joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180015c60
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
xor eax, eax
test eax, eax
jne 0x180015c6e
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x10], 0
je 0x180015ca0
mov r8, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x10]
call fcn.180018750
jmp 0x180015d23
movzx eax, byte [0x18011e5b0]
test eax, eax
jne 0x180015ce5
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180015cde
lea rdx, str.RegDeleteKeyExW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18011e5a8], rax
mov byte [0x18011e5b0], 1
cmp qword [0x18011e5a8], 0
je 0x180015d10
xor r9d, r9d
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 8]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [0x18011e5a8]
jmp 0x180015d23
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add rsp, 0x38
ret

Function at 0x180015d30
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor eax, eax
test eax, eax
jne 0x180015d3e
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add rsp, 0x28
ret

Function at 0x180018470
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x298
mov rax, qword [0x180094030]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov edx, 1
lea rcx, [rsp + 0x50]
call fcn.18001b200
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.180013380
mov rax, qword [rsp + 0x2a0]
mov eax, dword [rax + 8]
or eax, 0x2001f
mov r9d, eax
mov r8, qword [rsp + 0x2a8]
mov rax, qword [rsp + 0x2a0]
mov rdx, qword [rax]
lea rcx, [rsp + 0x50]
call fcn.180017970
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x180018504
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x50]
call fcn.180013860
mov eax, dword [rsp + 0x4c]
jmp 0x1800185c2
mov dword [rsp + 0x68], 0x100
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180018591
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x50]
call fcn.180018470
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x180018584
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0x50]
call fcn.180013860
mov eax, dword [rsp + 0x44]
jmp 0x1800185c2
mov dword [rsp + 0x68], 0x100
jmp 0x18001850c
lea rcx, [rsp + 0x50]
call fcn.1800157f0
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2a0]
call fcn.180015c60
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x50]
call fcn.180013860
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.18004a8d0
add rsp, 0x298
ret
Function at 0x180018750
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
je 0x1800187dc
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x18001878f
mov eax, 1
jmp 0x1800187fe
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1800187da
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x38]
jmp 0x1800187fe
jmp 0x1800187f9
mov rax, qword [rsp + 0x50]
cmp dword [rax + 8], 0
je 0x1800187f9
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x1800187fe
mov eax, 1
add rsp, 0x48
ret
Function at 0x180019dc0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
xor eax, eax
test eax, eax
jne 0x180019dd3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x180019e10
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
xor eax, eax
test eax, eax
jne 0x180019e23
cmp qword [rsp + 0x70], 0
je 0x180019e3b
mov dword [rsp + 0x38], 1
jmp 0x180019e43
mov dword [rsp + 0x38], 0
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x180019e59
mov eax, SafeArrayGetDim
jmp 0x180019ed8
xor eax, eax
test eax, eax
jne 0x180019e29
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.18004af38
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax*2]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
lea rax, [rcx + rax*2]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x30], 1
jne 0x180019e71
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x58
ret

Function at 0x180019ee0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x180019ef8
cmp qword [rsp + 0x60], 0
je 0x180019f10
mov dword [rsp + 0x30], 1
jmp 0x180019f18
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x180019f2e
mov eax, SafeArrayGetDim
jmp 0x180019f6e
xor eax, eax
test eax, eax
jne 0x180019efe
mov rcx, qword [rsp + 0x60]
call fcn.18004af38
inc eax
mov eax, eax
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x48
ret
Function at 0x18001d820
Capabilities:
Delete registry key

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
call fcn.180024710
mov eax, SafeArrayGetDim
mov word [rsp + 0x20], ax
movsx rax, word [rsp + 0x20]
lea rcx, [0x180093980]
cmp dword [rcx + rax*4], 1
jne 0x18001d877
movsx rax, word [rsp + 0x20]
lea rcx, [0x180093980]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x20]
lea rdx, [0x180093980]
mov dword [rdx + rcx*4], eax
call fcn.180024730
cmp qword [rax + 0x478], 0
je 0x18001d8bc
cmp qword [0x18011cb38], 0
je 0x18001d8ae
xor r9d, r9d
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [0x18011cb38]
mov dword [rsp + 0x24], eax
jmp 0x18001d8b6
mov dword [rsp + 0x24], 1
mov eax, dword [rsp + 0x24]
jmp 0x18001d8cc
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add rsp, 0x38
ret

Function at 0x18001d8e0
Capabilities:
Delete registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x180094030]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x68], 0
jne 0x18001d924
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x18001da86
mov qword [rsp + 0x40], 0
mov eax, SafeArrayDestroy
mov word [rsp + 0x34], ax
movsx rax, word [rsp + 0x34]
lea rcx, [0x180093980]
cmp dword [rcx + rax*4], 1
jne 0x18001d96c
movsx rax, word [rsp + 0x34]
lea rcx, [0x180093980]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x34]
lea rdx, [0x180093980]
mov dword [rdx + rcx*4], eax
mov eax, dword [rsp + 0x78]
or eax, 0x20006
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, eax
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x38], eax
mov eax, SafeArrayDestroy
mov word [rsp + 0x30], ax
movsx rax, word [rsp + 0x30]
lea rcx, [0x180093980]
cmp dword [rcx + rax*4], 1
jne 0x18001d9d8
movsx rax, word [rsp + 0x30]
lea rcx, [0x180093980]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x30]
lea rdx, [0x180093980]
mov dword [rdx + rcx*4], eax
cmp dword [rsp + 0x38], 0
jne 0x18001da82
cmp qword [rsp + 0x40], 0
je 0x18001da82
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x18001da86
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18004a8d0
add rsp, 0x58
ret
Function at 0x180023430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov word [rsp + 0x10], dx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rcx, qword [rsp + 0x60]
call fcn.180025f50
mov rcx, qword [rsp + 0x70]
lea rax, [rax + rcx*2]
mov qword [rsp + 0x28], rax
movzx eax, byte [rsp + 0x78]
test eax, eax
je 0x1800235e1
mov eax, 4
imul rax, rax, 3
lea rcx, [0x180093980]
mov eax, dword [rcx + rax]
add eax, 0x3ce13eb
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x180093980]
mov dword [rdx + rcx], eax
mov rcx, qword [rsp + 0x60]
call fcn.18001b420
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rax
jmp 0x1800234ce
mov rax, qword [rsp + 0x28]
add rax, 2
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x30], rax
jae 0x1800235dc
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
movzx eax, word [rsp + 0x20]
movzx ecx, word [rsp + 0x68]
cmp eax, ecx
je 0x18002354f
movzx eax, word [rsp + 0x20]
cmp eax, 0x5a
jg 0x18002351e
movzx eax, word [rsp + 0x20]
cmp eax, 0x41
jl 0x18002351e
movzx eax, word [rsp + 0x20]
add eax, 0x20
movzx ecx, word [rsp + 0x68]
cmp eax, ecx
je 0x18002354f
movzx eax, word [rsp + 0x20]
cmp eax, 0x7a
jg 0x1800235d7
movzx eax, word [rsp + 0x20]
cmp eax, 0x61
jl 0x1800235d7
movzx eax, word [rsp + 0x20]
sub eax, 0x20
movzx ecx, word [rsp + 0x68]
cmp eax, ecx
jne 0x1800235d7
mov rax, qword [rsp + 0x30]
jmp 0x180023679
jmp 0x1800234b3
jmp 0x180023672
mov rcx, qword [rsp + 0x60]
call fcn.18001b420
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
jmp 0x180023609
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x48]
cmp qword [rsp + 0x38], rax
jae 0x180023672
mov eax, 4
imul rax, rax, 2
lea rcx, [0x180093980]
mov eax, dword [rcx + rax]
xor eax, 0xfffffa68
mov ecx, 4
imul rcx, rcx, 2
lea rdx, [0x180093980]
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
mov word [rsp + 0x24], ax
mov rax, qword [rsp + 0x28]
add rax, 2
mov qword [rsp + 0x28], rax
movzx eax, word [rsp + 0x24]
movzx ecx, word [rsp + 0x68]
cmp eax, ecx
jne 0x180023670
mov rax, qword [rsp + 0x38]
jmp 0x180023679
jmp 0x1800235fc
mov rax, 0xffffffffffffffff
add rsp, 0x58
ret
Function at 0x180024d90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rcx, qword [rsp + 0x80]
call fcn.18001b420
mov qword [rsp + 0x48], rax
mov eax, 4
imul rax, rax, 3
lea rcx, [0x180093980]
mov eax, dword [rcx + rax]
add eax, 0x34e88e4
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x180093980]
mov dword [rdx + rcx], eax
cmp qword [rsp + 0x48], 1
jae 0x180024deb
mov rax, qword [rsp + 0x80]
jmp 0x180025099
mov rcx, qword [rsp + 0x80]
call fcn.180025f50
mov qword [rsp + 0x40], rax
mov eax, 0x5c
mov word [rsp + 0x20], ax
mov eax, 0x2e
mov word [rsp + 0x24], ax
mov eax, 4
imul rax, rax, 2
lea rcx, [0x180093980]
mov eax, dword [rcx + rax]
xor eax, 0xfffffb32
mov ecx, 4
imul rcx, rcx, 2
lea rdx, [0x180093980]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 3
lea rcx, [0x180093980]
mov eax, dword [rcx + rax]
add eax, 0xdacce8
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x180093980]
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x48]
dec rax
mov qword [rsp + 0x28], rax
jmp 0x180024e83
mov rax, qword [rsp + 0x28]
dec rax
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jbe 0x180025091
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
movzx ecx, word [rsp + 0x24]
cmp eax, ecx
jne 0x180024f4b
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0x10]
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx]
xor edx, edx
mov word [rcx + rax*2], dx
jmp 0x180025091
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
movzx ecx, word [rsp + 0x20]
cmp eax, ecx
jne 0x18002508c
mov eax, 4
imul rax, rax, 1
lea rcx, [0x180093980]
mov edx, 4
imul rdx, rdx, 2
lea r8, [0x180093980]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx], eax
mov eax, 4
imul rax, rax, 2
lea rcx, [0x180093980]
mov edx, 4
imul rdx, rdx, 1
lea r8, [0x180093980]
mov edx, dword [r8 + rdx]
cmp dword [rcx + rax], edx
jae 0x180024fe4
mov eax, 4
imul rax, rax, 3
lea rcx, [0x180093980]
mov edx, dword [rcx + rax]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, 4
imul rcx, rcx, 2
lea rdx, [0x180093980]
mov dword [rdx + rcx], eax
mov dword [rsp + 0x38], 0
mov eax, dword [rsp + 0x38]
cmp eax, 0x6fc96001
jne 0x18002500f
lea r8, str.Local2532697920140073120835501604279632972832348242427177120x
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
mov qword [rsp + 0x58], rax
jmp 0x180025037
mov eax, 4
imul rax, rax, 0xb
lea rcx, [0x180093980]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x180093980]
mov dword [rdx + rcx], eax
jmp 0x180025091
jmp 0x180024e76
mov rax, qword [rsp + 0x80]
add rsp, 0x78
ret
Function at 0x1800261d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
jmp 0x1800261ee
mov rax, qword [rsp + 0x40]
add rax, 2
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
test eax, eax
je 0x18002630f
mov eax, 4
imul rax, rax, 2
lea rcx, [0x180093980]
mov eax, dword [rcx + rax]
xor eax, 0xfffffd4a
mov ecx, 4
imul rcx, rcx, 2
lea rdx, [0x180093980]
mov dword [rdx + rcx], eax
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x20]
movzx eax, word [rax + rcx*2]
test eax, eax
je 0x180026273
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x20]
movzx ecx, word [rcx + rdx*2]
cmp eax, ecx
jne 0x180026273
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
jmp 0x180026232
mov eax, 4
imul rax, rax, 1
lea rcx, [0x180093980]
mov edx, 4
imul rdx, rdx, 2
lea r8, [0x180093980]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx], eax
mov eax, 4
imul rax, rax, 2
lea rcx, [0x180093980]
mov edx, 4
imul rdx, rdx, 1
lea r8, [0x180093980]
mov edx, dword [r8 + rdx]
cmp dword [rcx + rax], edx
jae 0x1800262f1
mov eax, 4
imul rax, rax, 3
lea rcx, [0x180093980]
mov edx, dword [rcx + rax]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, 4
imul rcx, rcx, 2
lea rdx, [0x180093980]
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x20]
movzx eax, word [rax + rcx*2]
test eax, eax
jne 0x18002630a
mov rax, qword [rsp + 0x40]
jmp 0x180026311
jmp 0x1800261e0
xor eax, eax
add rsp, 0x38
ret
Function at 0x180028d80
Capabilities:
Get file attributes

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x28], 0
mov eax, dword [rsp + 0x28]
cmp eax, 0x3bd773ad
jne 0x180028db8
lea r8, [0x180097420]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
mov qword [rsp + 0x40], rax
jmp 0x180028de0
mov eax, 4
imul rax, rax, 0xb
lea rcx, [0x180093a10]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x180093a10]
mov dword [rdx + rcx], eax
lea rax, [0x180096a14]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax]
movsx eax, al
cmp eax, 0x61
jne 0x180028e49
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x180028e49
mov eax, 4
imul rax, rax, 0xb
lea rcx, [0x180093a10]
mov edx, dword [rcx + rax]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, 4
imul rcx, rcx, 0xc
lea rdx, [0x180093a10]
mov dword [rdx + rcx], eax
cmp qword [rsp + 0x60], 0
je 0x180028e6b
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x60]
movzx eax, word [rcx + rax]
test eax, eax
jne 0x180028ef0
xor al, al
jmp 0x180028f28
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 0x10
test eax, eax
je 0x180028f1b
cmp dword [rsp + 0x20], 0xffffffff
je 0x180028f1b
mov dword [rsp + 0x24], 1
jmp 0x180028f23
mov dword [rsp + 0x24], 0
movzx eax, byte [rsp + 0x24]
add rsp, 0x58
ret
Function at 0x18003bc10
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov eax, 4
imul rax, rax, 3
lea rcx, [0x180093db0]
mov eax, dword [rcx + rax]
add eax, 0x183157b
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x180093db0]
mov dword [rdx + rcx], eax
cmp qword [rsp + 0x58], 0
je 0x18003bc5b
xor eax, eax
mov rcx, qword [rsp + 0x58]
mov word [rcx], ax
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x28], 0
je 0x18003bdc1
mov rax, qword [rsp + 0x50]
add rax, 0x28
mov rcx, rax
call fcn.180025f50
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18003bdc1
mov rax, qword [rsp + 0x50]
add rax, 0x28
mov rcx, rax
call fcn.180025f50
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x50]
add rcx, 0x28
call fcn.180025f50
mov ecx, dword [rsp + 0x28]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rax, qword [rsp + 0x50]
add rax, 0x28
mov rcx, rax
call fcn.180025f50
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18003bd19
mov rax, qword [rsp + 0x50]
add rax, 0x28
mov rcx, rax
call fcn.180025f50
mov r8d, 4
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x18003bd19
mov dword [rsp + 0x24], 0
jmp 0x18003bd21
mov dword [rsp + 0x24], 1
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x2c], eax
lea rax, [0x1800813a4]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax]
movsx eax, al
cmp eax, 0x61
jne 0x18003bd92
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x18003bd92
mov eax, 4
imul rax, rax, 0xb
lea rcx, [0x180093db0]
mov edx, dword [rcx + rax]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, 4
imul rcx, rcx, 0xc
lea rdx, [0x180093db0]
mov dword [rdx + rcx], eax
cmp qword [rsp + 0x58], 0
je 0x18003bdc1
cmp dword [rsp + 0x2c], 0
je 0x18003bdad
mov eax, 0xffffffff
mov word [rsp + 0x20], ax
jmp 0x18003bdb4
xor eax, eax
mov word [rsp + 0x20], ax
mov rax, qword [rsp + 0x58]
movzx ecx, word [rsp + 0x20]
mov word [rax], cx
xor eax, eax
add rsp, 0x48
ret
Function at 0x18003ff80
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov eax, 4
imul rax, rax, 2
lea rcx, [0x180093db0]
mov eax, dword [rcx + rax]
xor eax, 0xffffff31
mov ecx, 4
imul rcx, rcx, 2
lea rdx, [0x180093db0]
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x70]
mov dword [rax + 0x38], 8
cmp qword [rsp + 0x90], 0
je 0x18003fff2
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x28], rax
jmp 0x18003fffe
lea rax, str.Mozilla_5.0__Windows_NT_6.2__WOW64__AppleWebKit_535.7__KHTML__like_Gecko__Chrome_16.0.912.75_Safari_535.7
mov qword [rsp + 0x28], rax
mov r8, 0xffffffffffffffff
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x40]
call fcn.18001c1b0
nop
mov rax, qword [rsp + 0x70]
add rax, 8
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.18001c880
nop
lea rcx, [rsp + 0x40]
call fcn.180013670
mov rax, qword [rsp + 0x70]
add rax, 0x20
mov rdx, qword [rsp + 0x78]
mov rcx, rax
call fcn.18002d3a0
mov rax, qword [rsp + 0x70]
add rax, 0x28
mov rdx, qword [rsp + 0x80]
mov rcx, rax
call fcn.18002d3a0
lea rax, [0x180079b60]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
movsx eax, al
cmp eax, 0x61
jne 0x1800400ce
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1800400ce
mov eax, 4
imul rax, rax, 0xb
lea rcx, [0x180093db0]
mov edx, dword [rcx + rax]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, 4
imul rcx, rcx, 0xc
lea rdx, [0x180093db0]
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x88]
mov qword [rax + 0x78], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [rsp + 0x70]
add rcx, 0x80
mov rdx, rax
call fcn.1800154c0
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
jne 0x18004011c
mov eax, 0x80004005
jmp 0x180040189
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x70]
call qword [rax + 0xa8]
mov eax, 4
imul rax, rax, 2
lea rcx, [0x180093db0]
mov eax, dword [rcx + rax]
xor eax, 0xffffff06
mov ecx, 4
imul rcx, rcx, 2
lea rdx, [0x180093db0]
mov dword [rdx + rcx], eax
xor eax, eax
jmp 0x180040189
add rsp, 0x68
ret
Function at 0x180055b30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x180055b5c
call fcn.18004f110
mov dword [rax], SafeArrayCopy
call fcn.180050538
jmp 0x180055c62
mov eax, dword [rcx + 0x18]
test al, 0x83
je 0x180055c62
test al, 0x40
jne 0x180055c62
test al, 2
je 0x180055b7e
or eax, 0x20
mov dword [rcx + 0x18], eax
jmp 0x180055c62
or eax, 1
mov dword [rcx + 0x18], eax
test eax, 0x10c
jne 0x180055b92
call fcn.1800547bc
jmp 0x180055b99
mov rax, qword [rcx + 0x10]
mov qword [rcx], rax
mov rcx, rdi
call fcn.180053e84
mov r8d, dword [rdi + 0x24]
mov rdx, qword [rdi + 0x10]
mov ecx, eax
call fcn.180055e90
mov dword [rdi + 8], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x180055c51
test byte [rdi + 0x18], 0x82
jne 0x180055c1f
mov rcx, rdi
call fcn.180053e84
cmp eax, 0xffffffff
je 0x180055c0a
mov rcx, rdi
call fcn.180053e84
cmp eax, 0xfffffffe
je 0x180055c0a
mov rcx, rdi
call fcn.180053e84
mov rcx, rdi
lea rsi, [0x18011f600]
movsxd rbx, eax
sar rbx, 5
call fcn.180053e84
and eax, 0x1f
imul rax, rax, 0x58
add rax, qword [rsi + rbx*8]
jmp 0x180055c11
lea rax, [0x180094ba0]
mov al, byte [rax + 8]
and al, 0x82
cmp al, 0x82
jne 0x180055c1f
bts dword [rdi + 0x18], 0xd
cmp dword [rdi + 0x24], 0x200
jne 0x180055c3e
test byte [rdi + 0x18], 8
je 0x180055c3e
test dword [rdi + 0x18], 0x400
jne 0x180055c3e
mov dword [rdi + 0x24], 0x1000
mov rcx, qword [rdi]
add dword [rdi + 8], 0xfffffffe
movzx eax, word [rcx]
add rcx, 2
mov qword [rdi], rcx
jmp 0x180055c67
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [rdi + 0x18], eax
and dword [rdi + 8], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret