joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000755c
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x90
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x180080060]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov byte [rcx], 1
mov edx, 4
lea rcx, [r11 - 0x40]
call fcn.180004254
nop
xor esi, esi
cmp qword [rsp + 0x70], rsi
jne 0x1800075cd
lea rcx, str.cstate_not_found
call fcn.18001a97c
nop
cmp qword [rsp + 0x78], 8
jb 0x180007719
mov rcx, qword [rsp + 0x60]
call fcn.180042a14
jmp 0x180007719
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rsi
mov word [rsp + 0x38], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x30]
call fcn.180002ac8
nop
lea rdx, str.__init
lea rcx, [rsp + 0x30]
call fcn.1800081dc
mov edi, esi
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
mov edx, 1
call fcn.180036e9c
mov rbx, rax
mov qword [rsp + 0x20], rax
cmp rax, rsi
je 0x180007638
cmp rax, 0xffffffffffffffff
jne 0x180007679
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.start_cstate__init_failed:__d
call fcn.18001a97c
mov r11d, edi
inc edi
cmp r11d, 0x1e
jg 0x1800076cd
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
cmp rbx, 0xffffffffffffffff
je 0x18000760a
cmp rbx, rsi
je 0x18000760a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000760a
lea rcx, str.wait_for_fill_client_info_before_online
call fcn.18001a4b8
mov edx, 0x493e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1800076a6
lea rcx, str.fille_client_info_wait_time_out_
call fcn.18001a97c
lea r8, str._fci
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smpcache_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800076e2
cmp rbx, 0xffffffffffffffff
je 0x1800076e2
cmp rbx, rsi
je 0x1800076e2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x50], 8
jb 0x1800076f4
mov rcx, qword [rsp + 0x38]
call fcn.180042a14
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rsi
mov word [rsp + 0x38], si
cmp qword [rsp + 0x78], 8
jb 0x180007719
mov rcx, qword [rsp + 0x60]
call fcn.180042a14
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800423f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180009e20
Capabilities:
Check if file exists
Delete file

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x500
mov rax, qword [0x180080060]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
lea rax, str.aspda.exe
lea rcx, str.cstate.exe
lea rbx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x70], rcx
lea rax, str.assistda.exe
lea rcx, str.poda32.exe
mov edi, ntohl
mov qword [rsp + 0x28], rax
lea rax, str.asphost.exe
xor esi, esi
mov qword [rsp + 0x30], rax
lea rax, str.assisthost.exe
mov qword [rsp + 0x38], rax
lea rax, str.asphs.exe
mov qword [rsp + 0x40], rax
lea rax, str.assisths.exe
mov qword [rsp + 0x48], rax
lea rax, str.clientinfo.exe
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rax
lea rax, str.clientstat.exe
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rax
lea rax, str.poagent32.exe
mov qword [r11 - 0x488], rax
lea rax, str.poagent64.exe
mov qword [r11 - 0x480], rcx
mov qword [r11 - 0x478], rax
lea rax, str.pohost32.exe
mov qword [r11 - 0x470], rcx
mov qword [r11 - 0x468], rax
lea rax, str.pobus32.exe
mov qword [r11 - 0x460], rax
lea rax, str.pohost64.exe
mov qword [r11 - 0x458], rax
lea rax, str.pobus64.exe
mov qword [r11 - 0x450], rax
lea rax, str.rcserver.exe
mov qword [r11 - 0x448], rax
lea rax, str.assists.exe
mov qword [r11 - 0x440], rax
lea rcx, [rsp + 0x2e2]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x2e0], si
call fcn.180044a90
lea rcx, [rsp + 0xd2]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0xd0], si
call fcn.180044a90
mov rdx, qword [rbx + 8]
cmp rdx, rsi
je 0x180009fa3
lea r8, [rsp + 0x2e0]
xor ecx, ecx
call fcn.180035c98
mov rdx, qword [rbx]
cmp rdx, rsi
je 0x180009fba
lea r8, [rsp + 0xd0]
xor ecx, ecx
call fcn.180035c98
lea rcx, [rsp + 0x2e0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, esi
je 0x18000a000
lea rcx, [rsp + 0xd0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, esi
je 0x18000a000
lea rdx, [rsp + 0xd0]
lea rcx, str.delete_old_file:__s
call fcn.18001a650
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
add rbx, 0x10
sub rdi, 1
jne 0x180009f51
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.1800423f0
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x18000bf74
Capabilities:
Get local ipv4 addresses

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x98
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbp, rcx
and dword [rax + 0x20], 0
mov ebx, 8
mov rcx, rbx
call fcn.180042b10
test rax, rax
je 0x18000bfad
mov qword [rax], rbp
jmp 0x18000bfaf
xor eax, eax
mov qword [rbp], rax
and qword [rbp + 0x18], 0
and qword [rbp + 0x20], 0
and qword [rbp + 0x28], 0
mov dword [rsp + 0xd8], 1
and dword [rsp + 0xd0], 0
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
xor ecx, ecx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov edi, dword [rsp + 0xd0]
mov rcx, rbx
call fcn.180042b10
test rax, rax
je 0x18000c011
lea rcx, [rsp + 0x60]
mov qword [rax], rcx
jmp 0x18000c013
xor eax, eax
mov qword [rsp + 0x60], rax
mov byte [rsp + 0xc8], 0
lea r8, [rsp + 0xc8]
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.18000c7b4
nop
mov rbx, qword [rsp + 0x78]
cmp rbx, qword [rsp + 0x80]
jbe 0x18000c04a
call fcn.1800429bc
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x18000c05d
call fcn.1800429bc
xor edx, edx
jmp 0x18000c060
mov rdx, qword [rax]
cmp rbx, qword [rdx + 0x20]
jb 0x18000c06b
call fcn.1800429bc
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9, rbx
xor r8d, r8d
lea edx, [r8 + 0x10]
xor ecx, ecx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x18000c11f
test rbx, rbx
je 0x18000c11f
mov rsi, qword [rbx + 0x30]
test rsi, rsi
je 0x18000c112
mov rax, qword [rsi + 0x10]
cmp word [rax], 2
jne 0x18000c109
mov ecx, dword [rax + 4]
call sub.WS2_32.dll_inet_ntoa
mov rdx, rax
mov qword [rsp + 0x58], socket
and qword [rsp + 0x50], 0
mov byte [rsp + 0x40], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x38]
call fcn.180002e60
nop
lea rdx, [rsp + 0x38]
mov rcx, rbp
call fcn.180002874
nop
cmp qword [rsp + 0x58], 0x10
jb 0x18000c109
mov rcx, qword [rsp + 0x40]
call fcn.180042a14
mov rsi, qword [rsi + 8]
test rsi, rsi
jne 0x18000c0a3
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x18000c09a
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18000c12e
call fcn.180042a14
and qword [rsp + 0x78], 0
and qword [rsp + 0x80], 0
and qword [rsp + 0x88], 0
mov rcx, qword [rsp + 0x60]
call fcn.180042a14
mov rax, rbp
add rsp, 0x98
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000e6b0
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x130
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x180080060]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov rdi, r8
mov rsi, rdx
xor ebp, ebp
cmp rdx, rbp
je 0x18000e991
mov rcx, r8
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, ebp
je 0x18000e991
lea edx, [rbp + 1]
lea rcx, [rsp + 0xb0]
call fcn.18001cfe8
nop
lea rcx, [rsp + 0xb8]
mov rax, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xd0]
cmp rdx, 0x10
cmovae rcx, rax
cmp rcx, rbp
je 0x18000e97f
xor edx, edx
call fcn.180036370
cmp eax, ebp
jne 0x18000e75b
mov rdx, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xb8]
jmp 0x18000e97f
lea r8, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 0x10
cmovae r8, qword [rsp + 0xb8]
mov r9d, 0x32e3
lea rdx, str.https:___s:_d_globalSmallFile
lea rcx, [rsp + 0x100]
call fcn.1800384e0
nop
and dword [rsp + 0x88], 0xfffffe00
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0xa0], rbp
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
lea rdx, str.hardwareinfo
lea rcx, [rsp + 0x58]
call fcn.180027c80
mov rbx, rax
lea rdx, str.type
lea rcx, [rsp + 0x80]
call fcn.180029294
mov rcx, rax
mov rdx, rbx
call fcn.180027fb4
lea r11, [rsp + 0x58]
mov qword [rsp + 0x50], r11
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.180027c80
mov rbx, rax
lea rdx, str.name
lea rcx, [rsp + 0x80]
call fcn.180029294
mov rcx, rax
mov rdx, rbx
call fcn.180027fb4
lea r11, [rsp + 0x58]
mov qword [rsp + 0x50], r11
mov byte [rsp + 0x60], 1
btr dword [rsp + 0x60], 8
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x58], rbp
lea rdx, str.clean
lea rcx, [rsp + 0x80]
call fcn.180029294
mov rcx, rax
lea rdx, [rsp + 0x58]
call fcn.180027fb4
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x80]
call fcn.180029850
nop
lea rax, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 0x10
cmovae rax, qword [rsp + 0xe0]
lea rcx, [rsp + 0x108]
cmp qword [rsp + 0x120], 0x10
cmovae rcx, qword [rsp + 0x108]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
lea r9, str.desc
mov r8, rdi
lea rdx, str.file
call fcn.18001abb4
cmp eax, ebp
setne bl
cmp qword [rsp + 0xf8], 0x10
jb 0x18000e908
mov rcx, qword [rsp + 0xe0]
call fcn.180042a14
mov edi, recvfrom
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xf0], rbp
mov byte [rsp + 0xe0], bpl
lea rcx, [rsp + 0x80]
call fcn.180027f1c
nop
cmp qword [rsp + 0x120], 0x10
jb 0x18000e94b
mov rcx, qword [rsp + 0x108]
call fcn.180042a14
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x118], rbp
mov byte [rsp + 0x108], bpl
cmp qword [rsp + 0xd0], 0x10
jb 0x18000e97b
mov rcx, qword [rsp + 0xb8]
call fcn.180042a14
mov al, bl
jmp 0x18000e993
cmp rdx, 0x10
jb 0x18000e98d
mov rcx, rax
call fcn.180042a14
xor al, al
jmp 0x18000e993
xor al, al
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.1800423f0
mov rbx, qword [rsp + 0x150]
add rsp, 0x130
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000e9b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
lea rax, [r11 + 0x10]
mov r8, rcx
lea r9, [r11 + 0x18]
mov qword [r11 - 0x10], rax
lea rax, [r11 + 0x20]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x48], 4
mov qword [r11 - 0x18], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor ecx, ecx
cmp eax, ecx
jne 0x18000ea03
cmp dword [rsp + 0x50], 4
mov eax, dword [rsp + 0x58]
je 0x18000ea05
mov eax, ecx
cmp eax, ecx
setne al
add rsp, 0x38
ret
Function at 0x18000f788
Capabilities:
Get disk information
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x180080060]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor ebx, ebx
mov esi, eax
bt esi, ebx
jae 0x18000f82c
lea eax, [rbx + 0x61]
lea rcx, [rsp + 0x30]
mov word [rsp + 0x30], ax
mov eax, 0x3a
mov word [rsp + 0x32], ax
mov eax, 0x5c
mov word [rsp + 0x34], ax
xor eax, eax
mov qword [rsp + 0x36], rax
mov qword [rsp + 0x3e], rax
mov qword [rsp + 0x46], rax
mov word [rsp + 0x4e], ax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x18000f82c
and dword [rsp + 0x20], 0
xor eax, eax
lea r9, [rsp + 0x28]
and dword [rsp + 0x28], eax
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
xor edx, edx
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x2c], eax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x18000f82c
add rdi, qword [rsp + 0x20]
inc ebx
cmp ebx, 0x1a
jl 0x18000f7b2
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800423f0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x1800151a0
Capabilities:
Find taskbar

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.Shell_TrayWnd
xor edi, edi
xor edx, edx
mov dword [rsp + 0x38], edi
call qword [sym.imp.USER32.dll_FindWindowW]
cmp rax, rdi
jne 0x1800151eb
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rdi
lea rdx, [0x1800656f8]
xor r8d, r8d
mov rcx, rbx
mov word [rbx + 8], di
call fcn.1800030e4
jmp 0x180015209
lea rdx, [rsp + 0x38]
mov rcx, rax
mov dword [rsp + 0x38], edi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [rsp + 0x38]
mov rcx, rbx
call fcn.1800160b0
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180016748
Capabilities:
Get session information
Get session user name

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x550
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, qword [0x180080060]
xor rax, rsp
mov qword [rsp + 0x540], rax
xor ebp, ebp
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x30], ebp
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor edx, edx
lea r8d, [rbp + 1]
xor ecx, ecx
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
cmp eax, ebp
je 0x180016912
mov edi, ebp
cmp dword [rsp + 0x30], ebp
jbe 0x180016903
mov rsi, rbp
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x48], ebp
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov r8d, 5
mov edx, dword [rsi + rbx]
xor ecx, ecx
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
mov byte [rsp + 0x80], bpl
xor edx, edx
lea r8d, [rdx + 0x47]
lea rcx, [rsp + 0x81]
call fcn.180044a90
xor edx, edx
mov r8d, 0x478
lea rcx, [rsp + 0xc8]
call fcn.180044a90
mov dword [rsp + 0x4c], ebp
mov ebx, dword [rsi + rbx]
mov rax, qword [0x18008b368]
cmp rax, rbp
jne 0x180016864
mov rax, qword [0x18008b360]
cmp rax, rbp
jne 0x18001684d
lea rcx, str.winsta.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x18008b360], rax
cmp rax, rbp
je 0x18001688f
lea rdx, str.WinStationQueryInformationW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18008b368], rax
cmp rax, rbp
je 0x18001688f
lea rcx, [rsp + 0x4c]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x4c0
lea r9, [rsp + 0x80]
mov r8d, 8
mov edx, ebx
xor ecx, ecx
call rax
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x58]
call fcn.18001600c
nop
mov rcx, qword [rsp + 0x38]
cmp rcx, rbp
je 0x1800168e1
cmp word [rcx], bp
je 0x1800168d6
cmp qword [rsp + 0xe8], rbp
je 0x1800168d6
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
call fcn.1800162d4
mov rcx, qword [rsp + 0x38]
cmp rcx, rbp
je 0x1800168e1
call sub.WTSAPI32.dll_WTSFreeMemory
nop
cmp qword [rsp + 0x78], 8
jb 0x1800168f3
mov rcx, qword [rsp + 0x60]
call fcn.180042a14
inc edi
add rsi, 0x18
cmp edi, dword [rsp + 0x30]
jb 0x1800167b8
mov rcx, qword [rsp + 0x40]
cmp rcx, rbp
je 0x180016912
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, 1
mov rcx, qword [rsp + 0x540]
xor rcx, rsp
call fcn.1800423f0
lea r11, [rsp + 0x550]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x18001ab14
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and dword [rsp + 0x58], 0
lea rax, [rsp + 0x58]
mov rdi, r8
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x18001ab60
mov edx, dword [rsp + 0x58]
lea rcx, str.thread__d_created:__s
mov r8, rdi
call fcn.18001a4b8
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18001d1d4
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
sub rsp, 0x60
cmp qword [rdx + 0x18], 0
mov rbx, rdx
je 0x18001d2b4
mov rbp, 0xffffffff80000002
lea r8, str.servAddr
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
lea r8, str.servHost
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
cmp qword [rbx + 0x20], 0x10
jb 0x18001d22e
mov rcx, qword [rbx + 8]
jmp 0x18001d232
lea rcx, [rbx + 8]
test rcx, rcx
je 0x18001d269
xor edx, edx
call fcn.180036370
test eax, eax
je 0x18001d269
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.18003bc28
cmp qword [rax + 0x20], 0x10
jb 0x18001d25c
mov r9, qword [rax + 8]
jmp 0x18001d260
lea r9, [rax + 8]
lea r8, str.servAddr
jmp 0x18001d28e
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.18003bc28
cmp qword [rax + 0x20], 0x10
jb 0x18001d283
mov r9, qword [rax + 8]
jmp 0x18001d287
lea r9, [rax + 8]
lea r8, str.servHost
and dword [rsp + 0x20], 0
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_
mov rcx, rbp
call fcn.180038640
cmp qword [rsp + 0x50], 0x10
jb 0x18001d2b4
mov rcx, qword [rsp + 0x38]
call fcn.180042a14
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x18001d2c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
lea rax, [r11 + 8]
lea r9, [r11 + 0x10]
lea r8, str.online
mov qword [r11 - 0x10], rax
lea rax, [r11 + 0x18]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], 4
mov qword [r11 - 0x18], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
xor ecx, ecx
cmp eax, ecx
jne 0x18001d30f
cmp dword [rsp + 0x48], 4
jne 0x18001d30f
mov ecx, dword [rsp + 0x50]
mov eax, ecx
add rsp, 0x38
ret

Function at 0x18001d318
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x180080060]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
xor edi, edi
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov dword [rsp + 0x20], edi
mov word [rsp + 0x30], di
call fcn.180044a90
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, str.Logsignored
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov qword [rbx + 0x18], rdi
or rcx, 0xffffffffffffffff
mov qword [rbx + 0x20], 7
mov word [rbx + 8], di
xor eax, eax
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x30]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.1800030e4
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1800423f0
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x18001d600
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x280
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rax, qword [0x180080060]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, r8
mov esi, edx
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov word [rsp + 0x60], bp
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x62]
call fcn.180044a90
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp esi, 1
jne 0x18001d67a
lea rdx, str.projonepodlp
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x18001d691
cmp esi, 2
jne 0x18001d6de
lea rdx, str.projonepotcm
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp rdi, rbp
je 0x18001d6a4
mov rdx, rdi
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rbp
mov word [rbx + 8], bp
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1800030e4
mov rax, rbx
jmp 0x18001d784
cmp esi, ebp
jne 0x18001d75f
xor r8d, r8d
lea edx, [r8 + 2]
lea rcx, [rsp + 0x30]
call fcn.18001d600
nop
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
cmp eax, ebp
je 0x18001d737
mov r8, rdi
mov edx, 2
mov rcx, rbx
call fcn.18001d600
nop
cmp qword [rsp + 0x50], 8
jb 0x18001d732
mov rcx, qword [rsp + 0x38]
call fcn.180042a14
mov rax, rbx
jmp 0x18001d784
mov r8, rdi
mov edx, 1
mov rcx, rbx
call fcn.18001d600
nop
cmp qword [rsp + 0x50], 8
jb 0x18001d75a
mov rcx, qword [rsp + 0x38]
call fcn.180042a14
mov rax, rbx
jmp 0x18001d784
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rbp
mov word [rbx + 8], bp
xor r8d, r8d
lea rdx, [0x1800656f8]
mov rcx, rbx
call fcn.1800030e4
mov rax, rbx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1800423f0
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001d7a8
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x180080060]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
xor edi, edi
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jle 0x18001d7fe
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rdi
xor r8d, r8d
mov word [rbx + 8], di
lea rdx, [0x1800656f8]
jmp 0x18001d8bb
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x40e
mov word [rsp + 0x30], di
call fcn.180044a90
xor r9d, r9d
lea rdx, [rsp + 0x30]
lea r8d, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [rsp + 0x30], di
je 0x18001d7df
lea rdx, str.projone
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
cmp eax, edi
je 0x18001d871
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18001d871
or eax, 6
lea rcx, [rsp + 0x30]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x30]
call fcn.1800355cc
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
mov qword [rbx + 0x18], rdi
lea rcx, [0x1800656f8]
cmp eax, edi
mov qword [rbx + 0x20], 7
mov word [rbx + 8], di
lea rdx, [rsp + 0x30]
cmove rdx, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.1800030e4
mov rax, rbx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1800423f0
mov rbx, qword [rsp + 0x468]
add rsp, 0x450
pop rdi
ret
Function at 0x18001d8e8
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x180080060]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor esi, esi
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x20], esi
cmp rdx, rsi
jne 0x18001d93c
mov qword [rcx + 0x20], 7
mov qword [rcx + 0x18], rsi
xor r8d, r8d
mov word [rcx + 8], si
lea rdx, [0x1800656f8]
jmp 0x18001da39
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jle 0x18001d96b
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rsi
xor r8d, r8d
mov word [rbx + 8], si
lea rdx, [0x1800656f8]
jmp 0x18001da36
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x40e
mov word [rsp + 0x30], si
call fcn.180044a90
xor r9d, r9d
lea rdx, [rsp + 0x30]
lea r8d, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [rsp + 0x30], si
je 0x18001d94c
lea rdx, str.projone
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
cmp eax, esi
je 0x18001d9ec
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18001d9ec
or eax, 6
lea rcx, [rsp + 0x30]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x30]
call fcn.1800354a4
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea rcx, [0x1800656f8]
mov qword [rbx + 0x20], 7
cmp eax, esi
mov qword [rbx + 0x18], rsi
lea rdx, [rsp + 0x30]
cmove rdx, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
mov word [rbx + 8], si
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.1800030e4
mov rax, rbx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1800423f0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret