joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000c980
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov ebx, edx
mov rsi, rcx
test r8, r8
jne 0x18000c9a7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
mov r8d, ebx
mov rcx, rdi
shr r8d, 4
inc r8w
movzx edx, r8w
mov r8d, 6
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x18000ca4c
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18000ca4c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r8, rax
test rax, rax
je 0x18000ca4c
and ebx, 0xf
jbe 0x18000ca11
mov edx, ebx
nop word [rax + rax]
movzx eax, word [r8]
inc eax
cdqe
lea r8, [r8 + rax*2]
dec rdx
jne 0x18000ca00
movzx eax, word [r8]
test ax, ax
je 0x18000ca4c
movzx edx, ax
mov rcx, rsi
lea rbx, [r8 + 2]
call fcn.18000cb30
mov rcx, qword [rsi]
test rcx, rcx
je 0x18000ca4c
mov r8d, dword [rsi + 8]
mov rdx, rbx
add r8, r8
call fcn.180017c50
mov ecx, dword [rsi + 8]
mov rax, qword [rsi]
xor edx, edx
mov word [rax + rcx*2], dx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18000cc30
Capabilities:
Hash data using sha1

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x180040420]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r14d, r8d
mov rsi, rdx
mov rbx, rcx
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
mov ebp, r8d
cmp r8d, 0x40
jl 0x18000cca4
mov edi, r14d
mov ebp, r14d
shr rdi, 6
mov eax, edi
shl eax, 6
sub ebp, eax
nop
mov rdx, rsi
mov rcx, rbx
call fcn.18000cda0
add rsi, 0x40
dec rdi
jne 0x18000cc90
xor eax, eax
movsxd rdi, ebp
lea rcx, [rsp + 0x20]
mov r8, rdi
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
call fcn.180017c50
mov byte [rsp + rdi + 0x20], 0x80
cmp ebp, 0x37
jle 0x18000cd22
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.18000cda0
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea eax, [r14*8]
movsxd rcx, eax
call fcn.180007c20
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov qword [rsp + 0x58], rax
call fcn.18000cda0
xor edi, edi
lea rax, [rbx + 0x14]
mov rsi, rax
sub rsi, rbx
add rsi, 3
shr rsi, 2
cmp rbx, rax
cmova rsi, rdi
test rsi, rsi
je 0x18000cd7a
mov ecx, dword [rbx]
call fcn.180007bf0
inc rdi
lea rbx, [rbx + 4]
mov dword [rbx - 4], eax
cmp rdi, rsi
jne 0x18000cd64
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180016e40
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000cda0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x180040420]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea r10, [rsp]
mov rsi, rcx
lea r8, [rdx + 2]
sub r10, rdx
mov r9d, MsiDatabaseExportA
nop word [rax + rax]
movzx eax, byte [r8 - 1]
movzx edx, byte [r8 - 2]
lea r8, [r8 + 4]
shl edx, 8
or edx, eax
movzx eax, byte [r8 - 4]
shl edx, 8
or edx, eax
movzx eax, byte [r8 - 3]
shl edx, 8
or edx, eax
mov dword [r10 + r8 - 6], edx
dec r9
jne 0x18000cdf0
lea rax, [rsp + 8]
lea edx, [r9 + 0x40]
nop word [rax + rax]
mov ecx, dword [rax + 0x2c]
lea rax, [rax + 4]
xor ecx, dword [rax + 0x14]
xor ecx, dword [rax - 0xc]
xor ecx, dword [rax - 4]
rol ecx, 1
mov dword [rax + 0x34], ecx
dec rdx
jne 0x18000ce30
mov r14d, dword [rsi]
mov r15d, dword [rsi + 4]
mov r12d, dword [rsi + 8]
mov ebp, dword [rsi + 0xc]
mov r13d, dword [rsi + 0x10]
mov r11d, r14d
mov r9d, r15d
mov r8d, r12d
xor edi, edi
mov r10d, ebp
mov ebx, r13d
nop dword [rax]
mov eax, r8d
mov ecx, r9d
mov edx, r11d
and eax, r9d
rol edx, 5
not ecx
and ecx, r10d
inc rdi
or eax, ecx
add eax, edx
add eax, dword [rsp + rdi*4 - 4]
add eax, ebx
mov ebx, r10d
mov r10d, r8d
mov r8d, r9d
mov r9d, r11d
lea r11d, [rax + 0x5a827999]
ror r8d, 2
cmp rdi, 0x14
jl 0x18000ce70
mov edi, 0x14
nop dword [rax]
nop word [rax + rax]
mov edx, r10d
mov eax, r11d
inc rdi
xor edx, r8d
rol eax, 5
add eax, dword [rsp + rdi*4 - 4]
xor edx, r9d
add eax, ebx
mov ebx, r10d
mov r10d, r8d
mov r8d, r9d
add edx, eax
mov r9d, r11d
lea r11d, [rdx + 0x6ed9eba1]
ror r8d, 2
cmp rdi, 0x28
jl 0x18000cec0
mov edi, 0x28
nop dword [rax]
mov ecx, r8d
mov edx, r11d
mov eax, r8d
and eax, r9d
or ecx, r9d
rol edx, 5
and ecx, r10d
inc rdi
or ecx, eax
lea eax, [rbx + rdx]
mov ebx, r10d
add ecx, dword [rsp + rdi*4 - 4]
add eax, 0x8f1bbcdc
mov r10d, r8d
mov r8d, r9d
add eax, ecx
mov r9d, r11d
mov r11d, eax
ror r8d, 2
cmp rdi, 0x3c
jl 0x18000cf00
mov edi, 0x3c
nop word [rax + rax]
mov eax, dword [rsp + rdi*4]
mov edx, r11d
mov ecx, r10d
xor ecx, r8d
rol edx, 5
inc rdi
xor ecx, r9d
add eax, ecx
lea ecx, [rbx + rdx]
mov ebx, r10d
add ecx, 0xca62c1d6
mov r10d, r8d
mov r8d, r9d
add ecx, eax
mov r9d, r11d
ror r8d, 2
mov r11d, ecx
cmp rdi, 0x50
jl 0x18000cf50
lea eax, [r14 + rcx]
mov dword [rsi], eax
lea eax, [r15 + r9]
mov dword [rsi + 4], eax
lea eax, [r12 + r8]
mov dword [rsi + 8], eax
lea eax, [r10 + rbp]
mov dword [rsi + 0xc], eax
lea eax, [rbx + r13]
mov dword [rsi + 0x10], eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180016e40
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18000e500
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x180040420]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, rcx
test dl, dl
jne 0x18000e5b6
xor edx, edx
call fcn.180012190
mov rdi, rax
test rax, rax
je 0x18000e5b6
mov rcx, qword [rax]
test rcx, rcx
je 0x18000e5ae
mov rbx, rax
nop dword [rax]
mov rdx, rcx
lea r8, [rsp + 0x20]
mov r9d, 0x105
mov rcx, rsi
call fcn.180012920
lea rcx, [rsp + 0x20]
call fcn.1800122d0
test al, al
je 0x18000e582
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.18000e500
jmp 0x18000e59d
lea rdx, [rsp + 0x20]
lea rcx, str.Attempt:__s_n
call fcn.18001916c
lea rcx, [rsp + 0x20]
call fcn.18000e690
test al, al
je 0x18000e5e9
mov rcx, qword [rbx + 8]
add rbx, 8
test rcx, rcx
jne 0x18000e550
mov rcx, rdi
call fcn.180012fa0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
setne al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180016e40
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
xor al, al
jmp 0x18000e5c4

Function at 0x18000e5f0
Capabilities:
Check if file exists
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1800122d0
mov rcx, rbx
test al, al
je 0x18000e618
xor edx, edx
call fcn.18000e500
test al, al
je 0x18000e62a
mov al, 1
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x18000e62a
mov al, 1
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x18000e643
mov rcx, rbx
call fcn.18000e8b0
add rsp, 0x20
pop rbx
ret
lea rcx, [rsp + 0x38]
call fcn.180011a60
lea rcx, str.Unable_to_delete_file._n
call fcn.180010ec0
lea rcx, [0x1800329ac]
mov rdx, rbx
call fcn.180010ec0
mov rdx, qword [rsp + 0x38]
lea rcx, [0x1800329ac]
call fcn.180010ec0
mov rcx, qword [rsp + 0x38]
call fcn.180011a40
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x18000e690
Capabilities:
Check if file exists
Delete file
Set current directory

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x180040420]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
test rcx, rcx
je 0x18000e88c
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x18000e6c0
test eax, eax
je 0x18000e88c
call fcn.1800122d0
mov rcx, rbx
test al, al
je 0x18000e6ef
xor edx, edx
call fcn.18000e500
test al, al
je 0x18000e711
mov al, 1
jmp 0x18000e88e
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x18000e6e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x18000e711
mov rcx, rbx
call fcn.18000e8b0
jmp 0x18000e88e
lea rcx, [rsp + 0x30]
mov edx, 0x105
call fcn.180012000
lea rdx, [rsp + 0x140]
mov r8d, 0x105
mov rcx, rbx
call fcn.180011e00
test al, al
jne 0x18000e77f
or rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rbx + rax], 0
jne 0x18000e740
cmp eax, 0x105
jge 0x18000e77f
lea rax, [rsp + 0x140]
lea rcx, [rsp + 0x140]
sub rbx, rax
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
lea rcx, [rcx + 1]
mov byte [rcx - 1], al
test al, al
jne 0x18000e770
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x18000e790
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x140]
movsxd r8, eax
call fcn.180018dd0
test eax, eax
jne 0x18000e88c
lea rcx, [0x1800333b0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, [rsp + 0x140]
call fcn.18000e5f0
lea rcx, [rsp + 0x30]
movzx ebx, al
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x18000e887
nop word [rax + rax]
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x18000e800
cmp eax, 3
jle 0x18000e887
lea rcx, [rsp + 0x20]
call fcn.180011a60
lea rcx, str.Unable_to_set_current_directory._n
call fcn.18001916c
lea rdx, [rsp + 0x30]
lea rcx, str._s._n
call fcn.18001916c
mov rdx, qword [rsp + 0x20]
lea rcx, str._s._n
call fcn.18001916c
mov rcx, qword [rsp + 0x20]
call fcn.180011a40
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x30]
mov r8d, 0x105
call fcn.180012b20
lea rcx, str.result:__d_n
movzx edx, al
call fcn.18001916c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x18000e7f0
movzx eax, bl
jmp 0x18000e88e
xor al, al
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180016e40
add rsp, 0x260
pop rbx
ret
Function at 0x18000e8b0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x360
mov rax, qword [0x180040420]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov rsi, rcx
lea rdx, [rsp + 0x30]
mov r8d, 0x105
mov ecx, 4
call fcn.180012380
test al, al
je 0x18000e988
lea r8, [0x180032950]
lea rcx, [rsp + 0x30]
mov edx, 0x105
call fcn.1800127a0
test al, al
je 0x18000e988
lea r8, str.Maintenance
lea rcx, [rsp + 0x30]
mov edx, 0x105
call fcn.1800127a0
test al, al
je 0x18000e988
lea rcx, [rsp + 0x30]
call fcn.1800122d0
test al, al
jne 0x18000e9af
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.180011d60
test al, al
jne 0x18000e9af
lea rcx, [rsp + 0x20]
call fcn.180011a60
lea rcx, str.Unable_to_create_maintenance_directory._n
call fcn.180010ec0
lea rdx, [rsp + 0x30]
lea rcx, [0x1800329ac]
call fcn.180010ec0
mov rdx, qword [rsp + 0x20]
lea rcx, [0x1800329ac]
call fcn.180010ec0
mov rcx, qword [rsp + 0x20]
call fcn.180011a40
xor al, al
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.180016e40
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
xor ecx, ecx
xor edi, edi
call fcn.180015c50
inc edi
call fcn.180018458
xor ecx, ecx
movsxd rbx, eax
call fcn.180015c50
lea r8, [rsp + 0x250]
lea rdx, str.DELETE_04d_02d_02d_02d_02d_02d_04d
lea rcx, [rax + rbx]
mov r9d, pe_nt_image_headers64
call fcn.180015930
lea r8, [rsp + 0x140]
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x30]
mov r9d, 0x105
call fcn.180012920
lea rdx, [rsp + 0x140]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x18000eac1
cmp edi, 1
je 0x18000ea39
mov eax, edi
and eax, 0x8000000f
jge 0x18000ea35
dec eax
or eax, 0xfffffff0
inc eax
test eax, eax
jne 0x18000ea9b
lea rcx, [rsp + 0x20]
call fcn.180011a60
lea rcx, str.Unable_to_move_file_to_maintenance_directory._n
call fcn.180010ec0
lea rcx, str.source:__s_n
mov rdx, rsi
call fcn.180010ec0
lea rdx, [rsp + 0x140]
lea rcx, str.target:__s_n
call fcn.180010ec0
mov rdx, qword [rsp + 0x20]
lea rcx, [0x1800329ac]
call fcn.180010ec0
lea rcx, str.Retry:__d._n
mov edx, edi
call fcn.180010ec0
mov rcx, qword [rsp + 0x20]
call fcn.180011a40
cmp edi, 0x20
jl 0x18000e9b8
lea rcx, str.Unable_to_move_file_to_maintenance_directory._n
call fcn.180010ec0
lea rcx, str.Retries_exhausted._n
call fcn.180010ec0
jmp 0x18000e988
lea rcx, str.Moved_executable_to_maintenance_directory_for_later_deletion_n
call fcn.180010ec0
lea rcx, str.Source:__s_n
mov rdx, rsi
call fcn.180010ec0
lea rdx, [rsp + 0x140]
lea rcx, str.Target:__s_n
call fcn.180010ec0
mov al, 1
jmp 0x18000e98a
Function at 0x18000ebf0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
push rsi
sub rsp, 0x168
mov rax, qword [0x180040420]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbp, rdx
mov rsi, rcx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x18000ec23
mov al, 1
jmp 0x18000ecea
cmp eax, 2
je 0x18000ec3c
cmp eax, 5
je 0x18000ec3c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x18000ecea
mov r8d, 0xf003f
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x160], rdi
call fcn.18000f1e0
mov rdi, rax
test rax, rax
je 0x18000ed17
xor eax, eax
mov qword [rsp + 0x190], rbx
mov ebx, eax
nop dword [rax]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov edx, ebx
mov rcx, rdi
mov dword [rsp + 0x40], pe_nt_image_headers64
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x18000eca9
mov al, 1
jmp 0x18000ecb3
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
inc ebx
mov rcx, rdi
test al, al
je 0x18000ed04
lea rdx, [rsp + 0x50]
call fcn.18000ebf0
test al, al
mov eax, 0
jne 0x18000ec70
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rbx, qword [rsp + 0x190]
mov rdi, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180016e40
add rsp, 0x168
pop rsi
pop rbp
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rbp
mov rcx, rsi
call fcn.18000ebf0
jmp 0x18000ecda
jmp 0x18000ece2

Function at 0x18000ee80
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x18000ee95
mov al, 1
add rsp, 0x28
ret
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
add rsp, 0x28
ret

Function at 0x18000eeb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x20], r9d
sub rsp, 0x48
xor eax, eax
lea r9, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x18000eee5
mov al, 1
add rsp, 0x48
ret
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
add rsp, 0x48
ret

Function at 0x18000ef00
Capabilities:
Query or enumerate registry key

Disassembly:
mov dword [rsp + 0x20], r9d
sub rsp, 0x48
xor eax, eax
lea r9, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x18000ef35
mov al, 1
add rsp, 0x48
ret
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
add rsp, 0x48
ret
Function at 0x18000ef50
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov dword [rsp + 0x58], r9d
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x18000ef87
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
add rsp, 0x38
ret
cmp dword [rsp + 0x58], 0
je 0x18000ef80
mov al, 1
add rsp, 0x38
ret

Function at 0x18000efa0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x58]
xor r9d, r9d
mov dword [rsp + 0x58], 8
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x18000efda
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
add rsp, 0x38
ret
cmp dword [rsp + 0x58], 0
je 0x18000efd3
mov al, 1
add rsp, 0x38
ret

Function at 0x18000f340
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
lea rax, [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x18000f37d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
add rsp, 0x38
ret
mov al, 1
add rsp, 0x38
ret

Function at 0x18000f540
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xe0
xor edx, edx
mov rdi, rcx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.1800181d0
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x40], rax
xor eax, eax
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x18000f5e3
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x18000f5e3
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rdi
ret
lea rcx, [rsp + 0xf8]
call fcn.180011a60
lea rcx, str.Unable_to_start_external_process._n
call fcn.180010ec0
lea rcx, str.Command_line:___s_._n
mov rdx, rdi
call fcn.180010ec0
mov rdx, qword [rsp + 0xf8]
lea rcx, str._ERROR__s_n
call fcn.180010ec0
mov rcx, qword [rsp + 0xf8]
call fcn.180011a40
mov rbx, qword [rsp + 0xf0]
xor eax, eax
add rsp, 0xe0
pop rdi
ret
Function at 0x18000fbf0
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x180040420]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov edi, edx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.1800181d0
xor r9d, r9d
lea rax, [rsp + 0x30]
lea edx, [r9 + 0x26]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x18000fc92
lea rcx, [rsp + 0x30]
call fcn.180011bd0
test al, al
je 0x18000fc92
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x18000fc62
cmp eax, edi
jge 0x18000fc92
lea rcx, [rsp + 0x30]
lea rax, [rsp + 0x30]
sub rbx, rcx
nop dword [rax]
movzx ecx, byte [rax]
inc rax
mov byte [rbx + rax - 1], cl
test cl, cl
jne 0x18000fc80
mov al, 1
jmp 0x18000fc94
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180016e40
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret

Function at 0x180010bf0
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rdi
sub rsp, 0x148
mov rax, qword [0x180040420]
xor rax, rsp
mov qword [rsp + 0x120], rax
lea rdx, [r11 + 0x10]
mov qword [r11 - 0x18], rsi
call fcn.180010620
mov rcx, rax
mov rdi, rax
call fcn.1800130d0
mov rsi, rax
test rax, rax
je 0x180010cb7
mov rbx, qword [rax]
test rbx, rbx
je 0x180010caf
mov qword [rsp + 0x138], r14
mov r14, rax
mov cl, 1
call fcn.180015c50
lea r8, [rsp + 0x20]
lea rdx, str._04d__02d__02d__02d:_02d:_02d:_04d
mov rcx, rax
mov r9d, pe_nt_image_headers64
call fcn.180015930
lea rdx, [rsp + 0x20]
lea rcx, str.__s___s_n
mov r8, rbx
call fcn.180010590
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rbx
call fcn.1800177ec
mov rbx, qword [r14 + 8]
lea r14, [r14 + 8]
test rbx, rbx
jne 0x180010c51
mov r14, qword [rsp + 0x138]
mov rcx, rsi
call fcn.180012fa0
mov rsi, qword [rsp + 0x140]
test rdi, rdi
je 0x180010cdb
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x180010cd0
jmp 0x180010cdd
xor ebx, ebx
mov rcx, rdi
call fcn.1800177ec
mov eax, ebx
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180016e40
add rsp, 0x148
pop rdi
pop rbx
ret

Function at 0x180011c30
Capabilities:
Read file on windows

Disassembly:
mov rax, rdx
test rcx, rcx
je 0x180011c4b
mov r9, rcx
movsxd r8, r8d
mov edx, 1
mov rcx, rax
jmp 0x18001a1a8
xor eax, eax
ret
sub rsp, 0x38
mov qword [rsp + 0x20], r9
mov r9, r8
mov r8, rdx
or rdx, 0xffffffffffffffff
call fcn.18001a1c8
add rsp, 0x38
ret
Function at 0x180011d40
Capabilities:
Write file on windows

Disassembly:
mov rax, rdx
test rcx, rcx
je 0x180011d5b
mov r9, rcx
movsxd r8, r8d
mov edx, 1
mov rcx, rax
jmp 0x18001a88c
xor eax, eax
ret
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r9
push r14
sub rsp, 0x20
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x18001a903
test r8, r8
je 0x18001a903
xor eax, eax
test rbx, rbx
setne al
test eax, eax
jne 0x18001a8d9
call fcn.18001cda0
mov dword [rax], 0x16
call fcn.18001ccd4
jmp 0x18001a903
mov rcx, rbx
call fcn.180018f20
nop
mov r9, rbx
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call fcn.18001a6fc
mov rdi, rax
mov rcx, rbx
call fcn.180018fbc
mov rax, rdi
jmp 0x18001a905
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x180011d60
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x130
mov rax, qword [0x180040420]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rbx, rcx
test dl, dl
jne 0x180011dd6
mov dl, 1
call fcn.180011d60
test al, al
je 0x180011d91
mov al, 1
jmp 0x180011de3
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 1
ja 0x180011dd2
lea rdx, [rsp + 0x20]
mov r8d, pe_nt_image_headers64
mov rcx, rbx
call fcn.180012c40
test al, al
je 0x180011dd2
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.180011d60
test al, al
je 0x180011dd2
mov dl, 1
mov rcx, rbx
call fcn.180011d60
jmp 0x180011de3
xor al, al
jmp 0x180011de3
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
setne al
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180016e40
add rsp, 0x130
pop rbx
ret