joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180034570
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov rbx, rcx
mov rcx, qword [rcx + 0xd8]
xor r13d, r13d
test rcx, rcx
je 0x1800345ab
call fcn.1800a22f0
mov qword [rbx + 0xd8], r13
mov qword [rbx + 0xd0], r13
mov qword [rbx + 0xe0], r13
cmp qword [rbx + 0x40], r13
jne 0x1800345c9
mov eax, 1
jmp 0x1800347a2
lea r12, [0x1800d85c8]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], 0xffffffffffffffff
lea rdx, [rbx + 0x28]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov r9d, 3
mov r8d, 0x80000000
lea rcx, [rsp + 0x38]
call fcn.180043470
test al, al
jne 0x18003462c
mov qword [rsp + 0x38], r12
mov rcx, qword [rsp + 0x40]
cmp rcx, 0xffffffffffffffff
je 0x180034622
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1800347a2
mov rcx, qword [rsp + 0x40]
cmp rcx, 0xffffffffffffffff
je 0x18003478c
lea rdx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xffffffff
jne 0x180034664
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x180034664
mov rcx, qword [rsp + 0x40]
jmp 0x18003478c
mov esi, dword [rsp + 0x88]
shl rsi, 0x20
add rsi, rdi
lea eax, [rsi + 1]
mov edi, eax
cmp rdi, qword [rbx + 0xd0]
je 0x1800346e0
mov rbp, r13
test eax, eax
je 0x1800346c1
mov rcx, rdi
call fcn.1800a09e0
mov rbp, rax
cmp qword [rbx + 0xd0], 0
jbe 0x1800346c1
mov rdx, qword [rbx + 0xd8]
test rdx, rdx
je 0x1800346c1
mov rcx, qword [rbx + 0xd0]
mov r8, rdi
cmp rcx, rdi
cmovb r8, rcx
mov rcx, rax
call fcn.1800a2480
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
je 0x1800346d2
call fcn.1800a22f0
mov qword [rbx + 0xd8], rbp
mov qword [rbx + 0xd0], rdi
mov r8d, esi
mov rax, qword [rbx + 0xd0]
mov ecx, esi
cmp r8, rax
cmova rcx, rax
mov qword [rbx + 0xe0], rcx
xor edx, edx
mov rcx, qword [rbx + 0xd8]
call fcn.1800a3870
mov rdx, qword [rbx + 0xd8]
test rdx, rdx
je 0x18003476f
mov rcx, qword [rsp + 0x40]
cmp rcx, 0xffffffffffffffff
je 0x180034774
mov dword [rsp + 0x80], r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x80]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18003476f
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x180034755
test eax, eax
setne al
test al, al
je 0x18003476f
mov qword [rsp + 0x38], r12
mov rcx, qword [rsp + 0x40]
cmp rcx, 0xffffffffffffffff
je 0x18003476b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1800347a2
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x38], r12
cmp rcx, 0xffffffffffffffff
je 0x180034785
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1800347a2
mov qword [rsp + 0x38], r12
cmp rcx, 0xffffffffffffffff
je 0x18003479d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800347e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
sub rsp, 0x88
cmp qword [rcx + 0x40], 0
mov rbx, rcx
mov eax, 1
je 0x180034802
call fcn.180034570
mov rbp, qword [rbx + 0xe0]
test rbp, rbp
mov qword [rsp + 0x20], rbp
je 0x180034a5e
mov qword [rsp + 0x80], rsi
xor esi, esi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], r12
mov dword [rsp + 0x28], 0x454d4147
mov dword [rsp + 0x2c], 0x2d52474d
mov r8d, esi
mov rdx, rsi
mov dword [rsp + 0x30], 0x2d333231
mov dword [rsp + 0x34], 0x2d363534
mov dword [rsp + 0x38], 0x2d393837
mov dword [rsp + 0x3c], 0x2d323130
mov dword [rsp + 0x40], 0x2d353433
mov dword [rsp + 0x44], 0x2d383736
nop
nop
nop
nop
mov eax, dword [rsp + rdx*4 + 0x28]
add rdx, 1
lea ecx, [r8 + rax*2]
add r8d, 1
cmp rdx, 8
mov dword [rsp + rdx*4 + 0x24], ecx
jl 0x180034880
lea eax, [rbp + 1]
mov edi, eax
cmp rdi, qword [rbx + 0xb0]
je 0x180034907
test eax, eax
mov r12, rsi
je 0x1800348e8
mov rcx, rdi
call fcn.1800a09e0
cmp qword [rbx + 0xb0], rsi
mov r12, rax
jbe 0x1800348e8
mov rdx, qword [rbx + 0xb8]
test rdx, rdx
je 0x1800348e8
mov rcx, qword [rbx + 0xb0]
mov r8, rdi
cmp rcx, rdi
cmovb r8, rcx
mov rcx, rax
call fcn.1800a2480
mov rcx, qword [rbx + 0xb8]
test rcx, rcx
je 0x1800348f9
call fcn.1800a22f0
mov qword [rbx + 0xb8], r12
mov qword [rbx + 0xb0], rdi
mov rcx, qword [rbx + 0xb8]
mov r8, rdi
xor edx, edx
call fcn.1800a3870
mov r12, qword [rbx + 0xb8]
mov rdi, qword [rbx + 0xd8]
test r12, r12
je 0x180034a47
test rdi, rdi
je 0x180034a47
cmp ebp, 4
jb 0x180034a47
mov qword [rsp + 0x60], r14
call fcn.1800601e0
mov r11d, ebp
shr r11d, 3
mov r14d, ebp
mov ecx, r11d
and r14d, 7
test r11d, r11d
mov qword [rsp + 0xb8], rcx
jle 0x180034a02
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x58], r15
mov r15, rdi
lea r13, [r12 + 4]
mov rbx, rsi
mov rbp, rcx
sub r15, r12
nop
nop
mov eax, dword [rdi + rbx*8]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0xb0]
mov dword [rsp + 0xa8], eax
mov eax, dword [r15 + r13]
lea rcx, [rsp + 0xa8]
mov dword [rsp + 0xac], eax
call fcn.1800612d0
mov r11d, dword [rsp + 0xb0]
mov eax, dword [rsp + 0xb4]
add rbx, 1
mov dword [r13 - 4], r11d
mov dword [r13], eax
add r13, 8
cmp rbx, rbp
jl 0x180034990
mov rbx, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x20]
mov rcx, qword [rsp + 0xb8]
mov r15, qword [rsp + 0x58]
mov r13, qword [rsp + 0x68]
test r14d, r14d
jle 0x180034a22
movsxd rdx, r14d
lea rcx, [r12 + rcx*8]
sub rdi, r12
movzx eax, byte [rcx + rdi]
add rcx, 1
sub rdx, 1
mov byte [rcx - 1], al
jne 0x180034a11
mov rdx, qword [rbx + 0xb8]
mov r8d, ebp
mov rcx, rbx
call fcn.180034a70
mov r14, qword [rsp + 0x60]
mov ecx, 3
test al, al
cmove esi, ecx
mov eax, esi
jmp 0x180034a4c
mov eax, 2
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov r12, qword [rsp + 0x70]
add rsp, 0x88
pop rbp
pop rbx
ret
Function at 0x180039720
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov r12, rcx
mov ecx, 0x400
mov rbp, r8
mov rdi, rdx
mov dword [rsp + 0x30], 1
xor sil, sil
call fcn.1800a3360
xor edx, edx
mov r8d, 0x400
mov rcx, rax
mov rbx, rax
call fcn.1800a3870
mov rcx, qword [r12]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x78], 0x400
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1800397a2
mov rcx, rbp
mov dword [r12 + 8], eax
call fcn.180002b30
jmp 0x1800397c3
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdx, rbx
mov sil, 1
not rcx
lea r8, [rcx - 1]
mov rcx, rbp
call fcn.180005e10
mov rcx, rbx
call fcn.1800a3430
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov al, sil
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret

Function at 0x1800397f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [r8], 0
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x58]
xor r8d, r8d
mov dword [rsp + 0x58], 4
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18003983f
mov dword [rbx + 8], eax
xor al, al
add rsp, 0x30
pop rbx
ret
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x18003c130
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0xb8], rbx
mov r13d, r8d
mov r14, rdx
mov qword [rsp + 0x50], rcx
xor ebx, ebx
mov qword [rsp + 0x48], rbx
or rdi, 0xffffffffffffffff
cmp r8d, 0x3fe
jbe 0x18003c1d4
lea ecx, [r13 + 2]
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1800a09e0
mov r14, rax
mov rbx, rax
mov qword [rsp + 0x48], rax
xor ecx, ecx
call fcn.1800a22f0
mov rdx, rbx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x18003c1c5
cmp eax, r13d
ja 0x18003c1c5
mov ecx, eax
mov word [rbx + rcx*2], 0
lea ecx, [rax + 1]
mov word [rbx + rcx*2], 0
mov r13d, eax
jmp 0x18003c1e5
mov rcx, r14
call fcn.1800a22f0
xor al, al
jmp 0x18003c326
mov word [rdx + r13*2], 0
lea eax, [r13 + 1]
mov word [rdx + rax*2], 0
xor eax, eax
xor ebp, ebp
test r13d, r13d
je 0x18003c31c
mov r12, r14
movabs r9, 0x7ffffffffffffffe
mov rbx, qword [rsp + 0x50]
cmp word [r12], 0
jne 0x18003c307
cmp eax, ebp
je 0x18003c307
lea r15, [r14 + rax*2]
mov edx, 7
mov qword [rsp + 0x40], rdx
xor r8d, r8d
mov qword [rsp + 0x38], r8
mov word [rsp + 0x28], r8w
xor eax, eax
mov rcx, rdi
mov rdi, r15
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rsi, rcx
cmp rcx, r9
jbe 0x18003c25d
call fcn.1800a09f0
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
cmp rdx, rsi
jae 0x18003c276
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.180003710
mov rdx, qword [rsp + 0x40]
jmp 0x18003c294
test rsi, rsi
jne 0x18003c294
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x28]
cmp rdx, 8
cmovae rax, qword [rsp + 0x28]
mov word [rax], si
jmp 0x18003c2d6
test rsi, rsi
je 0x18003c2d6
lea rcx, [rsp + 0x28]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x28]
lea rdi, [rsi + rsi]
add rdx, rdx
mov r9, rdi
mov r8, r15
call fcn.1800a1c40
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rax, qword [rsp + 0x28]
mov word [rdi + rax], 0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180009110
nop
cmp qword [rsp + 0x40], 8
jb 0x18003c2f6
mov rcx, qword [rsp + 0x28]
call fcn.1800a2030
lea eax, [rbp + 1]
movabs r9, 0x7ffffffffffffffe
or rdi, 0xffffffffffffffff
add ebp, 1
add r12, 2
cmp ebp, r13d
jb 0x18003c204
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.1800a22f0
mov al, 1
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18003d390
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1800fca30]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
cmp qword [rcx + 0x18], 0
jne 0x18003d3c2
xor al, al
jmp 0x18003d4e4
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], 0
mov word [rsp + 0x58], 0
xor r8d, r8d
mov dx, 0x5c
call fcn.180008f80
cmp rax, 0xffffffffffffffff
je 0x18003d427
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180004870
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1800030a0
nop
cmp qword [rsp + 0x48], 8
jb 0x18003d43b
mov rcx, qword [rsp + 0x30]
call fcn.1800a2030
jmp 0x18003d43b
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1800030a0
cmp qword [rsp + 0x68], 0
je 0x18003d4cd
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
cmp eax, 3
je 0x18003d4be
cmp eax, 2
jne 0x18003d4d7
lea rax, [rsp + 0x58]
cmp rdx, 8
cmovae rax, rcx
cmp word [rax], 0x41
je 0x18003d4d7
lea rax, [rsp + 0x58]
cmp rdx, 8
cmovae rax, rcx
cmp word [rax], 0x42
je 0x18003d4d7
lea rax, [rsp + 0x58]
cmp rdx, 8
cmovae rax, rcx
cmp word [rax], 0x61
je 0x18003d4d7
lea rax, [rsp + 0x58]
cmp rdx, 8
cmovae rax, rcx
cmp word [rax], 0x62
je 0x18003d4d7
cmp rdx, 8
jb 0x18003d4c9
call fcn.1800a2030
mov al, 1
jmp 0x18003d4e4
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18003d4e2
call fcn.1800a2030
xor al, al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800a3210
add rsp, 0x80
pop rbx
ret
Function at 0x18003e850
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1800fca30]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx esi, r8b
mov rdi, rdx
mov rbx, rcx
mov qword [r11 - 0x20], 7
mov qword [r11 - 0x28], 0
mov word [rsp + 0x50], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [r11 - 0x40]
call fcn.1800030a0
nop
mov edx, 0x24
lea rcx, [rsp + 0x48]
call fcn.1800192c0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18003e8f4
test al, 0x10
jne 0x18003e8f4
cmp qword [rsp + 0x68], 8
jb 0x18003e96a
mov rcx, qword [rsp + 0x50]
call fcn.1800a2030
jmp 0x18003e96a
cmp qword [rsp + 0x68], 8
jb 0x18003e906
mov rcx, qword [rsp + 0x50]
call fcn.1800a2030
test sil, sil
jne 0x18003e912
xor al, al
jmp 0x18003e9a5
lea rsi, [0x1800d85c8]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], 0xffffffffffffffff
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov r9d, 2
mov r8d, 0x40000000
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.180043470
test al, al
je 0x18003e98d
mov qword [rsp + 0x30], rsi
mov rcx, qword [rsp + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x18003e96a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rdi
mov rcx, qword [rbx]
call fcn.18003db60
test al, al
jne 0x18003e982
mov rax, qword [rbx]
mov byte [rax + 0x68], 0
jmp 0x18003e989
mov rax, qword [rbx]
mov byte [rax + 0x68], 1
mov al, 1
jmp 0x18003e9a5
mov qword [rsp + 0x30], rsi
mov rcx, qword [rsp + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x18003e9a3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800a3210
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180043470
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xa8
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1800fca30]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov r13d, r9d
mov r12d, r8d
mov rbx, rdx
mov rsi, rcx
mov rdx, qword [rdx + 0x18]
mov ebp, dword [rsp + 0x100]
cmp rdx, 2
jb 0x180043654
cmp qword [rbx + 0x20], 8
jb 0x1800434cc
lea rdi, [rbx + 8]
mov rax, qword [rdi]
jmp 0x1800434d3
lea rdi, [rbx + 8]
mov rax, rdi
cmp word [rax], 0x5c
jne 0x1800434fa
cmp rdx, 1
jae 0x1800434e4
call fcn.1800a2200
cmp qword [rbx + 0x20], 8
jb 0x1800434f0
mov rax, qword [rdi]
jmp 0x1800434f3
mov rax, rdi
cmp word [rax + 2], 0x5c
je 0x18004356c
cmp qword [rbx + 0x18], 1
jae 0x180043506
call fcn.1800a2200
cmp qword [rbx + 0x20], 8
jb 0x180043512
mov rax, qword [rdi]
jmp 0x180043515
mov rax, rdi
cmp word [rax + 2], 0x3a
jne 0x180043654
mov rax, qword [rbx + 0x18]
cmp rax, 2
jbe 0x18004356c
cmp rax, 2
jae 0x180043535
call fcn.1800a2200
cmp qword [rbx + 0x20], 8
jb 0x180043541
mov rax, qword [rdi]
jmp 0x180043544
mov rax, rdi
cmp word [rax + 4], 0x2f
je 0x18004356c
cmp qword [rbx + 0x18], 2
jae 0x180043557
call fcn.1800a2200
cmp qword [rbx + 0x20], 8
jb 0x180043561
mov rdi, qword [rdi]
cmp word [rdi + 4], 0x5c
jne 0x180043654
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.180019a00
nop
cmp ebp, 2
jne 0x18004363f
cmp qword [rsp + 0x88], 0
je 0x18004363f
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], 0
mov word [rsp + 0x50], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1800030a0
nop
lea edx, [rbp + 0x22]
lea rcx, [rsp + 0x48]
call fcn.1800192c0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180043603
test al, 0x10
je 0x180043603
cmp qword [rsp + 0x68], 8
jb 0x18004363f
mov rcx, qword [rsp + 0x50]
call fcn.1800a2030
jmp 0x18004363f
cmp qword [rsp + 0x68], 8
jb 0x180043615
mov rcx, qword [rsp + 0x50]
call fcn.1800a2030
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.180019a00
nop
mov rcx, rax
call fcn.18000c6b0
nop
cmp qword [rsp + 0x68], 8
jb 0x18004363f
mov rcx, qword [rsp + 0x50]
call fcn.1800a2030
nop
cmp qword [rsp + 0x90], 8
jb 0x180043654
mov rcx, qword [rsp + 0x78]
call fcn.1800a2030
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
cmp qword [rbx + 0x20], 8
jb 0x18004366a
mov rcx, qword [rbx + 8]
jmp 0x18004366e
lea rcx, [rbx + 8]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], ebp
xor r9d, r9d
mov r8d, r13d
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsi + 8], rax
cmp rax, 0xffffffffffffffff
setne al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1800a3210
add rsp, 0xa8
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180045a60
Capabilities:
Check os version

Disassembly:
mov r11, rsp
push rbx
push r12
sub rsp, 0x158
mov rax, qword [0x1800fca30]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov rbx, rcx
lea rcx, [rsp + 0x20]
xor r12d, r12d
xor edx, edx
mov r8d, VarUI4FromDisp
mov qword [r11 + 0x20], rdi
mov esi, r12d
call fcn.1800a3870
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], VarUI4FromDisp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov rcx, rbx
mov ebp, r12d
mov rdi, r12
call fcn.180045c10
test rax, rax
je 0x180045b14
nop
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180045ae9
mov rax, qword [rbx + 0x10]
sub rax, rcx
sar rax, 3
cmp rdi, rax
jb 0x180045aee
call fcn.1800a2200
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + rdi*8]
call fcn.1800a2030
mov rcx, rbx
add ebp, 1
add rdi, 1
call fcn.180045c10
mov r11, rax
mov eax, ebp
cmp rax, r11
jb 0x180045ad0
mov rdi, qword [rbx + 0x10]
cmp qword [rbx + 8], rdi
jbe 0x180045b23
call fcn.1800a2200
mov rbp, qword [rbx + 8]
cmp rbp, qword [rbx + 0x10]
jbe 0x180045b32
call fcn.1800a2200
cmp rbp, rdi
je 0x180045b75
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x150], r13
sub rax, rdi
sar rax, 3
test rax, rax
lea rdx, [rax*8]
lea r13, [rdx + rbp]
jle 0x180045b69
mov r9, rdx
mov r8, rdi
mov rcx, rbp
call fcn.1800a1d10
mov qword [rbx + 0x10], r13
mov r13, qword [rsp + 0x150]
cmp dword [rsp + 0x30], 2
mov rbp, qword [rsp + 0x178]
jne 0x180045b9e
mov rcx, rbx
call fcn.180045150
mov rcx, rbx
call fcn.180045680
mov rcx, rbx
call fcn.180044fb0
jmp 0x180045bb7
mov edi, r12d
test esi, esi
jne 0x180045bb7
mov rcx, rbx
call fcn.180045360
add edi, 1
cmp edi, 0xa
mov esi, eax
jl 0x180045ba1
mov rcx, qword [rbx + 8]
mov rdi, qword [rsp + 0x188]
mov rsi, qword [rsp + 0x180]
test rcx, rcx
jne 0x180045bd5
mov rax, r12
jmp 0x180045be0
mov rax, qword [rbx + 0x10]
sub rax, rcx
sar rax, 3
test rax, rax
setne al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800a3210
add rsp, 0x158
pop r12
pop rbx
ret
Function at 0x180063e80
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x180063ec0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x30
test r8, r8
mov rsi, r8
mov rbp, rdx
mov r12, rcx
jne 0x180063ee9
mov ecx, 0x80004005
call fcn.1800141c0
int3
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
xor edi, edi
mov rbx, r8
nop
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 1
lea rbx, [rbx + rax*2]
lea edi, [rdi + rax*2]
jne 0x180063f00
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x180064300
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1800fca30]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rcx
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
xor ebp, ebp
mov r9d, 0x2001f
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x50], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x40]
test eax, eax
mov ebx, eax
jne 0x180064439
test rcx, rcx
mov ebx, ebp
je 0x18006436d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
test ebx, ebx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x40], rcx
jne 0x180064439
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x48], pe_nt_image_headers64
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180064411
nop
nop
nop
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.180064300
mov rcx, qword [rsp + 0x40]
test eax, eax
mov ebx, eax
jne 0x180064439
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x48], pe_nt_image_headers64
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1800643c0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180064426
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
mov rcx, qword [rdi]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test rcx, rcx
je 0x180064444
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1800a3210
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x270
pop rdi
pop rsi
pop rbp
ret
Function at 0x180066a30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1800fca30]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r13, r9
mov r12, r8
mov rdi, rdx
mov rbx, rcx
call qword [0x1800fe530]
xor r11d, r11d
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x70], r11
xor edx, edx
lea r8d, [r11 + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x180066aab
call fcn.180063e50
mov ebx, eax
jmp 0x180066bf1
mov r8, r13
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x180066ace
call fcn.180063e50
mov ebx, eax
jmp 0x180066be7
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x180066af3
call fcn.180063e50
mov ebx, eax
jmp 0x180066be7
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
add eax, 1
cmp eax, edi
jae 0x180066b2d
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x180066b23
lea rcx, [rsp + 0x70]
call fcn.180064290
nop
mov eax, 0x8007000e
jmp 0x180066c0a
mov ecx, eax
test eax, eax
je 0x180066b6a
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x180066b60
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x180066b6a
lea rcx, [rsp + 0x70]
call fcn.1800642a0
mov rbx, qword [rsp + 0x70]
jmp 0x180066b74
mov ecx, 0x80070057
call fcn.1800141c0
lea rbx, [rsp + 0x78]
mov qword [rsp + 0x70], rbx
jmp 0x180066b89
test rbx, rbx
jne 0x180066b95
mov ebx, 0x8007000e
jmp 0x180066be7
call qword [0x1800fe530]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
mov r9d, edi
mov r8, r12
xor edx, edx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x180066bc1
call fcn.180063e50
mov ebx, eax
jmp 0x180066be7
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], 0
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1800666f0
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x180066c08
lea rcx, [rsp + 0x70]
call fcn.180064290
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1800a3210
add rsp, 0x490
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret