joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003e0d4
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0xb0
mov rbp, rcx
mov rdi, r8
mov rbx, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x90
call fcn.180059f80
movzx eax, byte [rbx + 1]
movzx r11d, byte [rbx]
movzx ecx, byte [rbx + 4]
shl r11d, 8
mov esi, 0x20
shl ecx, 8
or r11d, eax
movzx eax, byte [rbx + 2]
shl r11d, 8
lea r12, [0x1800823d0]
or r11d, eax
movzx eax, byte [rbx + 3]
shl r11d, 8
or r11d, eax
movzx eax, byte [rbx + 5]
or ecx, eax
movzx eax, byte [rbx + 6]
mov dword [rsp + 0x20], r11d
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 9]
mov dword [rsp + 0x24], ecx
movzx ecx, byte [rbx + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xd]
mov dword [rsp + 0x28], ecx
movzx ecx, byte [rbx + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xf]
lea rbx, [rsp + 0x28]
shl ecx, 8
or ecx, eax
lea rax, [rsp + 0x28]
sub rbp, rax
mov dword [rsp + 0x2c], ecx
mov r9d, dword [rbx + rbp]
xor r9d, dword [rbx - 4]
xor r9d, dword [rbx]
add rbx, 4
xor r9d, dword [rbx]
mov eax, r9d
mov ecx, r9d
mov edx, r9d
shr ecx, 0x10
shr eax, 0x18
shr edx, 8
movzx eax, al
movzx r10d, byte [rax + r12]
movzx eax, cl
movzx ecx, byte [rax + r12]
shl r10d, 8
movzx eax, dl
movzx edx, byte [rax + r12]
or r10d, ecx
movzx eax, r9b
movzx r9d, byte [rax + r12]
shl r10d, 8
or r10d, edx
shl r10d, 8
or r10d, r9d
mov ecx, r10d
mov eax, r10d
ror ecx, 0xe
rol eax, 0xa
xor ecx, eax
mov eax, r10d
ror eax, 8
xor ecx, eax
mov eax, r10d
rol eax, 2
xor ecx, eax
xor ecx, dword [rbx - 0xc]
xor ecx, r10d
sub rsi, 1
mov dword [rbx + 4], ecx
jne 0x18003e1b7
mov ecx, dword [rsp + 0xac]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov eax, ecx
shr eax, 0x18
mov byte [rdi], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rdi + 2], cl
mov ecx, dword [rsp + 0xa8]
mov byte [rdi + 1], al
mov al, byte [rsp + 0xac]
mov byte [rdi + 3], al
mov eax, ecx
shr eax, 0x18
mov byte [rdi + 4], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rdi + 6], cl
mov ecx, dword [rsp + 0xa4]
mov byte [rdi + 5], al
mov al, byte [rsp + 0xa8]
mov byte [rdi + 7], al
mov eax, ecx
shr eax, 0x18
mov byte [rdi + 8], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rdi + 0xa], cl
mov ecx, dword [rsp + 0xa0]
mov byte [rdi + 9], al
mov al, byte [rsp + 0xa4]
mov byte [rdi + 0xb], al
mov eax, ecx
shr eax, 0x18
mov byte [rdi + 0xc], al
mov eax, ecx
shr eax, 0x10
shr ecx, 8
mov byte [rdi + 0xd], al
mov al, byte [rsp + 0xa0]
mov byte [rdi + 0xe], cl
mov byte [rdi + 0xf], al
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x18003ea20
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
lea r9, str..________.dirty
mov r8d, 1
mov rdx, rcx
lea rcx, [rax - 0x48]
call fcn.180001b30
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsi]
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x40]
mov rdi, rax
mov qword [rsp + 0x28], rax
test rdi, rdi
je 0x18003ea79
cmp rdi, rax
je 0x18003ea7e
call fcn.1800590d8
cmp rbx, rsi
je 0x18003ead7
test rdi, rdi
jne 0x18003ea92
call fcn.1800590d8
xor r11d, r11d
jmp 0x18003ea95
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x18003eaa0
call fcn.1800590d8
cmp qword [rbx + 0x38], 8
jb 0x18003eaad
mov rcx, qword [rbx + 0x20]
jmp 0x18003eab1
lea rcx, [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x28]
call fcn.18000c9bc
mov rsi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
jmp 0x18003ea6f
lea rcx, [rsp + 0x40]
call fcn.18000800c
nop
mov rcx, qword [rsp + 0x40]
call fcn.1800018ec
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x18003f0b8
Capabilities:
Check if file exists
Copy file
Get common file path
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, r8
mov rsi, rdx
lea rcx, [rsp + 0x52]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], di
call fcn.180059f80
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, str.drivers
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x50]
call fcn.18003ea20
lea rcx, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, edi
jne 0x18003f163
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb edi, edi
not edi
and edi, 8
jmp 0x18003f1eb
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.18000274c
cmp eax, edi
jne 0x18003f1eb
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, edi
jne 0x18003f1eb
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.18003e9e0
cmp qword [rsp + 0x40], 8
lea rdx, [rsp + 0x28]
cmovae rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, edi
je 0x18003f1d4
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb edi, edi
not edi
and edi, 8
jmp 0x18003f1d9
mov edi, 9
cmp qword [rsp + 0x40], 8
jb 0x18003f1eb
mov rcx, qword [rsp + 0x28]
call fcn.1800018ec
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180059930
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180042c14
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1800a4ce0]
test rcx, rcx
je 0x180042c44
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x1800a4ce0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [0x1800a4ce0], 0
add rsp, 0x28
ret

Function at 0x180042eec
Capabilities:
Read clipboard data

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rdi, rcx
mov qword [rax - 0x20], rcx
xor ebp, ebp
mov dword [rax - 0x58], ebp
mov qword [rcx + 0x20], 7
mov qword [rcx + 0x18], rbp
mov word [rcx + 8], bp
mov dword [rax - 0x58], 1
mov ecx, edx
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rsi, rax
cmp rax, rbp
je 0x180042fa5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbp
mov word [rsp + 0x30], bp
mov r8d, ebx
shr r8, 1
dec r8
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1800076b4
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.180007594
nop
cmp qword [rsp + 0x48], 8
jb 0x180042f9c
mov rcx, qword [rsp + 0x30]
call fcn.1800018ec
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, rdi
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x180043f28
Capabilities:
Open clipboard

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov ebx, edx
mov rdi, rcx
xor r9d, r9d
lea r8, [0x18007a090]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call fcn.18000568c
xor esi, esi
cmp eax, esi
je 0x1800440d9
cmp ebx, 1
jne 0x180043fd3
cmp dword [0x1800a4cd0], esi
je 0x1800440d9
call fcn.180003510
sub rax, qword [0x1800a4cd8]
cmp rax, 0xbb8
jbe 0x1800440d9
mov rcx, rdi
call qword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, esi
je 0x180043fc8
call fcn.180043a8c
call fcn.18004316c
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x1800a4cd0], esi
jmp 0x1800440d9
cmp ebx, 2
jne 0x1800440d9
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
cmp eax, esi
je 0x1800440d9
cmp rbx, qword [0x1800a0080]
je 0x1800440d9
mov qword [0x1800a0080], rbx
mov dword [rsp + 0x20], esi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, dword [rsp + 0x20]
cmp ebx, esi
je 0x1800440b7
mov word [rsp + 0x60], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x62]
call fcn.180059f80
mov r8d, 0x104
lea rdx, [rsp + 0x60]
mov ecx, ebx
call fcn.180004108
cmp eax, esi
je 0x1800440d9
lea rcx, [rsp + 0x60]
call fcn.180058e14
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [0x1800a0088]
call fcn.1800076b4
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.18000f0e0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [0x1800a00b0]
call fcn.180007214
nop
cmp qword [rsp + 0x50], 0x10
jb 0x1800440d9
mov rcx, qword [rsp + 0x38]
call fcn.1800018ec
jmp 0x1800440d9
lea rcx, [0x18007a088]
call fcn.180058e14
mov r8, rax
lea rdx, [0x18007a088]
lea rcx, [0x1800a0088]
call fcn.1800076b4
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180059930
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180044e4c
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x280
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
mov word [rsp + 0x60], bp
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x62]
call fcn.180059f80
mov r9d, 0x104
lea r8, [rsp + 0x60]
mov rdx, rbx
mov rcx, qword [0x1800a4f98]
call fcn.180002a40
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, ebp
jne 0x180044eed
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov qword [rsp + 0x20], rdi
lea r9, str.gb0R_
lea r8d, [rbp + 0x10]
lea rdx, [0x180083928]
call fcn.180002c44
jmp 0x180044f6d
lea r9, [0x180081a98]
cmp rsi, rbp
cmovne r9, rsi
lea r8, [rsp + 0x60]
lea rdx, str.__s___s
lea rcx, [rsp + 0x38]
call fcn.180005490
nop
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
xor edx, edx
lea r8d, [rdx + 1]
call fcn.1800036dc
cmp rax, rbp
jne 0x180044f5b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov qword [rsp + 0x20], rdi
lea r9, [0x18007a6d0]
mov r8d, sendto
lea rdx, [0x180083928]
call fcn.180002c44
nop
cmp qword [rsp + 0x58], 8
jb 0x180044f6d
mov rcx, qword [rsp + 0x40]
call fcn.1800018ec
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180059930
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret

Function at 0x180045344
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rsi, r8
mov r12d, edx
mov rdi, rcx
mov ecx, 0x20
call fcn.1800590f8
mov rbx, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1800453ae
mov rcx, qword [rdi + 0x18]
test rcx, rcx
jne 0x18004538e
and qword [rax + 0x18], rcx
jmp 0x1800453b0
cmp rcx, rdi
jne 0x1800453a1
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax]
mov qword [rbx + 0x18], rax
jmp 0x1800453b0
mov rax, qword [rcx]
xor edx, edx
call qword [rax]
mov qword [rbx + 0x18], rax
jmp 0x1800453b0
xor ebx, ebx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r12d
mov r9, rbx
lea r8, [0x18004524c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1800453ec
mov r8, qword [rcx]
cmp rcx, rdi
setne dl
call qword [r8 + 0x18]
and qword [rdi + 0x18], 0
mov rax, rbx
jmp 0x180045412
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x180047540
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xd0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1800472ac
nop
mov rbx, qword [rsp + 0x50]
mov r9d, 5
lea r8, str.BackupCount
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call fcn.18000568c
mov r11d, eax
xor edi, edi
cmp rbx, r11
jbe 0x1800476ae
mov rax, qword [rsp + 0x48]
mov rbx, qword [rax]
mov r11, qword [rsp + 0x20]
cmp r11, rdi
jne 0x1800475ca
call fcn.1800590d8
mov r11, rdi
jmp 0x1800475cd
mov r11, qword [r11]
cmp rbx, qword [r11 + 0x28]
jne 0x1800475d8
call fcn.1800590d8
lea rdx, [rbx + 0x10]
mov qword [rsp + 0xb8], 7
mov qword [rsp + 0xb0], rdi
mov word [rsp + 0xa0], di
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x98]
call fcn.180007594
lea rcx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r11, qword [rsp + 0x48]
mov rax, qword [r11]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x60], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x20]
call fcn.180006358
cmp qword [rsp + 0xb8], 8
jb 0x18004767d
mov rcx, qword [rsp + 0xa0]
call fcn.1800018ec
mov rbx, qword [rsp + 0x50]
mov r9d, 5
lea r8, str.BackupCount
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call fcn.18000568c
mov r11d, eax
cmp rbx, r11
ja 0x1800475ae
lea rcx, [rsp + 0x20]
call fcn.180009568
mov rcx, qword [rsp + 0x48]
call fcn.1800018ec
mov qword [rsp + 0x48], rdi
mov rcx, qword [rsp + 0x20]
call fcn.1800018ec
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180059930
mov rbx, qword [rsp + 0xe8]
add rsp, 0xd0
pop rdi
ret
Function at 0x180049df8
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov rcx, qword [0x1800a4d38]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x180049e34
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], eax
lea r8, [0x180049ca0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
ret

Function at 0x180049eb4
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x1800a5000], 0
mov rdi, rdx
mov rbx, rcx
jne 0x180049f08
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180049ef8
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800a4ff8], rax
jmp 0x180049eff
mov rax, qword [0x1800a4ff8]
mov byte [0x1800a5000], 1
jmp 0x180049f0f
mov rax, qword [0x1800a4ff8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x180049f25
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x180049f2b
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180049fe8
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
xor edi, edi
mov rbx, r8
mov rbp, rdx
mov r12, rcx
cmp r8, rdi
jne 0x18004a016
lea eax, [rdi + 0xd]
jmp 0x18004a04d
mov rsi, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea rsi, [rsi + rax*2]
lea edi, [rdi + rax*2]
cmp eax, 1
jne 0x18004a019
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x18004a77c
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov edi, dword [rcx + 8]
xor eax, eax
mov rsi, rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
or edi, 0x2001f
xor r8d, r8d
mov r9d, edi
mov rbp, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x18004a889
test rcx, rcx
je 0x18004a7f1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
and edi, 0x300
mov dword [rsp + 0x50], edi
xor edi, edi
mov qword [rsp + 0x48], rcx
cmp ebx, edi
jmp 0x18004a823
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.18004a77c
mov rcx, qword [rsp + 0x48]
mov ebx, eax
cmp eax, edi
jne 0x18004a88b
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], pe_nt_image_headers64
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, edi
je 0x18004a80b
mov rcx, qword [rsp + 0x48]
cmp rcx, rdi
je 0x18004a871
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rdi
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x50], edi
call fcn.180049eb4
mov rcx, qword [rsp + 0x48]
mov ebx, eax
jmp 0x18004a88b
xor edi, edi
cmp rcx, rdi
je 0x18004a896
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180059930
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x18004deb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r12, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
cmp rax, rbx
jne 0x18004df24
call fcn.180049e80
mov ebx, eax
jmp 0x18004e065
mov r8, r12
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
cmp rax, rbx
jne 0x18004df47
call fcn.180049e80
mov ebx, eax
jmp 0x18004e05b
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rsp + 0x40], rax
cmp rax, rbx
jne 0x18004df6c
call fcn.180049e80
mov ebx, eax
jmp 0x18004e05b
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jae 0x18004dfa5
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x18004df9b
lea rcx, [rsp + 0x70]
call fcn.18004a720
nop
mov eax, 0x8007000e
jmp 0x18004e07e
mov ecx, eax
cmp rcx, rbx
je 0x18004dfe3
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x18004dfd9
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x18004dfe3
lea rcx, [rsp + 0x70]
call fcn.18004a728
mov rax, qword [rsp + 0x70]
jmp 0x18004dfed
mov ecx, 0x80070057
call fcn.180049e3c
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x18004e004
cmp rax, rbx
jne 0x18004e010
mov ebx, 0x8007000e
jmp 0x18004e05b
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
jne 0x18004e037
call fcn.180049e80
mov ebx, eax
jmp 0x18004e05b
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.18004d164
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x18004e07c
lea rcx, [rsp + 0x70]
call fcn.18004a720
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.180059930
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret
Function at 0x18004f394
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x90
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x80], rax
call fcn.18002b1f0
xor edi, edi
cmp al, dil
jne 0x18004f4aa
lea ebx, [rdi + 1]
mov edx, ebx
lea rcx, [rsp + 0x58]
call fcn.180045ca4
nop
cmp qword [rsp + 0x70], rdi
je 0x18004f498
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae r8, qword [rsp + 0x60]
lea rdx, str._s__i
lea rcx, [rsp + 0x20]
call fcn.180005490
nop
cmp qword [rax + 0x20], 8
jb 0x18004f419
mov rcx, qword [rax + 8]
jmp 0x18004f41d
lea rcx, [rax + 8]
mov r8d, ebx
xor edx, edx
call fcn.1800036dc
mov rbx, rax
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x40], 8
jb 0x18004f441
mov rcx, qword [rsp + 0x28]
call fcn.1800018ec
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rdi
mov word [rsp + 0x28], di
cmp rbx, rdi
je 0x18004f46e
cmp rbx, 0xffffffffffffffff
je 0x18004f46e
lea rcx, str.CFID_POBUS_fixed
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x18004f483
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CFID_POBUS_start_failed:__d
call fcn.180034834
nop
cmp rbx, 0xffffffffffffffff
je 0x18004f498
cmp rbx, rdi
je 0x18004f498
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x78], 8
jb 0x18004f4aa
mov rcx, qword [rsp + 0x60]
call fcn.1800018ec
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180059930
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
Function at 0x180050734
Capabilities:
Create thread
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov esi, edx
mov rdi, rcx
cmp edx, 1
jne 0x1800508a5
mov qword [0x1800a4f98], rcx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea rdx, [0x1800a4d90]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [0x1800a4d90]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov qword [0x1800a4d88], rax
call fcn.1800280f8
xor ebx, ebx
cmp eax, ebx
je 0x1800507a1
lea rdx, [0x18004fa60]
mov rcx, rdi
call fcn.180027430
mov rdi, qword [0x1800a4d88]
cmp rdi, rbx
je 0x180050848
lea rdx, str.explorer.exe
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebx
jne 0x180050841
call fcn.18002ee84
call fcn.180057064
call fcn.1800444b4
lea r8, [0x18004a57c]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [0x18004f4cc]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1800a4d80], 1
mov qword [0x1800a4fa0], rax
call fcn.18005810c
mov rcx, rax
call fcn.1800588a4
call fcn.180049df8
call fcn.180055a88
jmp 0x18005089b
mov rdi, qword [0x1800a4d88]
lea rdx, str.360desktop
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp rax, rbx
jne 0x180050887
lea rdx, str.360FileBrowser
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp rax, rbx
jne 0x180050887
lea rdx, str.kdesktopservice
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp rax, rbx
je 0x18005089b
mov dword [0x1800a4d84], 1
call fcn.18002ee84
call fcn.180057064
cmp byte [0x1800a4d40], bl
je 0x180050907
jmp 0x18005090c
xor ebx, ebx
cmp edx, ebx
jne 0x180050907
cmp dword [0x1800a4d80], ebx
je 0x1800508fa
call fcn.18006057c
mov rcx, qword [0x1800a4fa0]
cmp rcx, rbx
je 0x1800508e1
lea edx, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x1800a4fa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1800a4fa0], rbx
call fcn.180042c14
call fcn.18005810c
mov rcx, rax
call fcn.18005814c
call fcn.180044538
jmp 0x180050907
cmp dword [0x1800a4d84], ebx
je 0x180050907
call fcn.18006057c
mov ebx, 1
neg esi
mov rsi, qword [rsp + 0x48]
sbb eax, eax
and eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret