joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003fac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180146748]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor r11d, r11d
mov dword [rsp], 0x4f0053
lea r10, [0x1801559e8]
mov dword [rsp + 4], 0x540046
lea r9, [rsp]
mov dword [rsp + 8], 0x410057
mov dword [rsp + 0xc], 0x450052
mov rcx, r10
lea r8d, [r11 + 0x14]
mov dword [rsp + 0x10], 0x4d005c
mov dword [rsp + 0x14], 0x520070
sub r9, r10
mov dword [rsp + 0x18], 0x730065
mov dword [rsp + 0x1c], 0x720065
mov dword [rsp + 0x20], 0x650076
mov word [rsp + 0x24], r11w
nop dword [rax + rax]
lea rax, [r8 + 0x7fffffea]
test rax, rax
je 0x18003fb63
movzx edx, word [r9 + rcx]
test dx, dx
je 0x18003fb63
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x18003fb40
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18008c720
add rsp, 0x38
ret

Function at 0x18003fb90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x28
mov rax, qword [0x180146748]
xor rax, rsp
mov qword [rsp + 0x18], rax
xor r11d, r11d
mov dword [rsp], 0x64006c
lea r10, [0x180155a18]
mov dword [rsp + 4], 0x5f0073
lea r9, [rsp]
mov dword [rsp + 8], 0x6e0075
mov dword [rsp + 0xc], 0x6f006c
mov rcx, r10
lea r8d, [r11 + 0xc]
mov dword [rsp + 0x10], 0x6b0063
mov word [rsp + 0x14], r11w
sub r9, r10
nop dword [rax + rax]
lea rax, [r8 + 0x7ffffff2]
test rax, rax
je 0x18003fc13
movzx edx, word [r9 + rcx]
test dx, dx
je 0x18003fc13
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x18003fbf0
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.18008c720
add rsp, 0x28
ret

Function at 0x18003fc40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180146748]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor r11d, r11d
mov dword [rsp], 0x4c005c
lea r10, [0x180155a38]
mov dword [rsp + 4], 0x67006f
mov edx, 0x67
mov dword [rsp + 8], 0x43005c
lea r9, [rsp]
mov dword [rsp + 0xc], 0x6d006f
mov dword [rsp + 0x10], 0x750070
mov rcx, r10
mov dword [rsp + 0x14], 0x650074
sub r9, r10
lea r8d, [rdx - 0x51]
mov dword [rsp + 0x18], 0x5a0072
mov dword [rsp + 0x1c], 0x320031
mov dword [rsp + 0x20], 0x6c002e
mov dword [rsp + 0x24], 0x67006f
mov word [rsp + 0x28], r11w
nop word [rax + rax]
lea rax, [r8 + 0x7fffffe8]
test rax, rax
je 0x18003fcf3
movzx edx, word [r9 + rcx]
test dx, dx
je 0x18003fcf3
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x18003fcd0
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18008c720
add rsp, 0x48
ret
Function at 0x180047e40
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x90
mov qword [rax - 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rax, qword [0x180146748]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor esi, esi
mov dword [rsp + 0x34], esi
call fcn.180027930
lea edx, [rsi + 1]
mov rcx, rax
call fcn.180074e20
call fcn.180027930
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.180070cf0
nop
lea rcx, [rsp + 0x30]
call fcn.18003f9e0
mov rdi, rax
movdqa xmm0, xmmword [0x1800f68b0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], si
mov dword [rsp + 0x34], 1
mov rbx, 0xffffffffffffffff
mov rcx, rbx
nop dword [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180047ed0
mov rdx, qword [rsp + 0x70]
add rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.18002e370
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.18001b0c0
nop dword [rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x180047f10
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.18001b0c0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call fcn.180068540
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x180047f83
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180047f7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180048038
call fcn.18008c16c
cmp dword [0x1801559b4], 0
jne 0x180047fcf
mov dword [0x1801559b4], 1
call fcn.180027a30
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x60]
call fcn.180041b40
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x180046290]
xor edx, edx
xor ecx, ecx
call fcn.1800bebdc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x18004800d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180048008
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180048032
call fcn.18008c16c
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18008c720
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.1800beee8
nop
call fcn.1800beee8
nop
int3
Function at 0x180050b20
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
lea r8, [0x18004f4f0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call fcn.1800bebdc
mov rcx, rax
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
Function at 0x180054bd0
Capabilities:
Accept command line arguments

Disassembly:
push rbp
push rdi
push r12
push r15
sub rsp, 0x98
mov rax, qword [0x180146748]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor r12d, r12d
xor r15b, r15b
mov dword [rsp + 0x50], r12d
mov edi, r12d
cmp qword [rcx + 0x18], 8
mov dword [rsp + 0x50], r12d
jb 0x180054c0d
mov rcx, qword [rcx]
mov qword [rsp + 0xc8], rbx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0x90], r14
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbp, rax
test rax, rax
je 0x180054d58
mov esi, 1
cmp dword [rsp + 0x50], esi
jle 0x180054d4f
lea r14, [rax + 8]
nop
mov rdx, qword [r14]
test rdx, rdx
je 0x180054ced
mov qword [rsp + 0x68], r12
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r12w
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], r12w
jne 0x180054c80
lea rcx, [rsp + 0x58]
call fcn.18001b240
xor eax, eax
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x30], r12
lea rdx, [rsp + 0x78]
or edi, 1
mov qword [rsp + 0x28], r12
cmp qword [rsp + 0x70], 8
lea r8d, [rax + 3]
mov dword [rsp + 0x78], eax
cmovae rcx, qword [rsp + 0x58]
xor r9d, r9d
mov word [rsp + 0x7c], ax
mov qword [rsp + 0x20], r12
call fcn.1800c5cdc
test eax, eax
jne 0x180054ced
cmp word [rsp + 0x78], r12w
je 0x180054ced
mov bl, 1
jmp 0x180054cef
xor bl, bl
test dil, 1
je 0x180054d36
mov rdx, qword [rsp + 0x70]
and edi, 0xfffffffe
cmp rdx, 8
jb 0x180054d36
mov rcx, qword [rsp + 0x58]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180054d31
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180054d92
call fcn.18008c16c
test bl, bl
jne 0x180054d4c
inc esi
add r14, 8
cmp esi, dword [rsp + 0x50]
jl 0x180054c50
jmp 0x180054d4f
mov r15b, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0x90]
movzx eax, r15b
mov rsi, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18008c720
add rsp, 0x98
pop r15
pop r12
pop rdi
pop rbp
ret
call fcn.1800beee8
int3
Function at 0x180057e90
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180057fb5
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r9d, [rbx + 1]
mov r8d, 0x80000000
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.180054da0
mov rbp, qword [rsp + 0x48]
test eax, eax
js 0x180057fa5
lea rdx, [rsp + 0x84]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [rsp + 0x80], eax
cmp eax, 0xffffffff
jne 0x180057f38
call fcn.180054a70
test eax, eax
js 0x180057fa5
mov edi, dword [rsp + 0x80]
mov rdx, qword [rsp + 0x80]
lea rax, [rdx - 1]
cmp rax, 0x4ffffe
ja 0x180057fa5
xor r8d, r8d
mov rcx, rsi
call fcn.180059a80
cmp qword [rsi + 0x18], 0x10
jb 0x180057f61
mov rsi, qword [rsi]
mov dword [rsp + 0x80], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x80]
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180057f91
call fcn.180054a70
mov ebx, eax
jmp 0x180057fa0
mov eax, 0x80070026
cmp dword [rsp + 0x80], edi
cmovne ebx, eax
not ebx
shr ebx, 0x1f
test rbp, rbp
je 0x180057fb3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
Function at 0x180058a30
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x880
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x180146748]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov rsi, r9
mov rax, r8
mov r10, rdx
mov rbx, rcx
mov qword [rsp + 0x58], rcx
xor ebp, ebp
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x40], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 7
mov word [rcx], bp
mov dword [rsp + 0x48], 1
test rdx, rdx
je 0x180058b58
test rax, rax
je 0x180058b58
test r9, r9
je 0x180058b58
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20219
xor r8d, r8d
mov rdx, rax
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180058b48
cmp qword [rsp + 0x40], rbp
je 0x180058b58
xor edx, edx
mov r8d, 0x802
lea rcx, [rsp + 0x60]
call fcn.1800bbd80
mov dword [rsp + 0x4c], 0x800
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov r9d, 0xffff
mov r8, rsi
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x180058b48
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x180058b30
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.18001b240
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180058b58
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.18008c720
add rsp, 0x880
pop rsi
pop rbp
pop rbx
ret
Function at 0x18005aca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180146748]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor r11d, r11d
mov dword [rsp], 0x6c005c
lea r10, [0x180156d90]
mov dword [rsp + 4], 0x640075
lea r9, [rsp]
mov dword [rsp + 8], 0x730061
mov dword [rsp + 0xc], 0x690068
mov rcx, r10
lea r8d, [r11 + 0x13]
mov dword [rsp + 0x10], 0x6c005f
mov dword [rsp + 0x14], 0x67006f
sub r9, r10
mov dword [rsp + 0x18], 0x2e006f
mov dword [rsp + 0x1c], 0x6e0070
mov dword [rsp + 0x20], 0x67
lea rax, [r8 + 0x7fffffeb]
test rax, rax
je 0x18005ad35
movzx edx, word [r9 + rcx]
test dx, dx
je 0x18005ad35
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x18005ad12
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18008c720
add rsp, 0x38
ret
Function at 0x180066a40
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov r13d, r9d
mov rbp, r8
mov rsi, rdx
mov rbx, rcx
lea rax, vtable.LogUtils::LogAppender.0
mov qword [rcx], rax
xor edi, edi
mov qword [rcx + 8], rdi
mov dword [rcx + 0x10], edi
mov byte [rcx + 0x14], 1
mov dword [rcx + 0x18], edi
call fcn.18000a3f0
mov rcx, rax
test rax, rax
je 0x180066c15
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx + 0x20], rax
call fcn.18000a3f0
mov rcx, rax
test rax, rax
je 0x180066c20
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx + 0x28], rax
call fcn.18000a3f0
mov rcx, rax
test rax, rax
je 0x180066c0a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx + 0x30], rax
mov r14, 0xffffffffffffffff
mov dword [rbx + 0x38], r14d
lea rcx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
mov qword [rbx + 0x68], rdi
mov qword [rbx + 0x70], rdi
mov qword [rbx + 0x78], rdi
mov dword [rbx + 0x18], r13d
test rsi, rsi
jne 0x180066b1c
mov eax, edi
jmp 0x180066b2a
mov rax, r14
nop
inc rax
cmp word [rsi + rax*2], 0
jne 0x180066b20
mov r8d, eax
mov rdx, rsi
lea rcx, [rbx + 0x20]
call fcn.18000b310
lea rdx, [rbx + 0x20]
lea rcx, [rbx + 0x28]
call fcn.1800091c0
test rbp, rbp
je 0x180066b5d
mov rax, r14
nop
inc rax
cmp word [rbp + rax*2], 0
jne 0x180066b50
mov edi, eax
mov r8d, edi
mov rdx, rbp
lea rcx, [rbx + 0x30]
call fcn.18000b310
lea r8, [rbx + 0x28]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180067690
nop
mov rdx, rax
lea rcx, [rbx + 0x28]
call fcn.1800091c0
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x180066ba9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r8, qword [rbx + 0x28]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 8], rax
test rax, rax
je 0x180066bea
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x180066bea
cmp dword [rbx + 0x18], 0
je 0x180066bdf
mov rcx, qword [rbx + 0x20]
call fcn.1800ccb08
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80004005
call fcn.180009990
nop
mov ecx, 0x80004005
call fcn.180009990
nop
mov ecx, 0x80004005
call fcn.180009990
int3
Function at 0x180068dd0
Capabilities:
Print debug messages

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x160
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x190], rbx
mov rax, qword [0x180146748]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x20], 0x180
lea r9d, [rbp + 0x40]
mov r8d, 0x8109
call fcn.1800cd544
mov esi, eax
test eax, eax
je 0x180068f8f
xor edx, edx
mov r8d, 0xe8
lea rcx, [rsp + 0x60]
call fcn.1800bbd80
lea edx, [rbp + 2]
lea r8d, [rbp + 1]
lea rcx, [rsp + 0x60]
call fcn.180007f60
nop
lea rdx, str.open
lea rcx, [rsp + 0x60]
call fcn.180007080
mov rcx, rax
mov rdx, rdi
call fcn.180007080
mov rcx, rax
lea rdx, str._error.__
call fcn.180007080
mov rcx, rax
mov edx, esi
call fcn.180014c70
mov rcx, rax
lea rdx, [0x180103470]
call fcn.180007080
nop
movdqa xmm0, xmmword [0x1800f68b0]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], bp
mov dword [rsp + 0x30], 2
mov rcx, qword [rsp + 0xd8]
test cl, 2
jne 0x180068eed
mov rax, qword [rsp + 0xa8]
mov r8, qword [rax]
test r8, r8
je 0x180068eed
mov rax, qword [rsp + 0x88]
mov rdx, qword [rax]
cmp r8, qword [rsp + 0xd0]
cmovb r8, qword [rsp + 0xd0]
sub r8, rdx
jmp 0x180068f21
test cl, 4
jne 0x180068f2f
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax]
test rcx, rcx
je 0x180068f2f
mov rax, qword [rsp + 0x80]
mov rdx, qword [rax]
mov rax, qword [rsp + 0xb8]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
lea rcx, [rsp + 0x38]
call fcn.18001b240
nop
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x180068f85
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180068f7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180068fcb
call fcn.18008c16c
nop
lea rcx, [rsp + 0x60]
call fcn.1800093c0
mov ecx, dword [rbx]
cmp ecx, 0xffffffff
je 0x180068fa3
xor edx, edx
lea r8d, [rdx + 2]
call fcn.1800cdaf0
jmp 0x180068fa8
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18008c720
mov rbx, qword [rsp + 0x190]
add rsp, 0x160
pop rdi
pop rsi
pop rbp
ret
call fcn.1800beee8
nop
int3
Function at 0x18006a340
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x290], rbx
mov rax, qword [0x180146748]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov ebp, r8d
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x38], rcx
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x40]
call fcn.1800bbd80
xor r9d, r9d
lea r8d, [r9 + 0x1a]
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.18000a3f0
mov rcx, rax
test rax, rax
je 0x18006a58f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov rdi, 0xffffffffffffffff
cmp rax, 0x10000
jae 0x18006a3ea
lea rax, [rsp + 0x40]
movzx edx, ax
lea rcx, [rsp + 0x28]
call fcn.18000af40
jmp 0x18006a40f
lea rcx, [rsp + 0x40]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x18006a3f2
mov r8d, eax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.18000b310
nop
xor r9d, r9d
mov r8, rbx
mov rbx, qword [rsp + 0x28]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.18006a5b0
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18006a441
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test ebp, ebp
je 0x18006a4e2
xor r8d, r8d
mov rdx, qword [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18006a4e2
call fcn.18000a3f0
mov rcx, rax
test rax, rax
je 0x18006a59a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea rdx, [0x1800f2fd8]
cmp rdx, 0x10000
jae 0x18006a4a3
movzx edx, dx
mov rcx, rsi
call fcn.18000af40
jmp 0x18006a4bc
mov rax, rdi
inc rax
cmp word [rdx + rax*2], 0
jne 0x18006a4a6
mov r8d, eax
mov rcx, rsi
call fcn.18000b310
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x18006a563
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
jmp 0x18006a563
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x18006a50a
cmp rax, qword [rbx - 0x18]
jne 0x18006a50a
lea rbp, [rbx - 0x18]
lock inc dword [rbx - 8]
jmp 0x18006a540
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rbp, rax
test rax, rax
je 0x18006a589
mov eax, dword [rbx - 0x10]
mov dword [rbp + 8], eax
mov eax, dword [rbx - 0x10]
inc eax
movsxd rdx, eax
add rdx, rdx
mov r8, rbx
lea rcx, [rbp + 0x18]
mov r9, rdx
call fcn.18000d2d0
lea rax, [rbp + 0x18]
mov qword [rsi], rax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x18006a563
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, rsi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18008c720
mov rbx, qword [rsp + 0x290]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
call fcn.18000b6a0
nop
mov ecx, 0x80004005
call fcn.180009990
nop
mov ecx, 0x80004005
call fcn.180009990
int3
Function at 0x18006a5b0
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov r14d, r9d
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
test rdx, rdx
je 0x18006a6ca
test r8, r8
je 0x18006a6ca
call fcn.18000a3f0
mov rcx, rax
test rax, rax
je 0x18006a747
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x105
or eax, ecx
jge 0x18006a636
mov edx, 0x105
lea rcx, [rsp + 0x58]
call fcn.18000b0d0
mov rbx, qword [rsp + 0x58]
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1800bf270
test eax, eax
js 0x18006a752
cmp eax, dword [rbx - 0xc]
jg 0x18006a752
mov dword [rbx - 0x10], eax
cdqe
xor ecx, ecx
mov word [rbx + rax*2], cx
test r14d, r14d
je 0x18006a6bb
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18006a6bb
lea rdx, [0x1800f2fd8]
mov rcx, rdi
call fcn.180007ec0
nop
lea rdx, [rbx - 0x18]
mov rax, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18006a726
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x18006a726
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.1800272b0
jmp 0x18006a69b
call fcn.18000a3f0
mov rcx, rax
test rax, rax
je 0x18006a73c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
lea rdx, [0x1800f2fd8]
cmp rdx, 0x10000
jae 0x18006a701
movzx edx, dx
mov rcx, rdi
call fcn.18000af40
jmp 0x18006a726
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x18006a710
mov r8d, eax
mov rcx, rdi
call fcn.18000b310
nop
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.180009990
int3
mov ecx, 0x80004005
call fcn.180009990
nop
mov ecx, 0x80070057
call fcn.180009990
int3
Function at 0x180074cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x880
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x180146748]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov rax, r9
mov r10, r8
mov rbx, rdx
mov qword [rsp + 0x58], rdx
mov rsi, qword [rsp + 0x8c0]
xor ebp, ebp
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x40], rbp
mov qword [rdx + 0x10], rbp
mov qword [rdx + 0x18], 7
mov word [rdx], bp
mov dword [rsp + 0x48], 1
test r8, r8
je 0x180074df8
test rax, rax
je 0x180074df8
test rsi, rsi
je 0x180074df8
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20219
xor r8d, r8d
mov rdx, rax
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180074de8
cmp qword [rsp + 0x40], rbp
je 0x180074df8
xor edx, edx
mov r8d, 0x802
lea rcx, [rsp + 0x60]
call fcn.1800bbd80
mov dword [rsp + 0x4c], 0x800
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov r9d, 0xffff
mov r8, rsi
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x180074de8
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x180074dd0
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.18001b240
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180074df8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.18008c720
add rsp, 0x880
pop rsi
pop rbp
pop rbx
ret