joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001d10
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xc80
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x18002d340]
xor rax, rsp
mov qword [rsp + 0xc70], rax
mov rbx, rdx
mov qword [rsp + 0x28], rdx
xor esi, esi
mov dword [rsp + 0x20], esi
lea rdx, str._s.
lea rcx, [r11 - 0x7e8]
call fcn.18000862c
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
mov word [rbx], si
lea r8d, [rsi + 7]
lea rdx, str.0.0.0.0
mov rcx, rbx
call fcn.180003e80
mov dword [rsp + 0x20], 1
cmp rdi, 0xffffffffffffffff
je 0x180001e80
nop dword [rax]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x180001e80
cmp word [rsp + 0x6c], 0x2e
je 0x180001db0
movzx eax, word [rsp + 0x6e]
test ax, ax
je 0x180001db0
cmp ax, 0x2e
jne 0x180001de6
cmp word [rsp + 0x70], 0
je 0x180001db0
test byte [rsp + 0x40], 0x10
je 0x180001db0
mov word [rsp + 0x290], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x292]
call fcn.1800098a0
lea r8, [rsp + 0x6c]
lea rdx, [0x18001f9d0]
lea rcx, [rsp + 0x290]
call fcn.18000862c
mov rcx, rbx
call fcn.180003fd0
mov rdx, rax
lea rcx, [rsp + 0x290]
call fcn.1800081e8
test eax, eax
jle 0x180001db0
cmp word [rsp + 0x290], 0
jne 0x180001e53
mov r8, rsi
jmp 0x180001e6b
lea rax, [rsp + 0x290]
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x180001e60
lea rdx, [rsp + 0x290]
mov rcx, rbx
call fcn.180003e80
jmp 0x180001db0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, rbx
mov rcx, qword [rsp + 0xc70]
xor rcx, rsp
call fcn.180009870
lea r11, [rsp + 0xc80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1800021d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x50
xor eax, eax
mov rbx, rdx
mov rsi, r9
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x20], rax
lea rax, [r11 - 0x18]
mov rbp, r8
mov rdi, rcx
lea rdx, str.SoftWare
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [r11 - 0x38], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800022b8
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800022b8
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x30], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x180002298
mov ecx, dword [rsp + 0x30]
lea rdx, str.GetServiceRegedit_RegQueryValueEx_name___s_errorcode___d__dwSize___d
mov r9d, eax
mov dword [rsp + 0x20], ecx
mov rcx, rdi
mov r8, rbx
call fcn.180002c90
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1800022a8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1800022b8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x180002880
Capabilities:
Check if file exists
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x18002d340]
xor rax, rsp
mov qword [rbp + 0x340], rax
lea rdx, str.InitLowPathExplorerPath
mov rsi, rcx
call fcn.180002c90
lea rcx, [rbp + 0x132]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x130], di
call fcn.1800098a0
lea rdx, [rbp + 0x130]
mov r8d, 0x104
mov rcx, rsi
call fcn.180001950
test al, al
jne 0x1800029a1
lea rdx, [rbp + 0x130]
lea rcx, str.USERPROFILE
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x18000296f
lea rcx, [rbp + 0x130]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x180002920
mov rax, qword [str.AppDataLocalLow]
mov qword [rcx], rax
mov rax, qword [0x18001fb38]
mov qword [rcx + 8], rax
mov rax, qword [0x18001fb40]
mov qword [rcx + 0x10], rax
mov rax, qword [0x18001fb48]
mov qword [rcx + 0x18], rax
mov eax, dword [0x18001fb50]
mov dword [rcx + 0x20], eax
lea rcx, [rbp + 0x130]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1800029a1
xor r9d, r9d
lea rdx, [rbp + 0x130]
xor ecx, ecx
lea r8d, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rcx, [rbp + 0x130]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], di
jne 0x180002990
test eax, eax
je 0x180002b00
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x468], rbx
mov word [rsp + 0x20], di
call fcn.1800098a0
lea r9, str.SmartCloudIME
lea r8, [rbp + 0x130]
lea rdx, str._sExplorerMenu_s_
lea rcx, [rsp + 0x20]
call fcn.18000862c
cmp word [rsp + 0x20], di
jne 0x1800029eb
mov r8, rdi
jmp 0x1800029fe
lea rax, [rsp + 0x20]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x1800029f4
lea rcx, [rsi + 0x100]
lea rdx, [rsp + 0x20]
call fcn.180003e80
cmp word [rsp + 0x20], di
jne 0x180002a1b
mov r8, rdi
jmp 0x180002a2e
lea rax, [rsp + 0x20]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x180002a24
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0xa0]
call fcn.180003e80
lea rdx, str.UseVestige.ini
lea rcx, [rsi + 0xa0]
mov r8d, 0xe
call fcn.180003950
cmp word [rsp + 0x20], di
jne 0x180002a64
mov r8, rdi
jmp 0x180002a7a
lea rax, [rsp + 0x20]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], di
jne 0x180002a70
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0xc0]
call fcn.180003e80
lea rdx, str.Config.ini
lea rcx, [rsi + 0xc0]
mov r8d, 0xa
call fcn.180003950
cmp word [rsp + 0x20], di
je 0x180002abe
lea rax, [rsp + 0x20]
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x180002ab4
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0xe0]
mov r8, rdi
call fcn.180003e80
lea rdx, str.RunDate.ini
lea rcx, [rsi + 0xe0]
mov r8d, 0xb
call fcn.180003950
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.180001570
mov rbx, qword [rsp + 0x468]
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.180009870
lea r11, [rsp + 0x450]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180002b30
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x18002d340]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rcx
lea rcx, [rsp + 0x22]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], bx
call fcn.1800098a0
lea r8d, [rbx + 0x26]
lea rdx, [rsp + 0x20]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [rsp + 0x20], bx
je 0x180002b9a
lea rax, [rsp + 0x20]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180002b90
add rdi, 0x120
lea rdx, [rsp + 0x20]
mov r8, rbx
mov rcx, rdi
call fcn.180003e80
lea rdx, [0x18001f778]
mov r8d, 1
mov rcx, rdi
call fcn.180003950
cmp qword [rdi + 0x18], 8
jb 0x180002bd2
mov rcx, qword [rdi]
jmp 0x180002bd5
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180002bf2
lea r8d, [rax + 0x11]
lea rdx, str.C:Program_Files_
mov rcx, rdi
call fcn.180003e80
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180009870
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret

Function at 0x180002c20
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
add rcx, 0x40
cmp qword [rcx + 0x18], 8
jb 0x180002c37
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180002c4c
mov eax, 1
add rsp, 0x20
pop rbx
ret
cmp qword [rbx + 0x78], 8
lea rcx, [rbx + 0x60]
jb 0x180002c5a
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180002c41
lea rcx, [rbx + 0x80]
cmp qword [rcx + 0x18], 8
jb 0x180002c75
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x180002c90
Capabilities:
Check if file exists
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rdi
lea rbp, [rsp - 0xb88]
sub rsp, 0xc88
mov rax, qword [0x18002d340]
xor rax, rsp
mov qword [rbp + 0xb60], rax
xor edi, edi
lea rcx, [rbp + 0x142]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x140], di
call fcn.1800098a0
mov ecx, edi
lea rdx, str.C:log_
nop word [rax + rax]
movzx eax, word [rcx + rdx]
lea rcx, [rcx + 2]
mov word [rbp + rcx + 0x13e], ax
test ax, ax
jne 0x180002cf0
lea rcx, [rbp + 0x772]
xor edx, edx
mov r8d, 0x3e6
mov word [rbp + 0x770], di
call fcn.1800098a0
lea r8, [rbp + 0x140]
lea rdx, str._sgswb.log
lea rcx, [rbp + 0x350]
call fcn.18000862c
lea rcx, [rbp + 0x562]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x560], di
call fcn.1800098a0
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], di
call fcn.1800098a0
lea rdx, [rsp + 0x30]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x30]
mov edx, 0x5c
call fcn.180007e94
lea rcx, [rbp + 0x350]
mov word [rax], di
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180002f2d
mov qword [rsp + 0xc80], rbx
or rbx, 0xffffffffffffffff
mov qword [rsp + 0xc78], rsi
mov qword [rsp + 0xc70], r14
lea rcx, [rsp + 0x30]
mov rax, rbx
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], di
lea rax, [rax + 1]
jne 0x180002dd0
lea rdx, [rsp + 0x32]
lea rax, [rdx + rax*2]
lea rdx, [rbp + 0x560]
sub rdx, rax
nop
movzx ecx, word [rax]
lea rax, [rax + 2]
mov word [rdx + rax - 2], cx
test cx, cx
jne 0x180002df0
lea r9, [rbp + 0x560]
lea r8, [rbp + 0x140]
lea rdx, str._s_s.txt
lea rcx, [rbp + 0x350]
call fcn.18000862c
mov r8, qword [rbp + 0xba8]
lea r9, [rbp + 0xbb0]
lea rcx, [rbp + 0x770]
mov edx, 0x1f3
call fcn.180008518
lea rcx, [rbp + 0x350]
mov word [rbp + 0xb56], di
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea rdx, [0x18001fad0]
lea rcx, [rbp + 0x350]
test eax, eax
mov r14d, 1
cmovne edi, r14d
call fcn.1800086f0
mov rsi, rax
test rax, rax
je 0x180002f15
test edi, edi
jne 0x180002ea2
mov eax, 0xfeff
lea r8d, [r14 + 1]
lea rcx, [rsp + 0x24]
mov r9, rsi
mov edx, r14d
mov word [rsp + 0x24], ax
call fcn.180008a58
lea rax, [rbp + 0x770]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180002eb0
add ebx, ebx
lea rcx, [rbp + 0x770]
mov r9, rsi
movsxd r8, ebx
mov rdx, r14
call fcn.180008a58
mov eax, 0xd
lea rcx, [rsp + 0x20]
lea r8d, [rax - 0xb]
mov r9, rsi
mov rdx, r14
mov word [rsp + 0x20], ax
call fcn.180008a58
mov eax, 0xa
lea rcx, [rsp + 0x20]
lea r8d, [rax - 8]
mov r9, rsi
mov rdx, r14
mov word [rsp + 0x20], ax
call fcn.180008a58
mov rcx, rsi
call fcn.180008860
mov rsi, qword [rsp + 0xc78]
mov rbx, qword [rsp + 0xc80]
mov r14, qword [rsp + 0xc70]
mov rcx, qword [rbp + 0xb60]
xor rcx, rsp
call fcn.180009870
add rsp, 0xc88
pop rdi
pop rbp
ret
Function at 0x180004570
Capabilities:
Check if file exists
Read .ini file

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x110
mov rax, qword [0x18002d340]
xor rax, rsp
mov qword [rsp + 0x100], rax
cmp qword [rcx + 0x18], 8
mov rsi, rdx
mov rbx, rcx
jb 0x18000459f
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18000465b
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x130], rdi
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x26]
movzx edi, word [rsp + 0x22]
imul edi, edi, 0x64
add edi, eax
lea rdx, [0x18001fd18]
lea rcx, [rsp + 0x30]
mov r8d, edi
call fcn.18000862c
cmp qword [rbx + 0x18], 8
jb 0x1800045ef
mov r9, qword [rbx]
jmp 0x1800045f2
mov r9, rbx
lea rdx, str.Interval
lea rcx, [rsp + 0x30]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsi], eax
test eax, eax
je 0x180004649
lea rdx, str._04d
lea rcx, [rsp + 0x30]
mov r8d, edi
call fcn.18000862c
cmp qword [rbx + 0x18], 8
jb 0x18000462b
mov rbx, qword [rbx]
lea rdx, str.Interval
lea rcx, [rsp + 0x30]
mov r9, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsi], eax
test eax, eax
jne 0x18000464d
xor al, al
jmp 0x180004653
cmp eax, 1
setge al
mov rdi, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.180009870
mov rbx, qword [rsp + 0x138]
add rsp, 0x110
pop rsi
ret

Function at 0x180004680
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push rbx
sub rsp, 0x110
mov rax, qword [0x18002d340]
xor rax, rsp
mov qword [rsp + 0x100], rax
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x1800046a8
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1800046b9
mov al, 1
jmp 0x180004760
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x128], rdi
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x26]
movzx edi, word [rsp + 0x22]
imul edi, edi, 0x64
add edi, eax
lea rdx, [0x18001fd18]
lea rcx, [rsp + 0x30]
mov r8d, edi
call fcn.18000862c
cmp qword [rbx + 0x18], 8
jb 0x1800046fb
mov r9, qword [rbx]
jmp 0x1800046fe
mov r9, rbx
lea rdx, str.Disable
lea rcx, [rsp + 0x30]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
jl 0x18000471c
mov al, 1
jmp 0x180004758
lea rdx, str._04d
lea rcx, [rsp + 0x30]
mov r8d, edi
call fcn.18000862c
cmp qword [rbx + 0x18], 8
jb 0x18000473a
mov rbx, qword [rbx]
lea rdx, str.Disable
lea rcx, [rsp + 0x30]
mov r9, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
setge al
mov rdi, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.180009870
add rsp, 0x110
pop rbx
ret
Function at 0x180005210
Capabilities:
Check for time delay via gettickcount
Read .ini file

Disassembly:
push rdi
sub rsp, 0x1a0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x1b0], rbx
mov rax, qword [0x18002d340]
xor rax, rsp
mov qword [rsp + 0x190], rax
lea rcx, [rsp + 0x50]
call fcn.180001220
nop
lea r8, str.SmartCloud
lea rdx, str.IconLay__s
lea rcx, [rsp + 0x50]
call fcn.180002c90
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.1800023a0
nop
lea rcx, [rsp + 0x50]
call fcn.180002c20
test eax, eax
je 0x180005292
lea rcx, [rsp + 0x50]
call fcn.180005c70
lea rcx, [rsp + 0x50]
call fcn.180005a00
int3
lea r9, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae r9, qword [rsp + 0x28]
mov r8d, 3
lea rdx, str.TimeDelay
lea rcx, str.Setting
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
imul ebx, ebx, 0xea60
test ebx, ebx
je 0x1800052e8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, ebx
jb 0x1800052d1
lea rcx, [rsp + 0x50]
call fcn.180005fd0
lea rcx, [rsp + 0x50]
call fcn.180005b70
nop
cmp qword [rsp + 0x40], 8
jb 0x18000530f
mov rcx, qword [rsp + 0x28]
call fcn.180007828
mov qword [rsp + 0x40], 7
xor eax, eax
mov qword [rsp + 0x38], rax
mov word [rsp + 0x28], ax
lea rcx, [rsp + 0x50]
call fcn.180001380
xor eax, eax
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.180009870
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x1a0
pop rdi
ret
xor ecx, ecx
jmp 0x180005210
Function at 0x180007230
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
cmp edx, 1
jne 0x180007259
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rcx, qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov eax, 1
add rsp, 0x28
ret
test edx, edx
jne 0x1800072bd
mov rcx, qword [0x18002e890]
test rcx, rcx
je 0x1800072bd
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1800072a5
cmp dword [rsp + 0x38], 0x103
jne 0x1800072a5
mov rcx, qword [0x18002e890]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x18002e890]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x18002e890]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x18002e890], 0
mov eax, 1
add rsp, 0x28
ret

Function at 0x180007560
Capabilities:
Check for time delay via gettickcount
Read .ini file

Disassembly:
push rdi
sub rsp, 0x1a0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x1b0], rbx
mov rax, qword [0x18002d340]
xor rax, rsp
mov qword [rsp + 0x190], rax
lea rcx, [rsp + 0x50]
call fcn.180001220
nop
lea r8, str.SmartCloud
lea rdx, str.IconLay__s
lea rcx, [rsp + 0x50]
call fcn.180002c90
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.1800023a0
nop
lea rcx, [rsp + 0x50]
call fcn.180002c20
test eax, eax
je 0x180005292
lea rcx, [rsp + 0x50]
call fcn.180005c70
lea rcx, [rsp + 0x50]
call fcn.180005a00
int3
lea r9, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae r9, qword [rsp + 0x28]
mov r8d, 3
lea rdx, str.TimeDelay
lea rcx, str.Setting
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
imul ebx, ebx, 0xea60
test ebx, ebx
je 0x1800052e8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, ebx
jb 0x1800052d1
lea rcx, [rsp + 0x50]
call fcn.180005fd0
lea rcx, [rsp + 0x50]
call fcn.180005b70
nop
cmp qword [rsp + 0x40], 8
jb 0x18000530f
mov rcx, qword [rsp + 0x28]
call fcn.180007828
mov qword [rsp + 0x40], 7
xor eax, eax
mov qword [rsp + 0x38], rax
mov word [rsp + 0x28], ax
lea rcx, [rsp + 0x50]
call fcn.180001380
xor eax, eax
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.180009870
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x1a0
pop rdi
ret
xor ecx, ecx
jmp 0x180005210
Function at 0x141550058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1415501df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141550089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14155006f
add dl, dl
jne 0x141550096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415500f6
xor eax, eax
add dl, dl
jne 0x1415500a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415501ad
add dl, dl
jne 0x1415500b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415500c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415500d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415500dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1415500ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14155007e
mov eax, 1
add dl, dl
jne 0x141550106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141550113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1415500fb
sub eax, ebx
mov ebx, 1
jne 0x14155014c
mov ecx, 1
add dl, dl
jne 0x14155012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14155013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141550123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14155007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141550168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141550175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14155015d
cmp eax, 0x7d00
jae 0x14155019b
cmp eax, 0x500
jb 0x141550196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14155007e
cmp eax, 0x7f
ja 0x14155019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14155007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1415501d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14155007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000200c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002056
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002056
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002056
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002056
cmp dword [rcx + 0x84], 0xe
jbe 0x140002056
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002058
xor al, al
add rsp, 0x28
ret
Function at 0x1400005d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rdx
mov r14, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
and qword [rcx + 0x10], 0
and qword [rcx + 0x10], 0
mov r13d, 0xf
mov qword [rcx + 0x18], r13
mov byte [rcx], 0
lea rsi, [rcx + 0x20]
movups xmmword [rsi], xmm0
lea r15, [rsi + 0x10]
and qword [r15], 0
mov qword [rsi + 0x18], r13
mov byte [rsi], 0
movdqa xmm0, xmmword [0x1400034e0]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1400034f0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x140003500]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [str.wxyz0123456789________.__:_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuv_]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [0x1400034d0]
movdqa xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x403f3e3d
mov dword [rbp - 0xc], 0x5e5d5c5b
lea edx, [r13 + 0x4f]
mov dword [rbp - 8], 0x7c7b605f
mov word [rbp - 4], 0x7e7d
cmp qword [rcx + 0x18], rdx
jb 0x1400006b8
mov rbx, qword [rcx]
mov qword [rcx + 0x10], rdx
mov r8d, edx
lea rdx, [rbp - 0x60]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x5e], 0
jmp 0x1400006c1
lea r9, [rbp - 0x60]
call fcn.140001c7c
cmp rsi, rdi
je 0x14000070a
mov r9, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400006d3
mov r9, qword [rdi]
mov rbx, qword [rdi + 0x10]
cmp rbx, qword [rsi + 0x18]
ja 0x1400006fe
cmp qword [rsi + 0x18], 0x10
jb 0x1400006e7
mov rsi, qword [rsi]
mov qword [r15], rbx
mov r8, rbx
mov rdx, r9
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], 0
jmp 0x14000070a
mov rdx, rbx
mov rcx, rsi
call fcn.140001c7c
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140000740
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14000073b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000076b
mov rcx, r8
call fcn.140002344
and qword [rdi + 0x10], 0
mov qword [rdi + 0x18], r13
mov byte [rdi], 0
mov rax, r14
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140002958
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400029a2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400029a2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400029a2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400029a2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400029a2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400029a4
xor al, al
add rsp, 0x28
ret