joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005b1e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor r11d, r11d
mov dword [rsp], 0x740075
lea r10, [0x180164f78]
mov dword [rsp + 4], 0x6c0069
lea r9, [rsp]
mov dword [rsp + 8], 0x5c0073
mov dword [rsp + 0xc], 0x750067
mov rcx, r10
lea r8d, [r11 + 0x13]
mov dword [rsp + 0x10], 0x720061
mov dword [rsp + 0x14], 0x680064
sub r9, r10
mov dword [rsp + 0x18], 0x2e0070
mov dword [rsp + 0x1c], 0x780065
mov dword [rsp + 0x20], 0x65
lea rax, [r8 + 0x7fffffeb]
test rax, rax
je 0x18005b275
movzx edx, word [r9 + rcx]
test dx, dx
je 0x18005b275
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x18005b252
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180096b80
add rsp, 0x38
ret

Function at 0x18005b2a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rsp + 0x20], rax
xor r11d, r11d
mov dword [rsp], 0x750067
lea r10, [0x180164fa0]
mov dword [rsp + 4], 0x720061
mov edx, 0x68
mov dword [rsp + 8], 0x680064
lea r9, [rsp]
mov dword [rsp + 0xc], 0x5f0070
mov dword [rsp + 0x10], 0x610070
mov rcx, r10
mov dword [rsp + 0x14], 0x680074
sub r9, r10
lea r8d, [rdx - 0x5a]
mov word [rsp + 0x18], r11w
nop word [rax + rax]
lea rax, [r8 + 0x7ffffff0]
test rax, rax
je 0x18005b333
movzx edx, word [r9 + rcx]
test dx, dx
je 0x18005b333
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x18005b310
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.180096b80
add rsp, 0x38
ret
Function at 0x18005b4c0
Capabilities:
Accept command line arguments

Disassembly:
push rbp
push rdi
push r12
push r15
sub rsp, 0x98
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor r12d, r12d
xor r15b, r15b
mov dword [rsp + 0x50], r12d
mov edi, r12d
cmp qword [rcx + 0x18], 8
mov dword [rsp + 0x50], r12d
jb 0x18005b4fd
mov rcx, qword [rcx]
mov qword [rsp + 0xc8], rbx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0x90], r14
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbp, rax
test rax, rax
je 0x18005b648
mov esi, 1
cmp dword [rsp + 0x50], esi
jle 0x18005b63f
lea r14, [rax + 8]
nop
mov rdx, qword [r14]
test rdx, rdx
je 0x18005b5dd
mov qword [rsp + 0x68], r12
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r12w
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], r12w
jne 0x18005b570
lea rcx, [rsp + 0x58]
call fcn.18001b400
xor eax, eax
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x30], r12
lea rdx, [rsp + 0x78]
or edi, 1
mov qword [rsp + 0x28], r12
cmp qword [rsp + 0x70], 8
lea r8d, [rax + 3]
mov dword [rsp + 0x78], eax
cmovae rcx, qword [rsp + 0x58]
xor r9d, r9d
mov word [rsp + 0x7c], ax
mov qword [rsp + 0x20], r12
call fcn.1800d01f8
test eax, eax
jne 0x18005b5dd
cmp word [rsp + 0x78], r12w
je 0x18005b5dd
mov bl, 1
jmp 0x18005b5df
xor bl, bl
test dil, 1
je 0x18005b626
mov rdx, qword [rsp + 0x70]
and edi, 0xfffffffe
cmp rdx, 8
jb 0x18005b626
mov rcx, qword [rsp + 0x58]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005b621
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b682
call fcn.1800965cc
test bl, bl
jne 0x18005b63c
inc esi
add r14, 8
cmp esi, dword [rsp + 0x50]
jl 0x18005b540
jmp 0x18005b63f
mov r15b, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0x90]
movzx eax, r15b
mov rsi, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180096b80
add rsp, 0x98
pop r15
pop r12
pop rdi
pop rbp
ret
call fcn.1800c9338
int3
Function at 0x18005e780
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18005e8a5
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r9d, [rbx + 1]
mov r8d, 0x80000000
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.18005b690
mov rbp, qword [rsp + 0x48]
test eax, eax
js 0x18005e895
lea rdx, [rsp + 0x84]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [rsp + 0x80], eax
cmp eax, 0xffffffff
jne 0x18005e828
call fcn.18005b360
test eax, eax
js 0x18005e895
mov edi, dword [rsp + 0x80]
mov rdx, qword [rsp + 0x80]
lea rax, [rdx - 1]
cmp rax, 0x4ffffe
ja 0x18005e895
xor r8d, r8d
mov rcx, rsi
call fcn.1800605a0
cmp qword [rsi + 0x18], 0x10
jb 0x18005e851
mov rsi, qword [rsi]
mov dword [rsp + 0x80], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x80]
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18005e881
call fcn.18005b360
mov ebx, eax
jmp 0x18005e890
mov eax, 0x80070026
cmp dword [rsp + 0x80], edi
cmovne ebx, eax
not ebx
shr ebx, 0x1f
test rbp, rbp
je 0x18005e8a3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
Function at 0x18005f680
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x880
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov rsi, r9
mov rax, r8
mov r10, rdx
mov rbx, rcx
mov qword [rsp + 0x58], rcx
xor ebp, ebp
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x40], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 7
mov word [rcx], bp
mov dword [rsp + 0x48], 1
test rdx, rdx
je 0x18005f7a8
test rax, rax
je 0x18005f7a8
test r9, r9
je 0x18005f7a8
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20219
xor r8d, r8d
mov rdx, rax
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18005f798
cmp qword [rsp + 0x40], rbp
je 0x18005f7a8
xor edx, edx
mov r8d, 0x802
lea rcx, [rsp + 0x60]
call fcn.1800c61d0
mov dword [rsp + 0x4c], 0x800
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov r9d, 0xffff
mov r8, rsi
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x18005f798
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x18005f780
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.18001b400
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18005f7a8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.180096b80
add rsp, 0x880
pop rsi
pop rbp
pop rbx
ret
Function at 0x180061710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor r11d, r11d
mov dword [rsp], 0x6c005c
lea r10, [0x180164fc8]
mov dword [rsp + 4], 0x640075
lea r9, [rsp]
mov dword [rsp + 8], 0x730061
mov dword [rsp + 0xc], 0x690068
mov rcx, r10
lea r8d, [r11 + 0x13]
mov dword [rsp + 0x10], 0x6c005f
mov dword [rsp + 0x14], 0x67006f
sub r9, r10
mov dword [rsp + 0x18], 0x2e006f
mov dword [rsp + 0x1c], 0x6e0070
mov dword [rsp + 0x20], 0x67
lea rax, [r8 + 0x7fffffeb]
test rax, rax
je 0x1800617a5
movzx edx, word [r9 + rcx]
test dx, dx
je 0x1800617a5
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x180061782
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180096b80
add rsp, 0x38
ret
Function at 0x18006d490
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov r13d, r9d
mov rbp, r8
mov rsi, rdx
mov rbx, rcx
lea rax, vtable.LogUtils::LogAppender.0
mov qword [rcx], rax
xor edi, edi
mov qword [rcx + 8], rdi
mov dword [rcx + 0x10], edi
mov byte [rcx + 0x14], 1
mov dword [rcx + 0x18], edi
call fcn.18000a5b0
mov rcx, rax
test rax, rax
je 0x18006d665
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx + 0x20], rax
call fcn.18000a5b0
mov rcx, rax
test rax, rax
je 0x18006d670
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx + 0x28], rax
call fcn.18000a5b0
mov rcx, rax
test rax, rax
je 0x18006d65a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx + 0x30], rax
mov r14, 0xffffffffffffffff
mov dword [rbx + 0x38], r14d
lea rcx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
mov qword [rbx + 0x68], rdi
mov qword [rbx + 0x70], rdi
mov qword [rbx + 0x78], rdi
mov dword [rbx + 0x18], r13d
test rsi, rsi
jne 0x18006d56c
mov eax, edi
jmp 0x18006d57a
mov rax, r14
nop
inc rax
cmp word [rsi + rax*2], 0
jne 0x18006d570
mov r8d, eax
mov rdx, rsi
lea rcx, [rbx + 0x20]
call fcn.18000b4d0
lea rdx, [rbx + 0x20]
lea rcx, [rbx + 0x28]
call fcn.180009380
test rbp, rbp
je 0x18006d5ad
mov rax, r14
nop
inc rax
cmp word [rbp + rax*2], 0
jne 0x18006d5a0
mov edi, eax
mov r8d, edi
mov rdx, rbp
lea rcx, [rbx + 0x30]
call fcn.18000b4d0
lea r8, [rbx + 0x28]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.18006e0e0
nop
mov rdx, rax
lea rcx, [rbx + 0x28]
call fcn.180009380
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x18006d5f9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r8, qword [rbx + 0x28]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 8], rax
test rax, rax
je 0x18006d63a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x18006d63a
cmp dword [rbx + 0x18], 0
je 0x18006d62f
mov rcx, qword [rbx + 0x20]
call fcn.1800d7028
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80004005
call fcn.180009b50
nop
mov ecx, 0x80004005
call fcn.180009b50
nop
mov ecx, 0x80004005
call fcn.180009b50
int3
Function at 0x18006f820
Capabilities:
Print debug messages

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x160
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x190], rbx
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x20], 0x180
lea r9d, [rbp + 0x40]
mov r8d, 0x8109
call fcn.1800d7a64
mov esi, eax
test eax, eax
je 0x18006f9df
xor edx, edx
mov r8d, 0xe8
lea rcx, [rsp + 0x60]
call fcn.1800c61d0
lea edx, [rbp + 2]
lea r8d, [rbp + 1]
lea rcx, [rsp + 0x60]
call fcn.180008120
nop
lea rdx, str.open
lea rcx, [rsp + 0x60]
call fcn.180007240
mov rcx, rax
mov rdx, rdi
call fcn.180007240
mov rcx, rax
lea rdx, str._error.__
call fcn.180007240
mov rcx, rax
mov edx, esi
call fcn.180014e30
mov rcx, rax
lea rdx, [0x18010ec00]
call fcn.180007240
nop
movdqa xmm0, xmmword [0x1801018d0]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], bp
mov dword [rsp + 0x30], 2
mov rcx, qword [rsp + 0xd8]
test cl, 2
jne 0x18006f93d
mov rax, qword [rsp + 0xa8]
mov r8, qword [rax]
test r8, r8
je 0x18006f93d
mov rax, qword [rsp + 0x88]
mov rdx, qword [rax]
cmp r8, qword [rsp + 0xd0]
cmovb r8, qword [rsp + 0xd0]
sub r8, rdx
jmp 0x18006f971
test cl, 4
jne 0x18006f97f
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax]
test rcx, rcx
je 0x18006f97f
mov rax, qword [rsp + 0x80]
mov rdx, qword [rax]
mov rax, qword [rsp + 0xb8]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
lea rcx, [rsp + 0x38]
call fcn.18001b400
nop
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x18006f9d5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006f9cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006fa1b
call fcn.1800965cc
nop
lea rcx, [rsp + 0x60]
call fcn.180009580
mov ecx, dword [rbx]
cmp ecx, 0xffffffff
je 0x18006f9f3
xor edx, edx
lea r8d, [rdx + 2]
call fcn.1800d8010
jmp 0x18006f9f8
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180096b80
mov rbx, qword [rsp + 0x190]
add rsp, 0x160
pop rdi
pop rsi
pop rbp
ret
call fcn.1800c9338
nop
int3

Function at 0x180070d90
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x180070dab
xor al, al
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x180070dd6
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x180070dd6
cmp eax, 0x50
je 0x180070dd6
cmp eax, 0xb7
jne 0x180070da3
mov al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x180070de0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x290], rbx
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov ebp, r8d
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x38], rcx
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x40]
call fcn.1800c61d0
xor r9d, r9d
lea r8d, [r9 + 0x1a]
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.18000a5b0
mov rcx, rax
test rax, rax
je 0x18007102f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov rdi, 0xffffffffffffffff
cmp rax, 0x10000
jae 0x180070e8a
lea rax, [rsp + 0x40]
movzx edx, ax
lea rcx, [rsp + 0x28]
call fcn.18000b100
jmp 0x180070eaf
lea rcx, [rsp + 0x40]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x180070e92
mov r8d, eax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.18000b4d0
nop
xor r9d, r9d
mov r8, rbx
mov rbx, qword [rsp + 0x28]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.180071170
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180070ee1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test ebp, ebp
je 0x180070f82
xor r8d, r8d
mov rdx, qword [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180070f82
call fcn.18000a5b0
mov rcx, rax
test rax, rax
je 0x18007103a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea rdx, [0x1800fdff8]
cmp rdx, 0x10000
jae 0x180070f43
movzx edx, dx
mov rcx, rsi
call fcn.18000b100
jmp 0x180070f5c
mov rax, rdi
inc rax
cmp word [rdx + rax*2], 0
jne 0x180070f46
mov r8d, eax
mov rcx, rsi
call fcn.18000b4d0
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x180071003
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
jmp 0x180071003
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x180070faa
cmp rax, qword [rbx - 0x18]
jne 0x180070faa
lea rbp, [rbx - 0x18]
lock inc dword [rbx - 8]
jmp 0x180070fe0
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rbp, rax
test rax, rax
je 0x180071029
mov eax, dword [rbx - 0x10]
mov dword [rbp + 8], eax
mov eax, dword [rbx - 0x10]
inc eax
movsxd rdx, eax
add rdx, rdx
mov r8, rbx
lea rcx, [rbp + 0x18]
mov r9, rdx
call fcn.18000d490
lea rax, [rbp + 0x18]
mov qword [rsi], rax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x180071003
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, rsi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180096b80
mov rbx, qword [rsp + 0x290]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
call fcn.18000b860
nop
mov ecx, 0x80004005
call fcn.180009b50
nop
mov ecx, 0x80004005
call fcn.180009b50
int3
Function at 0x180071170
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov r14d, r9d
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
test rdx, rdx
je 0x18007128a
test r8, r8
je 0x18007128a
call fcn.18000a5b0
mov rcx, rax
test rax, rax
je 0x180071307
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x105
or eax, ecx
jge 0x1800711f6
mov edx, 0x105
lea rcx, [rsp + 0x58]
call fcn.18000b290
mov rbx, qword [rsp + 0x58]
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1800c96c0
test eax, eax
js 0x180071312
cmp eax, dword [rbx - 0xc]
jg 0x180071312
mov dword [rbx - 0x10], eax
cdqe
xor ecx, ecx
mov word [rbx + rax*2], cx
test r14d, r14d
je 0x18007127b
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18007127b
lea rdx, [0x1800fdff8]
mov rcx, rdi
call fcn.180008080
nop
lea rdx, [rbx - 0x18]
mov rax, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800712e6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x1800712e6
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.180027470
jmp 0x18007125b
call fcn.18000a5b0
mov rcx, rax
test rax, rax
je 0x1800712fc
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
lea rdx, [0x1800fdff8]
cmp rdx, 0x10000
jae 0x1800712c1
movzx edx, dx
mov rcx, rdi
call fcn.18000b100
jmp 0x1800712e6
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1800712d0
mov r8d, eax
mov rcx, rdi
call fcn.18000b4d0
nop
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.180009b50
int3
mov ecx, 0x80004005
call fcn.180009b50
nop
mov ecx, 0x80070057
call fcn.180009b50
int3
Function at 0x18007c690
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x880
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov rax, r9
mov r10, r8
mov rbx, rdx
mov qword [rsp + 0x58], rdx
mov rsi, qword [rsp + 0x8c0]
xor ebp, ebp
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x40], rbp
mov qword [rdx + 0x10], rbp
mov qword [rdx + 0x18], 7
mov word [rdx], bp
mov dword [rsp + 0x48], 1
test r8, r8
je 0x18007c7b8
test rax, rax
je 0x18007c7b8
test rsi, rsi
je 0x18007c7b8
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20219
xor r8d, r8d
mov rdx, rax
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18007c7a8
cmp qword [rsp + 0x40], rbp
je 0x18007c7b8
xor edx, edx
mov r8d, 0x802
lea rcx, [rsp + 0x60]
call fcn.1800c61d0
mov dword [rsp + 0x4c], 0x800
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov r9d, 0xffff
mov r8, rsi
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x18007c7a8
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x18007c790
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.18001b400
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18007c7b8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.180096b80
add rsp, 0x880
pop rsi
pop rbp
pop rbx
ret
Function at 0x18007f360
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x18007f498
test rdx, rdx
je 0x18007f498
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18007f498
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x18007f498
xor ebx, ebx
mov dword [rsp + 0x80], ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rax + 5]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x18007f48e
xor eax, eax
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0x88]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x18007f485
cmp dword [rsp + 0x8c], ebx
jne 0x18007f485
mov edx, dword [rsp + 0x88]
xor r8d, r8d
mov rcx, rsi
call fcn.1800605a0
nop
mov dword [rsp + 0x70], ebx
xor edx, edx
mov rcx, rsi
call fcn.180067a98
mov rdx, rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x70]
mov r8d, dword [rsp + 0x88]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0x88], eax
jne 0x18007f485
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x18007f7b0
Capabilities:
Read .ini file

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r14, r9
mov rsi, r8
mov rdi, rdx
mov r15, rcx
mov qword [rsp + 0x38], rcx
mov rbx, qword [rsp + 0x2b0]
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.1800c61d0
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x40]
mov r8, qword [r14]
mov rdx, qword [rsi]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.18000a5b0
mov rcx, rax
test rax, rax
je 0x18007f8ad
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r15], rax
lea rax, [rsp + 0x40]
cmp rax, 0x10000
lea rax, [rsp + 0x40]
jae 0x18007f862
movzx edx, ax
mov rcx, r15
call fcn.18000b100
jmp 0x18007f88b
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x18007f870
mov r8d, ecx
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.18000b4d0
nop
mov rax, r15
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180096b80
add rsp, 0x260
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80004005
call fcn.180009b50
int3