joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002650
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400097c0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000266f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002678
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140002690
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400097c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400026b0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400026b8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400026b0
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x1400026b0
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140002704
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140002710
add rdx, 0x28
cmp rdx, r9
jne 0x1400026f0
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140002720
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1400097c0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002742
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002750
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002742
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002742
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x140002742
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x1400027a5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x1400027b8
add rdx, 0x28
cmp r10, rdx
jne 0x140002790
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x1400027c7
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x1400027d7
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400027ae
test ecx, ecx
jg 0x1400027c0
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140003140
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000318a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000318a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000318a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000318a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000318a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000318c
xor al, al
add rsp, 0x28
ret
Function at 0x140004970
Capabilities:
Query environment variable

Disassembly:
jmp 0x14013143c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
je 0x1401314bb
jmp 0x140131477
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], si
jne 0x140131466
lea rax, [rax + rcx*2]
add rax, 2
cmp word [rax], si
jne 0x140131462
sub rax, rbx
add rax, 2
sar rax, 1
lea rbp, [rax + rax]
mov rcx, rbp
call fcn.140006220
mov rdi, rax
test rax, rax
je 0x1401314ab
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call fcn.14000bb70
mov rsi, rdi
xor ecx, ecx
call fcn.140012110
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140005030
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x140141b10
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
add r8, rcx
mov r10, rdx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
test r11d, r11d
je 0x140141b51
mov edx, dword [rax + 0xc]
cmp r10, rdx
jb 0x140141b45
mov ecx, dword [rax + 8]
add ecx, edx
cmp r10, rcx
jb 0x140141b53
inc r9d
add rax, 0x28
cmp r9d, r11d
jb 0x140141b33
xor eax, eax
ret

Function at 0x1400054d0
Capabilities:
Get geographical location

Disassembly:
jmp 0x140124940
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
mov esi, edx
lea r9, [0x14017d9f8]
mov rbp, rcx
lea r8, [0x14017d9f0]
lea rdx, str.GetLocaleInfoEx
mov ecx, 0xb
call fcn.140123d4c
mov rcx, rbp
test rax, rax
je 0x140124996
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [0x1401cc010]
jmp 0x1401249ad
xor edx, edx
call fcn.140009730
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140006080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140108170
sub rsp, 0x58
mov rax, qword [0x1401b40a0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov r8, rdx
mov eax, r9d
mov r10, rcx
cmp rax, 0x20
lea r11d, [r9 + 1]
jae 0x14010820a
mov byte [rsp + rax + 0x20], r9b
add rax, r11
cmp rax, 0x20
jl 0x140108197
mov al, byte [rdx]
jmp 0x1401081ca
movzx edx, al
shr rdx, 3
movzx eax, al
and eax, 7
movzx ecx, byte [rsp + rdx + 0x20]
bts ecx, eax
add r8, r11
mov byte [rsp + rdx + 0x20], cl
mov al, byte [r8]
test al, al
jne 0x1401081ab
or byte [rsp + 0x20], r11b
jmp 0x1401081db
add r9d, r11d
add r10, r11
movzx r8d, byte [r10]
mov edx, r11d
mov ecx, r8d
shr r8, 3
and ecx, 7
shl edx, cl
test byte [rsp + r8 + 0x20], dl
je 0x1401081d5
movsxd rax, r9d
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140010c40
add rsp, 0x58
ret
call fcn.140005d50
int3
Function at 0x1400060e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14013e948
sub rsp, 0x58
mov rax, qword [0x1401b40a0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov r9, rdx
cmp rax, 0x20
mov r8, rcx
jae 0x14013e9e0
mov byte [rsp + rax + 0x20], 0
inc rax
cmp rax, 0x20
jl 0x14013e967
mov al, byte [rdx]
jmp 0x14013e99a
movzx edx, al
shr rdx, 3
movzx eax, al
and eax, 7
movzx ecx, byte [rsp + rdx + 0x20]
bts ecx, eax
inc r9
mov byte [rsp + rdx + 0x20], cl
mov al, byte [r9]
test al, al
jne 0x14013e97b
jmp 0x14013e9bf
movzx eax, r9b
mov edx, 1
movzx ecx, r9b
and ecx, 7
shr rax, 3
shl edx, cl
test byte [rsp + rax + 0x20], dl
jne 0x14013e9db
inc r8
mov r9b, byte [r8]
test r9b, r9b
jne 0x14013e9a0
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140010c40
add rsp, 0x58
ret
mov rax, r8
jmp 0x14013e9c9
call fcn.140005d50
int3
Function at 0x14000a550
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400e59fc
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1400e5760

Function at 0x14000ab60
Capabilities:
Terminate process

Disassembly:
jmp 0x1400e514c
sub rsp, 0x28
mov ecx, 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
test eax, eax
je 0x1400e5165
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
lea ecx, [r8 + 1]
call fcn.1400046d0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x140001300
Capabilities:
Delete registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14000c208]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, rdx
mov rbx, rcx
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rsi, r8
xor dil, dil
call qword [sym.imp.Qt5Core.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_QString::toStdWString_void____ptr64]
cmp qword [rax + 0x18], 8
jb 0x14000133b
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rdx, qword [rsp + 0x38]
mov ebx, eax
cmp rdx, 8
jb 0x14000138e
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001389
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001389
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004d70
test ebx, ebx
jne 0x140001397
mov dil, 1
jmp 0x1400013a1
mov rdx, rsi
mov ecx, ebx
call fcn.140001260
movzx eax, dil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140004e90
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140001590
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x498
mov rax, qword [0x14000c208]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x34], 0
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_void____ptr64]
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x38], 0x400
lea rdx, [rsp + 0x58]
mov rcx, rsi
call qword [sym.imp.Qt5Core.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_QString::toStdWString_void____ptr64]
cmp qword [rax + 0x18], 8
jb 0x1400015f5
mov rax, qword [rax]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140001667
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001662
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001662
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004d70
test ebx, ebx
jne 0x14000170a
cmp dword [rsp + 0x3c], 1
jne 0x1400016a0
lea r8d, [rbx - 1]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const____ptr64__int_]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::operator_class_QString____ptr64____ptr64]
lea rcx, [rsp + 0x40]
jmp 0x140001704
mov r9d, 0xffffffff
xor r8d, r8d
lea rdx, str.Registry_value__1_is_not_a_string
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QObject::tr_char_const____ptr64__char_const____ptr64__int_]
mov rbx, rax
mov dl, 0x20
lea rcx, [rsp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_struct_QLatin1Char____ptr64]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
mov r8, rsi
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::arg_class_QString_const____ptr64__int__class_QChar____ptr64]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::operator_class_QString____ptr64____ptr64]
lea rcx, [rsp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov rax, rdi
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140004e90
add rsp, 0x498
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001b60
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x14000c208]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, rdx
mov rbp, rcx
mov rcx, rax
lea rdx, [rsp + 0x30]
mov rsi, r9
mov rbx, r8
xor dil, dil
call qword [sym.imp.Qt5Core.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_QString::toStdWString_void____ptr64]
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x140001ba2
mov rdx, qword [rax]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140001bb0
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [rsp + 0x48]
mov ebx, eax
cmp rdx, 8
jb 0x140001c25
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c20
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004d70
test ebx, ebx
jne 0x140001c2e
mov dil, 1
jmp 0x140001c38
mov rdx, rsi
mov ecx, ebx
call fcn.140001260
movzx eax, dil
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140004e90
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140004930
Capabilities:
Get user security identifier

Disassembly:
mov r11, rsp
push rbx
push rsi
push r12
push r14
push r15
sub rsp, 0x50
xor r12d, r12d
xor bl, bl
mov dword [r11 + 0x20], r12d
mov rsi, r8
mov dword [r11 + 0x18], r12d
mov r15d, edx
mov r14, rcx
test r8, r8
je 0x140004a60
lea rax, [r11 - 0x38]
mov rdx, rcx
mov qword [r11 - 0x48], rax
lea r9, [r11 + 0x20]
lea rax, [r11 + 0x18]
xor r8d, r8d
mov qword [r11 - 0x50], rax
xor ecx, ecx
mov qword [r11 - 0x58], r12
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x140004a60
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140004a60
mov ecx, dword [rsp + 0x98]
mov qword [rsp + 0x88], rdi
call fcn.140003e90
mov rdi, rax
test rax, rax
je 0x140004a5b
mov ecx, dword [rsp + 0x90]
mov qword [rsp + 0x80], rbp
call fcn.140003ec0
mov rbp, rax
test rax, rax
je 0x140004a3b
lea rax, [rsp + 0x40]
mov r8, rdi
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x98]
lea rax, [rsp + 0x90]
mov rdx, r14
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x140004a33
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140004a28
cmp dword [rsp + 0x40], r15d
jne 0x140004a28
mov qword [rsi], rdi
mov bl, 1
jmp 0x140004a33
mov rcx, rdi
mov qword [rsi], r12
call fcn.140004900
mov rcx, rbp
call fcn.140004900
mov rbp, qword [rsp + 0x80]
movzx eax, bl
mov rdi, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop r12
pop rsi
pop rbx
ret
movzx eax, bl
jmp 0x140004a46
movzx eax, bl
add rsp, 0x50
pop r15
pop r14
pop r12
pop rsi
pop rbx
ret

Function at 0x140004a90
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x14000c208]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x140004b20
xor ebx, ebx
lea rax, [rsp + 0x40]
mov dword [rsp + 0x38], ebx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x44]
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140004b19
test byte [rsp + 0x40], 8
je 0x140004b19
mov eax, ebx
jmp 0x140004b26
mov eax, 0x643
jmp 0x140004b26
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140004e90
add rsp, 0x270
pop rbx
ret
Function at 0x1800028f0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x18000291e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1800049b0
cmp byte [0x1800697b0], 0
jne 0x180002969
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180002959
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x1800697b0], 1
mov qword [0x1800697a8], rax
jmp 0x180002970
mov rax, qword [0x1800697a8]
mov byte [0x1800697b0], 1
jmp 0x180002970
mov rax, qword [0x1800697a8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x18000298f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x180004a24
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x180004a3f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x180004a3f
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x180004a3f
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
add byte [rax], al
and dword [rax], 0x20000000
invalid
Function at 0x180003500
Capabilities:
Create thread

Disassembly:
cmp byte [rcx + 0x18], 1
je 0x18000351f
mov qword [rcx + 8], rdx
mov byte [rcx + 0x18], 1
mov r8, rcx
lea rcx, [0x180003db0]
xor edx, edx
jmp fcn.180019114
ret
Function at 0x180004710
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1800677c0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor eax, eax
xor ebp, ebp
mov rsi, rdx
mov r8, rdx
mov rdx, qword [rcx]
mov rdi, rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x40]
or r9d, 0x2001f
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x50], rbp
call fcn.180003dd0
mov ebx, eax
test eax, eax
jne 0x180004837
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x58], pe_nt_image_headers64
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180004811
nop dword [rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.180004710
mov ebx, eax
test eax, eax
jne 0x180004837
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x58], pe_nt_image_headers64
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1800047c0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180004826
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x48], ebp
call fcn.1800028f0
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180004847
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180019ba0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800049b0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x18000291e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1800049b0
cmp byte [0x1800697b0], 0
jne 0x180002969
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180002959
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x1800697b0], 1
mov qword [0x1800697a8], rax
jmp 0x180002970
mov rax, qword [0x1800697a8]
mov byte [0x1800697b0], 1
jmp 0x180002970
mov rax, qword [0x1800697a8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x18000298f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x180004a24
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x180004a3f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x180004a3f
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x180004a3f
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
add byte [rax], al
and dword [rax], 0x20000000
invalid
Function at 0x180004c40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1800677c0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x50], r14
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], r14
xor edx, edx
mov r8d, 0x408
lea rcx, [rsp + 0x70]
call fcn.180019cb0
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x180004cec
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x180004cec
call fcn.1800020e0
mov ebx, eax
jmp 0x180004e14
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x180004d0d
call fcn.1800020e0
jmp 0x180004e03
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x180004d30
call fcn.1800020e0
jmp 0x180004e03
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x180004d52
mov ebx, 0x8007000e
jmp 0x180004e05
mov ecx, eax
test eax, eax
je 0x180004d8a
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x180004d80
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x180004d8a
lea rcx, [rsp + 0x70]
call fcn.180001fc0
jmp 0x180004d94
mov ecx, 0x80070216
call fcn.1800022f0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x180004da7
cmp qword [rsp + 0x70], 0
jne 0x180004db6
mov ebx, 0x8007000e
jmp 0x180004e05
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x180004de0
call fcn.1800020e0
jmp 0x180004e03
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.180004a60
mov ebx, eax
test rdi, rdi
je 0x180004e14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x180004e2b
lea rcx, [rsp + 0x70]
call fcn.1800029e0
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.180019ba0
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret