joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001b120
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x850
mov rax, qword [0x18002d000]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov r12, qword [r8]
mov r14, rcx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
mov rbp, rdx
repne scasw ax, word [rdi]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
not rcx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea r13d, [rcx + rcx]
xor r8d, r8d
mov rdx, r14
mov rcx, r12
mov dword [rsp + 0x30], 0x800
lea rbx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
je 0x18001b1b5
cmp eax, 2
jne 0x18001b285
xor eax, eax
mov r8d, esi
mov word [rsp + 0x40], ax
mov dword [rsp + 0x30], r8d
jmp 0x18001b21f
cmp dword [rsp + 0x34], 7
jne 0x18001b280
mov r8d, dword [rsp + 0x30]
lea eax, [r8 + r13]
cmp eax, 0x800
ja 0x18001b280
cmp word [rsp + 0x40], 0
je 0x18001b21f
nop dword [rax]
mov rdi, rbp
mov rax, rbx
sub rdi, rbx
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x18001b203
add rax, 2
test ecx, ecx
jne 0x18001b1f0
test edx, edx
je 0x18001b285
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea rbx, [rbx + rcx*2]
cmp word [rbx], ax
jne 0x18001b1e0
lea rcx, [rsp + r13 + 0x40]
lea rdx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_memmove]
lea rcx, [rsp + 0x40]
mov r8d, r13d
mov rdx, rbp
call sub.msvcrt.dll_memcpy
mov ecx, dword [rsp + 0x30]
lea rax, [rsp + 0x40]
add ecx, r13d
mov r9d, 7
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x30], ecx
mov rcx, r12
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test eax, eax
jne 0x18001b285
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov esi, eax
jmp 0x18001b285
mov esi, 0x65d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.18000ee20
add rsp, 0x850
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18001b2c0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x850
mov rax, qword [0x18002d000]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rsi, qword [r8]
lea rax, [rsp + 0x30]
mov rbp, rdx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r12, rcx
mov rdx, rcx
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x40]
mov dword [rsp + 0x30], 0x800
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x18001b454
cmp dword [rsp + 0x34], 7
jne 0x18001b44f
mov r8d, dword [rsp + 0x30]
cmp r8d, 2
jb 0x18001b44f
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
not rcx
lea r9, [rcx - 1]
add r9d, r9d
je 0x18001b424
nop word [rax + rax]
mov rdi, rbp
mov rax, rbx
sub rdi, rbx
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x18001b393
add rax, 2
test ecx, ecx
jne 0x18001b380
test edx, edx
jne 0x18001b3fc
mov eax, 0xfffffffe
mov rcx, rbx
sub eax, r9d
add r8d, eax
mov eax, r8d
mov dword [rsp + 0x30], r8d
sub rax, rbx
lea r8, [rsp + rax + 0x40]
mov eax, r9d
lea rdx, [rax + rbx + 2]
call qword [sym.imp.msvcrt.dll_memmove]
mov r8d, dword [rsp + 0x30]
test r8d, r8d
je 0x18001b3d5
cmp word [rsp + 0x40], 0
jne 0x18001b407
mov dword [rsp + 0x30], 0
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
test eax, eax
jne 0x18001b454
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edi, eax
jmp 0x18001b454
mov eax, r9d
shr rax, 1
lea rbx, [rbx + rax*2 + 2]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
add ecx, ecx
mov r9d, ecx
jne 0x18001b370
test r8d, r8d
je 0x18001b3dd
mov dword [rsp + 0x28], r8d
lea rax, [rsp + 0x40]
mov r9d, 7
xor r8d, r8d
mov rdx, r12
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x18001b3e9
mov edi, 0x65d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.18000ee20
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x18001b5d0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 4]
lea rbx, [rcx + 4]
mov rdi, rcx
mov dword [rsp + 0x50], eax
mov eax, dword [rcx + 8]
lea r8, [rsp + 0x48]
lea rdx, str.SYSTEMCurrentControlSetServicesdcryptconfig
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], 0x34e
mov dword [rsp + 0x54], eax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x18001b6ed
mov rcx, qword [rsp + 0x48]
lea r9d, [rax + 4]
lea rdx, str.Flags
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x18001b6e0
mov rcx, qword [rsp + 0x48]
lea rax, [rdi + 0xc]
lea r9d, [rbx + 3]
lea rdx, str.Hotkeys
xor r8d, r8d
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x18001b6e0
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r9d, [rbx + 4]
lea rdx, str.sysBuild
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x18001b6e0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ebx, eax
test eax, eax
jne 0x18001b6e0
lea r8d, [rax + 8]
lea rdx, [rsp + 0x50]
xor edi, edi
xor r9d, r9d
mov ecx, 0x2201ec
mov dword [rsp + 0x20], edi
call sym.dcapi.dll_dc_device_control
mov ebx, eax
cmp eax, 0x591
cmove ebx, edi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x18001b700
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rdi, rcx
lea r8, [rsp + 0x60]
lea rdx, str.SYSTEMCurrentControlSetServicesdcryptconfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test eax, eax
jne 0x18001b824
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rbx, [rdi + 4]
lea rdx, str.Flags
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x58], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ebp, ebp
test eax, eax
je 0x18001b772
mov dword [rbx], ebp
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
lea rdx, str.sysBuild
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x58], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18001b7a7
mov dword [rdi], ebp
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
lea rbx, [rdi + 0xc]
mov qword [rsp + 0x28], rax
lea rdx, str.Hotkeys
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x58], 0x10
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18001b7e7
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
xor edx, edx
mov ecx, 0x2201e8
mov dword [rsp + 0x20], 8
call sym.dcapi.dll_dc_device_control
mov rcx, qword [rsp + 0x60]
test eax, eax
cmove ebp, dword [rsp + 0x6c]
mov dword [rdi + 8], ebp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
mov eax, esi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x18001b840
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
sub rsp, 0x468
mov rax, qword [0x18002d000]
xor rax, rsp
mov qword [rsp + 0x450], rax
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x18001b8d2
cmp eax, 0x104
jae 0x18001b8d2
lea rax, str.dcrypt.sys
lea r9, [rsp + 0x30]
lea r8, str._sdrivers_s
lea rcx, [rsp + 0x240]
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.180001090
test eax, eax
js 0x18001b8d2
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.18000ee20
add rsp, 0x468
ret
xor eax, eax
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.18000ee20
add rsp, 0x468
ret
Function at 0x18001b900
Capabilities:
Check os version
Get common file path
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x18002d000]
xor rax, rsp
mov qword [rsp + 0x460], rax
lea r8, [rsp + 0x30]
lea rdx, str.SYSTEMCurrentControlSetControlClass4D36E965_E325_11CE_BFC1_08002BE10318
mov rcx, 0xffffffff80000002
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x18001b958
lea r8, [rsp + 0x30]
lea rdx, [0x180027490]
lea rcx, str.UpperFilters
call fcn.18001b2c0
test eax, eax
lea r8, [rsp + 0x30]
lea rdx, str.SYSTEMCurrentControlSetControlClass71A27CDD_812A_11D0_BEC7_08002BE2092F
mov rcx, 0xffffffff80000002
cmovne ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x18001b992
lea r8, [rsp + 0x30]
lea rdx, [0x180027490]
lea rcx, str.LowerFilters
call fcn.18001b2c0
test eax, eax
cmovne ebx, eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
lea rdi, str.dcrypt.sys
cmp al, 6
jb 0x18001b9dc
lea r8, [rsp + 0x30]
lea rdx, str.SYSTEMCurrentControlSetControlCrashControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x18001b9d9
lea r8, [rsp + 0x30]
lea rcx, str.DumpFilters
mov rdx, rdi
call fcn.18001b2c0
test eax, eax
cmovne ebx, eax
call fcn.18001b080
lea rcx, [rsp + 0x40]
mov edx, 0x104
test eax, eax
cmovne ebx, eax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x18001ba53
cmp eax, 0x104
jae 0x18001ba53
lea r9, [rsp + 0x40]
lea r8, str._sdrivers_s
lea rcx, [rsp + 0x250]
mov edx, 0x104
mov qword [rsp + 0x20], rdi
call fcn.180001090
test eax, eax
jns 0x18001ba2f
mov eax, 0x7a
jmp 0x18001ba58
xor edx, edx
lea rcx, [rsp + 0x250]
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x18001ba4f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18001ba58
mov eax, ebx
jmp 0x18001ba58
mov eax, 0x7b
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18000ee20
mov rbx, qword [rsp + 0x480]
add rsp, 0x470
pop rdi
ret
Function at 0x18001ba80
Capabilities:
Create service
Get common file path

Disassembly:
sub rsp, 0x4a8
mov rax, qword [0x18002d000]
xor rax, rsp
mov qword [rsp + 0x490], rax
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x18001bbec
cmp eax, 0x104
jae 0x18001bbec
lea rax, str.dcrypt.sys
lea r9, [rsp + 0x70]
lea r8, str._sdrivers_s
lea rcx, [rsp + 0x280]
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.180001090
test eax, eax
jns 0x18001bb07
mov eax, 0x7a
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.18000ee20
add rsp, 0x4a8
ret
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov qword [rsp + 0x4b0], rbx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x18001bb4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x4b0]
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.18000ee20
add rsp, 0x4a8
ret
lea rax, str.FltMgr
mov qword [rsp + 0x4a0], rdi
xor edi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdi
lea rax, str.Filter
lea r8, str.DiskCryptor_driver
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x280]
lea rdx, [0x180027490]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 3
mov r9d, 0xf01ff
mov rcx, rbx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
je 0x18001bbcc
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x18001bbd4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
mov rdi, qword [rsp + 0x4a0]
jmp 0x18001bb2d
mov eax, 0x7b
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.18000ee20
add rsp, 0x4a8
ret
Function at 0x18001bc10
Capabilities:
Copy file
Get common file path
Move file

Disassembly:
sub rsp, 0x888
mov rax, qword [0x18002d000]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov rcx, qword [0x18002dba8]
test rcx, rcx
je 0x18001be10
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x18001be10
mov qword [rsp + 0x880], rbx
mov ebx, 0x103
cmp eax, ebx
jae 0x18001be06
lea rcx, [rsp + 0x30]
mov edx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
test rax, rax
je 0x18001be06
lea rdx, [rsp + 0x30]
mov rcx, rax
sub rcx, rdx
sar rcx, 1
sub rbx, rcx
lea rcx, [rax + 2]
mov rdx, rbx
call section..text
test eax, eax
jns 0x18001bcc6
mov eax, 0x7a
mov rbx, qword [rsp + 0x880]
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.18000ee20
add rsp, 0x888
ret
lea rcx, [rsp + 0x660]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x18001be06
cmp eax, 0x104
jae 0x18001be06
lea rax, str.dcrypt.sys
lea r9, [rsp + 0x660]
lea r8, str._sdrivers_s
lea rcx, [rsp + 0x450]
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.180001090
test eax, eax
js 0x18001bca1
lea rcx, [rsp + 0x660]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x18001be06
cmp eax, 0x104
jae 0x18001be06
lea rax, str.dcrypt_old.sys
lea r9, [rsp + 0x660]
lea r8, str._sdrivers_s
lea rcx, [rsp + 0x240]
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.180001090
test eax, eax
js 0x18001bca1
lea rcx, [rsp + 0x450]
xor edx, edx
call qword [sym.imp.msvcrt.dll__waccess]
cmp eax, 0xffffffff
je 0x18001bdad
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x450]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x18001bdf4
lea rdx, [rsp + 0x450]
lea rcx, [rsp + 0x30]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x18001bdf4
lea rcx, [rsp + 0x240]
xor edx, edx
call qword [sym.imp.msvcrt.dll__waccess]
cmp eax, 0xffffffff
je 0x18001bdff
xor edx, edx
lea rcx, [rsp + 0x240]
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x18001bdff
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18001bca6
xor eax, eax
jmp 0x18001bca6
mov eax, 0x7b
jmp 0x18001bca6
mov eax, 0x7b
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.18000ee20
add rsp, 0x888
ret
Function at 0x18001be40
Capabilities:
Check os version
Delete file
Get common file path

Disassembly:
push rbx
sub rsp, 0x490
mov rax, qword [0x18002d000]
xor rax, rsp
mov qword [rsp + 0x480], rax
call fcn.18001bc10
mov ebx, eax
test eax, eax
jne 0x18001c005
lea rcx, [rsp + 0x38]
call sym.dcapi.dll_dc_load_config
mov ebx, eax
test eax, eax
jne 0x18001c005
mov eax, dword [rsp + 0x38]
cmp eax, 0x2b4
jae 0x18001bf05
lea rcx, [rsp + 0x270]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x18001bf61
cmp eax, 0x104
jae 0x18001bf61
lea rax, str.dc_fsf.sys
lea r9, [rsp + 0x270]
lea r8, str._sdrivers_s
lea rcx, [rsp + 0x60]
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.180001090
test eax, eax
jns 0x18001bee7
mov ebx, 0x7a
jmp 0x18001c005
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.18001af30
mov ebx, eax
test eax, eax
jne 0x18001c005
mov eax, dword [rsp + 0x38]
cmp eax, 0x16e
jae 0x18001bf6b
lea r8, [rsp + 0x30]
lea rdx, str.SYSTEMCurrentControlSetControlClass4D36E965_E325_11CE_BFC1_08002BE10318
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, eax
test eax, eax
jne 0x18001bf45
lea r8, [rsp + 0x30]
lea rdx, [0x180027490]
lea rcx, str.UpperFilters
call fcn.18001b120
mov ebx, eax
test ebx, ebx
jne 0x18001c005
mov ecx, dword [rsp + 0x3c]
mov eax, dword [rsp + 0x38]
or ecx, 0x180
mov dword [rsp + 0x3c], ecx
jmp 0x18001bf6f
mov ebx, 0x7b
jmp 0x18001c005
mov ecx, dword [rsp + 0x3c]
cmp eax, 0x282
jae 0x18001bf7e
bts ecx, 0xa
mov dword [rsp + 0x3c], ecx
cmp eax, 0x332
jae 0x18001bfcc
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x18001bfcc
lea r8, [rsp + 0x30]
lea rdx, str.SYSTEMCurrentControlSetControlCrashControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, eax
test eax, eax
jne 0x18001bfc8
lea r8, [rsp + 0x30]
lea rdx, str.dcrypt.sys
lea rcx, str.DumpFilters
call fcn.18001b120
mov ebx, eax
test ebx, ebx
jne 0x18001c005
lea rcx, [rsp + 0x38]
call sym.dcapi.dll_dc_save_config
mov ebx, eax
test eax, eax
jne 0x18001c005
call sym.dcapi.dll_dc_get_version
lea r8, str.DC_UPD__d
lea rcx, [rsp + 0x60]
mov r9d, eax
mov edx, 0x104
call fcn.180001090
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.18000ee20
add rsp, 0x490
pop rbx
ret
Function at 0x18001c090
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x18002d000]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
lea r8, str.dc_save_drv_file..._n
lea rcx, str.drvinst.c
mov edx, 0x138
mov dword [rsp + 0x28], 0x34e
mov dword [rsp + 0x2c], 0x580
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], eax
call sym.dcapi.dll_log_print
call fcn.18001bc10
mov ebx, eax
test eax, eax
jne 0x18001c257
lea r8, str.dc_add_service..._n
lea rcx, str.drvinst.c
mov edx, 0x13a
call sym.dcapi.dll_log_print
call fcn.18001ba80
mov ebx, eax
test eax, eax
jne 0x18001c257
lea r8, str.dc_add_altitude..._n
lea rcx, str.drvinst.c
mov edx, 0x13e
call sym.dcapi.dll_log_print
call fcn.18001af30
mov ebx, eax
test eax, eax
jne 0x18001c257
lea r8, str.dc_add_filter_CDROM_..._n
lea rcx, str.drvinst.c
mov edx, 0x142
call sym.dcapi.dll_log_print
lea r8, str.dc_add_filter..._n
lea rcx, str.drvinst.c
mov edx, 0x143
call sym.dcapi.dll_log_print
lea r8, [rsp + 0x20]
lea rdx, str.SYSTEMCurrentControlSetControlClass71A27CDD_812A_11D0_BEC7_08002BE2092F
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, eax
test eax, eax
jne 0x18001c1a3
lea r8, [rsp + 0x20]
lea rdx, [0x180027490]
lea rcx, str.LowerFilters
call fcn.18001b120
mov ebx, eax
test ebx, ebx
jne 0x18001c257
lea r8, [rsp + 0x20]
lea rdx, str.SYSTEMCurrentControlSetControlClass4D36E965_E325_11CE_BFC1_08002BE10318
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, eax
test eax, eax
jne 0x18001c1e4
lea r8, [rsp + 0x20]
lea rdx, [0x180027490]
lea rcx, str.UpperFilters
call fcn.18001b120
mov ebx, eax
test ebx, ebx
jne 0x18001c257
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x18001c22f
lea r8, [rsp + 0x20]
lea rdx, str.SYSTEMCurrentControlSetControlCrashControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, eax
test eax, eax
jne 0x18001c22b
lea r8, [rsp + 0x20]
lea rdx, str.dcrypt.sys
lea rcx, str.DumpFilters
call fcn.18001b120
mov ebx, eax
test ebx, ebx
jne 0x18001c257
lea r8, str.dc_save_conf_CDROM_..._n
lea rcx, str.drvinst.c
mov edx, 0x14d
call sym.dcapi.dll_log_print
lea rcx, [rsp + 0x28]
call sym.dcapi.dll_dc_save_config
mov ebx, eax
test eax, eax
je 0x18001c276
lea r8, str.dc_remove_driver______________..._n
lea rcx, str.drvinst.c
mov edx, 0x152
call sym.dcapi.dll_log_print
call sym.dcapi.dll_dc_remove_driver
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18000ee20
add rsp, 0x50
pop rbx
ret

Function at 0x18001c290
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov ecx, dword [0x18002dbb0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edx, edx
xor r9d, r9d
mov qword [rsp + 0x38], rdx
mov rcx, rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rdx
mov edx, 0x2201e4
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
add rsp, 0x48
ret
Function at 0x18001c2e0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x308
mov rax, qword [0x18002d000]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
lea rdx, [rsp + 0x258]
sub rdx, rcx
nop word [rax + rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x18001c310
mov ecx, dword [0x18002dbb0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x40]
mov r9d, 0x2a0
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov edx, 0x220200
mov dword [rsp + 0x28], 0x2a0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
mov ecx, 1
cmovne ecx, dword [rsp + 0x2de]
mov eax, ecx
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.18000ee20
add rsp, 0x308
ret

Function at 0x18001c3a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x40
mov ecx, dword [0x18002dbb0]
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
lea r8, [rsp + 0x50]
mov qword [rsp + 0x38], rdi
mov rcx, rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea r9d, [rdi + 4]
mov edx, 0x2201e0
mov dword [rsp + 0x28], 0x18
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rbx, qword [rsp + 0x58]
test eax, eax
sete dil
mov eax, edi
add rsp, 0x40
pop rdi
ret

Function at 0x18001c410
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x300
mov rax, qword [0x18002d000]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rdi, rdx
lea rdx, [rsp + 0x258]
mov rbx, rcx
sub rdx, rcx
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x18001c440
mov ecx, dword [0x18002dbb0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x40]
mov r9d, 0x2a0
mov qword [rsp + 0x30], rax
mov edx, 0x2201ac
mov dword [rsp + 0x28], 0x22c
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x18001c4a1
mov eax, 1
jmp 0x18001c4c8
cmp word [rdi + 0x24], 0
jne 0x18001c4c1
sub rdi, rbx
nop dword [rax + rax]
movzx eax, word [rbx]
add rbx, 2
mov word [rdi + rbx + 0x22], ax
test ax, ax
jne 0x18001c4b0
mov eax, dword [rsp + 0x2de]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.18000ee20
mov rbx, qword [rsp + 0x310]
add rsp, 0x300
pop rdi
ret