joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000b098
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea r8, str.clientstat.exe
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.180004244
nop
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18000b103
cmp qword [rsp + 0x48], 8
jb 0x18000b334
mov rcx, qword [rsp + 0x30]
call fcn.180048114
jmp 0x18000b334
xor r8d, r8d
lea rdx, str..orp
mov rdi, 0xffffffff80000000
mov rcx, rdi
call fcn.18003a40c
test al, al
jne 0x18000b15b
lea rcx, str.register_.orp_handler
call fcn.18001b8f4
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
mov r9d, 0x65
lea r8, str.offlineRule
lea rcx, str..orp
call fcn.18003a728
jmp 0x18000b1e9
xor r9d, r9d
lea r8, str.offlineRule_shellopencommand
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.180039fd0
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x18000b1d7
lea rcx, str.register_.orp_handler_due_to_path_not_matched
call fcn.18001b8f4
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
mov r9d, 0x65
lea r8, str.offlineRule
lea rcx, str..orp
call fcn.18003a728
nop
cmp qword [rsp + 0x70], 8
jb 0x18000b1e9
mov rcx, qword [rsp + 0x58]
call fcn.180048114
xor r8d, r8d
lea rdx, str..orp2
mov rcx, rdi
call fcn.18003a40c
test al, al
jne 0x18000b235
lea rcx, str.register_.orp2_handler
call fcn.18001b8f4
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
mov r9d, 0x65
lea r8, str.offlineRule
lea rcx, str..orp2
call fcn.18003a728
call fcn.18001f21c
test eax, eax
je 0x18000b322
xor r8d, r8d
lea rdx, str..oml
mov rcx, rdi
call fcn.18003a40c
test al, al
jne 0x18000b293
lea rcx, str.register_.oml_handler
call fcn.18001b8f4
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
mov r9d, 0x66
lea r8, str.offlineLicense
lea rcx, str..oml
call fcn.18003a728
jmp 0x18000b322
xor r9d, r9d
lea r8, str.offlineLicense_shellopencommand
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.180039fd0
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x18000b30f
lea rcx, str.register_.oml_handler_due_to_path_not_matched
call fcn.18001b8f4
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
mov r9d, 0x66
lea r8, str.offlineLicense
lea rcx, str..oml
call fcn.18003a728
nop
cmp qword [rsp + 0x70], 8
jb 0x18000b322
mov rcx, qword [rsp + 0x58]
call fcn.180048114
nop
cmp qword [rsp + 0x48], 8
jb 0x18000b334
mov rcx, qword [rsp + 0x30]
call fcn.180048114
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180047b20
add rsp, 0x80
pop rdi
ret
Function at 0x18000b47c
Capabilities:
Check if file exists
Delete file

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x540
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rax, str.aspda.exe
lea rcx, str.cstate.exe
lea r8, str.poda32.exe
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x70], rcx
lea rax, str.assistda.exe
lea rdx, str.pobus32.exe
lea rcx, str.pobus64.exe
mov qword [rsp + 0x28], rax
lea rax, str.asphost.exe
lea rbx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, str.assisthost.exe
mov edi, InitCommonControls
mov qword [rsp + 0x38], rax
lea rax, str.asphs.exe
xor esi, esi
mov qword [rsp + 0x40], rax
lea rax, str.assisths.exe
mov qword [rsp + 0x48], rax
lea rax, str.clientinfo.exe
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rax
lea rax, str.clientstat.exe
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rax
lea rax, str.poagent32.exe
mov qword [r11 - 0x4c8], rax
lea rax, str.poagent64.exe
mov qword [r11 - 0x4c0], r8
mov qword [r11 - 0x4b8], rax
lea rax, str.pohost32.exe
mov qword [r11 - 0x4b0], r8
mov qword [r11 - 0x4a8], rax
lea rax, str.pohost64.exe
mov qword [r11 - 0x4a0], rdx
mov qword [r11 - 0x498], rax
lea rax, str.rcserver.exe
mov qword [r11 - 0x490], rcx
mov qword [r11 - 0x488], rax
lea rax, str.assists.exe
mov qword [r11 - 0x478], rdx
mov qword [r11 - 0x480], rax
lea rax, str.gxbus32.exe
mov qword [r11 - 0x468], rcx
mov qword [r11 - 0x470], rax
lea rax, str.gxbus64.exe
mov qword [r11 - 0x458], r8
mov qword [r11 - 0x460], rax
lea rax, str.gxda32.exe
mov qword [r11 - 0x450], rax
lea rax, str.poda64.exe
mov qword [r11 - 0x448], rax
lea rax, str.gxda64.exe
mov qword [r11 - 0x440], rax
lea rcx, [rsp + 0x322]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x320], si
call fcn.18004a190
lea rcx, [rsp + 0x112]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x110], si
call fcn.18004a190
mov rdx, qword [rbx + 8]
cmp rdx, rsi
je 0x18000b660
lea r8, [rsp + 0x320]
mov r9d, 0x104
xor ecx, ecx
call fcn.180037814
mov rdx, qword [rbx]
cmp rdx, rsi
je 0x18000b67d
lea r8, [rsp + 0x110]
mov r9d, 0x104
xor ecx, ecx
call fcn.180037814
lea rcx, [rsp + 0x320]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, esi
je 0x18000b6c3
lea rcx, [rsp + 0x110]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, esi
je 0x18000b6c3
lea rdx, [rsp + 0x110]
lea rcx, str.delete_old_file:__s
call fcn.18001ba8c
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
add rbx, 0x10
sub rdi, 1
jne 0x18000b608
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.180047b20
lea r11, [rsp + 0x540]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x18000d5ec
Capabilities:
Get local ipv4 addresses

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x98
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbp, rcx
and dword [rax + 0x20], 0
mov ebx, 8
mov rcx, rbx
call fcn.180048210
test rax, rax
je 0x18000d625
mov qword [rax], rbp
jmp 0x18000d627
xor eax, eax
mov qword [rbp], rax
and qword [rbp + 0x18], 0
and qword [rbp + 0x20], 0
and qword [rbp + 0x28], 0
mov dword [rsp + 0xd8], 1
and dword [rsp + 0xd0], 0
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
xor ecx, ecx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov edi, dword [rsp + 0xd0]
mov rcx, rbx
call fcn.180048210
test rax, rax
je 0x18000d689
lea rcx, [rsp + 0x60]
mov qword [rax], rcx
jmp 0x18000d68b
xor eax, eax
mov qword [rsp + 0x60], rax
mov byte [rsp + 0xc8], 0
lea r8, [rsp + 0xc8]
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.18000de60
nop
mov rbx, qword [rsp + 0x78]
cmp rbx, qword [rsp + 0x80]
jbe 0x18000d6c2
call fcn.1800480bc
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x18000d6d5
call fcn.1800480bc
xor edx, edx
jmp 0x18000d6d8
mov rdx, qword [rax]
cmp rbx, qword [rdx + 0x20]
jb 0x18000d6e3
call fcn.1800480bc
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9, rbx
xor r8d, r8d
lea edx, [r8 + 0x10]
xor ecx, ecx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x18000d797
test rbx, rbx
je 0x18000d797
mov rsi, qword [rbx + 0x30]
test rsi, rsi
je 0x18000d78a
mov rax, qword [rsi + 0x10]
cmp word [rax], 2
jne 0x18000d781
mov ecx, dword [rax + 4]
call sub.WS2_32.dll_inet_ntoa
mov rdx, rax
mov qword [rsp + 0x58], sendto
and qword [rsp + 0x50], 0
mov byte [rsp + 0x40], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x38]
call fcn.180002ed4
nop
lea rdx, [rsp + 0x38]
mov rcx, rbp
call fcn.1800028e8
nop
cmp qword [rsp + 0x58], 0x10
jb 0x18000d781
mov rcx, qword [rsp + 0x40]
call fcn.180048114
mov rsi, qword [rsi + 8]
test rsi, rsi
jne 0x18000d71b
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x18000d712
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18000d7a6
call fcn.180048114
and qword [rsp + 0x78], 0
and qword [rsp + 0x80], 0
and qword [rsp + 0x88], 0
mov rcx, qword [rsp + 0x60]
call fcn.180048114
mov rax, rbp
add rsp, 0x98
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000fd14
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x130
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov rdi, r8
mov rsi, rdx
xor ebp, ebp
cmp rdx, rbp
je 0x18000fff5
mov rcx, r8
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, ebp
je 0x18000fff5
lea edx, [rbp + 1]
lea rcx, [rsp + 0xb0]
call fcn.18001e3c8
nop
lea rcx, [rsp + 0xb8]
mov rax, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xd0]
cmp rdx, 0x10
cmovae rcx, rax
cmp rcx, rbp
je 0x18000ffe3
xor edx, edx
call fcn.18003804c
cmp eax, ebp
jne 0x18000fdbf
mov rdx, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xb8]
jmp 0x18000ffe3
lea r8, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 0x10
cmovae r8, qword [rsp + 0xb8]
mov r9d, 0x32e3
lea rdx, str.https:___s:_d_globalSmallFile
lea rcx, [rsp + 0x100]
call fcn.180039de8
nop
and dword [rsp + 0x88], 0xfffffe00
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0xa0], rbp
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
lea rdx, str.hardwareinfo
lea rcx, [rsp + 0x58]
call fcn.180029008
mov rbx, rax
lea rdx, str.type
lea rcx, [rsp + 0x80]
call fcn.18002a61c
mov rcx, rax
mov rdx, rbx
call fcn.18002933c
lea r11, [rsp + 0x58]
mov qword [rsp + 0x50], r11
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.180029008
mov rbx, rax
lea rdx, str.name
lea rcx, [rsp + 0x80]
call fcn.18002a61c
mov rcx, rax
mov rdx, rbx
call fcn.18002933c
lea r11, [rsp + 0x58]
mov qword [rsp + 0x50], r11
mov byte [rsp + 0x60], 1
btr dword [rsp + 0x60], 8
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x58], rbp
lea rdx, str.clean
lea rcx, [rsp + 0x80]
call fcn.18002a61c
mov rcx, rax
lea rdx, [rsp + 0x58]
call fcn.18002933c
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x80]
call fcn.18002ac20
nop
lea rax, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 0x10
cmovae rax, qword [rsp + 0xe0]
lea rcx, [rsp + 0x108]
cmp qword [rsp + 0x120], 0x10
cmovae rcx, qword [rsp + 0x108]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
lea r9, str.desc
mov r8, rdi
lea rdx, str.file
call fcn.18001bff0
cmp eax, ebp
setne bl
cmp qword [rsp + 0xf8], 0x10
jb 0x18000ff6c
mov rcx, qword [rsp + 0xe0]
call fcn.180048114
mov edi, InitCommonControls
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xf0], rbp
mov byte [rsp + 0xe0], bpl
lea rcx, [rsp + 0x80]
call fcn.1800292a4
nop
cmp qword [rsp + 0x120], 0x10
jb 0x18000ffaf
mov rcx, qword [rsp + 0x108]
call fcn.180048114
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x118], rbp
mov byte [rsp + 0x108], bpl
cmp qword [rsp + 0xd0], 0x10
jb 0x18000ffdf
mov rcx, qword [rsp + 0xb8]
call fcn.180048114
mov al, bl
jmp 0x18000fff7
cmp rdx, 0x10
jb 0x18000fff1
mov rcx, rax
call fcn.180048114
xor al, al
jmp 0x18000fff7
xor al, al
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.180047b20
mov rbx, qword [rsp + 0x150]
add rsp, 0x130
pop rdi
pop rsi
pop rbp
ret
Function at 0x180010d94
Capabilities:
Get disk information
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor ebx, ebx
mov esi, eax
bt esi, ebx
jae 0x180010e38
lea eax, [rbx + 0x61]
lea rcx, [rsp + 0x30]
mov word [rsp + 0x30], ax
mov eax, 0x3a
mov word [rsp + 0x32], ax
mov eax, 0x5c
mov word [rsp + 0x34], ax
xor eax, eax
mov qword [rsp + 0x36], rax
mov qword [rsp + 0x3e], rax
mov qword [rsp + 0x46], rax
mov word [rsp + 0x4e], ax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x180010e38
and dword [rsp + 0x20], 0
xor eax, eax
lea r9, [rsp + 0x28]
and dword [rsp + 0x28], eax
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
xor edx, edx
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x2c], eax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x180010e38
add rdi, qword [rsp + 0x20]
inc ebx
cmp ebx, 0x1a
jl 0x180010dbe
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180047b20
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x1800166c4
Capabilities:
Find taskbar

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.Shell_TrayWnd
xor edi, edi
xor edx, edx
mov dword [rsp + 0x38], edi
call qword [sym.imp.USER32.dll_FindWindowW]
cmp rax, rdi
jne 0x18001670f
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rdi
lea rdx, [0x18006c858]
xor r8d, r8d
mov rcx, rbx
mov word [rbx + 8], di
call fcn.180003158
jmp 0x18001672d
lea rdx, [rsp + 0x38]
mov rcx, rax
mov dword [rsp + 0x38], edi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [rsp + 0x38]
mov rcx, rbx
call fcn.1800175d4
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180017c6c
Capabilities:
Get session information
Get session user name

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x550
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x540], rax
xor ebp, ebp
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x30], ebp
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor edx, edx
lea r8d, [rbp + 1]
xor ecx, ecx
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
cmp eax, ebp
je 0x180017e36
mov edi, ebp
cmp dword [rsp + 0x30], ebp
jbe 0x180017e27
mov rsi, rbp
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x48], ebp
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov r8d, 5
mov edx, dword [rsi + rbx]
xor ecx, ecx
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
mov byte [rsp + 0x80], bpl
xor edx, edx
lea r8d, [rdx + 0x47]
lea rcx, [rsp + 0x81]
call fcn.18004a190
xor edx, edx
mov r8d, 0x478
lea rcx, [rsp + 0xc8]
call fcn.18004a190
mov dword [rsp + 0x4c], ebp
mov ebx, dword [rsi + rbx]
mov rax, qword [0x180096000]
cmp rax, rbp
jne 0x180017d88
mov rax, qword [0x180095ff8]
cmp rax, rbp
jne 0x180017d71
lea rcx, str.winsta.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x180095ff8], rax
cmp rax, rbp
je 0x180017db3
lea rdx, str.WinStationQueryInformationW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180096000], rax
cmp rax, rbp
je 0x180017db3
lea rcx, [rsp + 0x4c]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x4c0
lea r9, [rsp + 0x80]
mov r8d, 8
mov edx, ebx
xor ecx, ecx
call rax
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x58]
call fcn.180017530
nop
mov rcx, qword [rsp + 0x38]
cmp rcx, rbp
je 0x180017e05
cmp word [rcx], bp
je 0x180017dfa
cmp qword [rsp + 0xe8], rbp
je 0x180017dfa
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
call fcn.1800177f8
mov rcx, qword [rsp + 0x38]
cmp rcx, rbp
je 0x180017e05
call sub.WTSAPI32.dll_WTSFreeMemory
nop
cmp qword [rsp + 0x78], 8
jb 0x180017e17
mov rcx, qword [rsp + 0x60]
call fcn.180048114
inc edi
add rsi, 0x18
cmp edi, dword [rsp + 0x30]
jb 0x180017cdc
mov rcx, qword [rsp + 0x40]
cmp rcx, rbp
je 0x180017e36
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, 1
mov rcx, qword [rsp + 0x540]
xor rcx, rsp
call fcn.180047b20
lea r11, [rsp + 0x550]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x18001bf50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and dword [rsp + 0x58], 0
lea rax, [rsp + 0x58]
mov rdi, r8
mov r8, rcx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x18001bf9c
mov edx, dword [rsp + 0x58]
lea rcx, str.thread__d_created:__s
mov r8, rdi
call fcn.18001b8f4
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18001e5b4
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
sub rsp, 0x60
cmp qword [rdx + 0x18], 0
mov rbx, rdx
je 0x18001e694
mov rbp, 0xffffffff80000002
lea r8, str.servAddr
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
lea r8, str.servHost
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
cmp qword [rbx + 0x20], 0x10
jb 0x18001e60e
mov rcx, qword [rbx + 8]
jmp 0x18001e612
lea rcx, [rbx + 8]
test rcx, rcx
je 0x18001e649
xor edx, edx
call fcn.18003804c
test eax, eax
je 0x18001e649
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.18003e554
cmp qword [rax + 0x20], 0x10
jb 0x18001e63c
mov r9, qword [rax + 8]
jmp 0x18001e640
lea r9, [rax + 8]
lea r8, str.servAddr
jmp 0x18001e66e
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.18003e554
cmp qword [rax + 0x20], 0x10
jb 0x18001e663
mov r9, qword [rax + 8]
jmp 0x18001e667
lea r9, [rax + 8]
lea r8, str.servHost
and dword [rsp + 0x20], 0
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_
mov rcx, rbp
call fcn.180039f48
cmp qword [rsp + 0x50], 0x10
jb 0x18001e694
mov rcx, qword [rsp + 0x38]
call fcn.180048114
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x18001e6a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
lea rax, [r11 + 8]
lea r9, [r11 + 0x10]
lea r8, str.online
mov qword [r11 - 0x10], rax
lea rax, [r11 + 0x18]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], 4
mov qword [r11 - 0x18], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
xor ecx, ecx
cmp eax, ecx
jne 0x18001e6ef
cmp dword [rsp + 0x48], 4
jne 0x18001e6ef
mov ecx, dword [rsp + 0x50]
mov eax, ecx
add rsp, 0x38
ret

Function at 0x18001e6f8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
xor edi, edi
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov dword [rsp + 0x20], edi
mov word [rsp + 0x30], di
call fcn.18004a190
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, str.Logsignored
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov qword [rbx + 0x18], rdi
or rcx, 0xffffffffffffffff
mov qword [rbx + 0x20], 7
mov word [rbx + 8], di
xor eax, eax
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x30]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.180003158
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180047b20
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x18001e974
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0x2a0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rdi, r8
mov esi, edx
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov word [rsp + 0x80], bp
xor edx, edx
mov r8d, 0x206
lea rcx, [r11 - 0x236]
call fcn.18004a190
mov edx, 0x104
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp esi, 1
jne 0x18001e9f9
lea rdx, str.projonepodlp
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x18001ea2f
cmp esi, 2
jne 0x18001ea15
lea rdx, str.projonepotcm
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x18001ea2f
cmp esi, 3
jne 0x18001ea85
lea rdx, str.gxsoftgxtcm
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp rdi, rbp
je 0x18001ea45
mov rdx, rdi
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rbp
mov word [rbx + 8], bp
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.180003158
mov rax, rbx
jmp 0x18001ebad
cmp esi, ebp
jne 0x18001eb88
xor r8d, r8d
lea edx, [r8 + 3]
lea rcx, [rsp + 0x58]
call fcn.18001e974
nop
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
cmp eax, ebp
je 0x18001eae5
mov r8, rdi
mov edx, 3
mov rcx, rbx
call fcn.18001e974
nop
cmp qword [rsp + 0x78], 8
jb 0x18001eadd
mov rcx, qword [rsp + 0x60]
call fcn.180048114
mov rax, rbx
jmp 0x18001ebad
xor r8d, r8d
lea esi, [r8 + 2]
mov edx, esi
lea rcx, [rsp + 0x30]
call fcn.18001e974
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.180002b3c
nop
cmp qword [rsp + 0x50], 8
jb 0x18001eb20
mov rcx, qword [rsp + 0x38]
call fcn.180048114
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
cmp eax, ebp
je 0x18001eb60
mov r8, rdi
mov edx, esi
mov rcx, rbx
call fcn.18001e974
nop
cmp qword [rsp + 0x78], 8
jb 0x18001eb5b
mov rcx, qword [rsp + 0x60]
call fcn.180048114
mov rax, rbx
jmp 0x18001ebad
mov r8, rdi
mov edx, 1
mov rcx, rbx
call fcn.18001e974
nop
cmp qword [rsp + 0x78], 8
jb 0x18001eb83
mov rcx, qword [rsp + 0x60]
call fcn.180048114
mov rax, rbx
jmp 0x18001ebad
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rbp
mov word [rbx + 8], bp
xor r8d, r8d
lea rdx, [0x18006c858]
mov rcx, rbx
call fcn.180003158
mov rax, rbx
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.180047b20
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x2a0
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001ebd0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
xor edi, edi
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jle 0x18001ec26
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rdi
xor r8d, r8d
mov word [rbx + 8], di
lea rdx, [0x18006c858]
jmp 0x18001ecd4
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x40e
mov word [rsp + 0x30], di
call fcn.18004a190
xor r9d, r9d
lea rdx, [rsp + 0x30]
lea r8d, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [rsp + 0x30], di
je 0x18001ec07
lea rdx, str.projone
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
cmp eax, edi
je 0x18001ec8a
xor r8d, r8d
lea rcx, [rsp + 0x30]
lea edx, [r8 + 6]
call fcn.1800377cc
lea rcx, [rsp + 0x30]
call fcn.180036f3c
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
mov qword [rbx + 0x18], rdi
lea rcx, [0x18006c858]
cmp eax, edi
mov qword [rbx + 0x20], 7
mov word [rbx + 8], di
lea rdx, [rsp + 0x30]
cmove rdx, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.180003158
mov rax, rbx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180047b20
mov rbx, qword [rsp + 0x468]
add rsp, 0x450
pop rdi
ret