joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800eb430
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180161180]
jne 0x1800eb44b
rol rcx, 0x10
test cx, 0xffff
jne 0x1800eb447
ret 0
ror rcx, 0x10
jmp 0x1800f19cc
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180164020]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x180164118]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1800f1a51
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180164020]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1800f1a73
mov rax, qword [rsp + 0x88]
mov qword [0x180164118], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1801640b8], rax
mov rax, qword [0x180164118]
mov qword [0x180163f90], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1801640a0], rax
mov dword [0x180163f80], 0xc0000409
mov dword [0x180163f84], 1
mov rax, qword [0x180161180]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180161188]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800387f0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x1800ef8ac
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push r12
sub rsp, 0x30
mov edi, r8d
mov ebx, edx
mov r12d, ecx
mov ecx, 8
call fcn.1800f9c78
nop
cmp dword [0x180163e14], 1
je 0x1800ef95f
mov dword [0x180163e10], 1
mov byte [0x180163dcc], dil
test ebx, ebx
jne 0x1800ef94b
mov rcx, qword [0x180175b50]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov rcx, qword [0x180175b48]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov qword [rsp + 0x20], rax
test rsi, rsi
je 0x1800ef938
sub rbx, 8
mov qword [rsp + 0x20], rbx
cmp rbx, rsi
jb 0x1800ef938
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800ef936
call rcx
jmp 0x1800ef91e
lea rdx, [0x180001048]
lea rcx, [0x180001030]
call fcn.1800ef6fc
lea rdx, [0x180001058]
lea rcx, [0x180001050]
call fcn.1800ef6fc
nop
test edi, edi
je 0x1800ef96d
mov ecx, 8
call fcn.1800f9b68
test edi, edi
jne 0x1800ef995
mov dword [0x180163e14], 1
lea ecx, [rdi + 8]
call fcn.1800f9b68
mov ecx, r12d
call fcn.1800ef6a0
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1800ef8ac

Function at 0x1800ef9b4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1800ef8ac
Function at 0x1800f05bc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r12d, r12d
mov rdi, rax
cmp rax, r12
je 0x1800f0695
mov rbx, rax
cmp word [rax], r12w
je 0x1800f0607
add rbx, 2
cmp word [rbx], r12w
jne 0x1800f05f3
add rbx, 2
cmp word [rbx], r12w
jne 0x1800f05f3
mov qword [rsp + 0x38], r12
sub rbx, rax
mov qword [rsp + 0x30], r12
sar rbx, 1
mov r8, rax
xor edx, edx
lea r9d, [rbx + 1]
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbp, eax
cmp ebp, r12d
je 0x1800f068c
mov rcx, rbp
call fcn.1800eca10
mov rsi, rax
cmp rax, r12
je 0x1800f068c
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9d, [rbx + 1]
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, r12d
jne 0x1800f067e
mov rcx, rsi
call fcn.1800ecacc
mov rsi, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
jmp 0x1800f0697
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret

Function at 0x1800f1904
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1800f196f
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x1800f198f
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x1800387b8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret
Function at 0x1800f54b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r13
sub rsp, 0x30
lea r13, [0x180161fd0]
mov ebx, ecx
xor edi, edi
mov rax, r13
cmp ecx, dword [rax]
je 0x1800f54e2
inc edi
add rax, 0x10
cmp edi, 0x17
jb 0x1800f54d3
cmp edi, 0x17
jae 0x1800f5690
mov ebp, 3
mov ecx, ebp
call fcn.1800fd3d4
cmp eax, 1
je 0x1800f5648
mov ecx, ebp
call fcn.1800fd3d4
test eax, eax
jne 0x1800f5518
cmp dword [0x180163d84], 1
je 0x1800f5648
cmp ebx, 0xfc
je 0x1800f5690
lea rbx, [0x1801645c0]
mov ebp, 0x314
lea r8, [0x180038eb8]
mov rcx, rbx
mov rdx, rbp
call fcn.1800ecd58
test eax, eax
je 0x1800f555b
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800f1904
lea rdx, [0x1801645d9]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x1801646dd], 0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1800f55ac
lea r8, [0x180038ea0]
lea rcx, [0x1801645d9]
mov edx, 0x2fb
call fcn.1800ecd58
test eax, eax
je 0x1800f55ac
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800f1904
lea r8, [0x1801645d9]
mov rdx, rbp
mov rcx, rbx
call fcn.1800fa790
test eax, eax
je 0x1800f55d7
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800f1904
lea r8, [0x18001b0b8]
mov rdx, rbp
mov rcx, rbx
call fcn.1800fa790
test eax, eax
je 0x1800f5602
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800f1904
movsxd r8, edi
mov rdx, rbp
mov rcx, rbx
add r8, r8
mov r8, qword [r13 + r8*8 + 8]
call fcn.1800fa790
test eax, eax
je 0x1800f5631
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800f1904
lea rdx, [0x180038e78]
mov r8d, 0x12010
mov rcx, rbx
call fcn.1800fd19c
jmp 0x1800f5690
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r11, rax
test rax, rax
je 0x1800f5690
or rcx, 0xffffffffffffffff
cmp rax, rcx
je 0x1800f5690
movsxd rdx, edi
xor eax, eax
lea r9, [rsp + 0x48]
and qword [rsp + 0x20], rax
add rdx, rdx
mov rdx, qword [r13 + rdx*8 + 8]
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r13
ret
Function at 0x1800fc15c
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r12
push r13
sub rsp, 0x90
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rdi
mov rax, qword [0x180161180]
xor rax, rbp
mov qword [rbp + 0x68], rax
mov eax, dword [rsp]
sub rsp, 0x10
lea r12, [rsp + 0x20]
mov eax, dword [r12]
lea rdx, [rbp + 8]
mov r8d, 0x30
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800fc262
mov r13, qword [rbp + 0x10]
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rbp + 0x3c]
lea rcx, [rbp]
xor ebx, ebx
and dword [rbp], ebx
call qword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
cmp eax, 1
jne 0x1800fc1ea
mov eax, dword [rbp]
test eax, eax
cmovne ebx, eax
lea edx, [rdi - 1]
lea ecx, [rdx + rbx]
cmp ecx, ebx
jb 0x1800fc262
mov eax, edx
not eax
and ecx, eax
je 0x1800fc205
lea eax, [rcx + rdi]
cmp eax, ecx
jb 0x1800fc262
mov ecx, eax
lea eax, [rdi + rdi*2]
mov ebx, edx
cmp ecx, eax
not rbx
cmovb ecx, eax
and rbx, r12
lea rax, [r13 + rdi]
mov esi, ecx
sub rbx, rsi
cmp rbx, rax
jb 0x1800fc262
mov r9d, 4
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x1800fc262
lea r9, [rbp + 4]
mov r8d, 0x104
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800fc262
mov eax, 1
jmp 0x1800fc264
xor eax, eax
mov rcx, qword [rbp + 0x68]
xor rcx, rbp
call fcn.1800eb430
mov rbx, qword [rbp + 0x90]
mov rsi, qword [rbp + 0x98]
mov rdi, qword [rbp + 0xa0]
lea rsp, [rbp + 0x70]
pop r13
pop r12
pop rbp
ret
Function at 0x1800fd19c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov ebx, r8d
mov r12, rdx
mov r13, rcx
call fcn.1800efa4c
xor ebp, ebp
and dword [rsp + 0x88], ebp
and dword [rsp + 0x30], ebp
mov rdi, rax
cmp qword [0x180164bd8], rbp
jne 0x1800fd2d4
lea rcx, [0x18003aa68]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x1800fd200
xor eax, eax
jmp 0x1800fd3b4
lea rdx, [0x18003aa58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800fd1f9
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x18003aa48]
mov rcx, rsi
mov qword [0x180164bd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x18003aa30]
mov rcx, rsi
mov qword [0x180164be0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rcx, [rsp + 0x88]
mov qword [0x180164be8], rax
call fcn.1800ef738
test eax, eax
je 0x1800fd287
and qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800f1904
cmp dword [rsp + 0x88], 2
jne 0x1800fd2d4
lea rdx, [0x18003aa10]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x180164bf8], rax
test rax, rax
je 0x1800fd2d4
lea rdx, [0x18003a9f8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x180164bf0], rax
mov rcx, qword [0x180164bf0]
cmp rcx, rdi
je 0x1800fd366
cmp qword [0x180164bf8], rdi
je 0x1800fd366
call sub.KERNEL32.dll_DecodePointer
call rax
mov rsi, rax
test rax, rax
je 0x1800fd331
mov rcx, qword [0x180164bf8]
call sub.KERNEL32.dll_DecodePointer
lea rcx, [rsp + 0x34]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x38]
mov rcx, rsi
call rax
test eax, eax
je 0x1800fd331
test byte [rsp + 0x40], 1
jne 0x1800fd366
lea rcx, [rsp + 0x30]
call fcn.1800ef784
test eax, eax
je 0x1800fd353
and qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800f1904
cmp dword [rsp + 0x30], 4
jb 0x1800fd360
bts ebx, 0x15
jmp 0x1800fd39a
bts ebx, 0x12
jmp 0x1800fd39a
mov rcx, qword [0x180164be0]
cmp rcx, rdi
je 0x1800fd39a
call sub.KERNEL32.dll_DecodePointer
call rax
mov rbp, rax
test rax, rax
je 0x1800fd39a
mov rcx, qword [0x180164be8]
cmp rcx, rdi
je 0x1800fd39a
call sub.KERNEL32.dll_DecodePointer
mov rcx, rbp
call rax
mov rbp, rax
mov rcx, qword [0x180164bd8]
call sub.KERNEL32.dll_DecodePointer
mov r9d, ebx
mov r8, r12
mov rdx, r13
mov rcx, rbp
call rax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x180108c10
Capabilities:
Read file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x38], 0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea r8, [rsp + 0x34]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x180108c7c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x180108c76
xor eax, eax
jmp 0x180108cc1
mov eax, dword [rsp + 0x3c]
jmp 0x180108cc1
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180108cae
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180108cc1
mov eax, dword [rsp + 0x68]
cmp dword [rsp + 0x38], eax
je 0x180108cbf
mov eax, 0x3e4
jmp 0x180108cc1
xor eax, eax
add rsp, 0x48
ret

Function at 0x180108cd0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180108d1d
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180108d30
mov eax, dword [rsp + 0x60]
cmp dword [rsp + 0x30], eax
je 0x180108d2e
mov eax, 0x3e4
jmp 0x180108d30
xor eax, eax
add rsp, 0x48
ret

Function at 0x180108d40
Capabilities:
Read file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180108d8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180108da0
mov eax, dword [rsp + 0x60]
cmp dword [rsp + 0x30], eax
je 0x180108d9e
mov eax, 0x3e4
jmp 0x180108da0
xor eax, eax
add rsp, 0x48
ret
Function at 0x180108db0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x2c]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xffffffff
jne 0x180108dee
mov dword [rsp + 0x30], 1
jmp 0x180108df6
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x180108e11
mov dword [rsp + 0x34], 1
jmp 0x180108e19
mov dword [rsp + 0x34], 0
mov ecx, dword [rsp + 0x34]
mov eax, dword [rsp + 0x30]
and eax, ecx
test eax, eax
je 0x180108e2d
mov eax, dword [rsp + 0x20]
jmp 0x180108e3e
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x28]
mov qword [rcx], rax
mov eax, dword [rsp + 0x20]
add rsp, 0x48
ret

Function at 0x18010b280
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
mov eax, 0x1040
call fcn.1801339d0
sub rsp, rax
mov rax, qword [0x180161180]
xor rax, rsp
mov qword [rsp + 0x1038], rax
mov eax, dword [0x180162c04]
cmp dword [rsp + 0x1050], eax
ja 0x18010b311
lea rax, [rsp + 0x1060]
mov qword [rsp + 0x1030], rax
lea rdi, [rsp + 0x30]
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x1030]
mov rdx, qword [rsp + 0x1058]
lea rcx, [rsp + 0x30]
call fcn.1800eb8d0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov qword [rsp + 0x1030], 0
mov rcx, qword [rsp + 0x1038]
xor rcx, rsp
call fcn.1800eb430
add rsp, 0x1040
pop rdi
ret
Function at 0x1801228c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x50
mov dword [rsp + 0x48], 0x80004021
mov dword [rsp + 0x40], 0x78
mov dword [rsp + 0x44], 4
mov dword [rsp + 0x30], 0
lea r8, [0x18005f6c8]
lea rdx, [0x18005f6a8]
mov ecx, 1
call fcn.1801276b0
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x18005f678]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
jne 0x1801229f4
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [0x180175914]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [0x18005f668]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [0x180175918]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [0x18000ee60]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x44], 0x104
lea rdi, [0x1801637b0]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [0x1801637b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [0x18000ee50]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x48], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x40], 0
jmp 0x180122a2d
lea r8, [0x18005f618]
lea rdx, [0x18005f6a8]
mov ecx, 1
call fcn.1801276b0
mov eax, dword [rsp + 0x40]
add rsp, 0x50
pop rdi
ret
Function at 0x180127360
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x468
mov rax, qword [0x180161180]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov dword [rsp + 0x440], 0x78
mov dword [rsp + 0x444], 0x80004021
lea r8, [0x18005f6c8]
lea rdx, [0x180061170]
mov ecx, 1
call fcn.1801276b0
nop
lea rdi, [rsp + 0x40]
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov r9d, 0x20100110
lea r8, [0x180001ec8]
lea rdx, [0x180061130]
lea rcx, [rsp + 0x40]
call fcn.1800eb79c
lea rdi, [rsp + 0x40]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
sub rdi, 1
lea rsi, [0x180001e40]
mov ecx, 0x48
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x40]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
sub rdi, 1
lea rsi, [0x180001df0]
mov ecx, 0x42
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.1801228c0
mov ecx, dword [0x180175914]
call fcn.1801275c0
mov ecx, dword [0x180175918]
call fcn.1801275e0
lea rcx, [0x1801637b0]
call fcn.180127600
call fcn.180127230
mov dword [rsp + 0x440], eax
cmp dword [rsp + 0x440], 0
je 0x18012748d
mov eax, dword [rsp + 0x440]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x440]
lea r8, [0x18005f7b8]
lea rdx, [0x180061170]
xor ecx, ecx
call fcn.1801276b0
jmp 0x180127498
mov dword [rsp + 0x440], 0
jmp 0x1801274d8
lea r8, [0x18005f618]
lea rdx, [0x180061170]
mov ecx, 1
call fcn.1801276b0
mov eax, dword [rsp + 0x440]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1800eb430
add rsp, 0x468
pop rdi
pop rsi
ret
Function at 0x1801276b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x850
mov rax, qword [0x180161180]
xor rax, rsp
mov qword [rsp + 0x848], rax
mov eax, dword [0x180175920]
cmp dword [rsp + 0x860], eax
ja 0x180127821
mov byte [rsp + 0x440], 0
lea rdi, [rsp + 0x441]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov byte [rsp + 0x30], 0
lea rdi, [rsp + 0x31]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov qword [rsp + 0x840], 0
lea rax, [rsp + 0x878]
mov qword [rsp + 0x430], rax
lea rdi, [rsp + 0x440]
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
lea rdi, [rsp + 0x30]
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x430]
mov rdx, qword [rsp + 0x870]
lea rcx, [rsp + 0x440]
call fcn.1800eb8d0
lea r9, [rsp + 0x440]
mov r8, qword [rsp + 0x868]
lea rdx, [0x180003ef0]
lea rcx, [rsp + 0x30]
call fcn.1800eb79c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x180175924], 1
jb 0x180127802
lea rdx, [0x18000e748]
lea rcx, str.C:StarWave.log
call fcn.1800ed4ac
mov qword [rsp + 0x840], rax
cmp qword [rsp + 0x840], 0
je 0x180127802
lea r8, [rsp + 0x30]
lea rdx, [0x180001de4]
mov rcx, qword [rsp + 0x840]
call fcn.1800ed1bc
mov rcx, qword [rsp + 0x840]
call fcn.1800ed160
mov rcx, qword [rsp + 0x840]
call fcn.1800ecf18
cmp dword [0x180175924], 2
jb 0x180127815
lea rcx, [rsp + 0x30]
call fcn.1800ecdd0
mov qword [rsp + 0x430], 0
mov rcx, qword [rsp + 0x848]
xor rcx, rsp
call fcn.1800eb430
add rsp, 0x850
pop rdi
ret
Function at 0x18015a520
Capabilities:
Execute syscall

Disassembly:
sub rsp, 0x70
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], 0x40
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x50], 0x40
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x28], rdx
xor r9, r9
mov qword [rdx + 8], r9
mov dword [rdx], 0xc0000010
mov rdx, qword [0x18015a280]
mov qword [r8 + 8], rdx
xor r8, r8
xor rdx, rdx
mov r10, rcx
mov eax, dword [sym.StarBurn.dll_A0DB34FC6FE35D429A28ADDE5467D4D7]
syscall
add rsp, 0x70
ret