joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180067640
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x50
xor ebx, ebx
mov rax, rdx
mov rsi, rcx
test rcx, rcx
je 0x18006775f
test rdx, rdx
je 0x18006775f
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 2
mov qword [rsp + 0x70], rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18006774d
mov rcx, rsi
mov qword [rsp + 0x68], rbp
call fcn.180065c20
mov rcx, rsi
mov ebp, eax
xor eax, eax
mov qword [rsp + 0x42], rax
mov dword [rsp + 0x4a], eax
mov eax, 0x4d42
mov word [rsp + 0x40], ax
lea eax, [rbp + 0xe]
mov dword [rsp + 0x42], eax
call fcn.180065a40
lea r9, [rsp + 0x60]
add eax, 0x36
lea r8d, [rbx + 0xe]
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x4a], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18006772d
cmp dword [rsp + 0x60], 0xe
jne 0x18006772d
lea r9, [rsp + 0x60]
mov r8d, ebp
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18006772d
cmp dword [rsp + 0x60], ebp
mov eax, 1
cmove ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rsi
ret
mov eax, ebx
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rsi
ret
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rsi
ret
Function at 0x18006d020
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rbp, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
mov rbx, r9
mov rsi, rdx
repne scasb al, byte [rdi]
mov eax, 0x1f3
not rcx
dec rcx
sub eax, ecx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
mov rcx, rbp
mov dword [rsp + 0x24], eax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, rax
mov qword [rsp + 0x28], rax
cmp rax, 0xffffffffffffffff
jne 0x18006d08a
lea eax, [rcx + 2]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov r8d, 1
movsxd rdi, edi
mov dword [rsp + 0x20], r8d
mov qword [rsp + 0x30], rdi
nop dword [rax]
test byte [rsi], 0x10
je 0x18006d1db
cmp byte [rsi + 0x2c], 0x2e
jne 0x18006d0c9
movzx eax, byte [rsi + 0x2d]
cmp al, 0x2e
jne 0x18006d0c1
cmp byte [rsi + 0x2e], 0
je 0x18006d214
test al, al
je 0x18006d214
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsi + 0x2c]
repne scasb al, byte [rdi]
mov eax, dword [rsp + 0x24]
not rcx
dec rcx
mov qword [rsp + 0x40], rcx
lea rdx, [rcx + 1]
cmp rax, rdx
jb 0x18006d20a
mov rax, qword [rsp + 0x30]
mov r9, qword [rsp + 0x88]
lea rdx, [rsi + 0x2c]
mov r8d, 0x10002
mov rcx, rbp
mov byte [rax + rbp - 1], 0
call qword [rsp + 0x80]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rsi + rcx + 0x2c]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x18006d130
mov r9, qword [rsp + 0x88]
mov r8, qword [rsp + 0x80]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
mov rdx, rsi
repne scasb al, byte [rdi]
movzx eax, word [0x18015bbc4]
mov rcx, rbp
mov word [rdi - 1], ax
movzx eax, byte [0x18015bbc6]
mov byte [rdi + 1], al
call fcn.18006d020
lea rcx, [rsi + 0x2c]
xor edx, edx
mov r8d, 0x104
call fcn.1800a1250
mov ecx, dword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
lea rdx, [rcx + rbp - 1]
lea rcx, [rsi + 0x2c]
call fcn.1800a2980
mov rdi, qword [rsp + 0x30]
mov r9, qword [rsp + 0x88]
lea rdx, [rsi + 0x2c]
mov r8d, 0x20002
mov rcx, rbp
mov byte [rdi + rbp - 1], 0
call qword [rsp + 0x80]
mov byte [rdi + rbp - 1], 0x2a
mov r8d, eax
mov dword [rsp + 0x20], eax
mov byte [rdi + rbp], 0
jmp 0x18006d20f
lea rdx, [rsi + 0x2c]
mov r9, rbx
mov r8d, 1
mov rcx, rbp
mov byte [rdi + rbp - 1], 0
call qword [rsp + 0x80]
mov rcx, qword [rsp + 0x28]
mov byte [rdi + rbp - 1], 0x2a
mov r8d, eax
mov dword [rsp + 0x20], eax
jmp 0x18006d21c
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x88]
test r8d, r8d
je 0x18006d23c
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
test eax, eax
jne 0x18006d0a0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x20]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x18006f260
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
