joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800bd950
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18010c020]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov ecx, 1
call fcn.1800d25a0
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1800ccc80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1800bd9c3
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800d2580
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1800c1cb0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1800c1ce5
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x60], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x28], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.180005500
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1800c1e79
mov qword [rsp + 0x30], rbp
movabs rbp, 0x100000001b3
mov qword [rsp + 0x20], r15
movabs r15, 0xcbf29ce484222325
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
movzx r8d, byte [rcx + 0x14]
xor r9, r15
mov rdx, qword [rdx]
xor r8, r15
imul r9, rbp
imul r8, rbp
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rbp
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rbp
xor r9, rax
movzx eax, byte [rcx + 0x15]
xor r8, rax
movzx eax, byte [rcx + 0x16]
imul r8, rbp
imul r9, rbp
xor r8, rax
movzx eax, byte [rcx + 0x17]
imul r8, rbp
xor r8, rax
imul r8, rbp
lea r11, [r8 + r8]
xor r11, r9
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov rdi, qword [r11]
cmp rdi, rbx
jne 0x1800c1dd4
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1800c1e63
mov rax, qword [r11 + 8]
mov r10d, dword [rcx + 0x10]
cmp r10d, dword [rax + 0x10]
jne 0x1800c1e1b
mov r8d, dword [rax + 0x14]
cmp dword [rcx + 0x14], r8d
jne 0x1800c1e1b
mov r10, qword [rax]
cmp r10, rcx
je 0x1800c1e15
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1800c1e63
mov r8, rax
cmp rdi, rax
je 0x1800c1e3f
mov rax, qword [rax + 8]
mov r8, rax
cmp r10d, dword [rax + 0x10]
jne 0x1800c1e3a
mov r9d, dword [rax + 0x14]
cmp dword [rcx + 0x14], r9d
je 0x1800c1e8a
cmp rdi, rax
jne 0x1800c1e23
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x1800c1d50
mov r15, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x60]
mov r14, qword [rsp + 0x28]
add rsp, 0x38
pop rdi
pop rsi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1800c1e63
Function at 0x1800cc7d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rdi, r8
mov rsi, rdx
sub rdi, rdx
sar rdi, 2
test rdi, rdi
je 0x1800cc9b3
mov qword [rsp + 0x50], rbx
mov rbx, qword [0x180114298]
sub rbx, qword [0x180114290]
mov qword [rsp + 0x30], r13
sar rbx, 2
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
cmp rdi, 0x26f
jb 0x1800cc823
mov eax, ntohs
jmp 0x1800cc851
cmp rdi, 0x44
jb 0x1800cc830
mov eax, 7
jmp 0x1800cc851
cmp rdi, 0x27
jb 0x1800cc83d
mov eax, 5
jmp 0x1800cc851
cmp rdi, 7
jb 0x1800cc84a
mov eax, 3
jmp 0x1800cc851
lea rax, [rdi - 1]
shr rax, 1
mov r14, rdi
lea r15, [rbx + 1]
sub r14, rax
shr r14, 1
lea r13, [r14 + rax]
cmp rdi, rbx
jbe 0x1800cc86a
mov r15, rdi
mov r8, rdi
mov qword [rsp + 0x68], rbp
shl r8, 2
mov edx, 0x8b8b8b8b
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
xor ecx, ecx
test r15, r15
je 0x1800cc91d
nop
xor edx, edx
lea rax, [rcx + r14]
div rdi
mov r11d, dword [rsi + rdx*4]
lea r10, [rsi + rdx*4]
xor edx, edx
mov rax, rcx
div rdi
lea rbp, [rsi + rdx*4]
mov r8d, r11d
mov r9, rdx
lea rax, [rcx - 1]
xor edx, edx
div rdi
xor r8d, dword [rsi + rdx*4]
xor r8d, dword [rbp]
mov eax, r8d
shr eax, 0x1b
xor eax, r8d
imul edx, eax, 0x19660d
test rcx, rcx
jne 0x1800cc8dd
mov rax, rbx
jmp 0x1800cc8f5
cmp rcx, rbx
ja 0x1800cc8f2
mov rax, qword [0x180114290]
mov eax, dword [rax + rcx*4 - 4]
add rax, r9
jmp 0x1800cc8f5
mov rax, r9
lea r8d, [rax + rdx]
lea eax, [r11 + rdx]
xor edx, edx
mov dword [r10], eax
lea rax, [rcx + r13]
div rdi
inc rcx
add dword [rsi + rdx*4], r8d
mov dword [rbp], r8d
cmp rcx, r15
jb 0x1800cc890
add r15, rdi
cmp rcx, r15
jae 0x1800cc99a
inc r14
lea rbp, [rcx - 1]
inc r13
nop
xor edx, edx
lea rax, [r14 + rbp]
div rdi
mov r10d, dword [rsi + rdx*4]
lea r11, [rsi + rdx*4]
xor edx, edx
lea rbx, [rbp + 1]
mov rax, rbx
div rdi
mov rax, rbp
mov r9, rdx
xor edx, edx
div rdi
mov ecx, dword [rsi + rdx*4]
xor edx, edx
add ecx, r10d
add ecx, dword [rsi + r9*4]
mov eax, ecx
shr eax, 0x1b
xor eax, ecx
imul ecx, eax, 0x5d588b65
mov rax, rbp
add rax, r13
mov rbp, rbx
div rdi
xor r10d, ecx
lea rax, [rbx + 1]
mov dword [r11], r10d
mov r8d, ecx
sub r8d, r9d
xor dword [rsi + rdx*4], r8d
mov dword [rsi + r9*4], r8d
cmp rax, r15
jb 0x1800cc930
mov rbp, qword [rsp + 0x68]
mov r13, qword [rsp + 0x30]
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x1800041a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
xor ebx, ebx
movsxd rbp, edx
xor r11d, r11d
xor r10d, r10d
mov r14, r9
mov r15, r8
mov rdi, rcx
test edx, edx
jle 0x1800042dc
mov rsi, rcx
lea r12, [0x18004efb0]
neg rsi
mov rdx, rcx
movzx eax, byte [rdx]
cmp al, 0x3d
jne 0x1800041f6
inc r11d
cmp r11d, 2
jg 0x180004249
cmp al, 0x7f
ja 0x180004249
movzx eax, al
movzx ecx, byte [rax + r12]
cmp cl, 0x7f
je 0x180004249
cmp cl, 0x40
jae 0x180004211
test r11d, r11d
jne 0x180004249
inc rdx
inc ebx
inc r10d
lea rax, [rsi + rdx]
cmp rax, rbp
jl 0x1800041e6
test ebx, ebx
je 0x1800042dc
lea eax, [rbx + rbx*2]
lea eax, [rax*2 + 7]
sar eax, 3
cmp dword [r9], eax
jge 0x180004253
mov dword [r9], eax
mov eax, 0xfffffff0
jmp 0x1800042de
mov eax, 0xffffffee
jmp 0x1800042de
xor r8d, r8d
xor r11d, r11d
mov r9d, 3
mov rax, r15
test r10d, r10d
jle 0x1800042d6
nop word [rax + rax]
movzx ecx, byte [rdi]
movzx edx, byte [rcx + r12]
xor ecx, ecx
cmp dl, 0x40
sete cl
and edx, 0x3f
sub r9d, ecx
inc r11d
mov ecx, r8d
mov r8d, edx
shl ecx, 6
or r8d, ecx
cmp r11d, 4
jne 0x1800042cb
xor r11d, r11d
test r9d, r9d
jle 0x1800042ae
mov ecx, r8d
shr ecx, 0x10
mov byte [rax], cl
inc rax
cmp r9d, 1
jle 0x1800042bf
mov ecx, r8d
shr ecx, 8
mov byte [rax], cl
inc rax
cmp r9d, 2
jle 0x1800042cb
mov byte [rax], r8b
inc rax
dec r10d
inc rdi
test r10d, r10d
jg 0x180004270
sub eax, r15d
mov dword [r14], eax
xor eax, eax
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret

Function at 0x180004300
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
mov byte [rcx + 0x89], 0
xor eax, eax
mov qword [rcx + 0x10], rax
mov rbx, rcx
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
cmp qword [rdx + 0x18], 0x10
mov r8, qword [rdx + 0x10]
jb 0x18000433f
mov rdx, qword [rdx]
call fcn.180004fc0
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x180005740
Capabilities:
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x798]
sub rsp, 0x898
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x18006f0b0]
xor rax, rsp
mov qword [rbp + 0x780], rax
mov ebx, r9d
mov rsi, r8
mov rdi, rdx
mov r14, rcx
lea r9, [rcx + 0xc0]
cmp qword [r9 + 0x18], 8
jb 0x18000578f
mov r9, qword [r9]
mov r8d, ebx
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, ebx
jne 0x1800058b2
mov qword [rsp + 0x50], 7
xor r15d, r15d
mov qword [rsp + 0x48], r15
mov word [rsp + 0x38], r15w
xor r8d, r8d
lea rdx, [0x18004e720]
lea rcx, [rsp + 0x38]
call fcn.180002a90
nop
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x80]
call fcn.180035fe0
mov r8d, ebx
lea rdx, [0x18004f328]
lea rcx, [rbp - 0x80]
call fcn.180003040
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov r8, rdi
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.180005700
mov rbx, rax
lea rax, [rsp + 0x38]
cmp rax, rbx
je 0x18000585e
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x18000583c
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.180002c40
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r15
mov word [rsp + 0x38], r15w
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.180001a10
nop
mov r8, qword [rsp + 0x70]
cmp r8, 8
jb 0x18000587b
inc r8
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.180002c40
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call fcn.18003b0a8
mov ebx, eax
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x1800058b2
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.180002c40
mov eax, ebx
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.1800150f0
add rsp, 0x898
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1800058e0
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x888
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x18006f0b0]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov r14, r9
mov rbp, r8
mov rdi, rdx
mov r15, rcx
mov qword [rsp + 0x40], rdx
mov rsi, qword [rsp + 0x8e0]
xor ebx, ebx
mov dword [rsp + 0x30], ebx
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x70]
call fcn.180035fe0
lea rax, [r15 + 0xc0]
cmp qword [rax + 0x18], 8
jb 0x18000594d
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x70]
mov r8, rsi
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
cmp qword [rdi + 0x18], 8
jb 0x180005986
mov rax, qword [rdi]
jmp 0x180005989
mov rax, rdi
mov word [rax], bx
cmp word [rsp + 0x70], bx
je 0x1800059aa
lea rax, [rsp + 0x70]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1800059a0
mov r8, rbx
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.180002a90
mov dword [rsp + 0x30], 1
cmp qword [rdi + 0x18], 8
jb 0x1800059ce
mov rax, qword [rdi]
jmp 0x1800059d1
mov rax, rdi
mov r11, rsi
sub r11, rax
nop word [rax + rax]
movzx r10d, word [rax]
movzx edx, word [rax + r11]
sub r10d, edx
jne 0x1800059f6
add rax, 2
test edx, edx
jne 0x1800059e0
test r10d, r10d
jne 0x180005a3b
mov qword [rsp + 0x20], rsi
mov r9, r14
mov r8, rbp
lea rdx, [rsp + 0x48]
mov rcx, r15
call fcn.180005700
mov rdx, rax
mov rcx, rdi
call fcn.1800018a0
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x180005a3b
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.180002c40
mov rax, rdi
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.1800150f0
add rsp, 0x888
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180006b40
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x9a0]
sub rsp, 0xaa0
mov rax, qword [0x18006f0b0]
xor rax, rsp
mov qword [rbp + 0x990], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.180035fe0
cmp qword [rdi + 0x58], 8
lea r8, [rdi + 0x40]
jb 0x180006b8e
mov r8, qword [r8]
lea r9, str.Config
lea rdx, [0x18004e878]
lea rcx, [rsp + 0x40]
call fcn.180003040
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180006bbf
lea rcx, [rsp + 0x40]
call fcn.18000b7b0
xor edx, edx
lea rcx, [rbp + 0x150]
mov r8d, 0x208
call fcn.180035fe0
lea r9, str.UseVestige.ini
lea r8, [rsp + 0x40]
lea rdx, str._s_s
lea rcx, [rbp + 0x150]
call fcn.180003040
xor ebx, ebx
cmp word [rbp + 0x150], bx
jne 0x180006c02
mov r8d, ebx
jmp 0x180006c1a
lea rax, [rbp + 0x150]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x180006c10
lea rcx, [rdi + 0xc0]
lea rdx, [rbp + 0x150]
call fcn.180002a90
xor edx, edx
lea rcx, [rbp + 0x360]
mov r8d, 0x208
call fcn.180035fe0
lea r9, str.UseCache.ini
lea r8, [rsp + 0x40]
lea rdx, str._s_s
lea rcx, [rbp + 0x360]
call fcn.180003040
cmp word [rbp + 0x360], bx
jne 0x180006c6e
mov r8, rbx
jmp 0x180006c8a
lea rax, [rbp + 0x360]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x180006c80
lea rcx, [rdi + 0xe0]
lea rdx, [rbp + 0x360]
call fcn.180002a90
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x208
call fcn.180035fe0
lea rdx, str.DSKXRoad
lea rcx, [rsp + 0x20]
call fcn.18000bab0
cmp qword [rax + 0x18], 8
jb 0x180006ccc
mov rax, qword [rax]
mov r8, rax
lea rdx, [0x18004e8a4]
lea rcx, [rbp + 0x570]
call fcn.180003040
mov r8, qword [rsp + 0x38]
cmp r8, 8
jb 0x180006cff
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x20]
inc r8
call fcn.180002c40
lea rcx, [rbp + 0x570]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180006d1c
lea rcx, [rbp + 0x570]
call fcn.18000b7b0
xor edx, edx
lea rcx, [rbp + 0x780]
mov r8d, 0x208
call fcn.180035fe0
lea r9, str.UseCache.ini
lea r8, [rbp + 0x570]
lea rdx, str._s_s
lea rcx, [rbp + 0x780]
call fcn.180003040
cmp word [rbp + 0x780], bx
je 0x180006d6f
lea rax, [rbp + 0x780]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180006d65
lea rcx, [rdi + 0x100]
mov r8, rbx
lea rdx, [rbp + 0x780]
call fcn.180002a90
mov rcx, qword [rbp + 0x990]
xor rcx, rsp
call fcn.1800150f0
lea r11, [rsp + 0xaa0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18000b7b0
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
or r8, 0xffffffffffffffff
mov rbx, rcx
mov rdi, r8
nop dword [rax]
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x18000b7d0
lea eax, [rdi + 1]
movsxd rcx, eax
mov eax, 2
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.180014b90
mov rsi, rax
sub rax, rbx
nop word [rax + rax]
movzx ecx, word [rbx]
mov word [rax + rbx], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x18000b800
xor r14d, r14d
movsxd rdi, edi
mov ebx, r14d
lea ebp, [r14 + 1]
test rdi, rdi
js 0x18000b86f
mov qword [rsp + 0x40], r15
mov r15d, 0x5c
nop dword [rax]
cmp word [rsi + rbx*2], r15w
jne 0x18000b85d
mov rcx, rsi
mov word [rsi + rbx*2], r14w
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18000b858
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x18000b867
mov word [rsi + rbx*2], r15w
inc rbx
cmp rbx, rdi
jle 0x18000b830
jmp 0x18000b86a
mov ebp, r14d
mov r15, qword [rsp + 0x40]
mov rcx, rsi
call fcn.18001554c
mov rbx, qword [rsp + 0x48]
mov eax, ebp
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x18000b890
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x18006f0b0]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor r9d, r9d
mov rdi, rdx
mov rsi, rcx
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
or rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x20]
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x18000b8e0
test eax, eax
je 0x18000b9aa
lea rcx, [rsp + 0x20]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x18000b900
mov eax, dword [0x18004e724]
lea rdx, [rsp + 0x20]
sub rdx, 2
mov dword [rcx], eax
nop dword [rax]
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x18000b920
xor r8d, r8d
nop
movzx ecx, word [rdi + r8*2]
mov word [rdx + r8*2], cx
lea r8, [r8 + 1]
test cx, cx
jne 0x18000b930
lea rcx, [rsp + 0x20]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x18000b950
mov dword [rcx], eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18000b976
lea rcx, [rsp + 0x20]
call fcn.18000b7b0
cmp word [rsp + 0x20], 0
jne 0x18000b982
xor ebx, ebx
jmp 0x18000b99a
lea rax, [rsp + 0x20]
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18000b990
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.180002a90
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800150f0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18000be20
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
xor bl, bl
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
movzx ecx, bl
mov edx, 1
test eax, eax
cmovne ecx, edx
movzx eax, cl
add rsp, 0x20
pop rbx
ret
Function at 0x18000ca20
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x1d8]
sub rsp, 0x2c0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x18006f0b0]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rdi, rcx
xor ebx, ebx
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x70]
call fcn.180035fe0
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x28], bx
or r14, 0xffffffffffffffff
cmp word [rdi], bx
jne 0x18000ca8f
mov r8d, ebx
jmp 0x18000ca9c
mov r8, r14
inc r8
cmp word [rdi + r8*2], bx
jne 0x18000ca92
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.180002a90
nop
lea rcx, [rsp + 0x28]
call fcn.18000db50
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000cbfa
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x18000cbf0
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
cmp word [rbp - 0x64], 0
jne 0x18000cb07
mov r8, rbx
jmp 0x18000cb1b
lea rax, [rbp - 0x64]
mov r8, r14
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x18000cb10
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x48]
call fcn.180002a90
nop
lea rcx, [rsp + 0x48]
call fcn.18000db50
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x48]
mov rdi, qword [rsp + 0x48]
mov r9, qword [rsp + 0x60]
cmp r9, 8
cmovae rdx, rdi
mov r10, qword [rsp + 0x38]
mov r8, r10
mov r11, qword [rsp + 0x58]
cmp r11, r10
cmovb r8, r11
test r8, r8
jmp 0x18000cb9a
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x18000cb8b
add rdx, 2
add rcx, 2
sub r8, 1
jmp 0x18000cb9a
mov r8d, 1
cmp word [rdx], ax
cmovb r8d, r14d
jmp 0x18000cb9f
jne 0x18000cb75
mov r8d, ebx
test r8d, r8d
jne 0x18000cbab
cmp r11, r10
jb 0x18000cbab
jbe 0x18000cbd4
cmp r9, 8
jb 0x18000cbc2
lea r8, [r9 + 1]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.180002c40
lea rdx, [rsp + 0x70]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
jmp 0x18000cae0
mov ebx, 1
cmp r9, 8
jb 0x18000cbf0
lea r8, [r9 + 1]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.180002c40
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x18000cc17
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.180002c40
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.1800150f0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x18000d0e0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x70
xor r14d, r14d
lea rax, [r11 - 0x18]
mov rbx, r9
mov qword [r11 - 0x18], r14
mov rbp, r8
mov qword [r11 - 0x20], r14
mov rsi, rdx
mov qword [r11 - 0x28], r14
mov rdi, rcx
mov qword [r11 - 0x58], rax
mov r9d, 0xf013f
lea rdx, str.SoftWare
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000d224
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov rdx, rdi
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18000d219
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov rdx, rsi
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x18000d1c9
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
jmp 0x18000d21e
or rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rbx + rax*2 + 2], r14w
lea rax, [rax + 1]
jne 0x18000d1d0
lea ecx, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], ecx
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
mov rdx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x18000f7b0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x18000f7de
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180010700
cmp byte [0x180071c38], 0
jne 0x18000f829
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000f819
lea rdx, [0x1800506d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180071c30], rax
mov byte [0x180071c38], 1
jmp 0x18000f830
mov rax, qword [0x180071c30]
mov byte [0x180071c38], 1
jmp 0x18000f830
mov rax, qword [0x180071c30]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x18000f84f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x180010774
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180010796
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010796
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je 0x180010796
mov rdx, rdi
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret