joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001bc70
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [0x14001f428]
mov rsi, rcx
mov rcx, rbp
mov rdi, rdx
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rbx, rax
test rax, rax
je 0x14001bd90
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x14001bd90
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x14001bd90
test byte [rbx + 0x44], 4
jne 0x14001bdb0
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x14001f438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001bdf0
mov rdx, qword [rax + 0x1d8]
cmp rsi, rdx
je 0x14001be28
mov edx, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test edx, edx
jne 0x14001bd17
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14001bdd0
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001bd2b
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rdi, rdi
je 0x14001be08
mov rax, qword [rbx + 8]
mov qword [rdi], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14001be3a
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x14001be18
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [rbx + 0xbc]
test eax, eax
jne 0x14001bd13
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x10
jmp 0x14001bd7e
call sym.__pthread_self_lite.part.0
xor edx, edx
test rax, rax
jne 0x14001bce5
jmp 0x14001bcec
call sym.pthread_mutex_destroy
jmp 0x14001bd4c
mov rcx, rbx
call sym.push_pthread_mem.part.0
jmp 0x14001bd74
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x24
jmp 0x14001bd7e
call sym.replace_spin_keys.part.0
nop
Function at 0x180003f00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x10], 0
mov qword [rsp + 8], 0
mov qword [rsp + 0x18], 0
mov qword [rsp + 0x20], 0
mov rax, qword [0x180019c20]
mov qword [rsp + 0x10], rax
jnp 0x180003f69
push rbp
pop rbp
jp 0x180003f69
fcomp st(7)
invalid
invalid
mov rax, qword [rsp + 0x10]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180003f7f
xor eax, eax
jmp 0x1800040bf
mov rax, qword [rsp + 0x10]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x10]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
jg 0x180003fc4
push rbp
push rsp
push rsp
push rbp
pop rbp
pop rsp
pop rsp
pop rbp
jle 0x180003fc4
jno 0x180003f67
scasd eax, dword [rdi]
sub al, 0xd8
jno 0x180003fd5
sub ch, byte [rdi + rbp]
ffreep st(1)
fsubr dword [rdi]
rcr dword [rbx], 0x2c
invalid
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
je 0x180003fd8
xor eax, eax
jmp 0x1800040bf
add byte [rax], al
add bh, al
add al, 0x24
add byte [rax], al
add byte [rax], al
mov dword [rsp], 0
jmp 0x180003fe9
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 8]
movzx eax, word [rax + 6]
cmp dword [rsp], eax
jae 0x180004094
mov rax, qword [rsp + 8]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 8]
lea rax, [rcx + rax + 0x18]
mov ecx, dword [rsp]
imul rcx, rcx, 0x28
add rax, rcx
mov qword [rsp + 0x18], rax
jl 0x180004049
push rdx
push rdi
push rdx
pop rdx
pop rdi
pop rdx
jge 0x180004049
invalid
mov rax, qword [rsp + 0x18]
cmp dword [rax + 0x24], 0xe0000020
jne 0x18000408f
jae 0x180004083
jb 0x180004083
out 0x71, eax
mov esi, 0xf72e2eaf
rcr edi, 0x1b
imul dword [rdi]
scasd eax, dword [rdi]
invalid
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x20], rax
jmp 0x180004094
jmp 0x180003fe1
cmp qword [rsp + 0x20], 0
jne 0x1800040a0
xor eax, eax
jmp 0x1800040bf
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0xc]
mov rcx, qword [0x180019c20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x180012d90
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0
mov qword [rsp + 8], 0
mov qword [rsp], 0
mov qword [rsp + 0x20], 0
mov rax, qword gs:[0x60]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
mov rax, qword [rax + 0x238]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov qword [rsp], rax
mov rax, qword [rsp]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x180012e3d
mov rax, qword [rsp]
cmp dword [rax + 0x3c], 0
jle 0x180012e3d
mov rax, qword [rsp]
cmp dword [rax + 0x3c], 0x190
jge 0x180012e3d
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp dword [rax], 0x4550
jne 0x180012e3d
jmp 0x180012e4c
mov rax, qword [rsp + 8]
dec rax
mov qword [rsp + 8], rax
jmp 0x180012de9
mov rax, qword [rsp + 8]
add rsp, 0x38
ret

Function at 0x180012e60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov dword [rsp], 0
mov dword [rsp + 8], 0
mov dword [rsp], 0xffffffff
js 0x180012eb4
push rbx
push rbp
push rdi
nop
pop rdi
pop rbp
pop rbx
jns 0x180012eb4
sub al, 0xd8
fsub st(1)
mov esi, 0x62e762f7
sub al, 0xbe
sub ch, byte [rdi + 0x71dfd8f7]
scasd eax, dword [rdi]
fsub st(7)
out 0xb9, eax
sbb ebp, dword [rdi]
invalid
mov dword [rsp + 4], 0
jmp 0x180012ec8
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 4], eax
jae 0x180012f93
jl 0x180012f02
push rsp
push rbp
push rbp
pop rbp
pop rbp
pop rsp
jge 0x180012f02
fsubr dword [rdi]
mov ecx, 0xbed8c1e7
fadd st(1)
fsubr dword [rdi + 0x2c2ee7be]
shr dword [rsi], 0x1b
imul dword [rdx + riz*2]
sub al, 0x2a
scasd eax, dword [rdi]
scasd eax, dword [rdi]
neg edi
fbld tbyte [rdx - 0x19]
jno 0x180012ef7
mov ecx, 0x24448bc1
add al, 0x48
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
mov ecx, dword [rsp]
xor ecx, eax
mov eax, ecx
and eax, 0xff
mov dword [rsp + 8], eax
jl 0x180012f4b
nop
jge 0x180012f4b
loope 0x180012f41
invalid
mov esi, 0x2ce771e7
sub ch, byte [rdi + riz*8]
mov ecx, 0x24048b62
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp + 8]
lea rdx, [0x180019800]
xor eax, dword [rdx + rcx*4]
mov dword [rsp], eax
jge 0x180012f8e
nop
jl 0x180012f8e
mov esi, 0x62df2e1b
mov ecx, 0xc11b622c
fdivr dword [rsi - 0x1e414619]
invalid
loope 0x180012fe5
invalid
jmp 0x180012ebe
jnp 0x180012fbf
push rdx
push rdx
pop rdx
pop rdx
jp 0x180012fbf
invalid
mov eax, dword [rsp]
xor eax, 0xffffffff
mov dword [rsp], eax
jae 0x180012ff4
sub dl, byte [rax - 0x70]
push rax
nop
pop rax
jb 0x180012ff4
loope 0x180012f81
loope 0x180012f81
mov ecx, 0x1bb92caf
loope 0x180012fd0
sbb ebp, dword [rsi]
sub bl, bh
scasd eax, dword [rdi]
invalid
fsubr dword [rdi]
mov ecx, 0xc12edf2e
shr dword [rsi], 0xbe
jno 0x180012fc9
sub al, 0xb9
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp]
mov dword [rax], ecx
xor eax, eax
add rsp, 0x18
ret
Function at 0x180001010
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18000af9c
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180001060
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.18000d3a8
lea r8, [0x18001b5d8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18000afe4
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18000acc0
add rsp, 0x438
ret

Function at 0x180001440
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18000af9c
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180001490
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.18000d3a8
lea r8, [0x18001b5d8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18000afe4
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18000acc0
add rsp, 0x438
ret

Function at 0x1800021e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18000af9c
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180002230
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.18000d3a8
lea r8, [0x18001b5d8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18000afe4
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18000acc0
add rsp, 0x438
ret
Function at 0x180003470
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbp, rdx
mov rsi, rcx
mov rdx, rcx
lea rcx, str._EXTAPI_CLIPBOARD__parsing_timestamp__p
call fcn.1800021e0
movzx r8d, word [rsi + 0xc]
movzx eax, word [rsi + 0xe]
movzx r10d, word [rsi + 0xa]
movzx r11d, word [rsi + 8]
movzx ebx, word [rsi + 6]
movzx edi, word [rsi + 2]
movzx r9d, word [rsi]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x30], r11d
lea r8, str._04u__02u__02u__02u:_02u:_02u._04u
mov edx, 0x28
mov rcx, rbp
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
call fcn.18000afc0
lea rcx, str._EXTAPI_CLIPBOARD__timestamp_parsed
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
jmp fcn.1800021e0

Function at 0x180004730
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18000af9c
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180004780
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.18000d3a8
lea r8, [0x18001b5d8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18000afe4
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18000acc0
add rsp, 0x438
ret
Function at 0x180005d60
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
mov r14, r8
mov rbx, rcx
mov edi, r9d
mov rsi, rdx
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
lea rcx, [rbp - 0x20]
mov r9d, 1
xor edx, edx
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x28], 0
mov dword [rbp - 0x30], SafeArrayUnlock
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x180005ec4
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x28]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x180005eb8
mov rcx, qword [rbp - 0x28]
xor r9d, r9d
mov rdx, rbx
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x180005eae
xor ebx, ebx
test edi, edi
je 0x180005e32
mov rcx, qword [rbp - 0x28]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x180005eae
inc ebx
cmp ebx, edi
jb 0x180005e10
mov rcx, qword [rbp - 0x28]
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x10]
mov edx, 2
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x180005eae
mov r8, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x18]
xor r9d, r9d
mov edx, 0x6801
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x180005eae
mov eax, dword [rbp + 0x30]
mov rcx, qword [rbp - 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0x30]
lea r8d, [r9 + 1]
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rbp - 0x18]
test eax, eax
jne 0x180005ec8
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x20]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x180005ee9
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x20]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180006ed0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18000af9c
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180006f20
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.18000d3a8
lea r8, [0x18001b5d8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18000afe4
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18000acc0
add rsp, 0x438
ret

Function at 0x180007540
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18000af9c
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180007590
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.18000d3a8
lea r8, [0x18001b5d8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18000afe4
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18000acc0
add rsp, 0x438
ret
Function at 0x1800087a0
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x80
mov dword [rax + 0x20], 9
lea rax, [rax - 0x20]
mov rbx, r8
xor edi, edi
mov r9d, 0x20019
xor r8d, r8d
mov qword [rax - 8], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1800087ee
xor eax, eax
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x1800087db
lea r8d, [rax + 0x10]
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.18000c018
mov r9d, 4
lea r8, [rsp + 0x60]
lea edx, [r9 + 0xd]
mov rcx, rbx
mov qword [rsp + 0x60], rax
call fcn.18000bc18
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x90]
mov eax, 1
add rsp, 0x80
pop rdi
ret

Function at 0x180008a20
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18000af9c
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180008a70
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.18000d3a8
lea r8, [0x18001b5d8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18000afe4
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18000acc0
add rsp, 0x438
ret
Function at 0x1800090d0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18000af9c
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180009120
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.18000d3a8
lea r8, [0x18001b5d8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18000afe4
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18000acc0
add rsp, 0x438
ret

Function at 0x180009320
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18000af9c
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180009370
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.18000d3a8
lea r8, [0x18001b5d8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18000afe4
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18000acc0
add rsp, 0x438
ret
Function at 0x18000aa60
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18000af9c
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x18000aab0
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.18000d3a8
lea r8, [0x18001b5d8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18000afe4
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18000acc0
add rsp, 0x438
ret

Function at 0x18000acc0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [0x18002c5e8], 0
mov rbx, rcx
je 0x18000ad20
mov rcx, qword [0x18002c5e0]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
or r8, 0xffffffffffffffff
mov dword [rsp + 0x48], eax
nop dword [rax]
inc r8
cmp byte [rbx + r8], al
jne 0x18000acf0
mov rcx, qword [0x18002c5e8]
lea r9, [rsp + 0x48]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x18002c5e0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
add rsp, 0x30
pop rbx
ret

Function at 0x18000ad30
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18000af9c
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x18000ad80
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.18000d3a8
lea r8, [0x18001b5d8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18000afe4
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18000acc0
add rsp, 0x438
ret