joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180004288
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
mov eax, 0x12a0
call fcn.180078390
sub rsp, rax
mov rax, qword [0x1800c5470]
xor rax, rsp
mov qword [rsp + 0x1290], rax
mov rbx, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0x1048
lea rcx, [rsp + 0x240]
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x240]
mov rcx, qword [rsi + 0x28]
call fcn.180001900
xor r14d, r14d
test eax, eax
je 0x18000439a
cmp word [rsp + 0x242], 0x3a
jne 0x180004309
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x18000439a
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x30]
mov ecx, dword [rbx]
call fcn.180002308
test eax, eax
je 0x18000439a
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov rdi, rax
test rax, rax
je 0x18000439a
mov ecx, r14d
mov dword [rsp + 0x20], ecx
mov rdx, qword [rsi + 0x28]
mov qword [rsp + 0x28], rdx
cmp ecx, dword [rbx + 4]
ja 0x18000436f
cmp word [rdx], r14w
je 0x180004391
cmp ecx, dword [rbx + 4]
je 0x180004372
movzx eax, word [rdx]
add ecx, eax
mov dword [rsp + 0x20], ecx
movzx eax, word [rdx]
add rdx, rax
jmp 0x180004349
mov rdx, r14
test rdx, rdx
je 0x180004391
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_ILCombine]
mov rbx, rax
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsi + 0x28], rbx
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x18000439c
mov rcx, qword [rsp + 0x1290]
xor rcx, rsp
call fcn.1800782d0
mov rbx, qword [rsp + 0x12d0]
add rsp, 0x12a0
pop r14
pop rdi
pop rsi
ret
Function at 0x180008a0c
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x198]
sub rsp, 0x280
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1800c5470]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x58], r14
mov r9d, dword [rcx + 8]
or r9d, 0x2001f
mov r8, rdx
mov rdx, qword [rcx]
lea rcx, [rsp + 0x48]
call fcn.18000892c
jmp 0x180008a87
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.180008a0c
test eax, eax
mov ebx, eax
jne 0x180008af0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x40], 0x100
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x180008a78
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180008ade
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x50], r14d
mov rdx, rsi
mov rcx, rdi
call fcn.180008b5c
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180008b05
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x50], r14d
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1800782d0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x180008b5c
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x180008bee
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x180008bc8
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180008be7
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180008be7
mov rdx, qword [rdi]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call rax
jmp 0x180008bd7
cmp dword [rdi + 8], 0
je 0x180008be7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, 1
jmp 0x180008bd7
cmp byte [0x180168da0], 0
jne 0x180008c39
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180008c25
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
mov qword [0x180168d98], rax
jmp 0x180008c2c
mov r10, qword [0x180168d98]
mov eax, 1
mov byte [0x180168da0], al
jmp 0x180008c40
mov r10, qword [0x180168d98]
mov rcx, qword [rbx]
mov rdx, rsi
test r10, r10
je 0x180008bd1
mov r8d, dword [rbx + 8]
xor r9d, r9d
call r10
jmp 0x180008bd7
Function at 0x1800097e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1800c5470]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
xor edi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x70], rdi
xor edx, edx
lea r8d, [rdi + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x18000986d
xor edx, edx
lea r8d, [rdi + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x18000986d
call fcn.180007c0c
mov ebx, eax
jmp 0x180009976
mov r8, r15
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x18000988e
call fcn.180007c0c
jmp 0x180009965
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x180009884
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x1800098c9
mov ebx, 0x8007000e
jmp 0x180009967
mov ecx, eax
test eax, eax
je 0x1800098fb
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x1800099ae
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x1800098fb
lea rcx, [rsp + 0x70]
call fcn.180007be0
jmp 0x180009905
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x180009917
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x1800098bf
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x180009884
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], di
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.180009628
mov ebx, eax
test rsi, rsi
je 0x180009976
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x18000998d
lea rcx, [rsp + 0x70]
call fcn.180007bbc
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1800782d0
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.18000a540
int3
Function at 0x180009d04
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov rbp, r8
mov rcx, rdx
mov edi, ebx
xor edx, edx
lea r8d, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
je 0x180009dba
lea edx, [rbx + 1]
mov rcx, rax
lea r8d, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x180009db1
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r14
mov rcx, rsi
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x180009db1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
test rax, rax
je 0x180009da8
mov ecx, r12d
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
test rax, rax
je 0x180009da8
mov r8d, r12d
mov rdx, r15
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rdi, rdi
je 0x180009e16
lea r9, [rsp + 0x50]
mov qword [rsp + 0x68], rbx
lea r8, [rsp + 0x68]
mov dword [rsp + 0x50], ebx
lea rdx, [0x18008ad94]
mov rcx, rdi
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x180009e0d
mov rax, qword [rsp + 0x68]
mov ebx, 1
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm0
movups xmm0, xmmword [rax + 0x20]
mov eax, dword [rax + 0x30]
movups xmmword [rbp + 0x10], xmm1
movups xmmword [rbp + 0x20], xmm0
mov dword [rbp + 0x30], eax
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x18000a1bc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov rbx, r9
mov ecx, 0x43
mov rdi, rdx
call fcn.18000a354
mov r9, rbx
mov rdx, rdi
mov rcx, rsi
test rax, rax
je 0x18000a207
mov r8, qword [rsp + 0x68]
mov qword [rsp + 0x28], r8
mov r8, qword [rsp + 0x60]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call rax
jmp 0x18000a224
mov rax, qword [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18000bfa8
Capabilities:
Identify system language via api

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor r13d, r13d
mov dword [rax - 0x38], r13d
add rcx, 0x50
call fcn.1800402d0
lea rcx, [rdi + 0x68]
call fcn.180040358
lea rcx, [rdi + 0x60]
call fcn.180040688
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx r8d, ax
lea rdx, [0x180090580]
lea rcx, [rdi + 0x58]
call fcn.18000cf30
call fcn.18000a7ac
mov rcx, rax
test rax, rax
je 0x18000c11b
mov rax, qword [rax]
call qword [rax + ILCombine]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x80], 1
lea rax, [rsi + 0x44]
lea rcx, [rsi + 4]
lea rdx, [rsi + 0x84]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], rcx
mov rax, qword [rsi + 0xc4]
mov qword [rsp + 0x60], rax
mov rax, qword [rdi + 0x68]
mov qword [rsp + 0x58], rax
mov rax, qword [rdi + 0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rdi + 0x58]
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi + 0x48]
mov qword [rsp + 0x38], rax
mov rax, qword [rdi + 0x40]
mov qword [rsp + 0x30], rax
lea rax, str.conf
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r9, str.cloud
lea r8, [0x18008aed4]
lea rdx, str.pver_s_r_nproduct_s_r_nver_s_r_ncombo_s_r_nmid_s_r_nm2_s_r_nsysver_s_r_nlang_s_r_npa_s_r_nie_s_r_ncfg_ids_s_r_ncf_product_s_r_ncf_combo_s_r_n
mov rcx, rbx
call fcn.18000cf30
mov rdx, qword [rsi + 0xcc]
test rdx, rdx
je 0x18000c0ef
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], r13w
jne 0x18000c0da
mov r8d, eax
mov rcx, rbx
call fcn.1800057ac
mov rcx, rbx
call fcn.180004cfc
mov rax, rbx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80004005
call fcn.18000a540
int3
Function at 0x18000c97c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov rbx, rdx
call fcn.18000cb00
inc eax
mov dword [rbp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
mov dword [rbp + 0x30], eax
call fcn.18000a7ac
mov rcx, rax
test rax, rax
je 0x18000caf5
mov rax, qword [rax]
call qword [rax + ILCombine]
add rax, 0x18
mov qword [rbp - 0x18], rax
call fcn.18000a7ac
mov rcx, rax
test rax, rax
je 0x18000caea
mov rax, qword [rax]
call qword [rax + ILCombine]
add rax, 0x18
mov qword [rbp - 0x20], rax
mov r8, rbx
lea rdx, str._s_count
lea rcx, [rbp - 0x18]
call fcn.18000cf30
mov r8, rbx
lea rdx, str._s_lasttime
lea rcx, [rbp - 0x20]
call fcn.18000cf30
and dword [rsp + 0x20], 0
lea rdx, str.CloudCfg
mov r9, rdx
xor r8d, r8d
lea rcx, [rbp + 0x38]
call fcn.180056700
nop
mov edi, 4
mov dword [rsp + 0x28], edi
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, qword [rbp - 0x18]
mov rdx, qword [rbp + 0x38]
mov rbx, 0xffffffff80000001
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [rsp + 0x28], edi
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, qword [rbp - 0x20]
mov rdx, qword [rbp + 0x38]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor ebx, ebx
test eax, eax
sete bl
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x18000caa2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x18000cac1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
add ecx, edi
test ecx, ecx
jg 0x18000cae0
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
add rsp, 0x50
pop rdi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.18000a540
nop
mov ecx, 0x80004005
call fcn.18000a540
int3
Function at 0x18000deb4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1800c5470]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea eax, [r9 + 0x1f]
mov ebp, r9d
and eax, 0xfffffff0
mov r14, r8
mov dword [rsp + 0x40], eax
mov r15, rdx
add eax, 0x90
mov edi, 0x80004005
mov ecx, eax
mov esi, eax
call qword [sym.imp.msvcrt.dll_malloc]
mov rbx, rax
test rax, rax
je 0x18000e058
mov r8d, esi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x40]
mov r8d, ebp
lea r9, [rbx + 0x7c]
mov qword [rsp + 0x20], rax
mov rdx, r14
call fcn.18000da84
mov edi, eax
test eax, eax
jne 0x18000e04f
mov r14d, dword [rsp + 0x40]
lea r9, [rsp + 0x48]
mov r8d, r14d
lea rdx, [rbx + 0x7c]
call fcn.18000dda4
mov edi, eax
test eax, eax
jne 0x18000e04f
lea edi, [rax + 0x7c]
mov dword [rbx], 0x33363044
xor ecx, ecx
mov dword [rbx + 4], edi
mov dword [rbx + 8], 0xa
mov dword [rbx + 0xc], 0x10000
mov dword [rbx + 0x10], 0x3e9
call qword [sym.imp.msvcrt.dll__time64]
lea rcx, [rbx + 0x1c]
mov dword [rbx + 0x5c], 4
mov qword [rbx + 0x14], rax
lea r8, str.cloudcfg.dat
lea eax, [rdi - 0x68]
mov dword [rbx + 0x60], 0x20200
mov word [rbx + 0x74], ax
lea edx, [rdi - 0x5c]
lea eax, [r14 + 0x7c]
mov dword [rbx + 0x64], 0x10001
mov dword [rbx + 0x78], eax
lea esi, [rdi - 0x7a]
mov dword [rbx + 0x68], ebp
mov dword [rbx + 0x6c], r14d
mov dword [rbx + 0x70], edi
call fcn.18000aaec
mov edx, dword [rbx + 0x78]
xor r9d, r9d
movups xmm0, xmmword [rsp + 0x48]
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov rcx, r15
movups xmmword [rdx + rbx], xmm0
mov eax, dword [rsp + 0x58]
mov dword [rdx + rbx + 0x10], eax
mov edx, 0xc0000000
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
mov edi, 0x80004005
cmp rax, 0xffffffffffffffff
je 0x18000e03e
mov esi, dword [rbx + 0x78]
lea r9, [rsp + 0x40]
and dword [rsp + 0x40], 0
add esi, 0x14
and qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000e040
cmp dword [rsp + 0x40], esi
jne 0x18000e040
xor edi, edi
cmp rbp, 0xffffffffffffffff
je 0x18000e04f
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800782d0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000e07c
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov rax, qword [0x1800c5470]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, rcx
mov rax, rdx
xor ecx, ecx
mov r12, r8
mov qword [rsp + 0x30], rcx
mov r13, r9
mov dword [rbp - 0x38], ecx
mov ebx, ecx
mov qword [rbp - 0x30], rcx
mov edi, ecx
lea r8d, [rcx + 1]
mov dword [rsp + 0x28], 0x80
mov rcx, rax
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
mov r14d, 0x80004005
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000e29a
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x18000e28c
mov rax, qword [rbp - 0x30]
cmp rax, 0xa00000
jg 0x18000e28c
cmp rax, 0x80
jb 0x18000e28c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_malloc]
mov rbx, rax
test rax, rax
je 0x18000e28c
mov r8d, dword [rbp - 0x30]
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov r8d, dword [rbp - 0x30]
lea r9, [rbp - 0x38]
xor eax, eax
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18000e28c
mov eax, dword [rbp - 0x38]
cmp dword [rbp - 0x30], eax
jne 0x18000e28c
cmp dword [rbx], 0x33363044
jne 0x18000e28c
cmp dword [rbx + 8], 0xa
jb 0x18000e28c
cmp dword [rbx + 4], 0x7c
jne 0x18000e28c
mov r8d, dword [rbx + 0x6c]
movzx edx, word [rbx + 0x74]
lea rcx, [r8 + 0x7c]
add rcx, rdx
cmp rcx, rax
jne 0x18000e28c
test byte [rbx + 0x5c], 4
je 0x18000e28c
mov ecx, dword [rbx + 0x78]
lea rax, [r8 + 0x7c]
cmp rcx, rax
jne 0x18000e28c
test dx, dx
je 0x18000e28c
cmp ecx, 0x7c
jb 0x18000e28c
cmp word [rbx + 0x62], 2
jne 0x18000e28c
lea eax, [rdi + 1]
cmp word [rbx + 0x64], ax
jne 0x18000e28c
lea rdx, [rbx + 0x7c]
lea r9, [rbp - 0x28]
call fcn.18000dda4
test eax, eax
jne 0x18000e28c
mov ecx, dword [rbx + 0x78]
mov rax, qword [rcx + rbx]
cmp rax, qword [rbp - 0x28]
jne 0x18000e28c
mov rax, qword [rcx + rbx + 8]
cmp rax, qword [rbp - 0x20]
jne 0x18000e28c
mov eax, dword [rcx + rbx + 0x10]
cmp eax, dword [rbp - 0x18]
jne 0x18000e28c
mov ecx, dword [rbx + 0x6c]
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
mov eax, dword [rbx + 0x6c]
mov dword [rbp - 0x34], eax
test rdi, rdi
je 0x18000e28c
mov r8d, eax
xor edx, edx
mov rcx, rdi
call sub.msvcrt.dll_memset
mov edx, dword [rbx + 0x70]
lea rax, [rbp - 0x34]
mov r8d, dword [rbx + 0x6c]
add rdx, rbx
mov r9, rdi
mov qword [rsp + 0x20], rax
call fcn.18000dc14
test eax, eax
jne 0x18000e28c
mov eax, dword [rbp - 0x34]
mov r9, r15
mov qword [r12], rdi
xor r8d, r8d
xor edx, edx
mov dword [r13], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileTime]
xor eax, eax
mov r14d, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
jne 0x18000e2a2
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_free]
test r14d, r14d
je 0x18000e2b5
test rdi, rdi
je 0x18000e2b5
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov eax, r14d
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800782d0
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180010990
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x180010b54
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1800c5470]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, r8
mov edi, edx
mov rsi, rcx
test edx, edx
je 0x180010b31
and qword [rbp - 0x48], 0
mov dword [rsp + 0x20], 1
lea rdx, str.360scan
mov r9, rdx
xor r8d, r8d
lea rcx, [rbp - 0x40]
call fcn.180056700
nop
lea r8, [rbp - 0x48]
mov rdx, qword [rbp - 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x180010b13
cmp qword [rbp - 0x48], 0
je 0x180010b13
lea rcx, [rdi + 4]
lea rdx, [0x1800c8054]
call fcn.18006f9d0
mov rbx, rax
test rax, rax
je 0x180010b08
mov r9d, 0x64
mov dword [rbp - 0x50], r9d
movups xmm0, xmmword [str.softwareMicrosoftWindows]
movups xmmword [rbp - 0x30], xmm0
movsd xmm1, qword [0x18008b7c0]
movsd qword [rbp - 0x20], xmm1
movzx ecx, word [0x18008b7c8]
mov word [rbp - 0x18], cx
mov cl, byte [0x18008b7ca]
mov byte [rbp - 0x16], cl
xor r10d, r10d
test edi, edi
je 0x180010abe
mov r8, rax
sub r8, rsi
movsxd rcx, r10d
movabs rax, 0x97b425ed097b425f
mul rcx
shr rdx, 4
imul rax, rdx, 0x1b
sub rcx, rax
mov al, byte [rbp + rcx - 0x30]
xor al, byte [rsi]
mov byte [r8 + rsi + 4], al
movzx eax, byte [rsi]
add r9d, eax
inc r10d
inc rsi
cmp r10d, edi
jb 0x180010a83
mov dword [rbp - 0x50], r9d
xor r9d, r9d
mov rcx, rbx
lea r8, [rbp - 0x50]
sub r8, rbx
mov al, byte [r8 + rcx]
mov byte [rcx], al
inc r9d
inc rcx
cmp r9d, 4
jb 0x180010acb
lea eax, [rdi + 4]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180010b31
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800782d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret