joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140032f3c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntdll.dll_ZwQueryValueKey]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xc0000023
je 0x140032f8d
cmp dword [rsp + 0x30], 0x80000005
jne 0x140032f93
mov eax, dword [rsp + 0x34]
jmp 0x140032f95
xor eax, eax
add rsp, 0x48
ret

Function at 0x1400331dc
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x88
mov rax, qword [0x140049a88]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], 0
cmp dword [rsp + 0x90], 0
jl 0x140033235
cmp dword [rsp + 0x90], 0x7c
jge 0x140033235
lea r8, [rsp + 0x30]
mov edx, dword [rsp + 0x90]
lea rcx, [0x140048710]
call fcn.1400336dc
lea rcx, [rsp + 0x50]
call fcn.14002b418
nop
cmp qword [rsp + 0x30], 0
jne 0x14003325b
lea rdx, [0x140041978]
lea rcx, [rsp + 0x50]
call fcn.14002c468
jmp 0x14003326a
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14002c468
cmp dword [rsp + 0xa0], 1
jne 0x140033285
lea rdx, [0x140041988]
lea rcx, [rsp + 0x50]
call fcn.14002c468
movss xmm2, dword [0x140040d70]
movss xmm1, dword [0x140042360]
lea rcx, [rsp + 0x48]
call fcn.14002b934
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x50]
call fcn.140036180
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.140021d3c
movzx eax, al
test eax, eax
je 0x1400332fa
cmp dword [rsp + 0xa0], 0
jne 0x1400332fa
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
lea rcx, [rsp + 0x50]
call fcn.14002bf38
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140039700
add rsp, 0x88
ret
Function at 0x14003359c
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x38
lea rcx, [0x140041c1c]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140041c58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140033625
lea rcx, [0x140041c4c]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserSendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140033625
lea rcx, [0x140041c84]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.SendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140033625
xor al, al
jmp 0x1400336d7
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140041c90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400336a7
lea rcx, [0x140041cc8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserGetAsyncKeyState
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400336a7
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140041cd0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400336a7
xor al, al
jmp 0x1400336d7
mov r8d, 0x1e
mov rdx, qword [rsp + 0x20]
lea rcx, [0x14004a820]
call fcn.14003a28a
mov r8d, 0x1e
mov rdx, qword [rsp + 0x28]
lea rcx, [0x14004a840]
call fcn.14003a28a
mov al, 1
add rsp, 0x38
ret

Function at 0x140034200
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140034232
xor eax, eax
jmp 0x140034288
mov r8d, 0x1e
lea rdx, [0x14004a840]
mov rcx, qword [rsp + 0x28]
call fcn.14003a28a
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
call qword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r8d, 0x1000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x140034e64
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x44], 0xc0000001
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x68], 0x240
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwOpenKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x140034f3a
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xa8]
xor r8d, r8d
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwSetValueKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x140034f2a
mov byte [rsp + 0x40], 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
jmp 0x140034fcc
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwCreateKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x140034fc1
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xa8]
xor r8d, r8d
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwSetValueKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x140034fc1
mov byte [rsp + 0x40], 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
mov al, byte [rsp + 0x40]
add rsp, 0x88
ret
Function at 0x140036984
Capabilities:
Delete file
Execute command

Disassembly:
push rdi
sub rsp, 0xc0
mov rax, qword [0x140049a88]
xor rax, rsp
mov qword [rsp + 0xb0], rax
lea rcx, str.color_74
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140041974]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.__n_PasterX_Source_Updated_By_Payson_Holmes__n
call fcn.140038f78
lea rcx, str.__1__Load_Cheat_n__2__Load_Driver_n_n__
call fcn.140038f78
lea rdx, [rsp + 0x24]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 2
je 0x140036a12
jmp 0x140036b01
lea rcx, [0x140041984]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.14002c6e4
mov rcx, rax
call fcn.14002c4f8
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rsp + 0x21]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x21]
call fcn.14002c710
mov rcx, rax
call fcn.14002c4d8
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rax, [rsp + 0x22]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x22]
call fcn.14002c73c
mov rcx, rax
call fcn.14002c4d8
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rax, [rsp + 0x23]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x2c]
lea rcx, [rsp + 0x23]
call fcn.14002c768
mov rcx, rax
call fcn.14002c4b8
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor r9d, r9d
lea r8, str.PasterX_Updated_By_Payson
lea rdx, str.Loaded_Drivers
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14003699f
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140039700
add rsp, 0xc0
pop rdi
ret
Function at 0x140037f90
Capabilities:
Create thread
Hide graphical window

Disassembly:
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140034854]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rsp + 0xa0], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x88], 0
lea rax, [0x140034d0c]
mov qword [rsp + 0x78], rax
lea rax, [0x140041ba8]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x70], 3
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassA]
movzx eax, ax
test eax, eax
jne 0x140038048
lea rdx, str._n_n_notepad
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400287b0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x60], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x80000000
xor r8d, r8d
lea rdx, [0x140041c08]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x14004a888], rax
mov edx, 5
mov rcx, qword [0x14004a888]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140041b98]
mov rcx, qword [0x14004a888]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov r8d, 0x800a0
mov edx, 0xffffffec
mov rcx, qword [0x14004a888]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x14004a888]
call qword [sym.imp.USER32.dll_UpdateWindow]
add rsp, 0xc0
pop rdi
ret
Function at 0x140038da8
Capabilities:
Create thread
Execute command
Hide graphical window
Set console window title

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x88
mov rax, qword [0x140049a88]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rcx, [0x1400419a4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x40], rax
call fcn.14003359c
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400341a4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [0x140041b50]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.140036984
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400419c4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400419e4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140041a04]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [0x140041adc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
cmp qword [0x14004a3b0], 0
jne 0x140038ed9
lea rdx, str.Fortnite
lea rcx, [rsp + 0x68]
call fcn.14002acfc
lea rcx, [rsp + 0x68]
call fcn.140036510
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x14004a3b0], rax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140038e95
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rdx, [0x140041b70]
mov rcx, qword [rsp + 0x30]
call fcn.14002b3c0
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.140035470
mov dword [0x14004a3b8], eax
xor edx, edx
mov rcx, qword [0x14004a7c0]
call fcn.14003331c
movzx eax, al
test eax, eax
je 0x140038f4a
mov edx, dword [0x14004a3b8]
mov rcx, qword [0x14004a7c0]
call fcn.14002ca00
lea rdx, str.FortniteClient_Win64_Shipping.exe
mov rcx, qword [0x14004a7c0]
call fcn.140032f9c
mov qword [0x14004a3a8], rax
call fcn.140037f90
call fcn.14003811c
call fcn.140038928
call fcn.140038c90
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140039700
add rsp, 0x88
ret

Function at 0x140039e04
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140039e4e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140039e4e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140039e4e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140039e4e
cmp dword [rcx + 0x84], 0xe
jbe 0x140039e4e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140039e50
xor al, al
add rsp, 0x28
ret
Function at 0x180002b2c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
movdqa xmm0, xmmword [0x18002fe60]
movdqa xmm1, xmmword [0x18002fdd0]
mov rbx, qword [0x180037a70]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm0, xmmword [0x18002fde0]
movdqa xmmword [rbp + 7], xmm1
movdqa xmm1, xmmword [0x18002fe50]
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmm0, xmmword [0x18002fe40]
movdqa xmmword [rbp + 0x27], xmm1
movdqa xmm1, xmmword [0x18002fdc0]
movdqa xmmword [rbp + 0x37], xmm0
movdqa xmm0, xmmword [0x18002fe00]
movdqa xmmword [rbp + 0x47], xmm1
movdqa xmm1, xmmword [str.vSe_]
movdqa xmmword [rbp - 0x69], xmm0
movdqa xmm0, xmmword [0x18002fe30]
movdqa xmmword [rbp - 0x59], xmm1
movdqa xmm1, xmmword [str._l3]
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm0, xmmword [0x18002fdf0]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm1, xmmword [0x18002fe10]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmmword [rbp - 0x19], xmm1
call fcn.180004940
mov edx, 0xc9
mov r8d, 2
mov rcx, rbx
call rax
mov edi, dword [rax + 4]
mov esi, dword [rax]
mov ecx, edi
add rsi, rbx
mov ebx, edi
call fcn.180008730
xor ecx, ecx
mov r9, rax
test edi, edi
je 0x180002c24
mov byte [rax], cl
inc rax
sub rbx, 1
jne 0x180002c19
lea r8, [rsi + 0x67]
test r8, r8
je 0x180002c45
mov rdx, r9
test edi, edi
je 0x180002c45
sub r8, r9
mov al, byte [r8 + rdx]
mov byte [rdx], al
inc rdx
sub edi, 1
jne 0x180002c37
mov r11d, ecx
mov r8, rcx
mov r10, r9
movabs rbx, 0xaaaaaaaaaaaaaaab
mov edi, 0x49200
inc r11d
mov rax, rbx
mul r8
shr rdx, 4
lea rax, [rdx + rdx*2]
shl rax, 3
sub r8, rax
mov al, byte [rbp + r8*4 - 0x69]
xor byte [r10], al
inc r10
movsxd r8, r11d
cmp r8, rdi
jb 0x180002c5d
mov r8, rcx
mov r10, r9
inc ecx
mov rax, rbx
mul r8
shr rdx, 4
lea rax, [rdx + rdx*2]
shl rax, 3
sub r8, rax
mov al, byte [rbp + r8*4 - 9]
xor byte [r10], al
inc r10
movsxd r8, ecx
cmp r8, rdi
jb 0x180002c8e
lea r11, [rsp + 0xe0]
mov rax, r9
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180003070
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
movsxd rax, dword [rcx + 0x3c]
xor r12d, r12d
mov r14, rdx
mov r8d, dword [rax + rcx + 0x88]
test r8d, r8d
jne 0x1800030a7
xor eax, eax
jmp 0x180003145
lea rax, [rcx + r8]
mov rsi, r12
mov ebx, dword [rax + 0x20]
mov edx, dword [rax + 0x1c]
add rbx, rcx
mov r8d, dword [rax + 0x24]
add rdx, rcx
mov r15d, dword [rax + 0x18]
add r8, rcx
test r15, r15
je 0x180003132
mov edi, dword [rbx]
mov r9, r12
add rdi, rcx
cmp byte [r14], r12b
je 0x1800030e0
inc r9
cmp byte [r9 + r14], r12b
jne 0x1800030d7
test rdi, rdi
je 0x180003122
mov r10d, r12d
test r9, r9
je 0x18000311d
mov rbp, r14
mov r11, rdi
sub rbp, rdi
mov al, byte [r11 + rbp]
cmp byte [r11], al
jb 0x180003119
ja 0x180003111
inc r11
mov rax, r11
sub rax, rdi
cmp rax, r9
jb 0x1800030f6
jmp 0x18000311d
mov r10d, 1
jmp 0x18000311d
or r10d, 0xffffffff
test r10d, r10d
je 0x180003132
inc rsi
add rbx, 4
add r8, 2
cmp rsi, r15
jb 0x1800030ca
cmp r12w, word [r8]
jae 0x180003140
movzx eax, word [r8]
lea rdx, [rdx + rax*4]
mov eax, dword [rdx]
add rax, rcx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x180004940
Capabilities:
Access peb ldr_data
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x20]
jmp 0x18000498d
mov r9, qword [rdx + 0x50]
xor r8d, r8d
movzx r10d, word [rdx + 0x48]
movzx ecx, byte [r9]
ror r8d, 0xd
mov eax, r8d
add rax, rcx
cmp cl, 0x61
lea r8, [rax - 0x20]
cmovb r8, rax
inc r9
sub r10, 1
jne 0x18000495f
cmp r8d, 0x6a4abc5b
je 0x180004995
mov rdx, qword [rdx]
test rdx, rdx
jne 0x180004953
xor eax, eax
ret
mov r8, qword [rdx + 0x20]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
mov edx, dword [r9 + r8 + 0x20]
mov ecx, dword [r9 + r8 + 0x24]
add rdx, r8
add rcx, r8
mov r11d, dword [rdx]
add r11, r8
xor r10d, r10d
mov al, byte [r11]
inc r11
ror r10d, 0xd
movsx eax, al
add r10d, eax
mov al, byte [r11]
test al, al
jne 0x1800049c1
cmp r10d, 0x3bd09a55
je 0x1800049e8
add rdx, 4
add rcx, 2
jmp 0x1800049b5
movzx edx, word [rcx]
mov ecx, dword [r9 + r8 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
ret

Function at 0x180004c00
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x180004c92
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x180004c6c
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180004c8b
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180004c8b
mov rdx, qword [rdi]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call rax
jmp 0x180004c7b
cmp dword [rdi + 8], 0
je 0x180004c8b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, 1
jmp 0x180004c7b
cmp byte [0x180037af8], 0
jne 0x180004cdd
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180004cc9
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
mov qword [0x180037af0], rax
jmp 0x180004cd0
mov r10, qword [0x180037af0]
mov eax, 1
mov byte [0x180037af8], al
jmp 0x180004ce4
mov r10, qword [0x180037af0]
mov rcx, qword [rbx]
mov rdx, rsi
test r10, r10
je 0x180004c75
mov r8d, dword [rbx + 8]
xor r9d, r9d
call r10
jmp 0x180004c7b
Function at 0x180004cfc
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov edi, dword [rcx + 8]
lea rax, [rbp + 0x1a0]
xor r15d, r15d
mov qword [rsp + 0x20], rax
mov rsi, rcx
mov qword [rsp + 0x40], r15
mov rcx, qword [rcx]
or edi, 0x2001f
mov r9d, edi
mov dword [rsp + 0x48], r15d
xor r8d, r8d
mov qword [rsp + 0x50], r15
mov r14, rdx
mov qword [rbp + 0x1a0], r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x180004e18
mov rcx, qword [rsp + 0x40]
mov ebx, r15d
test rcx, rcx
je 0x180004d79
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rbp + 0x1a0]
and edi, 0x300
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x48], edi
test ebx, ebx
jne 0x180004e18
mov edi, 0x100
jmp 0x180004db8
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.180004cfc
mov ebx, eax
test eax, eax
jne 0x180004e18
mov rcx, qword [rsp + 0x40]
lea rax, [rbp + 0x1a8]
mov dword [rbp + 0x190], edi
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x190]
mov qword [rsp + 0x30], r15
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], r15
xor edx, edx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x180004d9e
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180004e06
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
mov rdx, r14
mov dword [rsp + 0x48], r15d
mov rcx, rsi
call fcn.180004c00
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180004e28
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x298]
add rsp, 0x260
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180005274
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x460
mov r14, r9
mov r15, r8
mov rbx, rdx
xor edi, edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x50], rdi
xor edx, edx
lea r8d, [rdi + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x488], rax
test rax, rax
jne 0x1800052f3
xor edx, edx
lea r8d, [rdi + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x488], rax
test rax, rax
jne 0x1800052f3
call fcn.180004a40
mov ebx, eax
jmp 0x180005407
mov r8, r14
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x180005314
call fcn.180004a40
jmp 0x1800053f6
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x18000530a
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x480], eax
inc eax
cmp eax, ebx
jae 0x180005352
mov ebx, 0x8007000e
jmp 0x1800053f8
mov ecx, eax
test eax, eax
je 0x180005384
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x180005439
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x180005384
lea rcx, [rsp + 0x50]
call fcn.18000839c
jmp 0x18000538e
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
jmp 0x1800053a6
cmp qword [rsp + 0x50], rdi
je 0x180005348
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x18000530a
mov ecx, eax
mov rax, qword [rsp + 0x50]
mov word [rax + rcx*2], di
mov r8d, dword [rsp + 0x4a0]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x38]
call fcn.180005fcc
mov ebx, eax
test rsi, rsi
je 0x180005407
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x50], rax
je 0x18000541e
lea rcx, [rsp + 0x50]
call fcn.180008224
nop
mov eax, ebx
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov ecx, 0x80070216
call fcn.180004a1c
int3