joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c43c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140014c60], rbx
je 0x14000c4a3
cmp rax, rbx
jne 0x14000c496
mov ebx, 1
mov esi, ebx
jmp 0x14000c4a8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000c47b
mov ebx, 1
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c4c0
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000c52c
mov eax, dword [0x140014c68]
test eax, eax
jne 0x14000c521
mov dword [0x140014c68], ebx
lea r15, [0x14000eba0]
lea rdi, [0x14000eb88]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000c513
test eax, eax
jne 0x14000c517
cmp qword [rdi], r14
je 0x14000c508
mov rax, qword [rdi]
mov rcx, qword [0x14000eb40]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000c4ea
test eax, eax
je 0x14000c527
mov eax, 0xff
jmp 0x14000c682
mov dword [0x1400143e4], ebx
mov edi, 0x1f
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c553
lea rdx, [0x14000eb80]
lea rcx, [0x14000eb48]
call sub.msvcrt.dll__initterm
mov dword [0x140014c68], 2
test esi, esi
jne 0x14000c561
mov rax, r14
xchg qword [0x140014c60], rax
cmp qword [0x140014c80], r14
je 0x14000c594
lea rcx, [0x140014c80]
call fcn.14000ca70
test eax, eax
je 0x14000c594
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140014c80]
mov r9, qword [0x14000eb40]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000c5ad
mov eax, 0xff
jmp 0x14000c682
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000c633
test ax, ax
je 0x14000c5c8
test edx, edx
jne 0x14000c633
sub ax, bx
cmp ax, di
ja 0x14000c5de
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000c5c8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001878
mov dword [0x1400143e0], eax
cmp dword [0x140014400], r14d
jne 0x14000c61c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400143e4], r14d
jne 0x14000c631
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400143e0]
jmp 0x14000c682
cmp ax, 0x22
jne 0x14000c647
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c5b6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140191000
add rsp, 0x28
jmp 0x14000c43c
Function at 0x1400111fe
Capabilities:
Terminate process

Disassembly:
jmp 0x1400134a0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001128f
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400147e0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014800
xor al, al
jmp 0x140014881
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014813
xor al, al
jmp 0x140014881
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001483d
xor al, al
jmp 0x140014881
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014851
xor al, al
jmp 0x140014881
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014863
xor al, al
jmp 0x140014881
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001487f
xor al, al
jmp 0x140014881
mov al, 1
add rsp, 0x38
ret
Function at 0x130e030
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x130e03d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x130e04d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x130e035
lea eax, [rcx + 1]
jmp 0x130e05b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x130e06e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x130e054
sub eax, 3
jb 0x130e08e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x130e0dd
sar eax, 1
movsxd rbp, eax
jb 0x130e0c4
jmp 0x130e09c
add ebx, ebx
jne 0x130e09a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x130e0c4
inc ecx
add ebx, ebx
jne 0x130e0aa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x130e0c4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x130e0bd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x130e0ac
add ecx, 2
jmp 0x130e0c9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.0130dff2
jmp 0x130e03d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xefc000]
mov eax, dword [rdi]
or eax, eax
je 0x130e139
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xf4cba8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x130e0e9
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x130e133
mov qword [rbx], rax
add rbx, 8
jmp 0x130e109
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x130e17d
cmp al, 0xef
ja 0x130e165
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x130e145
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x130e154
mov eax, dword [rdi]
add rdi, 4
jmp 0x130e154
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x130e1d1
sub rsp, 0xffffffffffffff80
jmp 0x47a260
Function at 0x1400019b0
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x40
and qword [r11 - 0x18], 0
lea rax, str.SNMPTRAP
and qword [r11 - 0x10], 0
xor r9d, r9d
mov qword [r11 - 0x28], rax
xor r8d, r8d
lea rax, [0x140001120]
xor ecx, ecx
mov qword [r11 - 0x20], rax
lea ebx, [r9 + 1]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
nop dword [rax + rax]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
nop dword [rax + rax]
mov qword [0x140004638], rax
test rax, rax
jne 0x140001a23
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
xorps xmm0, xmm0
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
movups xmmword [0x140004680], xmm0
movups xmmword [0x140004690], xmm0
call qword [sym.imp.KERNEL32.dll_CreateEventW]
nop dword [rax + rax]
mov qword [0x140004698], rax
test rax, rax
jne 0x140001a78
mov rcx, qword [0x140004638]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea rcx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
nop dword [rax + rax]
mov rcx, qword [0x140004638]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [0x140004698]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x140002800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
push rsi
dec rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov qword [rbp - 0x58], 0
mov qword [rbp - 0x70], 5
mov r10, qword [rbp - 0x70]
sub r10, 4
add al, 0x4c
mov dword [rbp - 0xa8], edx
xor eax, eax
mov r10, qword [rbp - 0x70]
cqo
idiv r10
mov qword [rbp - 0x88], rax
mov r10, qword [rbp - 0x70]
add r10, 2
mov qword [rbp - 0x40], r10
mov qword [rbp - 0x68], select
mov r10, qword [rbp - 0x68]
mov r13, r10
sub r13, 0xe
xor r14d, r14d
movabs r10, 0xe2e
mov qword [rbp - 0xd0], r10
mov r13d, 0x109e
mov edi, 0xd3310b8c
mov r10, qword [rbp - 0xd0]
movabs r9, 0x4837d
mov r14, r10
imul r14, r9
mov r10d, r13d
movabs r9, 0x306d
mov r13, r10
add r13, r9
movabs r10, 0x100000000
mov qword [rbp - 0x60], r10
mov dword [rbp - 0x60], edx
add r14, qword [rbp - 0x60]
sub edi, 1
mov r10d, r13d
movabs r9, 0x514f5
mov r13, r10
add r13, r9
movabs r10, 0xe5
add r14, r10
mov dword [rbp - 0x38], 0x15f3
mov r10, qword [rbp - 0xa8]
sub r10, 1
mov dword [rbp - 0x8c], r10d
mov r10d, dword [rbp - 0x38]
sub r14, r10
mov qword [rbp - 0xb0], 0x40007b5b
mov eax, dword [rbp - 0x8c]
mov r10, qword [rbp - 0x58]
add r10, 4
cqo
idiv r10
invalid
invalid
Function at 0x180003000
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov rdi, rcx
xor r12d, r12d
mov word [rax - 0x18], r12w
mov qword [rax + 0x10], r12
mov ebx, r12d
mov eax, dword [0x18004a1a4]
test eax, eax
je 0x180003048
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x18004a1a4]
test eax, eax
jne 0x180003051
call fcn.180002da0
test eax, eax
je 0x18000306d
lea rdx, [rsp + 0x48]
mov rcx, qword [0x180045028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x180003077
movzx eax, r12w
jmp 0x1800030bf
mov rcx, rdi
call qword [sym.imp.USER32.dll_RegisterClassExW]
movzx ebx, ax
mov word [rsp + 0x20], ax
mov edi, r12d
test bx, bx
sete dil
test edi, edi
je 0x1800030a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1800030a3
mov esi, r12d
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x1800030bc
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, bx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x180003120
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r12
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov r12, rcx
and dword [rax - 0x18], 0
and qword [rax + 0x20], 0
xor ebx, ebx
mov eax, dword [0x18004a1a4]
test eax, eax
je 0x18000316a
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x18004a1a4]
test eax, eax
jne 0x180003173
call fcn.180002da0
test eax, eax
je 0x18000318f
lea rdx, [rsp + 0x58]
mov rcx, qword [0x180045028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x180003197
xor eax, eax
jmp 0x1800031de
mov r8, rdi
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.USER32.dll_GetClassInfoExW]
mov esi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test eax, eax
sete bl
test ebx, ebx
je 0x1800031c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1800031c3
xor edi, edi
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1800031dc
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r12
ret
Function at 0x1800031f4
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
sub rsp, 0x70
mov edi, r9d
mov rsi, r8
mov r12, rdx
mov r13d, ecx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x18004a1a4]
test eax, eax
je 0x180003246
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x18004a1a4]
test eax, eax
jne 0x18000324f
call fcn.180002da0
test eax, eax
je 0x18000326b
lea rdx, [rsp + 0x60]
mov rcx, qword [0x180045028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x180003276
xor eax, eax
jmp 0x180003324
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, rsi
mov rdx, r12
mov ecx, r13d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rsi, rax
mov qword [rsp + 0x68], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je 0x180003306
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x180003308
xor edi, edi
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x180003321
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret

Function at 0x18000fcb0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x180048a70]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, VarUI4FromDisp
xor ebx, ebx
mov dword [rsp + 0x20], VarUI4FromDisp
call fcn.18001ef30
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 5
jne 0x18000fd07
cmp dword [rsp + 0x28], 1
jne 0x18000fd2f
mov ebx, 1
jmp 0x18000fd2f
cmp dword [rsp + 0x24], 6
jne 0x18000fd2f
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x18000fd2a
dec eax
je 0x18000fd23
dec eax
jne 0x18000fd2f
lea ebx, [rax + 4]
jmp 0x18000fd2f
mov ebx, 3
jmp 0x18000fd2f
mov ebx, 2
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18001f0c0
add rsp, 0x150
pop rbx
ret
Function at 0x18000fde4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x50
xor edi, edi
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
lea rcx, [rax - 0x28]
and qword [rax - 0x28], rdi
and dword [rax - 0x20], edi
and qword [rax - 0x18], rdi
mov r9d, 0x20019
mov rdx, 0xffffffff80000002
call fcn.18000d078
test eax, eax
jne 0x18000fe5c
mov rcx, qword [rsp + 0x30]
and dword [rsp + 0x60], edi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x70]
lea rdx, str.EnableLUA
xor r8d, r8d
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x60], edi
setne dil
cmp qword [rsp + 0x30], 0
je 0x18000fe6f
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
add rsp, 0x50
pop rdi
ret

Function at 0x1800119c4
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x180011a27
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180011a3b
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011a3b
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x180011a40
cmp dword [rcx + 8], 0
je 0x180011a3b
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x180011a40
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x180011a50
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x180011a76
mov r8, rdx
mov rdx, qword [rbx]
call fcn.1800119c4
jmp 0x180011add
cmp byte [0x18004a360], 0
jne 0x180011aba
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180011aaa
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18004a358], rax
jmp 0x180011ab1
mov rax, qword [0x18004a358]
mov byte [0x18004a360], 1
jmp 0x180011ac1
mov rax, qword [0x18004a358]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x180011ad7
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x180011add
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180011ae8
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
xor edi, edi
mov rbx, r8
mov rbp, rdx
mov r12, rcx
test r8, r8
jne 0x180011b16
lea eax, [rdi + 0xd]
jmp 0x180011b4d
mov rsi, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea rsi, [rsi + rax*2]
lea edi, [rdi + rax*2]
cmp eax, 1
jne 0x180011b19
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x18001216c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r12
sub rsp, 0x30
mov edi, r8d
mov rsi, rdx
mov r12, rcx
and qword [rax - 0x18], 0
and qword [rax + 0x20], 0
xor ebx, ebx
mov eax, dword [0x18004a1a4]
test eax, eax
je 0x1800121b7
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x18004a1a4]
test eax, eax
jne 0x1800121c0
call fcn.180002da0
test eax, eax
je 0x1800121dc
lea rdx, [rsp + 0x58]
mov rcx, qword [0x180045028]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x1800121e4
xor eax, eax
jmp 0x18001222f
mov r8d, edi
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je 0x180012211
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x180012213
xor edi, edi
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x18001222c
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r12
ret
Function at 0x180014884
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x180048a70]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r12, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call fcn.18001216c
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1800148f7
call fcn.180004c80
mov ebx, eax
jmp 0x180014a06
mov r8, r12
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x180014918
call fcn.180004c80
jmp 0x1800149fa
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18001490e
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jae 0x180014953
mov ebx, 0x8007000e
jmp 0x1800149fc
mov ecx, eax
test eax, eax
je 0x180014990
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x180014986
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x180014990
lea rcx, [rsp + 0x70]
call fcn.180012140
mov rax, qword [rsp + 0x70]
jmp 0x18001499a
mov ecx, 0x80070216
call fcn.180001000
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x1800149b1
test rax, rax
je 0x180014949
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x18001490e
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.180013fa8
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x180014a1d
lea rcx, [rsp + 0x70]
call fcn.180012138
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.18001f0c0
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret