joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18007a400
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x690
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x680], rax
xor edx, edx
lea rcx, [rsp + 0x470]
mov r8d, 0x208
call fcn.180233580
xor ecx, ecx
lea rdx, str.WnCloud.exe
nop dword [rax]
movzx eax, word [rcx + rdx]
mov word [rsp + rcx + 0x470], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x18007a440
lea rcx, [rsp + 0x470]
call fcn.18023b948
xor ebx, ebx
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp eax, 0xffffffff
je 0x18007a539
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18007a530
nop dword [rax]
xor edx, edx
lea rcx, [rsp + 0x260]
mov r8d, 0x208
call fcn.180233580
xor eax, eax
nop word [rax + rax]
movzx ecx, word [rsp + rax + 0x4c]
mov word [rsp + rax + 0x260], cx
lea rax, [rax + 2]
test cx, cx
jne 0x18007a4c0
lea rcx, [rsp + 0x260]
call fcn.18023b948
lea rax, [rsp + 0x260]
lea r8, [rsp + 0x470]
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x18007a514
add rax, 2
test ecx, ecx
jne 0x18007a500
test edx, edx
jne 0x18007a51a
inc ebx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18007a4a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x6a0]
add rsp, 0x690
pop rdi
ret

Function at 0x18007a860
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x18007a883
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x18007a88b
call qword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x30], rdi
or rdx, 0xffffffffffffffff
cmp word [rbx + rdx*2 + 2], 0
lea rdx, [rdx + 1]
jne 0x18007a894
lea rdx, [rdx*2 + 2]
mov ecx, 0x2042
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
jne 0x18007a8ce
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
sub rax, rbx
nop word [rax + rax]
movzx ecx, word [rbx]
mov word [rax + rbx], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x18007a8e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdi, qword [rsp + 0x30]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x18007a930
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 1
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x18007a950
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x18007a948
mov ecx, 1
mov qword [rsp + 0x30], rdi
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x18007a983
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
jne 0x18007a996
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
or rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x18007a9a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdi, qword [rsp + 0x30]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x18007a9d0
Capabilities:
Open clipboard

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 1
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x18007aa05
mov rcx, rbx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x18007aa05
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x18007aa0d
call qword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.USER32.dll_CloseClipboard]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x18007aa30
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push r14
sub rsp, 0x20
mov r14, rdx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x18007aa4a
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbx
mov ecx, 1
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rbx, rax
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rsi, qword [rsp + 0x38]
test edi, edi
mov rdi, qword [rsp + 0x40]
jne 0x18007aaa0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
test rbx, rbx
je 0x18007aabf
sub r14, rbx
nop dword [rax + rax]
movzx ecx, byte [rbx]
mov byte [r14 + rbx], cl
lea rbx, [rbx + 1]
test cl, cl
jne 0x18007aab0
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x18007ae50
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1540]
mov eax, 0x1640
call fcn.180204780
sub rsp, rax
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x1530], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rbp + 0x170]
mov r8d, 0x208
call fcn.180233580
mov r8, rdi
lea rdx, [0x1802abd74]
lea rcx, [rbp + 0x170]
call fcn.18005c530
lea rax, [rbp + 0x170]
or rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x18007aec0
lea eax, [rcx - 1]
test eax, eax
jle 0x18007aeee
cdqe
cmp word [rbp + rax*2 + 0x170], 0x5c
je 0x18007aeee
movsxd rax, ecx
mov ecx, 0x5c
mov word [rbp + rax*2 + 0x170], cx
lea r8, [rbp + 0x170]
lea rdx, [0x1802ac140]
lea rcx, [rbp + 0x590]
call fcn.18005c530
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x590]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18007afdd
nop word [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x18007afdd
cmp word [rsp + 0x4c], 0x2e
je 0x18007af30
movzx eax, word [rsp + 0x4e]
test ax, ax
je 0x18007af30
cmp ax, 0x2e
jne 0x18007af66
cmp word [rsp + 0x50], 0
je 0x18007af30
test byte [rsp + 0x20], 0x10
je 0x18007afac
xor edx, edx
lea rcx, [rbp + 0x380]
mov r8d, 0x208
call fcn.180233580
lea r9, [rsp + 0x4c]
lea r8, [rbp + 0x170]
lea rdx, [0x1802abd18]
lea rcx, [rbp + 0x380]
call fcn.18005c530
lea rcx, [rbp + 0x380]
call fcn.18007ae50
lea r9, [rsp + 0x4c]
lea r8, [rbp + 0x170]
lea rdx, [0x1802abef8]
lea rcx, [rbp + 0xd60]
call fcn.18005c530
lea rcx, [rbp + 0xd60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x18007af30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov edx, 0x20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, qword [rbp + 0x1530]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x1640]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x18007c860
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx]
mov r9d, 0x270
mov rbx, rcx
cmp eax, r9d
jne 0x18007c8bb
lea r8, [rcx + 8]
nop word [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x18007c880
jmp 0x18007c8c7
cmp eax, 0x4e0
jb 0x18007c8c7
call fcn.18007c910
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret
Function at 0x18007c910
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r10, rcx
lea r9, [rcx + 0x9c4]
mov r11d, 0xe3
mov edx, dword [r9]
xor edx, dword [r9 + 4]
lea r9, [r9 + 4]
btr edx, 0x1f
xor edx, dword [r9 - 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x630]
xor ecx, edx
mov dword [r9 - 0x9c4], ecx
sub r11, 1
jne 0x18007c920
lea r9, [r10 + 0xd50]
mov r11d, 0x18c
nop word [rax + rax]
mov edx, dword [r9]
xor edx, dword [r9 + 4]
lea r9, [r9 + 4]
btr edx, 0x1f
xor edx, dword [r9 - 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 - 0xd50]
xor ecx, edx
mov dword [r9 - 0x9c4], ecx
sub r11, 1
jne 0x18007c970
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov dword [r10], r11d
ret
Function at 0x180083510
Capabilities:
Check if file exists
Get file size
Hash data with md5
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x1a0], rbx
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov rdi, rdx
mov rbx, rcx
xor r13d, r13d
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r13
mov word [rsp + 0x50], r13w
xor r8d, r8d
lea rdx, [0x1802abc2c]
lea rcx, [rsp + 0x50]
call fcn.18005c660
nop
mov byte [rbp + 0x19], r13b
mov qword [rbp - 0x60], r13
mov dword [rbp - 0x70], 0x67452301
mov dword [rbp - 0x6c], 0xefcdab89
mov dword [rbp - 0x68], 0x98badcfe
mov dword [rbp - 0x64], 0x10325476
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800836e1
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r13 + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18008361c
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r13
cmp qword [rbx + 0x18], 8
jb 0x1800835fe
mov rax, qword [rbx]
jmp 0x180083601
mov rax, rbx
mov word [rax], r13w
xor r8d, r8d
lea rdx, [0x1802abc2c]
mov rcx, rbx
call fcn.18005c660
jmp 0x18008370e
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
lea rcx, [r14 + 1]
call fcn.180203f3c
mov rsi, rax
test rax, rax
je 0x1800835e6
lea r8, [r14 + 1]
xor edx, edx
mov rcx, rax
call fcn.180233580
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x44]
mov r8d, r14d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r14d
mov rdx, rsi
lea rcx, [rbp - 0x70]
call fcn.180058b10
mov rcx, rsi
call fcn.180085310
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x70]
call fcn.180059800
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.18006cf70
nop
lea rcx, [rbp + 0x20]
call fcn.18005ba50
cmp qword [rbp - 0x80], 0
jbe 0x1800836c5
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.18005cbe0
nop
mov r8, qword [rbp - 0x78]
cmp r8, 8
jb 0x1800836e1
inc r8
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.18005cac0
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r13
cmp qword [rbx + 0x18], 8
jb 0x1800836f9
mov rax, qword [rbx]
jmp 0x1800836fc
mov rax, rbx
mov word [rax], r13w
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.18005c590
nop
mov r8, qword [rsp + 0x68]
cmp r8, 8
jb 0x18008372b
inc r8
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.18005cac0
mov rax, rbx
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800840f0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebp, ebp
cmp eax, 0xffffffff
je 0x180084130
test al, 0x10
mov eax, ebp
seta al
test eax, eax
je 0x180084130
xor eax, eax
jmp 0x180084212
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x30], ebp
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp word [rdi + rax*2], bp
jne 0x180084140
cmp eax, 0x12c
jae 0x180084157
mov eax, 0x12c
jmp 0x180084169
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rdi + rax*2], bp
jne 0x180084160
mov edx, eax
lea rcx, [rsp + 0x28]
call fcn.180083d40
mov rcx, rdi
mov rsi, qword [rsp + 0x28]
mov rdx, rsi
sub rdx, rdi
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180084190
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1800841a0
cmp ebx, 1
jle 0x1800841c0
lea eax, [rbx - 1]
movsxd rcx, eax
cmp word [rsi + rcx*2], 0x5c
jne 0x1800841c0
mov word [rsi + rcx*2], bp
mov edx, 0x5c
mov rcx, rsi
call fcn.1802328bc
test rax, rax
jne 0x1800841d7
lea ebx, [rax + 0xf]
jmp 0x180084208
mov word [rax], bp
mov rcx, rsi
call fcn.1800840f0
mov ebx, eax
test eax, eax
jne 0x180084208
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180084206
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xb7
jne 0x180084208
mov ebx, ebp
mov rcx, rsi
call fcn.180085310
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1800849d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.180084c60
test eax, eax
jne 0x1800849e2
add rsp, 0x28
ret
mov ecx, dword [0x180344514]
cmp ecx, 0xffffffff
je 0x180084a05
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x180084a05
mov ecx, dword [0x180344514]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, 1
add rsp, 0x28
ret
Function at 0x180084a20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x1178], eax
je 0x180084a5b
xor edi, edi
mov qword [rbx + 0x1140], 0x3f3
mov dword [rbx + 0x1148], edi
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov ecx, dword [0x180344514]
cmp ecx, 0xffffffff
je 0x180084c34
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x180084a95
xor edi, edi
mov qword [rbx + 0x1140], 0x3f4
mov dword [rbx + 0x1148], edi
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov ecx, dword [0x180344514]
cmp ecx, 0xffffffff
je 0x180084c34
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x180084c34
mov ecx, dword [0x180344514]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x180084c34
xor edi, edi
mov qword [rsp + 0x60], rsi
lea rsi, [rbx + 0x1120]
xor eax, eax
mov qword [rsi + 0x20], rdi
mov dword [rsi + 0x28], edi
mov qword [rsi], rax
mov dword [rsi + 8], eax
cmp qword [rbx + 0x1150], rax
jne 0x180084bb1
cmp qword [rbx + 0x1180], rax
jne 0x180084bc1
lea rcx, str.Cabinet.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
mov qword [rbx + 0x1180], rax
lea rdx, str.FDICreate
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x1180]
lea rdx, str.FDICopy
mov qword [rbx + 0x1188], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x1180]
lea rdx, str.FDIIsCabinet
mov qword [rbx + 0x1190], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x1180]
lea rdx, str.FDIDestroy
mov qword [rbx + 0x1198], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x11a0], rax
cmp qword [rbx + 0x1188], rdi
je 0x180084b9d
cmp qword [rbx + 0x1190], rdi
je 0x180084b9d
cmp qword [rbx + 0x1198], rdi
je 0x180084b9d
test rax, rax
jne 0x180084bc1
mov qword [rbx + 0x1180], rdi
xor eax, eax
mov qword [rsi + 0x20], 0x3e8
mov dword [rsi + 0x28], edi
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov qword [rsp + 0x40], rsi
lea rax, [0x180085440]
mov dword [rsp + 0x38], 1
lea r9, [0x180085360]
mov qword [rsp + 0x30], rax
lea r8, [0x180085320]
lea rax, [0x180085400]
mov qword [rsp + 0x28], rax
lea rdx, [fcn.180085310]
lea rax, [0x1800853b0]
lea rcx, [0x180085300]
mov qword [rsp + 0x20], rax
call qword [rbx + 0x1188]
mov rsi, qword [rsp + 0x60]
test rax, rax
mov qword [rbx + 0x1150], rax
setne dil
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
xor edi, edi
mov qword [rbx + 0x1144], 0xe
mov dword [rbx + 0x1140], edi
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x180086360
Capabilities:
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x50
mov rsi, rdx
mov qword [rax - 0x28], 0
movzx ebx, r9w
mov dword [rax - 0x30], 0x80
xor r9d, r9d
mov dword [rax - 0x38], 3
movzx ebp, r8w
mov edx, 0xc0000000
mov rcx, rsi
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180086426
lea r8, [rsp + 0x40]
movzx edx, bx
movzx ecx, bp
call qword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
movzx ebx, word [rsp + 0x80]
test eax, eax
je 0x18008640e
mov rcx, qword [rsp + 0x40]
mov eax, 0x100
mov qword [rsp + 0x60], rcx
test ax, bx
ja 0x1800863f8
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx edx, bx
mov rcx, rsi
and edx, 0x27
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x1800864a0
Capabilities:
Set file attributes

Disassembly:
test r9b, r9b
js method.Cabinet::CExtract.virtual_40
mov rax, qword [rcx]
jmp qword [rax + 0x30]

Function at 0x1800864b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
xor r11d, r11d
movsxd rdx, dword [rcx + 0x84]
mov rdi, r8
test edx, edx
jle 0x1800864ec
mov rax, qword [rcx + 0x88]
mov r10d, r11d
cmp qword [rax], rbx
je 0x180086504
inc r11d
inc r10
add rax, 8
cmp r10, rdx
jl 0x1800864d8
mov r8d, r9d
mov rdx, rdi
mov ecx, ebx
call fcn.18024d1b0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test r11d, r11d
js 0x1800864ec
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x38]
test eax, eax
jle 0x1800864f9
add dword [rbx + 8], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800866e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov rdi, rcx
lea rdx, [rcx + 0x11d0]
lea rcx, [rsp + 0x28]
call fcn.180083c30
nop
mov r8d, dword [rdi + 0x11c8]
test r8d, r8d
je 0x180086730
lea rdx, [0x1802ae0e8]
lea rcx, [rsp + 0x28]
call fcn.180083f90
xor esi, esi
mov edx, esi
mov rcx, qword [rdi + 0x11b8]
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], dx
jne 0x180086740
cmp eax, dword [rdi + 0x11c0]
jb 0x18008676f
lea rax, str.The_string_has_no_terminating_null_character_
mov qword [rsp + 0x50], rax
lea rdx, [0x18032e358]
lea rcx, [rsp + 0x50]
call fcn.180232de8
int3
test eax, eax
je 0x180086776
mov rdx, rcx
mov rbp, qword [rdi + 0x1200]
test rbp, rbp
jne 0x18008678e
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbp, rax
mov r8, qword [rdi + 0x11e0]
mov rdx, qword [rsp + 0x28]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rdi + 0x11f0], rax
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rdi + 0x11fc], eax
mov dword [rdi + 0x11f8], esi
cmp qword [rdi + 0x11f0], rsi
je 0x1800867ee
test eax, eax
je 0x1800867ee
mov esi, 1
jmp 0x1800867ff
mov qword [rdi + 0x1140], 0x3ec
mov dword [rdi + 0x1148], esi
mov rcx, qword [rsp + 0x28]
call fcn.180085310
mov eax, esi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x180086b10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
lea rax, vtable.Cabinet::CExtract.0
mov qword [rcx], rax
call fcn.180084c60
nop
test eax, eax
je 0x18008491b
mov ecx, dword [0x180344514]
cmp ecx, 0xffffffff
je 0x18008491b
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test eax, eax
je 0x18008491b
mov ecx, dword [0x180344514]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
mov rcx, qword [rbx + 0x1180]
test rcx, rcx
je 0x18008492e
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rcx, qword [rbx + 0x1160]
test rcx, rcx
je 0x180084945
mov edx, 1
call fcn.180085310
nop
mov rcx, qword [rbx + 0x1130]
call fcn.180085310
nop
mov rcx, qword [rbx + 0x1110]
test rcx, rcx
je 0x180084964
call fcn.180085310
nop
xor eax, eax
mov qword [rbx + 0x1110], rax
mov dword [rbx + 0x1118], eax
mov rcx, qword [rbx + 0xa8]
call fcn.180085310
nop
mov rcx, qword [rbx + 0x98]
call fcn.180085310
nop
mov edx, 8
mov rcx, qword [rbx + 0x88]
call fcn.180085310
nop
mov edx, 4
mov rcx, qword [rbx + 0x90]
call fcn.180085310
nop
mov rcx, qword [rbx + 0x20]
call fcn.180085310
nop
mov rcx, qword [rbx + 0x10]
add rsp, 0x30
pop rbx
jmp fcn.180085310
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8, qword [rcx + 0x1208]
lea rdx, [rsp + 0x30]
mov rdi, rcx
mov r9, r8
add rcx, 0x1208
mov r8, qword [r8]
call fcn.180087550
mov rcx, qword [rdi + 0x1208]
call fcn.180203788
lea rax, vtable.Cabinet::CExtractResource.0
mov qword [rdi], rax
mov rcx, qword [rdi + 0x11e0]
call fcn.180085310
mov rcx, qword [rdi + 0x11d0]
call fcn.180085310
mov rcx, qword [rdi + 0x11b8]
call fcn.180085310
mov rcx, qword [rdi + 0x11a8]
call fcn.180085310
lea rax, vtable.Cabinet::CExtractMemory.0
mov rcx, rdi
mov qword [rdi], rax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1800848d0