joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000fe10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18000fe85
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x18000fe85
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x18000fe75
nop
cmp rbx, rcx
jae 0x18000fe85
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x18000fe60
cmp rbx, rcx
jae 0x18000fe85
cmp word [rbx], 0
je 0x18000fe85
mov rax, rbx
jmp 0x18000fe87
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180011a70
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x180011b25
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x180011af1
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x180011b09
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x180011b09
mov rdx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je case.default.0x180011b09
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x18006f388], 0
jne 0x180011b70
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180011b60
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18006f380], rax
mov byte [0x18006f388], 1
jmp 0x180011b77
mov rax, qword [0x18006f380]
mov byte [0x18006f388], 1
jmp 0x180011b77
mov rax, qword [0x18006f380]
mov rcx, qword [rbx]
mov rdx, rsi
test rax, rax
je 0x180011afa
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp rax
Function at 0x180012370
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x180064138]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov qword [rsp + 0x48], rbp
mov r8, rdx
mov dword [rsp + 0x50], ebp
mov rdx, qword [rcx]
mov rdi, rcx
or r9d, 0x2001f
mov qword [rsp + 0x58], rbp
lea rcx, [rsp + 0x48]
call fcn.180011e40
mov ebx, eax
test eax, eax
jne 0x180012487
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180012461
nop dword [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.180012370
mov ebx, eax
test eax, eax
jne 0x180012487
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x180012410
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180012476
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov rdx, rsi
mov dword [rsp + 0x50], ebp
mov rcx, rdi
call fcn.180011a70
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180012497
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.18001e0c0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800129a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x180064138]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x180012a2e
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x180012a2e
call fcn.180010b10
mov ebx, eax
jmp 0x180012b53
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x180012a4f
call fcn.180010b10
jmp 0x180012b42
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x180012a72
call fcn.180010b10
jmp 0x180012b42
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x180012a94
mov ebx, 0x8007000e
jmp 0x180012b44
mov ecx, eax
test eax, eax
je 0x180012ac9
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x180012b8b
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x180012ac9
lea rcx, [rsp + 0x70]
call fcn.180010890
jmp 0x180012ad3
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x180012ae6
cmp qword [rsp + 0x70], 0
jne 0x180012af5
mov ebx, 0x8007000e
jmp 0x180012b44
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x180012b1f
call fcn.180010b10
jmp 0x180012b42
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1800124c0
mov ebx, eax
test rdi, rdi
je 0x180012b53
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x180012b6a
lea rcx, [rsp + 0x70]
call fcn.180011be0
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.18001e0c0
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.180008e40
int3
Function at 0x180014430
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x48]
mov dword [rsp + 0x48], 8
mov qword [rsp + 0x28], rax
lea r8, str.LDSShellExt_UserDeleted
lea rax, [rsp + 0x50]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea rdx, str.Software360WallPaperEver
mov qword [rsp + 0x50], rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov rcx, qword [rsp + 0x50]
test eax, eax
cmovne rcx, rbx
mov rax, rcx
add rsp, 0x30
pop rbx
ret

Function at 0x180014490
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r8, str.LDSShellExt_Disabled
lea rax, [rsp + 0x48]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea rdx, str.Software360WallPaperEver
mov dword [rsp + 0x48], ebx
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x1800144e2
xor eax, eax
add rsp, 0x30
pop rbx
ret
cmp dword [rsp + 0x48], ebx
setne bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x180014500
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
xor ecx, ecx
call fcn.180033eb4
mov qword [rsp + 0x48], rax
lea r8, str.LDSShellExt_UserDeleted
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], 8
mov r9d, 3
mov qword [rsp + 0x20], rax
lea rdx, str.Software360WallPaperEver
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x38
ret

Function at 0x180014560
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x38
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, str.LDSShellExt_Disabled
mov rcx, 0xffffffff80000001
lea rdx, str.Software360WallPaperEver
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x38
ret
Function at 0x180017010
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
lea rax, vtable.CLdsStatistic.0
mov rbx, rcx
mov qword [rcx], rax
call fcn.180007b50
test rax, rax
je 0x180017184
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbx + 8], rax
call fcn.180007b50
test rax, rax
je 0x180017184
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbx + 0x10], rax
call fcn.180007b50
test rax, rax
je 0x180017184
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbx + 0x18], rax
call fcn.180007b50
test rax, rax
je 0x180017184
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbx + 0x20], rax
call fcn.180007b50
test rax, rax
je 0x180017184
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbx + 0x28], rax
call fcn.180007b50
test rax, rax
je 0x180017184
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbx + 0x30], rax
call fcn.180007b50
test rax, rax
je 0x180017184
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea r9, [rsp + 0x50]
mov dword [rsp + 0x40], 0
add rax, 0x18
mov dword [rsp + 0x50], 4
mov qword [rbx + 0x38], rax
lea r8, str.shell_test_percent
lea rax, [rsp + 0x48]
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x28], rax
lea rdx, str.Software360WallPaper
lea rax, [rsp + 0x40]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [rsp + 0x40]
mov dword [rbx + 0x40], eax
test eax, eax
jne 0x18001717b
call fcn.180029cfc
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x180049ef8]
mulsd xmm0, qword [0x180049f00]
cvttsd2si eax, xmm0
mov dword [rbx + 0x40], eax
mov rax, rbx
add rsp, 0x30
pop rbx
ret
mov ecx, 0x80004005
call fcn.180008e40
int3
Function at 0x180017240
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x70
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
test rdx, rdx
jne 0x180017260
xor eax, eax
add rsp, 0x70
pop rsi
pop rbp
pop rbx
ret
test r9d, r9d
je 0x180017382
mov qword [rsp + 0x90], rdi
mov ecx, 0x1420
mov qword [rsp + 0xa0], r14
call fcn.18001db7c
xor r14d, r14d
mov qword [rsp + 0x98], rax
mov rdi, rax
test rax, rax
je 0x1800172f6
xor edx, edx
mov qword [rax], rbx
mov r8d, 0x1000
mov dword [rax + 0x1418], 1
lea rcx, [rax + 8]
call fcn.180027560
mov r8d, 0x800
lea rcx, [rdi + 8]
mov rdx, rbp
call fcn.180033ef4
xor edx, edx
lea rcx, [rdi + 0x1008]
mov r8d, 0x410
call fcn.180027560
test rsi, rsi
je 0x1800172f9
mov r8d, 0x208
lea rcx, [rdi + 0x1008]
mov rdx, rsi
call fcn.180033ef4
jmp 0x1800172f9
mov rdi, r14
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rdi
lea r8, [0x1800173a0]
mov qword [rsp + 0x28], rax
lea rbx, vtable.CSimpleThread.0
mov dword [rsp + 0x20], r14d
mov r9, rdi
mov qword [rsp + 0x30], rbx
xor edx, edx
mov qword [rsp + 0x58], r8
xor ecx, ecx
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x40], 0xffffffff
mov dword [rsp + 0x44], r14d
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x50], r14d
call fcn.180034088
mov r14, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
test rax, rax
je 0x18001738d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x70
pop rsi
pop rbp
pop rbx
ret
mov rdx, rsi
mov rcx, rbp
call fcn.1800174c0
mov eax, 1
add rsp, 0x70
pop rsi
pop rbp
pop rbx
ret

Function at 0x1800174c0
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x180064138]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
test rcx, rcx
je 0x18001755e
cmp word [rcx], 0
je 0x18001755e
test rdx, rdx
je 0x180017516
cmp word [rdx], 0
je 0x180017516
mov r8, rdx
xor eax, eax
mov rdx, rcx
mov qword [rsp + 0x20], rax
xor ecx, ecx
xor r9d, r9d
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x18001755e
mov eax, 1
jmp 0x180017560
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x410
call fcn.180027560
xor eax, eax
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov r9d, 0x104
mov rdx, rbx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x18001755e
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
jmp 0x180017560
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18001e0c0
add rsp, 0x450
pop rbx
ret
Function at 0x1800183f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x3b8]
sub rsp, 0x4b0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x180064138]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov rdi, rcx
mov qword [rsp + 0x70], rcx
xor r14d, r14d
mov dword [rsp + 0x34], r14d
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x180018655
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
mov dword [rsp + 0x34], 1
lea rcx, [rsp + 0x48]
call fcn.180018660
nop
lea rdx, str.ludashi
mov rcx, qword [rsp + 0x48]
call fcn.180033a50
lea rbx, [r14 - 1]
test eax, eax
jne 0x18001855a
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x58], r14d
mov qword [rsp + 0x60], r14
mov r9d, 0x20219
lea r8, str.SOFTWARELudashi
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.180011e40
test eax, eax
jne 0x18001853e
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.VendorID
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18001853e
mov eax, dword [rsp + 0x38]
dec eax
cmp eax, 1
ja 0x18001853e
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x180018518
test al, 1
jne 0x18001853e
shr rax, 1
cmp word [rsp + rax*2 + 0x7e], r14w
je 0x18001851d
jmp 0x18001853e
mov word [rbp - 0x80], r14w
lea rcx, [rbp - 0x80]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], 0
jne 0x180018524
mov r8d, eax
lea rdx, [rbp - 0x80]
mov rcx, rdi
call fcn.18000fcf0
nop
cmp qword [rsp + 0x50], 0
je 0x18001860d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18001860d
lea rdx, str.bizhi
mov rcx, qword [rsp + 0x48]
call fcn.180033a50
test eax, eax
jne 0x18001860d
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x3c], 0x104
movzx eax, word [0x180045928]
mov word [rbp + 0x190], ax
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x192]
call fcn.180027560
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x190]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
lea r8, [0x18004a198]
lea rdx, str.Software360WallPaper
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18001860d
lea rcx, [rbp + 0x190]
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1800185f0
mov r8d, eax
lea rdx, [rbp + 0x190]
mov rcx, rdi
call fcn.18000fcf0
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x18001862a
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rax, rdi
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.18001e0c0
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov ecx, 0x80004005
call fcn.180008e40
int3
Function at 0x180018660
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push rbp
lea rbp, [rsp - 0xbc0]
sub rsp, 0xcc0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xcd8], rbx
mov rax, qword [0x180064138]
xor rax, rsp
mov qword [rbp + 0xbb0], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x30], 0
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x1800188f9
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x30], 1
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x50]
call fcn.180027560
mov r8d, 0x104
lea rdx, [rsp + 0x50]
mov rcx, qword [0x18006f2d0]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x370]
call fcn.180027560
lea r8, str.ComputerZ_CN.exe
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x370]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x790]
call fcn.180027560
lea r8, str.360wpapp.exe
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x790]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x580]
call fcn.180027560
lea r8, str.birdwp.exe
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x580]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x370]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800187bf
lea rdx, str.ludashi
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x1800187b0
jmp 0x1800188cb
lea rcx, [rbp + 0x580]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1800188b3
lea rcx, [rbp + 0x790]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1800188b3
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x9a0]
call fcn.180027560
mov r8d, 0x104
lea rdx, [rbp + 0x9a0]
mov rcx, qword [0x18006f2d0]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x9a0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rcx, rax
lea rdx, [0x18004a030]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x1800188d6
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x160]
call fcn.180027560
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.LDSShellExt_InstallSource
lea rdx, str.Software360WallPaperEver
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea rcx, [rbp + 0x160]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1800188a0
lea rdx, [rbp + 0x160]
jmp 0x1800188cb
lea rdx, str.bizhi
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x1800188c1
mov r8d, eax
mov rcx, rbx
call fcn.18000fcf0
mov rax, rbx
mov rcx, qword [rbp + 0xbb0]
xor rcx, rsp
call fcn.18001e0c0
mov rbx, qword [rsp + 0xcd8]
add rsp, 0xcc0
pop rbp
ret
mov ecx, 0x80004005
call fcn.180008e40
int3
Function at 0x180018910
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x180064138]
xor rax, rsp
mov qword [rbp + 0x60], rax
xor ebx, ebx
cmp dword [0x1800640a0], ebx
lea r14d, [rbx + 1]
je 0x1800189d5
lea rcx, str.ntdll.dll
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov esi, ebx
mov dword [rsp + 0x34], ebx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x1800189cf
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800189a6
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call rax
movzx eax, word [rsp + 0x34]
mov esi, r14d
mov dword [rsp + 0x34], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x1800189cf
cmp dword [rsp + 0x38], 6
jne 0x1800189cf
mov eax, dword [0x18006f5b8]
cmp dword [rsp + 0x30], r14d
cmove eax, r14d
mov dword [0x18006f5b8], eax
mov dword [0x1800640a0], ebx
cmp dword [0x18006f5b8], ebx
je 0x180018a55
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0x118
call fcn.180027560
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rcx, str.kernel32.dll
mov dword [rsp + 0x30], ebx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetProductInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180018a42
mov edx, dword [rsp + 0x48]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov ecx, dword [rsp + 0x44]
xor r8d, r8d
call rax
cmp dword [rsp + 0x30], 2
je 0x180018aec
mov eax, r14d
jmp 0x180018aee
cmp dword [0x1800640a4], ebx
je 0x180018ae2
lea rcx, str.ntdll.dll
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x38], ebx
mov esi, ebx
mov dword [rsp + 0x34], ebx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x180018adc
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180018ab6
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call rax
movzx eax, word [rsp + 0x34]
mov esi, r14d
mov dword [rsp + 0x34], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x180018adc
cmp dword [rsp + 0x30], 6
jne 0x180018ad3
cmp dword [rsp + 0x38], 2
jae 0x180018ad5
jmp 0x180018adc
jbe 0x180018adc
mov dword [0x18006f5bc], r14d
mov dword [0x1800640a4], ebx
cmp dword [0x18006f5bc], ebx
cmovne ebx, r14d
mov eax, ebx
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.18001e0c0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x18001c3b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180064138]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor r9d, r9d
mov dword [rbp - 0x70], 0x690051
lea rax, [0x18006fde0]
mov word [rbp - 0x18], r9w
lea r8, [rbp - 0x70]
mov dword [rbp - 0x6c], 0x6f0068
sub r8, rax
mov dword [rbp - 0x68], 0x20006f
mov dword [rbp - 0x64], 0x360033
mov edx, 0x2d
mov dword [rbp - 0x60], 0x200030
mov dword [rbp - 0x5c], 0x6f0053
mov dword [rbp - 0x58], 0x740066
mov dword [rbp - 0x54], 0x610077
mov dword [rbp - 0x50], 0x650072
mov dword [rbp - 0x4c], 0x280020
mov dword [rbp - 0x48], 0x650042
mov dword [rbp - 0x44], 0x6a0069
mov dword [rbp - 0x40], 0x6e0069
mov dword [rbp - 0x3c], 0x290067
mov dword [rbp - 0x38], 0x430020
mov dword [rbp - 0x34], 0x6d006f
mov dword [rbp - 0x30], 0x610070
mov dword [rbp - 0x2c], 0x79006e
mov dword [rbp - 0x28], 0x4c0020
mov dword [rbp - 0x24], 0x6d0069
mov dword [rbp - 0x20], 0x740069
mov dword [rbp - 0x1c], 0x640065
lea rcx, [rdx + 0x7fffffd1]
test rcx, rcx
je 0x18001c4a3
movzx ecx, word [r8 + rax]
test cx, cx
je 0x18001c4a3
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x18001c480
test rdx, rdx
lea rcx, [rax - 2]
cmovne rcx, rax
mov word [rcx], r9w
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18001e0c0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret