joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180040490
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x180040638
push rbp
push rsi
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0xf0], rbx
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbp, rdx
mov rbx, rcx
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
mov rdx, rdi
call fcn.180085744
cmp dword [0x18010b2b8], 0
je 0x180040616
mov qword [rsp + 0x50], 7
xor esi, esi
mov qword [rsp + 0x48], rsi
mov word [rsp + 0x38], si
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.18000f510
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x88]
call fcn.180012880
nop
cmp qword [rsp + 0x50], 8
jb 0x18004054d
mov rcx, qword [rsp + 0x38]
call fcn.18009a864
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rsi
mov word [rsp + 0x38], si
mov r9, rbp
mov r8, rbx
lea rdx, str.record_as_ff_base:__s__s
lea rcx, str.athenwDbg
call fcn.18005c640
lea rcx, [rsp + 0x60]
call fcn.180012790
lea rdi, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae rdi, qword [rsp + 0x90]
cmp qword [rax + 0x20], 8
jb 0x1800405aa
mov rbx, qword [rax + 8]
jmp 0x1800405ae
lea rbx, [rax + 8]
test rdi, rdi
je 0x1800405be
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea eax, [rsi + rsi + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
mov r8, rbx
lea rdx, str.Softwareprojonepodlp_focusfile_baseFiles_
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp qword [rsp + 0x80], 8
jb 0x1800405fe
mov rcx, qword [rsp + 0x68]
call fcn.18009a864
nop
cmp qword [rsp + 0xa8], 8
jb 0x180040616
mov rcx, qword [rsp + 0x90]
call fcn.18009a864
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180099fe0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
repz ret
Function at 0x180040499
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x180040638
push rbp
push rsi
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0xf0], rbx
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbp, rdx
mov rbx, rcx
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
mov rdx, rdi
call fcn.180085744
cmp dword [0x18010b2b8], 0
je 0x180040616
mov qword [rsp + 0x50], 7
xor esi, esi
mov qword [rsp + 0x48], rsi
mov word [rsp + 0x38], si
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.18000f510
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x88]
call fcn.180012880
nop
cmp qword [rsp + 0x50], 8
jb 0x18004054d
mov rcx, qword [rsp + 0x38]
call fcn.18009a864
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rsi
mov word [rsp + 0x38], si
mov r9, rbp
mov r8, rbx
lea rdx, str.record_as_ff_base:__s__s
lea rcx, str.athenwDbg
call fcn.18005c640
lea rcx, [rsp + 0x60]
call fcn.180012790
lea rdi, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae rdi, qword [rsp + 0x90]
cmp qword [rax + 0x20], 8
jb 0x1800405aa
mov rbx, qword [rax + 8]
jmp 0x1800405ae
lea rbx, [rax + 8]
test rdi, rdi
je 0x1800405be
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea eax, [rsi + rsi + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
mov r8, rbx
lea rdx, str.Softwareprojonepodlp_focusfile_baseFiles_
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp qword [rsp + 0x80], 8
jb 0x1800405fe
mov rcx, qword [rsp + 0x68]
call fcn.18009a864
nop
cmp qword [rsp + 0xa8], 8
jb 0x180040616
mov rcx, qword [rsp + 0x90]
call fcn.18009a864
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180099fe0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
repz ret

Function at 0x180040640
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
cmp dword [0x180108f58], 0
lea rax, [0x1800d1e90]
lea r8, [0x180108f60]
cmovne r8, rax
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.Softwareprojonepodlp_focusfile_states_
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1800406a6
cmp dword [rsp + 0x48], 4
jne 0x1800406a6
mov eax, dword [rsp + 0x50]
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret
Function at 0x1800406b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x50]
lea r8, str.wpsOpenSave
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.Softwareprojonepodlp_focusfile_states_
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18004071c
cmp dword [rsp + 0x50], 4
jne 0x18004071c
cmp dword [rsp + 0x40], eax
je 0x18004071c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsp + 0x40]
cmp eax, 0x1388
jae 0x18004071c
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret
Function at 0x180042e20
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rdi, rdx
mov rsi, rcx
xor ebp, ebp
mov dword [rax + 0x18], ebp
lea rdx, str.FileDialogEvents.OnFileOk
lea rcx, str.athenwDbg
call fcn.18005c640
mov ebx, ebp
cmp dword [0x180108d38], ebx
jne 0x180042ec7
cmp dword [0x180108d2c], ebx
jne 0x180042ec7
mov dword [rsp + 0xa0], 4
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa8]
lea r8, [0x1800cee58]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x180042ec0
cmp dword [rsp + 0xa8], 4
jne 0x180042ec0
cmp dword [rsp + 0x30], ebx
jne 0x180042ec7
xor eax, eax
jmp 0x180043066
mov qword [rsp + 0x38], rbp
mov rax, qword [rdi]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call qword [rax + 0x70]
test eax, eax
js 0x180043064
mov qword [rsp + 0xa8], rbp
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
lea r8, [rsp + 0xa8]
mov edx, 0x80058000
call qword [rax + 0x28]
test eax, eax
js 0x180043059
lea r9, [0x180108f60]
mov r8, qword [rsp + 0xa8]
lea rdx, str.GetDisplayName__s__s
lea rcx, str.athenwDbg
call fcn.18005c640
cmp dword [0x180108d2c], ebx
je 0x180042f73
test byte [rsi + 0x808], 1
je 0x180042f73
mov rcx, qword [rsp + 0xa8]
call fcn.180043300
test eax, eax
je 0x180042f73
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov r9d, sendto
lea r8, [0x1800d200c]
lea rdx, [rsi + 8]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, 1
cmp dword [0x180108d38], ebp
je 0x180042fbd
test byte [rsi + 0x808], 2
je 0x180042fbd
test ebx, ebx
js 0x180042fbd
cmp dword [0x180108d44], ebp
jne 0x180042fbd
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x180042fbd
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xa8]
lea ecx, [rax + 1]
call fcn.18002ac00
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbp
mov word [rsp + 0x50], bp
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x180108f60]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x180108f60]
lea rcx, [rsp + 0x48]
call fcn.18000f510
nop
mov dword [rsp + 0xa0], 1
lea rcx, [rsp + 0x48]
call fcn.18004bc20
test eax, eax
je 0x180043024
test byte [rsi + 0x808], 4
je 0x180043024
test ebx, ebx
js 0x180043024
mov dil, 1
jmp 0x180043027
xor dil, dil
cmp qword [rsp + 0x68], 8
jb 0x180043039
mov rcx, qword [rsp + 0x50]
call fcn.18009a864
test dil, dil
je 0x18004304b
mov rcx, qword [rsp + 0xa8]
call fcn.18004a7f0
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x180043b20
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rsi
push r12
sub rsp, 0x70
xor eax, eax
lea r8, [rsp + 0x30]
xor ebp, ebp
xor edx, edx
mov r12, rcx
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x180043d6e
mov esi, dword [rsp + 0x4c]
mov eax, dword [rsp + 0x50]
shl rsi, 0x20
add rsi, rax
je 0x180043d6e
lea rax, [rsp + 0x98]
lea r9, [rsp + 0xa0]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_volatileoeRes_
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa8]
mov r8, r12
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x98], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x180043bde
cmp dword [rsp + 0xa0], 4
jne 0x180043bde
cmp dword [rsp + 0xa8], ebp
jne 0x180043c1b
lea rax, [rsp + 0x98]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_volatileoeReq_
mov r9d, 4
mov r8, r12
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x98], 1
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov edi, ebp
mov qword [rsp + 0x68], rbx
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x98]
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa8]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_volatileoeRes_
mov r8, r12
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x98], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x180043c8a
cmp dword [rsp + 0xa0], 4
jne 0x180043c8a
mov ebx, dword [rsp + 0xa8]
test ebx, ebx
jne 0x180043ca6
inc edi
cmp edi, 5
jl 0x180043c22
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
add rsp, 0x70
pop r12
pop rsi
pop rbp
ret
cmp ebx, 3
je 0x180043d60
cmp ebx, 4
je 0x180043d60
shr rsi, 0xc
mov eax, 0x1f4
mov edi, ebp
cmp esi, 0xc8
cmovb esi, eax
nop dword [rax]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x98]
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa8]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_volatileoeRes_
mov r8, r12
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x98], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x180043d40
cmp dword [rsp + 0xa0], 4
jne 0x180043d40
mov ebx, dword [rsp + 0xa8]
cmp ebx, 3
je 0x180043d60
cmp ebx, 4
je 0x180043d60
jmp 0x180043d42
mov ebx, ebp
add edi, 0x32
cmp edi, esi
jbe 0x180043cd0
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_volatileoeRes_
mov r8, r12
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp ebx, 3
sete bpl
mov eax, ebp
jmp 0x180043c93
xor eax, eax
add rsp, 0x70
pop r12
pop rsi
pop rbp
ret
Function at 0x180046ce0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x48]
lea r8, str.CryptEnabled
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x180046dea
cmp dword [rsp + 0x48], 4
jne 0x180046dea
cmp dword [rsp + 0x50], eax
je 0x180046dea
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x48]
lea r8, str.PersonMode
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x180046d8a
cmp dword [rsp + 0x48], 4
jne 0x180046d8a
cmp dword [rsp + 0x50], eax
jne 0x180046dea
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x48]
lea r8, str.dlpOnline
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlpdlpcore_
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x180046dd7
cmp dword [rsp + 0x48], 4
jne 0x180046dd7
cmp dword [rsp + 0x50], eax
je 0x180046dea
call fcn.18007d1bc
test eax, eax
je 0x180046dea
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret

Function at 0x180048490
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x48]
lea r8, str.PersonMode
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1800484e1
cmp dword [rsp + 0x48], 4
jne 0x1800484e1
cmp dword [rsp + 0x50], eax
jne 0x180048508
mov eax, dword [0x180105274]
cmp eax, 1
jne 0x1800484f1
add rsp, 0x38
ret
cmp eax, 3
jne 0x180048508
cmp dword [0x1801037cc], 1
jne 0x180048508
add rsp, 0x38
jmp fcn.180040640
xor eax, eax
add rsp, 0x38
ret

Function at 0x180048510
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x48]
lea r8, str.PersonMode
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x180048561
cmp dword [rsp + 0x48], 4
jne 0x180048561
cmp dword [rsp + 0x50], eax
jne 0x180048588
mov eax, dword [0x180105278]
cmp eax, 1
jne 0x180048571
add rsp, 0x38
ret
cmp eax, 3
jne 0x180048588
cmp dword [0x1801037cc], 1
jne 0x180048588
add rsp, 0x38
jmp fcn.180040640
xor eax, eax
add rsp, 0x38
ret
Function at 0x18004ca70
Capabilities:
Check for time delay via gettickcount
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
call fcn.180046e00
cmp dword [rax + 0xc], 1
jne 0x18004ca8a
mov ebx, 1
jmp 0x18004caa5
call fcn.180046e00
cmp dword [rax + 0xc], 3
jne 0x18004caa5
cmp dword [0x1801037cc], 1
jne 0x18004caa5
call fcn.180040640
mov ebx, eax
cmp ebx, dword [0x18010b5b8]
jne 0x18004caea
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetTickCount64
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18004cad3
call rax
jmp 0x18004cadb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
sub rax, qword [0x18010b5b0]
cmp rax, 0x2710
jbe 0x18004cb46
lea rcx, [0x18004ca10]
movsxd rdx, ebx
call qword [sym.imp.USER32.dll_EnumWindows]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetTickCount64
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18004cb31
call rax
mov dword [0x18010b5b8], ebx
mov qword [0x18010b5b0], rax
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x18010b5b8], ebx
mov eax, eax
mov qword [0x18010b5b0], rax
add rsp, 0x20
pop rbx
ret
Function at 0x18004cc00
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x220
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x210], rax
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.SetWindowDisplayAffinity
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18010b5a8], rax
test rax, rax
jne 0x18004cc68
lea rdx, str.SetWindowDisplayAffinity_not_found
lea rcx, str.athenwDbg
call fcn.18005c640
jmp 0x18004ce6e
mov dword [rsp + 0x68], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, str.BanScreenshotAction
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18004cd11
cmp dword [rsp + 0x60], 4
jne 0x18004cd11
cmp dword [rsp + 0x64], 1
jne 0x18004cd11
xor edx, edx
mov r8d, 0x11c
lea rcx, [rsp + 0xf0]
call fcn.18009e990
mov dword [rsp + 0xf0], 0x11c
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x18004ccf5
lea rcx, [rsp + 0xf0]
call fcn.180051604
mov eax, dword [0x1801037c8]
mov ecx, sendto
cmp dword [rsp + 0xf4], 0xa
cmovae eax, ecx
mov dword [0x1801037c8], eax
lea rcx, [rsp + 0xc8]
call fcn.180012790
nop
mov dword [rsp + 0x70], 0x50
xor edx, edx
lea r8d, [rdx + 0x4c]
lea rcx, [rsp + 0x74]
call fcn.18009e990
mov dword [rsp + 0x74], 3
lea rax, [0x18004cb50]
mov qword [rsp + 0x78], rax
xor ebx, ebx
mov dword [rsp + 0x80], ebx
mov dword [rsp + 0x84], ebx
mov rax, qword [0x180108838]
mov qword [rsp + 0x88], rax
mov edx, 0x7f04
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rsp + 0x90], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rax, qword [rsp + 0xd0]
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassExW]
lea rdx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rdx, qword [rsp + 0xd0]
mov qword [rsp + 0x58], rbx
mov rax, qword [0x180108838]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov r9d, 0xcf0000
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x18010b5a0], rax
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x18004ce56
mov rcx, qword [0x18010b5a0]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov dword [0x18010b59c], 1
lea rdx, str.SecureWindowInit
lea rcx, str.athenwDbg
call fcn.18005c640
nop
cmp qword [rsp + 0xe8], 8
jb 0x18004ce6e
mov rcx, qword [rsp + 0xd0]
call fcn.18009a864
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.180099fe0
add rsp, 0x220
pop rbx
ret
Function at 0x18004e7e0
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x38
mov rcx, qword [0x18010b7e0]
mov dword [0x18010b7dc], 1
test rcx, rcx
je 0x18004e810
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov qword [0x18010b7e0], 0
cmp dword [0x18010b5bc], 0
je 0x18004e82c
lea rdx, [0x18004e720]
lea rcx, [0x18010b5c8]
call fcn.1800a7660
cmp qword [0x18010b5c0], 0
mov dword [0x18010b5bc], 0
je 0x18004e888
xor edx, edx
lea rax, [rsp + 0x40]
lea r9, [0x1800cad00]
lea rcx, [0x1800cad10]
lea r8d, [rdx + 0x15]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18004e888
mov r9, qword [0x18010b5c0]
mov rcx, qword [rsp + 0x40]
xor edx, edx
lea r8d, [rdx + 3]
call fcn.1800243f0
add rsp, 0x38
ret

Function at 0x18004ee40
Capabilities:
Create thread

Disassembly:
push rbx
mov eax, 0x1050
call fcn.1800b3cb0
sub rsp, rax
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea rax, str._ClearThumbnailCacheThread
lea r9, str.._thumbnail.cpp
lea r8, str._s._d:_s
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x40]
mov edx, 0x800
mov dword [rsp + 0x20], 0x107
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
xor r11d, r11d
lea rax, [rsp + 0x30]
lea r8, [0x18004ea80]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r11d
mov dword [rsp + 0x30], r11d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x18004eedb
mov edx, dword [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rcx, str.thread__d_created:__s
call fcn.180057ba8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.180099fe0
add rsp, 0x1050
pop rbx
ret
Function at 0x18004fd0c
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get common file path
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xae8
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov rsi, qword [rsp + 0xb30]
mov rdi, rcx
mov rcx, qword [rsp + 0xb38]
mov qword [rsp + 0x40], rcx
xor ecx, ecx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x48], r8
mov dword [rsp + 0x30], edx
cmp r8, rcx
jne 0x18004fd60
cmp rsi, rcx
je 0x18004ff19
cmp word [rdi + 2], 0x3a
je 0x18004fdb7
cmp word [rdi + 2], 0x5c
je 0x18004fdb7
mov word [rsp + 0x6c0], cx
lea rcx, [rsp + 0x6c2]
xor edx, edx
mov r8d, 0x40e
call fcn.18009e990
lea rdx, [rsp + 0x6c0]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rsp + 0x6c0]
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdi, [rsp + 0x6c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18004ff19
test al, 0x10
je 0x18004ff19
lea rcx, [rsp + 0x4b0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x1800d1804]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x18004ff19
mov ebx, 1
lea rdx, [0x1800d34d8]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x18004fef0
lea rdx, [0x1800d1a48]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x18004fef0
cmp dword [rsp + 0x50], 0xffffffff
je 0x18004fef0
lea rcx, [rsp + 0x2a0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test byte [rsp + 0x50], 0x10
je 0x18004fed3
test rsi, rsi
je 0x18004fe9e
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x2a0]
call rsi
test eax, eax
je 0x18004ff07
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x18004fef0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x38]
mov r8, qword [rsp + 0x48]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x2a0]
mov edx, eax
mov qword [rsp + 0x20], rsi
call fcn.18004fd0c
cmp eax, 2
jmp 0x18004feee
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x18004fef0
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x2a0]
call rax
test eax, eax
je 0x18004ff07
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x18004ff0c
jmp 0x18004fe1c
mov ebx, 2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
jmp 0x18004ff1b
xor eax, eax
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.180099fe0
add rsp, 0xae8
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180050354
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor edi, edi
mov rbx, rcx
cmp rcx, rdi
je 0x180050462
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jge 0x180050462
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], di
call fcn.18009e990
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180051928
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800503d3
shr eax, 4
not eax
and eax, 1
jmp 0x180050464
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x250]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rsp + 0x250]
call fcn.180050488
cmp eax, edi
je 0x180050462
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, rdi
je 0x180050440
mov ecx, 1
cmp rax, 0xffffffffffffffff
jne 0x180050442
mov ecx, edi
cmp cl, dil
mov ebx, edi
setne bl
cmp rax, 0xffffffffffffffff
je 0x18005045e
cmp rax, rdi
je 0x18005045e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x180050464
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.180099fe0
mov rbx, qword [rsp + 0x488]
add rsp, 0x470
pop rdi
ret