x11c
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180057ab7
cmp dword [rbp - 0x7c], 6
setae al
mov byte [rbx], al
lea r8, [rsp + 0x24]
lea rdx, [rsp + 0x28]
call fcn.1800849b0
test al, al
je 0x180057bd5
mov r8, qword [rsp + 0x28]
test r8, r8
je 0x180057bd5
lea rdx, [rsp + 0x60]
call fcn.180084a40
nop
cmp qword [rsp + 0x70], 0
jne 0x180057af6
xor bl, bl
jmp 0x180057b81
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
xor r9d, r9d
mov r8d, dword [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.180093b70
mov dword [rsp + 0x20], edi
mov rdx, rax
mov rcx, rsi
call fcn.180057c20
and edi, 0xfffffffe
mov dword [rsp + 0x20], edi
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180057b6c
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180057b67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180057c11
call fcn.18011e914
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov bl, 1
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x180057bbf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180057bba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180057c0b
call fcn.18011e914
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r14w
jmp 0x180057bd7
xor bl, bl
lea rcx, [rsp + 0x58]
call fcn.1800839f0
movzx eax, bl
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.18011e4d0
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.180146ae4
nop
call fcn.180146ae4
int3
Function at 0x1800586b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xb8], rbx
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbp, rdx
mov rsi, rcx
mov dword [rsp + 0x38], r8d
cmp qword [rcx + 0x18], 0
je 0x180058893
test r8d, r8d
je 0x180058893
mov edx, r8d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x180058893
lea r15, [rsi + 0xb0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r14, [rsi + 0x88]
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8d, [r9 + 4]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test ebx, ebx
jne 0x180058756
cmp eax, 0x3e5
jne 0x18005878d
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, dword [rsp + 0x38]
mov rdx, rbp
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test ebx, ebx
jne 0x180058883
cmp eax, 0x3e5
je 0x180058883
mov edx, 2
lea rcx, [0x180213e70]
call fcn.1800b6b60
mov esi, eax
xor bl, bl
test eax, eax
je 0x180058885
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rsp + 0x50], xmm1
xor ebx, ebx
mov word [rsp + 0x40], bx
mov r8d, edi
lea rdx, str.send_data_failed__err:__d
lea rcx, [rsp + 0x40]
call fcn.1800b7090
mov dword [rsp + 0x28], 0x96
lea rax, str.RC::RCNamePipeClient::SendData
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtglobalutils_sdkclientcon_rcnamepipeclient.cpp
lea r8, [rsp + 0x40]
lea edx, [rbx + 2]
lea rcx, [0x180213e70]
call fcn.1800b6bb0
cmp esi, 1
jbe 0x180058822
lea rdx, [rsp + 0x40]
lea rcx, [0x180213e70]
call fcn.1800b6f50
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x180058860
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005885b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800588b6
call fcn.18011e914
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], bx
xor bl, bl
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, bl
jmp 0x180058895
mov bl, 1
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, bl
jmp 0x180058895
xor al, al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18011e4d0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.180146ae4
int3
Function at 0x1800591c0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r10, qword [rcx + 0x18]
test r10, r10
jne 0x1800591fb
xor al, al
jmp 0x180059353
xor ebp, ebp
mov dword [rcx + 0xdc], ebp
lea rax, [rcx + 0x60]
lea rdx, [rcx + 0xe0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [rbp + 4]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
test eax, eax
setne dil
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test ebx, ebx
jne 0x180059240
cmp eax, 0x3e5
sete dil
test dil, dil
jne 0x18005934f
cmp qword [0x180213e70], rbp
je 0x18005934f
lea rcx, [0x180213e70]
call fcn.1800b5f20
mov rax, qword [0x180213e70]
cmp byte [rax + 0x78], bpl
je 0x18005934f
cmp dword [rax + 0x80], 2
jb 0x18005934f
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rsp + 0x48], xmm1
mov word [rsp + 0x38], bp
mov r8d, esi
lea rdx, str.request_read_size_failed___d
lea rcx, [rsp + 0x38]
call fcn.1800b7090
mov dword [rsp + 0x28], 0x149
lea rax, str.RC::RCNamePipeClient::RequestReadSize
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtglobalutils_sdkclientcon_rcnamepipeclient.cpp
lea r8, [rsp + 0x38]
mov edx, 2
lea rcx, [0x180213e70]
call fcn.1800b6bb0
test bl, bl
je 0x1800592fe
lea rdx, [rsp + 0x38]
lea rcx, [0x180213e70]
call fcn.1800b6f50
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x18005933c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180059337
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180059376
call fcn.18011e914
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], bp
movzx eax, dil
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18011e4d0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.180146ae4
int3
Function at 0x180059380
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
jne 0x1800593be
xor al, al
jmp 0x18005954a
mov dword [rbx + 0xdc], 1
mov r10, qword [rbx + 0xe8]
mov edx, dword [rbx + 0xe0]
mov rax, qword [rbx + 0xf0]
sub rax, r10
cmp rax, rdx
jae 0x180059401
lea rcx, [rbx + 0xe8]
call fcn.180059c40
mov r10, qword [rbx + 0xe8]
mov edx, dword [rbx + 0xe0]
mov rcx, qword [rbx + 0x18]
lea rax, [rbx + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, edx
mov rdx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
test eax, eax
setne dil
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test ebx, ebx
jne 0x180059436
cmp eax, 0x3e5
sete dil
test dil, dil
jne 0x180059546
cmp qword [0x180213e70], 0
je 0x180059546
lea rcx, [0x180213e70]
call fcn.1800b5f20
mov rax, qword [0x180213e70]
cmp byte [rax + 0x78], dil
je 0x180059546
cmp dword [rax + 0x80], 2
jb 0x180059546
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x1801b2820]
movdqu xmmword [rsp + 0x48], xmm1
xor ebp, ebp
mov word [rsp + 0x38], bp
mov r8d, esi
lea rdx, str.request_data_failed___d
lea rcx, [rsp + 0x38]
call fcn.1800b7090
mov dword [rsp + 0x28], 0x161
lea rax, str.RC::RCNamePipeClient::RequestData
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtglobalutils_sdkclientcon_rcnamepipeclient.cpp
lea r8, [rsp + 0x38]
lea edx, [rbp + 2]
lea rcx, [0x180213e70]
call fcn.1800b6bb0
test bl, bl
je 0x1800594f5
lea rdx, [rsp + 0x38]
lea rcx, [0x180213e70]
call fcn.1800b6f50
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x180059533
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005952e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005956d
call fcn.18011e914
movdqa xmm0, xmmword [0x1801b2820]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], bp
movzx eax, dil
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18011e4d0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.180146ae4
int3
Function at 0x18007fae0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor edi, edi
mov rbx, rcx
cmp qword [rcx + 0x18], 8
mov rax, rcx
mov qword [rcx + 0x10], rdi
jb 0x18007fb15
mov rax, qword [rcx]
xor edx, edx
mov word [rax], di
mov r8d, 0x412
lea rcx, [rsp + 0x20]
call fcn.18013d3e0
lea rdx, [rsp + 0x20]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x18007fb42
xor al, al
jmp 0x18007fb79
cmp eax, 0x208
jae 0x18007fb3e
mov word [rsp + 0x430], di
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], di
jne 0x18007fb60
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180003960
mov al, 1
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18011e4d0
mov rbx, qword [rsp + 0x468]
add rsp, 0x450
pop rdi
ret
Function at 0x180083970
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov ecx, 1
call fcn.18011e4f4
mov qword [rbx], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
mov byte [rax], 0
call fcn.18013d3e0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x1800839d7
cmp dword [rsp + 0x24], 6
mov rcx, qword [rbx]
setae dl
mov byte [rcx], dl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18011e4d0
add rsp, 0x150
pop rbx
ret
Function at 0x180086330
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
lea rcx, [r11 - 0x48]
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18011e4d0
add rsp, 0x68
ret

Function at 0x180086380
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor edx, edx
add rcx, 4
mov r8d, 0x118
call fcn.18013d3e0
mov rcx, rbx
mov dword [rbx], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1800864e2
cmp dword [rbx + 4], 6
mov qword [rsp + 0x188], rdi
ja 0x1800863e4
jne 0x180086485
cmp dword [rbx + 8], 2
jb 0x180086485
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x180086485
mov edx, 1
mov rcx, rax
lea r8d, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x180086485
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x180086485
movups xmm0, xmmword [0x1801ad528]
mov rcx, rax
movups xmm1, xmmword [0x1801ad538]
movups xmmword [rsp + 0x140], xmm0
movups xmmword [rsp + 0x150], xmm1
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x180086485
lea rcx, [rax + 6]
lea rdx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x180086485
cmp word [rdi + 2], ax
jbe 0x180086485
movzx edx, word [rdi + 0x32]
movzx eax, word [rdi + 0x30]
movzx ecx, word [rdi + 0x36]
mov dword [rbx + 4], edx
mov dword [rbx + 8], eax
mov dword [rbx + 0xc], ecx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1800864d6
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x118
call fcn.18013d3e0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call rdi
test eax, eax
jne 0x1800864d6
mov eax, dword [rsp + 0x2c]
mov dword [rbx + 0xc], eax
mov rdi, qword [rsp + 0x188]
mov al, 1
jmp 0x1800864e4
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.18011e4d0
add rsp, 0x170
pop rbx
ret
Function at 0x18008ddf0
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xb8], rbx
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ebp, r8d
mov r14, rdx
mov r15, rcx
xor r12d, r12d
mov qword [rsp + 0x48], r12
mov ebx, r12d
mov qword [rsp + 0x48], rbx
lea r13, [r12 - 1]
cmp r8d, 0x3fe
jbe 0x18008dec3
lea ecx, [rbp + 2]
mov eax, 2
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.18011e968
mov r14, rax
mov rbx, rax
mov qword [rsp + 0x48], rax
mov rdx, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x18008de8f
cmp eax, ebp
ja 0x18008de8f
mov ecx, eax
mov word [rbx + rcx*2], r12w
lea ecx, [rax + 1]
mov word [rbx + rcx*2], r12w
mov ebp, eax
jmp 0x18008def2
test r14, r14
je 0x18008de9c
mov rcx, r14
call fcn.18011e914
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18011e4d0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, rbp
add rax, rax
cmp rax, 0x800
jae 0x18008e01f
mov word [rax + rdx], r12w
lea ecx, [rbp + 1]
add rcx, rcx
cmp rcx, 0x800
jae 0x18008e019
mov word [rcx + rdx], r12w
mov eax, r12d
mov edi, r12d
test ebp, ebp
je 0x18008e005
mov rsi, r14
cmp word [rsi], 0
jne 0x18008dff7
cmp eax, edi
je 0x18008dff7
lea rdx, [r14 + rax*2]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], r12w
mov r8, r13
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x18008df40
lea rcx, [rsp + 0x20]
call fcn.180003960
nop
mov rdx, qword [r15 + 8]
cmp qword [r15 + 0x10], rdx
je 0x18008df94
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rdx + 0x10], xmm1
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], r12w
add qword [r15 + 8], 0x20
jmp 0x18008dfa2
lea r8, [rsp + 0x20]
mov rcx, r15
call fcn.180035640
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x18008dfe0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008dfdb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008e025
call fcn.18011e914
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], r12w
lea eax, [rdi + 1]
inc edi
add rsi, 2
cmp edi, ebp
jb 0x18008df03
test rbx, rbx
je 0x18008e012
mov rcx, rbx
call fcn.18011e914
mov al, 1
jmp 0x18008de9e
call fcn.18011ede8
int3
call fcn.18011ede8
int3
call fcn.180146ae4
int3
Function at 0x18008ed70
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x460
mov rax, qword [0x18020d020]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rdx
mov r14d, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], rdx
xor esi, esi
mov qword [rdx + 0x10], rsi
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x18008edb4
mov rax, qword [rdx]
mov word [rax], si
call fcn.18008ee90
movzx edi, al
mov byte [rsp + 0x20], al
jmp 0x18008edd9
test dil, dil
jne 0x18008ee59
cmp r14d, 0x1a
jne 0x18008ee59
mov qword [rbx + 0x10], rsi
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x18008edf5
mov rax, qword [rbx]
mov word [rax], si
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x40]
call fcn.18013d3e0
mov r8d, 0x207
lea rdx, [rsp + 0x40]
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x18008ee30
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180003960
movzx edi, dil
mov eax, 1
cmp qword [rbx + 0x10], 0
cmovne edi, eax
movzx eax, dil
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.18011e4d0
mov rbx, qword [rsp + 0x490]
add rsp, 0x460
pop r14
pop rdi
pop rsi
ret