joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001429
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x180020a90
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, 4
mov rdi, rdx
call fcn.180002da6
movzx ecx, byte [rdi]
lea rdx, str.cw
mov rbx, rax
mov r8d, ecx
and ecx, 0xf
and r8, 0xfffffffffffffff0
add r8, rcx
movzx ecx, byte [r8 + rdx]
mov byte [rax], cl
movzx ecx, byte [rdi + 1]
mov eax, ecx
and ecx, 0xf
and rax, 0xfffffffffffffff0
add rax, rcx
movzx eax, byte [rax + rdx]
mov byte [rbx + 1], al
movzx eax, byte [rdi + 2]
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
movzx eax, byte [rcx + rdx]
mov byte [rbx + 2], al
movzx eax, byte [rdi + 3]
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
movzx eax, byte [rcx + rdx]
mov rcx, rdi
mov byte [rbx + 3], al
call fcn.180001316
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18000143d
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1800349c0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x18009ab10]
mov ecx, 6
lea r8, [0x18009ab08]
lea rdx, str.FlsGetValue
call fcn.1800341a0
mov rdi, rax
test rax, rax
je 0x180034a01
mov rcx, rax
call fcn.180002969
mov ecx, ebx
call rdi
jmp 0x180034a09
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000167c
Capabilities:
Set registry value

Disassembly:
jmp 0x1800195c0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov eax, dword [r8 + 8]
xor ebp, ebp
mov r15, r8
mov r12, rdx
mov r13, rcx
mov esi, ebp
test eax, eax
je 0x180019615
mov r9, qword [r8]
mov r10d, eax
nop word [rax + rax]
mov rax, qword [r9]
lea r9, [r9 + 8]
mov eax, dword [rax + 8]
inc eax
add rsi, rax
sub r10, 1
jne 0x180019600
mov rbx, rbp
test rsi, rsi
je 0x18001963b
mov rcx, 0xffffffffffffffff
mov eax, 2
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.180002da6
mov rbx, rax
mov r14d, ebp
cmp dword [r15 + 8], ebp
jbe 0x18001967d
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [r15]
mov edx, r14d
mov rdx, qword [rcx + rdx*8]
mov ecx, dword [rdx + 8]
mov rdx, qword [rdx]
inc ecx
mov edi, ecx
lea r8, [rcx + rcx]
lea rcx, [rbx + rbp*2]
call fcn.180003143
add rbp, rdi
inc r14d
cmp r14d, dword [r15 + 8]
jb 0x180019650
mov rcx, qword [r13]
lea eax, [rsi + rsi]
mov dword [rsp + 0x28], eax
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
mov edi, eax
call fcn.180001316
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1800016b8
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x180018ee0
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [r8]
lea r9, [rsp + 0x78]
xor ebx, ebx
mov rdi, r8
mov dword [r8 + 8], ebx
mov r14, rcx
xor r8d, r8d
mov rsi, rdx
mov word [rax], bx
lea rax, [rsp + 0x60]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x60], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x180018f35
cmp eax, 0xea
jne 0x180018fad
mov edx, dword [rsp + 0x60]
mov dword [rsp + 0x70], edx
cmp edx, dword [rdi + 0xc]
jbe 0x180018f4a
mov rcx, rdi
call fcn.180004331
mov rax, qword [rdi]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x30]
mov rcx, qword [r14]
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x60]
cmp edx, dword [rsp + 0x70]
mov r8, qword [rdi]
cmova edx, dword [rsp + 0x70]
mov dword [rsp + 0x60], edx
mov ecx, edx
shr rcx, 1
mov word [r8 + rcx*2], bx
cmp word [r8], bx
je 0x180018faa
nop dword [rax + rax]
inc ebx
cmp word [r8 + rbx*2], 0
jne 0x180018fa0
mov dword [rdi + 8], ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x180001b77
Capabilities:
Query environment variable

Disassembly:
jmp 0x180075f60
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
je 0x180075fdf
jmp 0x180075f9b
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], si
jne 0x180075f8a
lea rax, [rax + rcx*2]
add rax, 2
cmp word [rax], si
jne 0x180075f86
sub rax, rbx
add rax, 2
sar rax, 1
lea rbp, [rax + rax]
mov rcx, rbp
call fcn.18000203b
mov rdi, rax
test rax, rax
je 0x180075fcf
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call fcn.180003143
mov rsi, rdi
xor ecx, ecx
call fcn.180004552
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180001b86
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x18002dc44
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x180000000], ax
jne 0x18002dcd2
movsxd rax, dword [0x18000003c]
lea rdx, [0x180000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x18002dcd2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18002dcd2
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x18002dcb9
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x18002dcb3
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x18002dcbb
add rdx, 0x28
jmp 0x18002dc98
xor edx, edx
test rdx, rdx
jne 0x18002dcc4
xor al, al
jmp 0x18002dcd8
cmp dword [rdx + 0x24], 0
jge 0x18002dcce
xor al, al
jmp 0x18002dcd8
mov al, 1
jmp 0x18002dcd8
xor al, al
jmp 0x18002dcd8
add rsp, 0x18
ret

Function at 0x180001ccb
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x180089eb0
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
add r8, rcx
mov r10, rdx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
test r11d, r11d
je 0x180089ef1
mov edx, dword [rax + 0xc]
cmp r10, rdx
jb 0x180089ee5
mov ecx, dword [rax + 8]
add ecx, edx
cmp r10, rcx
jb 0x180089ef3
inc r9d
add rax, 0x28
cmp r9d, r11d
jb 0x180089ed3
xor eax, eax
ret
Function at 0x180001db1
Capabilities:
Get geographical location

Disassembly:
jmp 0x180068ad4
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r9d
mov rsi, r8
mov ebp, edx
lea r9, [0x18009c9f0]
mov r14, rcx
lea r8, [0x18009c9e8]
lea rdx, str.GetLocaleInfoEx
mov ecx, 0xd
call fcn.180068010
mov rbx, rax
test rax, rax
je 0x180068b37
mov rcx, rax
call qword [section..00cfg]
mov r9d, edi
mov r8, rsi
mov edx, ebp
mov rcx, r14
call rbx
jmp 0x180068b51
xor edx, edx
mov rcx, r14
call fcn.180002abd
mov ecx, eax
mov r9d, edi
mov r8, rsi
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180001e06
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1800204c0
push rbx
sub rsp, 0x20
mov rax, qword [0x1800b75c0]
xor rax, rsp
mov qword [rsp + 0x10], rax
mov r10, rcx
lea rax, [rsp + 1]
xor r9d, r9d
mov r8, qword [r9 + r10 + 0x20]
lea rax, [rax + 4]
add r9, 8
movzx edx, byte [r8]
movzx ecx, byte [r8 + 2]
mov byte [rax - 5], dl
movzx edx, byte [r8 + 1]
mov byte [rax - 3], cl
movzx ecx, byte [r8 + 3]
mov byte [rax - 4], dl
mov byte [rax - 2], cl
cmp r9, 0x20
jl 0x1800204e0
mov ebx, 1
lea r11, [r10 + 0x28]
mov r9d, 3
mov rcx, qword [r11]
lea eax, [r9 - 2]
cdq
lea r11, [r11 + 8]
idiv dword [r10]
movzx eax, byte [rsp + rbx*4]
movsxd r8, edx
mov byte [r8 + rcx], al
lea eax, [r9 - 1]
mov rcx, qword [r11 - 8]
cdq
idiv dword [r10]
movzx eax, byte [rsp + rbx*4 + 1]
movsxd r8, edx
mov byte [r8 + rcx], al
mov eax, r9d
mov rcx, qword [r11 - 8]
cdq
idiv dword [r10]
movzx eax, byte [rsp + rbx*4 + 2]
inc r9d
movsxd r8, edx
mov byte [r8 + rcx], al
mov eax, r9d
mov rcx, qword [r11 - 8]
cdq
idiv dword [r10]
movzx eax, byte [rsp + rbx*4 + 3]
inc rbx
movsxd r8, edx
mov byte [r8 + rcx], al
cmp rbx, 4
jl 0x180020521
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.18000411a
add rsp, 0x20
pop rbx
ret

Function at 0x180001fff
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180083d04
sub rsp, 0x58
mov rax, qword [0x1800b75c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov r9, rdx
cmp rax, 0x20
mov r8, rcx
jae 0x180083d9c
mov byte [rsp + rax + 0x20], 0
inc rax
cmp rax, 0x20
jl 0x180083d23
mov al, byte [rdx]
jmp 0x180083d56
movzx edx, al
shr rdx, 3
movzx eax, al
and eax, 7
movzx ecx, byte [rsp + rdx + 0x20]
bts ecx, eax
inc r9
mov byte [rsp + rdx + 0x20], cl
mov al, byte [r9]
test al, al
jne 0x180083d37
jmp 0x180083d7b
movzx eax, r9b
mov edx, 1
movzx ecx, r9b
and ecx, 7
shr rax, 3
shl edx, cl
test byte [rsp + rax + 0x20], dl
jne 0x180083d97
inc r8
mov r9b, byte [r8]
test r9b, r9b
jne 0x180083d5c
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18000411a
add rsp, 0x58
ret
mov rax, r8
jmp 0x180083d85
call fcn.180001f55
int3
Function at 0x180002031
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x180018a90
push rbx
sub rsp, 0x40
movzx eax, byte [rsp + 0x50]
lea r9, [rsp + 0x30]
mov rcx, qword [rcx]
mov rbx, r8
mov dword [rsp + 0x50], eax
xor r8d, r8d
lea rax, [rsp + 0x68]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180018ae4
cmp dword [rsp + 0x50], eax
setne cl
mov byte [rbx], cl
add rsp, 0x40
pop rbx
ret

Function at 0x1800020d1
Capabilities:
Query or enumerate registry key

Disassembly:
jmp 0x180018830
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov rbx, rdx
mov r15, rcx
mov rcx, rdx
call fcn.180001406
lea rcx, [rsp + 0x48]
call fcn.180001c44
nop
xor r12d, r12d
mov r14d, r12d
or r13, 0xffffffffffffffff
mov dword [rsp + 0xa0], 0x105
cmp dword [rsp + 0x54], 0x105
jae 0x180018898
mov edx, 0x105
lea rcx, [rsp + 0x48]
call fcn.180004331
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xa0]
mov r8, qword [rsp + 0x48]
mov edx, r14d
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
mov rdx, qword [rsp + 0x48]
mov word [rdx + 0x20a], r12w
mov eax, r12d
cmp word [rdx], ax
je 0x1800188ed
inc eax
cmp word [rdx + rax*2], 0
jne 0x1800188e4
mov dword [rsp + 0x50], eax
cmp edi, 0x103
je 0x180018996
test edi, edi
jne 0x180018999
lea ecx, [rdi + 0x10]
call fcn.180001c85
mov qword [rsp + 0xb8], rax
test rax, rax
je 0x18001892c
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.180003e18
mov rdi, rax
jmp 0x18001892f
mov rdi, r12
mov ecx, dword [rbx + 0xc]
cmp dword [rbx + 8], ecx
jne 0x180018981
mov eax, ecx
shr eax, 2
lea ebp, [rcx + 1]
add ebp, eax
mov ecx, ebp
mov eax, 8
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.180002da6
mov rsi, rax
mov eax, dword [rbx + 8]
test eax, eax
je 0x180018973
mov r8d, eax
shl r8, 3
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.180003143
mov rcx, qword [rbx]
call fcn.180001316
mov qword [rbx], rsi
mov dword [rbx + 0xc], ebp
mov ecx, dword [rbx + 8]
mov rax, qword [rbx]
mov qword [rax + rcx*8], rdi
inc dword [rbx + 8]
inc r14d
jmp 0x180018874
mov edi, r12d
mov rcx, qword [rsp + 0x48]
call fcn.180001316
mov eax, edi
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800022cf
Capabilities:
Query service status
Start service

Disassembly:
jmp 0x1800231f0
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x50
mov rax, qword [0x1800b75c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0x20000000
xor bpl, bpl
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x180023311
mov r8d, 0x34
mov qword [rsp + 0x68], rdi
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x18002326a
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x18002327a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x18002330c
cmp dword [rsp + 0x24], 1
jne 0x1800232f3
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rdi
test eax, eax
je 0x180023264
lea rdx, [rsp + 0x20]
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1800232f6
nop word [rax + rax]
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsp + 0x24], 4
je 0x1800232e1
inc ebx
cmp ebx, 0xa
je 0x1800232dc
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1800232b0
jmp 0x1800232f6
xor bpl, bpl
jmp 0x1800232f6
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov bpl, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, bpl
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18000411a
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop rsi
ret
Function at 0x18000242d
Capabilities:
Encode data using base64

Disassembly:
jmp 0x180020df0
push rsi
mov esi, edx
mov r11, rcx
test rcx, rcx
je 0x180020f48
test edx, edx
js 0x180020f48
test r8, r8
je 0x180020f32
mov qword [rsp + 0x10], rbx
mov ebx, edx
test edx, edx
jle 0x180020f27
mov qword [rsp + 0x18], rbp
mov ebp, 0x3d
mov qword [rsp + 0x20], rdi
mov rdi, qword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
cmp ebx, 3
jl 0x180020ea9
movzx ecx, byte [r11 + 1]
movzx r9d, byte [r11]
mov edx, ecx
movzx r10d, byte [r11 + 2]
mov eax, r9d
shr rax, 2
add r11, 3
shl r9, 4
movsx eax, byte [rax + rdi]
mov word [r8], ax
mov eax, ecx
shr rax, 4
mov ecx, r10d
or rax, r9
shr rcx, 6
and eax, 0x3f
movsx eax, byte [rax + rdi]
mov word [r8 + 2], ax
lea rax, [rdx*4]
or rcx, rax
and ecx, 0x3f
movsx eax, byte [rcx + rdi]
mov word [r8 + 4], ax
add r8, 6
mov eax, r10d
and eax, 0x3f
movsx eax, byte [rax + rdi]
mov word [r8], ax
jmp 0x180020f0e
movzx r9d, byte [r11]
inc r11
cmp ebx, 2
jne 0x180020ebe
movzx edx, byte [r11]
inc r11
jmp 0x180020ec0
xor dl, dl
movzx eax, r9b
shr rax, 2
movzx ecx, dl
shr rcx, 4
movsx eax, byte [rax + rdi]
mov word [r8], ax
movzx eax, r9b
shl rax, 4
or rcx, rax
and ecx, 0x3f
movsx eax, byte [rcx + rdi]
mov word [r8 + 2], ax
cmp ebx, 1
jne 0x180020ef7
mov eax, ebp
jmp 0x180020f01
movzx eax, dl
and eax, 0xf
movsx eax, byte [rdi + rax*4]
mov word [r8 + 4], ax
add r8, 6
mov word [r8], bp
sub ebx, 3
add r8, 2
test ebx, ebx
jg 0x180020e36
mov rdi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
xor eax, eax
mov word [r8], ax
lea ecx, [rsi + 2]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
shl eax, 2
pop rsi
ret
or eax, 0xffffffff
pop rsi
ret

Function at 0x1800024fa
Capabilities:
Set registry value

Disassembly:
jmp 0x180019490
sub rsp, 0x38
mov rcx, qword [rcx]
xor eax, eax
test r8b, r8b
mov dword [rsp + 0x28], 4
mov r9d, 4
setne al
xor r8d, r8d
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret
Function at 0x1800026e4
Capabilities:
Read .ini file

Disassembly:
jmp 0x180022550
mov rax, rsp
push rbp
lea rbp, [rax - 0x1d8]
sub rsp, 0x2d0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x1800b75c0]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.1800029d7
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x50]
call fcn.180002d29
lea rax, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rbp - 0x50]
lea r8, [0x180094208]
lea rdx, str.laststartdata
lea rcx, str.info
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov qword [rsp + 0x50], 7
xor edi, edi
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x38], di
cmp word [rbp - 0x50], di
jne 0x1800225fe
mov r8d, edi
jmp 0x180022610
lea rax, [rbp - 0x50]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x180022606
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x38]
call fcn.180003850
nop
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [rsp + 0x5e]
movzx ecx, word [rsp + 0x5a]
movzx eax, word [rsp + 0x58]
add eax, 0xfffff894
mov dword [rbp - 0x64], eax
lea eax, [rcx - 1]
mov dword [rbp - 0x68], eax
mov dword [rbp - 0x6c], edx
mov qword [rbp - 0x74], rdi
mov dword [rbp - 0x78], edi
lea rcx, [rbp - 0x78]
call fcn.180002dd3
mov rbx, rax
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call fcn.180003c33
cmp eax, ebx
je 0x180022738
mov r8d, ebx
lea rdx, [0x18009603c]
lea rcx, [rbp - 0x78]
call fcn.180003a21
mov rbx, rax
lea rax, [rsp + 0x38]
cmp rax, rbx
je 0x1800226e5
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x1800226c4
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.180004a93
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x38], di
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.1800041d3
nop
mov r8, qword [rbp - 0x60]
cmp r8, 8
jb 0x1800226ff
inc r8
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp - 0x78]
call fcn.180004a93
lea r9, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae r9, qword [rsp + 0x68]
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r8, qword [rsp + 0x38]
lea rdx, str.laststartdata
lea rcx, str.info
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov bl, 1
jmp 0x18002273a
xor bl, bl
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x180022757
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.180004a93
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x38], di
mov r8, qword [rbp - 0x80]
cmp r8, 8
jb 0x180022786
inc r8
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
call fcn.180004a93
movzx eax, bl
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.18000411a
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x18000271b
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x180018da0
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add rsp, 0x38
ret
Function at 0x18000272a
Capabilities:
Parse pe header

Disassembly:
jmp 0x180089f70
mov rax, rcx
mov ecx, 0x5a4d
cmp word [rax], cx
je 0x180089f80
xor eax, eax
ret
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
xor eax, eax
cmp dword [rcx], 0x4550
jne 0x180089f9d
mov edx, 0x20b
cmp word [rcx + 0x18], dx
sete al
ret

Function at 0x180002c52
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x180018a20
push rbx
sub rsp, 0x40
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x68], 0
mov rbx, r8
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180018a68
mov ecx, dword [rsp + 0x30]
mov dword [rbx], ecx
add rsp, 0x40
pop rbx
ret

Function at 0x180002d42
Capabilities:
Parse pe header

Disassembly:
jmp 0x180063cc8
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1800639b0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800639b0
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1800639b0
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1800639b0
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1800639b0
cmp dword [rcx + 0x84], 0xe
jbe 0x1800639b0
cmp dword [rcx + 0xf8], esi
je 0x1800639b0
mov ecx, r14d
call fcn.180063c10
mov ecx, 2
call fcn.180003963
nop
cmp byte [0x1800b95b1], 0
jne 0x180063a7a
mov r15d, 1
mov eax, r15d
xchg dword [0x1800b95a4], eax
test ebx, ebx
jne 0x180063a23
mov rdi, qword [0x1800b75c0]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1800b95a8]
cmp rcx, rax
je 0x180063a1a
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [section..00cfg]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1800b99b0]
jmp 0x180063a2f
cmp ebx, r15d
jne 0x180063a35
lea rcx, [0x1800b99d0]
call fcn.180003cf6
nop
test ebx, ebx
jne 0x180063a4c
lea rdx, [0x180093a28]
lea rcx, [0x1800936e8]
call fcn.18000335a
lea rdx, [0x180093c48]
lea rcx, [0x180093b38]
call fcn.18000335a
movzx eax, byte [0x1800b95b1]
test esi, esi
cmove eax, r15d
mov byte [0x1800b95b1], al
jmp 0x180063a7a
mov ecx, 2
call fcn.180002680
test esi, esi
jne 0x180063a91
mov ecx, r14d
call fcn.180063b08
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x180063940
Function at 0x180002e4b
Capabilities:
Set registry value

Disassembly:
jmp 0x1800193b0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov rbx, r8
mov rcx, r8
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsi]
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x180002e50
Capabilities:
Terminate process

Disassembly:
jmp 0x18005d2fc
sub rsp, 0x28
mov ecx, 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
test eax, eax
je 0x18005d315
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
lea ecx, [r8 + 1]
call fcn.180001b0e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x180002eff
Capabilities:
Set registry value

Disassembly:
jmp 0x180019420
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x180003026
Capabilities:
Read file on windows

Disassembly:
jmp 0x180016980
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebp, ebp
mov rsi, r9
mov dword [r9], ebp
mov ebx, r8d
mov rdi, rdx
mov r14, rcx
nop dword [rax]
nop word [rax + rax]
cmp ebx, dword [0x1800b700c]
lea r9, [rsp + 0x60]
mov rcx, qword [r14]
mov r8d, ebx
cmova r8d, dword [0x1800b700c]
mov rdx, rdi
mov dword [rsp + 0x60], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x60]
add dword [rsi], ecx
test eax, eax
je 0x1800169f6
test ecx, ecx
je 0x1800169f2
add rdi, rcx
mov eax, ecx
sub ebx, ecx
jne 0x1800169b0
mov al, 1
jmp 0x1800169f8
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret