joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000fd90
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push r12
sub rsp, 0x60
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov r12, rcx
lea rax, [r11 + 0x10]
mov qword [r11 - 0x38], rax
lea rax, [r11 + 0x20]
mov qword [r11 - 0x40], rax
xor ebx, ebx
mov qword [r11 - 0x48], rbx
mov esi, 0x20006
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, rcx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebp, ebx
cmp eax, ebx
je 0x18000fee3
mov rdx, r12
lea rcx, [rsp + 0x90]
call fcn.1800035d0
nop
lea r8, [0x180085680]
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.180010884
mov rcx, qword [rsp + 0x90]
call fcn.1800167b0
cmp al, bl
jne 0x18000fe50
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, ebx
jg 0x18000fe49
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
xor eax, eax
jmp 0x18000ff60
lea rax, [rsp + 0x88]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
je 0x18000febb
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, ebx
jg 0x18000feb4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
xor eax, eax
jmp 0x18000ff60
mov ebp, 1
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, ebx
jg 0x18000fee3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
lea rdx, [0x1800856a8]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, ebx
je 0x18000ff59
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.1800035d0
nop
lea r8, str.HKEY_CURRENT_USER_
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.180010884
mov rcx, qword [rsp + 0x50]
call fcn.1800167a0
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
cmp ecx, ebx
jg 0x18000ff59
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rioctlsocket + 8]
cmp esi, ebx
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop r12
pop rsi
pop rbp
ret
Function at 0x180010280
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xa70
mov rax, qword [0x1800a7120]
xor rax, rsp
mov qword [rsp + 0xa60], rax
mov ebp, r8d
mov rbx, rdx
mov rdi, rcx
call fcn.18000f460
xor r12d, r12d
mov rdx, rbx
mov rcx, rdi
cmp eax, r12d
je 0x1800102d3
mov r8d, ebp
call fcn.18000ef80
lea eax, [r12 + 1]
jmp 0x180010409
call fcn.18000e830
mov r13, 0xffffffff80000000
lea r8, [rsp + 0x30]
mov rcx, r13
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, 1
cmp eax, r12d
je 0x18001030d
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov ebp, esi
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], r12w
call fcn.18005c190
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x50]
xor edx, edx
mov dword [rsp + 0x38], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
xor eax, eax
cmp ax, word [rsp + 0x50]
lea r8, [rdi + 8]
lea rdx, [0x1800857d0]
lea rcx, [rsp + 0x260]
mov r9, rbx
cmove ebp, esi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x260]
lea eax, [rax + rax + 2]
mov r8d, esi
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x260]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
cmp eax, r12d
je 0x1800103c2
xor eax, eax
jmp 0x180010409
mov rcx, qword [rsp + 0x40]
mov rdx, rbx
call fcn.180010040
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.18000ef80
lea rdx, [rsp + 0x260]
mov rcx, rdi
call fcn.18000ea60
mov edi, eax
cmp eax, r12d
je 0x180010407
mov rcx, rbx
call fcn.18000ff80
mov eax, edi
mov rcx, qword [rsp + 0xa60]
xor rcx, rsp
call fcn.18005c4c0
mov rbx, qword [rsp + 0xab0]
add rsp, 0xa70
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180010d0c
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1800a7120]
xor rax, rsp
mov qword [rsp + 0x250], rax
movsxd rsi, edx
lea rax, [rsp + 0x30]
mov rdi, rcx
lea rdx, str.SoftwareKuaiZipSFX_
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
cmp eax, ebx
jne 0x180010dce
cmp rdi, rbx
je 0x180010e1d
cmp esi, ebx
je 0x180010e1d
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], bx
call fcn.18005c190
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea rdx, [0x180085d00]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x180010df8
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18005c4c0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea r8, [rsp + 0x40]
mov rdx, rsi
mov rcx, rdi
call fcn.18005dd80
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, ebx
jne 0x180010e1d
mov word [rdi], bx
mov ebx, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x180010dd3

Function at 0x180010eac
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x1800a7120]
xor rax, rsp
mov qword [rsp + 0x140], rax
and dword [rsp + 0x20], 0
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.18005c190
cmp qword [rdi + 0x20], 0x10
jb 0x180010efa
mov rcx, qword [rdi + 8]
jmp 0x180010efe
lea rcx, [rdi + 8]
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
and qword [rbx + 0x18], 0
or rcx, 0xffffffffffffffff
xor eax, eax
mov qword [rbx + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbx + 8], 0
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.18000164c
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18005c4c0
mov rbx, qword [rsp + 0x170]
add rsp, 0x150
pop rdi
ret
Function at 0x180012364
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x100
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 8], rsi
mov rax, qword [0x1800a7120]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov esi, 7
mov qword [r11 - 0x20], rsi
xor edi, edi
mov qword [r11 - 0x28], rdi
mov word [r11 - 0x38], di
mov qword [r11 - 0x48], rsi
mov qword [r11 - 0x50], rdi
mov word [r11 - 0x60], di
lea r9, [r11 - 0x68]
lea r8, [r11 - 0x40]
call fcn.1800120f4
cmp eax, edi
jne 0x18001240f
cmp qword [rsp + 0xc0], 8
jb 0x1800123d8
mov rcx, qword [rsp + 0xa8]
call fcn.18005bda0
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xb8], rdi
mov word [rsp + 0xa8], di
cmp qword [rsp + 0xe8], 8
jb 0x180012408
mov rcx, qword [rsp + 0xd0]
call fcn.18005bda0
xor eax, eax
jmp 0x180012524
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x30]
call fcn.18005c190
mov dword [rsp + 0x30], reloc.WS2_32.dll_WSASetLastError
lea rax, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rax, qword [rsp + 0xd0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 8
cmovae rax, qword [rsp + 0xa8]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x60], 1
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, edi
jne 0x1800124c8
cmp qword [rsp + 0xc0], 8
jb 0x180012494
mov rcx, qword [rsp + 0xa8]
call fcn.18005bda0
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xb8], rdi
mov word [rsp + 0xa8], di
cmp qword [rsp + 0xe8], 8
jb 0x1800124c4
mov rcx, qword [rsp + 0xd0]
call fcn.18005bda0
xor eax, eax
jmp 0x180012524
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0xc0], 8
jb 0x1800124ef
mov rcx, qword [rsp + 0xa8]
call fcn.18005bda0
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xb8], rdi
mov word [rsp + 0xa8], di
cmp qword [rsp + 0xe8], 8
jb 0x18001251f
mov rcx, qword [rsp + 0xd0]
call fcn.18005bda0
mov eax, 1
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.18005c4c0
mov rsi, qword [rsp + 0x110]
add rsp, 0x100
pop rdi
ret
Function at 0x180013378
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x130
mov rax, qword [0x1800a7120]
xor rax, rsp
mov qword [rsp + 0x120], rax
lea rcx, [0x1800a91d0]
mov edx, 1
call fcn.1800144c0
mov edi, eax
test eax, eax
js 0x1800134c3
lea rdx, [rsp + 0xb0]
lea rcx, [0x180087e18]
mov r8d, reloc.WLDAP32.dll_Ordinal_50
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jle 0x1800134c1
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x40]
lea rcx, [0x180086370]
call fcn.1800131d8
lea rdx, [rsp + 0x40]
lea rcx, [0x1800863c0]
call fcn.1800131d8
lea rdx, [rsp + 0x40]
lea rcx, str.drive_shellexContextMenuHandlers_
call fcn.1800131d8
call qword [sym.imp.KERNEL32.dll_GetVersion]
bt eax, 0x1f
jb 0x1800134c1
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
lea rdx, [0x180086480]
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800134ac
mov rbx, qword [rsp + 0x30]
lea rsi, str.KuaiZip_Shell_Extension
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsp + 0x40]
mov r9d, 1
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1800134b3
test rbx, rbx
je 0x1800134ac
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80070005
jmp 0x1800134c3
test rbx, rbx
je 0x1800134c1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.18005c4c0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1800137ec
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
sub rsp, 0x50
and qword [rax - 0x20], 0
and qword [rax - 0x28], 0
and qword [rax - 0x18], 0
and dword [rax - 0x10], 0
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rbp, r9
mov dword [rax - 0x30], 0x2001f
and dword [rax - 0x38], 0
lea rcx, [rax - 0x18]
xor r9d, r9d
call fcn.18000b824
mov ebx, eax
test eax, eax
jne 0x180013871
test rsi, rsi
jne 0x180013842
lea ebx, [rax + 0xd]
jmp 0x180013871
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x40]
mov r9d, 1
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
cmp qword [rsp + 0x40], 0
je 0x180013884
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rsi
ret

Function at 0x180015b40
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x490
mov rax, qword [0x1800a7120]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r12, rdx
mov rbp, rcx
mov rdx, rcx
lea rcx, [rsp + 0x270]
mov r13, r8
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str..dll
lea rcx, [rsp + 0x270]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x24]
xor edi, edi
xor edx, edx
mov r8d, 0x24c
mov dword [rsp + 0x20], edi
call fcn.18005c190
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x180015bcf
xor eax, eax
jmp 0x180015c59
lea rdx, reloc.WLDAP32.dll_Ordinal_46
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, edi
je 0x180015c35
lea rdx, [0x180086b30]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, edi
je 0x180015c35
test byte [rsp + 0x20], 0x10
jne 0x180015c35
lea rcx, [rbp + 0x410]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x4c]
lea rcx, [rbp + 0x410]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp + 0x410]
mov rcx, r13
call r12
cmp eax, edi
jne 0x180015c49
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, edi
je 0x180015c4e
jmp 0x180015bcf
mov edi, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.18005c4c0
mov rbx, qword [rsp + 0x4d8]
add rsp, 0x490
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180015edc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1800a7120]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rax, rdx
mov rdi, rcx
mov rdx, rcx
mov rcx, rax
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea rdx, str.Lang
xor ebp, ebp
mov rcx, rdi
mov word [rax], bp
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea r8, [0x180086bf8]
lea rax, [0x1800957b8]
lea rsi, [rdi + 0x208]
lea rdx, [0x180086bd0]
lea rcx, [rsp + 0x40]
mov r9, r8
mov word [rdi + 0x410], bp
mov qword [rsp + 0x20], rax
mov word [rsi], bp
call qword [sym.imp.USER32.dll_wsprintfW]
lea r11, [rsp + 0x38]
lea r9d, [rbp + 1]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x180015fd5
mov rbx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.LangModule
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp rbx, rbp
je 0x180015fd5
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18005c4c0
mov rbx, qword [rsp + 0x290]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret

Function at 0x18001730c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov word [rsp + 0x18], r8w
push rdi
sub rsp, 0x20
mov r8d, edx
mov rbx, rcx
mov rdx, rcx
mov rcx, qword [0x1800a92c8]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rsp + 0x40]
mov edx, 1
call qword [sym.imp.USER32.dll_CharLowerBuffW]
xor edi, edi
cmp word [rsp + 0x40], 0x6d
jne 0x180017388
call fcn.18007dfb0
mov rcx, rbx
lea rdx, [0x180087378]
cmp al, dil
jne 0x180017379
lea rdx, [0x180087380]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [0x180087388]
jmp 0x18001739f
lea rdx, [0x1800873a8]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, str.KuaiZip.exe
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rbx, qword [rsp + 0x30]
cmp eax, 0xffffffff
setne dil
mov eax, edi
add rsp, 0x20
pop rdi
ret

Function at 0x18001743c
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
setae al
add rsp, 0x28
ret
Function at 0x180019a9c
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor edx, edx
mov rdi, rcx
lea r8, [0x180087ce0]
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
xor ebx, ebx
mov qword [rdi + 8], rax
cmp rax, rbx
jne 0x180019aca
xor eax, eax
jmp 0x180019aee
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp rax, rbx
mov qword [rdi + 0x10], rax
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18001aa20
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1800a7120]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rcx
mov rsi, rdx
lea rcx, [rsp + 0x22]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov rbx, r9
mov word [rsp + 0x20], bp
call fcn.18005c190
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp bp, word [rsp + 0x20]
jne 0x18001aa8a
lea rdx, [0x180088700]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rdi + 0x32c], ebp
je 0x18001aacc
lea rcx, str.Archive
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
cmp rax, rbp
jne 0x18001aab2
mov ecx, 0x8007000e
call fcn.180002f90
int3
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x18001ac41
mov rcx, qword [rdi + 0x80]
movabs rbx, 0x6666666666666667
sub rcx, qword [rdi + 0x78]
mov rax, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 1
jbe 0x18001abe4
cmp qword [rdi + 0x28], 8
jb 0x18001ab0c
mov rcx, qword [rdi + 0x10]
jmp 0x18001ab10
lea rcx, [rdi + 0x10]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp qword [rdi + 0x28], 8
mov rdx, rax
jb 0x18001ab26
mov rax, qword [rdi + 0x10]
jmp 0x18001ab2a
lea rax, [rdi + 0x10]
cmp rdx, rax
jne 0x18001abd0
mov rcx, qword [rdi + 0x80]
mov rax, rbx
sub rcx, qword [rdi + 0x78]
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x18001ab59
call fcn.18005dfbc
mov rax, qword [rdi + 0x78]
cmp qword [rax + 0x20], 8
jb 0x18001ab6a
mov rdx, qword [rax + 8]
jmp 0x18001ab6e
lea rdx, [rax + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rdi + 0x80]
mov rax, rbx
sub rcx, qword [rdi + 0x78]
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x18001ab9d
call fcn.18005dfbc
mov rax, qword [rdi + 0x78]
cmp qword [rax + 0x20], 8
jb 0x18001abae
mov rcx, qword [rax + 8]
jmp 0x18001abb2
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x18001ac41
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp rax, rbp
je 0x18001ac41
jmp 0x18001ac3e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
jmp 0x18001ac41
mov rcx, qword [rdi + 0x80]
mov rax, rbx
sub rcx, qword [rdi + 0x78]
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x18001ac0a
call fcn.18005dfbc
mov rax, qword [rdi + 0x78]
cmp qword [rax + 0x20], 8
jb 0x18001ac1b
mov rdx, qword [rax + 8]
jmp 0x18001ac1f
lea rdx, [rax + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x18001ac41
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov word [rax], bp
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18005c4c0
mov rbx, qword [rsp + 0x270]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret
Function at 0x180022198
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x20], r9d
push rdi
sub rsp, 0x40
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov r8d, r9d
xor edx, edx
mov rcx, rsi
call fcn.18005c190
mov rcx, qword [rdi]
lea r11, [rsp + 0x68]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rbx, eax
test eax, eax
je 0x180022209
mov ecx, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
cmp dword [rsp + 0x68], ecx
cmovb ecx, dword [rsp + 0x68]
mov r8d, ecx
mov rcx, rsi
call fcn.18005e160
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x180022228
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x20], r9d
push rdi
sub rsp, 0x40
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov r8d, r9d
xor edx, edx
mov rcx, rbx
call fcn.18005c190
mov rcx, qword [rsi]
lea r11, [rsp + 0x68]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
cdqe
add rsp, 0x40
pop rdi
ret

Function at 0x1800222c8
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x48
mov rcx, qword [rcx]
lea rax, [r11 + 0x20]
lea r9, [r11 - 0x18]
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], r8
xor r8d, r8d
mov dword [rsp + 0x68], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cdqe
add rsp, 0x48
ret
Function at 0x180023280
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x890
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x1800a7120]
xor rax, rsp
mov qword [rsp + 0x880], rax
xor ebx, ebx
mov word [rsp + 0x80], bx
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0x82]
call fcn.18005c190
lea r11, str.Update
mov qword [rsp + 0x20], r11
lea r9, [0x180089170]
lea r8, str.KuaiZip
lea rdx, str.software_s_s_s
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x30]
call fcn.180002034
nop
lea rcx, [rsp + 0x30]
call fcn.1800017b4
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x80]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x180023338
mov ebx, 1
jmp 0x1800233d0
mov dword [rsp + 0x40], ebx
xor eax, eax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x38], 8
lea rcx, [rsp + 0x30]
call fcn.180002060
mov rcx, rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.kernel
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx r11d, word [rsp + 0x60]
cmp word [rsp + 0x48], r11w
jbe 0x1800233b0
mov ebx, 1
jmp 0x1800233d0
movzx eax, word [rsp + 0x62]
cmp word [rsp + 0x4a], ax
jbe 0x1800233c3
mov ebx, 1
jmp 0x1800233d0
movzx ecx, word [rsp + 0x66]
cmp word [rsp + 0x4e], cx
seta bl
lea rcx, [rsp + 0x30]
call fcn.18000203c
mov eax, ebx
mov rcx, qword [rsp + 0x880]
xor rcx, rsp
call fcn.18005c4c0
add rsp, 0x890
pop rbx
ret