joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004ebd0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov edi, 1
test rcx, rcx
je 0x18004ec15
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x18004ec15
mov rcx, qword [rbx + 8]
lea edx, [rdi - 0x15]
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [0x180142e20]
bt eax, 0x16
cmovb ecx, edi
mov dword [0x180142e20], ecx
cmp dword [rbx + 0x67c], 0
je 0x18004ed04
cmp qword [rbx + 0x5a8], 8
jb 0x18004ec35
mov rcx, qword [rbx + 0x590]
jmp 0x18004ec3c
lea rcx, [rbx + 0x590]
test rcx, rcx
je 0x18004ec90
xor edx, edx
call fcn.1800c4e50
test eax, eax
jne 0x18004ec90
mov rcx, rbx
call fcn.1800545b0
test eax, eax
jne 0x18004ec60
mov rcx, rbx
call fcn.180054660
cmp dword [rbx + 0x67c], 0
je 0x18004ed04
mov rcx, rbx
call fcn.180051f80
test eax, eax
jne 0x18004ed04
cmp qword [rbx + 0x338], 8
jb 0x18004ecee
mov rcx, qword [rbx + 0x320]
jmp 0x18004ecf5
xor edx, edx
mov rcx, rbx
call fcn.1800521c0
test eax, eax
jne 0x18004ec60
cmp qword [rbx + 0x338], 8
jb 0x18004eccb
mov rcx, qword [rbx + 0x320]
lea rdx, str.ConfigUpdate
xor r8d, r8d
call fcn.18006f2a0
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rcx, [rbx + 0x320]
lea rdx, str.ConfigUpdate
xor r8d, r8d
call fcn.18006f2a0
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rcx, [rbx + 0x320]
lea rdx, str.ConfigUpdate
xor r8d, r8d
call fcn.18006f2a0
mov rcx, qword [rbx + 8]
mov r9d, 9
xor r8d, r8d
mov edx, 0x454
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 8]
xor r9d, r9d
lea r8d, [r9 + 0x20]
mov edx, 0x41e
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 8]
xor r9d, r9d
mov r8, rdi
mov edx, 0x43c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 8]
xor r9d, r9d
lea r8d, [r9 + 5]
mov edx, 0x2007
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 8]
xor r9d, r9d
mov r8, rdi
mov edx, 0x2005
call qword [sym.imp.USER32.dll_SendMessageW]
cmp qword [rbx + 0x820], 0
jne 0x18004ee1d
cmp dword [rbx + 0x67c], 0
je 0x18004ee1d
cmp qword [rbx + 0x818], 0
jne 0x18004edae
xor r9d, r9d
xor r8d, r8d
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x818], rax
cmp qword [rbx + 0x828], 0
jne 0x18004edcf
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x828], rax
cmp qword [rbx + 0x830], 0
jne 0x18004edf0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x830], rax
xor ecx, ecx
lea rax, [rsp + 0x40]
lea r8, [0x180054780]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x40], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x820], rax
call fcn.180051560
mov rcx, rbx
call fcn.180056b70
mov rbx, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1800517a0
Capabilities:
Reference http user-agent string

Disassembly:
push rdi
sub rsp, 0x870
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x888], rbx
mov rax, qword [0x18013a210]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x3ff
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x60]
call fcn.1800c1250
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x60]
xor ecx, ecx
call sub.urlmon.dll_ObtainUserAgentString
test eax, eax
jne 0x18005195e
mov qword [rsp + 0x50], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x48], 0
mov byte [rsp + 0x38], al
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x60]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.180003710
nop
cmp qword [rbx + 0x488], 0
jne 0x18005189c
mov r8d, 5
lea rdx, str.10920
lea rcx, [rbx + 0x470]
call fcn.180012d90
cmp qword [rbx + 0x460], 0
je 0x18005189c
mov r8d, 1
lea rdx, [0x1801070a8]
lea rcx, [rbx + 0x470]
call fcn.180010af0
lea rdx, [rbx + 0x448]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbx + 0x470]
call fcn.180011460
call fcn.180051560
mov rdi, rax
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rsp + 0x461]
call fcn.1800c1250
lea r9, [rsp + 0x460]
mov r8, rdi
lea rdx, str.WUID
lea rcx, [rsp + 0x30]
call fcn.1800516c0
movzx edi, al
cmp qword [rbx + 0x490], 8
jb 0x1800518eb
mov rbx, qword [rbx + 0x478]
jmp 0x1800518f2
add rbx, 0x478
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rsp + 0x461]
call fcn.1800c1250
lea r9, [rsp + 0x460]
mov r8, rbx
lea rdx, [0x1801008c0]
lea rcx, [rsp + 0x30]
call fcn.1800516c0
or dil, al
je 0x18005194c
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
xor r9d, r9d
mov r8d, dword [rsp + 0x48]
mov ecx, 0x10000001
call sub.urlmon.dll_UrlMkSetSessionOption
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18005195e
mov rcx, qword [rsp + 0x38]
call fcn.1800bd964
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.1800bd980
mov rbx, qword [rsp + 0x888]
add rsp, 0x870
pop rdi
ret
Function at 0x1800545b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
lea rax, [rsp + 0x30]
xor ebx, ebx
lea rdx, str.SoftwareAppDataLowSoftwareSimplytechZooBar
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180054657
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rdi
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
lea rdx, str.ConfigUpdate
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x68], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x58], 4
jne 0x18005463c
test eax, eax
cmove ebx, dword [rsp + 0x60]
test rdi, rdi
je 0x18005464a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rdi, qword [rsp + 0x50]
add rsp, 0x40
pop rbx
ret
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x180054660
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
sub rsp, 0x60
lea rcx, [rax + 0x20]
xor esi, esi
mov qword [rax + 0x20], rsi
call fcn.1800c0260
movsxd rdi, dword [rsp + 0x98]
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareAppDataLowSoftwareSimplytechZooBar
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov rbx, rsi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r8d, r8d
test eax, eax
jne 0x1800546be
mov rbx, qword [rsp + 0x50]
jmp 0x18005470e
lea rax, [rsp + 0x90]
lea rdx, str.SoftwareAppDataLowSoftwareSimplytechZooBar
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x58], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180054759
mov rbx, qword [rsp + 0x58]
xor r8d, r8d
lea rax, [rsp + 0x88]
lea rdx, str.ConfigUpdate
mov r9d, 4
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x88], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x98], rdi
test rbx, rbx
je 0x180054759
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
mov edi, dword [rsp + 0x98]
test rbx, rbx
je 0x18005476e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x180054b40
Capabilities:
Check http status code
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x130
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x150], rbx
mov rax, qword [0x18013a210]
xor rax, rsp
mov qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], rax
mov rdi, r9
mov rsi, r8
mov rbx, rdx
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
lea rcx, [rsp + 0x60]
mov rax, qword [str.Accept:___r_n_r_n]
mov qword [rcx], rax
mov rax, qword [0x1801072b8]
mov qword [rcx + 8], rax
mov rax, qword [0x1801072c0]
mov qword [rcx + 0x10], rax
mov rax, qword [0x1801072c8]
mov qword [rcx + 0x18], rax
test rdx, rdx
je 0x180054d58
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, eax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x4000000
lea r8, [rsp + 0x60]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x180054d61
mov dword [rsp + 0x34], RegisterTypeLib
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x80]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetLBound
mov rcx, rax
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x180054c64
lea rcx, [rsp + 0x80]
call fcn.1800bf9c8
cmp eax, 0x194
je 0x180054c4c
cmp eax, 0x1f4
jb 0x180054c64
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x180054d61
lea rdx, [0x1801072d0]
mov rcx, rdi
call fcn.1800bdbec
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x180054c98
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x180054d61
mov dword [rsp + 0x30], r12d
mov edx, 0x10000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
nop dword [rax]
xor edx, edx
mov r8d, 0x10000
mov rcx, rdi
call fcn.1800c1250
lea r9, [rsp + 0x30]
mov r8d, 0xffff
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
mov r11d, dword [rsp + 0x30]
test r11d, r11d
je 0x180054d0c
mov rdx, r11
mov r9, rbx
mov r8d, 1
mov rcx, rdi
call fcn.1800be1d4
cmp dword [rsp + 0x30], 0
jne 0x180054cc0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test rbx, rbx
je 0x180054d45
mov rcx, rbx
call fcn.1800be7c0
mov rcx, rbx
call fcn.1800bdc84
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov eax, 1
jmp 0x180054d61
mov rcx, qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal]
xor rcx, rsp
call fcn.1800bd980
mov rbx, qword [rsp + 0x150]
add rsp, 0x130
pop r12
pop rdi
pop rsi
ret
Function at 0x180054e80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rbx, rcx
mov byte [rsp + 0x78], 0
cmp qword [rcx + 0x838], 0
je 0x180054eac
mov al, 1
jmp 0x180054fff
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x818], rax
jne 0x180054ede
xor r9d, r9d
xor r8d, r8d
lea edx, [rax + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x818], rax
cmp qword [rbx + 0x818], 0
jne 0x180054f01
mov dword [rsp + 0x30], 0xffffffff
lea rdx, [0x180136c18]
lea rcx, [rsp + 0x30]
call fcn.1800c1ef0
cmp qword [rbx + 0x840], 0
jne 0x180054f22
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x840], rax
cmp qword [rbx + 0x840], 0
jne 0x180054f45
mov dword [rsp + 0x34], 0xffffffff
lea rdx, [0x180136c18]
lea rcx, [rsp + 0x34]
call fcn.1800c1ef0
mov qword [rsp + 0x48], rbx
mov rax, qword [rbx + 0x818]
mov qword [rsp + 0x58], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x180054f89
mov dword [rsp + 0x38], 0xffffffff
lea rdx, [0x180136c18]
lea rcx, [rsp + 0x38]
call fcn.1800c1ef0
mov dword [rsp + 0x80], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
lea r8, [0x1800550e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x838], rax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jne 0x180054fe9
mov dword [rsp + 0x3c], 0xffffffff
lea rdx, [0x180136c18]
lea rcx, [rsp + 0x3c]
call fcn.1800c1ef0
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, 1
mov byte [rsp + 0x78], al
jmp 0x180054fff
add rsp, 0x60
pop rbx
ret
Function at 0x180057f70
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
lea rcx, [rsp + 0x50]
xor ebp, ebp
mov rsi, rdx
mov qword [rsp + 0x50], rbp
call fcn.1800c0260
movsxd rdi, dword [rsp + 0x50]
lea rax, [rsp + 0x58]
lea rdx, str.SoftwareAppDataLowSoftwareSimplytechZooBar
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov rbx, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x58], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r8d, r8d
test eax, eax
jne 0x180057fd2
mov rbx, qword [rsp + 0x58]
jmp 0x180058022
lea rax, [rsp + 0xa8]
lea rdx, str.SoftwareAppDataLowSoftwareSimplytechZooBar
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x60], rbp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180058066
mov rbx, qword [rsp + 0x60]
xor r8d, r8d
lea rax, [rsp + 0xa0]
mov r9d, 4
mov rdx, rsi
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0xa0], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x50], rdi
test rbx, rbx
je 0x180058066
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rbp
mov edi, dword [rsp + 0x50]
test rbx, rbx
je 0x180058078
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret

Function at 0x180058dd0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
lea rax, [rsp + 0x38]
mov rsi, rcx
lea rdx, str.SoftwareAppDataLowSoftwareSimplytechZooBar
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], 0
mov qword [rsp + 0x38], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180058ed7
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x60]
lea rdx, str.UpdatePrompt24HourSleep
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x60], 4
jne 0x180058e96
test eax, eax
jne 0x180058e96
mov eax, dword [rsp + 0x68]
mov dword [rdi], eax
test rbx, rbx
je 0x180058e81
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
test rbx, rbx
je 0x180058ea6
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
lea rdx, str.UpdatePrompt24HourSleep
mov rcx, rsi
call fcn.180057f70
mov dword [rdi], eax
test rbx, rbx
je 0x180058ec5
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov eax, 1
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180058ef0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
lea rax, [rsp + 0x38]
mov rsi, rcx
lea rdx, str.SoftwareAppDataLowSoftwareSimplytechZooBar
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], 0
mov qword [rsp + 0x38], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180058ff7
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x60]
lea rdx, str.UpdatePrompt30DaySleep
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x60], 4
jne 0x180058fb6
test eax, eax
jne 0x180058fb6
mov eax, dword [rsp + 0x68]
mov dword [rdi], eax
test rbx, rbx
je 0x180058fa1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
test rbx, rbx
je 0x180058fc6
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
lea rdx, str.UpdatePrompt30DaySleep
mov rcx, rsi
call fcn.180057f70
mov dword [rdi], eax
test rbx, rbx
je 0x180058fe5
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov eax, 1
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x18005c070
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rdx + 8]
mov rbx, rdx
cmp eax, 0x100
je 0x18005c08a
cmp eax, 0x104
jne 0x18005c0bb
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x447
call qword [sym.imp.USER32.dll_SendMessageW]
mov r11, qword [rbx + 0x10]
cmp r11, 0xd
je 0x18005c0cd
cmp r11, 0x1b
je 0x18005c0cd
cmp r11, 0x26
je 0x18005c0cd
cmp r11, 0x28
je 0x18005c0cd
mov rcx, rbx
call qword [sym.imp.USER32.dll_TranslateMessage]
mov rcx, rbx
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1800614f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r13
push r14
sub rsp, 0x40
mov edi, r9d
mov r12, r8
mov r13d, edx
mov r14, rcx
xor ebx, ebx
mov esi, ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rbx
mov eax, dword [0x180142ce4]
test eax, eax
je 0x18006153f
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x180142ce4]
test eax, eax
jne 0x18006154c
call fcn.180016a00
test eax, eax
je 0x180061562
lea rdx, [rsp + 0x38]
mov rcx, qword [0x18013c120]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x180061566
xor eax, eax
jmp 0x1800615e0
mov r10, qword [0x180142fd0]
test r10, r10
jne 0x18006158d
lea rcx, str.ImageList_Draw
call fcn.18003e280
mov r10, rax
mov qword [0x180142fd0], rax
test rax, rax
je 0x1800615b1
mov dword [rsp + 0x28], ebx
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, r12
mov edx, r13d
mov rcx, r14
call r10
mov esi, eax
mov dword [rsp + 0x30], eax
mov edi, ebx
test esi, esi
sete dil
test edi, edi
je 0x1800615c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsp + 0x38]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x1800615de
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r13
pop r12
ret
Function at 0x1800627c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push r12
push r15
sub rsp, 0x48
xor r15d, r15d
mov rbp, rdx
mov rsi, rcx
mov dword [rsp + 0x70], r15d
cmp qword [rcx + 0x58], 8
jb 0x1800627e6
mov rdx, qword [rcx + 0x40]
jmp 0x1800627ea
lea rdx, [rcx + 0x40]
lea r12, [rcx + 8]
mov rcx, qword [rcx]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsi + 0x60], eax
test eax, eax
jne 0x1800629a8
cmp qword [rsi + 0x30], 8
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x70], r15d
jb 0x180062831
mov rdx, qword [rsi + 0x18]
jmp 0x180062835
lea rdx, [rsi + 0x18]
mov rcx, qword [r12]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x80]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rdx, dword [rsp + 0x70]
mov eax, 2
mov r13, 0xffffffffffffffff
mul rdx
cmovo rax, r13
mov rcx, rax
call fcn.1800bd95c
cmp qword [rsi + 0x30], 8
mov r14, rax
jb 0x180062889
mov rdx, qword [rsi + 0x18]
jmp 0x18006288d
lea rdx, [rsi + 0x18]
mov rcx, qword [r12]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x80]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsi + 0x60], eax
test eax, eax
jne 0x180062947
xor eax, eax
mov rcx, r13
mov rdi, r14
repne scasw ax, word [rdi]
mov rdx, r14
mov qword [rsp + 0x78], rbx
not rcx
lea r8, [rcx - 1]
lea rcx, [rsi + 0x68]
call fcn.180012d90
mov rcx, r14
call fcn.1800bd9a0
mov rcx, qword [r12]
mov dword [rsi + 0xb8], 1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [r12], r15
lea rdx, [rsi + 0x68]
mov dword [rsi + 0x60], eax
mov qword [rbp + 0x20], 7
mov qword [rbp + 0x18], r15
mov r9, r13
xor r8d, r8d
mov rcx, rbp
mov word [rbp + 8], r15w
call fcn.180003570
mov rbx, qword [rsp + 0x78]
mov rax, rbp
mov r14, qword [rsp + 0x30]
mov r13, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x48
pop r15
pop r12
pop rsi
pop rbp
ret
mov rcx, r14
call fcn.1800bd9a0
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsi + 0x68]
lea rdx, [rsi + 0x90]
mov r9, r13
xor r8d, r8d
mov qword [r12], r15
call fcn.180003570
mov dword [rsi + 0xb8], 1
mov qword [rbp + 0x20], 7
mov qword [rbp + 0x18], r15
lea rdx, [rsi + 0x90]
mov r9, r13
xor r8d, r8d
mov rcx, rbp
mov word [rbp + 8], r15w
call fcn.180003570
mov rax, rbp
jmp 0x18006292d
or r13, 0xffffffffffffffff
lea rcx, [rsi + 0x68]
lea rdx, [rsi + 0x90]
mov r9, r13
xor r8d, r8d
call fcn.180003570
mov qword [rbp + 0x20], 7
mov qword [rbp + 0x18], r15
lea rdx, [rsi + 0x90]
mov r9, r13
xor r8d, r8d
mov rcx, rbp
mov word [rbp + 8], r15w
call fcn.180003570
mov rax, rbp
jmp 0x180062932
Function at 0x180064650
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
sub rsp, 0x30
mov rdi, r8
mov r12, rcx
xor ebx, ebx
mov esi, ebx
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x58], rbx
mov eax, dword [0x180142ce4]
test eax, eax
je 0x180064695
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x180142ce4]
test eax, eax
jne 0x1800646a2
call fcn.180016a00
test eax, eax
je 0x1800646b8
lea rdx, [rsp + 0x58]
mov rcx, qword [0x18013c120]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x1800646bc
xor eax, eax
jmp 0x18006471f
mov rax, qword [0x180142fd8]
test rax, rax
jne 0x1800646e0
lea rcx, str.ImageList_GetImageInfo
call fcn.18003e280
mov qword [0x180142fd8], rax
test rax, rax
je 0x1800646f0
mov r8, rdi
xor edx, edx
mov rcx, r12
call rax
mov esi, eax
mov dword [rsp + 0x20], eax
mov edi, ebx
test esi, esi
sete dil
test edi, edi
je 0x180064704
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x18006471d
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r12
ret