or rcx, 0xffffffffffffffff
xor eax, eax
lea rbx, [0x1801d2750]
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
jne 0x18006f294
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18006f2b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
or rcx, 0xffffffffffffffff
xor eax, eax
lea rbx, [0x1801d2960]
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
jne 0x18006f2ec
lea rcx, str.APPDATA
mov r8d, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18006f300
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
or rcx, 0xffffffffffffffff
xor eax, eax
lea rbx, [0x1801d2b70]
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
jne 0x18006f33c
lea rcx, [0x18015c3c8]
mov r8d, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18006f3c0
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1801aef28]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov rdx, rcx
test rcx, rcx
je 0x18006f455
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x48], rdi
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
mov rdi, qword [rsp + 0x48]
not rcx
dec rcx
cmp rcx, 2
jb 0x18006f457
movzx eax, word [rdx]
cmp ax, 0x5c
jne 0x18006f428
cmp word [rdx + 2], ax
jne 0x18006f428
mov eax, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800a1220
add rsp, 0x30
pop rbx
ret
movzx ecx, word [rdx + 2]
mov word [rsp + 0x20], ax
mov word [rsp + 0x24], bx
mov word [rsp + 0x22], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
je 0x18006f410
cmp eax, 1
je 0x18006f410
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800a1220
add rsp, 0x30
pop rbx
ret
Function at 0x180076260
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x180076277
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
xor edx, edx
call fcn.180075ea0
test eax, eax
jne 0x18007626e
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_GetFileAttributesW]

Function at 0x1800767b0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1801aef28]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rdx
mov ebp, r8d
lea rdx, [0x18015b968]
mov r8d, 4
mov rbx, rcx
call fcn.1800a256c
test eax, eax
je 0x180076822
lea rdx, [0x18015b958]
mov r8d, 4
mov rcx, rbx
call fcn.1800a256c
test eax, eax
je 0x180076822
lea rdx, [0x18015b948]
mov r8d, 4
mov rcx, rbx
call fcn.1800a256c
test eax, eax
jne 0x180076826
add rbx, 8
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 4
jb 0x1800768f3
cmp word [rbx + 2], 0x3a
jne 0x1800768f3
cmp word [rbx + 4], 0x5c
lea rdi, [rbx + 4]
jne 0x1800768f3
mov eax, dword [0x180144738]
lea rcx, [rsp + 0x38]
mov dword [rcx], eax
movzx eax, word [0x18014473c]
mov word [rcx + 4], ax
movzx ecx, word [rbx]
xor eax, eax
mov dword [rsp + 0x3e], eax
mov word [rsp + 0x42], ax
call fcn.1800a3e10
lea rcx, [rsp + 0x38]
mov word [rsp + 0x38], ax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
jne 0x1800768f3
xor eax, eax
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], ax
call fcn.1800a1250
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x30], 0x104
call sub.MPR.dll_WNetGetConnectionW
test eax, eax
jne 0x1800768f3
lea edx, [rbp - 1]
lea r9, [rsp + 0x50]
lea r8, [0x180145f70]
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call fcn.1800a2084
jmp 0x180076902
lea r8d, [rbp - 1]
mov rdx, rbx
mov rcx, rsi
call fcn.1800a11c4
mov eax, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1800a1220
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x270
pop rdi
pop rsi
pop rbp
ret
Function at 0x180076930
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x1801aef28]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rsi, rdx
mov ebp, r8d
lea rdx, [0x18015ba84]
mov r8d, 4
mov rbx, rcx
call fcn.1800a3f20
test eax, eax
je 0x1800769a2
lea rdx, [0x18015ba7c]
mov r8d, 4
mov rcx, rbx
call fcn.1800a3f20
test eax, eax
je 0x1800769a2
lea rdx, [0x18015ba74]
mov r8d, 4
mov rcx, rbx
call fcn.1800a3f20
test eax, eax
jne 0x1800769a6
add rbx, 4
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 4
jb 0x180076a6e
cmp byte [rbx + 1], 0x3a
jne 0x180076a6e
cmp byte [rbx + 2], 0x5c
lea rdi, [rbx + 2]
jne 0x180076a6e
movzx eax, word [0x18015e348]
lea rcx, [rsp + 0x34]
mov word [rcx], ax
movzx eax, byte [0x18015e34a]
mov byte [rcx + 2], al
movsx ecx, byte [rbx]
xor eax, eax
mov word [rsp + 0x37], ax
mov byte [rsp + 0x39], al
call fcn.1800a3e10
lea rcx, [rsp + 0x34]
mov byte [rsp + 0x34], al
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
jne 0x180076a6e
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], 0
call fcn.1800a1250
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x34]
mov dword [rsp + 0x30], 0x104
call sub.MPR.dll_WNetGetConnectionA
test eax, eax
jne 0x180076a6e
lea edx, [rbp - 1]
lea r9, [rsp + 0x40]
lea r8, str._s_s
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call fcn.1800a3e38
jmp 0x180076a7d
lea r8d, [rbp - 1]
mov rdx, rbx
mov rcx, rsi
call fcn.1800a2980
mov eax, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800a1220
mov rbx, qword [rsp + 0x198]
add rsp, 0x160
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800773e0
Capabilities:
Hash data with crc32

Disassembly:
test rcx, rcx
je 0x1800773f6
test edx, edx
je 0x1800773f6
mov r8d, edx
mov rdx, rcx
xor ecx, ecx
jmp 0x1800dd040
xor eax, eax
ret
sub rsp, 8
mov r11d, r8d
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x1800dd059
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rdi
not r9d
lea rdi, [0x180168ee0]
cmp r11d, 8
jb 0x1800dd151
mov qword [rsp + 0x10], rbx
mov rbx, r11
shr rbx, 3
nop dword [rax]
movzx ecx, byte [r10]
mov eax, r9d
shr r9d, 8
xor rcx, rax
add r10, 8
add r11d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r10 - 7]
mov edx, dword [rdi + rax*4]
xor edx, r9d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 6]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 5]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 4]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 3]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 2]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 1]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov r9d, dword [rdi + rax*4]
xor r9d, edx
dec rbx
jne 0x1800dd080
mov rbx, qword [rsp + 0x10]
test r11d, r11d
je 0x1800dd17f
nop word [rax + rax]
movzx ecx, byte [r10]
mov eax, r9d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
dec r11d
jne 0x1800dd160
mov rdi, qword [rsp]
not r9d
mov eax, r9d
add rsp, 8
ret
Function at 0x180077610
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x4c0
mov rax, qword [0x1801aef28]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov rdi, rcx
mov esi, r8d
mov rbx, rdx
lea rcx, [rsp + 0x42]
xor ebp, ebp
xor edx, edx
mov r8d, 0x256
mov word [rsp + 0x40], bp
call fcn.1800a1250
lea rdx, [rsp + 0x40]
mov r8d, 0x12c
mov rcx, rdi
call fcn.180074cb0
test eax, eax
je 0x1800777fb
mov eax, dword [0x180144738]
lea rcx, [rsp + 0x30]
mov dword [rcx], eax
movzx eax, word [0x18014473c]
mov word [rcx + 4], ax
xor eax, eax
cmp word [rsp + 0x30], 0x5a
mov dword [rsp + 0x36], eax
mov word [rsp + 0x3a], ax
ja 0x18007771f
nop dword [rax]
lea rcx, [rsp + 0x2a2]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x2a0], bp
call fcn.1800a1250
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x2a0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
je 0x18007770c
mov r8, rcx
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x40]
call fcn.1800a39f8
test eax, eax
je 0x180077756
movzx eax, word [rsp + 0x30]
inc ax
mov word [rsp + 0x30], ax
cmp ax, 0x5a
jbe 0x1800776a0
lea rdx, [0x18015e508]
lea rcx, [rsp + 0x40]
mov r8d, 8
call fcn.1800a39f8
test eax, eax
jne 0x18007777e
lea r9, [rsp + 0x50]
lea r8, [0x18015e350]
mov rdx, rsi
mov rcx, rbx
call fcn.1800a2084
jmp 0x1800777f6
lea rax, [rsp + rdi*2 + 0x40]
test rax, rax
je 0x18007771f
lea r9, [rsp + 0x30]
lea r8, [0x180145f70]
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1800a2084
jmp 0x1800777f6
lea rdx, str.DeviceLanmanRedirector_
lea rcx, [rsp + 0x40]
mov r8d, 0x19
call fcn.1800a39f8
test eax, eax
jne 0x1800777b2
lea r9, [rsp + 0x72]
lea r8, [0x18015e350]
mov rdx, rsi
mov rcx, rbx
call fcn.1800a2084
jmp 0x1800777f6
lea rdx, str.DeviceMup_
lea rcx, [rsp + 0x40]
mov r8d, SafeArrayCreate
call fcn.1800a39f8
test eax, eax
jne 0x1800777e6
lea r9, [rsp + 0x58]
lea r8, [0x18015e350]
mov rdx, rsi
mov rcx, rbx
call fcn.1800a2084
jmp 0x1800777f6
lea rcx, [rsp + 0x40]
mov r8d, esi
mov rdx, rbx
call fcn.1800767b0
mov eax, 1
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.1800a1220
mov rbx, qword [rsp + 0x4f8]
add rsp, 0x4c0
pop rdi
pop rsi
pop rbp
ret
Function at 0x180078450
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x40]
mov rbx, rcx
test eax, eax
jne 0x18007851d
lea rcx, str.Shell32.dll
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x180078515
lea rdx, str.SHGetFolderPathA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SHCreateShellItemArrayFromDataObject
mov rcx, rdi
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SHCreateShellItemArrayFromShellItem
mov rcx, rdi
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SHCreateItemFromIDList
mov rcx, rdi
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SHGetKnownFolderPath
mov rcx, rdi
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SHCreateItemFromParsingName
mov rcx, rdi
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SHCreateShellItemArrayFromIDLists
mov rcx, rdi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rbx + 0x40], 1
mov qword [rbx + 0x30], rax
mov eax, dword [rbx + 0x40]
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x18007b1e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1801aef28]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rbx, [0x1801ddf00]
xor edx, edx
mov r8d, 0x208
mov rcx, rbx
call fcn.1800a1250
lea rsi, [0x1801de110]
xor edx, edx
mov rcx, rsi
mov r8d, 0x208
call fcn.1800a1250
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x18007b25c
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x18007b319
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.1800a1250
lea rcx, [rsp + 0x141]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x140], 0
call fcn.1800a1250
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, [rsp + 0x140]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
lea r8, [rsp + 0x30]
xor edx, edx
repne scasb al, byte [rdi]
mov dword [rsp + 0x28], 0x103
mov qword [rsp + 0x20], rbx
not rcx
lea r9, [rcx - 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x140]
lea r8, [rsp + 0x140]
xor edx, edx
repne scasb al, byte [rdi]
mov dword [rsp + 0x28], 0x103
mov qword [rsp + 0x20], rsi
not rcx
lea r9, [rcx - 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rbx
call fcn.1800a7000
mov rcx, rsi
call fcn.1800a7000
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdi, rsi
not rcx
dec rcx
mov dword [0x1801ddefc], ecx
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
dec rcx
mov dword [0x1801de108], ecx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1800a1220
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x18007c050
Capabilities:
Get file size
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x30
cmp dword [rcx + 0xc], 0
mov qword [rsp + 0x48], rbx
mov rsi, rdx
mov rbx, rcx
je 0x18007c074
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor ebp, ebp
mov qword [rsp + 0x50], rdi
cmp dword [rbx + 0x10], ebp
je 0x18007c0d7
mov rcx, qword [rbx + 0x20]
cmp rcx, 0xffffffffffffffff
je 0x18007c0d7
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, dword [rbx + 0x2c]
jae 0x18007c0d7
mov rcx, qword [rbx + 0x20]
lea r9d, [rbp + 2]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
lea r9, [rsp + 0x40]
mov rdx, rsi
repne scasb al, byte [rdi]
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x20], rbp
not rcx
lea r8, [rcx - 1]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rbx + 0x14], ebp
mov rbx, qword [rsp + 0x48]
je 0x18007c11b
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
mov dword [rsp + 0x40], ebp
not rcx
lea rdi, [rcx - 1]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret

Function at 0x18007c130
Capabilities:
Get file size
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x30
cmp dword [rcx + 0xc], 0
mov qword [rsp + 0x48], rbx
mov rsi, rdx
mov rbx, rcx
je 0x18007c154
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor ebp, ebp
mov qword [rsp + 0x50], rdi
cmp dword [rbx + 0x10], ebp
je 0x18007c1b9
mov rcx, qword [rbx + 0x20]
cmp rcx, 0xffffffffffffffff
je 0x18007c1b9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, dword [rbx + 0x2c]
jae 0x18007c1b9
mov rcx, qword [rbx + 0x20]
lea r9d, [rbp + 2]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
lea r9, [rsp + 0x40]
mov rdx, rsi
repne scasw ax, word [rdi]
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x20], rbp
not rcx
lea r8d, [rcx + rcx - 2]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rbx + 0x14], ebp
mov rbx, qword [rsp + 0x48]
je 0x18007c200
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
mov dword [rsp + 0x40], ebp
not rcx
lea rdi, [rcx - 1]
mov ecx, 0xfffffff5
add edi, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
Function at 0x18007cf00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
shr edx, 4
mov rsi, r9
inc dx
movzx r9d, r8w
mov rdi, rcx
movzx r8d, dx
mov edx, 6
and ebx, 0xf
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x18007cf63
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18007cf63
xor edx, edx
nop dword [rax + rax]
movzx ecx, word [rax]
cmp ebx, edx
je 0x18007cf75
inc edx
lea rax, [rax + rcx*2 + 2]
cmp edx, 0x10
jl 0x18007cf50
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rbx, dword [rsp + 0x50]
lea rdx, [rax + 2]
mov rcx, rsi
mov r8, rbx
call fcn.18007ccf0
test eax, eax
jne 0x18007cf93
mov byte [rbx + rsi - 1], al
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
dec eax
add rsp, 0x20
pop rdi
ret

Function at 0x18007e6c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
shr edx, 4
mov rsi, r9
inc dx
movzx r9d, r8w
mov rdi, rcx
movzx r8d, dx
mov edx, 6
and ebx, 0xf
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x18007e72b
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rax
test rax, rax
je 0x18007e72b
xor ebp, ebp
mov eax, ebp
movzx ecx, word [rdx]
add rdx, 2
cmp ebx, eax
je 0x18007e742
inc eax
lea rdx, [rdx + rcx*2]
cmp eax, 0x10
jl 0x18007e715
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov edi, dword [rsp + 0x50]
dec edi
cmp ecx, edi
cmovle edi, ecx
movsxd rcx, edi
lea rbx, [rcx + rcx]
mov rcx, rsi
mov r8, rbx
call fcn.1800a1360
mov word [rbx + rsi], bp
mov eax, edi
jmp 0x18007e72d

Function at 0x180087b50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, r8
mov rdi, rcx
test rdx, rdx
je 0x180087b7e
or r9d, 0x20019
mov r8d, r9d
call fcn.180087ab0
mov rbx, rax
jmp 0x180087b81
mov rbx, rcx
test rbx, rbx
je 0x180087c27
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180087c1a
cmp dword [rsp + 0x30], 4
jne 0x180087c1a
mov eax, dword [rsp + 0x58]
mov ecx, 4
mov rdx, rsi
cmp eax, ecx
cmova eax, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x58]
mov rcx, rbx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180087c1a
cmp rbx, rdi
je 0x180087c05
mov rcx, rbx
call fcn.180087b30
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
cmp rbx, rdi
je 0x180087c27
mov rcx, rbx
call fcn.180087b30
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x40
pop rdi
ret