joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140027030
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
lea rdi, [rsp + 0x38]
lea r15, [rsp + 0x28]
lea rbx, [rsp + 0x30]
nop
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x20], r15
mov r8, rbx
mov r9, rdi
call qword [0x1400d3008]
mov ebp, eax
mov r14, qword [rsp + 0x28]
sub r14, rbx
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, r14
call sym.fwrite
mov rcx, rax
mov eax, 0xffffffff
cmp rcx, r14
jne 0x1400270b6
cmp ebp, 1
je 0x140027050
cmp ebp, 2
je 0x1400270b6
mov rcx, qword [rsi + 0x40]
call sym.fflush
mov ecx, eax
xor eax, eax
neg ecx
sbb eax, eax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140027130
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
cmp dx, 0xffff
je 0x14002716d
mov esi, edx
mov rdi, rcx
mov word [rsp + 0x4e], dx
cmp byte [rcx + 0x58], 0
je 0x140027182
mov rdx, qword [rdi + 0x40]
mov ecx, esi
call sym.fputwc
cmp ax, 0xffff
jne 0x14002716f
mov si, 0xffff
jmp 0x14002716f
xor esi, esi
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [rsp + 0x60]
mov qword [rsp + 0x58], rbx
lea r15, [rsp + 0x4e]
lea r12, [rsp + 0x68]
lea r13, [rsp + 0x58]
lea r14, [rsp + 0x50]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, r15
lea r9, [rsp + 0x50]
call qword [0x1400d3008]
cmp qword [rsp + 0x50], r15
je 0x140027167
mov ebp, eax
cmp eax, 3
je 0x140027218
cmp ebp, 1
ja 0x140027167
mov r15, qword [rsp + 0x58]
sub r15, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, r15
call sym.fwrite
cmp rax, r15
jne 0x140027167
mov r15, qword [rsp + 0x50]
cmp ebp, 1
je 0x1400271a0
jmp 0x14002716f
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, r15
call sym.fwrite
cmp rax, 1
jne 0x140027167
jmp 0x14002716f

Function at 0x1400273e0
Capabilities:
Encode data using xor

Disassembly:
cmp rdx, r8
je 0x14002740b
movabs rcx, 0xf000000000000000
mov r9, r8
sub r9, rdx
mov rax, rdx
not rax
add rax, r8
jne 0x14002740e
xor r8d, r8d
test r9b, 1
jne 0x14002746e
jmp 0x140027485
xor eax, eax
ret
mov r8, r9
and r8, 0xfffffffffffffffe
xor eax, eax
nop word [rax + rax]
shl rax, 4
movsx r10, byte [rdx]
add r10, rax
mov rax, r10
shr rax, 0x38
and eax, 0xfffffff0
xor rax, r10
shl rax, 4
movsx r10, byte [rdx + 1]
add r10, rax
mov r11, r10
and r11, rcx
mov rax, r11
shr rax, 0x38
or rax, r11
xor rax, r10
add rdx, 2
add r8, 0xfffffffffffffffe
jne 0x140027420
mov r8, rax
shl r8, 4
test r9b, 1
je 0x140027485
movsx rax, byte [rdx]
add r8, rax
and rcx, r8
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r8
ret
Function at 0x1400275d0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140027617
movabs rcx, 0xf000000000000000
nop word cs:[rax + rax]
shl rax, 4
movzx r9d, word [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
add rdx, 2
cmp rdx, r8
jne 0x1400275f0
ret

Function at 0x14005fd40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call dbg.__acrt_iob_func
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sym.fwrite
mov ecx, 2
call dbg.__acrt_iob_func
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sym.vfprintf
call sym.abort
int3
Function at 0x1400622b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rcx
mov r13, rdx
mov edi, r8d
test rcx, rcx
je 0x140062328
cmp qword [rcx + 0x30], 0
je 0x140062328
cmp qword [rcx + 0x38], 0
je 0x140062328
mov rbx, qword [rcx + 0x28]
mov eax, 0xfffffffe
test rbx, rbx
je 0x14006232d
cmp rcx, qword [rbx]
jne 0x14006232d
mov edx, dword [rbx + 8]
cmp edx, 0x2a
je 0x14006233e
cmp edx, 0x39
je 0x14006233e
cmp edx, 0x71
jg 0x14006251f
cmp edx, 0x44
jle 0x14006232d
movabs rax, 0x100400400011
sub edx, 0x45
bt rax, rdx
jb 0x14006252b
nop dword [rax]
mov eax, 0xfffffffe
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test r13, r13
je 0x140062328
mov esi, dword [rbx + 0x2c]
cmp esi, 2
je 0x140062328
cmp esi, 1
je 0x14006249b
mov ecx, dword [rbx + 0x9c]
test ecx, ecx
jne 0x140062328
mov eax, dword [rbx + 0x44]
mov dword [rbx + 0x2c], 0
cmp edi, eax
jb 0x1400624d7
test esi, esi
je 0x1400624de
sub edi, eax
add r13, rdi
mov r12d, dword [rbp + 8]
mov rdi, qword [rbp]
mov dword [rbp + 8], eax
mov rcx, rbx
mov qword [rbp], r13
call sym.fill_window
mov r8d, dword [rbx + 0x9c]
cmp r8d, 2
jbe 0x14006244b
mov dword [rsp + 0x2c], esi
nop dword [rax]
mov eax, dword [rbx + 0x94]
mov ecx, dword [rbx + 0x80]
mov qword [rsp + 0x20], rdi
mov r14, qword [rbx + 0x50]
mov r13d, dword [rbx + 0x7c]
mov rsi, qword [rbx + 0x68]
mov r11, qword [rbx + 0x60]
lea r9d, [r8 + rax - 2]
mov r10d, dword [rbx + 0x4c]
mov edx, dword [rbx + 0x70]
nop dword [rax]
lea r8d, [rax + 2]
shl edx, cl
mov r15d, r10d
movzx r8d, byte [r14 + r8]
and r15d, eax
xor r8d, edx
mov edx, r8d
and edx, r13d
mov r8d, edx
mov dword [rbx + 0x70], edx
lea r8, [rsi + r8*2]
movzx edi, word [r8]
mov word [r11 + r15*2], di
mov word [r8], ax
add eax, 1
cmp eax, r9d
jne 0x1400623e0
mov dword [rbx + 0x94], eax
mov rcx, rbx
mov rdi, qword [rsp + 0x20]
mov dword [rbx + 0x9c], 2
call sym.fill_window
mov r8d, dword [rbx + 0x9c]
cmp r8d, 2
ja 0x1400623b0
mov esi, dword [rsp + 0x2c]
mov eax, dword [rbx + 0x94]
mov dword [rbx + 0x1708], r8d
mov dword [rbx + 0x88], 2
mov dword [rbx + 0x90], 0
add eax, r8d
mov dword [rbx + 0x94], eax
mov dword [rbx + 0x84], eax
mov rax, qword [0x1400a7bd0]
mov qword [rbx + 0x9c], rax
xor eax, eax
mov qword [rbp], rdi
mov dword [rbp + 8], r12d
mov dword [rbx + 0x2c], esi
jmp 0x14006232d
cmp edx, 0x2a
jne 0x140062328
mov r8d, dword [rbx + 0x9c]
test r8d, r8d
jne 0x140062328
mov ecx, dword [rbp + 0x4c]
mov r8d, edi
mov rdx, r13
call sym.adler32
mov dword [rbp + 0x4c], eax
mov eax, dword [rbx + 0x44]
mov dword [rbx + 0x2c], 0
cmp edi, eax
jae 0x140062378
mov eax, edi
jmp 0x14006237d
mov eax, dword [rbx + 0x74]
mov rcx, qword [rbx + 0x68]
xor edx, edx
sub eax, 1
mov word [rcx + rax*2], dx
lea r8, [rax + rax]
xor edx, edx
call sym.memset
mov eax, dword [rbx + 0x44]
mov dword [rbx + 0x94], 0
mov dword [rbx + 0x84], 0
mov dword [rbx + 0x1708], 0
jmp 0x140062378
cmp edx, 0x29a
jne 0x14006232d
test r13, r13
je 0x140062328
mov esi, dword [rbx + 0x2c]
mov eax, 0xfffffffe
cmp esi, 2
je 0x14006232d
cmp esi, 1
jne 0x140062354
jmp 0x14006232d
Function at 0x14006d5a0
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
xor edi, edi
cmp rax, 8
ja 0x14006d61f
mov rax, qword [0x14009c008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14006d61f
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14006d61d
add rax, rcx
movzx ecx, word [rax + 0x18]
cmp ecx, 0x20b
jne 0x14006d61d
movzx ebx, word [rax + 6]
test ebx, ebx
je 0x14006d61d
movzx ecx, word [rax + 0x14]
lea rdi, [rcx + rax]
add rdi, 0x18
nop dword [rax]
mov r8d, 8
mov rcx, rdi
mov rdx, rsi
call sym.strncmp
test eax, eax
je 0x14006d61f
add rdi, 0x28
dec ebx
jne 0x14006d600
xor edi, edi
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x14006d630
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x14009c008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14006d69c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14006d69c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14006d69c
movzx edx, word [rax + 6]
test edx, edx
je 0x14006d69c
sub rcx, qword [0x14009c008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x14006d688
add rax, 0x28
dec edx
je 0x14006d69c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x14006d680
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x14006d680
jmp 0x14006d69e
xor eax, eax
ret

Function at 0x14006d6a0
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x14009c008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x14006d6d5
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x14006d6d5
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x14006d6d5
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x14006d750
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14009c008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14006d77c
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14006d77c
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x14006d77e
xor eax, eax
ret

Function at 0x14006d810
Capabilities:
Parse pe header

Disassembly:
push rsi
mov rdx, qword [0x14009c008]
movzx eax, word [rdx]
cmp eax, 0x5a4d
jne 0x14006d8ad
movsxd rax, dword [rdx + 0x3c]
cmp dword [rdx + rax], 0x4550
jne 0x14006d8ad
add rax, rdx
movzx r8d, word [rax + 0x18]
cmp r8d, 0x20b
jne 0x14006d8ad
mov r8d, dword [rax + 0x90]
test r8, r8
je 0x14006d8ad
movzx r9d, word [rax + 6]
test r9, r9
je 0x14006d8ad
movzx r10d, word [rax + 0x14]
shl r9, 3
lea r9, [r9 + r9*4]
add r10, rax
add r10, 0x24
xor eax, eax
xor r11d, r11d
jmp 0x14006d889
add r11, 0x28
cmp r9d, r11d
je 0x14006d8af
mov esi, dword [r10 + r11]
cmp esi, r8d
ja 0x14006d880
add esi, dword [r10 + r11 - 4]
cmp esi, r8d
jbe 0x14006d880
add rdx, r8
add rdx, 0xc
xor eax, eax
cmp dword [rdx - 8], 0
jne 0x14006d8d1
jmp 0x14006d8cc
xor eax, eax
pop rsi
ret
dec ecx
add rdx, 0x14
cmp dword [rdx - 8], 0
jne 0x14006d8d1
cmp dword [rdx], 0
je 0x14006d8af
test ecx, ecx
jg 0x14006d8c0
mov eax, dword [rdx]
add rax, qword [0x14009c008]
jmp 0x14006d8af
Function at 0x140071230
Capabilities:
Hash data with crc32

Disassembly:
push rbp
push rdi
push rsi
push rbx
mov ebx, 0x80000000
mov r9d, ecx
mov eax, edx
test r8d, r8d
je 0x1400712b3
mov edi, 3
lea rbp, [0x1400a8820]
jmp 0x140071260
add edi, 1
sar r8d, 1
je 0x1400712b3
test r8b, 1
je 0x140071258
mov edx, edi
mov ecx, 0x80000000
and edx, 0x1f
mov esi, dword [rbp + rdx*4]
mov edx, ebx
xor ebx, ebx
jmp 0x14007129c
mov r11d, edx
shr edx, 1
mov r10d, edx
and r11d, 1
shr ecx, 1
xor r10d, 0xedb88320
test r11d, r11d
cmovne edx, r10d
test esi, ecx
je 0x140071280
lea r10d, [rcx - 1]
xor ebx, edx
test r10d, esi
jne 0x140071280
add edi, 1
sar r8d, 1
jne 0x140071260
xor r10d, r10d
mov edx, 0x80000000
jmp 0x1400712dc
mov r8d, r9d
shr r9d, 1
mov ecx, r9d
and r8d, 1
shr edx, 1
xor ecx, 0xedb88320
test r8d, r8d
cmovne r9d, ecx
test edx, ebx
je 0x1400712c0
lea ecx, [rdx - 1]
xor r10d, r9d
test ecx, ebx
jne 0x1400712c0
xor eax, r10d
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140071300
Capabilities:
Hash data with crc32

Disassembly:
push rbp
push rdi
push rsi
push rbx
mov ebx, 0x80000000
mov r9d, ecx
mov eax, edx
test r8d, r8d
je 0x140071383
mov edi, 3
lea rbp, [0x1400a8820]
jmp 0x140071330
add edi, 1
sar r8d, 1
je 0x140071383
test r8b, 1
je 0x140071328
mov edx, edi
mov ecx, 0x80000000
and edx, 0x1f
mov esi, dword [rbp + rdx*4]
mov edx, ebx
xor ebx, ebx
jmp 0x14007136c
mov r11d, edx
shr edx, 1
mov r10d, edx
and r11d, 1
shr ecx, 1
xor r10d, 0xedb88320
test r11d, r11d
cmovne edx, r10d
test esi, ecx
je 0x140071350
lea r10d, [rcx - 1]
xor ebx, edx
test r10d, esi
jne 0x140071350
add edi, 1
sar r8d, 1
jne 0x140071330
xor r10d, r10d
mov edx, 0x80000000
jmp 0x1400713ac
mov r8d, r9d
shr r9d, 1
mov ecx, r9d
and r8d, 1
shr edx, 1
xor ecx, 0xedb88320
test r8d, r8d
cmovne r9d, ecx
test edx, ebx
je 0x140071390
lea ecx, [rdx - 1]
xor r10d, r9d
test ecx, ebx
jne 0x140071390
xor eax, r10d
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x1400713d0
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rbx
mov r11d, 0x80000000
test ecx, ecx
je 0x14007144c
mov ebx, 3
lea rsi, [0x1400a8820]
jmp 0x1400713f7
add ebx, 1
sar ecx, 1
je 0x14007144c
test cl, 1
je 0x1400713f0
mov eax, ebx
mov edx, 0x80000000
and eax, 0x1f
mov r10d, dword [rsi + rax*4]
mov eax, r11d
xor r11d, r11d
jmp 0x140071434
mov r9d, eax
shr eax, 1
mov r8d, eax
and r9d, 1
shr edx, 1
xor r8d, 0xedb88320
test r9d, r9d
cmovne eax, r8d
test r10d, edx
je 0x140071418
lea r8d, [rdx - 1]
xor r11d, eax
test r8d, r10d
jne 0x140071418
add ebx, 1
sar ecx, 1
jne 0x1400713f7
mov eax, r11d
pop rbx
pop rsi
ret
Function at 0x140071460
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rbx
mov r11d, 0x80000000
test ecx, ecx
je 0x1400714dc
mov ebx, 3
lea rsi, [0x1400a8820]
jmp 0x140071487
add ebx, 1
sar ecx, 1
je 0x1400714dc
test cl, 1
je 0x140071480
mov eax, ebx
mov edx, 0x80000000
and eax, 0x1f
mov r10d, dword [rsi + rax*4]
mov eax, r11d
xor r11d, r11d
jmp 0x1400714c4
mov r9d, eax
shr eax, 1
mov r8d, eax
and r9d, 1
shr edx, 1
xor r8d, 0xedb88320
test r9d, r9d
cmovne eax, r8d
test r10d, edx
je 0x1400714a8
lea r8d, [rdx - 1]
xor r11d, eax
test r8d, r10d
jne 0x1400714a8
add ebx, 1
sar ecx, 1
jne 0x140071487
mov eax, r11d
pop rbx
pop rsi
ret

Function at 0x140073e90
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call sym..weak._Znwy.default.__clang_call_terminate
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [method.std::__1.__libcpp_beginthreadex_thunk_abi:ue170005__void_]
xor ecx, ecx
xor edx, edx
mov r9, rax
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140073ee8
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x140099670
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
add rsp, 0x58
ret
Function at 0x1800017c0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x1800260a0], 0
mov rdi, rdx
mov rbx, rcx
jne 0x18000181b
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000180b
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x1800260a0], 1
mov qword [0x180026098], rax
jmp 0x180001822
mov rax, qword [0x180026098]
mov byte [0x1800260a0], 1
jmp 0x180001822
mov rax, qword [0x180026098]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x180001841
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]

Function at 0x180001860
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x1800018a0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x30
mov rsi, r8
mov rbp, rdx
mov r12, rcx
test r8, r8
jne 0x1800018d3
lea eax, [r8 + 0xd]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
xor edi, edi
mov rbx, r8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea rbx, [rbx + rax*2]
lea edi, [rdi + rax*2]
cmp eax, 1
jne 0x1800018e2
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x180001fb0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ecx, ecx
call fcn.18000c7c0
lea r8, [rsp + 0x48]
lea rdx, str.SoftwareComplitly
mov rcx, 0xffffffff80000001
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x18000201f
mov rcx, qword [rsp + 0x48]
lea eax, [rbx + 0x127500]
lea rdx, str.LastUpdateTime
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret
Function at 0x180002030
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ecx, ecx
call fcn.18000c7c0
lea r8, [rsp + 0x48]
lea rdx, str.SoftwareComplitly
mov rcx, 0xffffffff80000001
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x180002099
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, str.LastUpdateTime
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret

Function at 0x1800020a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea r8, [rsp + 0x58]
lea rdx, str.SoftwareComplitly
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x180002123
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.LastUpdateTime
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0x30]
jne 0x180002123
mov eax, dword [rsp + 0x50]
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret
Function at 0x180002270
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x180024a58]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov edi, dword [rcx + 8]
xor eax, eax
mov rsi, rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
or edi, 0x2001f
xor r8d, r8d
mov r9d, edi
mov rbp, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x1800023bc
test rcx, rcx
je 0x1800022e5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
and edi, 0x300
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], edi
test ebx, ebx
jne 0x1800023bc
xor edi, edi
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180002391
nop word [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.180002270
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x1800023bc
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x180002340
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1800023a6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rdi
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x50], edi
call fcn.1800017c0
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test rcx, rcx
je 0x1800023c7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.18000c610
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800026f0
Capabilities:
Create http request
Get http content length
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
xor r12d, r12d
mov rax, r8
mov rsi, rdx
mov rbx, rcx
mov qword [rcx], r12
mov qword [rcx + 8], r12
lea edx, [r12 + 1]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbp, rax
test rax, rax
je 0x1800027e8
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x84000100
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rsi, rax
test rax, rax
je 0x1800027df
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x78]
lea r8, [rbx + 8]
mov edx, 0x20000005
mov rcx, rsi
mov dword [rsp + 0x78], 8
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], r12d
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x1800027d6
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800027d6
call fcn.18000c1e0
mov qword [rbx], rax
test rax, rax
je 0x1800027d6
mov r8d, dword [rbx + 8]
lea r9, [rsp + 0x30]
mov rdx, rax
mov rcx, rsi
mov dword [rsp + 0x30], r8d
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1800027d6
mov rcx, qword [rbx]
call fcn.18000c298
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rbp, qword [rsp + 0x70]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x180003b90
Capabilities:
Get file version info

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x28
xor esi, esi
cmp qword [rcx + 0x20], 8
mov rdi, rcx
jb 0x180003bb0
lea rbx, [rcx + 8]
mov rcx, qword [rcx + 8]
jmp 0x180003bb7
lea rbx, [rcx + 8]
mov rcx, rbx
lea rdx, [rsp + 0x58]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov r12d, eax
test eax, eax
jne 0x180003bd2
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, r12
mov qword [rsp + 0x20], rbp
call fcn.18000c1e0
mov rbp, rax
test rax, rax
jne 0x180003bf6
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp qword [rdi + 0x20], 8
jb 0x180003c00
mov rbx, qword [rbx]
mov r9, rax
mov r8d, r12d
xor edx, edx
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x180003c53
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x60]
lea rdx, [0x18001be74]
mov rcx, rbp
mov dword [rsp + 0x50], 8
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x180003c53
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x180003c53
mov ecx, dword [rax + 0x10]
lea esi, [rcx + rcx*4]
movzx ecx, cx
add esi, esi
shr esi, 0x10
add esi, ecx
mov rcx, rbp
call fcn.18000c298
mov rbp, qword [rsp + 0x20]
mov eax, esi
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbx
ret