joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000f3d4
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x1800a8120]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rcx, qword [rcx]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x40]
xor edi, edi
mov rsi, rdx
mov dword [rsp + 0x38], 0x800
mov word [rsp + 0x40], di
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
cmp eax, edi
jne 0x18000f447
mov rdx, qword [str.NoAssociate.KZ]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rdx, rsi
mov rcx, 0xffffffff80000000
cmp eax, edi
jne 0x18000f46e
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor eax, eax
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.18005cb30
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, edi
jne 0x18000f447
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x30]
xor edx, edx
lea eax, [rax + rax + 2]
lea r9, [rsp + 0x40]
lea r8d, [rdx + 1]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call fcn.18000f234
cmp ebx, edi
sete dil
mov eax, edi
jmp 0x18000f449
Function at 0x18000fe04
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push r12
sub rsp, 0x60
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov r12, rcx
lea rax, [r11 + 0x10]
mov qword [r11 - 0x38], rax
lea rax, [r11 + 0x20]
mov qword [r11 - 0x40], rax
xor ebx, ebx
mov qword [r11 - 0x48], rbx
mov esi, 0x20006
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, rcx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebp, ebx
cmp eax, ebx
je 0x18000ff57
mov rdx, r12
lea rcx, [rsp + 0x90]
call fcn.1800035b0
nop
lea r8, [0x180086680]
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.1800108f8
mov rcx, qword [rsp + 0x90]
call fcn.180016840
cmp al, bl
jne 0x18000fec4
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, ebx
jg 0x18000febd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
xor eax, eax
jmp 0x18000ffd4
lea rax, [rsp + 0x88]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
je 0x18000ff2f
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, ebx
jg 0x18000ff28
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
xor eax, eax
jmp 0x18000ffd4
mov ebp, 1
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, ebx
jg 0x18000ff57
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
lea rdx, [0x1800866a8]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, ebx
je 0x18000ffcd
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.1800035b0
nop
lea r8, str.HKEY_CURRENT_USER_
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1800108f8
mov rcx, qword [rsp + 0x50]
call fcn.180016830
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
cmp ecx, ebx
jg 0x18000ffcd
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rioctlsocket + 8]
cmp esi, ebx
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop r12
pop rsi
pop rbp
ret
Function at 0x1800102f4
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xa70
mov rax, qword [0x1800a8120]
xor rax, rsp
mov qword [rsp + 0xa60], rax
mov ebp, r8d
mov rbx, rdx
mov rdi, rcx
call fcn.18000f4d4
xor r12d, r12d
mov rdx, rbx
mov rcx, rdi
cmp eax, r12d
je 0x180010347
mov r8d, ebp
call fcn.18000eff4
lea eax, [r12 + 1]
jmp 0x18001047d
call fcn.18000e8a4
mov r13, 0xffffffff80000000
lea r8, [rsp + 0x30]
mov rcx, r13
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, 1
cmp eax, r12d
je 0x180010381
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov ebp, esi
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], r12w
call fcn.18005c800
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x50]
xor edx, edx
mov dword [rsp + 0x38], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
xor eax, eax
cmp ax, word [rsp + 0x50]
lea r8, [rdi + 8]
lea rdx, [0x1800867d0]
lea rcx, [rsp + 0x260]
mov r9, rbx
cmove ebp, esi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x260]
lea eax, [rax + rax + 2]
mov r8d, esi
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x260]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
cmp eax, r12d
je 0x180010436
xor eax, eax
jmp 0x18001047d
mov rcx, qword [rsp + 0x40]
mov rdx, rbx
call fcn.1800100b4
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.18000eff4
lea rdx, [rsp + 0x260]
mov rcx, rdi
call fcn.18000ead4
mov edi, eax
cmp eax, r12d
je 0x18001047b
mov rcx, rbx
call fcn.18000fff4
mov eax, edi
mov rcx, qword [rsp + 0xa60]
xor rcx, rsp
call fcn.18005cb30
mov rbx, qword [rsp + 0xab0]
add rsp, 0xa70
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180010d80
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1800a8120]
xor rax, rsp
mov qword [rsp + 0x250], rax
movsxd rsi, edx
lea rax, [rsp + 0x30]
mov rdi, rcx
lea rdx, str.SoftwareKuaiZipSFX_
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
cmp eax, ebx
jne 0x180010e42
cmp rdi, rbx
je 0x180010e91
cmp esi, ebx
je 0x180010e91
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], bx
call fcn.18005c800
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea rdx, [0x180086d00]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x180010e6c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18005cb30
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea r8, [rsp + 0x40]
mov rdx, rsi
mov rcx, rdi
call fcn.18005e3f0
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, ebx
jne 0x180010e91
mov word [rdi], bx
mov ebx, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x180010e47

Function at 0x180010f20
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x1800a8120]
xor rax, rsp
mov qword [rsp + 0x140], rax
and dword [rsp + 0x20], 0
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.18005c800
cmp qword [rdi + 0x20], 0x10
jb 0x180010f6e
mov rcx, qword [rdi + 8]
jmp 0x180010f72
lea rcx, [rdi + 8]
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
and qword [rbx + 0x18], 0
or rcx, 0xffffffffffffffff
xor eax, eax
mov qword [rbx + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbx + 8], 0
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.180001638
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18005cb30
mov rbx, qword [rsp + 0x170]
add rsp, 0x150
pop rdi
ret
Function at 0x1800123e0
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x100
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 8], rsi
mov rax, qword [0x1800a8120]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov esi, 7
mov qword [r11 - 0x20], rsi
xor edi, edi
mov qword [r11 - 0x28], rdi
mov word [r11 - 0x38], di
mov qword [r11 - 0x48], rsi
mov qword [r11 - 0x50], rdi
mov word [r11 - 0x60], di
lea r9, [r11 - 0x68]
lea r8, [r11 - 0x40]
call fcn.180012170
cmp eax, edi
jne 0x18001248b
cmp qword [rsp + 0xc0], 8
jb 0x180012454
mov rcx, qword [rsp + 0xa8]
call fcn.18005c410
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xb8], rdi
mov word [rsp + 0xa8], di
cmp qword [rsp + 0xe8], 8
jb 0x180012484
mov rcx, qword [rsp + 0xd0]
call fcn.18005c410
xor eax, eax
jmp 0x1800125a0
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x30]
call fcn.18005c800
mov dword [rsp + 0x30], reloc.WS2_32.dll_WSASetLastError
lea rax, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rax, qword [rsp + 0xd0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 8
cmovae rax, qword [rsp + 0xa8]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x60], 1
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, edi
jne 0x180012544
cmp qword [rsp + 0xc0], 8
jb 0x180012510
mov rcx, qword [rsp + 0xa8]
call fcn.18005c410
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xb8], rdi
mov word [rsp + 0xa8], di
cmp qword [rsp + 0xe8], 8
jb 0x180012540
mov rcx, qword [rsp + 0xd0]
call fcn.18005c410
xor eax, eax
jmp 0x1800125a0
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0xc0], 8
jb 0x18001256b
mov rcx, qword [rsp + 0xa8]
call fcn.18005c410
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xb8], rdi
mov word [rsp + 0xa8], di
cmp qword [rsp + 0xe8], 8
jb 0x18001259b
mov rcx, qword [rsp + 0xd0]
call fcn.18005c410
mov eax, 1
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.18005cb30
mov rsi, qword [rsp + 0x110]
add rsp, 0x100
pop rdi
ret
Function at 0x1800133f8
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x130
mov rax, qword [0x1800a8120]
xor rax, rsp
mov qword [rsp + 0x120], rax
lea rcx, [0x1800aa1d0]
mov edx, 1
call fcn.180014540
mov edi, eax
test eax, eax
js 0x180013543
lea rdx, [rsp + 0xb0]
lea rcx, [0x180088f18]
mov r8d, reloc.WLDAP32.dll_Ordinal_50
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jle 0x180013541
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x40]
lea rcx, [0x180087370]
call fcn.180013258
lea rdx, [rsp + 0x40]
lea rcx, [0x1800873c0]
call fcn.180013258
lea rdx, [rsp + 0x40]
lea rcx, str.drive_shellexContextMenuHandlers_
call fcn.180013258
call qword [sym.imp.KERNEL32.dll_GetVersion]
bt eax, 0x1f
jb 0x180013541
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
lea rdx, [0x180087480]
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18001352c
mov rbx, qword [rsp + 0x30]
lea rsi, str.KuaiZip_Shell_Extension
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsp + 0x40]
mov r9d, 1
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x180013533
test rbx, rbx
je 0x18001352c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80070005
jmp 0x180013543
test rbx, rbx
je 0x180013541
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.18005cb30
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x18001386c
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
sub rsp, 0x50
and qword [rax - 0x20], 0
and qword [rax - 0x28], 0
and qword [rax - 0x18], 0
and dword [rax - 0x10], 0
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rbp, r9
mov dword [rax - 0x30], 0x2001f
and dword [rax - 0x38], 0
lea rcx, [rax - 0x18]
xor r9d, r9d
call fcn.18000b884
mov ebx, eax
test eax, eax
jne 0x1800138f1
test rsi, rsi
jne 0x1800138c2
lea ebx, [rax + 0xd]
jmp 0x1800138f1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x40]
mov r9d, 1
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
cmp qword [rsp + 0x40], 0
je 0x180013904
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rsi
ret

Function at 0x180015bc0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x490
mov rax, qword [0x1800a8120]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r12, rdx
mov rbp, rcx
mov rdx, rcx
lea rcx, [rsp + 0x270]
mov r13, r8
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str..dll
lea rcx, [rsp + 0x270]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x24]
xor edi, edi
xor edx, edx
mov r8d, 0x24c
mov dword [rsp + 0x20], edi
call fcn.18005c800
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x180015c4f
xor eax, eax
jmp 0x180015cd9
lea rdx, reloc.WLDAP32.dll_Ordinal_46
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, edi
je 0x180015cb5
lea rdx, [0x180087b30]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, edi
je 0x180015cb5
test byte [rsp + 0x20], 0x10
jne 0x180015cb5
lea rcx, [rbp + 0x410]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x4c]
lea rcx, [rbp + 0x410]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp + 0x410]
mov rcx, r13
call r12
cmp eax, edi
jne 0x180015cc9
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, edi
je 0x180015cce
jmp 0x180015c4f
mov edi, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.18005cb30
mov rbx, qword [rsp + 0x4d8]
add rsp, 0x490
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180015f6c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1800a8120]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rax, rdx
mov rdi, rcx
mov rdx, rcx
mov rcx, rax
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea rdx, str.Lang
xor ebp, ebp
mov rcx, rdi
mov word [rax], bp
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea r8, [0x180087bf8]
lea rax, [0x180096878]
lea rsi, [rdi + 0x208]
lea rdx, [0x180087bd0]
lea rcx, [rsp + 0x40]
mov r9, r8
mov word [rdi + 0x410], bp
mov qword [rsp + 0x20], rax
mov word [rsi], bp
call qword [sym.imp.USER32.dll_wsprintfW]
lea r11, [rsp + 0x38]
lea r9d, [rbp + 1]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x180016065
mov rbx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.LangModule
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp rbx, rbp
je 0x180016065
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18005cb30
mov rbx, qword [rsp + 0x290]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
Function at 0x180016d98
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
sub rsp, 0xb0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x1800a8120]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rbx, rdx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
lea r12d, [rbp + 0xf]
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], rbp
mov byte [r11 - 0x40], bpl
xor r8d, r8d
lea rdx, [0x180088062]
lea rcx, [r11 - 0x48]
call fcn.180001638
nop
lea r8d, [rbp + 0x2e]
lea rdx, [0x180088128]
lea rcx, [rsp + 0x30]
call fcn.1800013d4
nop
cmp qword [rax + 0x20], 0x10
jb 0x180016e19
mov rdx, qword [rax + 8]
jmp 0x180016e1d
lea rdx, [rax + 8]
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x70], rbp
mov byte [rsp + 0x60], bpl
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x58]
call fcn.180001638
nop
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x58]
call fcn.18007f1b0
mov dil, al
cmp qword [rsp + 0x78], 0x10
jb 0x180016e70
mov rcx, qword [rsp + 0x60]
call fcn.18005c410
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x70], rbp
mov byte [rsp + 0x60], bpl
lea rcx, [rsp + 0x30]
call fcn.180001438
cmp dil, bpl
je 0x180016fdd
lea rdx, [rsp + 0x88]
cmp qword [rsp + 0xa0], 0x10
cmovae rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x30]
call fcn.18007ea10
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.180001528
nop
cmp qword [rsp + 0x50], 0x10
jb 0x180016ee1
mov rcx, qword [rsp + 0x38]
call fcn.18005c410
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x70], rbp
mov byte [rsp + 0x60], bpl
mov r8d, ntohs
lea rdx, str.cityname_:_
lea rcx, [rsp + 0x58]
call fcn.180001638
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
mov r9, qword [rsp + 0x70]
xor r8d, r8d
lea rcx, [rsp + 0x80]
call fcn.180003630
mov rsi, rax
cmp eax, 0xffffffff
je 0x180016fcb
movsxd rdi, eax
mov rax, qword [rsp + 0x70]
lea r8, [rdi + rax]
mov r9d, 1
lea rdx, [0x180088124]
lea rcx, [rsp + 0x80]
call fcn.180003630
cmp eax, 0xffffffff
cmove eax, dword [rsp + 0x98]
sub eax, esi
movsxd r9, eax
mov rax, qword [rsp + 0x70]
sub r9, rax
lea r8, [rdi + rax]
mov rdx, rbx
lea rcx, [rsp + 0x80]
call fcn.1800028a0
nop
cmp qword [rsp + 0x78], 0x10
jb 0x180016f9f
mov rcx, qword [rsp + 0x60]
call fcn.18005c410
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x70], rbp
mov byte [rsp + 0x60], bpl
cmp qword [rsp + 0xa0], 0x10
jb 0x180016fc6
mov rcx, qword [rsp + 0x88]
call fcn.18005c410
mov rax, rbx
jmp 0x180017004
cmp qword [rsp + 0x78], 0x10
jb 0x180016fdd
mov rcx, qword [rsp + 0x60]
call fcn.18005c410
mov qword [rbx + 0x20], r12
mov qword [rbx + 0x18], rbp
mov byte [rbx + 8], bpl
cmp qword [rsp + 0xa0], 0x10
jb 0x180017001
mov rcx, qword [rsp + 0x88]
call fcn.18005c410
mov rax, rbx
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.18005cb30
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1800179a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov word [rsp + 0x18], r8w
push rdi
sub rsp, 0x20
mov r8d, edx
mov rbx, rcx
mov rdx, rcx
mov rcx, qword [0x1800aa2c8]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rsp + 0x40]
mov edx, 1
call qword [sym.imp.USER32.dll_CharLowerBuffW]
xor edi, edi
cmp word [rsp + 0x40], 0x6d
jne 0x180017a1c
call fcn.18007e8a0
mov rcx, rbx
lea rdx, [0x180088478]
cmp al, dil
jne 0x180017a0d
lea rdx, [0x180088480]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [0x180088488]
jmp 0x180017a33
lea rdx, [0x1800884a8]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, str.KuaiZip.exe
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rbx, qword [rsp + 0x30]
cmp eax, 0xffffffff
setne dil
mov eax, edi
add rsp, 0x20
pop rdi
ret

Function at 0x180017ad0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
setae al
add rsp, 0x28
ret
Function at 0x18001a130
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor edx, edx
mov rdi, rcx
lea r8, [0x180088de0]
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
xor ebx, ebx
mov qword [rdi + 8], rax
cmp rax, rbx
jne 0x18001a15e
xor eax, eax
jmp 0x18001a182
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp rax, rbx
mov qword [rdi + 0x10], rax
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret