joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005cf00
Capabilities:
Get disk information via ioctl

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
xor ebp, ebp
mov esi, edx
xor r9d, r9d
mov qword [rsp + 0x30], rbp
lea r8d, [rbp + 3]
xor edx, edx
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18005cf48
or eax, eax
jmp 0x18005cff5
or ebx, 0xffffffff
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x90], ebp
mov qword [rsp + 0x38], rbp
mov rcx, rdi
test esi, esi
je 0x18005cfad
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x90]
mov edx, 0x560000
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x18005cfea
mov ebx, dword [rsp + 0x58]
jmp 0x18005cfea
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov edx, 0x2d1080
mov dword [rsp + 0x28], 0xc
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
cmovne ebx, dword [rsp + 0x44]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18005e5a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x170
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
mov rbp, r8
mov rsi, rdx
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x50], 0
call fcn.1800f4fb0
xor r12d, r12d
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 3]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18005e625
mov dword [rbp], r12d
or rcx, rax
jmp 0x18005e7d0
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x18005e640
mov dword [rbp], r12d
jmp 0x18005e7cd
mov rax, qword [rsp + 0x48]
test eax, eax
je 0x18005e637
lea ecx, [rax - 1]
cmp ecx, 0x1e
ja 0x18005e6a4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18005e7cd
mov rbx, qword [rsp + 0x48]
lea rdx, [rsp + 0x50]
mov rcx, rsi
mov r8d, ebx
call fcn.1800f6e10
mov dword [rbp], ebx
jmp 0x18005e7cd
cmp eax, 0x400
jae 0x18005e71a
cmp eax, 0x20
jb 0x18005e7cd
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov r8d, 0x20
mov rcx, rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18005e7cd
lea rcx, [rsp + 0x50]
mov rax, qword [rcx]
mov qword [rsi], rax
mov rax, qword [rcx + 8]
mov qword [rsi + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rsi + 0x10], rax
mov rax, qword [rcx + 0x18]
mov qword [rsi + 0x18], rax
mov dword [rbp], 0x20
jmp 0x18005e7cd
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov r8d, 0x20
mov rcx, rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18005e770
lea rcx, [rsp + 0x50]
mov rax, qword [rcx]
mov qword [rsi], rax
mov rax, qword [rcx + 8]
mov qword [rsi + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rsi + 0x10], rax
mov rax, qword [rcx + 0x18]
mov qword [rsi + 0x18], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x3e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov r8d, 0x20
mov rcx, rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rcx, [rsp + 0x50]
mov rax, qword [rcx]
mov qword [rsi + 0x20], rax
mov rax, qword [rcx + 8]
mov qword [rsi + 0x28], rax
mov rax, qword [rcx + 0x10]
mov qword [rsi + 0x30], rax
mov rax, qword [rcx + 0x18]
mov qword [rsi + 0x38], rax
mov dword [rbp], 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x170
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18005eef0
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x28
mov dword [rsp + 0x30], 0x5c3a61
mov byte [rsp + 0x30], cl
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor ecx, ecx
cmp eax, 4
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x18005f310
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rax, [rsp + 0x30]
mov rbx, rcx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0x200
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18005f3c4
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea rdx, str.Cache
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x18005f39e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18005f3c4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x208
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x250
pop rbx
ret

Function at 0x18005f3e0
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x40], 0
call fcn.1800f4fb0
lea rax, [rsp + 0x38]
mov ebx, 0x50
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
xor r8d, r8d
lea r9d, [rbx - 0x4f]
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18005f4f1
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.ProxyEnable
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [rsp + 0x34], 0
je 0x18005f4e6
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.ProxyServer
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea rdx, [0x18015c494]
lea rcx, [rsp + 0x40]
call fcn.1800f4d08
test rax, rax
je 0x18005f4e6
lea rcx, [rax + 1]
call fcn.1800f6d1c
mov dword [0x180259e98], 1
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x250
pop rbx
ret
Function at 0x18005f8a0
Capabilities:
Get disk information
Get file size
Read file via mapping

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x580
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x560], rax
xor esi, esi
mov r12, rdx
mov rdi, rcx
test rdx, rdx
je 0x18005faa2
cmp qword [0x1801e1b88], rsi
je 0x18005faa2
lea rdx, [rsp + 0x34]
mov qword [rsp + 0x570], r14
mov dword [rsp + 0x34], esi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
lea r8d, [rsi + 2]
xor r9d, r9d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r14, rax
test rax, rax
je 0x18005fa96
lea edx, [rsi + 4]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x578], r13
mov qword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r13, rax
test rax, rax
je 0x18005fa85
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x208
mov r8, r12
mov rcx, rax
mov rdx, r13
call qword [0x1801e1b88]
test eax, eax
je 0x18005fa77
lea rdx, [rsp + 0x150]
mov ecx, 0x1ff
mov byte [rsp + 0x150], sil
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x18005fa77
movzx eax, word [0x180158e70]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x5b0], rbx
mov word [rcx], ax
movzx eax, byte [0x180158e72]
mov qword [rsp + 0x5b8], rbp
mov ebp, esi
lea rbx, [rsp + 0x150]
mov byte [rcx + 2], al
movzx eax, byte [rbx]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov r8d, 0x200
mov byte [rsp + 0x30], al
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x18005fa50
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jae 0x18005fa50
mov edi, ecx
mov r8d, ecx
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.1800fc37c
mov ebp, esi
test eax, eax
sete bpl
test ebp, ebp
je 0x18005fa50
lea r9, [rdi + r12]
lea r8, [rsp + 0x30]
lea rdx, [0x180158e68]
lea rcx, [rsp + 0x350]
call fcn.1800f509c
lea rdx, [rsp + 0x350]
mov r8d, 0x104
mov rcx, r12
call fcn.1800fc7f0
nop
movzx eax, byte [rbx]
inc rbx
test al, al
jne 0x18005fa50
test ebp, ebp
jne 0x18005fa67
cmp byte [rbx], sil
jne 0x18005f9c2
mov rbp, qword [rsp + 0x5b8]
mov rbx, qword [rsp + 0x5b0]
mov rcx, r13
mov esi, 1
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x578]
mov r14, qword [rsp + 0x570]
mov eax, esi
jmp 0x18005faa4
xor eax, eax
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x580
pop r12
pop rdi
pop rsi
ret
Function at 0x18005fbd0
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
sub rsp, 0x50
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rax, str.APPDATA
xor edi, edi
mov dword [0x18025a8f0], 0x2e5c5c
mov qword [r11 - 0x38], rax
lea rax, str.ProgramFiles
mov esi, 1
mov qword [r11 - 0x30], rax
lea rax, str.SystemRoot
mov rbx, rdi
mov qword [r11 - 0x28], rax
lea rax, str.TEMP
lea r12, [0x18025a8f0]
mov qword [r11 - 0x20], rax
nop
mov rcx, qword [rsp + rbx*8 + 0x20]
movsxd rbp, esi
mov r8d, 0x208
imul rbp, rbp, 0x104
add rbp, r12
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp rbx, 3
jne 0x18005fc7a
lea edx, [rbx + 0x59]
mov rcx, rbp
call fcn.1800f7e94
test rax, rax
je 0x18005fc7a
mov byte [rax], 0
inc rbx
inc edi
inc esi
cmp rbx, 4
jl 0x18005fc40
lea eax, [rdi + 1]
mov dword [0x18025977c], eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800f4f80
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret

Function at 0x1800601c0
Capabilities:
Hash data with crc32

Disassembly:
xor edx, edx
lea r8, [0x1801def80]
nop dword [rax]
mov eax, edx
mov ecx, 8
test al, 1
je 0x1800601e4
shr eax, 1
xor eax, 0xedb88320
jmp 0x1800601e6
shr eax, 1
sub rcx, 1
jne 0x1800601d7
inc edx
mov dword [r8], eax
add r8, 4
cmp edx, 0x400
jl 0x1800601d0
repz ret

Function at 0x180060200
Capabilities:
Encode data using xor

Disassembly:
mov r9d, ecx
test rdx, rdx
je 0x180060240
test r8d, r8d
je 0x180060240
mov r10d, r8d
lea r8, [0x1801def80]
nop word [rax + rax]
movzx ecx, byte [rdx]
movzx eax, r9b
inc rdx
xor rcx, rax
mov eax, r9d
mov r9d, dword [r8 + rcx*4]
shr eax, 8
xor r9d, eax
sub r10, 1
jne 0x180060220
mov eax, r9d
ret
Function at 0x180060760
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x4e0
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
mov rdi, rcx
lea rcx, [rsp + 0x2d2]
xor ebx, ebx
xor edx, edx
mov r8d, 0x1fe
mov word [rsp + 0x2d0], bx
call fcn.1800f4fb0
lea rcx, [rsp + 0xd2]
xor edx, edx
mov r8d, 0x1fe
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], ebx
mov word [rsp + 0xd0], bx
call fcn.1800f4fb0
xor eax, eax
lea rdx, [rsp + 0x88]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov word [rsp + 0x88], bx
mov qword [rsp + 0x8a], rax
mov qword [rsp + 0x92], rax
mov qword [rsp + 0x9a], rax
mov qword [rsp + 0xa2], rax
mov qword [rsp + 0xaa], rax
mov qword [rsp + 0xb2], rax
mov qword [rsp + 0xba], rax
mov word [rsp + 0xc2], ax
mov word [rsp + 0x48], bx
mov qword [rsp + 0x4a], rax
mov qword [rsp + 0x52], rax
mov qword [rsp + 0x5a], rax
mov qword [rsp + 0x62], rax
mov qword [rsp + 0x6a], rax
mov qword [rsp + 0x72], rax
mov qword [rsp + 0x7a], rax
mov word [rsp + 0x82], ax
mov qword [rsp + 0x20], rbx
call fcn.1800fd0a8
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x48]
repne scasw ax, word [rdi]
xor edx, edx
lea r8, [rsp + 0x88]
nop word [rax + rax]
movzx eax, word [r8 + rdx]
add rdx, 2
mov word [rdi + rdx - 4], ax
test ax, ax
jne 0x180060880
xor eax, eax
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x38], pe_nt_image_headers64
lea rdi, [rsp + 0x48]
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x2d0]
repne scasw ax, word [rdi]
mov eax, dword [0x180155e50]
lea rcx, [rsp + 0x48]
mov dword [rdi - 2], eax
lea rax, [rsp + 0xd0]
mov r8d, pe_nt_image_headers64
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
lea rdx, str.cdfs
lea rcx, [rsp + 0xd0]
call fcn.1800fe0a4
lea r8, [rsp + 0xd0]
lea rcx, str.line:_d___ws___s
test eax, eax
jne 0x18006092b
lea r9, [0x18015c568]
mov edx, 0xc59
call fcn.18005cd20
mov eax, 1
jmp 0x18006093e
lea r9, [0x18015c550]
mov edx, 0xc5c
call fcn.18005cd20
xor eax, eax
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.1800f4f80
mov rbx, qword [rsp + 0x4f8]
add rsp, 0x4e0
pop rdi
ret

Function at 0x180060960
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x208
mov byte [rsp + 0x20], 0
call fcn.1800f4fb0
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.1800f6de4
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x240
pop rbx
ret
Function at 0x180060ca0
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x130], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x180060d27
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.1800f4fb0
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rdx, [0x18015c5b0]
lea rcx, [rsp + 0x20]
call fcn.1800f4d08
test rax, rax
je 0x180060d1d
mov qword [0x18025f1f8], rbx
mov dword [0x18025f1f4], 1
jmp 0x180060d27
mov dword [0x18025f1f4], 0
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x140
pop rbx
ret

Function at 0x180062520
Capabilities:
Check os version

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x94
call fcn.1800f4fb0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [rsp + 0x24], 6
setae al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0xd8
ret

Function at 0x180062580
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
xor ebx, ebx
mov r9, rdx
xor edx, edx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x1800625af
add rsp, 0x40
pop rbx
ret
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
setne bl
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x180063520
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push r12
sub rsp, 0x250
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rdx
mov rbp, rcx
lea rdx, [sym.vrvhook64.dll_MyRegOpenKeyA]
lea rcx, [0x18028d500]
mov r12, r8
call fcn.18000dae0
test rax, rax
jne 0x180063569
mov eax, 5
jmp 0x1800636d0
mov rcx, rax
mov qword [rsp + 0x248], rsi
call fcn.18000d7e0
cmp dword [0x1801f561c], 0
mov rsi, rax
je 0x1800635b5
lea rdx, [0x18025cbc0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [0x18025cbc0]
lea rcx, [0x1801f5620]
call fcn.180061120
test eax, eax
jne 0x1800636b8
cmp dword [0x1801f5a20], 1
jne 0x1800636bd
lea rdx, [0x18025cbc0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [0x18025cbc0]
call fcn.1800fd3f0
lea rdx, [0x18025cbc0]
lea rcx, [0x1801f5a34]
call fcn.180061120
test eax, eax
jne 0x1800636bd
cmp byte [0x180346010], al
jne 0x180063662
lea rcx, [0x180346010]
mov edx, 0x104
mov qword [rsp + 0x240], rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x180346010]
repne scasb al, byte [rdi]
mov rax, qword [0x18015c9f8]
lea rcx, [0x180346010]
mov qword [rdi - 1], rax
mov eax, dword [0x18015ca00]
mov dword [rdi + 7], eax
movzx eax, word [0x18015ca04]
mov word [rdi + 0xb], ax
call fcn.1800fd3f0
mov rdi, qword [rsp + 0x240]
lea rdx, [0x180346010]
lea rcx, [0x18025cbc0]
call fcn.1800f4d08
test rax, rax
jne 0x1800636bd
test rbx, rbx
je 0x1800636bd
lea rdx, [rsp + 0x20]
mov rcx, rbx
sub rdx, rbx
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rdx + rcx - 1], al
test al, al
jne 0x180063690
lea rcx, [rsp + 0x20]
call fcn.1800fd3f0
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.180061630
test eax, eax
je 0x1800636bd
or eax, 0xffffffff
jmp 0x1800636c8
mov r8, r12
mov rdx, rbx
mov rcx, rbp
call rsi
mov rsi, qword [rsp + 0x248]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x250
pop r12
pop rbp
pop rbx
ret
Function at 0x1800636f0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push r12
sub rsp, 0x270
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rdx
mov rbp, rcx
lea rdx, [sym.vrvhook64.dll_MyRegOpenKeyW]
lea rcx, [0x18028d500]
mov r12, r8
call fcn.18000dae0
test rax, rax
jne 0x180063739
mov eax, 5
jmp 0x1800638e2
mov rcx, rax
mov qword [rsp + 0x268], rsi
call fcn.18000d7e0
cmp dword [0x1801f561c], 0
mov rsi, rax
je 0x180063785
lea rdx, [0x18025cbc0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [0x18025cbc0]
lea rcx, [0x1801f5620]
call fcn.180061120
test eax, eax
jne 0x1800638c8
cmp dword [0x1801f5a20], 1
jne 0x1800638cf
lea rdx, [0x18025cbc0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [0x18025cbc0]
call fcn.1800fd3f0
lea rdx, [0x18025cbc0]
lea rcx, [0x1801f5a34]
call fcn.180061120
test eax, eax
jne 0x1800638cf
cmp byte [0x180346010], al
jne 0x180063832
lea rcx, [0x180346010]
mov edx, 0x104
mov qword [rsp + 0x260], rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x180346010]
repne scasb al, byte [rdi]
mov rax, qword [0x18015c9f8]
lea rcx, [0x180346010]
mov qword [rdi - 1], rax
mov eax, dword [0x18015ca00]
mov dword [rdi + 7], eax
movzx eax, word [0x18015ca04]
mov word [rdi + 0xb], ax
call fcn.1800fd3f0
mov rdi, qword [rsp + 0x260]
lea rdx, [0x180346010]
lea rcx, [0x18025cbc0]
call fcn.1800f4d08
test rax, rax
jne 0x1800638cf
test rbx, rbx
je 0x1800638cf
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x207
mov byte [rsp + 0x40], al
call fcn.1800f4fb0
xor edx, edx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x40]
or r9d, 0xffffffff
mov r8, rbx
xor ecx, ecx
mov dword [rsp + 0x28], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rsp + 0x40]
call fcn.1800fd3f0
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.180061630
test eax, eax
je 0x1800638cf
lea r8, [0x180259780]
lea rcx, str.line:_d__MyRegOpenKeyW
mov edx, 0x355d
call fcn.18005cd20
mov eax, 5
jmp 0x1800638da
mov r8, r12
mov rdx, rbx
mov rcx, rbp
call rsi
mov rsi, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x270
pop r12
pop rbp
pop rbx
ret
Function at 0x180063900
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push r12
sub rsp, 0x250
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rdx
mov rbp, rcx
lea rdx, [sym.vrvhook64.dll_MyRegCreateKeyA]
lea rcx, [0x18028d500]
mov r12, r8
call fcn.18000dae0
test rax, rax
jne 0x180063947
or eax, 0xffffffff
jmp 0x180063adf
mov rcx, rax
mov qword [rsp + 0x248], rsi
call fcn.18000d7e0
cmp dword [0x1801f561c], 0
mov rsi, rax
je 0x1800639c0
lea rdx, [0x18025cbc0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [0x18025cbc0]
lea rcx, [0x1801f5620]
call fcn.180061120
test eax, eax
je 0x1800639c0
lea rcx, [rsp + 0x20]
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
inc rbx
mov byte [rcx + rbx - 1], al
test al, al
jne 0x1800639a0
lea rcx, [rsp + 0x20]
call fcn.1800fd3f0
or eax, 0xffffffff
jmp 0x180063ad7
cmp dword [0x1801f5a20], 1
jne 0x180063acc
lea rdx, [0x18025cbc0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [0x18025cbc0]
call fcn.1800fd3f0
lea rdx, [0x18025cbc0]
lea rcx, [0x1801f5a34]
call fcn.180061120
test eax, eax
jne 0x180063acc
cmp byte [0x180346010], al
jne 0x180063a6d
lea rcx, [0x180346010]
mov edx, 0x104
mov qword [rsp + 0x240], rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x180346010]
repne scasb al, byte [rdi]
mov rax, qword [0x18015c9f8]
lea rcx, [0x180346010]
mov qword [rdi - 1], rax
mov eax, dword [0x18015ca00]
mov dword [rdi + 7], eax
movzx eax, word [0x18015ca04]
mov word [rdi + 0xb], ax
call fcn.1800fd3f0
mov rdi, qword [rsp + 0x240]
lea rdx, [0x180346010]
lea rcx, [0x18025cbc0]
call fcn.1800f4d08
test rax, rax
jne 0x180063acc
test rbx, rbx
je 0x180063acc
lea rdx, [rsp + 0x20]
mov rcx, rbx
sub rdx, rbx
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rdx + rcx - 1], al
test al, al
jne 0x180063aa0
lea rcx, [rsp + 0x20]
call fcn.1800fd3f0
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.180061630
test eax, eax
jne 0x1800639b8
mov r8, r12
mov rdx, rbx
mov rcx, rbp
call rsi
mov rsi, qword [rsp + 0x248]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x250
pop r12
pop rbp
pop rbx
ret