joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800a6ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
movsxd r14, dword [rdx + 0x1c]
xor r11d, r11d
mov rsi, qword [rdx]
or ebp, 0xffffffff
mov r10, qword [rdx + 8]
mov rbx, rcx
mov dword [rcx + 0x192c], r11d
mov r15, rdx
mov dword [rcx + 0x1930], 0x23d
mov ecx, r11d
mov r8d, r11d
test r14d, r14d
jle 0x1800a6d6b
cmp word [rsi + rcx*4], r11w
je 0x1800a6d5a
inc dword [rbx + 0x192c]
mov ebp, r8d
movsxd rax, dword [rbx + 0x192c]
mov dword [rbx + rax*4 + 0x1038], r8d
mov byte [rcx + rbx + 0x1934], r11b
jmp 0x1800a6d60
mov word [rsi + rcx*4 + 2], r11w
inc r8d
inc rcx
cmp rcx, r14
jl 0x1800a6d31
cmp dword [rbx + 0x192c], 2
mov r12d, 1
jge 0x1800a6dd8
movsxd r8, ebp
nop dword [rax]
cmp ebp, 2
jge 0x1800a6d91
inc ebp
inc r8
mov edx, ebp
mov rcx, r8
jmp 0x1800a6d97
mov edx, r11d
mov rcx, r11
inc dword [rbx + 0x192c]
movsxd rax, dword [rbx + 0x192c]
mov dword [rbx + rax*4 + 0x1038], edx
mov word [rsi + rcx*4], r12w
mov byte [rbx + rcx + 0x1934], r11b
dec dword [rbx + 0x1af70]
test r10, r10
je 0x1800a6dcf
movzx eax, word [r10 + rcx*4 + 2]
sub dword [rbx + 0x1af74], eax
cmp dword [rbx + 0x192c], 2
jl 0x1800a6d80
mov dword [r15 + 0x24], ebp
mov eax, dword [rbx + 0x192c]
cdq
sub eax, edx
sar eax, 1
mov edi, eax
cmp eax, r12d
jl 0x1800a6e05
nop
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call fcn.1800a9390
dec edi
cmp edi, r12d
jge 0x1800a6df0
movsxd rax, dword [rbx + 0x192c]
mov r8d, r12d
movsxd rdi, dword [rbx + 0x103c]
mov rdx, rsi
mov ecx, dword [rbx + rax*4 + 0x1038]
mov dword [rbx + 0x103c], ecx
mov rcx, rbx
dec dword [rbx + 0x192c]
call fcn.1800a9390
movsxd rcx, dword [rbx + 0x103c]
dec dword [rbx + 0x1930]
lea r8, [rsi + rcx*4]
movsxd rax, dword [rbx + 0x1930]
movsxd r9, r14d
mov dword [rbx + rax*4 + 0x1038], edi
dec dword [rbx + 0x1930]
movsxd rax, dword [rbx + 0x1930]
mov dword [rbx + rax*4 + 0x1038], ecx
movzx eax, word [r8]
add ax, word [rsi + rdi*4]
mov word [rsi + r9*4], ax
movzx eax, byte [rcx + rbx + 0x1934]
cmp byte [rdi + rbx + 0x1934], al
jb 0x1800a6e92
movzx eax, byte [rdi + rbx + 0x1934]
jmp 0x1800a6e9a
movzx eax, byte [rcx + rbx + 0x1934]
inc al
mov rdx, rsi
mov byte [r9 + rbx + 0x1934], al
mov rcx, rbx
mov word [r8 + 2], r14w
mov r8d, r12d
mov word [rsi + rdi*4 + 2], r14w
mov dword [rbx + 0x103c], r14d
inc r14d
call fcn.1800a9390
cmp dword [rbx + 0x192c], 2
jge 0x1800a6e05
dec dword [rbx + 0x1930]
mov rdx, r15
movsxd rcx, dword [rbx + 0x1930]
mov eax, dword [rbx + 0x103c]
mov dword [rbx + rcx*4 + 0x1038], eax
mov rcx, rbx
call fcn.1800a8380
mov r8d, ebp
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
jmp fcn.1800a85c0
Function at 0x1800a7220
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r10, r8
mov r9, rdx
test rdx, rdx
jne 0x1800a7236
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rbx
lea rbx, [0x18032e650]
not ecx
cmp r10, 8
jb 0x1800a7324
mov r11, r10
shr r11, 3
imul rax, r11, 0xfffffffffffffff8
add r10, rax
nop dword [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
mov edx, dword [rbx + rax*4]
xor edx, ecx
movzx ecx, byte [r9 + 1]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 2]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 3]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 4]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 5]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 6]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 7]
add r9, 8
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
sub r11, 1
jne 0x1800a7260
test r10, r10
je 0x1800a7350
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [rbx + r8*4]
xor ecx, eax
sub r10, 1
jne 0x1800a7330
mov rbx, qword [rsp]
not ecx
mov eax, ecx
add rsp, 8
ret
Function at 0x1800aa030
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbp, rdx
mov rcx, qword [rcx + 0xa8]
test rcx, rcx
je 0x1800aa0bc
mov eax, dword [rdi + 0xb4]
mov qword [rsp + 0x48], rsi
mov esi, dword [rdi + 0xb0]
cmp eax, esi
jb 0x1800aa07d
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
sub esi, eax
lea rdx, [rcx + rax]
cmp esi, r8d
mov rcx, rbp
cmova esi, r8d
mov r8d, esi
call fcn.18020f990
mov ecx, dword [rdi + 0x90]
mov rdx, rbp
add dword [rdi + 0xb4], esi
add dword [rdi + 0x8c], esi
mov r8d, esi
call fcn.1800a7220
mov dword [rdi + 0x90], eax
mov eax, esi
jmp 0x1800aa068
mov rcx, qword [rdi + 0x98]
test rcx, rcx
je 0x1800aa113
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800aa11a
mov ebx, dword [rsp + 0x40]
mov rdx, rbp
add dword [rdi + 0x8c], ebx
mov r8d, ebx
mov ecx, dword [rdi + 0x90]
call fcn.1800a7220
mov dword [rdi + 0x90], eax
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov dword [rdi + 0x24], 0x1000000
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1800aa7c0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x41], 0
mov rsi, rdx
mov edi, r8d
mov rbx, rcx
je 0x1800aa8c8
mov rcx, qword [rcx + 0x50]
mov qword [rsp + 0x48], rbp
test rcx, rcx
je 0x1800aa802
cmp dword [rbx + 0x58], edi
jae 0x1800aa802
call fcn.1800b7510
mov qword [rbx + 0x50], 0
cmp qword [rbx + 0x50], 0
jne 0x1800aa818
lea ecx, [rdi + rdi]
call fcn.1800b7c98
mov qword [rbx + 0x50], rax
mov dword [rbx + 0x58], edi
mov rcx, qword [rbx + 0x50]
mov r8, rdi
mov rdx, rsi
mov rbp, rdi
call fcn.18020f990
test edi, edi
je 0x1800aa8bf
xor r11d, r11d
lea rsi, [0x18032e650]
nop dword [rax]
mov rax, qword [rbx + 0x50]
lea r11, [r11 + 1]
mov r8d, dword [rbx + 0x4c]
mov ecx, dword [rbx + 0x44]
mov r9d, r8d
and r9d, 0xfffd
movsx r10, byte [r11 + rax - 1]
or r9d, 2
mov eax, dword [rbx + 0x44]
xor rcx, r10
movzx edx, cl
shr eax, 8
mov ecx, dword [rsi + rdx*4]
xor ecx, eax
movzx eax, cl
add eax, dword [rbx + 0x48]
mov dword [rbx + 0x44], ecx
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 0x48], ecx
movzx eax, byte [rbx + 0x4b]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
mov eax, dword [rsi + rcx*4]
mov ecx, r9d
xor ecx, 1
xor eax, r8d
imul ecx, r9d
mov dword [rbx + 0x4c], eax
mov rax, qword [rbx + 0x50]
shr ecx, 8
xor cl, r10b
mov byte [r11 + rax - 1], cl
sub rbp, 1
jne 0x1800aa840
mov rsi, qword [rbx + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdx, qword [rbx + 0x30]
test rdx, rdx
je 0x1800aa918
mov ecx, dword [rbx + 0x38]
lea eax, [rcx + rdi]
cmp eax, dword [rbx + 0x3c]
jb 0x1800aa8f5
mov dword [rbx + 0x24], 0x30000
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
add rcx, rdx
mov r8, rdi
mov rdx, rsi
call fcn.18020f990
add dword [rbx + 0x38], edi
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800aa94f
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x58]
xor eax, eax
mov dword [rbx + 0x24], 0x1000000
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800aafe0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x40
cmp qword [rcx + 0x58], 0x10
lea rsi, [rcx + 0x40]
movzx ebx, dl
jb 0x1800ab003
mov rcx, qword [rsi]
jmp 0x1800ab006
mov rcx, rsi
mov eax, reloc.WS2_32.dll_socket
mov qword [rsp + 0x58], rdi
test bl, bl
mov r14d, reloc.WS2_32.dll_setsockopt
cmovne r14d, eax
or r8d, 0xffffffff
mov edx, r14d
call fcn.18009ea10
test rax, rax
jne 0x1800ab215
call fcn.18009fcd0
cmp dword [rax], 8
je 0x1800ab144
test bl, bl
je 0x1800ab213
cmp qword [rsi + 0x18], 0x10
jb 0x1800ab053
mov rcx, qword [rsi]
jmp 0x1800ab056
mov rcx, rsi
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x12019f
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1800ab144
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsi + 0x18], 0x10
jb 0x1800ab0a4
mov rbx, qword [rsi]
jmp 0x1800ab0a7
mov rbx, rsi
call fcn.18009fcd0
mov ecx, dword [rax]
call fcn.18009e8e0
mov r9, rax
lea rdx, str.open_db__s_failed_db_broken:_s__forced_reset_successful
mov r8, rbx
mov ecx, 7
call fcn.1800a2ce0
cmp qword [rsi + 0x18], 0x10
jb 0x1800ab0d6
mov rcx, qword [rsi]
jmp 0x1800ab0d9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp qword [rsi + 0x18], 0x10
jb 0x1800ab0eb
mov rcx, qword [rsi]
jmp 0x1800ab0ee
mov rcx, rsi
or r8d, 0xffffffff
mov edx, r14d
call fcn.18009ea10
test rax, rax
jne 0x1800ab215
cmp qword [rsi + 0x18], 0x10
jb 0x1800ab10d
mov rsi, qword [rsi]
call fcn.18009fcd0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
mov edi, eax
call fcn.18009e8e0
mov r9, rax
mov dword [rsp + 0x20], edi
mov r8, rsi
lea rdx, str.open_db__s_failed_db_broken:_s
mov ecx, 7
call fcn.1800a2ce0
jmp 0x1800ab213
call fcn.18009fcd0
cmp dword [rax], 3
jne 0x1800ab213
cmp qword [rsi + 0x18], 0x10
mov qword [rsp + 0x50], rbp
jb 0x1800ab163
mov rbp, qword [rsi]
jmp 0x1800ab166
mov rbp, rsi
call fcn.18009fcd0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
mov edi, eax
call fcn.18009e8e0
mov r9, rax
mov dword [rsp + 0x20], edi
mov r8, rbp
lea rdx, str.open_db__s_failed_db_broken:_s_:_d
mov ecx, 8
call fcn.1800a2ce0
cmp qword [rsi + 0x18], 0x10
mov rbp, qword [rsp + 0x50]
jb 0x1800ab1a9
mov rcx, qword [rsi]
jmp 0x1800ab1ac
mov rcx, rsi
call fcn.18009f840
test eax, eax
jne 0x1800ab1d5
cmp qword [rsi + 0x18], 0x10
jb 0x1800ab1bf
mov rsi, qword [rsi]
mov r8, rsi
lea rdx, str._s:repaire_failed
mov ecx, 8
call fcn.1800a2ce0
jmp 0x1800ab213
cmp qword [rsi + 0x18], 0x10
jb 0x1800ab1e1
mov r8, qword [rsi]
jmp 0x1800ab1e4
mov r8, rsi
lea rdx, str._s:repaire_sucess
mov ecx, 8
call fcn.1800a2ce0
cmp qword [rsi + 0x18], 0x10
jb 0x1800ab1ff
mov rsi, qword [rsi]
or r8d, 0xffffffff
mov edx, r14d
mov rcx, rsi
call fcn.18009ea10
test rax, rax
jne 0x1800ab215
xor eax, eax
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1800b03c0
Capabilities:
Get file version info

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x260
mov rax, qword [0x1804a20e0]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor bl, bl
mov r14, rdx
cmp qword [rcx + 0x10], 0
mov rdi, rcx
je 0x1800b05b5
mov qword [rsp + 0x290], rsi
call fcn.180081e60
mov rcx, rax
lea rdx, [rsp + 0x30]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test eax, eax
je 0x1800b05b0
mov ecx, esi
mov qword [rsp + 0x288], rbp
lea rdx, [0x1804bd370]
call fcn.1800b846c
mov rbp, rax
test rax, rax
je 0x1800b0581
mov rcx, rdi
call fcn.180081e60
mov edx, dword [rsp + 0x30]
mov rcx, rax
mov r9, rbp
mov r8d, esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1800b0579
lea r9, [rsp + 0x34]
mov rcx, rbp
lea r8, [rsp + 0x38]
lea rdx, str.VarFileInfoTranslation
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1800b0579
mov rax, qword [rsp + 0x38]
mov rdi, qword [r14]
mov qword [rsp + 0x298], r15
movzx r15d, word [rax]
movzx eax, word [rax + 2]
mov rbx, qword [rdi]
shl r15d, 0x10
or r15d, eax
cmp rbx, rdi
je 0x1800b056f
cmp qword [rbx + 0x38], 8
jb 0x1800b04b2
mov rax, qword [rbx + 0x20]
jmp 0x1800b04b6
lea rax, [rbx + 0x20]
mov r9d, r15d
mov qword [rsp + 0x20], rax
lea r8, str.StringFileInfo_08lx_s
mov edx, 0x100
lea rcx, [rsp + 0x50]
call fcn.1800b0d00
lea r9, [rsp + 0x34]
mov rcx, rbp
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1800b0517
mov rdx, qword [rsp + 0x40]
cmp word [rdx], 0
jne 0x1800b04ff
xor r8d, r8d
jmp 0x1800b050e
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x1800b0503
lea rcx, [rbx + 0x40]
call fcn.1800856c0
cmp byte [rbx + 0x19], 0
jne 0x1800b0566
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1800b0541
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1800b0566
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1800b0533
jmp 0x1800b0566
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1800b0563
nop dword [rax + rax]
cmp rbx, qword [rax + 0x10]
jne 0x1800b0563
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1800b0550
mov rbx, rax
cmp rbx, rdi
jne 0x1800b04a5
mov r15, qword [rsp + 0x298]
mov bl, 1
mov rcx, rbp
call fcn.1800b7510
mov rbp, qword [rsp + 0x288]
movzx eax, bl
mov rsi, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1800b8140
add rsp, 0x260
pop r14
pop rdi
pop rbx
ret
movzx eax, bl
jmp 0x1800b058c
movzx eax, bl
jmp 0x1800b0594

Function at 0x1800b0d60
Capabilities:
Initialize winsock library
Print debug messages

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x1804a20e0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1800b0d9f
lea rcx, str.WSAStartup_error___n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rax, rbx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1800b8140
add rsp, 0x1d0
pop rbx
ret
Function at 0x1800b0dd0
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x198
mov rax, qword [0x1804a20e0]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rsi, r8
mov dword [rsp + 0x34], 1
mov r15, rdx
mov r14, rcx
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x105
mov rbp, r9
call fcn.18020fe90
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x30], 0x105
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x40]
xor ebx, ebx
cmp ax, 9
je 0x1800b0e40
cmp ax, 6
mov eax, ebx
jne 0x1800b0e45
mov eax, 1
test eax, eax
mov ecx, 0x100
mov r9d, 0x200
lea rax, [rsp + 0x38]
cmovne r9d, ecx
mov qword [rsp + 0x20], rax
or r9d, 0x20019
xor r8d, r8d
mov rdx, r15
mov rcx, r14
mov edi, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1800b0ede
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1800b0ede
cmp byte [rsp + 0x70], bl
je 0x1800b0ec9
lea rax, [rsp + 0x70]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], dil
jne 0x1800b0ec0
mov r8, rbx
lea rdx, [rsp + 0x70]
mov rcx, rbp
call fcn.180085e70
mov edi, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1800b8140
add rsp, 0x198
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1800b0f10
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x290
mov rax, qword [0x1804a20e0]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, r8
mov qword [rsp + 0x38], rcx
mov r14, rdx
mov dword [rsp + 0x34], 1
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x20a
mov rbp, r9
call fcn.18020fe90
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x30], 0x105
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x40]
xor ebx, ebx
cmp ax, 9
je 0x1800b0f80
cmp ax, 6
mov eax, ebx
jne 0x1800b0f85
mov eax, 1
test eax, eax
mov ecx, 0x100
mov r9d, 0x200
lea rax, [rsp + 0x38]
cmovne r9d, ecx
mov qword [rsp + 0x20], rax
or r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov rcx, 0xffffffff80000002
mov edi, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800b101e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800b101e
cmp word [rsp + 0x70], bx
je 0x1800b1009
lea rax, [rsp + 0x70]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], di
jne 0x1800b1000
mov r8, rbx
lea rdx, [rsp + 0x70]
mov rcx, rbp
call fcn.1800856c0
mov edi, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1800b8140
add rsp, 0x290
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800b1050
Capabilities:
Get disk information

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x510
mov rax, qword [0x1804a20e0]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rbp, rdx
mov r14, rcx
xor edx, edx
lea rcx, [rsp + 0x100]
mov r8d, 0x3e8
call fcn.18020fe90
xor eax, eax
lea rcx, [rsp + 0x30]
xor r15d, r15d
mov dword [rsp + 0x22], eax
xor edx, edx
mov word [rsp + 0x20], r15w
mov r8d, reloc.WLDAP32.dll_Ordinal_200
call fcn.18020fe90
test r14, r14
je 0x1800b1250
test rbp, rbp
je 0x1800b1250
lea r8d, [r15 + 0xc]
mov rcx, r14
lea rdx, str.DeviceMup_
call fcn.180217e18
test eax, eax
jne 0x1800b10fa
lea rdx, [0x18032feb4]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [r14 + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [r15 + 1]
jmp 0x1800b1211
mov qword [rsp + 0x540], rbx
lea rdx, [rsp + 0x100]
mov qword [rsp + 0x508], rsi
mov ecx, 0x3e8
mov qword [rsp + 0x500], rdi
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x1800b11eb
mov edi, r15d
cmp word [rsp + 0x100], di
je 0x1800b11eb
lea rbx, [rsp + 0x100]
nop word [rax + rax]
movsxd rax, edi
lea rsi, [rsp + 0x100]
lea rdx, [0x180330200]
lea rsi, [rsi + rax*2]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1800b11da
lea rdx, [0x180330208]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1800b11da
movzx eax, word [rbx]
lea rdx, [rsp + 0x30]
mov word [rsp + 0x20], ax
lea rcx, [rsp + 0x20]
movzx eax, word [rbx + 2]
mov r8d, 0x64
mov word [rsp + 0x22], ax
mov word [rsp + 0x24], r15w
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x1800b11f7
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rsi, eax
lea rdx, [rsp + 0x30]
mov r8, rsi
mov rcx, r14
call fcn.180217e18
test eax, eax
je 0x1800b122e
add rbx, 8
add edi, 4
cmp word [rbx], r15w
jne 0x1800b1150
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
mov rsi, qword [rsp + 0x508]
mov rbx, qword [rsp + 0x540]
mov rdi, qword [rsp + 0x500]
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.1800b8140
add rsp, 0x510
pop r15
pop r14
pop rbp
ret
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [r14 + rsi*2]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, 1
jmp 0x1800b11f9
xor eax, eax
jmp 0x1800b1211
Function at 0x1800b1480
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x1804a20e0]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rdx
mov r8d, ecx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1800b14f2
xor edx, edx
lea rcx, [rsp + 0x230]
mov r8d, 0x208
call fcn.18020fe90
mov r8d, 0x104
lea rdx, [rsp + 0x230]
mov rcx, rbx
call sub.KERNEL32.dll_K32GetProcessImageFileNameW
test eax, eax
jne 0x1800b14f6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1800b155a
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.18020fe90
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x230]
call fcn.1800b1050
test eax, eax
je 0x1800b14e9
cmp word [rsp + 0x20], 0
jne 0x1800b152b
xor r8d, r8d
jmp 0x1800b153f
lea rax, [rsp + 0x20]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1800b1534
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1800856c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1800b8140
mov rbx, qword [rsp + 0x470]
add rsp, 0x450
pop rdi
ret

Function at 0x1800b1750
Capabilities:
Get common file path
Get file version info

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x268
mov rax, qword [0x1804a20e0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r15, r8
mov r14, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
mov rbp, r9
call fcn.18020fe90
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x25]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1800b185c
lea rdx, str.kernel32.dll
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x1800b185c
xor edx, edx
lea rcx, [rsp + 0x40]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test eax, eax
je 0x1800b185c
mov ecx, edi
call fcn.1800b7c98
mov r9, rax
lea rcx, [rsp + 0x40]
mov r8d, edi
xor edx, edx
mov rbx, rax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1800b1854
xor eax, eax
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
mov dword [rsp + 0x30], eax
lea rdx, [0x18033024c]
mov qword [rsp + 0x38], rax
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1800b1854
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx + 0xa]
mov dword [rsi], eax
movzx eax, word [rcx + 8]
mov dword [r14], eax
movzx eax, word [rcx + 0xe]
mov dword [r15], eax
movzx eax, word [rcx + 0xc]
mov rcx, rbx
mov dword [rbp], eax
call fcn.1800b7510
mov al, 1
jmp 0x1800b185e
mov rcx, rbx
call fcn.1800b7510
xor al, al
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1800b8140
add rsp, 0x268
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800d81e0
Capabilities:
Query environment variable

Disassembly:
mov eax, Ordinal_41
call fcn.1800b8180
sub rsp, rax
cmp dword [0x1804bdcfc], 0
jne 0x1800d8342
mov qword [rsp + 0x38], rbp
lea r8d, [rax + 8]
mov qword [rsp + 0x40], rsi
lea rcx, str.OPENSSL_ia32cap
mov qword [rsp + 0x20], rdi
lea rdi, [0x1804bdd00]
mov rdx, rdi
mov dword [0x1804bdcfc], 1
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x2e
ja 0x1800d830e
movzx r11d, word [0x1804bdd00]
xor ebp, ebp
mov eax, ebp
cmp r11w, 0x7e
sete al
lea rcx, [rdi + rax*2]
call fcn.1800d8830
mov rsi, rax
cmp r11w, 0x7e
jne 0x1800d829d
mov qword [rsp + 0x30], rbx
lea rcx, [0x18059f5a0]
mov rbx, rax
call fcn.180004bf0
movzx r11d, word [0x1804bdd00]
not rsi
and rsi, rax
bt rbx, 0x18
mov rbx, qword [rsp + 0x30]
jae 0x1800d82bb
movabs rax, 0xedfff7fdffffffff
and rsi, rax
jmp 0x1800d82bb
cmp r11w, 0x3a
jne 0x1800d82bb
lea rcx, [0x18059f5a0]
call fcn.180004bf0
movzx r11d, word [0x1804bdd00]
mov rsi, rax
test r11w, r11w
je 0x1800d82d7
cmp r11w, 0x3a
je 0x1800d82df
movzx r11d, word [rdi + 2]
add rdi, 2
test r11w, r11w
jne 0x1800d82c1
mov dword [0x18059f5a8], ebp
jmp 0x1800d831d
cmp word [rdi + 2], 0x7e
sete bpl
lea rcx, [rbp + 1]
lea rcx, [rdi + rcx*2]
call fcn.1800d8830
cmp word [rdi + 2], 0x7e
jne 0x1800d8306
not eax
and dword [0x18059f5a8], eax
jmp 0x1800d831d
mov dword [0x18059f5a8], eax
jmp 0x1800d831d
lea rcx, [0x18059f5a0]
call fcn.180004bf0
mov rsi, rax
mov rdi, qword [rsp + 0x20]
mov eax, esi
mov rbp, qword [rsp + 0x38]
bts eax, 0xa
shr rsi, 0x20
mov dword [0x18059f5a4], esi
mov rsi, qword [rsp + 0x40]
mov dword [0x18059f5a0], eax
add rsp, 0x28
ret