joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140031b80
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140049fa0]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140031bc7
or eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14001b2b0
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.14001fa40
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14001b2b0
add rsp, 0x38
ret

Function at 0x140034690
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0x20
mov rbp, rdx
xor edi, edi
xor edx, edx
lea r8d, [rdi + 1]
mov esi, ecx
call fcn.14002f240
cmp rax, 0xffffffffffffffff
mov r13, rax
je 0x140034834
lea r8d, [rdi + 2]
xor edx, edx
mov ecx, esi
call fcn.14002f240
cmp rax, 0xffffffffffffffff
je 0x140034834
mov qword [rsp + 0x40], rbx
mov rbx, rbp
mov qword [rsp + 0x50], r14
sub rbx, rax
test rbx, rbx
jle 0x1400347b3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r14d, 0x1000
lea edx, [rdi + 8]
mov rcx, rax
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbp, rax
jne 0x140034739
call fcn.14001e9f0
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
call fcn.14001e9f0
mov eax, dword [rax]
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
mov edx, 0x8000
mov ecx, esi
mov qword [rsp + 0x48], r12
call fcn.140034850
mov r12d, eax
nop
mov r8d, ebx
cmp rbx, r14
mov rdx, rbp
cmovge r8d, r14d
mov ecx, esi
call fcn.140027300
cmp eax, 0xffffffff
je 0x140034775
cdqe
sub rbx, rax
test rbx, rbx
jg 0x140034750
jmp 0x14003478e
call fcn.14001ea20
cmp dword [rax], 5
jne 0x14003478a
call fcn.14001e9f0
mov dword [rax], 0xd
or rdi, 0xffffffffffffffff
mov edx, r12d
mov ecx, esi
call fcn.140034850
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, qword [rsp + 0x48]
jmp 0x14003480c
test rbx, rbx
jns 0x140034816
xor r8d, r8d
mov rdx, rbp
mov ecx, esi
call fcn.14002f240
cmp rax, 0xffffffffffffffff
je 0x14003471a
mov ecx, esi
call fcn.14002f5e0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb rdi, rdi
neg rdi
sub rdi, 1
cmp rdi, 0xffffffffffffffff
jne 0x140034816
call fcn.14001e9f0
mov dword [rax], 0xd
call fcn.14001ea20
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
cmp rdi, 0xffffffffffffffff
je 0x14003471a
xor r8d, r8d
mov rdx, r13
mov ecx, esi
call fcn.14002f240
cmp rax, 0xffffffffffffffff
je 0x14003471a
xor eax, eax
jmp 0x140034721
call fcn.14001e9f0
mov rbp, qword [rsp + 0x58]
mov eax, dword [rax]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
Function at 0x140034e38
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x140049fa0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.14001b8f0
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x140000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.14001b8f0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x140034ecb
cmp dword [rsp + 0x24], 5
jb 0x140034ee5
jmp 0x140034ee1
cmp dword [rsp + 0x30], esi
jne 0x140034ee5
cmp dword [rsp + 0x24], 4
ja 0x140034ee1
jne 0x140034ee5
cmp dword [rsp + 0x28], 0
jbe 0x140034ee5
mov byte [rbx + 0x18], sil
lea rax, [0x14003e490]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.140034cf8
movzx ecx, byte [0x14004bfc0]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x14004bfc0], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14001b2b0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140034fe0
Capabilities:
Check os version
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0xf0
mov rax, qword [0x140049fa0]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rax, qword [0x14004bb50]
cmp rax, 1
jne 0x140035142
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x94
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x50], 2
jne 0x14003511d
cmp dword [rsp + 0x44], 5
jae 0x14003511d
mov qword [0x14004bb50], 0
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x100], rdi
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, 1
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
call qword [sym.imp.USER32.dll_GetCursor]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor r8d, r8d
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rdi, qword [rsp + 0x100]
test rsi, rsi
je 0x1400350f9
lea rcx, [0x14004b908]
lea rdx, [0x14004bb78]
nop
cmp rsi, qword [rcx - 8]
jne 0x1400350f0
mov rax, qword [rcx]
test rax, rax
cmovne rsi, rax
add rcx, 0x30
cmp rcx, rdx
jl 0x1400350e0
mov rax, rsi
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14001b2b0
mov rbx, qword [rsp + 0x108]
add rsp, 0xf0
pop rsi
ret
test rbx, rbx
je 0x14003513b
lea rdx, str.GetCursorInfo
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14004bb50], rax
jmp 0x140035142
mov rax, qword [0x14004bb50]
test rax, rax
je 0x140035054
xor ecx, ecx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x18
call rax
test eax, eax
je 0x140035180
cmp dword [rsp + 0x24], 0
je 0x140035180
mov rsi, qword [rsp + 0x28]
jmp 0x1400350c9
xor eax, eax
jmp 0x1400350fc
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x140a0e0b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140a0e237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140a0e0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a0e0c7
add dl, dl
jne 0x140a0e0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a0e14e
xor eax, eax
add dl, dl
jne 0x140a0e0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a0e205
add dl, dl
jne 0x140a0e10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a0e11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a0e128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a0e135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140a0e142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140a0e0d6
mov eax, 1
add dl, dl
jne 0x140a0e15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a0e16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a0e153
sub eax, ebx
mov ebx, 1
jne 0x140a0e1a4
mov ecx, 1
add dl, dl
jne 0x140a0e186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a0e193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a0e17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a0e0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140a0e1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a0e1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a0e1b5
cmp eax, 0x7d00
jae 0x140a0e1f3
cmp eax, 0x500
jb 0x140a0e1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a0e0d6
cmp eax, 0x7f
ja 0x140a0e1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a0e0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140a0e22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140a0e0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180003170
Capabilities:
Get common file path

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
lea rcx, [rbp + 0x38]
mov qword [rbp + 0x38], rdi
mov qword [rbp - 8], rdi
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x28], rdi
mov qword [rbp + 0x20], rdi
call fcn.180006f30
mov rdx, qword [rbp + 0x38]
lea rcx, [rbp + 0x30]
call fcn.180006010
lea r9, [rbp - 0x10]
lea rcx, [0x180030778]
xor r8d, r8d
xor edx, edx
mov qword [rbp - 0x10], rdi
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x1800031d3
mov rdx, qword [rbp - 0x10]
mov rcx, rbx
call fcn.180005d00
lea rdx, str.BrightData_
mov rcx, rbx
call fcn.180005e20
mov rcx, qword [rbp + 0x30]
or rdx, 0xffffffffffffffff
nop word [rax + rax]
inc rdx
cmp byte [rcx + rdx], dil
jne 0x1800031f0
lea r8, [rbp + 0x28]
call fcn.1800077b0
test eax, eax
jne 0x180003238
mov rdx, qword [rbp + 0x28]
lea r8d, [rax + 0x14]
lea rcx, [rbp + 0x20]
call fcn.180007b70
mov rcx, qword [rbp + 0x20]
call fcn.180005bf0
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp - 8]
call fcn.180005f00
mov rcx, rbx
mov rdx, qword [rax]
call fcn.180005e20
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x18000324a
call fcn.1800099d8
mov qword [rbp + 0x28], rdi
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x18000325c
call fcn.1800099d8
mov qword [rbp + 0x20], rdi
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x18000326e
call fcn.1800099d8
mov qword [rbp + 0x30], rdi
lea rcx, [rbp - 8]
call fcn.180005cb0
lea rcx, [rbp + 0x38]
call fcn.180005cb0
mov rax, rbx
add rsp, 0x30
pop rdi
pop rbx
pop rbp
ret
Function at 0x180003490
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x290
mov rax, qword [0x18003d1b0]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor ebp, ebp
lea rcx, [rsp + 0x28]
mov ebx, ebp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call fcn.180006f30
lea rdx, [0x18002f5c0]
lea rcx, [rsp + 0x28]
call fcn.180005e20
cmp dword [section..data], ebx
je 0x1800034fd
mov rcx, qword [rsp + 0x28]
call fcn.180006ba0
test eax, eax
jne 0x1800034fd
lea rcx, [rsp + 0x28]
call fcn.180003170
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x20]
call fcn.180005d00
lea rdx, [0x18002f5d8]
lea rcx, [rsp + 0x20]
call fcn.180005e20
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
mov rsi, rax
cmove rsi, rbp
test rsi, rsi
je 0x180003653
mov qword [rsp + 0x2a0], rdi
nop dword [rax]
lea rdx, [0x18002f600]
lea rcx, [rsp + 0x5c]
call fcn.180005df0
test rax, rax
jne 0x1800035d7
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x20]
call fcn.180005d00
lea rdx, [0x18002f5d4]
lea rcx, [rsp + 0x20]
call fcn.180005e20
lea rdx, [rsp + 0x5c]
lea rcx, [rsp + 0x20]
call fcn.180005e20
mov edx, 1
lea ecx, [rdx + 0x17]
call fcn.180009994
mov rdx, qword [rsp + 0x20]
lea rcx, [rax + 0x10]
mov rdi, rax
call fcn.180005d00
test rbx, rbx
je 0x1800035cd
mov rcx, qword [rbx + 8]
mov qword [rdi + 8], rcx
mov qword [rbx + 8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rdi
jmp 0x1800035d4
mov qword [rdi + 8], rdi
mov rbx, rdi
mov qword [rdi], rbp
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180003550
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
test rbx, rbx
je 0x18000364b
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
call fcn.180009b18
mov rdi, rbx
mov rbx, qword [rbx]
mov rcx, qword [rdi]
test rcx, rcx
je 0x180003621
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x18000362e
test rbx, rbx
je 0x18000362e
mov rax, qword [rdi + 8]
mov qword [rbx + 8], rax
lea rcx, [rdi + 0x10]
mov qword [rdi], rbp
mov qword [rdi + 8], rbp
call fcn.180005cb0
mov rcx, rdi
call fcn.1800099d8
test rbx, rbx
jne 0x180003600
mov rdi, qword [rsp + 0x2a0]
lea rcx, [rsp + 0x20]
call fcn.180005cb0
lea rcx, [rsp + 0x28]
call fcn.180005cb0
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.180009cc0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
Function at 0x180003720
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rax, qword [0x18003edf0]
test rax, rax
jne 0x18000386b
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
call fcn.180006f30
lea rdx, [0x18002f810]
lea rcx, [rsp + 0x40]
call fcn.180005e20
mov rcx, qword [rsp + 0x40]
call fcn.180006b20
test eax, eax
je 0x180003846
mov rcx, qword [rsp + 0x40]
lea rdx, [0x18002f82c]
call fcn.180006a80
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180003846
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea r8d, [rdx + 2]
call fcn.180008ae8
mov rcx, qword [rsp + 0x30]
call fcn.180008e70
mov rcx, qword [rsp + 0x30]
movsxd rbx, eax
call fcn.1800090e8
cmp ebx, 0x32
jg 0x180003841
lea rcx, [rsp + 0x38]
mov edx, ebx
call fcn.180005a40
mov r9, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov r8, rbx
mov edx, 1
call fcn.180008974
mov rax, qword [rsp + 0x38]
mov byte [rbx + rax], 0
mov rdx, qword [rsp + 0x38]
test rbx, rbx
jle 0x180003835
mov r9, rdx
mov r8, rdx
movabs r10, 0x21ffffff80ffd
neg r9
nop dword [rax + rax]
movzx ecx, byte [r8]
lea eax, [rcx - 0x2e]
cmp al, 0x31
ja 0x180003821
bt r10, rax
jb 0x180003829
sub cl, 0x61
cmp cl, 0x19
ja 0x180003841
inc r8
lea rax, [r9 + r8]
cmp rax, rbx
jl 0x180003810
lea rcx, [0x18003edf0]
call fcn.180005f00
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180006af0
lea rcx, [rsp + 0x38]
call fcn.180005a80
lea rcx, [rsp + 0x40]
call fcn.180005cb0
mov rax, qword [0x18003edf0]
add rsp, 0x28
ret

Function at 0x180003b60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
lea r8, [0x18002f928]
movzx edx, dx
mov ebx, r9d
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
jne 0x180003ba5
imul eax, ebx, 0x64
inc eax
mov dword [0x18003e86c], eax
xor eax, eax
jmp 0x180003c03
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x180003bc6
imul eax, ebx, 0x64
add eax, 2
mov dword [0x18003e86c], eax
xor eax, eax
jmp 0x180003c03
mov rcx, rax
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
jne 0x180003bec
imul eax, ebx, 0x64
add eax, 3
mov dword [0x18003e86c], eax
xor eax, eax
jmp 0x180003bfe
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [r14], eax
mov rax, rdi
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180003cf0
Capabilities:
Move file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
imul edi, r9d, 0x64
mov rbx, r8
lea r8, [rbp + 0x38]
lea r9d, [rdi + 1]
or esi, 0xffffffff
mov qword [rbp - 0x10], 0
call fcn.180003b60
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov r14, rax
test rax, rax
je 0x180003e7f
lea rcx, [rbp - 0x20]
call fcn.180006f30
lea rdx, [0x18002f5c0]
lea rcx, [rbp - 0x20]
call fcn.180005e20
cmp dword [section..data], 0
je 0x180003d78
mov rcx, qword [rbp - 0x20]
call fcn.180006ba0
test eax, eax
jne 0x180003d78
lea rcx, [rbp - 0x20]
call fcn.180003170
lea rdx, [0x18002f5fc]
lea rcx, [rbp - 0x20]
call fcn.180005e20
lea rcx, [rbp - 0x20]
mov rdx, rbx
call fcn.180005e20
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x18]
call fcn.180005d00
lea rdx, [0x18002f938]
lea rcx, [rbp - 0x18]
call fcn.180005e20
mov rcx, qword [rbp - 0x18]
call fcn.180009b18
mov rcx, qword [rbp - 0x20]
call fcn.180006b20
movsxd rbx, dword [rbp + 0x38]
test eax, eax
je 0x180003e1d
mov rcx, qword [rbp - 0x20]
mov r8d, ebx
mov rdx, r14
call fcn.180003c20
test eax, eax
jne 0x180003e7d
mov rcx, qword [rbp - 0x20]
call fcn.180009b18
mov rcx, qword [rbp - 0x20]
call fcn.180006b20
test eax, eax
je 0x180003e05
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
call fcn.180009b20
mov rcx, qword [rbp - 0x20]
call fcn.180006b20
test eax, eax
je 0x180003e1d
lea eax, [rdi + 2]
mov dword [0x18003e86c], eax
jmp 0x180003e7f
mov rcx, qword [rbp - 0x20]
lea rdx, [0x18002f948]
call fcn.180006a80
mov qword [rbp - 0x10], rax
test rax, rax
jne 0x180003e5a
mov rcx, qword [rbp - 0x20]
lea rdx, [0x18002f958]
call fcn.180006a80
mov qword [rbp - 0x10], rax
test rax, rax
jne 0x180003e5a
lea eax, [rdi + 3]
mov dword [0x18003e86c], eax
jmp 0x180003e7f
mov r9, rax
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.180009058
cmp rax, rbx
je 0x180003e7d
lea eax, [rdi + 4]
mov dword [0x18003e86c], eax
jmp 0x180003e7f
xor esi, esi
lea rcx, [rbp - 0x20]
call fcn.180005cb0
lea rcx, [rbp - 0x18]
call fcn.180005cb0
lea rcx, [rbp - 0x10]
call fcn.180006af0
mov rbx, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x180004a60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, rcx
xor ebx, ebx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
call fcn.180005e20
lea rdx, str.kbasnthasciateuhant98437uau
lea rcx, [rsp + 0x38]
call fcn.180005e20
mov rcx, qword [rsp + 0x38]
call fcn.180009b18
xor ecx, ecx
call fcn.180009958
mov rcx, qword [rsp + 0x38]
lea rdx, str.rbe
call fcn.180006a80
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x180004ae3
mov rcx, qword [rsp + 0x38]
lea rdx, str.wbe
call fcn.180006a80
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x180004ae3
call fcn.180009834
imul ebx, dword [rax], 0x64
inc ebx
jmp 0x180004b14
xor ecx, ecx
call fcn.180009958
mov r9, qword [rsp + 0x40]
mov edx, 1
lea rcx, [0x18002f80c]
mov r8d, edx
call fcn.180009058
cmp rax, 1
je 0x180004b14
call fcn.180009834
imul ebx, dword [rax], 0x64
add ebx, 2
lea rcx, [rsp + 0x40]
call fcn.180006af0
mov rcx, qword [rsp + 0x38]
call fcn.180009b18
lea rcx, [rsp + 0x38]
call fcn.180005cb0
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1800065f0
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rdi
push r14
push r15
sub rsp, 0x68
mov r14, rcx
mov rcx, qword [r8]
mov ebp, edx
mov edx, 2
mov rdi, r8
call fcn.18000bdf8
xor r15d, r15d
xor r9d, r9d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rdi], rax
mov qword [rsp + 0x40], r15
mov word [rax], r15w
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa8]
xor r8d, r8d
xor edx, edx
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x180006675
or eax, 0xffffffff
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rbp
ret
cmp dword [rsp + 0xa8], ebp
jg 0x18000668e
mov eax, 1
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rbp
ret
mov qword [rsp + 0x90], rbx
mov ebx, dword [rsp + 0xa0]
xor ecx, ecx
inc ebx
mov qword [rsp + 0x60], rsi
lea eax, [rbx + 1]
mov dword [rsp + 0xa0], ebx
movsxd rdx, eax
add rdx, rdx
call fcn.18000bdf8
mov qword [rsp + 0x38], r15
movsxd rcx, ebx
mov word [rax], r15w
mov word [rax + rcx*2], r15w
mov qword [rsp + 0x30], r15
lea r9, [rsp + 0xa0]
mov rcx, r14
mov r8, rax
mov edx, ebp
mov qword [rsp + 0x28], r15
mov rsi, rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rbx, qword [rsp + 0x90]
test eax, eax
je 0x180006713
or eax, 0xffffffff
mov rsi, qword [rsp + 0x60]
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rbp
ret
mov rcx, qword [rdi]
test rcx, rcx
je 0x180006723
call fcn.1800099d8
mov qword [rdi], r15
mov qword [rdi], rsi
mov rsi, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rbp
ret
Function at 0x180006870
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r15, r8
xor ebx, ebx
lea r8, [0x180030e64]
mov rsi, r9
or edi, 0xffffffff
mov ebp, ebx
mov dword [rsp + 0x60], ebx
call fcn.180006350
mov r14, rax
test rax, rax
je 0x180006923
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x180006923
mov ecx, dword [rsp + 0x60]
add rcx, 2
call fcn.18000bd40
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rbx, rax
mov byte [rax], bpl
mov eax, dword [rsp + 0x60]
mov byte [rax + rbx], bpl
mov eax, dword [rsp + 0x60]
mov rdx, r15
inc eax
mov rcx, r14
mov byte [rax + rbx], bpl
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x180006923
cmp dword [rsp + 0x78], 4
jne 0x180006923
mov ebp, dword [rbx]
test rsi, rsi
je 0x18000692a
mov dword [rsi], edi
mov rcx, rbx
call fcn.1800099d8
mov rbx, qword [rsp + 0x68]
mov eax, ebp
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180006c00
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
push rbx
push rsi
sub rsp, 0xa8
mov rax, qword [0x18003d1b0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov qword [r11 - 0x30], r14
or ebx, 0xffffffff
xor r13d, r13d
mov rdi, rcx
mov qword [r11 - 0x38], r15
mov r12d, r8d
mov r10d, r13d
mov r14, rdx
movsxd r15, r9d
lea rcx, [0x180030e68]
nop dword [rax + rax]
movzx eax, word [r10 + rcx]
lea r10, [r10 + 2]
mov word [rsp + r10 + 0x56], ax
test ax, ax
jne 0x180006c50
lea rcx, [rsp + 0x58]
mov qword [rsp + 0xd8], rbp
call fcn.1800069d0
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.180007df0
mov rsi, rax
test rax, rax
je 0x180006d5c
mov rcx, rax
call fcn.18000c78c
lea rdx, [rsp + 0x20]
mov ecx, eax
mov ebp, eax
call fcn.18000c7b4
test eax, eax
jne 0x180006d5c
lea eax, [r12*2 - 2]
mov r8d, 2
mov ecx, ebp
movsxd rdi, eax
cmp qword [rsp + 0x38], rdi
cmovl rdi, qword [rsp + 0x38]
mov rax, rdi
cqo
sub rax, rdx
mov rdx, rdi
sar rax, 1
neg rdx
mov rbx, rax
call fcn.18000cb80
lea rcx, [rdi + 2]
call fcn.18000bd40
mov r9, rsi
mov r8, rdi
mov rcx, rax
mov edx, 1
mov qword [r14], rax
call fcn.180008974
mov rax, qword [r14]
movsxd r8, ebx
mov word [rax + r8*2], r13w
cmp ebx, r15d
jle 0x180006d57
mov rcx, qword [r14]
mov rax, r15
mov rdx, rcx
test r15, r15
je 0x180006d57
cmp word [rdx], 0xa
je 0x180006d35
add rdx, 2
dec rax
jne 0x180006d21
mov ebx, r13d
jmp 0x180006d6c
test rdx, rdx
je 0x180006d57
mov rax, rdx
sub rax, rcx
sar rax, 1
sub r8, rax
cmp r8, r15
jle 0x180006d57
add r8, r8
add rdx, 2
call fcn.18000ade0
mov ebx, r13d
jmp 0x180006d6c
mov rcx, qword [r14]
test rcx, rcx
je 0x180006d6c
call fcn.1800099d8
mov qword [r14], r13
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xd8]
test rsi, rsi
je 0x180006da9
mov rcx, rsi
call fcn.18000c724
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180009cc0
add rsp, 0xa8
pop rsi
pop rbx
ret
mov r9d, 0x400
jmp 0x180006c00