joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180015050
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x870
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800a7b78]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov rsi, rcx
mov byte [rcx + 0x1c], 1
mov dword [rcx + 8], 1
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 9
xor r8d, r8d
lea rdx, str.SoftwareDownloadManagerDwnlSelPanel
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180015246
mov dword [rsp + 0x78], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.PanelMode
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180015101
mov eax, dword [rsp + 0x74]
mov dword [rsi + 8], eax
cmp dword [rsi + 8], 3
jne 0x18001523a
xor ebx, ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x18001523a
movsxd rax, dword [rsp + 0x70]
test eax, eax
je 0x18001523a
mov dword [rsi + 0x18], eax
mov rcx, rax
mov eax, 8
mul rcx
mov r13, 0xffffffffffffffff
cmovo rax, r13
mov rcx, rax
call fcn.180058e74
mov qword [rsi + 0x10], rax
test rax, rax
je 0x18001523a
mov edx, ebx
mov dword [rsp + 0x60], ebx
cmp edx, dword [rsi + 0x18]
jge 0x1800151ae
movsxd rcx, edx
mov rax, qword [rsi + 0x10]
mov qword [rax + rcx*8], rbx
inc edx
mov dword [rsp + 0x60], edx
jmp 0x180015196
mov dword [rsp + 0x60], ebx
mov r12d, ebx
test r12d, r12d
jne 0x18001523a
cmp ebx, dword [rsi + 0x18]
je 0x18001523a
mov r9d, 0x7d0
lea r8, [rsp + 0x90]
mov edx, ebx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov r12d, eax
test eax, eax
jne 0x18001522f
xor eax, eax
mov rcx, r13
lea rdi, [rsp + 0x90]
repne scasb al, byte [rdi]
not rcx
call fcn.180058e74
movsxd rdx, ebx
mov rcx, qword [rsi + 0x10]
mov qword [rcx + rdx*8], rax
mov rax, qword [rsi + 0x10]
cmp qword [rax + rdx*8], 0
je 0x18001522f
lea rcx, [rsp + 0x90]
mov rdx, qword [rax + rdx*8]
nop
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180015220
inc ebx
mov dword [rsp + 0x60], ebx
jmp 0x1800151b5
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.1800590c0
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x180015390
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rdi, rdx
mov rbx, rcx
lea rax, vtable.CExceptionServersList.0
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov rcx, qword [0x1800a9550]
test rcx, rcx
je 0x18001543d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18001543d
mov ecx, dword [rsp + 0x60]
inc ecx
call fcn.180058e74
mov qword [rbx + 8], rax
test rax, rax
je 0x18001543d
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [0x1800a9550]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x18001543d
mov rcx, qword [rbx + 8]
call fcn.180058dfc
mov qword [rbx + 8], 0
mov rax, rbx
jmp 0x180015447
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x18001c060
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1800a7b78]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x18001c107
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x158], rdi
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
cmp byte [rsp + rcx + 0x1e], 0x5c
je 0x18001c0c7
lea rdi, [rsp + 0x20]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x18008736c]
mov word [rdi - 1], ax
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x18001c0e0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, qword [rsp + 0x158]
test rax, rax
jne 0x18001c110
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1800590c0
add rsp, 0x140
pop rbx
ret
Function at 0x18001c130
Capabilities:
Get file version info

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x130
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x170], rbx
mov rax, qword [0x1800a7b78]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rsi, rdx
mov r13, rcx
xor ebx, ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x34], ebx
lea rdx, [rsp + 0x34]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov r12d, eax
test eax, eax
je 0x18001c297
mov rdx, r12
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r14, rax
mov r9, rax
mov r8d, r12d
mov edx, dword [rsp + 0x34]
mov rcx, r13
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x18001c284
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, str.VarFileInfoTranslation
mov rcx, r14
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x18001c284
mov dword [rsp + 0x30], ebx
mov rax, qword [rsp + 0x40]
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov dword [rsp + 0x20], ecx
lea r8, str.StringFileInfo_04x_04xFileVersion
lea edx, [rbx + 0x40]
lea rcx, [rsp + 0xe0]
call fcn.18005ac08
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0xe0]
mov rcx, r14
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x18001c284
mov dword [rsi], ebx
lea r8d, [rbx + 0x7f]
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.18005b440
mov byte [rsp + 0xdf], bl
lea edx, [rbx + 0x2c]
lea rcx, [rsp + 0x60]
call fcn.180058724
test rax, rax
jne 0x18001c26c
lea edx, [rbx + 0x2e]
lea rcx, [rsp + 0x60]
call fcn.180058724
test rax, rax
je 0x18001c26f
mov byte [rax], 0
lea rcx, [rsp + 0x60]
call fcn.18005b9e8
mov dword [rsi], eax
mov ebx, 1
mov dword [rsp + 0x38], ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop
mov eax, ebx
jmp 0x18001c29f
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1800590c0
mov rbx, qword [rsp + 0x170]
add rsp, 0x130
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x18001c870
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rcx, qword [0x1800a9560]
test rcx, rcx
jne 0x18001c8d4
lea rax, [0x1800a9560]
lea r9d, [rcx + 1]
lea rdx, str.SoftwareDownloadManagerIDMBIFirefoxDwnlPanel
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x18001c8be
xor eax, eax
mov qword [0x1800a9560], rax
mov eax, 1
add rsp, 0x38
ret
mov rcx, qword [0x1800a9560]
test rcx, rcx
jne 0x18001c8d4
mov eax, 1
add rsp, 0x38
ret
lea rax, [rsp + 0x40]
lea rdx, str.PanelView
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18001c8ca
xor eax, eax
cmp dword [rsp + 0x48], 2
setne al
add rsp, 0x38
ret
Function at 0x18001cde0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rcx, qword [0x1800a9578]
test rcx, rcx
je 0x18001ce2e
lea rax, [rsp + 0x40]
lea rdx, [0x180089494]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18001ce2e
cmp dword [rsp + 0x48], eax
jne 0x18001ce2e
add rsp, 0x38
ret
mov al, 1
add rsp, 0x38
ret
Function at 0x18001e1f0
Capabilities:
Get file size

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x280
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800a7b78]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rdx
test rdx, rdx
jne 0x18001e232
xor eax, eax
jmp 0x18001e332
xor edi, edi
mov qword [rsp + 0x48], rdi
mov r8d, 0x208
lea rdx, [rsp + 0x60]
call fcn.180007720
test eax, eax
je 0x18001e32b
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rdi + 1]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x18001e32b
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov eax, 0xffffffff
cmp rbx, rax
jne 0x18001e2ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x18001e2ae
xor ebx, ebx
jmp 0x18001e2b9
mov eax, dword [rsp + 0x40]
shl rax, 0x20
add rbx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x18001e32b
cmp rbx, rsi
jne 0x18001e32b
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x60]
repne scasb al, byte [rdi]
not rcx
lea rbx, [rcx - 1]
lea edx, [rcx + 1]
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x18001e32b
lea ecx, [rbx + 1]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
lea r8, [rsp + 0x60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x18001e32b
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor edi, edi
mov qword [rsp + 0x48], rdi
mov rax, rdi
jmp 0x18001e332
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1800590c0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x18001ebb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x830
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800a7b78]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov r12, rcx
mov rcx, qword [0x1800a9550]
test rcx, rcx
jne 0x18001ebf9
xor eax, eax
jmp 0x18001ecdc
mov dword [rsp + 0x30], 0x7d0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Extensions
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x18001ec33
xor eax, eax
jmp 0x18001ecdc
lea rsi, [rsp + 0x50]
nop dword [rax + rax]
mov edx, 0x20
mov rcx, rsi
call fcn.180058724
mov rbx, rax
test rax, rax
je 0x18001ec58
mov byte [rax], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 7
jae 0x18001eccc
mov r9, rsi
lea r8, [0x180089f08]
lea edx, [rax + 8]
lea rcx, [rsp + 0x40]
call fcn.18005ac08
lea rcx, [rsp + 0x40]
call fcn.18005af10
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.180059e18
test rax, rax
je 0x18001eca9
mov eax, 1
jmp 0x18001ecdc
lea rcx, [rsp + 0x40]
call fcn.18005be04
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.180059e18
test rax, rax
je 0x18001eccc
mov eax, 1
jmp 0x18001ecdc
test rbx, rbx
je 0x18001ecda
lea rsi, [rbx + 1]
jmp 0x18001ec40
xor eax, eax
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.1800590c0
lea r11, [rsp + 0x830]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret

Function at 0x18001ed10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov rdx, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
movsxd rcx, ecx
test rcx, rcx
jle 0x18001ed3d
xor byte [rax + rdx], 0xf
inc rax
cmp rax, rcx
jl 0x18001ed31
mov rdi, qword [rsp + 8]
ret

Function at 0x18001f790
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x478
mov rax, qword [0x1800a7b78]
xor rax, rsp
mov qword [rsp + 0x460], rax
cmp qword [0x1800a95e0], 0
jne 0x18001f870
mov rax, qword [0x1800a95d8]
test rax, rax
jne 0x18001f859
mov rcx, qword [0x1800a9550]
lea rax, [rsp + 0x30]
lea rdx, str.ExePath
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18001f84d
lea edx, [rax + 0x5c]
lea rcx, [rsp + 0x40]
call fcn.180058f10
test rax, rax
je 0x18001f84d
xor ecx, ecx
lea r9, [rsp + 0x40]
lea r8, str._sidmftype64.dll
mov word [rax], cx
lea rcx, [rsp + 0x250]
mov edx, 0x104
call fcn.180058fc0
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1800a95d8], rax
jmp 0x18001f854
mov rax, qword [0x1800a95d8]
test rax, rax
je 0x18001f870
lea rdx, str.IDMFileType
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800a95e0], rax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1800590c0
add rsp, 0x478
ret
Function at 0x18001fec0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xb0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1800a7b78]
xor rax, rsp
mov qword [rsp + 0xa0], rax
cmp qword [0x1800a9550], 0
je 0x18001fef5
mov al, 1
jmp 0x18001ffb6
lea rbx, [0x1800a9550]
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.SoftwareDownloadManager_
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x54], eax
test eax, eax
je 0x18001ff70
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareDownloadManager_
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [rsp + 0x54], eax
test eax, eax
jne 0x18001ff6c
call fcn.18001d190
jmp 0x18001ffb0
xor al, al
jmp 0x18001ffb6
mov dword [rsp + 0x50], 0x40
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.idmvers
mov rcx, qword [0x1800a9550]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
jne 0x18001ffb0
call fcn.18001d190
mov al, 1
jmp 0x18001ffb6
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1800590c0
add rsp, 0xb0
pop rbx
ret
Function at 0x180025d10
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
lea rcx, [rsp + 0x28]
call qword [0x1800a9420]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call qword [0x1800a9460]
nop
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call qword [0x1800a9438]
mov rcx, qword [rsp + 0x68]
call fcn.18005bfe8
mov rbx, rax
test rax, rax
je 0x180025d9b
lea rcx, str.OnGetSelectedTabID_docID
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call qword [0x1800a9438]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x180089e94]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x180025da8
lea rcx, str.OnGetSelectedTabID_docID0_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov qword [0x1800a9598], rbx
call fcn.180025c90
nop
lea rcx, [rsp + 0x28]
call qword [0x1800a9430]
xor eax, eax
add rsp, 0x50
pop rbx
ret

Function at 0x180025fa0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
lea rcx, [rsp + 0x28]
call qword [0x1800a9420]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call qword [0x1800a9460]
nop
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call qword [0x1800a9438]
mov rcx, qword [rsp + 0x68]
call fcn.18005bfe8
mov rbx, rax
test rax, rax
je 0x18002602b
lea rcx, str.Tabselect2_docID
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call qword [0x1800a9438]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x180089e94]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x180026038
lea rcx, str.Tabselect2_docID0_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [0x1800a95a0]
test rcx, rcx
je 0x180026083
cmp qword [rcx + 0x10], 0
je 0x180026083
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x180026083
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, qword [0x1800a95a0]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_SendMessageA]
mov r11, qword [0x1800a95a0]
mov qword [r11 + 0x10], 0
mov qword [0x1800a9598], rbx
call fcn.180025c90
nop
lea rcx, [rsp + 0x28]
call qword [0x1800a9430]
xor eax, eax
add rsp, 0x50
pop rbx
ret
Function at 0x1800328a0
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x830
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800a7b78]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov rsi, rcx
cmp qword [0x1800a9550], 0
jne 0x1800328e8
call fcn.18001fec0
test al, al
je 0x180032a23
lea rdx, [0x18008b9bc]
mov rcx, rsi
call fcn.18005b390
test rax, rax
je 0x180032903
xor al, al
jmp 0x180032a23
mov dword [rsp + 0x30], 0x7d0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Extensions
mov rcx, qword [0x1800a9550]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x18003297d
cmp dword [0x1800a9580], 0
jne 0x180032976
mov dword [0x1800a9580], 1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x180030760]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor al, al
jmp 0x180032a23
lea rbx, [rsp + 0x50]
mov qword [rsp + 0x38], rbx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
je 0x180032a23
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.18005b98c
test eax, eax
jne 0x1800329c4
movzx eax, byte [rdi + rbx]
cmp al, 0x20
je 0x1800329c0
test al, al
jne 0x1800329c4
mov al, 1
jmp 0x180032a23
lea rdx, [0x18008b9b8]
mov rcx, rbx
call fcn.180059e18
test rax, rax
je 0x1800329fa
lea rcx, [rdi + rbx]
cmp rcx, rax
jbe 0x1800329fa
sub rax, rbx
mov r8, rax
mov rdx, rsi
mov rcx, rbx
call fcn.18005b98c
test eax, eax
jne 0x1800329fa
mov al, 1
jmp 0x180032a23
lea rdx, [0x180087720]
mov rcx, rbx
call fcn.180059e18
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x180032a21
add rbx, 1
mov qword [rsp + 0x38], rbx
jne 0x1800329a2
xor al, al
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.1800590c0
lea r11, [rsp + 0x830]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18005cc5c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x18005cad0

Function at 0x18005f22f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1800a7b78]
jne 0x1800590da
rol rcx, 0x10
test cx, 0xffff
jne 0x1800590d6
repz ret
ror rcx, 0x10
jmp 0x18005f188
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1800ab560]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1800ab658]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18005f20d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1800ab560]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18005f22f
mov rax, qword [rsp + 0x88]
mov qword [0x1800ab658], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1800ab5f8], rax
mov rax, qword [0x1800ab658]
mov qword [0x1800ab4d0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1800ab5e0], rax
mov dword [0x1800ab4c0], 0xc0000409
mov dword [0x1800ab4c4], 1
mov rax, qword [0x1800a7b78]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1800a7b80]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1800ab558], eax
mov ecx, 1
call fcn.180068b08
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18008dec0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1800ab558], 0
jne 0x18005f2b6
mov ecx, 1
call fcn.180068b08
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x18006819c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.18005db78
xor ebx, ebx
mov rdi, rax
cmp qword [0x1800abde8], rbx
jne 0x1800682a2
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x180068377
lea rdx, [0x18008e0d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180068377
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1800abde8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1800abdf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x1800abdf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1800abe08], rax
test rax, rax
je 0x180068299
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1800abe00], rax
jmp 0x1800682a9
mov rax, qword [0x1800abe00]
jmp 0x1800682b0
mov rax, qword [0x1800abe00]
mov r11, qword [0x1800abe08]
cmp rax, rdi
je 0x180068318
cmp r11, rdi
je 0x180068318
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1800abe08]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x180068318
test rax, rax
je 0x180068318
call rsi
test rax, rax
je 0x180068312
lea rcx, [rsp + 0x88]
mov r9d, SafeArrayDestroy
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180068312
test byte [rsp + 0x38], 1
jne 0x180068318
bts ebp, 0x15
jmp 0x180068356
mov rcx, qword [0x1800abdf0]
cmp rcx, rdi
je 0x180068356
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180068356
call rax
mov rbx, rax
test rax, rax
je 0x180068356
mov rcx, qword [0x1800abdf8]
cmp rcx, rdi
je 0x180068356
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180068356
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1800abde8]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180068377
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x180068379
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret