joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140110690
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x140110838
push rbp
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov rdi, qword [rbp + 0x1e0]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x1401106f5
lea rax, [rsi + 1]
mov byte [rsi], 0xff
mov qword [rbx], rax
cmp rax, rbx
jae 0x1401106f5
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x1401106f5
mov byte [rax], dl
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x14011072c
mov byte [r9], r15b
inc qword [rbx]
mov r9, qword [rbx]
mov r15, qword [rsp + 0x58]
cmp r9, rbx
jae 0x140110782
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140110782
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140110782
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140110782
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140110782
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.140110140
mov rcx, qword [r14 + 0x4c0]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x1401107e4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1400ec8c0
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.140110510
mov rcx, qword [r14 + 0x4c0]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140110830
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1400ec8c0
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x140111fa0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1401adf80]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], pe_nt_image_headers64
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x140112035
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x140112096
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.1400ec8c0
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140125830
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x140112151
sub ecx, 1
je 0x1401121c4
sub ecx, 1
je 0x140112100
cmp ecx, 1
je 0x1401120e3
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x140156f74]
call fcn.1400ec8c0
jmp 0x1401121c4
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.140111cd0
test eax, eax
je 0x1401121c4
jmp 0x14011206a
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1401121c4
sub rax, rsi
cmp rax, rbp
jae 0x1401121c4
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.1400eca40
jmp 0x1401121c4
cmp r8d, 4
jle 0x1401121c4
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x1401121c4
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.1400ec7e0
mov esi, eax
test eax, eax
je 0x1401121a3
mov edx, 5
mov rcx, rbx
call fcn.140112c90
mov eax, esi
jmp 0x14011206a
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.1400fb0c0
mov rcx, r14
call fcn.1400fb3a0
test eax, eax
je 0x140112068
mov edx, 5
mov rcx, rbx
call fcn.140112c90
mov eax, Ordinal_46
jmp 0x14011206a
Function at 0x140124f60
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [fcn.1401275bc]
mov rdi, rax
test rax, rax
jne 0x140124fa2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140124fe9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140125042
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x140125000
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x140125083
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x140156362]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x140156363]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140125050
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
and eax, 0x470b76

Function at 0x1401250a0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140125124
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x140125124
dec r8
sub rdx, 1
jne 0x14012510a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140125d78
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x14012684c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140126896
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140126896
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140126896
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140126896
cmp dword [rcx + 0x84], 0xe
jbe 0x140126896
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140126898
xor al, al
add rsp, 0x28
ret
Function at 0x140459489
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r8
movzx r8w, r14b
push r9
push r12
not r8b
xchg r8b, r8b
push rbp
xchg r8b, r8b
bswap ebp
movsx r8, r11w
push r13
movsx bp, bl
xchg r8b, r8b
push r14
movsx bp, r13b
push r10
not r8
cmovo r10w, r11w
movzx ebp, r9w
pushfq
push r11
ror r10, cl
cmovo r10w, r13w
sal r8d, 0xb6
push rax
cmove r8d, esp
btc r8d, 0x15
push rdx
dec bpl
rdtsc
jmp 0x140583484
jmp r10
push rsi
cdqe
ror edx, cl
push rbx
btc dx, di
rcl ax, cl
push rcx
push r15
neg dh
push rdi
bswap r8
add rcx, 0x44eb4d5a
movabs rbp, 0
and ch, 0x4f
push rbp
mov rdi, qword [rsp + 0x90]
sal r8b, cl
btr rdx, r9
sub edi, 0x6f670bfb
sar edx, cl
shl dh, 9
xor edi, 0x50f14c4f
movsx r8w, r13b
rdtsc
not ah
sub edi, 0x3a9d6bf8
neg edi
lea rdi, [rdi + rbp]
movabs rdx, 0x100000000
rcr r10w, 0x69
lea rdi, [rdi + rdx]
test di, 0x3210
shrd rcx, r13, 0xa1
mov r8, rsp
sub rsp, 0x180
cmovnp rcx, rdx
test esp, 0x42766432
and rsp, 0xfffffffffffffff0
or r10b, 0x24
sal r10, 0x79
rcl ax, cl
mov rsi, rdi
btc ax, ax
stc
movabs rax, 0
sub rsi, rax
cmp r14b, 0x97
lea r10, [0x140583540]
sub cx, 0x7aa3
mov ecx, dword [rdi]
add rdi, 4
stc
xor ecx, esi
test r10w, r8w
cmp bl, r9b
add ecx, 0x4db9512f
clc
xor ecx, 0x737d0e1e
dec ecx
bswap ecx
cmc
stc
clc
ror ecx, 3
stc
cmp r11b, 0x49
push rsi
rcl sil, 0x84
add rsi, rbx
movsx si, bpl
xor dword [rsp], ecx
btr rsi, 0x54
shrd rsi, rsi, 0x70
pop rsi
cmp bh, 0xf4
movsxd rcx, ecx
add r10, rcx
jmp 0x140581da6
Function at 0x180002aec
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
movdqa xmm0, xmmword [0x1800310f0]
movdqa xmm1, xmmword [0x180031100]
mov rbx, qword [0x180039a70]
movdqa xmmword [rbp + 7], xmm0
movdqa xmm0, xmmword [0x1800310e0]
movdqa xmmword [rbp + 0x17], xmm1
movdqa xmm1, xmmword [0x1800310a0]
movdqa xmmword [rbp + 0x27], xmm0
movdqa xmm0, xmmword [0x1800310c0]
movdqa xmmword [rbp + 0x37], xmm1
movdqa xmm1, xmmword [0x1800310b0]
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm0, xmmword [0x1800310d0]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm1, xmmword [0x180031090]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmmword [rbp - 0x19], xmm1
mov dword [rbp + 0x47], 0x7b
mov dword [rbp + 0x4b], 0x6d
mov dword [rbp - 9], 0x2e
mov dword [rbp - 5], 0x95
call fcn.180005764
mov edx, 0xc9
mov r8d, 2
mov rcx, rbx
call rax
mov edi, dword [rax + 4]
mov esi, dword [rax]
mov ecx, edi
add rsi, rbx
mov ebx, edi
call fcn.180009554
xor ecx, ecx
mov r8, rax
test edi, edi
je 0x180002bcc
mov byte [rax], cl
inc rax
sub rbx, 1
jne 0x180002bc1
lea r9, [rsi + 0x67]
test r9, r9
je 0x180002bed
mov rdx, r8
test edi, edi
je 0x180002bed
sub r9, r8
mov al, byte [r9 + rdx]
mov byte [rdx], al
inc rdx
sub edi, 1
jne 0x180002bdf
mov r11d, ecx
mov r9, rcx
mov r10, r8
movabs rbx, 0xe38e38e38e38e38f
mov edi, 0x49200
inc r11d
mov rax, rbx
mul r9
shr rdx, 4
lea rax, [rdx + rdx*8]
add rax, rax
sub r9, rax
mov al, byte [rbp + r9*4 - 0x49]
xor byte [r10], al
inc r10
movsxd r9, r11d
cmp r9, rdi
jb 0x180002c05
mov r9, rcx
mov r10, r8
inc ecx
mov rax, rbx
mul r9
shr rdx, 4
lea rax, [rdx + rdx*8]
add rax, rax
sub r9, rax
mov al, byte [rbp + r9*4 + 7]
xor byte [r10], al
inc r10
movsxd r9, ecx
cmp r9, rdi
jb 0x180002c35
lea r11, [rsp + 0xc0]
mov rax, r8
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18000349c
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x70
comisd xmm0, xmmword [0x180030e00]
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm11
movaps xmmword [rax - 0x38], xmm12
movaps xmmword [rax - 0x48], xmm13
movaps xmmword [rax - 0x58], xmm14
jb 0x1800036cc
call qword [sym.imp.SHELL32.dll_InitNetworkAddressControl]
movss xmm11, dword [0x180030fec]
movsd xmm13, qword [0x180030e08]
movsd xmm12, qword [0x180030f10]
movsd xmm14, qword [0x180030d10]
xorps xmm6, xmm6
subss xmm11, xmm11
cvtss2sd xmm6, xmm11
movaps xmm0, xmm6
call fcn.18000349c
cvttss2si ebx, xmm0
movaps xmm0, xmm13
call fcn.180002fd0
movsd xmm2, qword [0x180030d70]
xorps xmm1, xmm1
cvtsi2sd xmm1, ebx
xorps xmm11, xmm11
cvtsd2ss xmm11, xmm0
divsd xmm6, xmm1
movsd xmm1, qword [0x180030df8]
cvtps2pd xmm13, xmm11
mulsd xmm6, xmm13
jmp 0x180003562
movaps xmm0, xmm1
subsd xmm0, xmm2
divsd xmm1, xmm0
movaps xmm2, xmm0
movaps xmm6, xmm1
mulsd xmm6, xmm0
comisd xmm6, xmmword [0x180030e98]
ja 0x18000354d
movss xmm1, dword [0x18003100c]
jmp 0x180003587
movaps xmm0, xmm1
xorps xmm6, xmm6
mulss xmm0, xmm1
movaps xmm1, xmm0
cvtss2sd xmm6, xmm0
ucomisd xmm6, qword [0x180030e40]
jp 0x180003593
je 0x180003576
comisd xmm6, xmmword [0x180030d08]
jb 0x1800035b0
call qword [sym.imp.USER32.dll_GetCursor]
movsd xmm0, qword [0x180030ef0]
jmp 0x18000363b
movsd xmm0, qword [0x180030ee8]
call fcn.18000349c
xorps xmm1, xmm1
cvttss2si rax, xmm0
cvtsi2sd xmm1, rax
subsd xmm1, qword [0x180030cf0]
subsd xmm1, qword [0x180030cf0]
comisd xmm12, xmm1
jb 0x1800035f6
call qword [sym.imp.SHELL32.dll_InitNetworkAddressControl]
movsd xmm0, qword [0x180030de8]
call fcn.18000349c
jmp 0x180003603
call qword [sym.imp.KERNEL32.dll_GetErrorMode]
mov cl, 0x44
call fcn.180002c7c
mov edi, 0x1a
call qword [sym.imp.USER32.dll_GetShellWindow]
mov rcx, rdi
call fcn.1800032e8
movsx rbx, al
mov cl, bl
call fcn.180002c7c
movsx rdi, al
xorps xmm0, xmm0
lea rax, [rdi + rbx]
cvtsi2sd xmm0, rax
comisd xmm0, xmmword [0x180030ed8]
ja 0x180003608
mov edi, 0x20
mov bl, 0x66
lea esi, [rdi + 0x37]
jmp 0x1800036a9
xorps xmm0, xmm0
cvtsi2sd xmm0, rdi
call fcn.18000349c
cvttss2si rdi, xmm0
movsx eax, sil
xor esi, esi
movsx ebx, bl
imul ebx, eax
xorps xmm0, xmm0
mov rcx, rdi
movsx rax, bl
sub rcx, rax
cvtsi2sd xmm0, rcx
comisd xmm14, xmm0
jbe 0x1800036c4
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
movsd xmm0, qword [0x180030d20]
call fcn.180002fd0
xorps xmm1, xmm1
cvttsd2si rax, xmm0
cvtsi2ss xmm1, rax
addss xmm1, dword [0x18003105c]
cvtps2pd xmm0, xmm1
ucomisd xmm0, qword [0x180030d88]
jp 0x1800036b5
je 0x180003647
comisd xmm0, xmmword [0x180030f18]
jbe 0x1800036cf
jmp 0x1800034fc
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x1800036c4
xorps xmm0, xmm0
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
movaps xmm11, xmmword [r11 - 0x20]
movaps xmm12, xmmword [r11 - 0x30]
movaps xmm13, xmmword [r11 - 0x40]
movaps xmm14, xmmword [r11 - 0x50]
cvtpd2ps xmm0, xmm0
mov rsp, r11
pop rdi
ret
Function at 0x1800039f8
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
cmp cl, 0x2e
jne 0x180003ac1
call qword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, 0x5d
call fcn.180003700
movaps xmm6, xmm0
cvttss2si rcx, xmm6
call fcn.180003700
cvttss2si eax, xmm0
xorps xmm1, xmm1
cvtss2sd xmm1, xmm6
movd xmm0, eax
mulsd xmm1, qword [0x180030ce0]
cvtdq2pd xmm0, xmm0
subsd xmm1, xmm0
cvttsd2si eax, xmm1
cmp al, 0xb
jl 0x180003a56
call qword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
jmp 0x180003a8d
movsd xmm0, qword [0x180030e90]
call fcn.180003ae8
movaps xmm6, xmm0
cvttss2si ecx, xmm6
call fcn.1800038a4
movsx ecx, al
xorps xmm0, xmm0
cvtss2sd xmm0, xmm6
movd xmm1, ecx
cvtdq2pd xmm1, xmm1
addsd xmm1, xmm0
cvttsd2si eax, xmm1
cmp al, 0x46
je 0x180003aa1
call qword [sym.imp.USER32.dll_IsProcessDPIAware]
mov ecx, 0x1b
call fcn.180003700
cvttss2si eax, xmm0
cmp al, 4
jl 0x180003ac1
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ecx, 0x6b
call fcn.1800038a4
add al, 0x71
cmp al, 3
jne 0x180003ac1
call qword [sym.imp.USER32.dll_GetMenuCheckMarkDimensions]
movsd xmm1, qword [0x180030e88]
movaps xmm0, xmm1
addsd xmm0, xmm1
cvttsd2si eax, xmm0
movaps xmm1, xmm0
cmp al, 0x2e
jle 0x180003ac9
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x180003f98
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
movsxd rax, dword [rcx + 0x3c]
xor r12d, r12d
mov r14, rdx
mov r8d, dword [rax + rcx + 0x88]
test r8d, r8d
jne 0x180003fcf
xor eax, eax
jmp 0x18000406d
lea rax, [rcx + r8]
mov rsi, r12
mov ebx, dword [rax + 0x20]
mov edx, dword [rax + 0x1c]
add rbx, rcx
mov r8d, dword [rax + 0x24]
add rdx, rcx
mov r15d, dword [rax + 0x18]
add r8, rcx
test r15, r15
je 0x18000405a
mov edi, dword [rbx]
mov r9, r12
add rdi, rcx
cmp byte [r14], r12b
je 0x180004008
inc r9
cmp byte [r9 + r14], r12b
jne 0x180003fff
test rdi, rdi
je 0x18000404a
mov r10d, r12d
test r9, r9
je 0x180004045
mov rbp, r14
mov r11, rdi
sub rbp, rdi
mov al, byte [r11 + rbp]
cmp byte [r11], al
jb 0x180004041
ja 0x180004039
inc r11
mov rax, r11
sub rax, rdi
cmp rax, r9
jb 0x18000401e
jmp 0x180004045
mov r10d, 1
jmp 0x180004045
or r10d, 0xffffffff
test r10d, r10d
je 0x18000405a
inc rsi
add rbx, 4
add r8, 2
cmp rsi, r15
jb 0x180003ff2
cmp r12w, word [r8]
jae 0x180004068
movzx eax, word [r8]
lea rdx, [rdx + rax*4]
mov eax, dword [rdx]
add rax, rcx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x180005764
Capabilities:
Access peb ldr_data
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x20]
jmp 0x1800057b1
mov r9, qword [rdx + 0x50]
xor r8d, r8d
movzx r10d, word [rdx + 0x48]
movzx ecx, byte [r9]
ror r8d, 0xd
mov eax, r8d
add rax, rcx
cmp cl, 0x61
lea r8, [rax - 0x20]
cmovb r8, rax
inc r9
sub r10, 1
jne 0x180005783
cmp r8d, 0x6a4abc5b
je 0x1800057b9
mov rdx, qword [rdx]
test rdx, rdx
jne 0x180005777
xor eax, eax
ret
mov r8, qword [rdx + 0x20]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
mov edx, dword [r9 + r8 + 0x20]
mov ecx, dword [r9 + r8 + 0x24]
add rdx, r8
add rcx, r8
mov r11d, dword [rdx]
add r11, r8
xor r10d, r10d
mov al, byte [r11]
inc r11
ror r10d, 0xd
movsx eax, al
add r10d, eax
mov al, byte [r11]
test al, al
jne 0x1800057e5
cmp r10d, 0x3bd09a55
je 0x18000580c
add rdx, 4
add rcx, 2
jmp 0x1800057d9
movzx edx, word [rcx]
mov ecx, dword [r9 + r8 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
ret

Function at 0x180005a24
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x180005ab6
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x180005a90
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180005aaf
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180005aaf
mov rdx, qword [rdi]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call rax
jmp 0x180005a9f
cmp dword [rdi + 8], 0
je 0x180005aaf
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, 1
jmp 0x180005a9f
cmp byte [0x180039af8], 0
jne 0x180005b01
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180005aed
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
mov qword [0x180039af0], rax
jmp 0x180005af4
mov r10, qword [0x180039af0]
mov eax, 1
mov byte [0x180039af8], al
jmp 0x180005b08
mov r10, qword [0x180039af0]
mov rcx, qword [rbx]
mov rdx, rsi
test r10, r10
je 0x180005a99
mov r8d, dword [rbx + 8]
xor r9d, r9d
call r10
jmp 0x180005a9f
Function at 0x180005b20
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov edi, dword [rcx + 8]
lea rax, [rbp + 0x1a0]
xor r15d, r15d
mov qword [rsp + 0x20], rax
mov rsi, rcx
mov qword [rsp + 0x40], r15
mov rcx, qword [rcx]
or edi, 0x2001f
mov r9d, edi
mov dword [rsp + 0x48], r15d
xor r8d, r8d
mov qword [rsp + 0x50], r15
mov r14, rdx
mov qword [rbp + 0x1a0], r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x180005c3c
mov rcx, qword [rsp + 0x40]
mov ebx, r15d
test rcx, rcx
je 0x180005b9d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rbp + 0x1a0]
and edi, 0x300
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x48], edi
test ebx, ebx
jne 0x180005c3c
mov edi, 0x100
jmp 0x180005bdc
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.180005b20
mov ebx, eax
test eax, eax
jne 0x180005c3c
mov rcx, qword [rsp + 0x40]
lea rax, [rbp + 0x1a8]
mov dword [rbp + 0x190], edi
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x190]
mov qword [rsp + 0x30], r15
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], r15
xor edx, edx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x180005bc2
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180005c2a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
mov rdx, r14
mov dword [rsp + 0x48], r15d
mov rcx, rsi
call fcn.180005a24
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180005c4c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x298]
add rsp, 0x260
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret