joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004c090
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
lea r14d, [rdx + 0x42]
mov r15, r9
mov rdi, r8
mov r13, rcx
cmp edx, r14d
jae case.0x18004c0f6.2
mov rbp, qword [rsp + 0x38]
lea ebx, [rdx - 0x4e]
mov r12, qword [rsp + 0x38]
lea rdx, [0x180000000]
cmp ebx, 0x18
ja case.0x18004c0f6.6
movzx eax, byte [rdx + rbx + 0x4c20c]
mov ecx, dword [rdx + rax*4 + 0x4c1f0]
add rcx, rdx
jmp rcx
mov qword [rsp + 0x38], r15
jmp case.0x18004c0f6.6
movdqu xmm0, xmmword [r13]
mov r8, qword [rsp + 0x38]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x20], 0xc0
lea rcx, [rsp + 0x50]
movdqu xmmword [rsp + 0x40], xmm0
call fcn.18001d1c0
movdqu xmm0, xmmword [rax]
movdqu xmmword [rdi], xmm0
jmp case.0x18004c0f6.6
mov rbp, qword [r15 + 0x10]
sub rbp, qword [r13 + 0x10]
mov r12, qword [r15]
sub rbp, qword [r13 + 8]
sub r12, qword [r13]
add rbp, qword [r15 + 8]
jne case.0x18004c0f6.6
xorps xmm0, xmm0
movsd qword [rsp + 0x30], xmm0
jmp case.0x18004c0f6.2
movzx eax, byte [r15]
mov esi, 0x1505
mov rdi, r15
test al, al
je 0x18004c188
nop dword [rax + rax]
movzx ecx, al
call fcn.18006efa0
imul esi, esi, 0x21
lea rdi, [rdi + 1]
add esi, eax
movzx eax, byte [rdi]
test al, al
jne 0x18004c170
mov rdi, qword [rsp + 0xa0]
mov dword [rsp + 0x30], esi
add ebx, 0xb
lea eax, [rbx + 0x4e]
cmp eax, r14d
jae case.0x18004c0f6.2
jmp 0x18004c0d4
xorps xmm1, xmm1
mov rax, rbp
sub rax, r12
xorps xmm0, xmm0
cvtsi2sd xmm0, rbp
cvtsi2sd xmm1, rax
mulsd xmm1, qword [0x18009f6a0]
divsd xmm1, xmm0
movsd qword [rsp + 0x30], xmm1
mov rax, qword [rsp + 0x30]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18006fb84
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x18006f9a4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18006f9a4
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18006f9a4
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18006f9a4
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18006f9a4
cmp dword [rcx + 0x84], 0xe
jbe 0x18006f9a4
cmp dword [rcx + 0xf8], esi
je 0x18006f9a4
mov ecx, r14d
call fcn.18006faec
mov ecx, 2
call fcn.18007accc
nop
cmp byte [0x1807423e8], 0
jne 0x18006fa6e
mov r15d, 1
mov eax, r15d
xchg dword [0x1807423d8], eax
test ebx, ebx
jne 0x18006fa17
mov rdi, qword [0x1800b54e8]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1807423e0]
cmp rcx, rax
je 0x18006fa0e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [0x1800895a0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x180742558]
jmp 0x18006fa23
cmp ebx, r15d
jne 0x18006fa29
lea rcx, [0x180742570]
call fcn.180079370
nop
test ebx, ebx
jne 0x18006fa40
lea rdx, [0x180089628]
lea rcx, [0x180089608]
call fcn.1800795c8
lea rdx, [0x180089638]
lea rcx, [0x180089630]
call fcn.1800795c8
movzx eax, byte [0x1807423e8]
test esi, esi
cmove eax, r15d
mov byte [0x1807423e8], al
jmp 0x18006fa6e
mov ecx, 2
call fcn.18007ad20
test esi, esi
jne 0x18006fa85
mov ecx, r14d
call fcn.18006faa0
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x18006f934
Function at 0x18007d9e8
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x18007d888
call fcn.18006f084
mov dword [rax], 0x16
call fcn.18006eb84
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x18007d870
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x18007d870
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x18007d8ba
lock or dword [rax + 0x14], 0x10
jmp 0x18007d870
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x18007d8d7
mov rcx, qword [rbp + 0x10]
call fcn.18007f088
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.180079a4c
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.18007dfbc
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x18007d92e
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x18007d870
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x18007d99a
mov rcx, qword [rbp + 0x10]
call fcn.180079a4c
cmp eax, 0xffffffff
je 0x18007d981
mov rcx, qword [rbp + 0x10]
call fcn.180079a4c
cmp eax, 0xfffffffe
je 0x18007d981
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.180079a4c
movsxd rdi, eax
lea rsi, [0x180742960]
mov rcx, rbx
sar rdi, 6
call fcn.180079a4c
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x18007d988
lea rax, [0x1800b57a0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x18007d99a
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x18007d9d0
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x18007d9cc
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x18007d9cc
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x18007d873
jmp 0x18007d840

Function at 0x18007f060
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18007f080
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.18006f014
or eax, 0xffffffff
jmp 0x18007f082
xor eax, eax
add rsp, 0x28
ret
Function at 0x1800010a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1800ac2b8]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rcx + 0x20], reloc.WS2_32.dll_ntohs
mov rbx, rcx
mov qword [rcx + 0x18], rax
mov byte [rsp + 0x28], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x29], 0x59
mov byte [rsp + 0x38], al
mov byte [rsp + 0x2a], Ordinal_79
mov byte [rsp + 0x2b], 0x66
mov byte [rsp + 0x2c], 0x64
mov byte [rsp + 0x2d], Ordinal_41
mov byte [rsp + 0x2e], 0x41
mov byte [rsp + 0x2f], 0x75
mov byte [rsp + 0x30], 0x69
mov byte [rsp + 0x31], 0x33
mov byte [rsp + 0x32], 0x48
mov byte [rsp + 0x33], 0x55
mov byte [rsp + 0x34], 0x76
mov byte [rsp + 0x35], Ordinal_41
mov byte [rsp + 0x36], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x37], gethostname
mov byte [rcx + 8], al
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x28]
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x28]
mov dword [rsp + 0x20], eax
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.180001638
mov rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18005f4d0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x180001164
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x1a0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1800ac2b8]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rbx, rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x70], r12
mov byte [rsp + 0x60], r12b
lea rcx, [rsp + 0x58]
call fcn.180001638
nop
lea rcx, [rsp + 0x30]
call fcn.1800010a4
mov r8, qword [rsp + 0x70]
lea rbp, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rbp, qword [rsp + 0x60]
cmp qword [rax + 0x20], 0x10
jb 0x1800011e7
mov r10, qword [rax + 8]
jmp 0x1800011eb
lea r10, [rax + 8]
movzx eax, r12w
lea rcx, [rsp + 0x80]
mov r13d, 1
mov r9d, pe_nt_image_headers64
mov byte [rcx], al
add ax, r13w
add rcx, r13
cmp ax, r9w
jl 0x180001203
mov byte [rsp + 0x180], r12b
mov byte [rsp + 0x181], r12b
mov sil, r12b
mov dil, r12b
lea r11, [rsp + 0x80]
mov r14d, 0xff
movzx eax, sil
movzx ecx, byte [rax + r10]
movzx eax, byte [r11]
add ecx, eax
movzx eax, dil
add eax, ecx
cdq
and edx, r14d
add eax, edx
and eax, r14d
sub eax, edx
mov edi, eax
movzx edx, al
mov cl, byte [r11]
mov al, byte [rsp + rdx + 0x80]
mov byte [r11], al
mov byte [rsp + rdx + 0x80], cl
movzx eax, sil
add eax, r13d
cdq
and edx, 0xf
lea esi, [rdx + rax]
and esi, 0xf
sub esi, edx
add r11, r13
sub r9, r13
jne 0x180001236
mov r10b, byte [rsp + 0x180]
mov r11b, byte [rsp + 0x181]
cmp r8d, r12d
jle 0x18000132f
mov r9d, r8d
movzx eax, r10b
add eax, r13d
cdq
and edx, r14d
add eax, edx
and eax, r14d
sub eax, edx
mov r10d, eax
movzx r8d, al
movzx ecx, byte [rsp + r8 + 0x80]
movzx eax, r11b
add eax, ecx
cdq
and edx, r14d
add eax, edx
and eax, r14d
sub eax, edx
mov r11d, eax
movzx edx, al
mov cl, byte [rsp + r8 + 0x80]
mov al, byte [rsp + rdx + 0x80]
mov byte [rsp + r8 + 0x80], al
mov byte [rsp + rdx + 0x80], cl
movzx ecx, cl
movzx eax, byte [rsp + r8 + 0x80]
add eax, ecx
cdq
and edx, r14d
add eax, edx
and eax, r14d
sub eax, edx
movzx eax, al
mov cl, byte [rsp + rax + 0x80]
xor byte [rbp], cl
add rbp, r13
sub r9, r13
jne 0x1800012a6
cmp qword [rsp + 0x50], 0x10
jb 0x180001341
mov rcx, qword [rsp + 0x38]
call fcn.18005eeb4
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.180002080
nop
cmp qword [rsp + 0x78], 0x10
jb 0x180001361
mov rcx, qword [rsp + 0x60]
call fcn.18005eeb4
mov rax, rbx
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.18005f4d0
add rsp, 0x1a0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180006060
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x140
mov qword [rsp + 0x128], 0xfffffffffffffffe
mov rax, qword [0x1800ac2b8]
xor rax, rsp
mov qword [rsp + 0x138], rax
mov rax, qword [rsp + 0x150]
cmp qword [rax + 0x70], 0
je 0x1800060aa
mov rax, qword [rsp + 0x150]
movzx eax, byte [rax + 0x79]
test eax, eax
jne 0x1800060b6
mov al, 1
jmp 0x1800062e2
mov dword [rsp + 0x30], 8
call fcn.180007fa0
mov edx, eax
mov rax, qword [rsp + 0x150]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x150]
call qword [rax + ioctlsocket]
mov dword [rsp + 0x78], eax
call fcn.180007fa0
mov dword [rsp + 0x7c], eax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x7c]
call fcn.180007f50
movzx eax, al
test eax, eax
je 0x180006105
xor al, al
jmp 0x1800062e2
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x48]
call fcn.180005a90
nop
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x48]
call fcn.180002820
mov rcx, rax
call fcn.180006520
mov rbx, rax
lea rcx, [rsp + 0x48]
call fcn.180001520
add rbx, rax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x48]
call fcn.180002820
mov rcx, rax
call fcn.180006520
mov r8, rax
mov rdx, qword [rsp + 0x150]
add rdx, 0x7c
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov rcx, qword [rsp + 0x150]
mov rcx, qword [rcx + 0x70]
call fcn.180006860
mov dword [rsp + 0x130], eax
cmp dword [rsp + 0x130], 0
je 0x1800061b7
cmp dword [rsp + 0x130], 1
je 0x1800061c3
cmp dword [rsp + 0x130], 3
je 0x18000629c
jmp 0x1800062b7
mov rax, qword [rsp + 0x150]
mov byte [rax + 0x79], 0
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x48]
call fcn.180002820
mov rcx, rax
call fcn.180006520
mov r11, rax
mov rax, qword [rsp + 0x38]
sub rax, r11
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
jbe 0x180006255
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x48]
call fcn.180002820
mov rcx, rax
call fcn.180006520
mov r9, qword [rsp + 0x150]
mov r9, qword [r9 + 0x88]
mov r8, qword [rsp + 0x70]
mov edx, 1
mov rcx, rax
call fcn.1800620f8
cmp qword [rsp + 0x70], rax
je 0x180006255
mov byte [rsp + 0xc0], 0
lea rcx, [rsp + 0x48]
call fcn.180001498
mov al, byte [rsp + 0xc0]
jmp 0x1800062e2
mov rax, qword [rsp + 0x150]
movzx eax, byte [rax + 0x79]
test eax, eax
jne 0x180006280
mov byte [rsp + 0xc1], 1
lea rcx, [rsp + 0x48]
call fcn.180001498
mov al, byte [rsp + 0xc1]
jmp 0x1800062e2
cmp qword [rsp + 0x70], 0
jne 0x18000629a
xor r8d, r8d
mov edx, 8
lea rcx, [rsp + 0x48]
call fcn.1800024a8
jmp 0x1800062d2
mov byte [rsp + 0xc2], 1
lea rcx, [rsp + 0x48]
call fcn.180001498
mov al, byte [rsp + 0xc2]
jmp 0x1800062e2
mov byte [rsp + 0xc3], 0
lea rcx, [rsp + 0x48]
call fcn.180001498
mov al, byte [rsp + 0xc3]
jmp 0x1800062e2
jmp 0x180006118
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.18005f4d0
add rsp, 0x140
pop rbx
ret
Function at 0x18000b720
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x1800ae3c0], 0
mov rdi, rdx
mov rbx, rcx
jne 0x18000b77b
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000b76b
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x1800ae3c0], 1
mov qword [0x1800ae3b8], rax
jmp 0x18000b782
mov rax, qword [0x1800ae3b8]
mov byte [0x1800ae3c0], 1
jmp 0x18000b782
mov rax, qword [0x1800ae3b8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x18000b7a1
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]

Function at 0x18000b7c0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x18000b800
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x30
mov rsi, r8
mov rbp, rdx
mov r12, rcx
test r8, r8
jne 0x18000b833
lea eax, [r8 + 0xd]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
xor edi, edi
mov rbx, r8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea rbx, [rbx + rax*2]
lea edi, [rdi + rax*2]
cmp eax, 1
jne 0x18000b842
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x18000c2f0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1800ac2b8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov edi, dword [rcx + 8]
xor eax, eax
mov rsi, rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
or edi, 0x2001f
xor r8d, r8d
mov r9d, edi
mov rbp, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x18000c43c
test rcx, rcx
je 0x18000c365
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
and edi, 0x300
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], edi
test ebx, ebx
jne 0x18000c43c
xor edi, edi
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], pe_nt_image_headers64
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x18000c411
nop word [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.18000c2f0
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x18000c43c
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], pe_nt_image_headers64
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x18000c3c0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x18000c426
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rdi
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x50], edi
call fcn.18000b720
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test rcx, rcx
je 0x18000c447
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.18005f4d0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000e480
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x4b0], rbx
mov rax, qword [0x1800ac2b8]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rsi, r9
mov rbx, r8
mov rax, rdx
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x70], r12
xor edx, edx
lea r8d, [r12 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x18000e4f8
call fcn.18000b6f0
mov ebx, eax
jmp 0x18000e63a
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x18000e51b
call fcn.18000b6f0
mov ebx, eax
jmp 0x18000e630
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x18000e540
call fcn.18000b6f0
mov ebx, eax
jmp 0x18000e630
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x18000e579
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x18000e56f
lea rcx, [rsp + 0x70]
call fcn.18000c270
nop
mov eax, 0x8007000e
jmp 0x18000e653
mov ecx, eax
test eax, eax
je 0x18000e5b6
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x18000e5ac
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x18000e5b6
lea rcx, [rsp + 0x70]
call fcn.18000c280
mov rax, qword [rsp + 0x70]
jmp 0x18000e5c0
mov ecx, 0x80070057
call fcn.180002fb0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x18000e5d8
test rax, rax
jne 0x18000e5e4
mov ebx, 0x8007000e
jmp 0x18000e630
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x18000e60b
call fcn.18000b6f0
mov ebx, eax
jmp 0x18000e630
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r12w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.18000e190
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x18000e651
lea rcx, [rsp + 0x70]
call fcn.18000c270
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.18005f4d0
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret
Function at 0x18000eac0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1050
call fcn.180083120
sub rsp, rax
mov rax, qword [0x1800ac2b8]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rsi, rcx
mov rcx, qword [rcx]
mov rdi, rdx
test rcx, rcx
jne 0x18000eafa
xor eax, eax
jmp 0x18000ec49
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x840]
mov dword [rsp + 0x30], 0x800
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x18000eb3c
mov rdx, qword [str.NoAssociate.KZ]
lea rcx, [rsp + 0x840]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18000eb3c
mov eax, 1
jmp 0x18000ec49
lea r8, [rsp + 0x38]
mov rdx, rdi
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x18000ebbf
lea r8, [rsp + 0x38]
mov rdx, rdi
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x1070], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [str.NoAssociate.KZ]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9, qword [str.NoAssociate.KZ]
mov rcx, qword [rsi]
lea eax, [rax + rax + 2]
mov r8d, 1
mov rdx, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
xor r11d, r11d
test ebx, ebx
mov rbx, qword [rsp + 0x1070]
jmp 0x18000ec42
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x30], 0x800
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsi + 8]
lea rcx, [rsp + 0x40]
call fcn.18005ef18
lea rcx, [rsp + 0x40]
cmp rax, rcx
jne 0x18000ec13
mov rdx, qword [str.NoAssociate.KZ]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsi]
lea r9, [rsp + 0x40]
lea eax, [rax + rax + 2]
mov r8d, 1
mov rdx, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
xor r11d, r11d
test eax, eax
sete r11b
mov eax, r11d
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.18005f4d0
mov rsi, qword [rsp + 0x1078]
add rsp, 0x1050
pop rdi
ret
Function at 0x18000ed00
Capabilities:
Delete registry key
Persist via default file association registry key
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1260
call fcn.180083120
sub rsp, rax
mov rax, qword [0x1800ac2b8]
xor rax, rsp
mov qword [rsp + 0x1250], rax
mov rsi, rdx
mov rbx, rcx
mov r8, rdx
lea rdx, [0x180089998]
lea rcx, [rsp + 0xa50]
lea r9, str._shellopencommand
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xa50]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov edi, eax
test eax, eax
jne 0x18000edec
lea rdx, [rbx + 0x210]
lea rcx, [rsp + 0x40]
cmp word [rdx], ax
je 0x18000ed88
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x18000eda4
mov edx, 0x104
call fcn.180011660
lea rdx, [0x1800899a8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, str.___1_
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x30]
xor edx, edx
lea eax, [rax + rax + 2]
lea r9, [rsp + 0x40]
lea r8d, [rdx + 1]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, qword [rsp + 0x30]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r9, str._shellPropertySheetHandlers
lea rdx, [0x180089a10]
lea rcx, [rsp + 0xa50]
xor ebx, ebx
mov r8, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, str._shellexopenddeexec
lea rdx, [0x180089a50]
lea rcx, [rsp + 0x250]
mov r8, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x250]
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea r9, [0x180089a60]
lea rdx, [0x180089a70]
lea rcx, [rsp + 0x250]
mov r8, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x250]
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x1250]
xor rcx, rsp
call fcn.18005f4d0
lea r11, [rsp + 0x1260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret