joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001ec0
Capabilities:
Get process image filename

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x160
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x190], rbx
mov rax, qword [0x1800f18c0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rsi, rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x20], 0
mov qword [rcx + 0x20], InitCommonControls
mov qword [rcx + 0x18], 0
lea rbx, [rcx + 8]
mov byte [rbx], 0
mov dword [rsp + 0x20], 1
mov r8d, edx
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x180002050
mov byte [rsp + 0x40], 0
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x41]
call fcn.18008fd00
mov r8d, 0x104
lea rdx, [rsp + 0x40]
mov rcx, rbp
call sub.PSAPI.DLL_GetProcessImageFileNameA
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov rdx, qword [rsi + 0x20]
cmp rdx, 0x10
jb 0x180001f86
mov rax, qword [rbx]
jmp 0x180001f89
mov rax, rbx
lea rcx, [rsp + 0x40]
cmp rcx, rax
jb 0x180001fd0
cmp rdx, 0x10
jb 0x180001f9e
mov rcx, qword [rbx]
jmp 0x180001fa1
mov rcx, rbx
add rcx, qword [rsi + 0x18]
lea rax, [rsp + 0x40]
cmp rcx, rax
jbe 0x180001fd0
cmp rdx, 0x10
jb 0x180001fb8
mov rbx, qword [rbx]
lea r8, [rsp + 0x40]
sub r8, rbx
mov r9, rdi
mov rdx, rsi
mov rcx, rsi
call fcn.1800051e0
jmp 0x180002042
cmp rdi, 0xfffffffffffffffe
jbe 0x180001fdb
call fcn.18002d730
mov rax, qword [rsi + 0x20]
cmp rax, rdi
jae 0x180001ff5
mov r8, qword [rsi + 0x18]
mov rdx, rdi
mov rcx, rsi
call fcn.180005ab0
jmp 0x18000200c
test rdi, rdi
jne 0x18000200c
mov qword [rsi + 0x18], rdi
cmp rax, 0x10
jb 0x180002007
mov rbx, qword [rbx]
mov byte [rbx], 0
jmp 0x180002042
test rdi, rdi
je 0x180002042
mov rdx, qword [rsi + 0x20]
cmp rdx, 0x10
jb 0x180002020
mov rcx, qword [rbx]
jmp 0x180002023
mov rcx, rbx
mov r9, rdi
lea r8, [rsp + 0x40]
call fcn.180087940
mov qword [rsi + 0x18], rdi
cmp qword [rsi + 0x20], 0x10
jb 0x18000203e
mov rbx, qword [rbx]
mov byte [rbx + rdi], 0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
jmp 0x180002053
mov rax, rsi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180087cc0
mov rbx, qword [rsp + 0x190]
add rsp, 0x160
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800093a0
Capabilities:
Get process image filename
Terminate process

Disassembly:
push rdi
sub rsp, 0x150
mov rax, qword [0x1800f18c0]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea r8, str.DeskIconBar
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExA]
test rax, rax
mov rdi, rax
je 0x1800094a2
mov qword [rsp + 0x160], rbx
mov qword [rsp + 0x168], rsi
xor esi, esi
nop
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x20]
xor edx, edx
mov ecx, 0x401
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rbx, rax
je 0x180009471
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x30], sil
call fcn.18008fd00
lea rdx, [rsp + 0x30]
mov r8d, 0x104
mov rcx, rbx
call sub.PSAPI.DLL_GetProcessImageFileNameA
lea rdx, str._vd.exe
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x180009468
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.DeskIconBar
xor r9d, r9d
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExA]
test rax, rax
mov rdi, rax
jne 0x1800093f0
mov rsi, qword [rsp + 0x168]
mov rbx, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180087cc0
add rsp, 0x150
pop rdi
ret
Function at 0x18002bd90
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push r12
push r13
push r14
sub rsp, 0x38
mov rbx, rdx
xor r14d, r14d
lea r9, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
mov r12, rcx
xor r13b, r13b
mov dword [rsp + 0x70], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18002bfb4
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
je 0x18002bfb4
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov esi, eax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x30], rdi
cmp rsi, rax
ja 0x18002be85
or rbp, 0xffffffffffffffff
cmp rax, rsi
jae 0x18002be09
call fcn.18002d800
mov r9, qword [rbx + 0x18]
mov rax, r9
sub rax, rsi
cmp rax, 0xffffffffffffffff
jae 0x18002be25
test rax, rax
mov rbp, rax
je 0x18002bf5a
mov rdx, qword [rbx + 0x20]
cmp rdx, 0x10
jb 0x18002be39
mov rcx, qword [rbx + 8]
lea rdi, [rbx + 8]
jmp 0x18002be40
lea rdi, [rbx + 8]
mov rcx, rdi
cmp rdx, 0x10
jb 0x18002be4b
mov rax, qword [rdi]
jmp 0x18002be4e
mov rax, rdi
lea r8, [rcx + rbp]
sub r9, rbp
lea rcx, [rax + rsi]
add r8, rsi
sub r9, rsi
sub rdx, rsi
call fcn.180087f60
mov r11, qword [rbx + 0x18]
sub r11, rbp
cmp qword [rbx + 0x20], 0x10
mov qword [rbx + 0x18], r11
jb 0x18002be7c
mov rdi, qword [rdi]
mov byte [rdi + r11], r14b
jmp 0x18002bf5a
or rbp, 0xffffffffffffffff
sub rsi, rax
sub rbp, rax
cmp rbp, rsi
ja 0x18002be99
call fcn.18002d730
test rsi, rsi
je 0x18002bf5a
mov rax, qword [rbx + 0x18]
lea rbp, [rsi + rax]
cmp rbp, 0xfffffffffffffffe
jbe 0x18002beb5
call fcn.18002d730
mov rax, qword [rbx + 0x20]
cmp rax, rbp
jae 0x18002bef5
mov r8, qword [rbx + 0x18]
mov rdx, rbp
mov rcx, rbx
call fcn.180005ab0
test rbp, rbp
je 0x18002bf5a
cmp rsi, 1
mov rcx, qword [rbx + 0x18]
jne 0x18002bf23
cmp qword [rbx + 0x20], 0x10
jb 0x18002bf16
mov rax, qword [rbx + 8]
lea rdi, [rbx + 8]
mov byte [rax + rcx], r14b
jmp 0x18002bf48
test rbp, rbp
jne 0x18002becd
cmp rax, 0x10
mov qword [rbx + 0x18], r14
jb 0x18002bf0d
mov rax, qword [rbx + 8]
mov byte [rax], r14b
jmp 0x18002bf5a
lea rax, [rbx + 8]
mov byte [rax], r14b
jmp 0x18002bf5a
lea rdi, [rbx + 8]
mov rax, rdi
mov byte [rax + rcx], r14b
jmp 0x18002bf48
cmp qword [rbx + 0x20], 0x10
jb 0x18002bf34
mov rax, qword [rbx + 8]
lea rdi, [rbx + 8]
jmp 0x18002bf3b
lea rdi, [rbx + 8]
mov rax, rdi
add rcx, rax
mov r8, rsi
xor edx, edx
call fcn.18008fd00
cmp qword [rbx + 0x20], 0x10
mov qword [rbx + 0x18], rbp
jb 0x18002bf56
mov rdi, qword [rdi]
mov byte [rdi + rbp], r14b
mov rcx, rbx
mov dword [rsp + 0x70], r14d
call fcn.180004c90
mov r8d, dword [rbx + 0x18]
lea r9, [rsp + 0x70]
mov rdx, rax
mov rcx, r12
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x68]
test eax, eax
mov rbp, qword [rsp + 0x60]
je 0x18002bfb4
mov ecx, dword [rsp + 0x70]
movzx eax, r13b
mov edx, 1
cmp qword [rbx + 0x18], rcx
cmove eax, edx
add rsp, 0x38
pop r14
pop r13
pop r12
pop rbx
ret
mov al, r13b
add rsp, 0x38
pop r14
pop r13
pop r12
pop rbx
ret
Function at 0x18003935c
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
lea ecx, [rbx + 8]
test ax, ax
cmovs ebx, ecx
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18003938b
or ebx, 2
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18003939e
or ebx, 1
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1800393b1
or ebx, 4
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1800393c4
or ebx, 0x20
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1800395f0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1800f18c0]
xor rax, rsp
mov qword [rsp + 0x240], rax
and dword [rsp + 0x20], 0
and word [rsp + 0x30], 0
mov rbx, rcx
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x208
call fcn.18008fd00
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0x30]
or r8d, 0xffffffff
mov rcx, rbx
call sym.VKD.dll_public:_void___cdecl_DuiLib::CDuiString::constructor_wchar_t_const____ptr64__int____ptr64
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180087cc0
add rsp, 0x250
pop rbx
ret
Function at 0x18003f948
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov rbx, rcx
add rcx, 0x348
mov r13, r9
mov rbp, r8
mov edi, edx
xor esi, esi
call sym.VKD.dll_public_virtual:_int___cdecl_DuiLib::CListContainerElementUI::GetIndex_void_const___ptr64
test eax, eax
jle 0x18003f9d2
lea rcx, [rbx + 0x348]
mov edx, esi
mov byte [rsp + 0x80], 0
call sym.VKD.dll_public:_void____ptr64___cdecl_DuiLib::CDuiPtrArray::operator___int_const___ptr64
lea rcx, [rsp + 0x80]
mov r9, r13
mov r10, qword [rax]
mov qword [rsp + 0x20], rcx
mov r8, rbp
mov edx, edi
mov rcx, rax
call qword [r10]
cmp byte [rsp + 0x80], 0
jne 0x18003fa63
lea rcx, [rbx + 0x348]
add esi, 1
call sym.VKD.dll_public_virtual:_int___cdecl_DuiLib::CListContainerElementUI::GetIndex_void_const___ptr64
cmp esi, eax
jl 0x18003f97d
sub edi, 0x100
je 0x18003fae6
sub edi, 4
je 0x18003fa67
cmp edi, 2
jne 0x18003faca
cmp qword [rbx + 0x120], 0
je 0x18003faca
and word [rsp + 0x80], 0
xor eax, eax
mov ecx, ebp
mov word [rsp + 0x82], ax
call fcn.180090480
mov rcx, qword [rbx + 0x120]
mov word [rsp + 0x80], ax
mov rax, qword [rcx]
lea r8, [rsp + 0x80]
lea rdx, [sym.VKD.dll_private:_static_class_DuiLib::CControlUI____ptr64___cdecl_DuiLib::CPaintManagerUI::__FindControlFromShortcut_class_DuiLib::CControlUI____ptr64__void____ptr64_]
mov r9d, 0x80000012
call qword [rax + 0x220]
test rax, rax
mov rbx, rax
je 0x18003faca
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x208]
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x40]
mov al, 1
jmp 0x18003facc
mov rdi, qword [rbx + 0x128]
test rdi, rdi
je 0x18003faca
xor edx, edx
lea rcx, [rsp + 0x38]
lea r8d, [rdx + 0x28]
call fcn.18008fd00
mov rax, qword [rbx + 0x150]
mov dword [rsp + 0x30], 6
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x38], rdi
mov word [rsp + 0x4c], bp
call fcn.18003935c
mov word [rsp + 0x4e], ax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rbx + 0x128]
mov dword [rsp + 0x40], eax
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x238]
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
cmp rbp, 9
jne 0x18003faca
cmp qword [rbx + 0x128], 0
je 0x18003fb53
mov rcx, qword [rbx + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x1b8]
test al, al
je 0x18003fb53
mov rcx, qword [rbx + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x1d0]
test al, al
je 0x18003fb53
mov rcx, qword [rbx + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x20]
lea rdx, str.RichEdit
mov rcx, rax
call fcn.18008ffa0
test rax, rax
je 0x18003fb53
mov rcx, qword [rbx + 0x128]
call sym.VKD.dll_public:_bool___cdecl_DuiLib::CListContainerElementUI::IsExpandable_void_const___ptr64
test al, al
jne 0x18003faca
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, rbx
test ax, ax
setns dl
call sym.VKD.dll_public:_bool___cdecl_DuiLib::CPaintManagerUI::SetNextTabControl_bool____ptr64
jmp 0x18003fa63
Function at 0x180064900
Capabilities:
Get graphical window text

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rdi
mov rax, qword [0x1800f18c0]
xor rax, rbp
mov qword [rbp], rax
cmp byte [rcx + 0x30], 0
mov rdi, rcx
je 0x1800649ea
cmp qword [rcx + 0x20], 0
je 0x1800649ea
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea r8d, [rax + 1]
movsxd rax, r8d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x180064960
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1800a85f0
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x1800649ea
mov rcx, qword [rdi + 8]
mov rdx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rdi + 0x20]
mov rdx, rbx
add rcx, 0x218
call fcn.180046544
mov rbx, qword [rdi + 0x20]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x48]
mov byte [rsp + 0x30], 1
lea r8, str.textchanged
xor r9d, r9d
mov rdx, rbx
mov rcx, rax
mov byte [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call sym.VKD.dll_public:_void___cdecl_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI____ptr64__wchar_t_const____ptr64__unsigned_long_long_unsigned___int64___long_long___int64___bool__bool____ptr64
mov rcx, qword [rdi + 0x20]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, rax
call sym.VKD.dll_public_virtual:_bool___cdecl_DuiLib::CControlUI::IsContextMenuUsed_void_const___ptr64
test al, al
je 0x1800649ea
mov rcx, qword [rdi + 0x20]
call sym.VKD.dll_public:_void___cdecl_DuiLib::CControlUI::Invalidate_void____ptr64
xor eax, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.180087cc0
mov rbx, qword [rbp + 0x20]
mov rdi, qword [rbp + 0x28]
lea rsp, [rbp + 0x10]
pop rbp
ret

Function at 0x180069ac4
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0x720], 0
mov rbp, r9
mov rdi, r8
mov esi, edx
mov rbx, rcx
je 0x180069b77
cmp edx, 0x100
jne 0x180069b51
cmp r8w, 0xd
jne 0x180069b51
cmp byte [rcx + 0x72a], 0
je 0x180069b22
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x180069b51
cmp byte [rbx + 0x72b], 0
jne 0x180069b51
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x180069b4d
mov byte [rsp + 0x30], 1
lea r8, str.return
xor r9d, r9d
mov rdx, rbx
mov byte [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call sym.VKD.dll_public:_void___cdecl_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI____ptr64__wchar_t_const____ptr64__unsigned_long_long_unsigned___int64___long_long___int64___bool__bool____ptr64
xor eax, eax
jmp 0x180069b7c
mov rax, qword [rbx + 0x720]
mov r9, rbp
mov r8, rdi
mov rcx, qword [rax + 0x18]
mov rax, qword [rsp + 0x70]
mov edx, esi
mov r10, qword [rcx]
mov qword [rsp + 0x20], rax
call qword [r10 + 0x18]
jmp 0x180069b7c
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1800786e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
test rdx, rdx
mov r10d, r8d
mov r11, rdx
mov r9d, ecx
jne 0x1800786ff
xor eax, eax
jmp 0x1800787f2
cmp r10d, 8
not r9d
lea rsi, [0x1800b7790]
jb 0x1800787c7
mov rbx, r10
shr rbx, 3
mov cl, byte [r11]
add r10d, 0xfffffff8
add r11, 8
xor cl, r9b
shr r9d, 8
movzx eax, cl
mov cl, byte [r11 - 7]
mov edx, dword [rsi + rax*4]
xor edx, r9d
xor cl, dl
shr edx, 8
movzx eax, cl
mov cl, byte [r11 - 6]
mov r8d, dword [rsi + rax*4]
xor r8d, edx
xor cl, r8b
shr r8d, 8
movzx eax, cl
mov cl, byte [r11 - 5]
mov edx, dword [rsi + rax*4]
xor edx, r8d
xor cl, dl
shr edx, 8
movzx eax, cl
mov cl, byte [r11 - 4]
mov r8d, dword [rsi + rax*4]
xor r8d, edx
xor cl, r8b
shr r8d, 8
movzx eax, cl
mov cl, byte [r11 - 3]
mov edx, dword [rsi + rax*4]
xor edx, r8d
xor cl, dl
shr edx, 8
movzx eax, cl
mov cl, byte [r11 - 2]
mov r8d, dword [rsi + rax*4]
xor r8d, edx
xor cl, r8b
shr r8d, 8
movzx eax, cl
mov cl, byte [r11 - 1]
mov edx, dword [rsi + rax*4]
xor edx, r8d
xor cl, dl
shr edx, 8
movzx eax, cl
mov r9d, dword [rsi + rax*4]
xor r9d, edx
sub rbx, 1
jne 0x18007871a
test r10d, r10d
je 0x1800787ec
mov cl, byte [r11]
mov eax, r9d
add r11, 1
xor cl, r9b
shr eax, 8
movzx edx, cl
mov r9d, dword [rsi + rdx*4]
xor r9d, eax
add r10d, 0xffffffff
jne 0x1800787cc
not r9d
mov eax, r9d
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
ret

Function at 0x180078e04
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov rdi, r9
mov rbp, rdx
mov r10, rcx
imul esi, edx
cmp byte [r9], 0
je 0x180078e54
and qword [rax - 0x18], 0
mov rdx, rcx
mov rcx, qword [rdi + 8]
lea r9, [rax + 0x10]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180078e4e
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
jmp 0x180078e7b
mov edx, dword [r9 + 0x24]
mov ecx, dword [r9 + 0x20]
lea eax, [rdx + rsi]
cmp eax, ecx
jbe 0x180078e67
sub ecx, edx
mov esi, ecx
add rdx, qword [r9 + 0x18]
mov r8d, esi
mov rcx, r10
call fcn.1800898c0
add dword [rdi + 0x24], esi
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
xor edx, edx
div rbp
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180079e5c
Capabilities:
Create directory

Disassembly:
test rdx, rdx
je 0x180079f37
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x1800f18c0]
xor rax, rsp
mov qword [rsp + 0x440], rax
movzx eax, word [rdx]
mov rbx, rdx
mov rsi, rcx
test ax, ax
je 0x180079f13
mov rdi, rdx
mov rcx, rdx
cmp ax, 0x2f
je 0x180079ea9
cmp ax, 0x5c
jne 0x180079eac
mov rdi, rcx
add rcx, 2
mov ax, word [rcx]
test ax, ax
jne 0x180079e9d
cmp rdi, rdx
je 0x180079ee3
sub rdi, rdx
lea rcx, [rsp + 0x20]
sar rdi, 1
mov r8, rdi
call fcn.1800900c0
and word [rsp + rdi*2 + 0x20], 0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.180079e5c
lea rcx, [rsp + 0x230]
mov rdx, rsi
call fcn.180090b10
lea rcx, [rsp + 0x230]
mov rdx, rbx
call fcn.180090ad0
lea rcx, [rsp + 0x230]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180087cc0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x180079e65
Capabilities:
Create directory

Disassembly:
test rdx, rdx
je 0x180079f37
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x1800f18c0]
xor rax, rsp
mov qword [rsp + 0x440], rax
movzx eax, word [rdx]
mov rbx, rdx
mov rsi, rcx
test ax, ax
je 0x180079f13
mov rdi, rdx
mov rcx, rdx
cmp ax, 0x2f
je 0x180079ea9
cmp ax, 0x5c
jne 0x180079eac
mov rdi, rcx
add rcx, 2
mov ax, word [rcx]
test ax, ax
jne 0x180079e9d
cmp rdi, rdx
je 0x180079ee3
sub rdi, rdx
lea rcx, [rsp + 0x20]
sar rdi, 1
mov r8, rdi
call fcn.1800900c0
and word [rsp + rdi*2 + 0x20], 0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.180079e5c
lea rcx, [rsp + 0x230]
mov rdx, rsi
call fcn.180090b10
lea rcx, [rsp + 0x230]
mov rdx, rbx
call fcn.180090ad0
lea rcx, [rsp + 0x230]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180087cc0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x18007b7f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
cmp qword [rcx], 0
mov ebp, r9d
mov r12d, r8d
mov rsi, rdx
mov rdi, rcx
jne 0x18007b889
cmp dword [rcx + 8], 0xffffffff
jne 0x18007b889
lea rdx, [rcx + 0x13c]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [0x1800b7dac]
lea rcx, [rdi + 0x13c]
call fcn.180090ad0
cmp ebp, 1
jne 0x18007b858
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, ebp
je 0x18007b858
mov eax, 0x2000000
jmp 0x18007b88e
lea r9, [rsp + 0x40]
mov r8d, ebp
mov edx, r12d
mov rcx, rsi
call fcn.180078b88
test rax, rax
jne 0x18007b876
mov eax, dword [rsp + 0x40]
jmp 0x18007b88e
mov rcx, rax
call fcn.18007b308
mov qword [rdi], rax
mov eax, dword [0x1800f4370]
jmp 0x18007b88e
mov eax, 0x1000000
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x18007ff6c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r9d, dword [rcx + 0x10]
mov rbx, rcx
and r9d, 7
je 0x18007ff98
cmp dword [rcx + 0x10], r9d
jge 0x18007ff8e
call fcn.18007f8e0
mov ecx, r9d
shr dword [rbx + 0x14], cl
sub dword [rbx + 0x10], r9d
xor ecx, ecx
cmp dword [rbx + 0x10], ecx
jle 0x18007ffbe
lea rdx, [rsp + 0x30]
mov al, byte [rbx + 0x14]
add dword [rbx + 0x10], 0xfffffff8
shr dword [rbx + 0x14], 8
mov byte [rdx], al
add ecx, 1
add rdx, 1
cmp dword [rbx + 0x10], 0
jg 0x18007ffa4
movsxd rcx, ecx
jmp 0x18007ffe1
mov rax, qword [rbx]
cmp rax, qword [rbx + 8]
jb 0x18007ffd0
xor dl, dl
jmp 0x18007ffd9
mov dl, byte [rax]
add rax, 1
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
add rcx, 1
cmp rcx, 4
jl 0x18007ffc3
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
shl ecx, 8
add r8d, eax
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
je 0x180080022
lea rcx, str.zlib_corrupt
call fcn.18007bda0
jmp 0x180080070
mov rax, qword [rbx]
movsxd rdi, r8d
lea rcx, [rdi + rax]
cmp rcx, qword [rbx + 8]
jbe 0x18008003b
lea rcx, str.read_past_buffer
jmp 0x18008001b
mov rdx, qword [rbx + 0x18]
lea rax, [rdx + rdi]
cmp rax, qword [rbx + 0x28]
jbe 0x180080055
mov rcx, rbx
call fcn.18007f9e4
test eax, eax
je 0x180080070
mov rdx, qword [rbx]
mov rcx, qword [rbx + 0x18]
mov r8, rdi
call fcn.1800898c0
add qword [rbx], rdi
add qword [rbx + 0x18], rdi
mov eax, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180085f84
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rax, rdx
mov r13, r9
mov rbp, r8
shr rax, 0x10
mov rbx, rdx
mov rsi, rcx
test ax, ax
je 0x180085fd8
cmp word [rdx], 0x3c
jne 0x180085fce
call sym.VKD.dll_public:_bool___cdecl_DuiLib::CMarkup::Load_wchar_t_const____ptr64____ptr64
test al, al
jne 0x180086064
xor eax, eax
jmp 0x180086079
xor r8d, r8d
call sym.VKD.dll_public:_bool___cdecl_DuiLib::CMarkup::LoadFromFile_wchar_t_const____ptr64__int____ptr64
jmp 0x180085fbf
call sym.VKD.dll_public:_static_struct_HINSTANCE______ptr64___cdecl_DuiLib::CPaintManagerUI::GetResourceDll_void_
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov rdi, rax
je 0x180085fc7
call sym.VKD.dll_public:_static_struct_HINSTANCE______ptr64___cdecl_DuiLib::CPaintManagerUI::GetResourceDll_void_
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov r12, rax
jne 0x180086018
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x180085fc7
mov qword [rsi + 0x148], r13
call sym.VKD.dll_public:_static_struct_HINSTANCE______ptr64___cdecl_DuiLib::CPaintManagerUI::GetResourceDll_void_
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r12
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r9d, r9d
mov r8d, ebx
mov rcx, rsi
mov rdx, rax
call sym.VKD.dll_public:_bool___cdecl_DuiLib::CMarkup::LoadFromMem_unsigned_char____ptr64__unsigned_long_int__int____ptr64
test al, al
je 0x180085fc7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov qword [rsi + 0x150], rbp
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov rdx, r13
mov rcx, rsi
call sym.VKD.dll_public:_class_DuiLib::CControlUI____ptr64___cdecl_DuiLib::CDialogBuilder::Create_class_DuiLib::IDialogBuilderCallback____ptr64__class_DuiLib::CPaintManagerUI____ptr64__class_DuiLib::CControlUI____ptr64____ptr64
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret