joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000895c
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov rsi, r8
mov rbx, rdx
lea rax, [r11 - 0x28]
mov rdx, qword [rsi]
mov rbp, r9
mov edi, 0xf003f
xor r8d, r8d
mov rcx, rbx
mov r9d, edi
mov qword [r11 - 0x58], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180008a73
mov rdx, qword [rsi]
and dword [rsp + 0x90], 0
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], edi
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x180008a73
mov rcx, qword [rsi]
lea rdi, [0x18015f758]
or ebx, 0xffffffff
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x180008a1a
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x180008a1a
mov rcx, qword [rsi]
sub rcx, 0xc
call fcn.1800d1434
mov rcx, qword [rbp]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x180008a40
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x180008a40
mov rcx, qword [rbp]
sub rcx, 0xc
call fcn.1800d1434
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rdx]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x180008a6c
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x180008a6c
mov rcx, qword [rdx]
sub rcx, 0xc
call fcn.1800d1434
xor eax, eax
jmp 0x180008b3a
mov r12, qword [rsp + 0xa0]
mov rdx, qword [rbp]
mov r9d, 1
mov rcx, qword [r12]
xor r8d, r8d
mov eax, dword [rcx - 8]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsi]
xor r13d, r13d
test ebx, ebx
lea rdi, [0x18015f758]
sete r13b
add rcx, 0xfffffffffffffff4
or ebx, 0xffffffff
cmp rcx, rdi
je 0x180008aeb
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x180008aeb
mov rcx, qword [rsi]
sub rcx, 0xc
call fcn.1800d1434
mov rcx, qword [rbp]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x180008b11
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x180008b11
mov rcx, qword [rbp]
sub rcx, 0xc
call fcn.1800d1434
mov rax, qword [r12]
add rax, 0xfffffffffffffff4
cmp rax, rdi
je 0x180008b37
mov ecx, ebx
lock xadd dword [rax], ecx
add ecx, ebx
test ecx, ecx
jg 0x180008b37
mov rcx, qword [r12]
sub rcx, 0xc
call fcn.1800d1434
mov eax, r13d
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x180009610
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov rbx, qword [rsp + 0x70]
mov rsi, r8
lea rax, [r11 + 0x18]
and dword [rbx], 0
mov rdx, qword [rsi]
mov rdi, r9
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [r11 - 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1800096af
mov rcx, qword [rsi]
lea rbp, [0x18015f758]
or ebx, 0xffffffff
add rcx, 0xfffffffffffffff4
cmp rcx, rbp
je 0x180009684
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x180009684
mov rcx, qword [rsi]
sub rcx, 0xc
call fcn.1800d1434
mov rcx, qword [rdi]
add rcx, 0xfffffffffffffff4
cmp rcx, rbp
je 0x1800096a8
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x1800096a8
mov rcx, qword [rdi]
sub rcx, 0xc
call fcn.1800d1434
xor eax, eax
jmp 0x180009745
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x70], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsi]
xor r12d, r12d
test ebx, ebx
lea rbp, [0x18015f758]
sete r12b
add rcx, 0xfffffffffffffff4
or ebx, 0xffffffff
cmp rcx, rbp
je 0x18000971e
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x18000971e
mov rcx, qword [rsi]
sub rcx, 0xc
call fcn.1800d1434
mov rax, qword [rdi]
add rax, 0xfffffffffffffff4
cmp rax, rbp
je 0x180009742
mov ecx, ebx
lock xadd dword [rax], ecx
add ecx, ebx
test ecx, ecx
jg 0x180009742
mov rcx, qword [rdi]
sub rcx, 0xc
call fcn.1800d1434
mov eax, r12d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x180009758
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov rsi, r8
lea rax, [r11 - 0x28]
mov rdi, r9
mov rdx, qword [rsi]
mov ebx, 0xf003f
mov rbp, 0xffffffff80000001
xor r8d, r8d
mov r9d, ebx
mov rcx, rbp
mov qword [r11 - 0x58], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18000983c
mov rdx, qword [rsi]
and dword [rsp + 0x90], 0
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x28], ebx
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x18000983c
mov rcx, qword [rsi]
lea rbp, [0x18015f758]
or ebx, 0xffffffff
add rcx, 0xfffffffffffffff4
cmp rcx, rbp
je 0x180009811
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x180009811
mov rcx, qword [rsi]
sub rcx, 0xc
call fcn.1800d1434
mov rcx, qword [rdi]
add rcx, 0xfffffffffffffff4
cmp rcx, rbp
je 0x180009835
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x180009835
mov rcx, qword [rdi]
sub rcx, 0xc
call fcn.1800d1434
xor eax, eax
jmp 0x1800098d0
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0xa0]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsi]
xor r12d, r12d
test ebx, ebx
lea rbp, [0x18015f758]
sete r12b
add rcx, 0xfffffffffffffff4
or ebx, 0xffffffff
cmp rcx, rbp
je 0x1800098a9
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x1800098a9
mov rcx, qword [rsi]
sub rcx, 0xc
call fcn.1800d1434
mov rax, qword [rdi]
add rax, 0xfffffffffffffff4
cmp rax, rbp
je 0x1800098cd
mov ecx, ebx
lock xadd dword [rax], ecx
add ecx, ebx
test ecx, ecx
jg 0x1800098cd
mov rcx, qword [rdi]
sub rcx, 0xc
call fcn.1800d1434
mov eax, r12d
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x18000a444
Capabilities:
Move file

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rdx
lea r8, str.itb.properties
lea rcx, [rsp + 0x58]
call fcn.1800084fc
nop
lea r8, str.idb.properties
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1800084fc
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov r11, qword [rsp + 0x50]
add r11, 0xfffffffffffffff4
lea rdi, [0x18015f758]
or ebx, 0xffffffff
cmp r11, rdi
je 0x18000a4c5
mov eax, ebx
lock xadd dword [r11], eax
add eax, ebx
test eax, eax
jg 0x18000a4c5
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x58]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x18000a4ed
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x18000a4ed
mov rcx, qword [rsp + 0x58]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x18000a6f0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x100
mov rax, qword [0x1801563c0]
xor rax, rsp
mov qword [rsp + 0xf0], rax
xor ebx, ebx
mov rcx, rbx
lea rax, str.GlobalSBWPROCEXIT
movzx eax, word [rcx + rax]
add rcx, 2
mov word [rsp + rcx + 0x6e], ax
cmp ax, bx
jne 0x18000a710
xor eax, eax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rax
lea edx, [rax + 1]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x18
mov dword [rsp + 0x40], ebx
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cmp eax, ebx
je 0x18000a7eb
xor r9d, r9d
lea rcx, [rsp + 0x48]
xor r8d, r8d
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
cmp eax, ebx
je 0x18000a7eb
xor r8d, r8d
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x70]
lea edx, [r8 + 1]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
mov qword [0x18015f548], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [0x18015f548]
mov qword [0x18015f550], rax
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea r9, vtable.CMainMgr.0
lea r8, [0x18000a60c]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x18015f558], rax
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1800d12b0
add rsp, 0x100
pop rbx
ret
Function at 0x18000b3b4
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov dword [r11 + 0x20], r9d
push rdi
sub rsp, 0x30
mov rdi, r8
lea rcx, [r11 + 0x20]
mov rax, rdx
mov rdx, qword [rdi]
mov r9d, 4
xor r8d, r8d
mov dword [r11 - 0x10], r9d
mov qword [r11 - 0x18], rcx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
lea rcx, [0x18015f758]
test eax, eax
mov rax, qword [rdi]
sete bl
add rax, 0xfffffffffffffff4
cmp rax, rcx
je 0x18000b41e
or ecx, 0xffffffff
lock xadd dword [rax], ecx
dec ecx
test ecx, ecx
jg 0x18000b41e
mov rcx, qword [rdi]
sub rcx, 0xc
call fcn.1800d1434
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x18000b42c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x30
and dword [r9], 0
mov rdi, r8
lea rcx, [r11 + 0x18]
mov rax, rdx
mov rdx, qword [rdi]
mov qword [r11 - 0x10], rcx
mov qword [r11 - 0x18], r9
xor r8d, r8d
mov rcx, rax
xor r9d, r9d
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ebx, ebx
lea rcx, [0x18015f758]
test eax, eax
mov rax, qword [rdi]
sete bl
add rax, 0xfffffffffffffff4
cmp rax, rcx
je 0x18000b49b
or ecx, 0xffffffff
lock xadd dword [rax], ecx
dec ecx
test ecx, ecx
jg 0x18000b49b
mov rcx, qword [rdi]
sub rcx, 0xc
call fcn.1800d1434
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x18000b6a8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
mov r11b, byte [r8 + 0x100]
mov bl, byte [r8 + 0x101]
xor edi, edi
movsxd rsi, edx
mov r10, r8
mov rbp, rcx
cmp rsi, rdi
jle 0x18000b74b
mov r12d, 0xff
movzx ecx, bl
movzx eax, r11b
inc eax
cdq
and edx, r12d
add eax, edx
and eax, r12d
sub eax, edx
movzx r9d, al
mov r11d, eax
movzx eax, byte [r9 + r10]
add eax, ecx
cdq
and edx, r12d
add eax, edx
and eax, r12d
sub eax, edx
mov dl, byte [r9 + r10]
movzx r8d, al
mov ebx, eax
movzx eax, dl
mov cl, byte [r8 + r10]
mov byte [r9 + r10], cl
mov byte [r8 + r10], dl
movzx ecx, byte [r9 + r10]
add eax, ecx
cdq
and edx, r12d
add eax, edx
and eax, r12d
sub eax, edx
movzx ecx, al
mov al, byte [rcx + r10]
xor byte [rdi + rbp], al
inc rdi
cmp rdi, rsi
jl 0x18000b6e1
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov byte [r10 + 0x101], bl
mov rbx, qword [rsp + 0x10]
mov byte [r10 + 0x100], r11b
pop r12
ret
Function at 0x18000e90c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x270
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1801563c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r12, r8
mov rdi, rcx
mov rbp, qword [rcx + 0xf0]
mov rax, qword [rbp + 8]
mov rbx, rbp
mov rsi, qword [rsp + 0x2c8]
cmp byte [rax + 0x21], 0
jne 0x18000e977
cmp qword [rax + 0x18], rsi
jae 0x18000e96b
mov rax, qword [rax + 0x10]
jmp 0x18000e971
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x21], 0
je 0x18000e95f
mov qword [rsp + 0x50], rbx
mov rax, qword [rcx + 0xc0]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x18000e992
cmp rax, rax
je 0x18000e997
call fcn.1800d15f4
cmp rbx, rbp
je 0x18000e9a9
cmp rsi, qword [rbx + 0x18]
jb 0x18000e9a9
lea rax, [rsp + 0x48]
jmp 0x18000e9c6
mov rax, qword [rdi + 0xf0]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi + 0xc0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x38]
movdqu xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x28], xmm0
mov rbx, qword [rdi + 0xf0]
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x18000e9ea
cmp rax, qword [rdi + 0xc0]
je 0x18000e9ef
call fcn.1800d15f4
cmp qword [rsp + 0x30], rbx
je 0x18000eaca
lea rdx, [0x18010ed0c]
lea rcx, [rsp + 0x20]
call fcn.1800041c0
nop
mov rcx, r12
call qword [sym.imp.USER32.dll_WindowFromDC]
mov rsi, rax
or ebp, 0xffffffff
lea r12, [0x18015f758]
test rax, rax
je 0x18000eaab
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x28]
call fcn.1800041c0
nop
lea rdx, [0x18010ed10]
mov rbx, qword [rsp + 0x28]
mov rcx, rbx
call fcn.1800d1e6c
test eax, eax
jne 0x18000ea90
mov qword [rdi + 0x100], rsi
lea r8, [rsp + 0x60]
lea rdx, str.___FOUND_SEARCH_DROP_WINDOW_______CLASS_:__s
lea rcx, [rsp + 0x20]
call fcn.180008f64
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
lea rcx, [rbx - 0xc]
cmp rcx, r12
je 0x18000eaab
mov eax, ebp
lock xadd dword [rcx], eax
add eax, ebp
test eax, eax
jg 0x18000eaab
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x20]
add rcx, 0xfffffffffffffff4
cmp rcx, r12
je 0x18000eaca
mov eax, ebp
lock xadd dword [rcx], eax
add eax, ebp
test eax, eax
jg 0x18000eaca
call fcn.1800d1434
mov eax, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1800d12b0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x18000f950
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x870
mov rax, qword [0x1801563c0]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov r12, qword [rsp + 0x8c8]
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x24], edx
xor ebx, ebx
mov r13d, 0x400
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8, r13
mov word [rsp + 0x20], r9w
mov r14d, ebx
mov byte [rsp + 0x40], bl
call fcn.1800d7640
lea rcx, [rsp + 0x451]
mov r8, r13
xor edx, edx
mov byte [rsp + 0x450], bl
call fcn.1800d7640
lea edx, [r13 + 1]
lea rcx, [rsp + 0x40]
mov r9, r13
mov r8, rdi
lea r15, [rsp + 0x40]
lea rsi, [rsp + 0x450]
call fcn.1800d28c4
mov rcx, rdi
mov r13, r12
mov qword [r12], rbx
mov byte [rsi], bl
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rdi, rax
cmp rax, rbx
je 0x18000fb31
cmp word [rax + 0x10], 2
jne 0x18000fa5a
cmp word [rax + 0x12], 4
jne 0x18000fa5a
mov rbp, qword [rax + 0x18]
jmp 0x18000fa51
mov r9d, dword [rax]
movzx r8d, word [rsp + 0x20]
mov edx, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x24]
call fcn.18000f8b0
mov qword [r13], rax
cmp rax, rbx
je 0x18000fac4
lea r13, [rax + 0x28]
add rbp, 8
mov rax, qword [rbp]
cmp rax, rbx
jne 0x18000fa2a
mov r8, qword [rdi]
mov r9d, 0x400
mov rcx, rsi
lea edx, [r9 + 1]
call fcn.1800d28c4
cmp qword [r12], rbx
jne 0x18000fad5
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x18000face
mov rdi, rsi
mov rax, r15
sub rdi, r15
movzx ecx, byte [rax]
movzx edx, byte [rax + rdi]
sub ecx, edx
jne 0x18000faa4
inc rax
test edx, edx
jne 0x18000fa92
cmp ecx, ebx
je 0x18000face
inc r14d
cmp r14d, 0x10
je 0x18000face
mov rdi, qword [rsp + 0x30]
mov rax, r15
mov r15, rsi
mov rsi, rax
jmp 0x18000f9f8
mov ebx, 8
jmp 0x18000fb4e
mov ebx, 0x2afb
jmp 0x18000fb4e
cmp dword [rsp + 0x8c0], ebx
je 0x18000fb4e
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
mov rdx, rcx
lea rbp, [rcx - 1]
lea ecx, [rax + 1]
call fcn.1800d280c
mov rdi, rax
cmp rax, rbx
jne 0x18000fb08
mov rdi, rbx
jmp 0x18000fb17
lea rdx, [rbp + 1]
mov r8, rsi
mov rcx, rax
call fcn.1800d2850
mov rax, qword [r12]
mov qword [rax + 0x18], rdi
mov rax, qword [r12]
cmp qword [rax + 0x18], rbx
mov eax, 8
cmove ebx, eax
jmp 0x18000fb4e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov eax, 0x2af9
sub edx, eax
je 0x18000fb4c
sub edx, 1
je 0x18000fb81
sub edx, 1
je 0x18000face
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.1800d12b0
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ebx, 0x2afa
jmp 0x18000fb4e
Function at 0x180010208
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1801563c0]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rax, [0x18000fbd8]
lea rsi, str.getaddrinfo
xor ebx, ebx
mov qword [rsp + 0x28], rax
lea rax, str.getnameinfo
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rax
lea rax, [0x18000ffb4]
mov qword [rsp + 0x38], rax
lea rax, str.freeaddrinfo
mov qword [rsp + 0x40], rax
lea rax, [0x18000fb88]
mov qword [rsp + 0x48], rax
cmp dword [0x180163388], ebx
jne 0x1800103c3
lea rcx, [r11 - 0x128]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, ebx
je 0x1800103b9
mov ebp, 0x10c
lea r8, [rsp + 0x160]
lea rcx, [rsp + 0x50]
mov rdx, rbp
call fcn.1800d2850
lea r8, str.ws2_32
lea rcx, [rsp + 0x50]
mov rdx, rbp
call fcn.1800d2d60
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
cmp rax, rbx
je 0x180010304
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbx
jne 0x1800102ff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, rbx
cmp rdi, rbx
jne 0x180010362
lea r8, [rsp + 0x160]
lea rcx, [rsp + 0x50]
mov rdx, rbp
call fcn.1800d2850
lea r8, str.wship6
lea rcx, [rsp + 0x50]
mov rdx, rbp
call fcn.1800d2d60
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
cmp rax, rbx
je 0x1800103b9
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbx
jne 0x18001035d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, rbx
cmp rdi, rbx
je 0x1800103b9
mov rbp, rbx
lea rsi, [rsp + 0x28]
mov rdx, qword [rsi - 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi], rax
cmp rax, rbx
je 0x18001038e
inc rbp
add rsi, 0x10
cmp rbp, 3
jl 0x18001036a
jmp 0x18001039a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, rbx
cmp rdi, rbx
je 0x1800103b9
mov rax, qword [rsp + rbx + 0x28]
lea rcx, [0x18015f908]
mov qword [rbx + rcx], rax
add rbx, 0x10
cmp rbx, 0x30
jl 0x18001039f
mov dword [0x180163388], 1
mov rax, qword [0x18015f908]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1800d12b0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180011e58
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov rbx, r9
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x18015f768]
mov qword [r11 + 0x20], rax
test r9, r9
je 0x180011ead
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.180003e28
mov rax, qword [0x18015f768]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x58]
mov r8, rdi
lea rdx, str._______HWND_CREATED_CLASS:_HWND_:__d__CLASS__s
lea rcx, [rsp + 0x20]
call fcn.180008f64
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.Internet_Explorer_Server
mov rcx, qword [rsp + 0x58]
call fcn.1800d1e6c
test eax, eax
je 0x180011f39
lea rcx, [rbx - 0xc]
lea rdi, [0x18015f758]
or ebx, 0xffffffff
cmp rcx, rdi
je 0x180011f13
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x180011f13
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x58]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x180011f32
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x180011f32
call fcn.1800d1434
mov eax, 1
jmp 0x180011fa8
lea rcx, [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsi + 0x88]
lea rdx, [rsp + 0x48]
call fcn.180011fb8
lea rcx, [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbx - 0xc]
lea rdi, [0x18015f758]
or ebx, 0xffffffff
cmp rcx, rdi
je 0x180011f84
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x180011f84
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x58]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x180011fa3
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x180011fa3
call fcn.1800d1434
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800136b8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1801563c0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rdi, rcx
mov rcx, qword [rcx]
lea rax, [rsp + 0x58]
xor r8d, r8d
or r9d, 0x2001f
mov rsi, rdx
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
cmp eax, ebp
jne 0x1800137bd
mov ebx, ebp
cmp rcx, rbp
je 0x18001372e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x50], ebp
cmp ebx, ebp
mov qword [rsp + 0x48], rcx
jmp 0x180013758
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1800136b8
mov rcx, qword [rsp + 0x48]
mov ebx, eax
cmp eax, ebp
jne 0x1800137bd
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebp
je 0x180013740
mov rcx, qword [rsp + 0x48]
cmp rcx, rbp
je 0x1800137a6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov rcx, qword [rdi]
mov rdx, rsi
mov dword [rsp + 0x50], ebp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
cmp rcx, rbp
je 0x1800137c8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1800d12b0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret