joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000272c
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2070
call fcn.180069af0
sub rsp, rax
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x2060], rax
xor esi, esi
mov rbx, rdx
mov rdi, rcx
cmp rcx, rsi
je 0x1800028f9
cmp rdx, rsi
je 0x1800028f9
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
jne 0x180002784
mov esi, 1
jmp 0x1800028f9
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x28], esi
mov rdi, rax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rdi, rsi
je 0x1800028d1
cmp rdi, 0xffffffffffffffff
je 0x1800028d1
cmp rax, rsi
je 0x1800028d1
cmp rax, 0xffffffffffffffff
je 0x1800028e5
xor eax, eax
lea rdx, [rsp + 0x50]
mov rcx, rdi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x4c], eax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, esi
je 0x18000283c
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, esi
je 0x18000283c
mov rax, qword [rsp + 0x48]
cmp qword [rsp + 0x50], rax
je 0x18000284a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800028f0
mov dword [rsp + 0x40], esi
jmp 0x1800028a0
mov r8d, dword [rsp + 0x40]
cmp r8d, esi
je 0x1800028c7
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x1060]
mov rcx, rbx
mov dword [rsp + 0x44], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, esi
je 0x18000283c
mov eax, dword [rsp + 0x40]
cmp eax, dword [rsp + 0x44]
jne 0x18000283c
lea rdx, [rsp + 0x1060]
lea rcx, [rsp + 0x60]
mov r8, rax
call fcn.180055e40
cmp eax, esi
jne 0x18000283c
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov r8d, 0x1000
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, esi
jne 0x180002850
jmp 0x18000283c
mov esi, 1
jmp 0x18000283c
cmp rax, 0xffffffffffffffff
je 0x1800028e5
cmp rax, rsi
je 0x1800028e5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, 0xffffffffffffffff
je 0x1800028f9
cmp rdi, rsi
je 0x1800028f9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.180055580
lea r11, [rsp + 0x2070]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x180002920
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180002943
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18000295e
test al, 1
je 0x180002955
and eax, 0xfffffffe
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
add rsp, 0x20
pop rbx
ret
Function at 0x180002964
Capabilities:
Check if file exists
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rdi, rcx
cmp rcx, rbx
je 0x1800029c3
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
je 0x1800029c3
lea rax, [0x1800029e4]
lea r8, [0x1800029d0]
lea edx, [rbx + 1]
xor r9d, r9d
mov rcx, rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.180001904
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, ebx
sete bl
mov eax, ebx
jmp 0x1800029c5
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180002aec
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov ebp, r8d
mov r12, rdx
mov rdi, rcx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
test eax, eax
jne 0x180002b25
xor edx, edx
mov rcx, rdi
call fcn.180001de8
test eax, eax
je 0x180002bd1
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
test rax, rax
je 0x180002bb0
cmp rax, 0xffffffffffffffff
je 0x180002bb0
and dword [rsp + 0x78], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, ebp
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180002b93
cmp dword [rsp + 0x78], ebp
jne 0x180002b93
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x180002bd3
test esi, esi
jne 0x180002bbd
mov rcx, rbx
or rbx, 0xffffffffffffffff
cmp rcx, rbx
je 0x180002bb4
test rcx, rcx
je 0x180002bb4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180002bb4
test esi, esi
jne 0x180002bbd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp rbx, 0xffffffffffffffff
je 0x180002bd1
test rbx, rbx
je 0x180002bd1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret

Function at 0x180002be8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor r9d, r9d
movsxd r10, edx
cmp r10, r9
jle 0x180002c1b
movzx edx, byte [r9 + rcx]
movzx eax, r8b
lea r11, [0x18009c900]
xor rdx, rax
mov eax, r8d
inc r9
mov r8d, dword [r11 + rdx*4]
shr eax, 8
xor r8d, eax
cmp r9, r10
jl 0x180002bf3
not r8d
mov eax, r8d
ret
Function at 0x1800030b8
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xb0
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movsx r8d, cl
lea rdx, str.__c:
lea rcx, [rsp + 0x48]
call fcn.1800052f0
cmp qword [rax + 0x20], 0x10
jb 0x1800030f9
mov rcx, qword [rax + 8]
jmp 0x1800030fd
lea rcx, [rax + 8]
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov r8d, 3
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp qword [rsp + 0x68], 0x10
mov rbx, rax
jb 0x180003136
mov rcx, qword [rsp + 0x50]
call fcn.180054958
and qword [rsp + 0x60], 0
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x68], sendto
mov byte [rsp + 0x50], 0
test rbx, rbx
je 0x1800031da
cmp rbx, rdi
je 0x1800031ed
lea r8d, [rdi + 0x25]
lea rcx, [rsp + 0x84]
xor edx, edx
mov dword [rsp + 0x80], 0x28
call fcn.180055bd0
and dword [rsp + 0x70], 0
and dword [rsp + 0x74], 0
xor eax, eax
lea r9d, [rdi + 0xd]
and qword [rsp + 0x38], rax
and dword [rsp + 0x40], eax
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov edx, 0x2d1400
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov rcx, rbx
mov dword [rsp + 0x28], 0x28
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1800031e4
mov edi, dword [rsp + 0x9c]
jmp 0x1800031e4
cmp rbx, rdi
je 0x1800031ed
test rbx, rbx
je 0x1800031ed
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.180055580
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rdi
ret

Function at 0x180003210
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor r12d, r12d
mov rsi, rdx
mov rdi, rcx
cmp rdx, r12
je 0x1800032f2
lea rdx, str.deviceMup_
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp rax, rdi
jne 0x18000327b
lea r8, [0x18007c26c]
lea rdx, str.deviceMup_
mov r9, rsi
mov rcx, rdi
call fcn.180005000
mov eax, 1
jmp 0x1800032f4
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, r12d
mov ebp, eax
bt ebp, ebx
jae 0x1800032eb
lea ecx, [rbx + 0x61]
mov eax, 0x3a
xor edx, edx
mov word [rsp + 0x20], cx
mov word [rsp + 0x22], ax
xor eax, eax
lea rcx, [rsp + 0x32]
mov r8d, 0x206
mov word [rsp + 0x30], r12w
mov dword [rsp + 0x24], eax
call fcn.180055bd0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
cmp eax, r12d
jbe 0x1800032eb
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov rcx, rdi
call fcn.18000512c
cmp eax, r12d
jne 0x18000331c
inc ebx
cmp ebx, 0x1a
jl 0x180003286
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180055580
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
jmp 0x180003269
Function at 0x18000350c
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov ebx, ecx
mov rdi, rdx
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x434
call fcn.180055bd0
mov edx, ebx
mov ecx, 8
mov dword [rsp + 0x20], 0x438
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
test rax, rax
je 0x180003595
cmp rax, 0xffffffffffffffff
je 0x1800035a9
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Module32FirstW
jmp 0x180003591
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.180004200
test eax, eax
je 0x180003595
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x180003573
cmp rbx, 0xffffffffffffffff
je 0x1800035a9
test rbx, rbx
je 0x1800035a9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.180055580
mov rbx, qword [rsp + 0x490]
add rsp, 0x470
pop rdi
ret

Function at 0x1800035cc
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rdx
mov rdi, rcx
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x180003667
cmp rax, 0xffffffffffffffff
je 0x180003667
mov dword [rsp + 0x30], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x34]
call fcn.180055bd0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x180003667
mov rdx, rsi
lea rcx, [rsp + 0x30]
call rdi
test eax, eax
je 0x180003667
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x180003648
cmp rbx, 0xffffffffffffffff
je 0x18000367b
test rbx, rbx
je 0x18000367b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180055580
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1800036a0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0xe0
xor r12d, r12d
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
cmp rcx, r12
jne 0x1800036d4
xor eax, eax
jmp 0x180003792
xor edx, edx
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x70], 0x68
lea r8d, [rdx + 0x60]
call fcn.180055bd0
cmp esi, r12d
jne 0x180003705
mov dword [rsp + 0xac], 1
mov word [rsp + 0xb0], r12w
xor eax, eax
mov rcx, rbp
mov rdi, r12
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], r12
call fcn.1800018b8
lea rcx, [rsp + 0x50]
neg esi
mov qword [rsp + 0x48], rcx
mov rbp, rax
sbb eax, eax
lea rcx, [rsp + 0x70]
not eax
xor r9d, r9d
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], r12
and eax, 0x8000000
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, r12d
je 0x180003787
mov rcx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbx, r12
je 0x180003787
mov ecx, dword [rsp + 0x60]
mov dword [rbx], ecx
mov rcx, rbp
call fcn.180056028
mov rax, rdi
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x180003c28
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x110
xor edi, edi
mov ebp, edx
mov rsi, rcx
cmp rcx, rdi
je 0x180003dfa
call fcn.180003af4
lea rcx, [0x180003e18]
mov dword [rsp + 0x6c], edi
mov dword [rsp + 0x70], edi
mov dword [rsp + 0x68], eax
cmp rcx, rdi
je 0x180003dfa
lea rdx, [rsp + 0x68]
call fcn.1800035cc
cmp dword [rsp + 0x70], edi
je 0x180003dfa
mov r8d, dword [rsp + 0x6c]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
cmp rax, rdi
je 0x180003de6
cmp rax, 0xffffffffffffffff
je 0x180003dfa
lea r8, [rsp + 0x60]
mov edx, 0xf01ff
mov rcx, rax
mov qword [rsp + 0x60], rdi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, edi
je 0x180003dd8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x78], rdi
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
cmp eax, edi
je 0x180003dcd
mov rcx, rsi
call fcn.1800018b8
lea r8d, [rdi + 0x60]
lea rcx, [rsp + 0xa8]
xor edx, edx
mov dword [rsp + 0xa0], 0x68
mov rsi, rax
call fcn.180055bd0
mov dword [rsp + 0xdc], 1
cmp ebp, edi
je 0x180003d31
lea eax, [rdi + 5]
mov word [rsp + 0xe0], ax
jmp 0x180003d39
mov word [rsp + 0xe0], di
mov rcx, qword [rsp + 0x60]
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xa0]
mov r8, rsi
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x420
xor edx, edx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp eax, edi
je 0x180003dba
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.180056028
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
jmp 0x180003dfc
cmp rax, 0xffffffffffffffff
je 0x180003dfa
cmp rax, rdi
je 0x180003dfa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180004080
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, rdx
mov r8d, ecx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edi, edi
mov rbx, rax
cmp rax, rdi
je 0x180004114
cmp rax, 0xffffffffffffffff
je 0x180004128
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.180055bd0
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rbx
call sub.PSAPI.DLL_GetProcessImageFileNameW
cmp eax, edi
jbe 0x180004107
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.180003210
mov edi, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x18000412a
cmp rax, 0xffffffffffffffff
je 0x180004128
cmp rax, rdi
je 0x180004128
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180055580
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x18000437c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rsi, rdx
cmp rcx, rbx
je 0x1800043e1
mov eax, 0x5a4d
cmp ax, word [rcx]
jne 0x1800043e1
cmp dword [rcx + 0x3c], 0x400
jge 0x1800043e1
movsxd rdi, dword [rcx + 0x3c]
lea edx, [rbx + 8]
add rdi, rcx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, ebx
jne 0x1800043e1
cmp dword [rdi], 0x4550
jne 0x1800043e1
cmp rsi, rbx
je 0x1800043da
mov eax, 0xf0
cmp word [rdi + 0x14], ax
sete bl
mov dword [rsi], ebx
mov eax, 1
jmp 0x1800043e3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800043f4
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
and qword [rsp + 0x30], 0
mov rax, rdx
xor r9d, r9d
mov rbx, rcx
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x1800044a6
lea rdx, [rbx + 0x18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800044a6
cmp qword [rbx + 0x18], 0
je 0x1800044a6
mov eax, 0x400000
cmp qword [rbx + 0x18], rax
jg 0x18000445e
mov eax, dword [rbx + 0x18]
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov dword [rbx + 0x20], eax
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbx + 8], rax
test rax, rax
je 0x1800044a6
mov ecx, dword [rbx + 0x20]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rcx
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x10], rax
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1800044f0
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x50
or qword [rax - 0x38], 0xffffffffffffffff
and qword [rax - 0x30], 0
and qword [rax - 0x28], 0
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180004528
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.1800043f4
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180004559
cmp qword [rsp + 0x38], 0x138
jbe 0x18000454c
mov rdx, rdi
call fcn.18000437c
mov rcx, qword [rsp + 0x30]
jmp 0x18000454e
xor eax, eax
test eax, eax
je 0x180004559
mov ebx, 1
jmp 0x18000455b
xor ebx, ebx
test rcx, rcx
je 0x180004566
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x180004576
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x20]
cmp rcx, 0xffffffffffffffff
je 0x180004587
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180005398
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov dword [r11 + 0x20], r9d
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
cmp dword [rsp + 0x70], ebx
je 0x180005401
lea rax, [r11 - 0x14]
lea r9, [r11 + 0x28]
mov dword [rsp + 0x30], ebx
mov qword [r11 - 0x20], rax
lea rax, [r11 - 0x18]
mov dword [rsp + 0x70], ebx
mov qword [r11 - 0x28], rax
mov dword [rsp + 0x34], 4
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [rsp + 0x70], 4
jne 0x180005401
mov eax, dword [rsp + 0x68]
cmp dword [rsp + 0x30], eax
jne 0x180005401
lea eax, [rbx + 1]
jmp 0x18000542f
lea rax, [rsp + 0x68]
mov r9d, 4
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp eax, ebx
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180005444
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x40
lea rax, [r11 - 0x18]
mov ebx, r9d
lea r9, [r11 - 0x14]
mov qword [r11 - 0x20], rax
lea rax, [r11 - 0x10]
mov dword [rsp + 0x30], 4
mov qword [r11 - 0x28], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x180005480
cmp dword [rsp + 0x34], 4
jne 0x180005480
mov ebx, dword [rsp + 0x38]
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x180005488
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov eax, 0x5050
call fcn.180069af0
sub rsp, rax
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x5040], rax
xor ebx, ebx
mov rdi, r9
mov r12, r8
mov rbp, rdx
mov rsi, rcx
cmp dword [rsp + 0x50a0], ebx
je 0x18000552e
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x4ffe
mov word [rsp + 0x40], bx
call fcn.180055bd0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, r12
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], 0x5000
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [rsp + 0x30], 1
jne 0x18000552e
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, ebx
jne 0x18000552e
lea eax, [rbx + 1]
jmp 0x18000556b
cmp rdi, rbx
je 0x18000553e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x180005540
mov eax, ebx
lea r9d, [rax + rax + 2]
mov r8, r12
mov rdx, rbp
mov dword [rsp + 0x28], r9d
mov r9d, 1
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp eax, ebx
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x5040]
xor rcx, rsp
call fcn.180055580
add rsp, 0x5050
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000558c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x868
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov r12, r9
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rcx + 0x20], 7
mov qword [rcx + 0x18], r13
mov word [rcx + 8], r13w
mov dword [rsp + 0x38], 1
mov rsi, r13
cmp r8, r13
je 0x1800056fc
mov word [rsp + 0x50], r13w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0x52]
call fcn.180055bd0
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x34], r13d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x34]
mov r8, r12
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [rsp + 0x34], 1
je 0x18000564c
cmp dword [rsp + 0x34], 2
jne 0x1800056fc
mov eax, dword [rsp + 0x30]
cmp eax, r13d
je 0x1800056fc
cmp eax, 0x800
jbe 0x1800056a2
lea rcx, [rax + 2]
call fcn.180055f70
mov rsi, rax
mov r8d, dword [rsp + 0x30]
add r8, 2
xor edx, edx
mov rcx, rax
call fcn.180055bd0
lea r11, [rsp + 0x30]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, r12
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
jmp 0x1800056c8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, r12
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea rdx, [rsp + 0x50]
cmp rsi, r13
cmovne rdx, rsi
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.180007250
cmp rsi, r13
je 0x1800056fc
mov rcx, rsi
call fcn.180056028
mov rax, rbx
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.180055580
add rsp, 0x868
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret