joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140018220
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x140057038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov esi, 1
mov rdi, rcx
cmp dword [rcx + 4], esi
jle 0x140018307
lea rbx, [r11 - 0x38]
sub rbx, rcx
lea rbp, [rcx + 0x2a]
sub rbx, 0x2a
lea r15, [0x140000000]
xor r9d, r9d
mov r10, rbp
lea r14, [rbx + r9]
mov r11d, 4
movzx eax, byte [r10 + 1]
lea rdx, [r9 + rax*4]
movzx eax, byte [r10 - 1]
mov r8b, byte [rdx + r15 + 0x60f70]
lea rcx, [r9 + rax*4]
movzx eax, byte [r10 - 2]
xor r8b, byte [rcx + r15 + 0x60770]
lea rcx, [r9 + rax*4]
movzx eax, byte [r10]
xor r8b, byte [rcx + r15 + 0x60370]
lea rcx, [r9 + rax*4]
xor r8b, byte [rcx + r15 + 0x60b70]
mov byte [r14 + r10], r8b
lea r10, [r10 + 4]
sub r11, 1
jne 0x14001827e
inc r9
cmp r9, 4
jl 0x140018271
movsxd rcx, esi
lea r8d, [r11 + 0x10]
shl rcx, 4
lea rdx, [rsp + 0x20]
add rcx, 0x18
add rcx, rdi
call fcn.14002b4d0
inc esi
add rbp, 0x10
sub rbx, 0x10
cmp esi, dword [rdi + 4]
jl 0x14001826e
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400292f0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x140018864
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword [0x140059400]
xor ebx, ebx
movzx ebp, r9b
mov r14b, r8b
mov rdi, rdx
mov rsi, rcx
test rax, rax
jne 0x1400188ab
lea rcx, [0x1400593f0]
call fcn.1400185e8
mov rax, qword [0x140059400]
mov rdx, rdi
mov r8d, ebp
and rdx, 0xfffffffffffffff0
test r14b, r14b
je 0x1400188f7
test rax, rax
je 0x140018919
mov rcx, rsi
call qword [0x140044528]
test eax, eax
jne 0x140018934
lea rdx, str.CryptProtectMemory_failed
lea rcx, [0x1400593e0]
call fcn.14000b75c
call fcn.14000baa8
mov edx, 2
lea rcx, [0x1400593e0]
call fcn.14000b9b8
jmp 0x140018934
mov rax, qword [0x140059408]
test rax, rax
je 0x140018919
mov rcx, rsi
call qword [0x140044528]
test eax, eax
jne 0x140018934
lea rdx, str.CryptUnprotectMemory_failed
jmp 0x1400188d3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test rdi, rdi
je 0x140018934
lea ecx, [rax + 0x4b]
add cl, bl
xor byte [rbx + rsi], cl
inc rbx
cmp rbx, rdi
jb 0x140018924
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140019170
Capabilities:
Hash data using sha1

Disassembly:
and qword [rcx + 0x18], 0
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
ret

Function at 0x14001949c
Capabilities:
Hash data using sha256

Disassembly:
and qword [rcx + 0x20], 0
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
ret

Function at 0x140019764
Capabilities:
Hash data using sha256

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov ebx, dword [rcx + 0x20]
mov esi, 0x38
mov rbp, qword [rcx + 0x20]
and ebx, 0x3f
shl rbp, 3
mov r14, rdx
mov rdi, rcx
mov byte [rbx + rcx + 0x28], 0x80
inc ebx
cmp ebx, esi
je 0x1400197de
jbe 0x1400197c9
lea edx, [rsi + 8]
cmp ebx, edx
jae 0x1400197bf
sub edx, ebx
mov ecx, ebx
add rcx, 0x28
mov r8d, edx
add rcx, rdi
xor edx, edx
call fcn.14002bb80
xor ebx, ebx
mov rcx, rdi
call fcn.1400194dc
sub esi, ebx
mov ecx, ebx
add rcx, 0x28
mov r8d, esi
add rcx, rdi
xor edx, edx
call fcn.14002bb80
mov rcx, rbp
lea rdx, [rdi + 0x60]
shr rcx, 0x20
call fcn.14001947c
lea rdx, [rdi + 0x64]
mov ecx, ebp
call fcn.14001947c
mov rcx, rdi
call fcn.1400194dc
mov ecx, dword [rdi]
mov rdx, r14
call fcn.14001947c
mov ecx, dword [rdi + 4]
lea rdx, [r14 + 4]
call fcn.14001947c
mov ecx, dword [rdi + 8]
lea rdx, [r14 + 8]
call fcn.14001947c
mov ecx, dword [rdi + 0xc]
lea rdx, [r14 + 0xc]
call fcn.14001947c
mov ecx, dword [rdi + 0x10]
lea rdx, [r14 + 0x10]
call fcn.14001947c
mov ecx, dword [rdi + 0x14]
lea rdx, [r14 + 0x14]
call fcn.14001947c
mov ecx, dword [rdi + 0x18]
lea rdx, [r14 + 0x18]
call fcn.14001947c
mov ecx, dword [rdi + 0x1c]
lea rdx, [r14 + 0x1c]
call fcn.14001947c
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.14001949c
Function at 0x14001ad40
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x140057038]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rdi, rcx
mov edx, 0x104
lea rcx, [rbp - 0x29]
call fcn.140001da4
nop
lea rcx, [rbp - 0x29]
call fcn.140001aec
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.140001adc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ebx, ebx
test eax, eax
je 0x14001ae0c
lea rcx, [rbp - 0x11]
call fcn.1400026bc
nop
mov rdx, rdi
lea rcx, [rbp + 0x2f]
call fcn.1400020b4
nop
lea rcx, [rbp - 0x29]
call fcn.140001adc
mov rdx, rax
lea rcx, [rbp + 0xf]
call fcn.1400020b4
nop
lea r8, [rbp - 0x11]
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
call fcn.1400138e4
nop
lea rcx, [rbp + 0xf]
call fcn.140002254
nop
lea rcx, [rbp + 0x2f]
call fcn.140002254
lea rcx, [rbp - 0x11]
call fcn.14000128c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
lea rcx, [rbp - 0x11]
call fcn.140002254
nop
lea rcx, [rbp - 0x29]
call fcn.140001af8
mov rax, rbx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400292f0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x140028938
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x1400289b0
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x1400289b0
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x1400289b0
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x1400289a4
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1400289c2
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140028992
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x1400289b2
Function at 0x180001ad0
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov r11, rsp
push rsi
push rdi
sub rsp, 0x268
mov rax, qword [0x18004e3a0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov qword [r11 + 8], rbx
mov rsi, rdx
mov qword [r11 - 0x18], r14
mov rbx, rcx
xor r14b, r14b
call fcn.180003fd0
xor edi, edi
test al, al
je 0x180001b70
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
mov rcx, rbx
call fcn.180002330
test al, al
je 0x180001b70
mov r8, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x290], rbp
lea edx, [rdi + 0x1a]
mov ebp, 1
mov qword [rsp + 0x20], rax
mov r9d, ebp
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, r14b
cmove ebx, ebp
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x290]
test bl, bl
jne 0x180001b84
xor r9d, r9d
lea rdx, [rsp + 0x40]
xor ecx, ecx
lea r8d, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov r14, qword [rsp + 0x260]
lea rcx, [rsp + 0x40]
mov rbx, qword [rsp + 0x280]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], di
jne 0x180001ba0
test eax, eax
je 0x180001c6f
lea rcx, [rsp + 0x40]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x180001bc0
mov eax, dword [0x180036804]
lea rdx, [rsp + 0x40]
sub rdx, 2
mov dword [rcx], eax
nop dword [rax + rax]
cmp word [rdx + 2], di
lea rdx, [rdx + 2]
jne 0x180001be0
mov ecx, dword [0x180036888]
movups xmm0, xmmword [str.PuddingDesktop]
movsd xmm1, qword [0x180036880]
movups xmmword [rdx], xmm0
movsd qword [rdx + 0x10], xmm1
mov dword [rdx + 0x18], ecx
movzx ecx, word [0x18003688c]
mov word [rdx + 0x1c], cx
lea rcx, [rsp + 0x40]
sub rcx, 2
nop
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x180001c20
mov dword [rcx], eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180001c45
lea rcx, [rsp + 0x40]
call fcn.180005f40
cmp word [rsp + 0x40], di
je 0x180001c5f
lea rax, [rsp + 0x40]
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x180001c55
mov r8, rdi
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.180005b90
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180018080
add rsp, 0x268
pop rdi
pop rsi
ret
Function at 0x180001c90
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov r11, rsp
push rsi
push rdi
sub rsp, 0x268
mov rax, qword [0x18004e3a0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov qword [r11 + 8], rbx
mov rsi, rdx
mov qword [r11 - 0x18], r14
mov rbx, rcx
xor r14b, r14b
call fcn.180003fd0
xor edi, edi
test al, al
je 0x180001d30
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
mov rcx, rbx
call fcn.180002330
test al, al
je 0x180001d30
mov r8, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x290], rbp
lea edx, [rdi + 0x1a]
mov ebp, 1
mov qword [rsp + 0x20], rax
mov r9d, ebp
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, r14b
cmove ebx, ebp
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x290]
test bl, bl
jne 0x180001d44
xor r9d, r9d
lea rdx, [rsp + 0x40]
xor ecx, ecx
lea r8d, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov r14, qword [rsp + 0x260]
lea rcx, [rsp + 0x40]
mov rbx, qword [rsp + 0x280]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], di
jne 0x180001d60
test eax, eax
je 0x180001e2f
lea rcx, [rsp + 0x40]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x180001d80
mov eax, dword [0x180036804]
lea rdx, [rsp + 0x40]
sub rdx, 2
mov dword [rcx], eax
nop dword [rax + rax]
cmp word [rdx + 2], di
lea rdx, [rdx + 2]
jne 0x180001da0
movups xmm0, xmmword [str.PuddingDesktop.users]
movzx ecx, word [0x1800368c8]
movups xmm1, xmmword [0x1800368b0]
movups xmmword [rdx], xmm0
movsd xmm0, qword [0x1800368c0]
movups xmmword [rdx + 0x10], xmm1
movsd qword [rdx + 0x20], xmm0
mov word [rdx + 0x28], cx
lea rcx, [rsp + 0x40]
sub rcx, 2
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x180001de0
mov dword [rcx], eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180001e05
lea rcx, [rsp + 0x40]
call fcn.180005f40
cmp word [rsp + 0x40], di
je 0x180001e1f
lea rax, [rsp + 0x40]
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x180001e15
mov r8, rdi
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.180005b90
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180018080
add rsp, 0x268
pop rdi
pop rsi
ret
Function at 0x180001fb0
Capabilities:
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x798]
sub rsp, 0x898
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x18004e3a0]
xor rax, rsp
mov qword [rbp + 0x780], rax
mov edi, r9d
mov r14, r8
mov rsi, rdx
mov rbx, rcx
lea r9, [rcx + 0xf0]
cmp qword [r9 + 0x18], 8
jb 0x180001fff
mov r9, qword [r9]
mov r8d, edi
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, edi
jne 0x18000217b
mov qword [rsp + 0x50], 7
xor r15d, r15d
mov qword [rsp + 0x48], r15
mov word [rsp + 0x38], r15w
xor r8d, r8d
lea rdx, [0x180036800]
lea rcx, [rsp + 0x38]
call fcn.180005b90
nop
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x80]
call fcn.18001b5d0
mov r8d, edi
lea rdx, [0x180036c0c]
lea rcx, [rbp - 0x80]
call fcn.180005ee0
lea rax, [rbp - 0x80]
mov r9, r14
mov r8, rsi
lea rdx, [rsp + 0x58]
mov rcx, rbx
mov qword [rsp + 0x20], rax
cmp byte [rbx + 1], r15b
je 0x1800020d6
call fcn.180001e70
mov rbx, rax
lea rax, [rsp + 0x38]
cmp rax, rbx
je 0x1800020d4
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x1800020b2
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.180005ce0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r15
mov word [rsp + 0x38], r15w
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.180005080
nop
jmp 0x180002127
call fcn.180001f70
mov rbx, rax
lea rax, [rsp + 0x38]
cmp rax, rbx
je 0x180002127
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x180002105
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.180005ce0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r15
mov word [rsp + 0x38], r15w
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.180005080
nop
mov r8, qword [rsp + 0x70]
cmp r8, 8
jb 0x180002144
inc r8
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.180005ce0
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call fcn.18001d184
mov ebx, eax
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x180002179
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.180005ce0
mov eax, ebx
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.180018080
add rsp, 0x898
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1800021a0
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x888
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x18004e3a0]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
mov rbp, rcx
mov qword [rsp + 0x40], rdx
mov rsi, qword [rsp + 0x8e0]
xor edi, edi
mov dword [rsp + 0x30], edi
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x70]
call fcn.18001b5d0
lea rax, [rbp + 0xf0]
cmp qword [rax + 0x18], 8
jb 0x18000220d
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x70]
mov r8, rsi
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
cmp qword [rbx + 0x18], 8
jb 0x180002246
mov rax, qword [rbx]
jmp 0x180002249
mov rax, rbx
mov word [rax], di
cmp word [rsp + 0x70], di
je 0x18000226a
lea rax, [rsp + 0x70]
or rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x180002260
mov r8, rdi
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.180005b90
mov dword [rsp + 0x30], 1
cmp qword [rbx + 0x18], 8
jb 0x18000228e
mov rax, qword [rbx]
jmp 0x180002291
mov rax, rbx
mov r11, rsi
sub r11, rax
nop word [rax + rax]
movzx r10d, word [rax]
movzx edx, word [rax + r11]
sub r10d, edx
jne 0x1800022b6
add rax, 2
test edx, edx
jne 0x1800022a0
test r10d, r10d
jne 0x180002308
mov qword [rsp + 0x20], rsi
mov r9, r15
mov r8, r14
lea rdx, [rsp + 0x48]
mov rcx, rbp
cmp byte [rbp + 1], r10b
je 0x1800022db
call fcn.180001e70
jmp 0x1800022e0
call fcn.180001f70
mov rdx, rax
mov rcx, rbx
call fcn.180001930
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x180002308
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.180005ce0
mov rax, rbx
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.180018080
add rsp, 0x888
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180002520
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x18004e3a0]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp qword [rcx + 0x48], 8
lea r8, [rcx + 0x30]
mov rbx, rcx
jb 0x18000254c
mov r8, qword [r8]
lea r9, str.Config
lea rdx, str._s_s_
lea rcx, [rsp + 0x20]
call fcn.180005ee0
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18000257d
lea rcx, [rsp + 0x20]
call fcn.180005f40
lea rax, [rsp + 0x20]
sub rax, 2
nop word [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x180002590
movups xmm0, xmmword [str.Related.ini]
movsd xmm1, qword [0x180036b00]
movups xmmword [rax], xmm0
movsd qword [rax + 0x10], xmm1
cmp word [rsp + 0x20], 0
jne 0x1800025bf
xor r8d, r8d
jmp 0x1800025db
lea rax, [rsp + 0x20]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800025d0
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x20]
call fcn.180005b90
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180018080
add rsp, 0x240
pop rbx
ret
Function at 0x180002cd0
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x18004e3a0]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp qword [rcx + 0x48], 8
lea r8, [rcx + 0x30]
mov rbx, rcx
jb 0x180002cfc
mov r8, qword [r8]
lea r9, str.Config
lea rdx, str._s_s_
lea rcx, [rsp + 0x20]
call fcn.180005ee0
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180002d2d
lea rcx, [rsp + 0x20]
call fcn.180005f40
lea rax, [rsp + 0x20]
sub rax, 2
nop word [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x180002d40
mov ecx, dword [0x180036b48]
movups xmm0, xmmword [str.Config.ini]
movups xmmword [rax], xmm0
mov dword [rax + 0x10], ecx
movzx ecx, word [0x180036b4c]
mov word [rax + 0x14], cx
cmp word [rsp + 0x20], 0
jne 0x180002d76
xor r8d, r8d
jmp 0x180002d8b
lea rax, [rsp + 0x20]
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x180002d80
lea rcx, [rbx + 0x50]
lea rdx, [rsp + 0x20]
call fcn.180005b90
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180018080
add rsp, 0x240
pop rbx
ret

Function at 0x180002e70
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x18004e3a0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.18001b5d0
xor r9d, r9d
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [rsp + 0x20], 0
jne 0x180002ec1
xor r8d, r8d
jmp 0x180002edb
lea rax, [rsp + 0x20]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180002ed0
add rbx, 0x170
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180005b90
mov r8d, 1
lea rdx, [0x180036804]
mov rcx, rbx
call fcn.180005680
cmp qword [rbx + 0x18], 8
jb 0x180002f10
mov rcx, qword [rbx]
jmp 0x180002f13
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180002f30
lea r8d, [rax + 0x11]
mov rcx, rbx
lea rdx, str.C:Program_Files_
call fcn.180005b90
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180018080
add rsp, 0x240
pop rbx
ret
Function at 0x180003fd0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x248
mov rax, qword [0x18004e3a0]
xor rax, rsp
mov qword [rsp + 0x230], rax
movzx eax, byte [0x18004f4c8]
test al, al
jne 0x180004082
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.18001b5d0
mov r9d, 1
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x19]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x18000407b
lea rcx, [rsp + 0x20]
call fcn.180020810
lea rdx, str.config_systemprofile
lea rcx, [rsp + 0x20]
call fcn.18001ab58
test rax, rax
jne 0x18000405b
lea rdx, str.cocuments_and_settingslocalService
lea rcx, [rsp + 0x20]
call fcn.18001ab58
test rax, rax
je 0x18000407b
mov al, 1
mov byte [0x18004f4c8], al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180018080
add rsp, 0x248
ret
movzx eax, byte [0x18004f4c8]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180018080
add rsp, 0x248
ret
Function at 0x1800049a0
Capabilities:
Read .ini file

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x18004e3a0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov r15, rcx
lea rdx, [rcx + 0xb0]
cmp qword [rdx + 0x18], 8
jb 0x1800049ee
mov rdx, qword [rdx]
or r12, 0xffffffffffffffff
xor esi, esi
cmp word [rdx], si
jne 0x1800049fe
mov r8d, esi
jmp 0x180004a0b
mov r8, r12
inc r8
cmp word [rdx + r8*2], si
jne 0x180004a01
lea r14, [rcx + 0x110]
mov rcx, r14
call fcn.180005b90
mov r8d, 0x12
lea rdx, str.PuddingDesktop.ini
mov rcx, r14
call fcn.180005680
lea r13, [0x180036bec]
mov qword [rsp + 0x20], r13
lea r9, str.Spreader
lea r8, str.AppInfo
lea rdx, [rsp + 0x38]
mov rcx, r15
call fcn.180001f30
nop
lea rdi, [r15 + 0x130]
lea rax, [rsp + 0x38]
cmp rdi, rax
je 0x180004a7b
mov r9, r12
xor r8d, r8d
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.180005a50
cmp qword [rdi + 0x18], 8
jb 0x180004a87
mov rcx, qword [rdi]
jmp 0x180004a8a
mov rcx, rdi
mov r9, qword [rdi + 0x10]
mov ebx, 2
mov r8d, ebx
cmp r9, rbx
cmovb r8, r9
lea ebp, [rbx - 1]
test r8, r8
je 0x180004ac9
mov rdx, r13
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x180004abd
add rcx, rbx
add rdx, rbx
sub r8, rbp
jne 0x180004aa8
jmp 0x180004ac9
mov r8d, ebp
cmp word [rcx], ax
cmovb r8d, r12d
jmp 0x180004acc
mov r8d, esi
test r8d, r8d
jne 0x180004b6b
cmp r9, rbx
jb 0x180004b6b
ja 0x180004b6b
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x80]
call fcn.18001b5d0
cmp qword [r14 + 0x18], 8
jb 0x180004b03
mov r14, qword [r14]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x80]
mov r8, r13
lea rdx, str.Spreader
lea rcx, str.AppInfo
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [rsp + 0x80], 0
jne 0x180004b3f
mov r8, rsi
jmp 0x180004b5b
lea rax, [rsp + 0x80]
mov r8, r12
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180004b50
lea rdx, [rsp + 0x80]
mov rcx, rdi
call fcn.180005b90
mov rcx, rdi
lea r8, [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x180004b7c
mov rcx, qword [rcx]
mov r8, qword [r8]
cmp r8, rbx
cmovb rbx, r8
test rbx, rbx
je 0x180004bad
mov rdx, r13
nop
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x180004ba7
add rcx, 2
add rdx, 2
sub rbx, rbp
jne 0x180004b90
jmp 0x180004bad
cmovb ebp, r12d
mov esi, ebp
test esi, esi
jne 0x180004c00
cmp r8, 2
jne 0x180004c00
mov qword [rsp + 0x20], r13
lea r9, str.Spreader
lea r8, str.AppInfo
lea rdx, [rsp + 0x58]
mov rcx, r15
call fcn.1800021a0
mov rdx, rax
mov rcx, rdi
call fcn.180001930
mov r8, qword [rsp + 0x70]
cmp r8, 8
jb 0x180004c00
inc r8
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.180005ce0
nop
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x180004c1d
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.180005ce0
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.180018080
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret