joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003b450
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, rdx
mov rbx, rcx
and dword [rsp + 0x20], 0
xor esi, esi
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov r13, rcx
mov qword [r11 - 0x38], 0xf
mov qword [r11 - 0x40], rax
mov byte [rsp + 0x38], al
je 0x18003b642
lea rdi, [0x18007ccb0]
movsx rax, byte [r12 + rsi]
mov cl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x18003b4d6
cmp cl, r14b
je 0x18003b4c1
cmp cl, r14b
je 0x18003b642
movsx rax, byte [r12 + rsi]
mov bpl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x18003b4f5
cmp bpl, r14b
je 0x18003b4df
cmp bpl, r14b
je 0x18003b642
mov r8b, bpl
sar r8b, 4
and r8b, 3
shl cl, 2
or r8b, cl
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.180006cb4
jmp 0x18003b527
lea rdi, [0x18007ccb0]
mov al, byte [r12 + rsi]
inc rsi
cmp al, 0x3d
je 0x18003b606
movsx rax, al
mov dil, byte [rax + rdi]
cmp rsi, r13
jae 0x18003b548
cmp dil, r14b
je 0x18003b520
cmp dil, r14b
je 0x18003b642
mov r8b, dil
sar r8b, 2
and r8b, 0xf
shl bpl, 4
or r8b, bpl
mov ebp, 1
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.180006cb4
lea rdx, [0x18007ccb0]
mov al, byte [r12 + rsi]
add rsi, rbp
cmp al, 0x3d
je 0x18003b5ca
movsx rax, al
mov cl, byte [rax + rdx]
cmp rsi, r13
jae 0x18003b598
cmp cl, r14b
je 0x18003b57c
cmp cl, r14b
je 0x18003b642
shl dil, 6
or dil, cl
mov r8b, dil
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.180006cb4
cmp rsi, r13
lea rdi, [0x18007ccb0]
jb 0x18003b4c1
jmp 0x18003b642
mov qword [rbx + 0x20], sendto
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180006db0
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18003b601
mov rcx, qword [rsp + 0x38]
call fcn.180054958
mov rax, rbx
jmp 0x18003b67c
mov qword [rbx + 0x20], sendto
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180006db0
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18003b63d
mov rcx, qword [rsp + 0x38]
call fcn.180054958
mov rax, rbx
jmp 0x18003b67c
mov qword [rbx + 0x20], sendto
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180006db0
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18003b679
mov rcx, qword [rsp + 0x38]
call fcn.180054958
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180055580
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18003b708
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
xor r11d, r11d
mov rdi, rcx
mov dword [rsp], 0x2ac3268c
mov dword [rsp + 4], 0x33747d9a
mov dword [rsp + 8], 0xd1de98ac
mov dword [rsp + 0xc], 0x6eee320c
lea ebx, [r11 + 0x20]
lea rsi, [0x180000000]
mov r9d, dword [r11 + rsi + 0x7cbe0]
xor r9d, dword [rsp + r11 + 4]
xor r9d, dword [rsp + r11 + 0xc]
xor r9d, dword [rsp + r11 + 8]
mov eax, r9d
mov ecx, r9d
mov edx, r9d
shr ecx, 0x10
shr eax, 0x18
shr edx, 8
movzx eax, al
movzx r10d, byte [rax + rsi + 0x7cad0]
movzx eax, cl
movzx ecx, byte [rax + rsi + 0x7cad0]
shl r10d, 8
movzx eax, dl
movzx edx, byte [rax + rsi + 0x7cad0]
or r10d, ecx
movzx eax, r9b
movzx r9d, byte [rax + rsi + 0x7cad0]
shl r10d, 8
or r10d, edx
shl r10d, 8
or r10d, r9d
mov ecx, r10d
mov eax, r10d
rol ecx, 0xd
ror eax, 9
xor ecx, eax
xor ecx, dword [rsp + r11]
xor ecx, r10d
mov dword [rsp + r11 + 0x10], ecx
mov dword [r11 + rdi], ecx
add r11, 4
sub rbx, 1
jne 0x18003b74a
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x18003b7f8
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0xb0
mov rbp, rcx
mov rdi, r8
mov rbx, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x90
call fcn.180055bd0
movzx eax, byte [rbx + 1]
movzx r11d, byte [rbx]
movzx ecx, byte [rbx + 4]
shl r11d, 8
mov esi, 0x20
shl ecx, 8
or r11d, eax
movzx eax, byte [rbx + 2]
shl r11d, 8
lea r12, [0x18007cad0]
or r11d, eax
movzx eax, byte [rbx + 3]
shl r11d, 8
or r11d, eax
movzx eax, byte [rbx + 5]
or ecx, eax
movzx eax, byte [rbx + 6]
mov dword [rsp + 0x20], r11d
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 9]
mov dword [rsp + 0x24], ecx
movzx ecx, byte [rbx + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xd]
mov dword [rsp + 0x28], ecx
movzx ecx, byte [rbx + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xf]
lea rbx, [rsp + 0x28]
shl ecx, 8
or ecx, eax
lea rax, [rsp + 0x28]
sub rbp, rax
mov dword [rsp + 0x2c], ecx
mov r9d, dword [rbx + rbp]
xor r9d, dword [rbx - 4]
xor r9d, dword [rbx]
add rbx, 4
xor r9d, dword [rbx]
mov eax, r9d
mov ecx, r9d
mov edx, r9d
shr ecx, 0x10
shr eax, 0x18
shr edx, 8
movzx eax, al
movzx r10d, byte [rax + r12]
movzx eax, cl
movzx ecx, byte [rax + r12]
shl r10d, 8
movzx eax, dl
movzx edx, byte [rax + r12]
or r10d, ecx
movzx eax, r9b
movzx r9d, byte [rax + r12]
shl r10d, 8
or r10d, edx
shl r10d, 8
or r10d, r9d
mov ecx, r10d
mov eax, r10d
ror ecx, 0xe
rol eax, 0xa
xor ecx, eax
mov eax, r10d
ror eax, 8
xor ecx, eax
mov eax, r10d
rol eax, 2
xor ecx, eax
xor ecx, dword [rbx - 0xc]
xor ecx, r10d
sub rsi, 1
mov dword [rbx + 4], ecx
jne 0x18003b8db
mov ecx, dword [rsp + 0xac]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov eax, ecx
shr eax, 0x18
mov byte [rdi], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rdi + 2], cl
mov ecx, dword [rsp + 0xa8]
mov byte [rdi + 1], al
mov al, byte [rsp + 0xac]
mov byte [rdi + 3], al
mov eax, ecx
shr eax, 0x18
mov byte [rdi + 4], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rdi + 6], cl
mov ecx, dword [rsp + 0xa4]
mov byte [rdi + 5], al
mov al, byte [rsp + 0xa8]
mov byte [rdi + 7], al
mov eax, ecx
shr eax, 0x18
mov byte [rdi + 8], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rdi + 0xa], cl
mov ecx, dword [rsp + 0xa0]
mov byte [rdi + 9], al
mov al, byte [rsp + 0xa4]
mov byte [rdi + 0xb], al
mov eax, ecx
shr eax, 0x18
mov byte [rdi + 0xc], al
mov eax, ecx
shr eax, 0x10
shr ecx, 8
mov byte [rdi + 0xd], al
mov al, byte [rsp + 0xa0]
mov byte [rdi + 0xe], cl
mov byte [rdi + 0xf], al
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x18003c144
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
lea r9, str..________.dirty
mov r8d, 1
mov rdx, rcx
lea rcx, [rax - 0x48]
call fcn.180001b40
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsi]
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x40]
mov rdi, rax
mov qword [rsp + 0x28], rax
test rdi, rdi
je 0x18003c19d
cmp rdi, rax
je 0x18003c1a2
call fcn.180054d28
cmp rbx, rsi
je 0x18003c1fb
test rdi, rdi
jne 0x18003c1b6
call fcn.180054d28
xor r11d, r11d
jmp 0x18003c1b9
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x18003c1c4
call fcn.180054d28
cmp qword [rbx + 0x38], 8
jb 0x18003c1d1
mov rcx, qword [rbx + 0x20]
jmp 0x18003c1d5
lea rcx, [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x28]
call fcn.18000b9ac
mov rsi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
jmp 0x18003c193
lea rcx, [rsp + 0x40]
call fcn.180007ba8
nop
mov rcx, qword [rsp + 0x40]
call fcn.180054958
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x18003c7dc
Capabilities:
Check if file exists
Copy file
Get common file path
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, r8
mov rsi, rdx
lea rcx, [rsp + 0x52]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], di
call fcn.180055bd0
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, str.drivers
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x50]
call fcn.18003c144
lea rcx, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, edi
jne 0x18003c887
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb edi, edi
not edi
and edi, 8
jmp 0x18003c90f
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.18000272c
cmp eax, edi
jne 0x18003c90f
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, edi
jne 0x18003c90f
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.18003c104
cmp qword [rsp + 0x40], 8
lea rdx, [rsp + 0x28]
cmovae rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, edi
je 0x18003c8f8
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb edi, edi
not edi
and edi, 8
jmp 0x18003c8fd
mov edi, 9
cmp qword [rsp + 0x40], 8
jb 0x18003c90f
mov rcx, qword [rsp + 0x28]
call fcn.180054958
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180055580
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18004013c
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x18009dbe0]
test rcx, rcx
je 0x18004016c
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x18009dbe0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [0x18009dbe0], 0
add rsp, 0x28
ret

Function at 0x180040fd4
Capabilities:
Read clipboard data

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rdi, rcx
mov qword [rax - 0x20], rcx
xor ebp, ebp
mov dword [rax - 0x58], ebp
mov qword [rcx + 0x20], 7
mov qword [rcx + 0x18], rbp
mov word [rcx + 8], bp
mov dword [rax - 0x58], 1
mov ecx, edx
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rsi, rax
cmp rax, rbp
je 0x18004108d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbp
mov word [rsp + 0x30], bp
mov r8d, ebx
shr r8, 1
dec r8
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.180007250
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.180007130
nop
cmp qword [rsp + 0x48], 8
jb 0x180041084
mov rcx, qword [rsp + 0x30]
call fcn.180054958
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, rdi
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800420dc
Capabilities:
Open clipboard

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov ebx, edx
mov rdi, rcx
xor r9d, r9d
lea r8, [0x180075158]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call fcn.180005444
xor esi, esi
cmp eax, esi
je 0x18004228d
cmp ebx, 1
jne 0x180042187
cmp dword [0x18009dbd0], esi
je 0x18004228d
call fcn.1800034d4
sub rax, qword [0x18009dbd8]
cmp rax, 0xbb8
jbe 0x18004228d
mov rcx, rdi
call qword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, esi
je 0x18004217c
call fcn.180041c40
call fcn.180041254
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x18009dbd0], esi
jmp 0x18004228d
cmp ebx, 2
jne 0x18004228d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
cmp eax, esi
je 0x18004228d
cmp rbx, qword [0x180099080]
je 0x18004228d
mov qword [0x180099080], rbx
mov dword [rsp + 0x20], esi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, dword [rsp + 0x20]
cmp ebx, esi
je 0x18004226b
mov word [rsp + 0x60], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x62]
call fcn.180055bd0
mov r8d, 0x104
lea rdx, [rsp + 0x60]
mov ecx, ebx
call fcn.180004150
cmp eax, esi
je 0x18004228d
lea rcx, [rsp + 0x60]
call fcn.180054a5c
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [0x180099088]
call fcn.180007250
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.18000e0d0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1800990b0]
call fcn.180006db0
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18004228d
mov rcx, qword [rsp + 0x38]
call fcn.180054958
jmp 0x18004228d
lea rcx, [0x180075150]
call fcn.180054a5c
mov r8, rax
lea rdx, [0x180075150]
lea rcx, [0x180099088]
call fcn.180007250
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180055580
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180042a34
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rsi
sub rsp, 0x270
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov ebx, edx
xor esi, esi
cmp edx, esi
je 0x180042aad
xor r9d, r9d
lea r8, [0x180075598]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call fcn.180005444
cmp eax, esi
jne 0x180042af6
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
lea r9d, [rsi + 0x10]
lea r8, [0x18007dfbc]
lea rdx, [0x180075580]
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x180042c2e
xor r9d, r9d
lea r8, [0x180075558]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call fcn.180005444
cmp eax, esi
jne 0x180042af6
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov r9d, sendto
lea r8, [0x18007dfbc]
lea rdx, [0x180075540]
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x180042c2e
mov word [rsp + 0x50], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x52]
call fcn.180055bd0
mov r9d, 0x104
lea r8, [rsp + 0x50]
lea rdx, str.wfchost.exe
mov rcx, qword [0x18009de98]
call fcn.180002a20
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, esi
jne 0x180042b62
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov r9d, sendto
lea r8, [0x18007dfbc]
lea rdx, str.gb0R
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x180042c2e
cmp ebx, esi
je 0x180042b6f
lea r9, str._encrypt
jmp 0x180042ba0
xor r9d, r9d
lea r8, [0x1800754e0]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call fcn.180005444
lea rcx, str._decrypt
lea r9, str._decryptNoReq
cmp eax, esi
cmovne r9, rcx
lea r8, [rsp + 0x50]
lea rdx, str.__s___s__shl
lea rcx, [rsp + 0x20]
call fcn.180005248
nop
cmp qword [rax + 0x20], 8
jb 0x180042bc4
mov rcx, qword [rax + 8]
jmp 0x180042bc8
lea rcx, [rax + 8]
xor edx, edx
lea r8d, [rdx + 1]
call fcn.1800036a0
mov rbx, rax
cmp qword [rsp + 0x40], 8
jb 0x180042be8
mov rcx, qword [rsp + 0x28]
call fcn.180054958
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x28], si
cmp rbx, rsi
jne 0x180042c25
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov r9d, sendto
lea r8, [0x18007dfbc]
lea rdx, [0x180075470]
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x180042c2e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180055580
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rsi
ret
Function at 0x180042c50
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x280
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
mov word [rsp + 0x60], bp
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x62]
call fcn.180055bd0
mov r9d, 0x104
lea r8, [rsp + 0x60]
mov rdx, rbx
mov rcx, qword [0x18009de98]
call fcn.180002a20
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, ebp
jne 0x180042cf1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov qword [rsp + 0x20], rdi
lea r9, str.gb0R_
lea r8d, [rbp + 0x10]
lea rdx, [0x18007dfbc]
call fcn.180002c24
jmp 0x180042d71
lea r9, [0x18007c198]
cmp rsi, rbp
cmovne r9, rsi
lea r8, [rsp + 0x60]
lea rdx, str.__s___s
lea rcx, [rsp + 0x38]
call fcn.180005248
nop
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
xor edx, edx
lea r8d, [rdx + 1]
call fcn.1800036a0
cmp rax, rbp
jne 0x180042d5f
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov qword [rsp + 0x20], rdi
lea r9, [0x1800755e8]
mov r8d, sendto
lea rdx, [0x18007dfbc]
call fcn.180002c24
nop
cmp qword [rsp + 0x58], 8
jb 0x180042d71
mov rcx, qword [rsp + 0x40]
call fcn.180054958
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180055580
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret

Function at 0x180043148
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rsi, r8
mov r12d, edx
mov rdi, rcx
mov ecx, 0x20
call fcn.180054d48
mov rbx, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1800431b2
mov rcx, qword [rdi + 0x18]
test rcx, rcx
jne 0x180043192
and qword [rax + 0x18], rcx
jmp 0x1800431b4
cmp rcx, rdi
jne 0x1800431a5
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax]
mov qword [rbx + 0x18], rax
jmp 0x1800431b4
mov rax, qword [rcx]
xor edx, edx
call qword [rax]
mov qword [rbx + 0x18], rax
jmp 0x1800431b4
xor ebx, ebx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r12d
mov r9, rbx
lea r8, [0x180043050]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1800431f0
mov r8, qword [rcx]
cmp rcx, rdi
setne dl
call qword [r8 + 0x18]
and qword [rdi + 0x18], 0
mov rax, rbx
jmp 0x180043216
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x180043cec
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xd0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.180043a58
nop
mov rbx, qword [rsp + 0x50]
mov r9d, 5
lea r8, str.BackupCount
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call fcn.180005444
mov r11d, eax
xor edi, edi
cmp rbx, r11
jbe 0x180043e5a
mov rax, qword [rsp + 0x48]
mov rbx, qword [rax]
mov r11, qword [rsp + 0x20]
cmp r11, rdi
jne 0x180043d76
call fcn.180054d28
mov r11, rdi
jmp 0x180043d79
mov r11, qword [r11]
cmp rbx, qword [r11 + 0x28]
jne 0x180043d84
call fcn.180054d28
lea rdx, [rbx + 0x10]
mov qword [rsp + 0xb8], 7
mov qword [rsp + 0xb0], rdi
mov word [rsp + 0xa0], di
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x98]
call fcn.180007130
lea rcx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r11, qword [rsp + 0x48]
mov rax, qword [r11]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x60], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x20]
call fcn.180006110
cmp qword [rsp + 0xb8], 8
jb 0x180043e29
mov rcx, qword [rsp + 0xa0]
call fcn.180054958
mov rbx, qword [rsp + 0x50]
mov r9d, 5
lea r8, str.BackupCount
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call fcn.180005444
mov r11d, eax
cmp rbx, r11
ja 0x180043d5a
lea rcx, [rsp + 0x20]
call fcn.180008c64
mov rcx, qword [rsp + 0x48]
call fcn.180054958
mov qword [rsp + 0x48], rdi
mov rcx, qword [rsp + 0x20]
call fcn.180054958
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180055580
mov rbx, qword [rsp + 0xe8]
add rsp, 0xd0
pop rdi
ret
Function at 0x180046428
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov rcx, qword [0x18009dc38]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x180046464
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], eax
lea r8, [0x1800462d0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
ret

Function at 0x1800464f0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x18009df00], 0
mov rdi, rdx
mov rbx, rcx
jne 0x180046544
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180046534
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18009def8], rax
jmp 0x18004653b
mov rax, qword [0x18009def8]
mov byte [0x18009df00], 1
jmp 0x18004654b
mov rax, qword [0x18009def8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x180046561
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x180046567
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180046624
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
xor edi, edi
mov rbx, r8
mov rbp, rdx
mov r12, rcx
cmp r8, rdi
jne 0x180046652
lea eax, [rdi + 0xd]
jmp 0x180046689
mov rsi, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea rsi, [rsi + rax*2]
lea edi, [rdi + rax*2]
cmp eax, 1
jne 0x180046655
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x180046dac
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov edi, dword [rcx + 8]
xor eax, eax
mov rsi, rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
or edi, 0x2001f
xor r8d, r8d
mov r9d, edi
mov rbp, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x180046eb9
test rcx, rcx
je 0x180046e21
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
and edi, 0x300
mov dword [rsp + 0x50], edi
xor edi, edi
mov qword [rsp + 0x48], rcx
cmp ebx, edi
jmp 0x180046e53
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.180046dac
mov rcx, qword [rsp + 0x48]
mov ebx, eax
cmp eax, edi
jne 0x180046ebb
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, edi
je 0x180046e3b
mov rcx, qword [rsp + 0x48]
cmp rcx, rdi
je 0x180046ea1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rdi
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x50], edi
call fcn.1800464f0
mov rcx, qword [rsp + 0x48]
mov ebx, eax
jmp 0x180046ebb
xor edi, edi
cmp rcx, rdi
je 0x180046ec6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180055580
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret