joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800017d0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x1800260a0], 0
mov rdi, rdx
mov rbx, rcx
jne 0x18000182b
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000181b
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x1800260a0], 1
mov qword [0x180026098], rax
jmp 0x180001832
mov rax, qword [0x180026098]
mov byte [0x1800260a0], 1
jmp 0x180001832
mov rax, qword [0x180026098]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x180001851
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]

Function at 0x180001870
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x1800018b0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x30
mov rsi, r8
mov rbp, rdx
mov r12, rcx
test r8, r8
jne 0x1800018e3
lea eax, [r8 + 0xd]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
xor edi, edi
mov rbx, r8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea rbx, [rbx + rax*2]
lea edi, [rdi + rax*2]
cmp eax, 1
jne 0x1800018f2
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x180001fc0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ecx, ecx
call fcn.18000c5a0
lea r8, [rsp + 0x48]
lea rdx, str.SoftwareComplitly
mov rcx, 0xffffffff80000001
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x18000202f
mov rcx, qword [rsp + 0x48]
lea eax, [rbx + 0x127500]
lea rdx, str.LastUpdateTime
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret
Function at 0x180002040
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ecx, ecx
call fcn.18000c5a0
lea r8, [rsp + 0x48]
lea rdx, str.SoftwareComplitly
mov rcx, 0xffffffff80000001
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1800020a9
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, str.LastUpdateTime
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret

Function at 0x1800020b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea r8, [rsp + 0x58]
lea rdx, str.SoftwareComplitly
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x180002133
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.LastUpdateTime
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0x30]
jne 0x180002133
mov eax, dword [rsp + 0x50]
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret
Function at 0x180002270
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x180024a58]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov edi, dword [rcx + 8]
xor eax, eax
mov rsi, rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
or edi, 0x2001f
xor r8d, r8d
mov r9d, edi
mov rbp, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x1800023bc
test rcx, rcx
je 0x1800022e5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
and edi, 0x300
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], edi
test ebx, ebx
jne 0x1800023bc
xor edi, edi
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180002391
nop word [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.180002270
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x1800023bc
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x180002340
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1800023a6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rdi
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x50], edi
call fcn.1800017d0
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test rcx, rcx
je 0x1800023c7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.18000c3f0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800026f0
Capabilities:
Create http request
Get http content length
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
xor r12d, r12d
mov rax, r8
mov rsi, rdx
mov rbx, rcx
mov qword [rcx], r12
mov qword [rcx + 8], r12
lea edx, [r12 + 1]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbp, rax
test rax, rax
je 0x1800027e8
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x84000100
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rsi, rax
test rax, rax
je 0x1800027df
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x78]
lea r8, [rbx + 8]
mov edx, 0x20000005
mov rcx, rsi
mov dword [rsp + 0x78], 8
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], r12d
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x1800027d6
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800027d6
call fcn.18000bfc0
mov qword [rbx], rax
test rax, rax
je 0x1800027d6
mov r8d, dword [rbx + 8]
lea r9, [rsp + 0x30]
mov rdx, rax
mov rcx, rsi
mov dword [rsp + 0x30], r8d
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1800027d6
mov rcx, qword [rbx]
call fcn.18000c078
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rbp, qword [rsp + 0x70]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x180003ba0
Capabilities:
Get file version info

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x28
xor esi, esi
cmp qword [rcx + 0x20], 8
mov rdi, rcx
jb 0x180003bc0
lea rbx, [rcx + 8]
mov rcx, qword [rcx + 8]
jmp 0x180003bc7
lea rbx, [rcx + 8]
mov rcx, rbx
lea rdx, [rsp + 0x58]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov r12d, eax
test eax, eax
jne 0x180003be2
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, r12
mov qword [rsp + 0x20], rbp
call fcn.18000bfc0
mov rbp, rax
test rax, rax
jne 0x180003c06
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp qword [rdi + 0x20], 8
jb 0x180003c10
mov rbx, qword [rbx]
mov r9, rax
mov r8d, r12d
xor edx, edx
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x180003c63
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x60]
lea rdx, [0x18001be84]
mov rcx, rbp
mov dword [rsp + 0x50], 8
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x180003c63
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x180003c63
mov ecx, dword [rax + 0x10]
lea esi, [rcx + rcx*4]
movzx ecx, cx
add esi, esi
shr esi, 0x10
add esi, ecx
mov rcx, rbp
call fcn.18000c078
mov rbp, qword [rsp + 0x20]
mov eax, esi
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x180005cb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x4b0], rbx
mov rax, qword [0x180024a58]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rsi, r9
mov rbx, r8
mov rax, rdx
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x70], r12
xor edx, edx
lea r8d, [r12 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x180005d28
call fcn.1800017a0
mov ebx, eax
jmp 0x180005e6a
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x180005d4b
call fcn.1800017a0
mov ebx, eax
jmp 0x180005e60
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x180005d70
call fcn.1800017a0
mov ebx, eax
jmp 0x180005e60
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x180005da9
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x180005d9f
lea rcx, [rsp + 0x70]
call fcn.180002170
nop
mov eax, 0x8007000e
jmp 0x180005e83
mov ecx, eax
test eax, eax
je 0x180005de6
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x180005ddc
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x180005de6
lea rcx, [rsp + 0x70]
call fcn.1800021a0
mov rax, qword [rsp + 0x70]
jmp 0x180005df0
mov ecx, 0x80070057
call fcn.1800016e0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x180005e08
test rax, rax
jne 0x180005e14
mov ebx, 0x8007000e
jmp 0x180005e60
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x180005e3b
call fcn.1800017a0
mov ebx, eax
jmp 0x180005e60
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r12w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1800051c0
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x180005e81
lea rcx, [rsp + 0x70]
call fcn.180002170
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.18000c3f0
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret
Function at 0x180006540
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x260
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x278], rbx
mov rax, qword [0x180024a58]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor eax, eax
mov dword [rsp + 0x20], eax
mov qword [rcx + 0x20], 7
mov qword [rcx + 0x18], rax
mov word [rcx + 8], ax
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1800065e2
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180006240
mov r8d, 0x13
lea rdx, str.BHOUpdater.restart
mov rcx, rbx
call fcn.180005870
mov rax, rbx
jmp 0x1800065e5
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18000c3f0
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret

Function at 0x180007080
Capabilities:
Delete file
Write file on windows

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x180024a58]
xor rax, rsp
mov qword [rsp + 0x98], rax
test cl, cl
jne 0x1800070ec
lea rcx, [rsp + 0x48]
call fcn.180006540
cmp qword [rax + 0x20], 8
jb 0x1800070b4
mov rcx, qword [rax + 8]
jmp 0x1800070b8
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [rsp + 0x68], 8
jb 0x1800071d3
mov rcx, qword [rsp + 0x50]
call fcn.18000b39c
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.18000c3f0
add rsp, 0xa8
ret
lea rcx, [rsp + 0x48]
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xa0], rdi
call fcn.180006540
cmp qword [rax + 0x20], 8
jb 0x180007113
mov rcx, qword [rax + 8]
jmp 0x180007117
lea rcx, [rax + 8]
xor edi, edi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov edx, 0x1f01ff
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp qword [rsp + 0x68], 8
mov rbx, rax
jb 0x180007150
mov rcx, qword [rsp + 0x50]
call fcn.18000b39c
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x50], di
cmp rbx, 0xffffffffffffffff
je 0x1800071c3
lea rcx, [rsp + 0x70]
call fcn.180007000
cmp qword [rsp + 0x90], 8
mov r8d, dword [rsp + 0x88]
lea rdx, [rsp + 0x78]
lea r9, [rsp + 0x40]
mov rcx, rbx
cmovae rdx, qword [rsp + 0x78]
add r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x90], 8
jb 0x1800071c3
mov rcx, qword [rsp + 0x78]
call fcn.18000b39c
mov rbx, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.18000c3f0
add rsp, 0xa8
ret
Function at 0x180008a00
Capabilities:
Create thread

Disassembly:
push rbp
push r12
push r13
sub rsp, 0x20
mov r12, r9
mov r13, r8
mov r10, rdx
mov rbp, rcx
test r9, r9
jne 0x180003a8a
mov eax, 0x80004003
add rsp, 0x20
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x48], rsi
xor esi, esi
mov qword [r9], rsi
test rcx, rcx
jne 0x180003aad
mov eax, 0x80070057
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r13
pop r12
pop rbp
ret
cmp dword [rcx], esi
jne 0x180003ac5
mov eax, 0x8000ffff
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r13
pop r12
pop rbp
ret
mov rcx, qword [rcx + 0x10]
mov r8, qword [rbp + 0x18]
mov qword [rsp + 0x40], rbx
cmp rcx, r8
jae 0x180003b7f
nop dword [rax + rax]
mov rbx, qword [rcx]
test rbx, rbx
je 0x180003b13
cmp qword [rbx + 0x10], rsi
je 0x180003b13
mov rdx, qword [rbx]
mov eax, dword [rdx]
cmp dword [r10], eax
jne 0x180003b13
mov eax, dword [rdx + 4]
cmp dword [r10 + 4], eax
jne 0x180003b13
mov eax, dword [rdx + 8]
cmp dword [r10 + 8], eax
jne 0x180003b13
mov eax, dword [rdx + 0xc]
cmp dword [r10 + 0xc], eax
je 0x180003b1e
add rcx, 8
cmp rcx, r8
jb 0x180003ae0
jmp 0x180003b7f
mov qword [rsp + 0x50], rdi
cmp qword [rbx + 0x20], rsi
jne 0x180003b57
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [rbx + 0x20], rsi
jne 0x180003b4d
mov rcx, qword [rbx + 0x18]
lea r8, [rbx + 0x20]
lea rdx, [0x18001be68]
call qword [rbx + 0x10]
mov esi, eax
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp qword [rbx + 0x20], 0
je 0x180003b6f
mov rcx, qword [rbx + 0x20]
mov r8, r12
mov rdx, r13
mov rax, qword [rcx]
call qword [rax]
mov esi, eax
cmp qword [r12], 0
mov rdi, qword [rsp + 0x50]
jne 0x180003b84
test esi, esi
jne 0x180003b84
mov esi, 0x80040111
mov rbx, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [0x180026090], 0
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
jne 0x180008a81
mov ecx, 0x60
mov qword [rsp + 0x40], rbx
call fcn.18000c99c
test rax, rax
je 0x180008a4a
mov rdx, qword [0x180026088]
mov rcx, rax
call fcn.180006a80
mov rbx, rax
jmp 0x180008a4c
xor ebx, ebx
lea r8, [0x1800086d0]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov qword [0x180026090], rbx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
mov rbx, qword [rsp + 0x40]
lea rcx, [0x180026120]
mov r9, rdi
mov r8, rsi
mov rdx, rbp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp 0x180003a60
Function at 0x180008af0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
sub rsp, 0x60
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareComplitly
xor ebx, ebx
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jne 0x180008b72
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareComplitly
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x180008bd1
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x88]
lea rdx, str.FirstRun
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
xor r8d, r8d
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x80], 4
mov dword [rsp + 0x88], 3
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180008bd9
cmp dword [rsp + 0x78], 1
je 0x180008bd9
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
add rsp, 0x60
pop rbx
ret
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x78]
lea rdx, str.FirstRun
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x78], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add rsp, 0x60
pop rbx
ret

Function at 0x18000e2f4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x18000e168
Function at 0x18000fe67
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180024a58]
jne 0x18000c40a
rol rcx, 0x10
test cx, 0xffff
jne 0x18000c406
repz ret
ror rcx, 0x10
jmp 0x18000fdc0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180026680]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x180026778]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18000fe45
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180026680]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18000fe67
mov rax, qword [rsp + 0x88]
mov qword [0x180026778], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180026718], rax
mov rax, qword [0x180026778]
mov qword [0x1800265f0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180026700], rax
mov dword [0x1800265e0], 0xc0000409
mov dword [0x1800265e4], 1
mov rax, qword [0x180024a58]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180024a60]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180026678], eax
mov ecx, 1
call fcn.180010038
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18001d398]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180026678], 0
jne 0x18000feee
mov ecx, 1
call fcn.180010038
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x180014350
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.18000d814
xor ebx, ebx
mov rdi, rax
cmp qword [0x180026f78], rbx
jne 0x180014456
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x18001452b
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001452b
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180026f78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180026f80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x180026f88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x180026f98], rax
test rax, rax
je 0x18001444d
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x180026f90], rax
jmp 0x18001445d
mov rax, qword [0x180026f90]
jmp 0x180014464
mov rax, qword [0x180026f90]
mov r11, qword [0x180026f98]
cmp rax, rdi
je 0x1800144cc
cmp r11, rdi
je 0x1800144cc
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x180026f98]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1800144cc
test rax, rax
je 0x1800144cc
call rsi
test rax, rax
je 0x1800144c6
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1800144c6
test byte [rsp + 0x38], 1
jne 0x1800144cc
bts ebp, 0x15
jmp 0x18001450a
mov rcx, qword [0x180026f80]
cmp rcx, rdi
je 0x18001450a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18001450a
call rax
mov rbx, rax
test rax, rax
je 0x18001450a
mov rcx, qword [0x180026f88]
cmp rcx, rdi
je 0x18001450a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18001450a
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180026f78]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18001452b
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x18001452d
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret