joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002008
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x50
and qword [rsp + 0x70], 0
cmp edx, 0x20
mov ebp, r8d
mov rbx, rcx
jb 0x180002173
mov r9d, dword [rcx + 0x1c]
mov eax, dword [rcx + 0x14]
add r9d, dword [rcx + 0x10]
lea r9d, [r9 + rax + 0x20]
cmp edx, r9d
jne 0x180002173
add qword [rcx], rcx
add qword [rcx + 8], rcx
mov rcx, qword [rcx + 8]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x18000216c
mov eax, dword [0x180036a28]
mov dword [rsp + 0x40], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x44], eax
mov rax, qword [0x180036a20]
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rsp + 0x88]
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x38], rax
call fcn.18001c298
test eax, eax
mov edi, eax
jne 0x180002178
cmp dword [rbx + 0x18], eax
je 0x180002129
xor ecx, ecx
call fcn.180015a88
test rax, rax
mov rsi, rax
je 0x180002129
mov r9d, dword [rbx + 0x10]
mov r8, qword [rbx]
and qword [rsp + 0x20], 0
lea rdx, [rbx + 0x20]
mov rcx, rax
call fcn.180001f0c
test eax, eax
jne 0x180002117
mov r9d, dword [rbx + 0x14]
mov r8, qword [rbx + 8]
lea rax, [rsp + 0x70]
lea rdx, [rbx + 0x20]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.180001f0c
mov r8, qword [rsp + 0x70]
test r8, r8
je 0x180002117
mov rcx, qword [0x180036838]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x180036838]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
je 0x180002178
mov rcx, qword [rsp + 0x88]
lea rdx, [0x18003a1a4]
xor r9d, r9d
xor r8d, r8d
call fcn.180018db8
test rax, rax
je 0x180002165
mov eax, dword [rax]
add rax, qword [rsp + 0x88]
je 0x180002165
lea rcx, [0x1800360e0]
xor edx, edx
call rax
jmp 0x180002178
mov edi, 0x7f
jmp 0x180002178
mov edi, 0xb
jmp 0x180002178
mov edi, 0x57
mov rcx, qword [0x180036838]
xor edx, edx
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea rdx, [0x18003a1d7]
mov r8d, edi
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
xor r9d, r9d
mov rdx, rbx
mov r8d, eax
mov ecx, 0x10d
call fcn.18000fa58
mov rcx, qword [0x180036838]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x180002580
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rcx, qword [0x180036838]
xor edx, edx
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rdi, rax
je 0x180002620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x22]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov ebx, 1
test eax, eax
jne 0x1800025d4
mov r8d, ebx
mov edx, ebx
mov rcx, rdi
call fcn.180015a38
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x20]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x1800025fc
mov r8d, ebx
mov edx, ebx
mov rcx, rdi
call fcn.180015a38
lea rcx, [0x1800394cf]
mov edx, ebx
call fcn.1800021e8
mov rcx, qword [0x180036838]
mov r8, rdi
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180002625
mov ebx, 8
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180002dd8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x30
xor ebx, ebx
mov rsi, r8
mov r12, rdx
cmp r8, rbx
mov r13, rcx
mov ebp, ebx
je 0x180002e0d
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, eax
mov rcx, qword [0x180036838]
lea r8d, [rbp + 1]
xor edx, edx
add r8, 0x10
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, rbx
mov rdi, rax
je 0x180002e97
cmp ebp, ebx
mov qword [rax], r13
mov qword [rax + 8], r12
je 0x180002e46
lea rcx, [rax + 0x10]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x180002e49
mov byte [rax + 0x10], bl
lea rax, [rsp + 0x60]
lea r8, [0x180002d7c]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, rbx
je 0x180002e7b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180002e9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x180036838]
mov r8, rdi
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180002e9c
mov ebx, 8
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x180002fb0
Capabilities:
Create directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov r12d, r8d
mov r13d, edx
mov r14, rcx
mov rbx, qword [0x1800368c0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
test rbx, rbx
mov r11d, dword [rsp + 0x24]
mov eax, dword [rsp + 0x20]
bswap r11d
mov byte [rsp + 0x28], r12b
bswap eax
mov dword [rsp + 0x20], r11d
mov dword [rsp + 0x24], eax
je 0x180003016
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
jmp 0x180003018
xor edi, edi
mov rcx, qword [0x180036838]
lea ebp, [rdi + 1]
xor edx, edx
mov r8d, ebp
add r8, 0x13
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rsi, rax
je 0x1800030cf
test rbx, rbx
je 0x18000308d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rcx, rsi
call fcn.180015050
test rax, rax
mov rbx, rax
je 0x180003085
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180003073
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x180036838]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov edi, ebp
mov byte [rax + rsi], 0x5c
mov ebx, edi
lea rcx, [rsp + 0x20]
mov edx, 9
add rbx, rsi
mov r8, rbx
call fcn.180018684
xor r9d, r9d
mov r8d, r13d
mov rdx, r14
mov rcx, rsi
mov byte [rbx + 0x12], 0
call fcn.1800153a0
mov rcx, qword [0x180036838]
mov r8, rsi
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800030d4
mov ebx, 8
cmp ebx, 0x50
je 0x180002fd6
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop r13
pop r12
ret
Function at 0x18000341c
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
sub rsp, 0x30
and qword [rax + 0x18], 0
mov ebp, edx
mov rsi, rcx
lea rdx, [0x1800392fb]
lea r8, [rax + 0x20]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
mov ebx, eax
jne 0x180003514
mov r8, qword [0x180036b60]
mov rcx, qword [rsp + 0x58]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
xor edx, edx
call fcn.180018460
test eax, eax
mov ebx, eax
jne 0x180003494
mov rcx, qword [rsp + 0x50]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1800034ed
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [0x180036b60]
mov rcx, qword [rsp + 0x58]
lea eax, [rax + rax + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test ebp, ebp
mov ebx, eax
je 0x1800034ed
mov r8, qword [0x180036c60]
test r8, r8
je 0x1800034e6
mov rcx, qword [0x180036838]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [0x180036c60], rsi
cmp qword [rsp + 0x50], 0
je 0x180003509
mov r8, qword [rsp + 0x50]
mov rcx, qword [0x180036838]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rsi
ret
Function at 0x180003528
Capabilities:
Access pe header
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
cmp edx, 0x1000
mov eax, dword [0x180036a34]
mov ebp, edx
mov dword [rsp + 0x78], eax
mov r12, rcx
jbe 0x180003741
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
mov rbx, rax
je 0x180003741
mov rcx, qword [0x180036838]
xor edx, edx
mov r8d, 0x10000
mov edi, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rsi, rax
je 0x180003746
lea rcx, [0x1800394ba]
call fcn.180015050
test rax, rax
mov r13, rax
je 0x18000372d
mov r8, qword [0x180036b70]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
bt word [rbx + 0x16], 0xd
mov rcx, qword [0x180036858]
mov r15d, eax
lea rax, [0x18003a908]
lea r14, [0x18003a918]
cmovae r14, rax
test rcx, rcx
je 0x180003603
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [0x180036858], 0
mov rdx, qword [0x180036b68]
lea rax, [rsp + 0x80]
mov r9, r12
mov qword [rsp + 0x28], rax
mov r8, r14
mov rcx, rsi
mov dword [rsp + 0x20], ebp
call fcn.180003358
test eax, eax
mov edi, eax
je 0x18000367a
lea rdx, [rsp + 0x78]
lea rcx, [0x180036b68]
call fcn.180018084
test eax, eax
je 0x180003672
and word [rsi + r15*2], 0
mov rdx, qword [0x180036b68]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov r9, r12
mov r8, r14
mov rcx, rsi
mov dword [rsp + 0x20], ebp
call fcn.180003358
mov edi, eax
test edi, edi
jne 0x18000371b
bt word [rbx + 0x16], 0xd
mov rax, qword [rsp + 0x80]
mov qword [0x180036858], rax
jae 0x1800036f0
lea rcx, [0x18003a3ee]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, rsi
movsxd rbx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [0x180036838]
movsxd r8, eax
xor edx, edx
add r8, rbx
lea r8, [r8 + r8 + 0x22]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x1800036e6
lea r9, [0x18003a3ee]
lea rdx, [0x18003a8e0]
mov r8, rsi
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
test rbx, rbx
jne 0x1800036f3
lea edi, [rbx + 8]
jmp 0x1800036f3
mov rbx, rsi
test edi, edi
jne 0x18000371b
lea edx, [rdi + 1]
mov rcx, rbx
call fcn.18000341c
cmp rbx, rsi
mov edi, eax
je 0x18000371b
mov rcx, qword [0x180036838]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x180036838]
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x180036838]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180003746
mov edi, 0xb
mov eax, edi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180004dec
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
and dword [rax + 0x20], 0
mov r12, rcx
mov rcx, qword [0x180036970]
mov rsi, r8
mov rbp, rdx
lea r8, [rax - 0x28]
xor edx, edx
call fcn.180004d58
test eax, eax
mov ebx, eax
jne 0x180004eb9
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x28], rsi
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov ebx, eax
jne 0x180004eae
mov r8d, dword [rsi]
mov rcx, qword [0x180036838]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rdi, rax
je 0x180004ea9
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov ebx, eax
jne 0x180004e95
mov qword [rbp], rdi
jmp 0x180004eae
mov rcx, qword [0x180036838]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180004eae
mov ebx, 8
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret

Function at 0x180004ed0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
mov rsi, rcx
mov rcx, qword [0x180036970]
mov r12d, r8d
mov rdi, rdx
lea r8, [rax - 0x18]
mov edx, 1
mov ebp, r9d
call fcn.180004d58
test eax, eax
mov ebx, eax
jne 0x180004f48
test rdi, rdi
mov rcx, qword [rsp + 0x30]
mov rdx, rsi
je 0x180004f35
mov r9d, ebp
xor r8d, r8d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x180004f3b
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop r12
ret
Function at 0x180004f68
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rdi
push r13
sub rsp, 0x30
mov rcx, qword [0x180036970]
mov ebx, dword [0x180035610]
lea r8, [rsp + 0x60]
mov edx, 1
mov dword [rsp + 0x50], 0x28
call fcn.180004d58
lea r13, [0x180035610]
test eax, eax
mov edi, eax
jne 0x18000503e
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rdx, [0x1800391f9]
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x50], 0x28
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov edi, eax
jne 0x180004fe4
cmp dword [rsp + 0x50], 0x28
je 0x180004ff0
lea rcx, [0x180035618]
call fcn.18001a554
movzx eax, word [0x180035614]
bt ax, 0xf
jb 0x180005033
mov rcx, qword [rsp + 0x60]
or ax, 0x8008
lea rdx, [0x1800391f9]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 0x28
mov word [0x180035614], ax
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x180035610], 0
jne 0x18000507d
test ebx, ebx
mov dword [0x180035610], ebx
je 0x180005073
mov r9d, 3
lea rcx, [0x1800391f9]
mov rdx, r13
lea r8d, [r9 + 0x25]
call fcn.180004ed0
cmp dword [0x180035610], 0
jne 0x18000507d
mov dword [0x180035610], 0x3e8
cmp qword [0x180036af0], 0
jne 0x1800050e5
mov rcx, qword [0x180036838]
xor edx, edx
lea r8d, [rdx + 0x27]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x1800050de
mov edx, dword [0x180035624]
mov ecx, dword [0x180035620]
mov r9d, dword [0x18003561c]
mov r8d, dword [0x180035618]
bswap edx
bswap ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], ecx
lea rdx, [0x180039439]
bswap r9d
bswap r8d
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov qword [0x180036af0], rbx
mov eax, edi
add rsp, 0x30
pop r13
pop rdi
pop rbx
ret

Function at 0x1800050f0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
test ecx, ecx
movzx edi, r8w
mov eax, ecx
mov ebx, 0x57
jne 0x180005116
mov rcx, rdx
call qword [sym.imp.SHLWAPI.dll_StrToIntA]
test eax, eax
je 0x180005179
mov rcx, qword [0x180036970]
lea r8, [rsp + 0x30]
mov edx, 1
mov dword [0x180035610], eax
mov word [0x180035614], di
call fcn.180004d58
test eax, eax
mov ebx, eax
jne 0x180005179
mov rcx, qword [rsp + 0x30]
lea rax, [0x180035610]
lea r9d, [rbx + 3]
lea rdx, [0x1800391f9]
xor r8d, r8d
mov dword [rsp + 0x28], 0x28
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180005188
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x80
mov r14, r8
lea r8, [rax + 0x20]
mov r13d, edx
mov r12, rcx
xor edi, edi
call fcn.180019c94
cmp eax, edi
mov edx, eax
je 0x180005349
cmp eax, 8
jbe 0x180005330
mov rbp, qword [rsp + 0xc8]
add edx, 0xfffffff8
mov ebx, dword [rdx + rbp + 4]
lea rcx, [rbp + 4]
call fcn.180028900
not eax
cmp ebx, eax
jne 0x180005330
mov rax, qword [rsp + 0xc8]
mov rcx, qword [0x180036838]
xor edx, edx
mov ebx, dword [rax]
lea r8d, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, rdi
mov rsi, rax
je 0x180005330
lea rcx, [rbp + 4]
mov rdx, rax
call fcn.18001d674
cmp eax, ebx
jne 0x18000531e
lea rdx, [0x18003a203]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp eax, edi
jne 0x18000524f
mov edx, r13d
mov rcx, r12
call fcn.180028900
not eax
mov dword [0x180036864], eax
lea rcx, [0x180036c20]
mov r9d, ebx
mov r8, rsi
mov rdx, r14
call fcn.1800073d4
mov rcx, qword [0x180036988]
mov ebp, 1
lea r8, [rsp + 0x30]
mov edx, ebp
call fcn.180004d58
cmp eax, edi
jne 0x1800052af
mov rcx, qword [rsp + 0x30]
lea r9d, [rbp + 2]
xor r8d, r8d
mov rdx, r14
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
cmp eax, edi
cmove edi, ebp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov r8d, 6
lea rax, [rbx + 4]
mov ebx, dword [rbx]
mov dword [rcx], ebx
mov qword [rdx], rax
add rbx, rax
add rcx, 4
add rdx, 8
sub r8, rbp
jne 0x1800052c2
cmp dword [rsp + 0x38], ebp
jb 0x18000531e
mov edx, dword [rsp + 0x3c]
cmp edx, ebp
jbe 0x1800052b2
mov rcx, qword [rsp + 0x58]
add edx, 0xffffffff
call fcn.180028900
xor eax, dword [0x180036a50]
cmp eax, 0x36994a2b
jne 0x1800052b2
mov r8d, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x50]
xor r9d, r9d
mov ecx, 0x102
call fcn.18000fa58
jmp 0x1800052b2
mov rcx, qword [0x180036838]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0xc8]
mov rcx, qword [0x180036838]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180005360
mov rcx, qword [0x180036b58]
lea rdx, [0x180035616]
add rcx, 8
call fcn.1800196a8
lea r11, [rsp + 0x80]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180005380
Capabilities:
Delete file
Initialize winsock library

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x1d0
mov ecx, 0xf00
xor ebx, ebx
call fcn.180015a88
test rax, rax
mov rdi, rax
je 0x1800054b9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rdx, rdi
lea ecx, [rax - 1]
mov dword [rsp + 0x1f0], eax
mov byte [rcx + rdi], bl
mov esi, ecx
lea rcx, [0x180039e67]
call fcn.180009acc
test eax, eax
jne 0x1800054a7
lea r8, [rsp + 0x1f0]
lea rdx, [rsp + 0x200]
mov rcx, rdi
mov byte [rsi + rdi], 0x31
call fcn.1800151dc
test eax, eax
jne 0x18000549e
mov edx, dword [rsp + 0x1f0]
mov rcx, qword [rsp + 0x200]
lea r9, [rsp + 0x1f8]
lea r8, [0x180039e98]
call fcn.180019044
test rax, rax
je 0x180005487
mov edx, dword [rsp + 0x1f0]
mov rsi, rax
sub eax, dword [rsp + 0x200]
add eax, dword [rsp + 0x1f8]
lea r9, [rsp + 0x1f8]
lea r8, [0x180039e98]
mov ecx, eax
sub edx, eax
add rcx, qword [rsp + 0x200]
call fcn.180019044
test rax, rax
jne 0x18000541e
test rsi, rsi
je 0x180005487
mov eax, dword [rsp + 0x1f8]
lea rdx, str._s:_r
mov rcx, rsi
mov byte [rax + rsi], bl
call qword [sym.imp.SHLWAPI.dll_StrTrimA]
xor edx, edx
mov rcx, rsi
call fcn.1800187c4
mov rbx, rax
mov r8, qword [rsp + 0x200]
mov rcx, qword [0x180036838]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [0x180036838]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
mov qword [rsp + 0x1f8], rbx
je 0x180005591
lea rdx, [rsp + 0x30]
mov cx, 0x201
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1800054ef
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov rcx, rbx
call fcn.180018350
jmp 0x1800054f1
xor eax, eax
test eax, eax
je 0x180005570
mov ecx, dword [rsp + 0x24]
test ecx, ecx
je 0x180005570
cmp ecx, 0x8080808
je 0x180005570
cmp ecx, 0xdede43d0
je 0x180005570
movzx edx, cl
cmp edx, 0xa
je 0x180005570
movzx r8d, cx
cmp r8d, 0xa8c0
je 0x180005570
mov eax, ecx
and eax, 0xfff
cmp eax, 0x10ac
je 0x180005570
cmp edx, 0x7f
je 0x180005570
test cl, cl
je 0x180005570
cmp r8d, 0xfea9
je 0x180005570
mov eax, ecx
and eax, 0x7fff
cmp eax, 0x12c6
je 0x180005570
and ecx, 0x3ff
cmp ecx, 0x4064
je 0x180005570
mov dx, 0x3a
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrChrA]
test rax, rax
je 0x18000558c
mov rcx, qword [0x180036838]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
mov qword [rsp + 0x1f8], rbx
test rbx, rbx
jne 0x1800055f8
mov rcx, qword [0x180036090]
test rcx, rcx
je 0x1800055f8
lea r8, [rsp + 0x1f0]
lea rdx, [rsp + 0x1f8]
xor r9d, r9d
call fcn.180004bdc
mov rbx, qword [rsp + 0x1f8]
test eax, eax
jne 0x1800055f8
lea rdx, str.__t_r_n
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrTrimA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 7
jb 0x1800055e4
cmp eax, 0xf
jbe 0x1800055f8
mov rcx, qword [0x180036838]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
mov rax, rbx
add rsp, 0x1d0
pop rdi
pop rsi
pop rbx
ret
Function at 0x180005838
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor r15d, r15d
mov r13, r8
mov r14, rdx
lea r8, [rax - 0x38]
xor edx, edx
mov r12d, r9d
mov dword [rax - 0x44], r15d
mov dword [rax - 0x48], r15d
mov dword [rax - 0x40], r15d
call fcn.180004d58
cmp eax, r15d
mov ebx, eax
jne 0x180005a08
mov rcx, qword [0x180036838]
mov edi, 0x105
xor edx, edx
mov r8, rdi
lea ebx, [r15 + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r15
mov rsi, rax
je 0x1800059fd
mov rcx, qword [0x180036838]
mov r8, rdi
xor edx, edx
mov ebp, edi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r15
mov rdi, rax
je 0x1800059eb
mov edx, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
mov r8, rsi
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x48], 0x105
mov dword [rsp + 0x40], ebp
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0xea
mov ebx, eax
jne 0x18000596b
cmp dword [rsp + 0x48], 0x105
jbe 0x18000592a
add dword [rsp + 0x44], 1
mov ebx, r15d
jmp 0x1800059b4
cmp dword [rsp + 0x40], ebp
jbe 0x1800059d9
mov rcx, qword [0x180036838]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebp, dword [rsp + 0x40]
mov rcx, qword [0x180036838]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r15
mov rdi, rax
jne 0x180005922
mov ebx, 8
jmp 0x1800059d9
cmp eax, r15d
jne 0x1800059cf
cmp r12d, r15d
je 0x18000598b
mov r8d, dword [0x180036a34]
mov edx, dword [rsp + 0x40]
xor r9d, r9d
mov rcx, rdi
call fcn.18002886c
mov r9d, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
mov r8, rdi
mov rdx, rsi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call r14
cmp eax, r15d
mov ebx, eax
jne 0x1800059cf
mov rcx, qword [0x180036a48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1800059d9
jmp 0x1800058c9
cmp ebx, 0x103
cmove ebx, r15d
mov rcx, qword [0x180036838]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x180036838]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret