joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000d040
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x1f8]
sub rsp, 0x2e0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800704c0]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
xor ebx, ebx
mov edi, ebx
mov dword [rsp + 0x20], ebx
test rcx, rcx
jne 0x18000d08b
xor eax, eax
jmp 0x18000d292
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
cmp word [rcx], bx
jne 0x18000d0a8
mov r8, rbx
jmp 0x18000d0ba
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rcx + r8*2], bx
jne 0x18000d0b0
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.180002d00
nop
lea rcx, [rsp + 0x50]
call fcn.18000e590
xor edx, edx
mov r8d, 0x238
lea rcx, [rbp - 0x70]
call fcn.180036a10
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x18000d273
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x18000d269
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
cmp word [rbp - 0x44], 0
jne 0x18000d134
mov r8, rbx
jmp 0x18000d14b
lea rax, [rbp - 0x44]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18000d140
lea rdx, [rbp - 0x44]
lea rcx, [rsp + 0x30]
call fcn.180002d00
nop
lea rcx, [rsp + 0x30]
call fcn.18000e590
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
mov r9, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x40]
call fcn.180002240
test eax, eax
je 0x18000d1e3
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.18000ddb0
or edi, 1
lea r9, [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x18000d1b9
mov rax, qword [rax]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov r9, qword [r9]
mov r8, rax
mov rdx, qword [rsp + 0x60]
call fcn.180002240
test eax, eax
je 0x18000d1e3
xor sil, sil
jmp 0x18000d1e6
mov sil, 1
test dil, 1
je 0x18000d20b
and edi, 0xfffffffe
mov r8, qword [rbp - 0x78]
cmp r8, 8
jb 0x18000d20b
inc r8
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.180002f20
test sil, sil
jne 0x18000d23e
mov r8, qword [rsp + 0x48]
cmp r8, 8
jb 0x18000d22d
inc r8
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.180002f20
lea rdx, [rbp - 0x70]
mov rcx, r14
call sub.KERNEL32.dll_Process32NextW
jmp 0x18000d10d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp - 0x68]
mov r8, qword [rsp + 0x48]
cmp r8, 8
jb 0x18000d273
inc r8
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.180002f20
jmp 0x18000d273
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rsp + 0x68]
cmp r8, 8
jb 0x18000d290
inc r8
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.180002f20
mov eax, ebx
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.180015b60
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x18000d2c0
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x1d8]
sub rsp, 0x2c0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800704c0]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rdi, rcx
xor ebx, ebx
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x70]
call fcn.180036a10
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x28], bx
or r14, 0xffffffffffffffff
cmp word [rdi], bx
jne 0x18000d32f
mov r8d, ebx
jmp 0x18000d33c
mov r8, r14
inc r8
cmp word [rdi + r8*2], bx
jne 0x18000d332
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.180002d00
nop
lea rcx, [rsp + 0x28]
call fcn.18000e590
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000d49a
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x18000d490
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
cmp word [rbp - 0x64], 0
jne 0x18000d3a7
mov r8, rbx
jmp 0x18000d3bb
lea rax, [rbp - 0x64]
mov r8, r14
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x18000d3b0
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x48]
call fcn.180002d00
nop
lea rcx, [rsp + 0x48]
call fcn.18000e590
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x48]
mov rdi, qword [rsp + 0x48]
mov r9, qword [rsp + 0x60]
cmp r9, 8
cmovae rdx, rdi
mov r10, qword [rsp + 0x38]
mov r8, r10
mov r11, qword [rsp + 0x58]
cmp r11, r10
cmovb r8, r11
test r8, r8
jmp 0x18000d43a
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x18000d42b
add rdx, 2
add rcx, 2
sub r8, 1
jmp 0x18000d43a
mov r8d, 1
cmp word [rdx], ax
cmovb r8d, r14d
jmp 0x18000d43f
jne 0x18000d415
mov r8d, ebx
test r8d, r8d
jne 0x18000d44b
cmp r11, r10
jb 0x18000d44b
jbe 0x18000d474
cmp r9, 8
jb 0x18000d462
lea r8, [r9 + 1]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.180002f20
lea rdx, [rsp + 0x70]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
jmp 0x18000d380
mov ebx, 1
cmp r9, 8
jb 0x18000d490
lea r8, [r9 + 1]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.180002f20
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x18000d4b7
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.180002f20
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.180015b60
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x18000d4e0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
call fcn.18000d040
test eax, eax
jg 0x18000d4f9
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x30], rdi
mov r8d, eax
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x18000d51f
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x30]
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x18000d9f0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x70
xor r14d, r14d
lea rax, [r11 - 0x18]
mov rbx, r9
mov qword [r11 - 0x18], r14
mov rbp, r8
mov qword [r11 - 0x20], r14
mov rsi, rdx
mov qword [r11 - 0x28], r14
mov rdi, rcx
mov qword [r11 - 0x58], rax
mov r9d, 0xf013f
lea rdx, str.SoftWare
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000db34
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov rdx, rdi
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18000db29
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov rdx, rsi
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x18000dad9
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
jmp 0x18000db2e
or rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rbx + rax*2 + 2], r14w
lea rax, [rax + 1]
jne 0x18000dae0
lea ecx, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], ecx
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
mov rdx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1800101e0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x18001020e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180011130
cmp byte [0x180073050], 0
jne 0x180010259
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180010249
lea rdx, [0x180051978]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180073048], rax
mov byte [0x180073050], 1
jmp 0x180010260
mov rax, qword [0x180073048]
mov byte [0x180073050], 1
jmp 0x180010260
mov rax, qword [0x180073048]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x18001027f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1800111a4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800111c6
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800111c6
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je 0x1800111c6
mov rdx, rdi
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180010fe0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1800704c0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov qword [rsp + 0x48], rbp
mov r8, rdx
mov dword [rsp + 0x50], ebp
mov rdx, qword [rcx]
mov rdi, rcx
or r9d, 0x2001f
mov qword [rsp + 0x58], rbp
lea rcx, [rsp + 0x48]
call fcn.180010b40
mov ebx, eax
test eax, eax
jne 0x1800110f7
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1800110d1
nop dword [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.180010fe0
mov ebx, eax
test eax, eax
jne 0x1800110f7
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x180011080
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1800110e6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov rdx, rsi
mov dword [rsp + 0x50], ebp
mov rcx, rdi
call fcn.1800101e0
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180011107
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180015b60
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x180011130
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x18001020e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180011130
cmp byte [0x180073050], 0
jne 0x180010259
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180010249
lea rdx, [0x180051978]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180073048], rax
mov byte [0x180073050], 1
jmp 0x180010260
mov rax, qword [0x180073048]
mov byte [0x180073050], 1
jmp 0x180010260
mov rax, qword [0x180073048]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x18001027f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1800111a4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800111c6
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800111c6
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je 0x1800111c6
mov rdx, rdi
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1800113d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1800704c0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x18001145e
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x18001145e
call fcn.18000fbf0
mov ebx, eax
jmp 0x180011586
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x18001147f
call fcn.18000fbf0
jmp 0x180011575
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1800114a2
call fcn.18000fbf0
jmp 0x180011575
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x1800114c4
mov ebx, 0x8007000e
jmp 0x180011577
mov ecx, eax
test eax, eax
je 0x1800114fc
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x1800114f2
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x1800114fc
lea rcx, [rsp + 0x70]
call fcn.18000fae0
jmp 0x180011506
mov ecx, 0x80070216
call fcn.18000aaf0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x180011519
cmp qword [rsp + 0x70], 0
jne 0x180011528
mov ebx, 0x8007000e
jmp 0x180011577
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x180011552
call fcn.18000fbf0
jmp 0x180011575
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1800111e0
mov ebx, eax
test rdi, rdi
je 0x180011586
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x18001159d
lea rcx, [rsp + 0x70]
call fcn.1800102d0
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.180015b60
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x180011d30
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x180011d70
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9, r8
mov r10, rdx
test r8, r8
jne 0x180011d88
lea eax, [r8 + 0xd]
add rsp, 0x38
ret
xor r8d, r8d
mov rdx, r9
nop
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x180011d94
inc eax
lea rdx, [rdx + rax*2]
lea r8d, [r8 + rax*2]
cmp eax, 1
jne 0x180011d90
mov rcx, qword [rcx]
mov rdx, r10
mov dword [rsp + 0x28], r8d
xor r8d, r8d
mov qword [rsp + 0x20], r9
lea r9d, [rax + 6]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x180019288
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x18001929b
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.180019900
lea rdx, [0x18006e698]
lea rcx, [rsp + 0x20]
call fcn.180036270
int3

Function at 0x180023e40
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x180074128]
xor edx, edx
jmp fcn.180019288

Function at 0x180024840
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x180074128]
jmp fcn.180019288
Function at 0x180002bab
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x180002d02
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x40]
jmp 0x180002c2c
mov eax, 1
add eax, 0
jmp 0x180002c26
ret
cmp dword [rsp + 0x34], 0xffffffff
je 0x180002c22
movsxd rax, dword [rsp + 0x34]
jmp 0x180002e10
jmp 0x180002c38
xor eax, eax
add rsp, 0x78
jmp 0x180002bc7
movzx eax, word [rax + 6]
cmp dword [rsp + 0x30], eax
jge 0x180002c24
jmp 0x180002cb2
mov eax, dword [rsp + 0x30]
inc eax
jmp 0x180002bb0
mov rax, qword [rsp + 0x38]
cmp dword [rax + 8], 0
jne 0x180002c61
jmp 0x180002c5f
mov rax, qword [rsp + 0x38]
cmp dword [rax + 0xc], 0
je 0x180002c5f
cmp dl, dl
je 0x180002c43
jmp 0x180002c38
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
jmp 0x180002cdb
xor edx, edx
mov rcx, qword [rsp + 0x98]
cmp dl, dl
je 0x180002c94
mov r8d, 6
add r8d, 0xa
cmp bl, bl
je 0x180002c6b
movsxd rcx, dword [rsp + 0x30]
imul rcx, rcx, 0x28
cmp bh, bh
je 0x180002ce7
call fcn.180003ca1
mov dword [rsp + 0x30], 0
jmp 0x180002bb4
mov rax, rcx
mov qword [rsp + 0x50], rax
jmp 0x180002cc0
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x14]
cmp ax, ax
je 0x180002ccd
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 8]
jmp 0x180002e42
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax + 0x18]
cmp dl, dl
je 0x180002c87
mov rcx, qword [rsp + 0x48]
add rcx, rax
cmp bh, bh
je 0x180002ca8
add rax, rcx
mov qword [rsp + 0x38], rax
jmp 0x180002c50
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
cmp ch, ch
je 0x180002d47
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
cmp bp, bp
je 0x180002d7f
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
jmp 0x180002c79
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x34], 0
jmp 0x180002d11
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x88]
cmp bl, bl
je 0x180002d6f
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x48]
cmp bx, bx
je 0x180002d65
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
cmp ah, ah
je 0x180002cf4
add rcx, rax
mov rax, rcx
cmp dl, dl
je 0x180002d36
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x90]
cmp al, al
je 0x180002d28
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
cmp cl, cl
je 0x180002d55
out 0xda, al
xchg r9, rdx
test r11, rax
ret
call fcn.180003fb5
mov dword [rsp + 0x34], eax
jmp 0x180002c11
mov edx, eax
mov rcx, qword [rsp + 0x50]
cmp di, di
je 0x180002df6
mov rcx, qword [rsp + 0x50]
add rcx, rax
cmp bx, bx
je 0x180002e1d
mov rax, rcx
mov qword [rsp + 0x58], rax
cmp al, al
je 0x180002e34
mov ecx, dword [rcx + 0xc]
mov dword [rax + 8], ecx
jmp 0x180002bbb
mov rax, qword [rsp + 0x58]
add rax, 0x10
cmp cx, cx
je 0x180002e73
mov qword [rsp + 0x20], 0
mov r9d, 0xa
cmp sp, sp
je 0x180002e65
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x58]
jmp 0x180002e29
add r9d, 2
lea r8, [rsp + 0x60]
cmp si, si
je 0x180002e04
mov rcx, qword [rsp + 0x98]
mov qword [rcx], rax
cmp ch, ch
je 0x180002e56

Function at 0x1800033a7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x180003414
add rsp, 0x18
ret
add dword [rsp], 0
mov eax, dword [rsp]
jmp 0x180003406
sub rsp, 0x18
mov dword [rsp], 1
cmp cl, cl
je 0x18000340b
Function at 0x140005c90
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
mov eax, 0x1030
call fcn.14001a2a0
sub rsp, rax
mov rax, qword [0x14005c080]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov r15, r9
mov rdi, r8
mov r14, rcx
test r8, r8
je 0x140005d57
mov r9d, 0x1000
lea rdx, [rsp + 0x20]
call fcn.140003d70
test al, al
jne 0x140005ce6
lea rdx, str.____Cant_read_module_headers
jmp 0x140005d43
movsxd rax, dword [rsp + 0x5c]
lea rcx, [rsp + 0x20]
add rcx, rax
xor r8d, r8d
movzx eax, word [rcx + 0x14]
lea r10, [rcx + 0x18]
movzx r9d, word [rcx + 6]
add r10, rax
test r9d, r9d
je 0x140005d3c
lea rbx, [r8 - 1]
nop
lea rcx, [r8 + r8*4]
cmp dword [r10 + rcx*8], 0x45474150
lea rdx, [r10 + rcx*8]
jne 0x140005d34
mov rax, rbx
inc rax
cmp byte [rdx + rax], 0
jne 0x140005d25
cmp rax, 4
je 0x140005d79
inc r8d
cmp r8d, r9d
jb 0x140005d10
lea rdx, str.____Cant_find_section
lea rcx, [0x1403b1b80]
call fcn.14000a3b0
mov rcx, rax
call fcn.14000a660
lea rdx, str.____No_module_address_to_find_pattern
lea rcx, [0x1403b1b80]
call fcn.14000a3b0
mov rcx, rax
call fcn.14000a660
xor eax, eax
jmp 0x140005e79
mov eax, dword [rdx + 0xc]
lea rbp, [rsp + 0x20]
mov ecx, dword [rdx + 8]
add rbp, rax
je 0x140005d3c
test ecx, ecx
je 0x140005d3c
lea rax, [rsp + 0x20]
sub rbp, rax
add rbp, rdi
mov edi, ecx
je 0x140005d57
cmp rcx, 0x40000000
jbe 0x140005dc7
lea rdx, str.____Cant_find_pattern__Too_big_section
lea rcx, [0x1403b1b80]
call fcn.14000a3b0
mov rcx, rax
call fcn.14000a660
xor eax, eax
jmp 0x140005e79
mov qword [rsp + 0x1068], rsi
call fcn.140019ee8
mov r9, rdi
mov r8, rbp
mov rdx, rax
mov rcx, r14
mov rsi, rax
call fcn.140003d70
mov r10, qword [rsp + 0x1080]
inc rbx
cmp byte [r10 + rbx], 0
jne 0x140005df0
mov r9d, 0
sub rdi, rbx
je 0x140005e4c
movzx r11d, byte [r10]
mov rbx, rsi
sub rbx, r15
nop
mov rdx, r10
mov rax, r15
test r11b, r11b
je 0x140005e3f
movzx ecx, r11b
lea r8, [rbx + r9]
cmp cl, 0x78
jne 0x140005e31
movzx ecx, byte [rax]
cmp byte [r8 + rax], cl
jne 0x140005e44
movzx ecx, byte [rdx + 1]
inc rdx
inc rax
test cl, cl
jne 0x140005e23
cmp byte [rdx], 0
je 0x140005e98
inc r9
cmp r9, rdi
jb 0x140005e10
lea rdx, str.____Cant_find_pattern
lea rcx, [0x1403b1b80]
call fcn.14000a3b0
mov rcx, rax
call fcn.14000a660
mov rcx, rsi
call fcn.1400198a0
xor eax, eax
mov rsi, qword [rsp + 0x1068]
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140019880
add rsp, 0x1030
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
lea rbx, [r9 + rsi]
test rbx, rbx
je 0x140005e4c
mov rcx, rsi
call fcn.1400198a0
sub rbx, rsi
lea rax, [rbx + rbp]
jmp 0x140005e71