joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180102490
Capabilities:
Create thread
Resume thread

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
jne 0x1801024c6
xor al, al
jmp 0x18010257c
mov qword [rsp + 0x38], 0
add rdi, 0x38
mov qword [rsp + 0x38], rdi
je 0x1801024e9
mov rcx, qword [rdi]
test rcx, rcx
je 0x1801024e9
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [rbx + 0x10]
cmp qword [rax + 8], 0
je 0x18010255b
mov eax, 1
lock xadd dword [rbx + 8], eax
mov rcx, qword [rbx + 0x10]
add rcx, 0x14
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 4
mov r9, rbx
lea r8, [0x180102100]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rbx + 0x10]
mov qword [rcx + 0x18], rax
mov rax, qword [rbx + 0x10]
cmp qword [rax + 0x18], 0
jne 0x180102594
mov eax, 0xffffffff
lock xadd dword [rbx + 8], eax
sub eax, 1
jne 0x180102552
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbx + 0x10]
call fcn.1801022b0
xor bl, bl
test rdi, rdi
je 0x180102579
mov rcx, qword [rdi]
test rcx, rcx
je 0x180102570
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0x38], 0
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18022a7d0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov byte [rax + 0x10], 1
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx + 0x40]
test rax, rax
je 0x1801025b2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x10]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x18010253a
mov bl, 1
jmp 0x18010255d

Function at 0x1801033f0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0x110
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180103477
cmp dword [rsp + 0x44], 6
jb 0x180103477
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
lea r8, str.Progid
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
call fcn.180103230
test al, al
je 0x180103477
cmp word [rbx], 0
jne 0x1801034e1
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.http_shellopencommand
mov rcx, 0xffffffff80000000
call fcn.180103230
test al, al
je 0x1801034ac
cmp word [rbx], 0
jne 0x1801034e1
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareClasses.html
mov rcx, 0xffffffff80000001
call fcn.180103230
test al, al
je 0x1801034e5
cmp word [rbx], 0
je 0x1801034e5
mov al, 1
jmp 0x1801034e7
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.18022a7d0
add rsp, 0x170
pop rbx
ret
Function at 0x180104470
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
lea rcx, [r11 - 0x48]
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18022a7d0
add rsp, 0x68
ret

Function at 0x1801044c0
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor edx, edx
add rcx, 4
mov r8d, 0x118
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
mov dword [rbx], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180104622
cmp dword [rbx + 4], 6
mov qword [rsp + 0x188], rdi
ja 0x180104524
jne 0x1801045c5
cmp dword [rbx + 8], 2
jb 0x1801045c5
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x1801045c5
mov edx, 1
mov rcx, rax
lea r8d, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1801045c5
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1801045c5
movups xmm0, xmmword [0x180289878]
mov rcx, rax
movups xmm1, xmmword [0x180289888]
movups xmmword [rsp + 0x140], xmm0
movups xmmword [rsp + 0x150], xmm1
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x1801045c5
lea rcx, [rax + 6]
lea rdx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1801045c5
cmp word [rdi + 2], ax
jbe 0x1801045c5
movzx edx, word [rdi + 0x32]
movzx eax, word [rdi + 0x30]
movzx ecx, word [rdi + 0x36]
mov dword [rbx + 4], edx
mov dword [rbx + 8], eax
mov dword [rbx + 0xc], ecx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x180104616
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x118
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call rdi
test eax, eax
jne 0x180104616
mov eax, dword [rsp + 0x2c]
mov dword [rbx + 0xc], eax
mov rdi, qword [rsp + 0x188]
mov al, 1
jmp 0x180104624
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.18022a7d0
add rsp, 0x170
pop rbx
ret

Function at 0x1801058d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, r9
mov edi, r8d
test rax, rax
je 0x180105922
mov rax, qword [rax]
test rax, rax
je 0x180105922
test rdx, rdx
je 0x180105922
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x180105922
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180105922
cmp edi, dword [rbx]
sete al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x180108bf0
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x60], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r13, r8
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rdx]
test rcx, rcx
je 0x180108dda
cmp qword [rcx], 0xffffffffffffffff
je 0x180108dda
mov qword [r11 - 0x50], 0xffffffffffff8000
mov ebx, 2
mov r9d, ebx
lea r8, [r11 - 0x4c]
mov edx, 0xffff8000
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x48], eax
cmp eax, 0xffffffff
jne 0x180108c75
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x180108dda
mov ecx, 0x10000
call fcn.18022afbc
mov r15, rax
xor ebp, ebp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x50], rax
xor edx, edx
mov r8d, 0x10000
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], ebp
mov rcx, qword [rsi]
test rcx, rcx
je 0x180108db8
test r15, r15
je 0x180108db8
cmp qword [rcx], 0xffffffffffffffff
je 0x180108db8
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov r8d, 0x8000
mov rdx, r15
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180108db8
xor ecx, ecx
mov ebp, ecx
mov esi, ecx
mov r14d, 0x8000
lea r12, [r15 + 0x8000]
nop dword [rax + rax]
movzx eax, byte [rdi + 0xd8]
test al, al
jne 0x180108dc9
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x30], ecx
mov edx, esi
add rdx, r12
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov r8d, r14d
mov rcx, r13
call fcn.18012a100
test al, al
je 0x180108dad
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x180108d6c
mov rcx, qword [rdi + 0x110]
test rcx, rcx
je 0x180108d59
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx eax, byte [rdi + 0xd8]
test al, al
jne 0x180108dc9
inc ebp
mov eax, dword [rsp + 0x30]
jmp 0x180108d76
add esi, eax
cmp esi, 0x8000
je 0x180108d87
cmp ebp, 0xf
ja 0x180108da6
sub r14d, eax
je 0x180108d87
xor ecx, ecx
jmp 0x180108d00
mov r8d, 0x8000
mov rdx, r12
mov rcx, r15
call sub.VCRUNTIME140.dll_memcmp
xor ebp, ebp
mov ebx, ebp
test eax, eax
setne bl
add ebx, 4
jmp 0x180108dc9
mov ebx, 3
jmp 0x180108dc9
mov eax, dword [rsp + 0x34]
mov ebx, 3
jmp 0x180108dc3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 1
mov dword [rdi + 0x100], eax
test r15, r15
je 0x180108dd6
mov rcx, r15
call fcn.18022acec
mov eax, ebx
jmp 0x180108ddf
mov eax, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18022a7d0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180109210
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, r9
mov rbx, r8
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rdx
mov rdi, rcx
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r13d, eax
xor sil, sil
mov ecx, 0x4000
call fcn.18022afbc
mov r12, rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x48], rax
xor edx, edx
mov r8d, 0x4000
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xor r15d, r15d
cmp qword [rbp + 0x20], r15
jbe 0x1801093f1
nop
movzx eax, byte [rdi + 0xd8]
test al, al
jne 0x1801093ee
xor esi, esi
cmp qword [rbx + 8], rsi
jne 0x1801092ae
mov ebx, 0xffffffff
jmp 0x18010931e
mov dword [rsp + 0x40], esi
add rbx, 0x30
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xchg dword [rbx], eax
lea r9, [rsp + 0x40]
mov rdx, r12
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
call fcn.18012a090
test al, al
jne 0x1801092f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor edx, edx
mov rcx, qword [rsp + 0x20]
xchg dword [rcx], edx
mov ebx, 0xffffffff
jmp 0x18010931e
xor ecx, ecx
mov rax, qword [rsp + 0x20]
xchg dword [rax], ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [rsp + 0x40]
add r14, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, r13d
cmovne r13d, eax
mov ebx, dword [rsp + 0x40]
mov dword [rdi + 0x100], esi
movzx eax, byte [rdi + 0xd8]
test al, al
jne 0x1801093ee
cmp ebx, 0xffffffff
je 0x1801093ee
test ebx, ebx
je 0x18010937b
mov dword [rsp + 0x44], 0
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsi]
lea r9, [rsp + 0x44]
mov r8d, ebx
mov rdx, r12
mov rcx, rsi
call qword [rax]
test al, al
je 0x18010936a
cmp dword [rsp + 0x44], ebx
je 0x1801093a6
mov sil, 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0x100], eax
jmp 0x1801093f1
cmp byte [rbp + 0x30], 0
jne 0x1801093ee
mov rcx, qword [rdi + 0x110]
test rcx, rcx
je 0x180109398
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx eax, byte [rdi + 0xd8]
test al, al
jne 0x1801093ee
inc r15d
cmp r15d, 0xf
ja 0x1801093ee
mov rcx, qword [rdi + 0xd0]
test rcx, rcx
je 0x1801093d9
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x28]
cmp rdx, 0xffffffffffffffff
je 0x1801093c9
add rdx, rax
mov r8d, r14d
add r8, rax
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
test al, al
je 0x1801093e9
cmp r14, qword [rbp + 0x20]
jae 0x1801093ee
mov rbx, qword [rsp + 0x28]
jmp 0x180109290
mov sil, 1
jmp 0x1801093f1
xor sil, sil
mov qword [rsp + 0x48], 0
test r12, r12
je 0x180109407
mov rcx, r12
call fcn.18022acec
mov qword [rdi + 0x108], r14
cmp r14, qword [rbp + 0x20]
sete al
test sil, sil
je 0x180109427
xor al, al
movzx ecx, byte [rdi + 0xd8]
test cl, cl
jne 0x180109436
movzx eax, al
mov ecx, 1
cmp byte [rbp + 0x30], 0
cmovne eax, ecx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18022a7d0
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180109c80
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx]
test rax, rax
je 0x180109cb8
test rdx, rdx
je 0x180109cb8
cmp qword [rax], 0xffffffffffffffff
je 0x180109cb8
xor eax, eax
mov dword [r9], eax
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180109cb8
mov al, 1
add rsp, 0x38
ret
xor al, al
add rsp, 0x38
ret

Function at 0x180109d00
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx]
mov rdi, rdx
test rcx, rcx
je 0x180109d5e
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x180109d5e
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x180109d49
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x180109d5e
mov ecx, dword [rsp + 0x20]
mov rax, rbx
shl rcx, 0x20
mov al, 1
add rcx, rbx
mov qword [rdi], rcx
jmp 0x180109d60
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18022a7d0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180109eb0
Capabilities:
Set file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edi, edx
mov rbx, rcx
and edi, 0xffffb1af
cmp qword [rcx + 0x18], 8
jb 0x180109eed
mov rcx, qword [rcx]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x180109f00
mov al, 1
jmp 0x180109fae
xor esi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.18010b470
test al, al
je 0x180109f51
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x180109f51
mov bl, 1
jmp 0x180109f53
xor bl, bl
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x180109f98
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180109f93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180109f93
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18022acec
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18022a7d0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x180109fd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x18010a005
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
jne 0x18010a0b6
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x180291a20]
movdqu xmmword [rsp + 0x38], xmm1
xor esi, esi
mov word [rsp + 0x28], si
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.18010b470
test al, al
je 0x18010a05e
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x18010a0a3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18010a09e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18010a09e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18022acec
movdqa xmm0, xmmword [0x180291a20]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], si
mov eax, edi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18022a7d0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x18010a620
Capabilities:
Copy file

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x70
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rdx
mov rbx, rcx
cmp qword [rdx + 0x18], 8
jb 0x18010a65a
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x18010a664
mov rcx, qword [rcx]
mov ebp, 1
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x18010a67f
movzx eax, bpl
jmp 0x18010a7d4
xor sil, sil
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x180291a20]
movdqu xmmword [rsp + 0x58], xmm1
xor r14d, r14d
mov word [rsp + 0x48], r14w
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.18010b470
movzx ebx, sil
test al, al
cmovne ebx, ebp
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x180291a20]
movdqu xmmword [rsp + 0x38], xmm1
mov word [rsp + 0x28], r14w
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.18010b470
test al, al
jne 0x18010a6ea
test bl, bl
je 0x18010a71d
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x18010a71d
mov bl, 1
jmp 0x18010a71f
xor bl, bl
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x18010a764
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18010a75f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18010a75f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18022acec
movdqa xmm0, xmmword [0x180291a20]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], r14w
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x18010a7bd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18010a7b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18010a7b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18022acec
movdqa xmm0, xmmword [0x180291a20]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r14w
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18022a7d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18010a800
Capabilities:
Copy file

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rdx
mov rbx, rcx
cmp qword [rdx + 0x18], 8
jb 0x18010a838
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x18010a842
mov rcx, qword [rcx]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x18010a856
mov al, 1
jmp 0x18010a9ab
xor sil, sil
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x180291a20]
movdqu xmmword [rsp + 0x58], xmm1
xor ebp, ebp
mov word [rsp + 0x48], bp
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.18010b470
movzx ebx, sil
mov ecx, 1
test al, al
cmovne ebx, ecx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x180291a20]
movdqu xmmword [rsp + 0x38], xmm1
mov word [rsp + 0x28], bp
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.18010b470
test al, al
jne 0x18010a8c3
test bl, bl
je 0x18010a8f6
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x18010a8f6
mov bl, 1
jmp 0x18010a8f8
xor bl, bl
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x18010a93d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18010a938
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18010a938
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18022acec
movdqa xmm0, xmmword [0x180291a20]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], bp
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x18010a995
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18010a990
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18010a990
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18022acec
movdqa xmm0, xmmword [0x180291a20]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], bp
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18022a7d0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x18010ad10
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x20c
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memset
cmp qword [rdi + 0x18], 8
jb 0x18010ad52
mov rdi, qword [rdi]
cmp qword [rbx + 0x18], 8
jb 0x18010ad5c
mov rbx, qword [rbx]
lea r9, [rsp + 0x20]
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x18010adac
xor eax, eax
mov r8, 0xffffffffffffffff
mov word [rsp + 0x22a], ax
lea rax, [rsp + 0x20]
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18010ad90
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.180007110
mov al, 1
jmp 0x18010adae
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18022a7d0
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret
Function at 0x18010e400
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x18032a080]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov ecx, 1
call fcn.18022a7fc
mov qword [rbx], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
mov byte [rax], 0
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x18010e467
cmp dword [rsp + 0x24], 6
mov rcx, qword [rbx]
setae dl
mov byte [rcx], dl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18022a7d0
add rsp, 0x150
pop rbx
ret