joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004c450
Capabilities:
Check os version

Disassembly:
push rdi
sub rsp, 0x150
mov rax, qword [0x1801485f0]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea r8, [0x180100868]
lea rcx, [0x18014dae0]
mov edx, 0x400
xor edi, edi
call fcn.1800b9838
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, VarUI4FromDisp
call fcn.1800b6c70
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], VarUI4FromDisp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x30], 2
jne 0x18004c4d3
call fcn.18004b7d0
test eax, eax
jne 0x18004c503
call fcn.18004c260
test eax, eax
jne 0x18004c503
call fcn.18004bd90
test eax, eax
jne 0x18004c503
call fcn.18004ba10
jmp 0x18004c503
mov qword [rsp + 0x160], rbx
mov ebx, edi
nop dword [rax]
test edi, edi
jne 0x18004c4fb
cmp byte [0x18014dae0], dil
jne 0x18004c4fb
call fcn.18004c080
inc ebx
mov edi, eax
cmp ebx, 0xa
jl 0x18004c4e0
mov rbx, qword [rsp + 0x160]
lea rax, [0x18014dae0]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800b6c40
add rsp, 0x150
pop rdi
ret
Function at 0x18004d440
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1801485f0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rsi, rcx
mov qword [rsp + 0x30], rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], r12
mov word [rcx], r12w
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
lea rcx, [rbp - 0x31]
call fcn.18001cce0
mov r14, rax
call fcn.1800285c0
mov edx, eax
lea rcx, [rbp - 0x11]
call fcn.18001cce0
mov r15, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ecx, 6
movzx eax, word [rsp + 0x38]
cmp cx, ax
je 0x18004d4ec
mov ecx, 9
cmp cx, ax
je 0x18004d4ec
xor al, al
jmp 0x18004d4ee
mov al, 1
movzx edx, al
lea rcx, [rbp + 0xf]
call fcn.18001cce0
mov rdi, rax
call fcn.180028770
mov edx, eax
lea rcx, [rbp - 0x51]
call fcn.18001cce0
mov rbx, rax
mov r8d, 4
lea rdx, str.il
mov rcx, rsi
call fcn.180016430
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.1800162f0
mov r8d, 4
lea rdx, str.ob
mov rcx, rax
call fcn.180016430
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.1800162f0
mov r8d, 4
lea rdx, str.ov
mov rcx, rax
call fcn.180016430
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r15
mov rcx, rax
call fcn.1800162f0
mov r8d, 4
lea rdx, str.ts
mov rcx, rax
call fcn.180016430
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r14
mov rcx, rax
call fcn.1800162f0
mov r8d, 5
lea rdx, str.tp6
mov rcx, rax
call fcn.180016430
nop
cmp qword [rbp - 0x39], 8
jb 0x18004d5d2
mov rcx, qword [rbp - 0x51]
call fcn.1800b5700
mov qword [rbp - 0x39], 7
mov qword [rbp - 0x41], r12
mov word [rbp - 0x51], r12w
cmp qword [rbp + 0x27], 8
jb 0x18004d5f3
mov rcx, qword [rbp + 0xf]
call fcn.1800b5700
mov qword [rbp + 0x27], 7
mov qword [rbp + 0x1f], r12
mov word [rbp + 0xf], r12w
cmp qword [rbp + 7], 8
jb 0x18004d614
mov rcx, qword [rbp - 0x11]
call fcn.1800b5700
mov qword [rbp + 7], 7
mov qword [rbp - 1], r12
mov word [rbp - 0x11], r12w
cmp qword [rbp - 0x19], 8
jb 0x18004d635
mov rcx, qword [rbp - 0x31]
call fcn.1800b5700
mov qword [rbp - 0x19], 7
mov qword [rbp - 0x21], r12
mov word [rbp - 0x31], r12w
mov rax, rsi
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1800b6c40
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x18004da10
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov dword [rcx + 8], edx
add rcx, 0x10
mov edi, r9d
mov rax, r8
cmp rcx, r8
je 0x18004da3e
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
call fcn.1800165a0
mov rdx, qword [rsp + 0x60]
lea rcx, [rbx + 0x38]
mov dword [rbx + 0x30], edi
cmp rcx, rdx
je 0x18004da5b
or r9, 0xffffffffffffffff
xor r8d, r8d
call fcn.1800165a0
xor eax, eax
lea r8, [0x18004ddc0]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x180064030
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x180064088
cmp byte [rcx + 0x50], dl
jne 0x18006407b
mov byte [rcx + 0x50], 1
mov dword [rcx + 0x54], 2
mov rdx, qword [str.Failed_to_open_file]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x180064060
add rcx, 0x58
call fcn.180062ba0
mov qword [rbx + 0x64], 0xffffffffffffffff
xor al, al
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbp
call fcn.180063650
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rsi
mov qword [rbx + 8], 0xffffffffffffffff
call fcn.1800bbb54
mov rcx, rsi
call fcn.1800bbebc
xor r8d, r8d
xor edx, edx
mov rcx, rsi
movsxd rbp, eax
call fcn.1800bbb54
test ebp, ebp
jg 0x18006410d
cmp byte [rbx + 0x50], 0
jne 0x1800640fb
mov byte [rbx + 0x50], 1
mov dword [rbx + 0x54], 0xc
mov rdx, qword [str.Error_document_empty.]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1800640e0
lea rcx, [rbx + 0x58]
call fcn.180062ba0
mov qword [rbx + 0x64], 0xffffffffffffffff
xor al, al
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
lea eax, [rbp + 1]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r14
movsxd rcx, eax
call fcn.1800b57e8
mov r9, rsi
mov r8d, 1
mov rcx, rax
mov rdx, rbp
mov rdi, rax
mov byte [rax], 0
call fcn.1800ba1c8
mov rcx, rdi
cmp rax, 1
je 0x180064185
call fcn.1800b5700
cmp byte [rbx + 0x50], 0
jne 0x180064181
mov byte [rbx + 0x50], 1
mov dword [rbx + 0x54], 2
mov rdx, qword [str.Failed_to_open_file]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x180064166
lea rcx, [rbx + 0x58]
call fcn.180062ba0
mov qword [rbx + 0x64], 0xffffffffffffffff
xor al, al
jmp 0x1800641dc
mov byte [rbp + rdi], 0
cmp byte [rdi], 0
mov rax, rdi
je 0x1800641b7
movzx edx, byte [rax]
cmp dl, 0xd
jne 0x1800641aa
mov byte [rcx], 0xa
inc rax
inc rcx
cmp byte [rax], 0xa
jne 0x1800641b2
jmp 0x1800641af
mov byte [rcx], dl
inc rcx
inc rax
cmp byte [rax], 0
jne 0x180064192
mov byte [rcx], 0
mov rax, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, rdi
call fcn.1800b5700
xor eax, eax
cmp byte [rbx + 0x50], al
sete al
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x18006a590
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1801485f0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
xor esi, esi
mov qword [rbp - 0x19], rsi
mov dword [rbp - 0x11], esi
mov qword [rbp - 9], rsi
lea rcx, [rbp + 7]
call fcn.180008be0
nop
cmp word [rbx], si
jne 0x18006a5e5
mov r8d, esi
jmp 0x18006a5fb
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x18006a5f0
mov rdx, rbx
lea rcx, [rbp + 7]
call fcn.180016430
lea r8, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae r8, qword [rbp + 7]
mov rdx, 0xffffffff80000001
mov r9d, 0x20019
lea rcx, [rbp - 0x19]
call fcn.180030a40
test eax, eax
jne 0x18006a6d6
mov dword [rbp - 0x29], esi
lea rcx, [rbp + 0x27]
call fcn.180009150
nop
cmp qword [rax + 0x18], 8
jb 0x18006a64a
mov rax, qword [rax]
mov dword [rbp - 0x25], 4
lea rcx, [rbp - 0x25]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x29]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x21]
xor r8d, r8d
mov rdx, rax
mov rbx, qword [rbp - 0x19]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x18006a68e
mov edi, esi
mov eax, 0xd
cmp dword [rbp - 0x21], 4
cmovne edi, eax
cmp qword [rbp + 0x3f], 8
jb 0x18006a69e
mov rcx, qword [rbp + 0x27]
call fcn.1800b5700
mov qword [rbp + 0x3f], 7
mov qword [rbp + 0x37], rsi
mov word [rbp + 0x27], si
test rbx, rbx
je 0x18006a6c3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
mov qword [rbp - 0x19], rbx
mov dword [rbp - 0x11], esi
test edi, edi
jne 0x18006a6da
mov eax, dword [rbp - 0x29]
and eax, 1
test al, al
je 0x18006a6da
jmp 0x18006a6dd
mov rbx, qword [rbp - 0x19]
mov dil, 1
cmp qword [rbp + 0x1f], 8
jb 0x18006a6ed
mov rcx, qword [rbp + 7]
call fcn.1800b5700
mov qword [rbp + 0x1f], 7
mov qword [rbp + 0x17], rsi
mov word [rbp + 7], si
test rbx, rbx
je 0x18006a70f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x19], rsi
movzx eax, dil
mov dword [rbp - 0x11], esi
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1800b6c40
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x18006a8b0
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2b0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1801485f0]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov r12, qword [rbp + 0x200]
mov rsi, qword [rbp + 0x208]
xor r13d, r13d
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x58], r13
cmp qword [rdx + 0x18], 8
jb 0x18006a91a
mov rdx, qword [rdx]
mov r9d, 0x20019
mov r8, rdx
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.180030a40
mov r14, qword [rsp + 0x48]
test eax, eax
jne 0x18006aa85
mov r15d, r13d
mov dword [rsp + 0x40], 0x104
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x70]
mov edx, r15d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x18006aa66
mov edi, r13d
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
sub rax, rdx
sar rax, 5
test rax, rax
je 0x18006aa5e
mov rbx, r13
nop
add rdx, rbx
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x18006a9b1
mov rdx, qword [rdx]
lea rcx, [rbp - 0x70]
call fcn.1800b8cec
test eax, eax
je 0x18006a9df
inc edi
add rbx, 0x20
mov rdx, qword [rsi]
mov rcx, qword [rsi + 8]
sub rcx, rdx
sar rcx, 5
movsxd rax, edi
cmp rax, rcx
jb 0x18006a9a0
jmp 0x18006aa5e
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], r13
mov word [rsp + 0x70], r13w
cmp word [rbp - 0x70], 0
jne 0x18006aa05
mov r8, r13
jmp 0x18006aa1b
lea rax, [rbp - 0x70]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18006aa10
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x70]
call fcn.1800166f0
nop
mov r8, r12
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.18006a330
nop
cmp qword [rbp - 0x78], 8
jb 0x18006aa4c
mov rcx, qword [rsp + 0x70]
call fcn.1800b5700
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], r13
mov word [rsp + 0x70], r13w
inc r15d
jmp 0x18006a944
test r14, r14
je 0x18006aa7c
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, r13
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x50], r13d
mov bl, 1
jmp 0x18006aa87
xor bl, bl
test r14, r14
je 0x18006aa9a
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r13
movzx eax, bl
mov dword [rsp + 0x50], r13d
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1800b6c40
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180072cc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0xa0
mov qword [rax - 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1801485f0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbp, rcx
mov rbx, qword [rcx + 0x48]
cmp rbx, qword [rcx + 0x50]
je 0x180072e58
lea rsi, [rcx + 8]
xor r14d, r14d
lea r15d, [r14 + 0x78]
mov edx, dword [rbx]
lea rcx, [rsp + 0x70]
call fcn.18001cce0
mov rdi, rax
cmp rsi, rax
je 0x180072d50
cmp qword [rsi + 0x18], 8
jb 0x180072d34
mov rcx, qword [rsi]
call fcn.1800b5700
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], r14
mov word [rsi], r14w
mov rdx, rdi
mov rcx, rsi
call fcn.180016260
nop
cmp qword [rsp + 0x88], 8
jb 0x180072d65
mov rcx, qword [rsp + 0x70]
call fcn.1800b5700
mov qword [rsp + 0x88], 7
mov qword [rsp + 0x80], r14
mov word [rsp + 0x70], r14w
mov r8d, dword [rbx + 0x2c]
test r8d, r8d
jle 0x180072e4a
mov eax, r8d
imul eax, eax, 0x3c
mov dword [rsp + 0x30], eax
lea r9, [rsp + 0x30]
mov rdx, rsi
mov rcx, rbp
call fcn.180080d60
cmp al, 1
jne 0x180072e14
cmp byte [0x18014bc4c], 0
jne 0x180072dc1
xor ecx, ecx
call fcn.1800b878c
mov ecx, eax
call fcn.1800b704c
call fcn.1800b7020
mov ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x78
sub ecx, edx
inc ecx
cmp ecx, 1
jge 0x180072dee
mov ecx, 1
jmp 0x180072df5
cmp ecx, 0x78
cmovg ecx, r15d
mov eax, dword [rbx]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], ecx
lea rdx, [rsp + 0x34]
lea rcx, [rbp + 0x70]
call fcn.18006e420
lea rdx, [rsp + 0x60]
jmp 0x180072e35
mov eax, dword [rbx]
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x3c]
lea rcx, [rbp + 0x70]
call fcn.18006e420
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rax + 0x1c]
xor r8d, r8d
lea rcx, [rbp + 0x70]
call fcn.18006ee60
add rbx, 0x40
cmp rbx, qword [rbp + 0x50]
jne 0x180072d11
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1800b6c40
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x180073a90
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x180073abe
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1800851a0
cmp byte [0x18014b6d0], 0
jne 0x180073b09
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180073af9
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x18014b6d0], 1
mov qword [0x18014b6c8], rax
jmp 0x180073b10
mov rax, qword [0x18014b6c8]
mov byte [0x18014b6d0], 1
jmp 0x180073b10
mov rax, qword [0x18014b6c8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x180073b2f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x180085214
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180085236
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180085236
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je 0x180085236
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x180085030
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x280
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x2b0], rbx
mov rax, qword [0x1801485f0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rdx
mov rdi, rcx
xor ebp, ebp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x58], rbp
mov r9d, dword [rcx + 8]
or r9d, 0x2001f
mov r8, rdx
mov rdx, qword [rcx]
lea rcx, [rsp + 0x48]
call fcn.180030a40
mov ebx, eax
test eax, eax
jne 0x180085157
mov dword [rsp + 0x40], 0x100
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180085131
nop word [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.180085030
mov ebx, eax
test eax, eax
jne 0x180085157
mov dword [rsp + 0x40], 0x100
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1800850e0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180085146
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov rdx, rsi
mov rcx, rdi
call fcn.180073a90
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x18008516c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov eax, ebx
mov dword [rsp + 0x50], ebp
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1800b6c40
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800851a0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x180073abe
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1800851a0
cmp byte [0x18014b6d0], 0
jne 0x180073b09
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180073af9
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x18014b6d0], 1
mov qword [0x18014b6c8], rax
jmp 0x180073b10
mov rax, qword [0x18014b6c8]
mov byte [0x18014b6d0], 1
jmp 0x180073b10
mov rax, qword [0x18014b6c8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x180073b2f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x180085214
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180085236
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180085236
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je 0x180085236
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x180085430
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1801485f0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1800854be
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1800854be
call fcn.1800729a0
mov ebx, eax
jmp 0x1800855e3
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x1800854df
call fcn.1800729a0
jmp 0x1800855d2
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x180085502
call fcn.1800729a0
jmp 0x1800855d2
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x180085524
mov ebx, 0x8007000e
jmp 0x1800855d4
mov ecx, eax
test eax, eax
je 0x18008555c
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x180085552
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x18008555c
lea rcx, [rsp + 0x70]
call fcn.1800724a0
jmp 0x180085566
mov ecx, 0x80070216
call fcn.180044800
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x180085579
mov rax, qword [rsp + 0x70]
test rax, rax
jne 0x18008558a
mov ebx, 0x8007000e
jmp 0x1800855d4
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1800855af
call fcn.1800729a0
jmp 0x1800855d2
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.180085250
mov ebx, eax
test rdi, rdi
je 0x1800855e3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x1800855fa
lea rcx, [rsp + 0x70]
call fcn.180074420
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1800b6c40
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800871e0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x1800875d0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9, r8
mov r10, rdx
test r8, r8
jne 0x1800875e8
lea eax, [r8 + 0xd]
add rsp, 0x38
ret
xor r8d, r8d
mov rdx, r9
nop
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x1800875f4
inc eax
lea rdx, [rdx + rax*2]
lea r8d, [r8 + rax*2]
cmp eax, 1
jne 0x1800875f0
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret
Function at 0x18009e8b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x18009e8e4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x18009e8d0
mov rcx, rax
shr rcx, 0x20
xor eax, ecx
ret