joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180004a84
Capabilities:
Delete file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
xor edx, edx
xor ecx, ecx
call fcn.180018fb8
xor esi, esi
lea r8, [rsp + 0x68]
lea ecx, [rsi + 1]
cmp eax, 0x57
lea rdx, [0x18003d2c5]
cmove esi, ecx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x180004ba0
mov r8, qword [0x180039fc0]
mov rcx, qword [rsp + 0x68]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.18001905c
test eax, eax
jne 0x180004b95
mov rdi, qword [rsp + 0x70]
mov rcx, rdi
call fcn.180001a70
mov rbx, rax
test rax, rax
je 0x180004b63
mov rcx, rax
test esi, esi
jne 0x180004b4b
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x180004b42
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180004b51
mov qword [0x180039b68], rax
jmp 0x180004b51
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [0x180039b48]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x180004b8e
mov rcx, qword [0x180039b48]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [0x180039fc0]
mov rcx, qword [rsp + 0x68]
xor edx, edx
call fcn.18001924c
jmp 0x180004b95
mov qword [0x18003a0c0], rdi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180004e24
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
and dword [rax + 0x20], 0
mov r12, rcx
mov rcx, qword [0x180039c80]
mov rsi, r8
mov rbp, rdx
lea r8, [rax - 0x28]
xor edx, edx
call fcn.180004d90
mov ebx, eax
test eax, eax
jne 0x180004ef1
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x28], rsi
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
test eax, eax
jne 0x180004ee6
mov r8d, dword [rsi]
mov rcx, qword [0x180039b48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x180004ee1
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
test eax, eax
jne 0x180004ecd
mov qword [rbp], rdi
jmp 0x180004ee6
mov rcx, qword [0x180039b48]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180004ee6
mov ebx, 8
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x180004f08
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
mov rsi, rcx
mov rcx, qword [0x180039c80]
mov r12d, r8d
mov rdi, rdx
lea r8, [rax - 0x18]
mov edx, 1
mov ebp, r9d
call fcn.180004d90
mov ebx, eax
test eax, eax
jne 0x180004f80
mov rcx, qword [rsp + 0x30]
mov rdx, rsi
test rdi, rdi
je 0x180004f6d
mov r9d, ebp
xor r8d, r8d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x180004f73
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop r12
ret

Function at 0x18000511c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rdi
push r13
sub rsp, 0x30
mov rcx, qword [0x180039c80]
mov ebx, dword [0x180038640]
lea r8, [rsp + 0x60]
mov edx, 1
mov dword [rsp + 0x50], 0x28
call fcn.180004d90
lea r13, [0x180038640]
mov edi, eax
test eax, eax
jne 0x1800051f9
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rdx, [0x18003d1c3]
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x50], 0x28
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test eax, eax
jne 0x180005198
cmp dword [rsp + 0x50], 0x28
je 0x1800051a4
lea rcx, [0x180038648]
call fcn.18001b20c
movzx eax, word [0x180038644]
mov ecx, 0x8000
test cx, ax
jne 0x1800051ee
mov ecx, 0x801c
lea rdx, [0x18003d1c3]
mov r9d, 3
or ax, cx
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x28], 0x28
mov qword [rsp + 0x20], r13
mov word [0x180038644], ax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x180038640], 0
jne 0x180005238
mov dword [0x180038640], ebx
test ebx, ebx
je 0x18000522e
mov r9d, 3
lea rcx, [0x18003d1c3]
mov rdx, r13
lea r8d, [r9 + 0x25]
call fcn.180004f08
cmp dword [0x180038640], 0
jne 0x180005238
mov dword [0x180038640], 0x3e8
cmp qword [0x180039dd0], 0
jne 0x1800052a0
mov rcx, qword [0x180039b48]
xor edx, edx
lea r8d, [rdx + 0x27]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x180005299
mov edx, dword [0x180038654]
mov ecx, dword [0x180038650]
mov r9d, dword [0x18003864c]
mov r8d, dword [0x180038648]
bswap edx
bswap ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], ecx
lea rdx, [0x18003d3e9]
bswap r9d
bswap r8d
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov qword [0x180039dd0], rbx
mov eax, edi
add rsp, 0x30
pop r13
pop rdi
pop rbx
ret
Function at 0x1800052ac
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
movzx edi, r8w
mov eax, ecx
mov ebx, 0x57
test ecx, ecx
jne 0x1800052d2
mov rcx, rdx
call qword [sym.imp.SHLWAPI.dll_StrToIntA]
test eax, eax
je 0x180005335
mov rcx, qword [0x180039c80]
lea r8, [rsp + 0x30]
mov edx, 1
mov dword [0x180038640], eax
mov word [0x180038644], di
call fcn.180004d90
mov ebx, eax
test eax, eax
jne 0x180005335
mov rcx, qword [rsp + 0x30]
lea rax, [0x180038640]
lea r9d, [rbx + 3]
lea rdx, [0x18003d1c3]
xor r8d, r8d
mov dword [rsp + 0x28], 0x28
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180005344
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x80
mov r14, r8
lea r8, [rax + 0x20]
mov r13d, edx
mov r12, rcx
xor edi, edi
call fcn.18001a958
mov edx, eax
cmp eax, edi
je 0x180005504
cmp eax, 8
jbe 0x1800054eb
mov rbp, qword [rsp + 0xc8]
add edx, 0xfffffff8
mov ebx, dword [rdx + rbp + 4]
lea rcx, [rbp + 4]
call fcn.18002b31c
not eax
cmp ebx, eax
jne 0x1800054eb
mov rax, qword [rsp + 0xc8]
mov rcx, qword [0x180039b48]
xor edx, edx
mov ebx, dword [rax]
lea r8d, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
cmp rax, rdi
je 0x1800054eb
lea rcx, [rbp + 4]
mov rdx, rax
call fcn.1800202ac
cmp eax, ebx
jne 0x1800054d9
lea rdx, [0x18003e164]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp eax, edi
jne 0x18000540b
mov edx, r13d
mov rcx, r12
call fcn.18002b31c
not eax
mov dword [0x180039b74], eax
lea rcx, [0x18003a080]
mov r9d, ebx
mov r8, rsi
mov rdx, r14
call fcn.1800076c4
mov rcx, qword [0x180039c98]
mov ebp, 1
lea r8, [rsp + 0x30]
mov edx, ebp
call fcn.180004d90
cmp eax, edi
jne 0x18000546b
mov rcx, qword [rsp + 0x30]
lea r9d, [rbp + 2]
xor r8d, r8d
mov rdx, r14
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
cmp eax, edi
cmove edi, ebp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov r8d, 6
lea rax, [rbx + 4]
mov ebx, dword [rbx]
mov dword [rcx], ebx
mov qword [rdx], rax
add rbx, rax
add rcx, 4
add rdx, 8
sub r8, rbp
jne 0x18000547e
cmp dword [rsp + 0x38], ebp
jb 0x1800054d9
mov edx, dword [rsp + 0x3c]
cmp edx, ebp
jbe 0x18000546e
mov rcx, qword [rsp + 0x58]
dec edx
call fcn.18002b31c
xor eax, dword [0x180039d14]
cmp eax, 0x369d482b
jne 0x18000546e
mov r8d, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x50]
xor r9d, r9d
mov ecx, 0x102
call fcn.18000fc1c
jmp 0x18000546e
mov rcx, qword [0x180039b48]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0xc8]
mov rcx, qword [0x180039b48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18000551b
mov rcx, qword [0x180039fb0]
lea rdx, [0x180038646]
add rcx, 8
call fcn.18001a2c8
lea r11, [rsp + 0x80]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18000553c
Capabilities:
Delete file
Initialize winsock library

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x1d0
mov ecx, 0xf00
xor ebx, ebx
call fcn.180016088
mov rdi, rax
test rax, rax
je 0x180005675
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rdx, rdi
lea ecx, [rax - 1]
mov dword [rsp + 0x1f0], eax
mov byte [rcx + rdi], bl
mov esi, ecx
lea rcx, [0x18003d93f]
call fcn.180009cfc
test eax, eax
jne 0x180005663
lea r8, [rsp + 0x1f0]
lea rdx, [rsp + 0x200]
mov rcx, rdi
mov byte [rsi + rdi], 0x31
call fcn.1800157c0
test eax, eax
jne 0x18000565a
mov edx, dword [rsp + 0x1f0]
mov rcx, qword [rsp + 0x200]
lea r9, [rsp + 0x1f8]
lea r8, [0x18003ddf9]
call fcn.180019b4c
test rax, rax
je 0x180005643
mov edx, dword [rsp + 0x1f0]
mov rsi, rax
sub eax, dword [rsp + 0x200]
add eax, dword [rsp + 0x1f8]
lea r9, [rsp + 0x1f8]
lea r8, [0x18003ddf9]
mov ecx, eax
sub edx, eax
add rcx, qword [rsp + 0x200]
call fcn.180019b4c
test rax, rax
jne 0x1800055da
test rsi, rsi
je 0x180005643
mov eax, dword [rsp + 0x1f8]
lea rdx, str._s:_r
mov rcx, rsi
mov byte [rax + rsi], bl
call qword [sym.imp.SHLWAPI.dll_StrTrimA]
xor edx, edx
mov rcx, rsi
call fcn.18001855c
mov rbx, rax
mov r8, qword [rsp + 0x200]
mov rcx, qword [0x180039b48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [0x180039b48]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x1f8], rbx
test rbx, rbx
je 0x18000574f
lea rdx, [rsp + 0x30]
mov ecx, 0x201
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1800056ac
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov rcx, rbx
call fcn.180018ca4
jmp 0x1800056ae
xor eax, eax
test eax, eax
je 0x18000572e
mov ecx, dword [rsp + 0x24]
test ecx, ecx
je 0x18000572e
cmp ecx, 0x8080808
je 0x18000572e
cmp ecx, 0xdede43d0
je 0x18000572e
movzx edx, cl
cmp edx, 0xa
je 0x18000572e
movzx r8d, cx
cmp r8d, 0xa8c0
je 0x18000572e
mov eax, ecx
and eax, 0xfff
cmp eax, 0x10ac
je 0x18000572e
cmp edx, 0x7f
je 0x18000572e
test cl, cl
je 0x18000572e
cmp r8d, 0xfea9
je 0x18000572e
mov eax, ecx
and eax, 0x7fff
cmp eax, 0x12c6
je 0x18000572e
and ecx, 0x3ff
cmp ecx, 0x4064
je 0x18000572e
mov edx, 0x3a
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrChrA]
test rax, rax
je 0x18000574a
mov rcx, qword [0x180039b48]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
mov qword [rsp + 0x1f8], rbx
test rbx, rbx
jne 0x1800057b6
mov rcx, qword [0x180039120]
test rcx, rcx
je 0x1800057b6
lea r8, [rsp + 0x1f0]
lea rdx, [rsp + 0x1f8]
xor r9d, r9d
call fcn.180004c74
mov rbx, qword [rsp + 0x1f8]
test eax, eax
jne 0x1800057b6
lea rdx, str.__t_r_n
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrTrimA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 7
jb 0x1800057a2
cmp eax, 0xf
jbe 0x1800057b6
mov rcx, qword [0x180039b48]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
mov rax, rbx
add rsp, 0x1d0
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800059f4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor r15d, r15d
mov r13, r8
mov r14, rdx
lea r8, [rax - 0x38]
xor edx, edx
mov r12d, r9d
mov dword [rax - 0x44], r15d
mov dword [rax - 0x48], r15d
mov dword [rax - 0x40], r15d
call fcn.180004d90
mov ebx, eax
cmp eax, r15d
jne 0x180005bc3
mov rcx, qword [0x180039b48]
mov edi, 0x105
xor edx, edx
mov r8, rdi
lea ebx, [r15 + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
cmp rax, r15
je 0x180005bb8
mov rcx, qword [0x180039b48]
mov r8, rdi
xor edx, edx
mov ebp, edi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
cmp rax, r15
je 0x180005ba6
mov edx, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
mov r8, rsi
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x48], 0x105
mov dword [rsp + 0x40], ebp
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ebx, eax
cmp eax, 0xea
jne 0x180005b26
cmp dword [rsp + 0x48], 0x105
jbe 0x180005ae5
inc dword [rsp + 0x44]
mov ebx, r15d
jmp 0x180005b6f
cmp dword [rsp + 0x40], ebp
jbe 0x180005b94
mov rcx, qword [0x180039b48]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebp, dword [rsp + 0x40]
mov rcx, qword [0x180039b48]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
cmp rax, r15
jne 0x180005add
mov ebx, 8
jmp 0x180005b94
cmp eax, r15d
jne 0x180005b8a
cmp r12d, r15d
je 0x180005b46
mov r8d, dword [0x180039d10]
mov edx, dword [rsp + 0x40]
xor r9d, r9d
mov rcx, rdi
call fcn.18002b25c
mov r9d, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
mov r8, rdi
mov rdx, rsi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call r14
mov ebx, eax
cmp eax, r15d
jne 0x180005b8a
mov rcx, qword [0x180039d08]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x180005b94
jmp 0x180005a85
cmp ebx, 0x103
cmove ebx, r15d
mov rcx, qword [0x180039b48]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x180039b48]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800067d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x180039bd0]
mov edx, 1
mov r8d, edx
call fcn.180016038
mov rcx, qword [0x180039c90]
lea rdx, [0x180006774]
mov r9d, 1
xor r8d, r8d
add rsp, 0x28
jmp fcn.1800059f4

Function at 0x180006b70
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x28
test byte [0x180038644], 4
je 0x180006b8f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x121
call fcn.18000fc1c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x120
call fcn.18000fc1c
mov rcx, qword [0x180039d08]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x180039c90]
lea rdx, [0x180006590]
mov r9d, 1
xor r8d, r8d
add rsp, 0x28
jmp fcn.1800059f4
Function at 0x1800080cc
Capabilities:
Access pe header
Allocate or change rwx memory
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x40
xor ebx, ebx
mov r15, rdx
mov rsi, rcx
mov rdi, rbx
mov qword [rsp + 0x28], rbx
mov bpl, bl
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r13, rax
cmp rax, rbx
jne 0x18000810b
lea ebx, [rdi + 0xb]
jmp 0x1800082ba
lea rdx, [rsp + 0x20]
mov r8d, 1
mov rcx, rsi
call fcn.180017e94
cmp eax, ebx
jne 0x1800081c5
mov rcx, qword [rsp + 0x20]
xor edx, edx
mov ebp, ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [rsp + 0x80], eax
cmp eax, ebx
je 0x1800081ae
mov rcx, qword [0x180039b48]
mov r8d, eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
cmp rax, rbx
je 0x1800081ae
mov r8d, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x20]
mov r9, rax
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoW
cmp eax, ebx
je 0x18000819c
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x30]
lea rdx, [0x180031770]
mov rcx, r12
call sub.VERSION.dll_VerQueryValueA
cmp eax, ebx
je 0x18000819c
mov rax, qword [rsp + 0x30]
mov ebp, dword [rax + 8]
mov rcx, qword [0x180039b48]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x20]
mov rcx, qword [0x180039b48]
xor edx, edx
shr ebp, 0x10
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r8, [0x180039100]
mov rax, rbx
mov ecx, ebx
mov rdx, r8
cmp bpl, byte [rdx]
jb 0x1800081e2
mov eax, ecx
lea rax, [rax + rax*4]
add rax, r8
inc ecx
add rdx, 5
cmp ecx, 5
jb 0x1800081d4
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x80]
mov rcx, r15
mov qword [0x180039b40], rax
call fcn.180004e24
cmp eax, ebx
jne 0x18000825c
cmp dword [rsp + 0x88], 0x10
jne 0x18000825c
mov r8, qword [rsp + 0x80]
mov eax, dword [r13 + 0x58]
cmp dword [r8], eax
jne 0x180008248
cmp qword [r8 + 8], rbx
je 0x180008248
mov eax, dword [r13 + 0x50]
cmp qword [r8 + 8], rax
jae 0x180008248
mov rax, qword [r8 + 8]
lea rdi, [rsi + rax]
mov qword [rsp + 0x28], rdi
mov rcx, qword [0x180039b48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp rdi, rbx
jne 0x1800082ad
xor ecx, ecx
mov edx, 0x1000000
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x180039c08], rax
cmp rax, rbx
je 0x1800082ba
mov eax, dword [r13 + 0x58]
lea rdx, [rsp + 0x28]
mov rcx, rsi
mov qword [0x180039b38], r15
mov qword [0x180039b30], rsi
mov dword [0x180039b28], eax
call fcn.180007f04
cmp eax, ebx
jne 0x1800082ba
mov rdi, qword [rsp + 0x28]
mov rdx, rdi
mov rcx, rsi
call fcn.180007c44
mov ebx, eax
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1800082d4
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, [0x18003d065]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x180008319
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x18003877c], eax
cmp eax, 0xffffffff
je 0x180008311
lea rdx, [0x18003d1eb]
mov rcx, rbx
call fcn.1800080cc
jmp 0x180008334
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180008334
mov edx, 1
lea r8, [0x180038e10]
lea rcx, [0x180038df8]
mov r9d, edx
call fcn.18000ee9c
add rsp, 0x20
pop rbx
ret

Function at 0x18000976c
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov rsi, rdx
mov rbx, rcx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r8d, [rdi + 3]
mov qword [rsp + 0x30], rdi
lea r9, [0x180039d38]
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x180009868
lea r9d, [rdi + 1]
lea rdx, [0x18003d458]
lea rcx, [rsp + 0x70]
xor r8d, r8d
call fcn.180017358
mov rbx, rax
cmp rax, rdi
je 0x180009858
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
lea r8d, [rdi + 2]
lea rdx, [0x180039d38]
xor r9d, r9d
mov rcx, rbp
mov qword [rsp + 0x28], rbx
mov r12d, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp rax, rdi
je 0x18000983c
mov rcx, rbx
mov dword [rsi + 0x10], edi
mov qword [rsi], rax
mov dword [rsi + 8], r12d
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsi + 0x14]
mov rdx, rbx
mov dword [rsi + 0xc], eax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x180009844
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x180039b48]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18000985d
mov edi, 8
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180009870
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov eax, edi
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x180009888
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0xf0
xor edi, edi
mov r12, rcx
lea rcx, [rax - 0x80]
and dword [rax + 0x18], edi
lea r8d, [rdi + 0x60]
xor edx, edx
call sub.ntdll.dll_memset
and qword [rsp + 0x50], rdi
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x80], 0x68
xor ebx, ebx
call fcn.180015634
mov rsi, rax
test rax, rax
je 0x18000993b
mov edx, 0x104
mov rcx, rax
call fcn.1800185e0
mov rbp, rax
test rax, rax
je 0x180009922
mov rcx, rax
call qword [sym.imp.SHELL32.dll_PathGetShortPath]
mov rcx, rbp
mov rbx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, rbp
mov rcx, rsi
inc eax
movsxd r8, eax
call qword [sym.imp.ntdll.dll_wcstombs]
mov r8, rbp
jmp 0x180009925
mov r8, rsi
mov rcx, qword [0x180039b48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
cmovne rdi, rbx
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov rdx, r12
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
and qword [rsp + 0x30], 0
xor ecx, ecx
mov dword [rsp + 0x28], 0xc000000
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1800099ee
mov rax, qword [0x180039d08]
xor r8d, r8d
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x50]
lea ecx, [r8 + 2]
or r9d, 0xffffffff
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x120], eax
test eax, eax
jne 0x1800099c3
mov dword [rsp + 0x120], 0x102
jmp 0x1800099d6
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800099fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x120], eax
test rbx, rbx
je 0x180009a12
mov rcx, qword [0x180039b48]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [rsp + 0x120]
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret

Function at 0x18000a038
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rbp, rcx
mov ecx, 0x929
mov esi, r9d
mov r12d, r8d
mov r13, rdx
mov edi, 0x3ee
call fcn.180016088
mov rbx, rax
test rax, rax
je 0x18000a0b8
mov r9d, 1
mov r8d, r12d
mov rdx, r13
mov rcx, rax
call fcn.180015980
mov edi, eax
test eax, eax
jne 0x18000a09d
mov r8d, esi
mov rdx, rbx
mov rcx, rbp
call fcn.180009be0
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [0x180039b48]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x20
pop r13
pop r12
pop rdi
ret