joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005b0f4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov rax, qword [0x18016b2c0]
test rax, rax
jne 0x18005b1ef
mov dword [rbp + 0x18], VariantTimeToDosDateTime
mov dword [rbp + 0x10], 8
and qword [rbp + 0x20], rax
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MsgCenter
lea rcx, [rbp + 0x28]
call fcn.180056700
nop
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x18]
lea r8, str.opentime_traystartup
mov rdx, qword [rbp + 0x28]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18005b185
mov rax, qword [rbp + 0x20]
test rax, rax
jne 0x18005b1ca
mov dword [rbp + 0x18], VariantTimeToDosDateTime
mov dword [rbp + 0x10], 8
and qword [rbp + 0x20], 0
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x18]
lea r8, str.opentime_traystartup
mov rdx, qword [rbp + 0x28]
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov rax, qword [rbp + 0x20]
mov qword [0x18016b2c0], rax
mov rdx, qword [rbp + 0x28]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18005b1ef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [0x18016b2c0]
add rsp, 0x40
pop rbp
ret

Function at 0x18005b1fc
Capabilities:
Set registry value

Disassembly:
push rsi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
call fcn.1800572cc
mov qword [0x18016b2c0], rax
mov dword [rsp + 0x20], 1
lea r9, str.MsgCenter
xor r8d, r8d
lea rdx, str.MsgCenter
lea rcx, [rsp + 0x50]
call fcn.180056700
nop
and dword [rsp + 0x20], 0
lea r9, str.MsgCenter
xor r8d, r8d
lea rdx, str.MsgCenter
lea rcx, [rsp + 0x58]
call fcn.180056700
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.18000525c
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18005b289
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x28], 8
lea rsi, [0x18016b2c0]
mov qword [rsp + 0x20], rsi
mov r9d, VariantTimeToDosDateTime
lea r8, str.opentime_traystartup
mov rdx, qword [rsp + 0x50]
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rsi
mov r9d, VariantTimeToDosDateTime
lea r8, str.opentime_traystartup
mov rdx, qword [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18005b308
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x40
pop rsi
ret
Function at 0x18005b310
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbx
sub rsp, 0x40
mov qword [rax - 0x18], 0xfffffffffffffffe
mov dword [rax - 0x28], 1
lea rdx, str.MsgCenter
mov r9, rdx
xor r8d, r8d
lea rcx, [rax + 8]
call fcn.180056700
nop
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r8, str.opentime_afterupdate
mov rdx, qword [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor ebx, ebx
test eax, eax
sete bl
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x18005b39a
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x18005b3a4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov qword [rbp - 0x79], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800c5470]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, rdx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov ebx, 0x80
mov r8d, ebx
xor edx, edx
lea rcx, [rbp - 0x49]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Coop
lea rcx, [rsp + 0x38]
call fcn.180056700
nop
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
lea r8, str.registtime
mov rdx, qword [rsp + 0x38]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18005b533
cmp dword [rsp + 0x30], 1
jne 0x18005b533
cmp dword [rsp + 0x34], 0x14
jb 0x18005b533
mov word [rbp + 0x35], r14w
xor edx, edx
lea r8d, [r14 + 0x24]
lea rcx, [rbp - 0x71]
call sub.msvcrt.dll_memset
lea rdx, [0x180091358]
lea rcx, [rbp - 0x49]
call qword [sym.imp.msvcrt.dll_wcspbrk]
mov rbx, rax
test rax, rax
je 0x18005b531
mov word [rax], r14w
add rbx, 2
lea rdx, [0x180091358]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcspbrk]
mov rdi, rax
test rax, rax
je 0x18005b4be
mov word [rax], r14w
add rdi, 2
test rbx, rbx
je 0x18005b531
test rdi, rdi
je 0x18005b531
lea rcx, [rbp - 0x49]
call qword [sym.imp.msvcrt.dll__wtoi]
sub eax, 0x76c
mov dword [rbp - 0x5d], eax
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wtoi]
dec eax
mov dword [rbp - 0x61], eax
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [rbp - 0x65], eax
or dword [rbp - 0x51], 0xffffffff
test rsi, rsi
je 0x18005b50a
lea rcx, [rbp - 0x71]
call qword [sym.imp.msvcrt.dll__mktime64]
mov qword [rsi], rax
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x18005b52a
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, 1
jmp 0x18005b554
jmp 0x18005b533
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18005b552
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1800782d0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x18005b708
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x58
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov rdi, rcx
cmp byte [rcx], 0
jne 0x18005b72b
xor al, al
jmp 0x18005b866
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
mov rdx, qword [rdi + 8]
mov rcx, rax
call fcn.180070d90
andps xmm0, xmmword [0x180093e80]
movsd xmm1, qword [0x180093e48]
comisd xmm1, xmm0
jb 0x18005b75c
mov al, byte [rdi + 0x38]
jmp 0x18005b866
lea rsi, [rdi + 0x10]
xor ebx, ebx
mov qword [rbp - 0x20], rbx
test rsi, rsi
je 0x18005b77b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, rsi
mov qword [rbp - 0x20], rbx
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
mov qword [rdi + 8], rax
test rbx, rbx
je 0x18005b795
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
and qword [rbp + 0x40], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, str.360Ent
lea rcx, [rbp - 0x28]
call fcn.180056700
nop
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
mov rdx, qword [rbp - 0x28]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18005b83f
and dword [rbp + 0x30], eax
lea ebx, [rax + 4]
mov dword [rbp + 0x28], ebx
mov dword [rbp + 0x38], ebx
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x28]
xor r8d, r8d
lea rdx, str.ForceNoPopup
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18005b835
cmp dword [rbp + 0x28], ebx
jne 0x18005b835
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp + 0x30], 1
sete bl
mov byte [rdi + 0x38], bl
jmp 0x18005b845
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rdi + 0x38], 0
xor bl, bl
mov rax, qword [rbp - 0x28]
lea rdx, [rax - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x18005b864
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, bl
add rsp, 0x58
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18005b870
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rax, qword [0x1800c5470]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
lea rcx, [rbp - 0x48]
call fcn.18001b178
nop
cmp qword [rbp - 0x38], 0
je 0x18005b903
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x18005b903
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18005b903
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
jb 0x18005b8ed
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x18005b903
call fcn.180065ee4
test eax, eax
je 0x18005b903
lea rcx, [rbp - 0x48]
call fcn.1800101e0
mov al, 1
jmp 0x18005b981
lea rcx, [rbp - 0x28]
call fcn.18001b1bc
nop
cmp qword [rbp - 0x18], 0
je 0x18005b96c
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x18005b96c
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18005b96c
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
jb 0x18005b958
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x18005b96c
call fcn.180065ee4
test eax, eax
je 0x18005b96c
lea rcx, [rbp - 0x28]
call fcn.1800101e0
jmp 0x18005b8f6
lea rcx, [rbp - 0x28]
call fcn.1800101e0
nop
lea rcx, [rbp - 0x48]
call fcn.1800101e0
xor al, al
mov byte [rbx], al
and qword [rbx + 8], 0
mov byte [rbx + 0x38], 0
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800782d0
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rbp
ret

Function at 0x18005bdcc
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x40
mov qword [rax - 0x18], 0xfffffffffffffffe
mov dword [rax + 0x10], edx
mov dword [rax - 0x28], 1
lea rdx, str.MsgCenter
mov r9, rdx
xor r8d, r8d
lea rcx, [rax + 0x18]
call fcn.180056700
nop
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r8, str.PopMode
mov rdx, qword [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x18005be59
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x18005c9f4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbx
push rsi
push rdi
sub rsp, 0x40
mov qword [rax - 0x20], 0xfffffffffffffffe
mov rsi, rcx
xor ebx, ebx
mov dword [rax + 0x18], ebx
mov dword [rax + 0x10], ebx
mov dword [rax + 0x20], 4
lea edi, [rbx + 1]
mov dword [rax - 0x38], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MsgCenter
lea rcx, [rax - 0x28]
call fcn.180056700
nop
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
lea r8, str.opentime_afterupdate
mov rdx, qword [rsp + 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18005ca76
cmp dword [rsp + 0x68], 4
je 0x18005ca78
mov edi, ebx
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18005ca97
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test edi, edi
je 0x18005cac8
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
mov edx, dword [rsp + 0x70]
mov rcx, rax
call fcn.180070d90
andps xmm0, xmmword [0x180093e80]
mov eax, dword [rsi + 0xc]
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
comisd xmm1, xmm0
setae bl
mov eax, ebx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x18005e750
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rdi, rcx
mov rsi, qword [rcx + 0x4c0]
mov qword [rax + 0x18], rsi
test rsi, rsi
je 0x18005e78d
or edx, 0xffffffff
mov rcx, rsi
call fcn.180056140
nop
mov ebx, 1
mov r15d, ebx
lea rbp, [rdi + 0x214]
lea r14, [rdi + 0x4b8]
cmp qword [r14], 0
jne 0x18005e895
mov rax, qword [rdi + 0x430]
test rax, rax
je 0x18005e7c3
mov rdx, r14
mov rcx, rbp
call rax
jmp 0x18005e7c5
mov eax, ebx
test eax, eax
jne 0x18005e927
mov rax, qword [rdi + 0x440]
test rax, rax
je 0x18005e7f9
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.PRAGMA_synchronous__OFF_
mov rcx, qword [r14]
call rax
mov ecx, eax
jmp 0x18005e7fb
mov ecx, ebx
lea eax, [rcx - 0xa]
test eax, 0xffffffee
jne 0x18005e88d
cmp ecx, 0x1b
je 0x18005e88d
xor r15d, r15d
mov rax, qword [rdi + 0x438]
test rax, rax
je 0x18005e824
mov rcx, qword [r14]
call rax
jmp 0x18005e826
mov eax, ebx
test eax, eax
jne 0x18005e927
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x18005e921
mov rax, qword [rdi + 0x430]
test rax, rax
je 0x18005e855
mov rdx, r14
mov rcx, rbp
call rax
jmp 0x18005e857
mov eax, ebx
test eax, eax
jne 0x18005e927
mov rax, qword [rdi + 0x440]
test rax, rax
je 0x18005e88b
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.PRAGMA_synchronous__OFF_
mov rcx, qword [r14]
call rax
mov ecx, eax
jmp 0x18005e88d
mov ecx, ebx
test ecx, ecx
jne 0x18005e927
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18005e8b9
mov ecx, 0x2000
test ecx, eax
jne 0x18005e8b9
or eax, ecx
mov edx, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
and dword [rsp + 0x78], 0
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.18005e6fc
test eax, eax
jne 0x18005e929
test r15d, r15d
je 0x18005e927
mov ecx, dword [rsp + 0x78]
lea eax, [rcx - 0xa]
test eax, 0xffffffee
jne 0x18005e927
cmp ecx, 0x1b
je 0x18005e927
xor r15d, r15d
mov rax, qword [rdi + 0x438]
test rax, rax
je 0x18005e8fd
mov rcx, qword [r14]
call rax
jmp 0x18005e8ff
mov eax, ebx
test eax, eax
jne 0x18005e927
and qword [r14], r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18005e7a3
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18005e929
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
test rsi, rsi
je 0x18005e93c
mov rcx, qword [rsi]
test rcx, rcx
je 0x18005e93c
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18005ecc0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x770]
sub rsp, 0x870
mov rax, qword [0x1800c5470]
xor rax, rsp
mov qword [rbp + 0x760], rax
mov esi, edx
mov rdi, rcx
call fcn.180018e8c
xor ebx, ebx
mov r14d, 0x104
test eax, eax
jne 0x18005ed44
xor edx, edx
lea rcx, [rbp + 0x550]
mov r8d, 0x208
call sub.msvcrt.dll_memset
mov r8d, r14d
lea rdx, [rbp + 0x550]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x550]
call fcn.180065ee4
test eax, eax
jne 0x18005ed44
mov eax, 0x80004005
jmp 0x18005ee21
mov rcx, qword [0x1800c7ff8]
lea rdx, [rbp + 0x340]
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x180090d64]
lea rcx, [rbp + 0x340]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea r8, [rbp + 0x340]
mov dword [rsp + 0x20], 0x418
mov rdx, r14
mov dword [rbp + 0x334], esi
lea rcx, [rbp + 0x12c]
call fcn.18000aaec
lea r8, str.ConfigMessageCenter.db
lea rcx, [rbp + 0x12c]
call fcn.180041588
lea r8, [rbp + 0x340]
mov rdx, r14
lea rcx, [rsp + 0x24]
call fcn.18000aaec
lea r8, str.deepscanheavygate64.dll
lea rcx, [rsp + 0x24]
call fcn.180041588
lea rcx, [rsp + 0x24]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18005edff
lea r8, [rbp + 0x340]
mov rdx, r14
lea rcx, [rsp + 0x24]
call fcn.18000aaec
lea r8, str.heavygate64.dll
lea rcx, [rsp + 0x24]
call fcn.180041588
cmp dword [rsp + 0x20], 8
jb 0x18005ee16
lea rcx, [rdi + 0x40]
lea rdx, [rsp + 0x20]
call fcn.18005cca8
mov ebx, eax
neg ebx
sbb eax, eax
not eax
and eax, 0x80004005
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.1800782d0
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x18005f710
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x40
mov qword [rax - 0x10], 0xfffffffffffffffe
mov rbx, rcx
and dword [rax + 0x10], 0
and dword [rax + 0x18], 0
mov dword [rax + 0x20], 4
mov dword [rax - 0x28], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MsgCenter
lea rcx, [rax - 0x18]
call fcn.180056700
nop
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, str.PopMode
mov rdx, qword [rsp + 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18005f79c
cmp dword [rsp + 0x58], 4
jne 0x18005f79c
test rbx, rbx
je 0x18005f79c
mov eax, dword [rsp + 0x60]
mov dword [rbx], eax
xor ebx, ebx
jmp 0x18005f7a1
mov ebx, 0x80004005
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x18005f7c1
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x18005ff20
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov eax, dword [0x18016b500]
test al, 1
jne 0x18005ff50
or eax, 1
mov dword [0x18016b500], eax
and qword [0x18016b508], 0
and qword [rbp + 0x18], 0
lea rcx, [rbp - 0x38]
call fcn.1800679c0
nop
lea rax, [rbp - 0x38]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x18]
mov qword [rbp - 0x10], rax
lea rax, [0x18004c3c8]
mov qword [rbp - 8], rax
lea r8, [rbp - 0x18]
lea rdx, [0x180060f88]
lea rcx, [0x18016b508]
call fcn.180068010
test eax, eax
je 0x18005ffbc
lea rcx, [rbp - 0x38]
call fcn.180067a60
and dword [rbp + 0x10], 0
lea rdx, [rbp + 0x10]
lea rcx, [0x18005fd0c]
call qword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [rbp + 0x10]
add rsp, 0x60
pop rbp
ret
lea rcx, [rbp - 0x38]
call fcn.180067ad0
test al, al
je 0x18005ffe8
lea rax, [rbp - 0x28]
mov qword [rbp + 0x20], rax
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x28]
call fcn.18001ad20
nop
mov rcx, rax
call fcn.18001ad50
int3
call fcn.1800681d0
int3
Function at 0x180060a0c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1800c5470]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov eax, dword [rcx + 0x50]
mov rbp, rdx
mov rbx, rcx
cmp eax, 0xffffffff
jne 0x180060afb
and dword [rcx + 0x50], 0
test rdx, rdx
je 0x180060af9
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20a
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetClassNameW]
dec eax
cmp eax, 0x103
ja 0x180060aa1
xor edi, edi
lea rsi, str.360se6_Frame
mov rcx, qword [rsi]
lea rdx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x180060aeb
inc edi
add rsi, 8
cmp edi, 0x13
jb 0x180060a84
lea rdx, [rsp + 0x20]
lea rcx, str.ApplicationFrameWindow
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x180060af9
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowTextW]
dec eax
cmp eax, 0x103
ja 0x180060af9
lea rdx, str.Microsoft_Edge
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180060af9
mov dword [rbx + 0x50], 1
mov eax, 1
jmp 0x180060afb
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800782d0
mov rbx, qword [rsp + 0x270]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret
Function at 0x180060fe0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 8], edi
je 0x180061002
cmp qword [rcx], rdi
setne dil
mov eax, edi
jmp 0x180061208
mov dword [rcx + 8], 1
mov rcx, rdx
call fcn.180065f9c
mov qword [rbx], rax
test rax, rax
je 0x180061206
lea rdx, str.sqlite3_open16
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x180061206
mov rcx, qword [rbx]
lea rdx, str.sqlite3_close
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x180061206
mov rcx, qword [rbx]
lea rdx, str.sqlite3_exec
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x20], rax
test rax, rax
je 0x180061206
mov rcx, qword [rbx]
lea rdx, str.sqlite3_prepare16_v2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x28], rax
test rax, rax
je 0x180061206
mov rcx, qword [rbx]
lea rdx, str.sqlite3_reset
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x30], rax
test rax, rax
je 0x180061206
mov rcx, qword [rbx]
lea rdx, str.sqlite3_bind_int64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x38], rax
test rax, rax
je 0x180061206
mov rcx, qword [rbx]
lea rdx, str.sqlite3_bind_int
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x40], rax
test rax, rax
je 0x180061206
mov rcx, qword [rbx]
lea rdx, str.sqlite3_bind_blob
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x48], rax
test rax, rax
je 0x180061206
mov rcx, qword [rbx]
lea rdx, str.sqlite3_bind_text16
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x50], rax
test rax, rax
je 0x180061206
mov rcx, qword [rbx]
lea rdx, str.sqlite3_column_blob
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x58], rax
test rax, rax
je 0x180061206
mov rcx, qword [rbx]
lea rdx, str.sqlite3_column_text16
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x60], rax
test rax, rax
je 0x180061206
mov rcx, qword [rbx]
lea rdx, str.sqlite3_column_int
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x68], rax
test rax, rax
je 0x180061206
mov rcx, qword [rbx]
lea rdx, str.sqlite3_column_int64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x70], rax
test rax, rax
je 0x180061206
mov rcx, qword [rbx]
lea rdx, str.sqlite3_finalize
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x78], rax
test rax, rax
je 0x180061206
mov rcx, qword [rbx]
lea rdx, str.sqlite3_step
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x80], rax
test rax, rax
je 0x180061206
mov rcx, qword [rbx]
lea rdx, str.sqlite3_column_bytes
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x88], rax
test rax, rax
je 0x180061206
mov rcx, qword [rbx]
lea rdx, str.sqlite3_bind_parameter_index
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x90], rax
test rax, rax
je 0x180061206
mov eax, 1
jmp 0x180061208
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret