joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180047d10
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov esi, 0x20
test eax, eax
je 0x180047d7a
mov rcx, qword [rsp + 0x50]
mov r8, rdi
mov edx, esi
mov qword [rsp + 0x40], rbx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test ebx, ebx
mov rbx, qword [rsp + 0x40]
jne 0x180047dc4
xor ecx, ecx
call fcn.1800aefe0
mov rcx, rax
call fcn.1800bafcc
nop dword [rax]
call fcn.1800bafa0
mov r8d, eax
lea rdi, [rdi + 1]
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
mov byte [rdi - 1], r8b
sub rsi, 1
jne 0x180047d90
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x180049bf0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov eax, dword [rcx + 0x10]
mov rdi, rcx
mov rbx, qword [sym.imp.KERNEL32.dll_ReadFile]
lea rcx, [0x18004a950]
mov r10, qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
mov r11, r9
mov ebp, r8d
cmovne rbx, rcx
mov r14, rdx
lea rcx, [0x18004a8f0]
cmovne r10, rcx
test rbx, rbx
je 0x180049c9d
test r10, r10
je 0x180049c9d
mov rcx, qword [rdi + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, r11
call r10
test eax, eax
je 0x180049c9d
mov r9, qword [rsp + 0x60]
mov r8d, ebp
mov rcx, qword [rdi + 8]
mov rdx, r14
mov qword [rsp + 0x20], 0
call rbx
mov ebx, eax
test eax, eax
jne 0x180049c99
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x180049c99
mov r9, qword [rsp + 0x60]
mov r8d, ebp
mov rcx, qword [rdi + 8]
mov rdx, r14
call fcn.1800247a0
mov ebx, eax
mov eax, ebx
jmp 0x180049c9f
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x180052940
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
cmp dword [rcx + 0x14], 0
mov rdi, r9
mov r14, qword [rcx + 8]
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
je 0x18005298f
mov ecx, 0x10
call fcn.180033710
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
test rax, rax
je 0x18005299b
call rax
jmp 0x1800529a1
xor r9d, r9d
mov rdx, rdi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180052a2b
cmp dword [rbx + 0x14], 0
mov rdi, qword [rbx + 8]
je 0x1800529e0
mov ecx, 9
call fcn.180033710
mov rbx, qword [rsp + 0x60]
mov r8d, esi
mov qword [rsp + 0x20], 0
mov r9, rbx
mov rdx, rbp
mov rcx, rdi
test rax, rax
je 0x1800529fa
call rax
jmp 0x180052a00
mov rbx, qword [rsp + 0x60]
mov r8d, esi
mov r9, rbx
mov qword [rsp + 0x20], 0
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180052a24
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x180052a2b
mov r9, rbx
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
call fcn.1800247a0
test eax, eax
je 0x180052a2b
mov eax, 1
jmp 0x180052a44
lea r9, [0x1800f7d08]
xor edx, edx
lea r8, [0x1800f7d08]
xor ecx, ecx
call fcn.1800689dc
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x180052a60
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x14], 0
mov rbx, rdx
mov rdi, qword [rcx + 8]
je 0x180052a99
mov ecx, 0x28
call fcn.180033710
mov rdx, rbx
mov rcx, rdi
test rax, rax
je 0x180052a9c
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
Function at 0x18005c0f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov ebx, r8d
mov rdi, rdx
test rdx, rdx
je 0x18005c1a3
test ebx, ebx
jle 0x18005c1a3
mov rsi, qword [rcx + 8]
mov qword [rsp + 0x40], rbp
xor ebp, ebp
mov dword [rsp + 0x48], ebp
cmp dword [rcx + 0x218], ebp
je 0x18005c151
lea ecx, [rbp + 9]
call fcn.180033710
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x48]
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
test rax, rax
je 0x18005c15e
call rax
jmp 0x18005c164
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbp, qword [rsp + 0x40]
test eax, eax
jne 0x18005c18f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x18005c1a3
lea r9, [rsp + 0x48]
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call fcn.1800247a0
test eax, eax
je 0x18005c1a3
mov eax, dword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x50]
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x18005ec90
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rbp + 0x100], rax
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x10]
call fcn.1800abaa0
xor r14d, r14d
mov dword [rsp + 0x28], 0x67452301
mov r9, rbx
mov qword [rsp + 0x20], r14
lea r8, [0x1800fe5a8]
mov dword [rsp + 0x2c], 0xefcdab89
mov edx, 0x104
mov dword [rsp + 0x30], 0x98badcfe
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x34], 0x10325476
call fcn.180060fb0
lea rax, [rbp - 0x10]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], r14b
jne 0x18005ed20
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x20]
call fcn.18005de20
lea rcx, [rsp + 0x20]
call fcn.18005e110
lea rcx, [rsp + 0x20]
call fcn.18005e110
movups xmm0, xmmword [rsp + 0x78]
xor eax, eax
mov rbx, r14
mov qword [rbp - 0x60], rax
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
nop dword [rax]
movzx r9d, byte [rbp + rbx - 0x20]
lea r8, str._02x
mov edx, 8
mov qword [rbp - 0x70], r14
lea rcx, [rbp - 0x70]
call fcn.180060fb0
lea rcx, [rbp - 0x60]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], r14b
jne 0x18005edb0
mov ecx, 0x40
lea rdx, [rbp - 0x70]
sub ecx, eax
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], r14b
jne 0x18005edd0
cmp ecx, eax
lea rdx, [rbp - 0x70]
cmovge ecx, eax
movsxd r8, ecx
lea rcx, [rbp - 0x60]
call fcn.1800bbb30
inc rbx
cmp rbx, 0x10
jl 0x18005ed80
test rdi, rdi
je 0x18005ee2a
mov r8, rsi
xor edx, edx
mov rcx, rdi
call fcn.1800abaa0
lea eax, [rsi - 1]
mov rcx, rdi
movsxd rdx, eax
lea r9, [rbp - 0x60]
lea r8, [0x1800fe5a8]
call fcn.180060fb0
mov rcx, rdi
call fcn.1800bbef0
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.18008f850
add rsp, 0x210
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18005f370
Capabilities:
Get storage device properties

Disassembly:
push rbp
mov eax, 0x2d80
call fcn.180090180
sub rsp, rax
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rsp + 0x2d60], rax
mov rbp, rcx
test rcx, rcx
je 0x18005f555
mov qword [rsp + 0x2d98], rbx
mov qword [rsp + 0x2da0], rsi
mov qword [rsp + 0x2da8], rdi
mov qword [rsp + 0x2d78], r14
xor r14d, r14d
mov qword [rsp + 0x2d70], r15
mov edi, r14d
mov ebx, r14d
lea r15d, [r14 + 1]
nop dword [rax]
nop word [rax + rax]
mov r9d, ebx
lea r8, [0x1800fe5b8]
mov edx, 0x200
lea rcx, [rsp + 0x450]
call fcn.18002d560
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, [rsp + 0x450]
xor edx, edx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18005f51e
xor edx, edx
mov dword [rsp + 0x40], r14d
mov r8d, 0x2710
mov qword [rsp + 0x4c], r14
lea rcx, [rsp + 0x650]
mov dword [rsp + 0x48], r14d
call fcn.1800abaa0
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x48]
lea rax, [rsp + 0x650]
mov dword [rsp + 0x28], 0x2710
mov r9d, 0xc
mov qword [rsp + 0x20], rax
mov edx, 0x2d1400
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x18005f511
xor edx, edx
lea rcx, [rsp + 0x61]
mov r8d, 0x3e7
call fcn.1800abaa0
mov edx, dword [rsp + 0x668]
mov byte [rsp + 0x60], r14b
test edx, edx
jle 0x18005f4cb
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x650]
call fcn.18005d6f0
lea r8, [rsp + 0x60]
mov edx, 0x64
sub r8, rbp
mov rax, rbp
nop dword [rax + rax]
lea rcx, [rdx + 0x7fffff9a]
test rcx, rcx
je 0x18005f4ff
movzx ecx, byte [r8 + rax]
test cl, cl
je 0x18005f4ff
mov byte [rax], cl
inc rax
sub rdx, r15
jne 0x18005f4e0
test rdx, rdx
lea rcx, [rax - 1]
cmovne rcx, rax
cmovne edi, r15d
mov byte [rcx], r14b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x18005f529
inc ebx
cmp ebx, 0x10
jl 0x18005f3e0
mov r15, qword [rsp + 0x2d70]
mov eax, edi
mov rdi, qword [rsp + 0x2da8]
mov r14, qword [rsp + 0x2d78]
mov rsi, qword [rsp + 0x2da0]
mov rbx, qword [rsp + 0x2d98]
jmp 0x18005f557
xor eax, eax
mov rcx, qword [rsp + 0x2d60]
xor rcx, rsp
call fcn.18008f850
add rsp, 0x2d80
pop rbp
ret
Function at 0x18005fd40
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x560
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rsp + 0x550], rax
mov rdi, rcx
test rcx, rcx
je 0x18005ff32
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x30], 0x400
xor edx, edx
mov r8d, 0x400
lea rcx, [r11 - 0x418]
call fcn.1800abaa0
lea rcx, [rsp + 0x38]
call fcn.18005dbb0
nop
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x150]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x34]
lea r8, str.mid64
mov rdx, qword [rax]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
sete sil
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18005fe07
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test sil, sil
je 0x18005ff32
lea rax, [rsp + 0x150]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x18005fe20
cmp rbx, 0x40
jne 0x18005ff32
mov edx, 0x80
mov r8d, edx
lea rcx, [rsp + 0x50]
lea r9, [rsp + 0x150]
lea rax, [rsp + 0x50]
sub r9, rax
lea rax, [r8 - 0x60]
test rax, rax
je 0x18005fe6d
movzx eax, byte [r9 + rcx]
test al, al
je 0x18005fe6d
mov byte [rcx], al
inc rcx
sub r8, 1
jne 0x18005fe50
lea rax, [rcx - 1]
test r8, r8
cmovne rax, rcx
mov byte [rax], 0
lea rax, [rsp + 0xd0]
lea r9, [rsp + 0x170]
lea rcx, [rsp + 0xd0]
sub r9, rcx
nop word [rax + rax]
lea rcx, [rdx + 0x7fffff7e]
test rcx, rcx
je 0x18005fec0
movzx ecx, byte [r9 + rax]
test cl, cl
je 0x18005fec0
mov byte [rax], cl
inc rax
sub rdx, 1
jne 0x18005fea0
lea rcx, [rax - 1]
test rdx, rdx
cmovne rcx, rax
mov byte [rcx], 0
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x150]
call fcn.1800abaa0
mov r8d, 0x400
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x50]
call fcn.18005ec90
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x18005ff32
lea r8, [rsp + 0x50]
mov edx, 0x104
mov rcx, rdi
call fcn.180047b30
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
jmp 0x18005ff34
xor eax, eax
mov rcx, qword [rsp + 0x550]
xor rcx, rsp
call fcn.18008f850
lea r11, [rsp + 0x560]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1800612d0
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov r9, rcx
test edx, edx
je 0x1800613b4
mov r10d, edx
movzx edx, byte [r9]
lea r9, [r9 + 1]
xor dl, al
movzx eax, dl
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx r8d, al
and dl, 1
cmove r8d, ecx
movzx eax, r8b
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx edx, al
and r8b, 1
cmove edx, ecx
movzx eax, dl
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx r8d, al
and dl, 1
cmove r8d, ecx
movzx eax, r8b
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx edx, al
and r8b, 1
cmove edx, ecx
movzx eax, dl
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx r8d, al
and dl, 1
cmove r8d, ecx
movzx eax, r8b
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx edx, al
and r8b, 1
cmove edx, ecx
movzx eax, dl
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx r8d, al
and dl, 1
cmove r8d, ecx
movzx eax, r8b
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
and r8b, 1
movzx eax, al
cmove eax, ecx
sub r10, 1
jne 0x1800612e0
ret
Function at 0x1800614f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov qword [rbp - 0x51], 0xfffffffffffffffe
mov qword [rsp + 0x130], rbx
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rdx], r15d
mov qword [rbp - 0x71], r15
mov dword [rbp - 0x69], r15d
mov qword [rbp - 0x61], r15
lea rcx, [rbp - 0x59]
call fcn.1800613c0
nop
mov r9d, 0x201
mov r8, qword [rax]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x71]
call fcn.180022180
test eax, eax
sete bl
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180061586
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test bl, bl
je 0x1800616ee
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rbp - 0x49]
call fcn.1800abaa0
mov dword [rsp + 0x30], 0x64
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, [0x1800fe79c]
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800616ee
mov eax, dword [rsp + 0x38]
dec eax
cmp eax, 1
ja 0x1800616ee
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x18006160b
test cl, 1
jne 0x1800616ee
mov eax, ecx
shr rax, 1
cmp word [rbp + rax*2 - 0x4b], 0
je 0x180061610
jmp 0x1800616ee
mov word [rbp - 0x49], r15w
shr ecx, 1
cmp ecx, 0x2d
jne 0x1800616ee
call fcn.180025f00
mov rcx, rax
test rax, rax
je 0x18006172d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x79], rax
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x79]
call fcn.180063dd0
mov dword [rsp + 0x34], r15d
lea r8, [rsp + 0x34]
lea rdx, [0x1800fe7a4]
lea rcx, [rbp + 0xb]
call fcn.18002d350
mov edx, 0x2a
mov rbx, qword [rbp - 0x79]
mov rcx, rbx
call fcn.1800612d0
movzx ecx, al
cmp dword [rsp + 0x34], ecx
jne 0x1800616d7
lea rcx, [rbp - 0x49]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x180061682
mov r8d, eax
lea rdx, [rbp - 0x49]
mov rcx, rsi
call fcn.1800252d0
mov r8d, 8
lea rdx, str.ffffffff
lea rcx, [rbp - 0x49]
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
mov esi, 1
test eax, eax
jne 0x1800616be
mov dword [r14], esi
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1800616f1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x1800616f1
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1800616ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov esi, r15d
mov rcx, qword [rbp - 0x71]
test rcx, rcx
je 0x180061704
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x71], r15
mov dword [rbp - 0x69], r15d
mov eax, esi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.18008f850
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.1800220a0
int3
Function at 0x1800645f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x2c0], rbx
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rdi, rdx
mov rbx, rcx
xor esi, esi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.DriverDesc
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800646a7
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 1
ja 0x1800646a7
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x180064745
test al, 1
jne 0x1800646a7
shr rax, 1
cmp word [rsp + rax*2 + 0x6e], si
je 0x18006474a
cmp dword [rdi], 0
jne 0x1800647bd
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x60], rsi
mov r9d, 1
lea r8, str.NDIInterfaces
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.180022180
mov rbx, qword [rsp + 0x50]
test eax, eax
jne 0x1800647a6
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.LowerRange
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800647a6
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 1
ja 0x1800647a6
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x18006476d
test al, 1
jne 0x1800647a6
shr rax, 1
cmp word [rsp + rax*2 + 0x6e], 0
je 0x180064772
jmp 0x1800647a6
mov word [rsp + 0x70], si
lea rdx, str.Wireless
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x1800646a7
mov dword [rdi], 1
jmp 0x1800647bd
mov word [rsp + 0x70], si
lea rdx, str.wlan
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x1800647a0
lea rdx, str.vwifi
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x1800647a6
mov dword [rdi], 1
test rbx, rbx
je 0x1800647b9
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x40], esi
mov eax, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.18008f850
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x180066dd8
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor ebx, ebx
mov r15, rcx
cmp dword [0x180132500], ebx
je 0x180066e25
movups xmm0, xmmword [0x180131ea0]
lea eax, [rbx + 1]
movdqu xmmword [rcx], xmm0
jmp 0x180066f30
mov ebp, 0x2000
mov ecx, ebp
call fcn.1800686e8
mov rsi, rax
test rax, rax
jne 0x180066e55
lea r9, [0x1800f7d08]
xor edx, edx
lea r8, [0x1800f7d08]
xor ecx, ecx
call fcn.1800689dc
jmp 0x180066f2e
mov rcx, rsi
call fcn.18006b03c
movsxd rdi, eax
test eax, eax
js 0x180066ea0
sub ebp, edi
lea r14, [rsi + rdi]
mov edx, ebp
mov rcx, r14
call fcn.18006b118
movsxd rcx, eax
test eax, eax
jle 0x180066e7f
mov byte [r14], 0x7c
js 0x180066ea0
sub ebp, ecx
add r14, rcx
add edi, ecx
mov edx, ebp
mov rcx, r14
call fcn.18006b328
test eax, eax
jle 0x180066e9a
mov byte [r14], 0x7c
js 0x180066ea0
add edi, eax
jmp 0x180066ea3
or edi, 0xffffffff
test edi, edi
jns 0x180066ebf
mov r8d, 9
xor edx, edx
lea r9, [0x1800f7d08]
xor ecx, ecx
call fcn.180068b40
jmp 0x180066f26
jne 0x180066ec9
mov r8d, 0xb
jmp 0x180066ead
mov r8d, edi
mov qword [rsp + 0x30], rbx
mov rdx, rsi
mov dword [rsp + 0x20], 0x67452301
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
call fcn.180069ff4
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.18006a0b4
movups xmm0, xmmword [r15]
mov dword [0x180132500], 1
mov ebx, 1
movdqu xmmword [0x180131ea0], xmm0
mov rcx, rsi
call fcn.1800aea38
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18008f850
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x180066f60
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x10], edx
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r12, r9
lea rax, [rbp - 8]
mov r14, r8
mov qword [rsp + 0x20], rax
mov rdi, rcx
lea rdx, str.SOFTWARE360MachineSignature
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
xor esi, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180067108
xor edx, edx
lea r8d, [rsi + 0x38]
mov rcx, r14
call fcn.1800abaa0
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x38]
mov r15d, 0x400
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov dword [rbp + 0x38], r15d
lea rdx, str.Operator
mov ebx, r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180067017
cmp dword [rbp - 0x10], 1
jne 0x1800670fe
mov eax, dword [rbp + 0x38]
mov qword [r14], rdi
add rdi, rax
sub ebx, dword [rbp + 0x38]
je 0x1800670fe
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.IssueDate
mov dword [rbp + 0x38], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180067061
cmp dword [rbp - 0x10], 1
jne 0x1800670fe
mov eax, dword [rbp + 0x38]
mov qword [r14 + 8], rdi
add rdi, rax
sub ebx, dword [rbp + 0x38]
je 0x1800670fe
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.ExpirationDate
mov dword [rbp + 0x38], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800670a3
cmp dword [rbp - 0x10], 1
jne 0x1800670fe
mov eax, dword [rbp + 0x38]
mov qword [r14 + 0x10], rdi
add rdi, rax
sub ebx, dword [rbp + 0x38]
je 0x1800670fe
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.SignData
mov dword [rbp + 0x38], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800670fe
cmp dword [rbp - 0x10], 3
jne 0x1800670fe
mov eax, dword [rbp + 0x38]
mov dword [r14 + 0x28], eax
mov qword [r14 + 0x30], rdi
sub ebx, eax
je 0x1800670fe
lea rcx, [r14 + 0x18]
call fcn.180066dd8
test eax, eax
je 0x1800670fe
sub r15d, ebx
mov esi, 1
mov dword [r12], r15d
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x40]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret