joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800089a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
lea rcx, [0x180032458]
jmp fcn.180008ad0

Function at 0x180008ad0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x58
mov qword [rsp + 0x20], 0xfffffffffffffffe
lea rdi, [0x180042058]
mov qword [rsp + 0x28], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov eax, dword [0x180042110]
test al, 1
jne 0x180008b32
test al, 2
jne 0x180008b32
shr eax, 0x11
test al, 1
jne 0x180008b32
lea rax, [0x1800081b0]
cmp qword [0x180040190], rax
je 0x180008bc9
lea r9, [rsp + 0x78]
mov r8, qword [rsp + 0x70]
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.18000b880
nop
lea rcx, [rsp + 0x38]
call fcn.18000c3d0
mov ecx, dword [0x180042054]
cmp ecx, 0xffffffff
je 0x180008ba9
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x180008ba1
lea ecx, [rax + 0x18]
call fcn.1800186b0
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180008b8b
mov rcx, rax
call fcn.1800081c0
mov rbx, rax
jmp 0x180008b8d
xor ebx, ebx
test rbx, rbx
je 0x180008ba9
mov rdx, rbx
mov ecx, dword [0x180042054]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, rbx
call fcn.180009170
lea rcx, [rsp + 0x38]
call fcn.18000c3d0
mov rdx, rax
xor ecx, ecx
call fcn.180009240
nop
lea rcx, [rsp + 0x38]
call fcn.18000b9b0
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x180008c20
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbp
mov rbp, rcx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r14d, eax
test eax, eax
je 0x180008d38
xor ebx, ebx
mov qword [rsp + 0x28], rbx
xor esi, esi
mov dword [rsp + 0x30], esi
lea edi, [rax + rax]
xor ecx, ecx
test edi, edi
jne 0x180008c7b
call fcn.1800177ec
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rbx
jmp 0x180008c95
mov edx, edi
call fcn.180017b64
test rax, rax
je 0x180008c95
mov rbx, rax
mov qword [rsp + 0x28], rax
mov esi, edi
mov dword [rsp + 0x30], edi
test edi, edi
jne 0x180008cae
mov rcx, rbx
call fcn.1800177ec
mov dword [rsp + 0x30], edi
xor ebx, ebx
mov qword [rsp + 0x28], rbx
jmp 0x180008ccd
cmp edi, esi
je 0x180008ccd
mov edx, edi
mov rcx, rbx
call fcn.180017b64
test rax, rax
je 0x180008d30
mov rbx, rax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], edi
mov r8d, r14d
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x180008d30
cmp word [rbx], 0x30
jne 0x180008d04
movzx eax, word [rbx + 2]
sub ax, 0x58
mov ecx, 0xffdf
test cx, ax
jne 0x180008d04
lea rcx, [rbx + 4]
mov r8d, MsiDatabaseExportA
jmp 0x180008d0d
mov r8d, 0xa
mov rcx, rbx
lea rdx, [rsp + 0x68]
call fcn.180018b5c
mov edi, eax
mov rax, qword [rsp + 0x68]
cmp word [rax], 0
jne 0x180008d30
mov rcx, rbx
call fcn.1800177ec
mov eax, edi
jmp 0x180008d3a
mov rcx, rbx
call fcn.1800177ec
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x180008db0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rbx, rdx
mov rdi, rcx
lea rsi, [0x18002fa44]
mov qword [rax - 0x20], rsi
lea rcx, [rax - 0x18]
call fcn.18000b960
nop
mov r9, rbx
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.18000b880
nop
cmp byte [0x180042114], 0
jne 0x180008e5f
cmp byte [0x1800401d0], 0
je 0x180008e41
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
lea rcx, [0x180042118]
call fcn.18000c3b0
mov r8, rax
mov dword [rsp + 0x20], edi
mov r9d, ebx
lea rdx, str._s__lu._lu_
lea rcx, [rsp + 0x58]
call fcn.180008be0
jmp 0x180008e5f
lea rcx, [0x180042118]
call fcn.18000c3d0
mov rbx, rax
lea rcx, [rsp + 0x60]
call fcn.18000bd70
mov qword [rsp + 0x58], rbx
mov rbx, qword [rsp + 0x58]
lea rcx, [rsp + 0x48]
call fcn.18000c3d0
lea rcx, [0x180032008]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, rsi
lea rdx, [0x180032010]
lea rcx, [rsp + 0x38]
call fcn.18000b8f0
nop
lea rcx, [rsp + 0x38]
call fcn.18000c3d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
lea rcx, [rsp + 0x38]
call fcn.18000b9b0
nop
lea rcx, [rsp + 0x48]
call fcn.18000b9b0
nop
lea rcx, [rsp + 0x60]
call fcn.18000b9b0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x180008ee0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x58], rsi
mov rbp, rdx
mov esi, ecx
xor ebx, ebx
mov ecx, dword [0x180042054]
cmp ecx, 0xffffffff
je 0x180008f57
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x180008f54
lea ecx, [rbx + 0x18]
call fcn.1800186b0
mov qword [rsp + 0x50], rax
test rax, rax
je 0x180008f3d
mov rcx, rax
call fcn.1800081c0
mov rdi, rax
jmp 0x180008f40
mov rdi, rbx
test rdi, rdi
je 0x180008f57
mov rdx, rdi
mov ecx, dword [0x180042054]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, rdi
test sil, 2
jne 0x180008f79
test sil, 1
je 0x180008f79
test rbx, rbx
je 0x180008f75
mov r8, rbp
mov edx, esi
mov rcx, rbx
call fcn.180008550
mov al, 1
jmp 0x180008f88
test rbx, rbx
je 0x180008f86
mov rcx, rbx
call fcn.180009170
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1800091d0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x30], 0xfffffffffffffffe
test cl, 8
lea rcx, [0x18002fa44]
lea rax, [0x180032008]
cmovne rax, rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
mov r9, r8
mov r8, rdx
lea rdx, [0x180032010]
lea rcx, [rsp + 0x38]
call fcn.18000b8f0
nop
lea rcx, [rsp + 0x38]
call fcn.18000c3d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
lea rcx, [rsp + 0x38]
call fcn.18000b9b0
add rsp, 0x58
ret
Function at 0x180009240
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rbp, rdx
mov esi, ecx
lea r15, [0x18002fa44]
mov qword [rax - 0x30], r15
lea rcx, [rax - 0x28]
call fcn.18000b960
nop
lea rcx, [rsp + 0x38]
call fcn.18000b960
nop
test sil, 4
je 0x180009332
mov rcx, rbp
call qword [0x180040190]
bt esi, 0xd
jb 0x1800092a7
test byte [0x180042110], 1
je 0x1800092e9
test sil, 8
je 0x1800092b8
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1800092e9
mov r8, rbp
lea rdx, str._s_n_n
lea rcx, [rsp + 0x48]
call fcn.18000b8f0
nop
mov rcx, rax
call fcn.18000c3d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
lea rcx, [rsp + 0x48]
call fcn.18000b9b0
mov eax, dword [0x180042110]
shr eax, 0x11
test al, 1
je 0x180009314
test sil, 8
lea r8, [0x180032008]
cmovne r8, r15
mov rdx, rbp
lea rcx, [0x180030fb0]
call fcn.180018b68
mov ecx, esi
call fcn.180008fa0
test al, al
je 0x180009486
mov rdx, rbp
mov ecx, esi
call fcn.18000a0a0
jmp 0x180009486
cmp byte [0x180042114], 0
jne 0x18000939b
cmp byte [0x1800401d0], 0
je 0x18000937d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
lea rcx, [0x180042118]
call fcn.18000c3b0
mov r8, rax
mov dword [rsp + 0x20], edi
mov r9d, ebx
lea rdx, str._s__lu._lu_
lea rcx, [rsp + 0x58]
call fcn.180008be0
jmp 0x18000939b
lea rcx, [0x180042118]
call fcn.18000c3d0
mov rbx, rax
lea rcx, [rsp + 0x60]
call fcn.18000bd70
mov qword [rsp + 0x58], rbx
xor r8d, r8d
mov rdi, rbp
movzx eax, word [rdi]
cmp eax, 0xa
je 0x1800093ae
cmp eax, 0xd
jne 0x1800093b7
inc r8d
add rdi, 2
jmp 0x1800093a1
test r8d, r8d
je 0x1800093d1
cmp word [rdi], 0
je 0x1800093d1
mov rdx, rbp
lea rcx, [rsp + 0x38]
call fcn.18000bd10
jmp 0x1800093de
mov rdi, rbp
lea rcx, [rsp + 0x38]
call fcn.18000bd70
mov rcx, rbp
call qword [0x180040190]
bt esi, 0xd
jb 0x1800093f7
mov eax, dword [0x180042110]
test al, 1
je 0x18000941c
mov rbx, qword [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.18000c3d0
mov rdx, rax
mov r9, rdi
mov r8, rbx
mov ecx, esi
call fcn.1800091d0
mov eax, dword [0x180042110]
shr eax, 0x11
test al, 1
je 0x18000945b
mov rbx, qword [rsp + 0x58]
test sil, 8
lea r14, [0x180032008]
cmovne r14, r15
lea rcx, [rsp + 0x38]
call fcn.18000c3b0
mov rdx, rax
mov qword [rsp + 0x20], r14
mov r9, rdi
mov r8, rbx
lea rcx, [0x180032010]
call fcn.180018b68
mov ecx, esi
call fcn.180008fa0
test al, al
je 0x180009486
mov rbx, qword [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.18000c3d0
mov rdx, rax
mov r9, rdi
mov r8, rbx
mov ecx, esi
call fcn.18000a1f0
nop
lea rcx, [rsp + 0x38]
call fcn.18000b9b0
nop
lea rcx, [rsp + 0x60]
call fcn.18000b9b0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1800094c0
Capabilities:
Move file

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0xa0
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x180040420]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rbx, rdx
mov rbp, rcx
lea rcx, [r11 - 0x78]
call fcn.18000b960
nop
lea rcx, [rsp + 0x50]
call fcn.18000b960
nop
lea rcx, [rsp + 0x60]
call fcn.18000b960
nop
test rbx, rbx
jne 0x180009531
lea rbx, [rsp + 0x88]
lea rcx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
xor esi, esi
lea r14, [0x180032024]
nop word [rax + rax]
movzx ecx, word [rbx + 0xa]
test cx, cx
jne 0x18000959e
cmp word [rbx + 0xc], cx
jne 0x18000959e
movzx eax, word [rbx + 8]
movzx r9d, word [rbx + 2]
movzx r8d, word [rbx]
test ax, ax
je 0x180009583
movzx eax, ax
movzx ecx, word [rbx + 6]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str._04u__02u__02u__02u
lea rcx, [rsp + 0x50]
call fcn.18000be30
jmp 0x1800095d9
movzx eax, word [rbx + 6]
mov dword [rsp + 0x20], eax
lea rdx, str._04u__02u__02u
lea rcx, [rsp + 0x50]
call fcn.18000be30
jmp 0x1800095d9
movzx eax, word [rbx + 0xc]
movzx ecx, cx
movzx edx, word [rbx + 8]
movzx r10d, word [rbx + 6]
movzx r9d, word [rbx + 2]
movzx r8d, word [rbx]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
lea rdx, str._04u__02u__02u__02u__02u__02u
lea rcx, [rsp + 0x50]
call fcn.18000be30
lea rcx, [rsp + 0x60]
test esi, esi
jne 0x1800095e9
call fcn.18000bd70
jmp 0x1800095f8
mov r8d, esi
lea rdx, str._03u
call fcn.18000be30
lea rcx, [rsp + 0x60]
call fcn.18000c3b0
mov rdi, rax
lea rcx, [rsp + 0x50]
call fcn.18000c3b0
mov r8, rax
mov r9, rdi
lea rdx, str.__s_s
lea rcx, [rsp + 0x70]
call fcn.18000b8f0
nop
mov rcx, rax
call fcn.18000c3d0
mov r8, qword [0x1800401a8]
lea rdx, [0x18002fa44]
cmp word [r8], 0
cmovne rdx, r14
lea rcx, [0x18002fa44]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
mov r9, qword [str.Debug]
mov r8, qword [0x180040198]
lea rdx, [0x180032028]
lea rcx, [rsp + 0x40]
call fcn.18000be30
nop
lea rcx, [rsp + 0x70]
call fcn.18000b9b0
lea rcx, [rsp + 0x40]
call fcn.18000c3d0
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1800096e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1800096c2
inc esi
cmp esi, 0x3e8
jb 0x180009540
lea rcx, [rsp + 0x40]
call fcn.18000c3b0
mov r8, rax
mov rdx, rbp
lea rcx, str.Name_collision_renaming_log_path___s__to_n______s_
call fcn.180008d50
xor bl, bl
jmp 0x180009700
lea rcx, [rsp + 0x40]
call fcn.18000c3b0
mov r8, rax
mov rdx, rbp
lea rcx, str.Log_path___s__renamed_to_n______s_
call fcn.180008d80
mov bl, 1
lea rcx, [rsp + 0x60]
call fcn.18000b9b0
nop
lea rcx, [rsp + 0x50]
call fcn.18000b9b0
nop
lea rcx, [rsp + 0x40]
call fcn.18000b9b0
movzx eax, bl
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.180016e40
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180009e90
Capabilities:
Terminate thread

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rdi, rcx
lea rbx, [rcx + 0x20]
mov qword [rsp + 0x40], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp qword [rdi], 0
je 0x180009f30
mov byte [rdi + 0x5c], 1
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [0x1800401d4]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x180009eed
or edx, 0xffffffff
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x180009f04
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x18], 0
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x180009f1b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x10], 0
mov rcx, qword [rdi]
test rcx, rcx
je 0x180009f30
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], 0
test rbx, rbx
je 0x180009f3e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x18000a0a0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rbx, rdx
mov edi, ecx
lea rax, [0x18002fa44]
mov qword [r11 - 0x20], rax
lea rcx, [r11 - 0x18]
call fcn.18000b960
nop
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.180009f50
mov r8, qword [rsp + 0x58]
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.18000b690
nop
test dil, 8
lea rcx, [0x180032234]
lea rbx, [0x180032238]
cmovne rbx, rcx
mov rcx, rax
call fcn.18000c390
mov r8, rax
mov r9, rbx
lea rdx, [0x1800322ec]
lea rcx, [rsp + 0x38]
call fcn.18000b720
nop
lea rcx, [rsp + 0x48]
call fcn.18000b9b0
lea rcx, [rsp + 0x38]
call fcn.18000c4b0
mov ebx, eax
lea rcx, [rsp + 0x38]
call fcn.18000c390
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x90]
mov r8d, ebx
mov rdx, rax
mov rcx, qword [0x1800401d8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18000a1c4
lea rcx, [rsp + 0x80]
call fcn.18000b980
mov edx, dword [rsp + 0x80]
lea rcx, [rsp + 0x48]
call fcn.18000b930
nop
mov rcx, rax
call fcn.18000c3b0
mov rbx, rax
lea rcx, [rsp + 0x38]
call fcn.18000c4b0
mov edx, eax
mov r9d, dword [rsp + 0x80]
mov r8, rbx
lea rcx, str.Unable_to_write__lu_bytes_to_log_file.__s._Error_code___lu.
call fcn.180008d50
nop
lea rcx, [rsp + 0x48]
call fcn.18000b9b0
nop
lea rcx, [rsp + 0x38]
call fcn.18000b9b0
nop
lea rcx, [rsp + 0x60]
call fcn.18000b9b0
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x18000b570
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x48
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000b5b7
cmp dword [rsp + 0x30], 4
jne 0x18000b5b2
cmp dword [rsp + 0x68], 4
jne 0x18000b5b2
mov al, 1
add rsp, 0x48
ret
mov eax, 0x70c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
add rsp, 0x48
ret

Function at 0x18000b5d0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
lea rax, [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x18000b60d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
add rsp, 0x38
ret
mov al, 1
add rsp, 0x38
ret

Function at 0x18000b620
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r10, rcx
or rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [r8 + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x18000b630
lea ecx, [rax*2 + 2]
mov r9d, 2
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x18000b672
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
add rsp, 0x38
ret
mov al, 1
add rsp, 0x38
ret
Function at 0x18000c130
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov r12d, r9d
mov r15, r8
mov rbx, rdx
mov r14, rcx
mov rax, rdx
shr rax, 0x10
xor ecx, ecx
test ax, ax
jne 0x18000c303
movzx ebx, dx
xor esi, esi
mov edi, esi
mov qword [r11 - 0x40], rsi
mov dword [rsp + 0x30], esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbp, rax
mov ecx, ebx
shr ecx, 4
inc cx
movzx edx, cx
lea r8d, [rsi + 6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x18000c21f
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18000c21f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r8, rax
test rax, rax
je 0x18000c21f
and ebx, 0xf
jbe 0x18000c1e1
mov edx, ebx
nop
movzx eax, word [r8]
inc eax
cdqe
lea r8, [r8 + rax*2]
dec rdx
jne 0x18000c1d0
movzx eax, word [r8]
test ax, ax
je 0x18000c21f
movzx edx, ax
lea rbp, [r8 + 2]
lea rcx, [rsp + 0x28]
call fcn.18000cb30
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x18000c21f
mov eax, dword [rsp + 0x30]
lea rbx, [rax + rax]
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.180017c50
mov word [rbx + rdi], si
mov ebx, 1
or rbp, 0xffffffffffffffff
test rdi, rdi
jne 0x18000c26f
mov eax, 2
mul rbx
cmovo rax, rbp
mov rcx, rax
call fcn.180016d3c
mov rdi, rax
test rax, rax
jne 0x18000c263
mov dword [rsp + 0x78], 2
lea rdx, [0x18003e3b0]
lea rcx, [rsp + 0x78]
call fcn.180018c14
int3
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], esi
mov word [rax], si
mov r9, r15
mov r8, rdi
xor edx, edx
xor ecx, ecx
call fcn.180018484
cmp eax, r12d
cmova eax, r12d
mov edx, eax
mov rcx, r14
call fcn.18000cb30
cmp qword [r14], 0
je 0x18000c2f9
test rdi, rdi
jne 0x18000c2dc
mov eax, 2
mul rbx
cmovo rax, rbp
mov rcx, rax
call fcn.180016d3c
mov rdi, rax
test rax, rax
jne 0x18000c2d0
mov dword [rsp + 0x78], 2
lea rdx, [0x18003e3b0]
lea rcx, [rsp + 0x78]
call fcn.180018c14
int3
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], esi
mov word [rax], si
mov edx, dword [r14 + 8]
mov r9, r15
mov r8, rdi
mov rcx, qword [r14]
call fcn.180018484
mov edx, dword [r14 + 8]
mov rax, qword [r14]
mov word [rax + rdx*2], si
mov rcx, rdi
call fcn.180017754
jmp 0x18000c345
mov r9, r8
mov r8, rdx
xor edx, edx
call fcn.180018484
cmp eax, r12d
cmova eax, r12d
mov edx, eax
mov rcx, r14
call fcn.18000cb30
mov rcx, qword [r14]
test rcx, rcx
je 0x18000c345
mov edx, dword [r14 + 8]
mov r9, r15
mov r8, rbx
call fcn.180018484
mov ecx, dword [r14 + 8]
mov rax, qword [r14]
xor esi, esi
mov word [rax + rcx*2], si
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x18000c4c0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov esi, ecx
mov edx, ecx
xor r9d, r9d
mov ecx, 0x400
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
test eax, eax
mov eax, 2
jne 0x18000c51a
mov ecx, 1
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180016d3c
test rax, rax
je 0x18000c563
xor ecx, ecx
mov word [rax], cx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mul rbx
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x30], rdi
cmovo rax, rcx
mov rcx, rax
call fcn.180016d3c
mov rdi, rax
test rax, rax
je 0x18000c57d
mov r9d, ebx
mov r8, rax
mov edx, esi
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret
lea rdx, [0x18003e3b0]
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x38], 2
call fcn.180018c14
int3
lea eax, [rbx + rbx]
lea rdx, [0x18003e3b0]
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x38], eax
call fcn.180018c14
int3

Function at 0x18000c850
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov ebx, edx
mov rsi, rcx
test r8, r8
jne 0x18000c877
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
mov r8d, ebx
mov rcx, rdi
shr r8d, 4
inc r8w
movzx edx, r8w
mov r8d, 6
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x18000c96e
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18000c96e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rax
test rax, rax
je 0x18000c96e
and ebx, 0xf
jbe 0x18000c8e0
mov r8d, ebx
movzx eax, word [rdx]
inc eax
cdqe
lea rdx, [rdx + rax*2]
dec r8
jne 0x18000c8d0
movzx eax, word [rdx]
test ax, ax
je 0x18000c96e
lea rdi, [rdx + 2]
movzx ebx, ax
mov qword [rsp + 0x50], rbp
xor ebp, ebp
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov r8, rdi
mov r9d, ebx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x18000c969
mov edx, eax
mov rcx, rsi
call fcn.18000ca60
mov rdx, qword [rsi]
test rdx, rdx
je 0x18000c969
mov eax, dword [rsi + 8]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, ebx
xor edx, edx
mov r8, rdi
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [rsi + 8]
mov rax, qword [rsi]
mov byte [rcx + rax], bpl
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret