joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180009810
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
push rbp
push rsi
push r14
lea rbp, [r11 - 0x78]
sub rsp, 0x160
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov qword [r11 - 0x20], rdi
mov r14, r8
mov qword [r11 - 0x28], r12
movzx esi, r9w
movzx r8d, dx
xor r12d, r12d
mov rdx, rcx
mov qword [rsp + 0x20], r12
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x7380166f
mov edi, 1
mov dword [rsp + 0x2c], 0x4914b2b9
mov dword [rsp + 0x30], 0x172442d7
mov dword [rsp + 0x34], 0xda8a0600
mov dword [rsp + 0x38], 0xa96f30bc
mov dword [rsp + 0x3c], 0x163138aa
mov dword [rsp + 0x40], 0xe38dee4d
mov dword [rsp + 0x44], 0xb0fb0e4e
call fcn.180048d50
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x20]
call fcn.180048e40
cmp si, 0x20
jbe 0x180009985
mov qword [rsp + 0x198], rbx
lea eax, [rsi - 0x21]
mov qword [rsp + 0x148], r13
mov r13d, 0xffe0
shr ax, 5
inc ax
mov qword [rsp + 0x140], r15
movzx r15d, ax
movsxd rax, edi
lea ebx, [rdi + 1]
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x20], r12
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x7380166f
mov dword [rsp + 0x2c], 0x4914b2b9
xor byte [rbp + rax + 0x10], dil
not edi
mov dword [rsp + 0x30], 0x172442d7
mov dword [rsp + 0x34], 0xda8a0600
mov dword [rsp + 0x38], 0xa96f30bc
lea r8d, [rdi + 0x20]
mov dword [rsp + 0x3c], 0x163138aa
mov dword [rsp + 0x40], 0xe38dee4d
mov dword [rsp + 0x44], 0xb0fb0e4e
call fcn.180048d50
mov rdx, r14
lea rcx, [rsp + 0x20]
call fcn.180048e40
add r14, 0x20
add si, r13w
cmp ebx, 0x1e
mov edi, r12d
cmovl edi, ebx
sub r15, 1
jne 0x1800098e1
mov r15, qword [rsp + 0x140]
mov r13, qword [rsp + 0x148]
mov rbx, qword [rsp + 0x198]
mov rdi, qword [rsp + 0x158]
cmp r12w, si
mov r12, qword [rsp + 0x150]
jae 0x1800099ab
movzx r8d, si
lea rdx, [rbp + 0x10]
mov rcx, r14
call fcn.180112cb0
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x160
pop r14
pop rsi
pop rbp
ret

Function at 0x1800099d5
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x180009a4f
sub rsp, 0x28
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x18], rax
movups xmm0, xmmword [str.0123456789:____]
movzx eax, byte [0x180154a48]
mov r9, rdx
mov byte [rsp + 0x10], al
movups xmmword [rsp], xmm0
mov r8d, r8d
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r9]
lea rcx, [rcx + 2]
xor rdx, 0x58
lea r9, [r9 + 1]
mov rax, rdx
and edx, 0xf
shr rax, 4
movzx eax, byte [rsp + rax]
mov byte [rcx - 2], al
movzx eax, byte [rsp + rdx]
mov byte [rcx - 1], al
sub r8, 1
jne 0x180009a10
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x28
ret
Function at 0x180009a50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x18], rax
movzx eax, byte [0x180154a60]
xor r9d, r9d
movups xmm0, xmmword [0x180154a50]
mov byte [rsp + 0x10], al
mov esi, edx
mov rdi, rcx
mov ebx, r9d
movups xmmword [rsp], xmm0
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], bl
jne 0x180009a96
cmp rax, 1
jbe 0x180009b18
mov r10, r9
cmp r9d, esi
jae 0x180009b18
movzx eax, byte [r10 + r8]
mov r11d, r9d
sub al, 0x30
mov byte [r11 + rdi], 0
cmp al, 0x10
jae 0x180009ad0
movzx eax, al
movzx edx, byte [rsp + rax]
shl dl, 4
mov byte [r11 + rdi], dl
jmp 0x180009ad2
xor dl, dl
movzx eax, byte [r10 + r8 + 1]
sub al, 0x30
cmp al, 0x10
jae 0x180009af1
movzx eax, al
movzx ecx, byte [rsp + rax]
and cl, 0xf
or cl, dl
xor cl, 0x58
mov byte [r11 + rdi], cl
add ebx, 2
add r10, 2
inc r9d
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [r8 + rcx], 0
jne 0x180009b02
movsxd rdx, ebx
sub rcx, rdx
cmp rcx, 1
ja 0x180009aa8
mov eax, r9d
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18000bd40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x450], rax
test r8d, r8d
mov qword [rsp + 0x30], 0
mov edi, 2
mov dword [rsp + 0x28], 0x80
mov eax, 4
mov rbx, rdx
cmove eax, edi
mov edx, 0xc0000000
xor r9d, r9d
mov dword [rsp + 0x20], eax
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000be6d
xor edx, edx
lea rcx, [rsp + 0x150]
mov r8d, 0x300
call fcn.180113150
lea rcx, [rsp + 0x50]
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
lea rbx, [rbx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rbx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rbx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rbx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rbx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rbx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rbx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdi, 1
jne 0x18000bdd0
xor edx, edx
lea rcx, [rsp + 0x50]
call sym.SafeBase64.dll_Ordinal_39
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rdi
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x18000be66
cmp dword [rsp + 0x40], 0x400
jb 0x18000be6d
mov eax, 1
jmp 0x18000be6f
xor eax, eax
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18000bea0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x460
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov rbx, rdx
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000bfc8
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x40], 0x400
jne 0x18000bfc8
cmp dword [rsp + 0x50], 0x4d524418
jne 0x18000bfc8
cmp dword [rsp + 0x54], 0xc4cedcc3
jne 0x18000bfc8
cmp word [rsp + 0x5c], 0
je 0x18000bfc8
xor edx, edx
lea rcx, [rsp + 0x50]
call sym.SafeBase64.dll_Ordinal_40
test eax, eax
je 0x18000bfc8
lea rax, [rsp + 0x50]
mov ecx, 2
nop dword [rax]
lea rbx, [rbx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rbx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rbx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rbx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rbx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rbx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rbx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rbx - 0x20], xmm0
movups xmmword [rbx - 0x10], xmm1
sub rcx, 1
jne 0x18000bf70
lea eax, [rcx + 1]
jmp 0x18000bfca
xor eax, eax
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x480]
add rsp, 0x460
pop rdi
ret
Function at 0x18000c2e0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x278
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor edi, edi
mov ebx, r9d
mov rbp, r8
mov qword [rsp + 0x30], rdi
mov r15, rdx
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov dword [rsp + 0x20], 3
lea r8d, [rdi + 3]
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000c365
mov r14, qword [rsp + 0x2d0]
xor r9d, r9d
mov rdx, r14
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, rsi
cmp eax, 0xffffffff
jne 0x18000c387
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x278
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rdi
mov r8d, ebx
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x18000c365
cmp dword [rsp + 0x40], ebx
jb 0x18000c365
mov qword [rsp + 0x268], r13
movzx r13d, word [r15 + 0xca]
add r15, 0xa0
test r14, r14
jne 0x18000c432
cmp ebx, 0x100
jb 0x18000c4ed
cmp dword [rbp], 0x4d524418
jne 0x18000c4ed
cmp dword [rbp + 4], 0xc4cedcc3
jne 0x18000c4ed
cmp word [rbp + 0xc], r14w
je 0x18000c4ed
mov rdx, r15
mov rcx, rbp
call sym.SafeBase64.dll_Ordinal_47
test eax, eax
je 0x18000c4ed
lea r15, [rbp + 0xa0]
cmp ebx, 0x1000
jb 0x18000c4ed
add rbp, 0x1000
add ebx, 0xfffff000
mov ecx, 0x200
and r14d, 0x1ff
je 0x18000c4b8
lea eax, [r14 + rbx]
mov qword [rsp + 0x270], r12
mov r12d, ebx
cmp eax, ecx
jb 0x18000c45e
mov eax, ecx
sub eax, r14d
cmp eax, ebx
cmovbe r12d, eax
mov eax, r14d
lea rdi, [rsp + 0x50]
add rdi, rax
mov r8d, r12d
mov rcx, rdi
mov esi, r12d
mov rdx, rbp
call fcn.180112cb0
mov r9d, 0x20
mov dword [rsp + 0x20], r13d
mov r8, r15
lea rcx, [rsp + 0x50]
mov edx, 0x200
call sym.SafeBase64.dll_Ordinal_24
mov r8d, r12d
mov rdx, rdi
mov rcx, rbp
call fcn.180112cb0
add rbp, rsi
mov ecx, 0x200
sub ebx, r12d
mov r12, qword [rsp + 0x270]
test ebx, ebx
je 0x18000c4ed
nop dword [rax]
cmp ebx, ecx
mov dword [rsp + 0x20], r13d
mov edi, ebx
mov r9d, 0x20
cmova edi, ecx
mov r8, r15
mov edx, edi
mov rcx, rbp
call sym.SafeBase64.dll_Ordinal_24
mov eax, edi
mov ecx, 0x200
add rbp, rax
sub ebx, edi
jne 0x18000c4c0
mov r13, qword [rsp + 0x268]
mov eax, 1
jmp 0x18000c367
Function at 0x18000c610
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, r8d
mov ebx, edx
xor edx, edx
mov r8d, 0x1000
mov r14, r9
mov r15, rcx
call fcn.180113150
movzx edx, bx
mov rcx, r15
call sym.SafeBase64.dll_Ordinal_37
lea rcx, [rsp + 0x20]
mov dword [r15 + 0x100], edi
call qword [sym.imp.RPCRT4.dll_UuidCreate]
xor esi, esi
test eax, eax
je 0x18000c6b0
xor ecx, ecx
call fcn.18011ab34
mov rcx, rax
call fcn.18011aa84
mov ebx, esi
lea rdi, [rsp + 0x20]
call fcn.18011aa58
imul ecx, eax, 0xff
mov eax, 0x20005
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0xe
mov byte [rdi], cl
test cl, cl
jne 0x18000c6a6
lea eax, [rbx + 1]
mov byte [rdi], al
inc ebx
inc rdi
cmp ebx, 0x10
jb 0x18000c680
lea rdi, [rsp + 0x20]
mov ebp, 0x10
lea rbx, [r15 + 0x1d0]
movzx r8d, byte [rdi]
lea rdx, str._02x
mov rcx, rbx
call fcn.180010dc0
add rbx, 2
lea rdi, [rdi + 1]
sub rbp, 1
jne 0x18000c6c1
mov byte [rbx], sil
test r14, r14
je 0x18000c772
mov eax, dword [rsp + 0x90]
mov ecx, 0x20
cmp eax, ecx
mov rdx, r14
cmova ax, cx
lea rcx, [r15 + 0xe0]
movzx r8d, ax
mov word [r15 + 0xce], r8w
call fcn.180112cb0
movzx eax, word [r15 + 0xce]
lea ecx, [rbp + 1]
cmp si, ax
jae 0x18000c766
movzx r8d, ax
nop
movzx eax, byte [r14]
lea r14, [r14 + 1]
add ecx, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov eax, 0x80078071
add esi, ecx
mul esi
shr edx, 0xf
imul eax, edx, 0xfff1
sub esi, eax
sub r8, 1
jne 0x18000c730
shl esi, 0x10
or esi, ecx
mov dword [r15 + 0xd0], esi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000c7e0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
movzx eax, word [rcx + 0xe]
lea r8, [rcx + 0x10]
mov rdi, rdx
mov dword [rsp + 0x20], eax
mov rbx, rcx
mov edx, 0xd50
add rcx, 0x2b0
mov r9d, 0x20
call sym.SafeBase64.dll_Ordinal_24
mov rcx, rbx
call fcn.18000c500
cmp dword [rbx + 0xe00], eax
je 0x18000c830
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp sym.SafeBase64.dll_Ordinal_40
Function at 0x18000e040
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
mov eax, 0x1050
call fcn.180110950
sub rsp, rax
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rbx, r8
mov rdi, rcx
mov r8d, 0x1000
lea rcx, [rsp + 0x40]
call fcn.180112cb0
mov rdx, rbx
lea rcx, [rsp + 0x40]
call sym.SafeBase64.dll_Ordinal_39
lea rcx, [rsp + 0x40]
call fcn.18000c500
mov dword [rsp + 0xe40], eax
lea r8, [rsp + 0x50]
movzx eax, word [rsp + 0x4e]
lea rcx, [rsp + 0x2f0]
mov r9d, 0x20
mov dword [rsp + 0x20], eax
mov edx, 0xd50
call sym.SafeBase64.dll_Ordinal_23
xor ebx, ebx
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000e0f0
cmp dword [rsp + 0x30], 0x1000
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x1078]
add rsp, 0x1050
pop rdi
ret

Function at 0x18000e120
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, r8
mov qword [rsp + 0x20], 0
mov r8d, 0x1000
lea r9, [rsp + 0x30]
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0x30], 0x1000
jb 0x18000e19d
cmp dword [rbx], 0x4d524418
jne 0x18000e19d
cmp dword [rbx + 4], 0xc4cedcc3
jne 0x18000e19d
mov eax, 0xf100
test word [rbx + 0xc], ax
je 0x18000e19d
mov rdx, rdi
mov rcx, rbx
call sym.SafeBase64.dll_Ordinal_47
test eax, eax
mov ecx, 0xffffffff
mov edx, 1
cmovne ecx, edx
mov eax, ecx
jmp 0x18000e19f
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18000e1c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x1060
call fcn.180110950
sub rsp, rax
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x1050], rax
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov rbx, rdx
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000e28f
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, 0x1000
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x40], 0x1000
jb 0x18000e28f
cmp dword [rsp + 0x50], 0x4d524418
jne 0x18000e28f
cmp dword [rsp + 0x54], 0xc4cedcc3
jne 0x18000e28f
mov ecx, 0xf100
test word [rsp + 0x5c], cx
je 0x18000e28f
movaps xmm0, xmmword [rsp + 0x220]
mov eax, 1
movaps xmm1, xmmword [rsp + 0x230]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
jmp 0x18000e291
xor eax, eax
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x1080]
add rsp, 0x1060
pop rdi
ret
Function at 0x18000e2c0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x7a0]
sub rsp, 0x8a0
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rbp + 0x790], rax
mov rsi, rdx
lea rax, [rsp + 0x40]
mov r14, rcx
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
mov rcx, 0xffffffff80000002
mov r9d, 0x20119
xor r8d, r8d
mov edi, 0xffffffff
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000e515
mov qword [rsp + 0x8c8], rbx
lea rcx, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x8d0], r15
mov r8d, 0x208
call fcn.180113150
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x50]
xor r15d, r15d
mov dword [rsp + 0x50], 0x104
mov qword [rsp + 0x38], r15
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r15
lea ebx, [rdi + 2]
mov qword [rsp + 0x28], r15
xor edx, edx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x18000e4fa
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x370]
mov r8d, 0x20a
call fcn.180113150
lea rax, [rsp + 0x60]
mov edx, 0x104
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
mov qword [rsp + 0x20], rax
lea r8, [0x180154c70]
lea rcx, [rbp + 0x370]
call fcn.18000f870
lea rax, [rsp + 0x48]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x370]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000e4b8
xor edx, edx
lea rcx, [rbp + 0x580]
mov r8d, 0x208
call fcn.180113150
xor edx, edx
mov dword [rsp + 0x58], 0x104
mov r8d, 0x200
lea rcx, [rbp + 0x170]
call fcn.180113150
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x58]
lea rax, [rbp + 0x170]
mov dword [rsp + 0x54], 0x100
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x580]
mov qword [rsp + 0x28], r15
xor edx, edx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, r14
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x18000e4b8
lea rax, [rbp + 0x170]
mov r8, rsi
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x18000e4b4
add rax, 2
test ecx, ecx
jne 0x18000e4a0
test edx, edx
je 0x18000e4f7
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x38], r15
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r15
mov edx, ebx
mov qword [rsp + 0x28], r15
inc ebx
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x50], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x18000e390
jmp 0x18000e4fa
lea edi, [rbx - 1]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15, qword [rsp + 0x8d0]
mov rbx, qword [rsp + 0x8c8]
mov eax, edi
mov rcx, qword [rbp + 0x790]
xor rcx, rsp
call fcn.18010faf0
mov rsi, qword [rsp + 0x8d8]
add rsp, 0x8a0
pop r14
pop rdi
pop rbp
ret
Function at 0x18000eeb0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x2f0
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
xor r14d, r14d
mov rbp, rcx
mov edi, r14d
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x18000ef49
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
mov rcx, rsi
test eax, eax
je 0x18000ef05
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x18000ef49
lea rdx, str.DllRegisterServer
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x18000ef28
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call qword [sym.imp.ole32.dll_OleUninitialize]
jmp 0x18000ef49
call rax
mov ebx, eax
call qword [sym.imp.ole32.dll_OleUninitialize]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
sete dil
test ebx, ebx
je 0x18000f030
xor edx, edx
lea rcx, [rsp + 0xe0]
mov r8d, 0x200
call fcn.180113150
mov r8, rbp
lea rdx, str.regsvr32__s___s_
lea rcx, [rsp + 0xe0]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
mov dword [rsp + 0x68], r14d
lea rcx, [rsp + 0x74]
lea r8d, [rdx + 0x64]
call fcn.180113150
xor eax, eax
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x58], rax
xor r9d, r9d
mov qword [rsp + 0x60], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x18000f030
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x18000f030
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x68], r14d
mov eax, 1
cmovge edi, eax
mov eax, edi
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18000f470
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18000f4e5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x18000f4e5
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x18000f4d5
nop
cmp rbx, rcx
jae 0x18000f4e5
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x18000f4c0
cmp rbx, rcx
jae 0x18000f4e5
cmp word [rbx], 0
je 0x18000f4e5
mov rax, rbx
jmp 0x18000f4e7
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18000f500
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov eax, r8d
mov rsi, rdx
shr eax, 4
mov edi, r8d
inc ax
mov r14, rcx
movzx edx, ax
mov r8d, 6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x18000f620
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18000f620
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x18000f620
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x18000f5a9
nop word [rax + rax]
cmp rbx, rcx
jae 0x18000f620
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x18000f590
cmp rbx, rcx
jae 0x18000f620
movzx edi, word [rbx]
test di, di
je 0x18000f620
mov r10, qword [r14]
mov ecx, 1
movzx esi, di
movzx edx, di
mov eax, dword [r10 - 0xc]
sub ecx, dword [r10 - 8]
sub eax, esi
or ecx, eax
jge 0x18000f5e2
mov edx, esi
mov rcx, r14
call fcn.180007df0
mov r10, qword [r14]
movzx edx, word [rbx]
lea r8, [rbx + 2]
movzx r9d, dx
movzx ebx, di
mov rcx, r10
mov edx, ebx
call fcn.18011abd4
xor edx, edx
test eax, eax
je 0x18000f607
cmp eax, 0xc
je 0x18000f643
cmp eax, 0x50
jne 0x18000f63d
mov rcx, qword [r14]
cmp esi, dword [rcx - 0xc]
jg 0x18000f649
mov dword [rcx - 0x10], esi
mov eax, 1
mov rcx, qword [r14]
mov word [rcx + rbx*2], dx
jmp 0x18000f622
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call fcn.1800f389c
int3
call fcn.1800f38c0
int3
mov ecx, 0x80070057
call fcn.180007f70
int3