joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180058450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
imul rax, rax, 0x11
mov byte [rsp + rax + 0x30], 0x6c
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x30], 0x4e
movabs rax, 0x3c06b4800000001
mov byte [rsp + rax + 0x30], 0x53
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x30], 0x4d
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x30], 0x6c
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x30], 0x49
mov eax, 1
imul rax, rax, 0x14
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x15
jae 0x1800584a1
jmp 0x1800584a6
call 0x180089f02
mov rax, qword [rsp + 0x20]
mov byte [rsp + rax + 0x30], 0
mov eax, 1
imul rax, rax, 0x13
mov byte [rsp + rax + 0x30], 0x29
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x30], 0x28
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x30], 0x20
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x30], 0x74
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x30], 0x5f
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x30], 0x6f
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x30], 0x53
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x30], 0x49
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x30], 0x6e
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x30], 0x69
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x30], 0x63
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x30], 0x7a
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x30], 0x65
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x30], 0x61
mov rax, qword [rsp + 0x60]
invalid
invalid
push rsp
invalid

Function at 0x18005cabe
Capabilities:
Parse pe header
Query or enumerate registry value

Disassembly:
imul eax, eax, 0x14
mov ecx, 0x69
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0xa
mov ecx, 0x69
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x1f
mov ecx, 0x75
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 5
mov ecx, 0x41
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 8
mov ecx, 0x5c
mov word [rbp + rax + 0x890], cx
nop
or byte [rax], al
add byte [rax + 2], bh
imul rax, rax, 0
mov ecx, 0x53
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0xe
mov ecx, 0x73
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x10
mov ecx, 0x66
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0xb
mov ecx, 0x63
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x27
mov ecx, 0x72
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 3
mov ecx, 0x54
mov word [rbp + rax + 0x890], cx
mov word [0x18005d43a], es
mov eax, 2
imul rax, rax, 0x1a
mov ecx, 0x20
mov word [rbp + rax + 0x890], cx
mov eax, 2
Function at 0x18005cb22
Capabilities:
Parse pe header
Query or enumerate registry value

Disassembly:
imul eax, eax, 0x14
mov ecx, 0x69
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0xa
mov ecx, 0x69
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x1f
mov ecx, 0x75
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 5
mov ecx, 0x41
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 8
mov ecx, 0x5c
mov word [rbp + rax + 0x890], cx
nop
or byte [rax], al
add byte [rax + 2], bh
imul rax, rax, 0
mov ecx, 0x53
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0xe
mov ecx, 0x73
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x10
mov ecx, 0x66
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0xb
mov ecx, 0x63
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x27
mov ecx, 0x72
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 3
mov ecx, 0x54
mov word [rbp + rax + 0x890], cx
mov word [0x18005d43a], es
mov eax, 2
imul rax, rax, 0x1a
mov ecx, 0x20
mov word [rbp + rax + 0x890], cx
mov eax, 2

Function at 0x18005cba4
Capabilities:
Parse pe header
Query or enumerate registry value

Disassembly:
imul eax, eax, 0x14
mov ecx, 0x69
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0xa
mov ecx, 0x69
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x1f
mov ecx, 0x75
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 5
mov ecx, 0x41
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 8
mov ecx, 0x5c
mov word [rbp + rax + 0x890], cx
nop
or byte [rax], al
add byte [rax + 2], bh
imul rax, rax, 0
mov ecx, 0x53
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0xe
mov ecx, 0x73
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x10
mov ecx, 0x66
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0xb
mov ecx, 0x63
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x27
mov ecx, 0x72
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 3
mov ecx, 0x54
mov word [rbp + rax + 0x890], cx
mov word [0x18005d43a], es
mov eax, 2
imul rax, rax, 0x1a
mov ecx, 0x20
mov word [rbp + rax + 0x890], cx
mov eax, 2

Function at 0x18005cbc5
Capabilities:
Parse pe header
Query or enumerate registry value

Disassembly:
imul rax, rax, 0x13
mov ecx, 0x57
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x23
mov ecx, 0x6e
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x29
mov ecx, 0x69
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x22
mov ecx, 0x65
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x1b
mov ecx, 0x4e
mov word [rbp + rax + 0x890], cx

Function at 0x18005cc2e
Capabilities:
Parse pe header
Query or enumerate registry value

Disassembly:
mov eax, 2
imul rax, rax, 7
mov ecx, 0x45
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x12
mov ecx, 0x5c
mov word [rbp + rax + 0x890], cx
or byte [rax], al
invalid

Function at 0x18005cc56
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 2
imul rax, rax, 7
mov ecx, 0x45
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x12
mov ecx, 0x5c
mov word [rbp + rax + 0x890], cx
or byte [rax], al
invalid
Function at 0x18005cc5a
Capabilities:
Query or enumerate registry value

Disassembly:
or byte [rax], al
add byte [rax + 2], bh
mov eax, 2

Function at 0x18005cc86
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 2
imul rax, rax, 1
mov ecx, 0x4f
mov word [rbp + rax + 0x890], cx
mov eax, 2
add byte [rax], al

Function at 0x18005cca1
Capabilities:
Query or enumerate registry value

Disassembly:
imul rax, rax, 0xd
mov ecx, 0x6f
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x2a
mov ecx, 0x6f
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x19
mov ecx, 0x73
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x28
mov ecx, 0x73
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x1e
mov ecx, 0x43
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x16
mov ecx, 0x64
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 4
mov ecx, 0x57
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 2
mov ecx, 0x46
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x21
mov ecx, 0x72
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x15
mov ecx, 0x6e
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0xf
mov ecx, 0x6f
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x18
mov ecx, 0x77
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0xc
mov ecx, 0x72
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x2b
mov ecx, 0x6e
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x2c
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x18], 0x5a
jae 0x18005cde6
jmp 0x18005cdeb
call 0x18008e847
xor eax, eax
mov rcx, qword [rbp + 0x18]
mov word [rbp + rcx + 0x890], ax
mov eax, 2
imul rax, rax, 0x24
mov ecx, 0x74
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 6
mov ecx, 0x52
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 9
mov ecx, 0x4d
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x11
mov ecx, 0x74
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x17
mov ecx, 0x6f
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x26
mov ecx, 0x65
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 0x1d
mov ecx, 0x5c
mov word [rbp + rax + 0x890], cx
mov eax, 2
imul rax, rax, 9
mov ecx, 0x6f
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 0xc
mov ecx, 0x63
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 7
mov ecx, 0x50
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 5
mov ecx, 0x61
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 0xb
mov ecx, 0x75
mov word [rbp + rax + 0x868], cx
add byte [rax + 2], bh
imul rax, rax, 0xe
mov ecx, 0x49
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 2
imul eax, eax, 2
mov ecx, 0x67
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 0x10
mov qword [rbp + 0x20], rax
cmp qword [rbp + 0x20], 0x22
jae 0x18005cf43
jmp 0x18005cf48
call 0x18008e9a4
xor eax, eax
mov rcx, qword [rbp + 0x20]
mov word [rbp + rcx + 0x868], ax
Function at 0x18005cf56
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 2
imul rax, rax, 3
mov ecx, 0x69
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 0xa
mov ecx, 0x64
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 0xd
mov ecx, 0x74
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 1
mov ecx, 0x69
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 0
mov ecx, 0x44
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 0xf
mov ecx, 0x64
mov word [rbp + rax + 0x868], cx
mov eax, 2
add byte [rax + 0x6b], cl
rol byte [rsi], 0xb9
insb byte [rdi], dx
add byte [rax], al
add byte [rsi - 0x77], ah
mov word [0x18005d858], es
add eax, 0x868
mov eax, 2
imul rax, rax, 4
mov ecx, 0x74
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 8
mov ecx, 0x72
mov word [rbp + rax + 0x868], cx
mov dword [rbp + 0x60], 0
lea rax, [rbp + 0x64]
mov rdi, rax
xor eax, eax
mov ecx, 0x7fc
rep stosb byte [rdi], al
mov dword [rbp + 0x50], 0x800
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
lea rdx, [rbp + 0x890]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18005d1d5
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x868]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 8], eax
cmp dword [rbp + 8], 0
jne 0x18005d1cb
mov byte [rbp + 0x8f0], 0
lea rax, [rbp + 0x8f1]
mov rdi, rax
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov r8d, dword [rbp + 0x50]
lea rdx, [rbp + 0x8f0]
invalid
invalid
Function at 0x18005cfde
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 2
imul rax, rax, 3
mov ecx, 0x69
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 0xa
mov ecx, 0x64
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 0xd
mov ecx, 0x74
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 1
mov ecx, 0x69
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 0
mov ecx, 0x44
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 0xf
mov ecx, 0x64
mov word [rbp + rax + 0x868], cx
mov eax, 2
add byte [rax + 0x6b], cl
rol byte [rsi], 0xb9
insb byte [rdi], dx
add byte [rax], al
add byte [rsi - 0x77], ah
mov word [0x18005d858], es
add eax, 0x868
mov eax, 2
imul rax, rax, 4
mov ecx, 0x74
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 8
mov ecx, 0x72
mov word [rbp + rax + 0x868], cx
mov dword [rbp + 0x60], 0
lea rax, [rbp + 0x64]
mov rdi, rax
xor eax, eax
mov ecx, 0x7fc
rep stosb byte [rdi], al
mov dword [rbp + 0x50], 0x800
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
lea rdx, [rbp + 0x890]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18005d1d5
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x868]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 8], eax
cmp dword [rbp + 8], 0
jne 0x18005d1cb
mov byte [rbp + 0x8f0], 0
lea rax, [rbp + 0x8f1]
mov rdi, rax
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov r8d, dword [rbp + 0x50]
lea rdx, [rbp + 0x8f0]
invalid
invalid
Function at 0x18005cfeb
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 2
imul rax, rax, 3
mov ecx, 0x69
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 0xa
mov ecx, 0x64
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 0xd
mov ecx, 0x74
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 1
mov ecx, 0x69
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 0
mov ecx, 0x44
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 0xf
mov ecx, 0x64
mov word [rbp + rax + 0x868], cx
mov eax, 2
add byte [rax + 0x6b], cl
rol byte [rsi], 0xb9
insb byte [rdi], dx
add byte [rax], al
add byte [rsi - 0x77], ah
mov word [0x18005d858], es
add eax, 0x868
mov eax, 2
imul rax, rax, 4
mov ecx, 0x74
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 8
mov ecx, 0x72
mov word [rbp + rax + 0x868], cx
mov dword [rbp + 0x60], 0
lea rax, [rbp + 0x64]
mov rdi, rax
xor eax, eax
mov ecx, 0x7fc
rep stosb byte [rdi], al
mov dword [rbp + 0x50], 0x800
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
lea rdx, [rbp + 0x890]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18005d1d5
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x868]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 8], eax
cmp dword [rbp + 8], 0
jne 0x18005d1cb
mov byte [rbp + 0x8f0], 0
lea rax, [rbp + 0x8f1]
mov rdi, rax
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov r8d, dword [rbp + 0x50]
lea rdx, [rbp + 0x8f0]
invalid
invalid
Function at 0x18005d069
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 2
imul rax, rax, 3
mov ecx, 0x69
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 0xa
mov ecx, 0x64
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 0xd
mov ecx, 0x74
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 1
mov ecx, 0x69
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 0
mov ecx, 0x44
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 0xf
mov ecx, 0x64
mov word [rbp + rax + 0x868], cx
mov eax, 2
add byte [rax + 0x6b], cl
rol byte [rsi], 0xb9
insb byte [rdi], dx
add byte [rax], al
add byte [rsi - 0x77], ah
mov word [0x18005d858], es
add eax, 0x868
mov eax, 2
imul rax, rax, 4
mov ecx, 0x74
mov word [rbp + rax + 0x868], cx
mov eax, 2
imul rax, rax, 8
mov ecx, 0x72
mov word [rbp + rax + 0x868], cx
mov dword [rbp + 0x60], 0
lea rax, [rbp + 0x64]
mov rdi, rax
xor eax, eax
mov ecx, 0x7fc
rep stosb byte [rdi], al
mov dword [rbp + 0x50], 0x800
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
lea rdx, [rbp + 0x890]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18005d1d5
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x868]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 8], eax
cmp dword [rbp + 8], 0
jne 0x18005d1cb
mov byte [rbp + 0x8f0], 0
lea rax, [rbp + 0x8f1]
mov rdi, rax
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov r8d, dword [rbp + 0x50]
lea rdx, [rbp + 0x8f0]
invalid
invalid

Function at 0x18005d4ad
Capabilities:
Query or enumerate registry value

Disassembly:
mov word [rax + rdx*4], es
add byte [rax], al
add byte [rax + 2], bh
imul rax, rax, 8
mov ecx, 0x5c
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 0x16
mov ecx, 0x70
add byte [rax], al

Function at 0x18005d4d5
Capabilities:
Query or enumerate registry value

Disassembly:
mov word [rax + rdx*4], es
add byte [rax], al
add byte [rax + 2], bh
imul rax, rax, 8
mov ecx, 0x5c
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 0x16
mov ecx, 0x70
add byte [rax], al
Function at 0x18005d4f5
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 2
imul rax, rax, 4
mov ecx, 0x57
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 9
mov ecx, 0x4d
add byte [r8], r8b
add byte [rsi - 0x77], ah
mov word [rax + rdx*4], es
add byte [rax], al
add byte [rax + 2], bh
imul rax, rax, 0xa
mov ecx, 0x69
mov word [rsp + rax + 0x90], cx
add byte [rax], al
mov eax, 2
imul rax, rax, 0x18
mov ecx, 0x6f
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 0x1b
mov ecx, 0x61
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 0x17
mov ecx, 0x74
mov word [rsp + rax + 0x90], cx
nop
add byte [rax], al
add byte [rax + 2], bh
imul rax, rax, 0xe
mov ecx, 0x73
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 6
mov ecx, 0x52
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 1
mov ecx, 0x4f
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 7
mov ecx, 0x45
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 0x11
mov ecx, 0x74
je 0x18005d5dd
add byte [rax], al
mov word [rsp + rax + 0x90], cx
mov eax, 2
add byte [rax], al
add byte [rax + 0x6b], cl
rol byte [rax], 0xb9
push rbx
add byte [rax], al
add byte [rsi - 0x77], ah
mov word [rax + rdx*4], es
add byte [rax], al
add byte [rax + 2], bh

Function at 0x18005d611
Capabilities:
Query or enumerate registry value

Disassembly:
add byte [rsi - 0x77], ah
mov word [rax + rdx*4], es
add byte [rax], al
add byte [rax + 2], bh
imul rax, rax, 0xc
mov ecx, 0x72
mov word [rsp + rax + 0x90], cx
add byte [rax], al
mov eax, 2
imul rax, rax, 2
mov ecx, 0x46
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 3
mov ecx, 0x54
mov word [rsp + rax + 0x90], cx
add byte [rax], al
add byte [rax + 2], bh
imul rax, rax, 0x19
mov ecx, 0x67
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 0x1a
mov ecx, 0x72
mov word [rsp + rax + 0x90], cx
mov eax, 2

Function at 0x18005d63b
Capabilities:
Query or enumerate registry value

Disassembly:
add byte [rsi - 0x77], ah
mov word [rax + rdx*4], es
add byte [rax], al
add byte [rax + 2], bh
imul rax, rax, 0xc
mov ecx, 0x72
mov word [rsp + rax + 0x90], cx
add byte [rax], al
mov eax, 2
imul rax, rax, 2
mov ecx, 0x46
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 3
mov ecx, 0x54
mov word [rsp + rax + 0x90], cx
add byte [rax], al
add byte [rax + 2], bh
imul rax, rax, 0x19
mov ecx, 0x67
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 0x1a
mov ecx, 0x72
mov word [rsp + rax + 0x90], cx
mov eax, 2

Function at 0x18005d646
Capabilities:
Query or enumerate registry value

Disassembly:
add byte [rsi - 0x77], ah
mov word [rax + rdx*4], es
add byte [rax], al
add byte [rax + 2], bh
imul rax, rax, 0xc
mov ecx, 0x72
mov word [rsp + rax + 0x90], cx
add byte [rax], al
mov eax, 2
imul rax, rax, 2
mov ecx, 0x46
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 3
mov ecx, 0x54
mov word [rsp + rax + 0x90], cx
add byte [rax], al
add byte [rax + 2], bh
imul rax, rax, 0x19
mov ecx, 0x67
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 0x1a
mov ecx, 0x72
mov word [rsp + rax + 0x90], cx
mov eax, 2
Function at 0x18005d670
Capabilities:
Query or enumerate registry value

Disassembly:
imul rax, rax, 0x1f
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0x40
jae 0x18005d683
jmp 0x18005d688
call 0x18008f0e4
xor eax, eax
mov rcx, qword [rsp + 0x38]
mov word [rsp + rcx + 0x90], ax
mov eax, 2
imul rax, rax, 0x1e
mov ecx, 0x79
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 0xf
mov ecx, 0x6f
mov word [rsp + rax + 0x90], cx

Function at 0x18005fefe
Capabilities:
Read file on windows

Disassembly:
and al, 0x40
mov eax, dword [rsp + 0x40]
mov edx, eax
mov rcx, qword [rsp + 0x78]
call 0x18008180a
mov rcx, qword [rsp + 0x78]
js 0x18005fee8
xor byte [rdx + 2], ah
add byte [rax - 0x39], cl
and al, 0x20
add byte [rax], al
add byte [rax], al
js 0x18005fee8
xor byte [rdx + 2], ah
add byte [rax - 0x39], cl
and al, 0x20
add byte [rax], al
add byte [rax], al
lea r9, [rsp + 0x50]
mov r8d, dword [rsp + 0x40]
mov rdx, rax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x18005ff36
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call 0x1800910f3
add rsp, 0x68
ret

Function at 0x18005ff87
Capabilities:
Write file on windows

Disassembly:
add bh, al
and al, 0x20
add al, byte [rax]
add byte [rax], al
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x18005fffd
mov rcx, qword [rsp + 0x78]
call 0x18008188b
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x78]
call 0x1800861fa
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rsp + 0x40]
and al, 0x40
xor al, al

Function at 0x18005ffe6
Capabilities:
Write file on windows

Disassembly:
and al, 0x40
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x18005ffff
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call 0x1800911bc
add rsp, 0x68
ret
Function at 0x180062aa1
Capabilities:
Enumerate pe sections

Disassembly:
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x78]
mov rax, qword [rax + 8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x78]
mov rcx, qword [rcx]
movzx ecx, word [rcx + 0x14]
lea rax, [rax + rcx + 0x18]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
add byte [rax], al

Function at 0x18006357b
Capabilities:
Check if file exists

Disassembly:
xor eax, esp
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x68], 0xffffffff
mov dword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x170]
call fcn.180069112
test rax, rax
je 0x1800635c1
mov rcx, qword [rsp + 0x170]
call 0x1800875c4
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1800635df
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x74], eax
invalid