joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400025f8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002642
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002642
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002642
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002642
cmp dword [rcx + 0x84], 0xe
jbe 0x140002642
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002644
xor al, al
add rsp, 0x28
ret
Function at 0x18e7cac
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x0195c138]
xor rax, rsp
mov qword [rsp + 0x260], rax
and qword [rsp + 0x40], 0
and qword [rsp + 0x50], 0
mov rdi, rcx
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov r9d, 0x2001f
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x40]
test eax, eax
mov ebx, eax
jne 0x18e7da5
test rcx, rcx
je 0x18e7d1a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
test ebx, ebx
mov qword [rsp + 0x40], rcx
jmp 0x18e7d40
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.018e7cac
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test eax, eax
jne 0x18e7da5
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rsp + 0x48], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x18e7d28
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18e7d92
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x40], 0
mov rcx, qword [rdi]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test rcx, rcx
je 0x18e7db0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.018fdad0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18e832c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x0195c138]
xor rax, rsp
mov qword [rsp + 0x450], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x40], 0
mov rax, rdx
xor edx, edx
mov rbx, r8
mov qword [rsp + 0x38], rcx
lea r8d, [rdx + 2]
mov rcx, rax
mov rsi, r9
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
mov rdi, rax
jne 0x18e8386
call fcn.018e7c70
mov ebx, eax
jmp 0x18e8494
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov rbx, rax
jne 0x18e83a7
call fcn.018e7c70
jmp 0x18e8489
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rsi, rax
je 0x18e839d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
add eax, 1
cmp eax, ebx
jae 0x18e83f0
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x40], rax
je 0x18e83e6
lea rcx, [rsp + 0x40]
call fcn.018eb0fc
mov eax, 0x8007000e
jmp 0x18e84ac
test eax, eax
mov ecx, eax
je 0x18e842e
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x18e8423
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x18e842e
lea rcx, [rsp + 0x40]
call fcn.018eb6c4
mov r11, qword [rsp + 0x40]
jmp 0x18e8438
mov ecx, 0x80070057
call fcn.018e7be8
int3
lea r11, [rsp + 0x48]
mov qword [rsp + 0x40], r11
test r11, r11
jne 0x18e8444
mov ebx, 0x8007000e
jmp 0x18e848b
xor edx, edx
mov r9d, ebx
mov r8, rsi
lea ecx, [rdx + 3]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r11
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x18e839d
mov r8d, dword [rsp + 0x4a0]
mov ecx, eax
mov rax, qword [rsp + 0x40]
and word [rax + rcx*2], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.018e8f14
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x40], rax
je 0x18e84aa
lea rcx, [rsp + 0x40]
call fcn.018eb0fc
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.018fdad0
add rsp, 0x460
pop rdi
pop rsi
pop rbx
ret
Function at 0x18f2b08
Capabilities:
Create directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r14
sub rsp, 0x350
mov rax, qword [0x0195c138]
xor rax, rsp
mov qword [rsp + 0x340], rax
lea rdx, [rsp + 0x30]
sub rdx, rcx
mov al, byte [rcx]
mov byte [rdx + rcx], al
add rcx, 1
test al, al
jne 0x18f2b3e
lea r12, [0x018e6090]
lea rcx, [rsp + 0x30]
lea rsi, [rsp + 0x30]
mov rdx, r12
call qword [sym.imp.msvcrt.dll_strcspn]
test rax, rax
je 0x18f2b82
lea rdx, [0x018e6094]
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll_strcspn]
cmp rax, 1
jne 0x18f2ba2
lea rcx, [0x018e6098]
call qword [sym.imp.msvcrt.dll__chdir]
lea rcx, [rsp + 0x30]
mov rdx, r12
call qword [sym.imp.msvcrt.dll_strcspn]
lea rsi, [rsp + rax + 0x31]
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_strcspn]
lea rdi, [rsi + rax]
cmp byte [rdi], 0
je 0x18f2d21
mov bl, byte [rdi]
mov rcx, rsi
mov byte [rdi], 0
call qword [sym.imp.msvcrt.dll__mkdir]
cmp eax, 0xffffffff
jne 0x18f2bd9
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0x11
jne 0x18f2bfb
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__chdir]
lea rsi, [rdi + 1]
mov rdx, r12
mov rcx, rsi
mov byte [rdi], bl
call qword [sym.imp.msvcrt.dll_strcspn]
lea rdi, [rdi + rax + 1]
jmp 0x18f2bb2
call qword [sym.imp.msvcrt.dll__errno]
mov rdi, rax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rdi]
mov rbx, rax
call qword [sym.imp.msvcrt.dll_strerror]
or rcx, 0xffffffffffffffff
mov rdi, rax
xor eax, eax
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, dword [rbx]
call qword [sym.imp.msvcrt.dll_strerror]
lea r9d, [rdi + 1]
xor edx, edx
mov r8, rax
lea rax, [rsp + 0x130]
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [0x01965a38]
lea r14, [0x01965a38]
cmp rcx, r14
mov bl, 6
lea r12, [0x018e4d08]
je 0x18f2c94
test byte [rcx + 0x1c], 4
je 0x18f2c94
cmp byte [rcx + 0x19], bl
jb 0x18f2c94
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x130]
mov r8, r12
mov dx, 0xa
call fcn.018ebfa8
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
lea rax, [rsp + 0x130]
mov r8, rsi
not rcx
xor edx, edx
mov dword [rsp + 0x28], 0x104
mov r9d, ecx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [0x01965a38]
cmp rcx, r14
je 0x18f2d21
test byte [rcx + 0x1c], 4
je 0x18f2cfd
cmp byte [rcx + 0x19], bl
jb 0x18f2cfd
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x130]
mov r8, r12
mov dx, 0xb
call fcn.018ebfa8
mov rcx, qword [0x01965a38]
cmp rcx, r14
je 0x18f2d21
test byte [rcx + 0x1c], 4
je 0x18f2d21
cmp byte [rcx + 0x19], bl
jb 0x18f2d21
mov rcx, qword [rcx + 0x10]
or r9d, 0xffffffff
mov r8, r12
mov dx, 0xc
call fcn.018ec0a0
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.018fdad0
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x18f2fe8
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
test rcx, rcx
mov rax, rdx
je 0x18f3008
mov r9, rcx
mov r8d, r8d
mov edx, 1
mov rcx, rax
call qword [sym.imp.msvcrt.dll_fwrite]
add rsp, 0x28
ret

Function at 0x18f3740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xe8
xor r15d, r15d
mov dword [rsp + 0x20], 0x626d343c
mov dword [rsp + 0x24], 0x62365966
mov dword [rsp + 0x28], 0x66373531
mov dword [rsp + 0x2c], 0x57403851
mov dword [rsp + 0x30], 0x56437578
mov byte [rsp + 0x36], r15b
mov word [rbp - 0x79], r15w
mov word [rsp + 0x34], 0x5175
mov dword [rsp + 0x38], 0x65006b
mov dword [rsp + 0x3c], 0x6e0072
mov dword [rsp + 0x40], 0x6c0065
mov dword [rsp + 0x44], 0x320033
mov dword [rsp + 0x48], 0x64002e
mov dword [rbp - 0x7d], 0x6c006c
mov edx, 0x3d090c
mov eax, r15d
lea rcx, [rbp - 0x59]
mov byte [rcx], al
inc eax
inc rcx
cmp eax, 0x6a
jb 0x18f37d4
dec rdx
jne 0x18f37cd
cmp byte [rbp - 0x29], 0x30
jne 0x18f37fa
lea rcx, [rsp + 0x38]
call fcn.018f3ca8
mov rbx, rax
jmp 0x18f37fe
mov rbx, qword [rbp + 0x67]
mov edx, 0xe3142
mov rcx, rbx
call fcn.018f3cfc
mov edx, 0xd5786
mov rcx, rbx
mov rdi, rax
call fcn.018f3cfc
mov edx, 0x348bfa
mov rcx, rbx
mov qword [rbp - 0x69], rax
call fcn.018f3cfc
mov esi, 0x3000
mov r12d, 0x1c0e00
mov r9d, 4
xor ecx, ecx
mov r8d, esi
mov edx, r12d
mov qword [rbp - 0x71], rax
call rdi
movsx r8d, byte [rbp - 0x59]
mov r10d, r15d
mov r14, rax
mov eax, 0x92f11385
imul r8d
movsx eax, byte [rbp - 0x36]
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, r8d, 0x156
mov r8d, 0x66666667

Function at 0x18f387c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
imul edx, eax
imul eax, edx, 0xe
movsxd rbx, eax
mov eax, r8d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
imul edx
mov eax, r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx
mov eax, r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx
Function at 0x18f3cfc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
xor r9d, r9d
mov esi, edx
mov r8d, dword [rax + rcx + 0x88]
mov r10, rcx
add r8, rcx
mov r11d, dword [r8 + 0x20]
mov ebx, dword [r8 + 0x1c]
mov edi, dword [r8 + 0x24]
mov r8d, dword [r8 + 0x18]
add r11, rcx
add rbx, rcx
add rdi, rcx
test r8d, r8d
je 0x18f3d5b
mov ecx, dword [r11]
add rcx, r10
call fcn.018f3c90
cmp eax, esi
je 0x18f3d6d
inc r9d
add r11, 4
cmp r9d, r8d
jb 0x18f3d40
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx ecx, word [rdi + r9*2]
mov eax, dword [rbx + rcx*4]
add rax, r10
jmp 0x18f3d5d

Function at 0x18f84c8
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov rsi, rcx
mov rcx, qword [rcx]
mov r12, rdx
lea rdx, [rsp + 0x68]
mov rbp, r8
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
mov ebx, eax
jne 0x18f8510
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
jmp 0x18f856e
mov rcx, rbx
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
test rax, rax
mov rdi, rax
je 0x18f8569
mov rcx, qword [rsi]
mov r9, rax
mov r8d, ebx
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoW
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [0x018e68fc]
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueW
mov r11, qword [rsp + 0x28]
mov rcx, rdi
mov eax, dword [r11 + 8]
mov dword [r12], eax
mov eax, dword [r11 + 0xc]
mov dword [rbp], eax
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
xor eax, eax
jmp 0x18f856e
mov eax, 0x8007000e
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x18f8610
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r13, rcx
mov r12d, edx
lea rcx, [0x01966050]
xor edx, edx
xor ebx, ebx
call fcn.018fcf50
lea ebp, [rbx + 1]
jmp 0x18f86ed
test rbx, rbx
jne 0x18f86f9
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, 1
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
mov rbx, rax
je 0x18f86dc
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x18f8689
xor ebx, ebx
jmp 0x18f86d7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x18f8685
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x18f86c6
cmp rdi, r11
jae 0x18f8685
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x18f86b4
cmp rdi, r11
jae 0x18f8685
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x18f86fb
lea rcx, [0x01966050]
mov edx, ebp
call fcn.018fcf50
add ebp, 1
test rax, rax
mov rsi, rax
jne 0x18f8646
xor esi, esi
test rsi, rsi
jne 0x18f8704
xor eax, eax
jmp 0x18f8712
mov r8d, r12d
mov rdx, rsi
mov rcx, r13
call fcn.018f8734
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x18f8734
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov r8d, 6
add ax, 1
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x18f889d
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18f889d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x18f889d
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x18f87d5
cmp rdi, r11
jae 0x18f889d
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x18f87bf
cmp rdi, r11
jae 0x18f889d
cmp word [rdi], 0
je 0x18f889d
mov rax, qword [rsi]
movzx ebx, word [rdi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x18f8809
mov edx, ebx
mov rcx, rsi
call fcn.018f7c3c
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x18f8826
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call sub.msvcrt.dll_memcpy_s
test eax, eax
je 0x18f8874
cmp eax, 0xc
je 0x18f8869
cmp eax, 0x16
je 0x18f885e
cmp eax, 0x22
je 0x18f885e
cmp eax, 0x50
je 0x18f8874
mov ecx, 0x80004005
call fcn.018e7be8
int3
mov ecx, 0x80070057
call fcn.018e7be8
int3
mov ecx, 0x8007000e
call fcn.018e7be8
int3
test ebx, ebx
js 0x18f8892
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x18f8892
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
and word [rdi + rcx], 0
jmp 0x18f889f
mov ecx, 0x80070057
call fcn.018e7be8
int3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x18fa3d4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov rax, qword [0x0195c138]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, rcx
lea r8, [r11 - 0x50]
lea rdx, [0x018e5a20]
xor esi, esi
mov rcx, 0xffffffff80000002
xor ebx, ebx
and qword [r11 - 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x18fa465
mov rcx, qword [rsp + 0x38]
and dword [rsp + 0x30], ebx
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea rdx, [0x018e5a50]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18fa465
cmp dword [rsp + 0x30], 1
sete bl
movdqu xmm0, xmmword [0x018e6ba8]
mov rdi, qword [rbp + 0x10]
movsxd rbx, ebx
test rdi, rdi
movdqu xmmword [rsp + 0x40], xmm0
je 0x18fa5a7
mov r12d, dword [rsp + 0x4c]
mov r13d, dword [rsp + 0x48]
mov r14d, dword [rsp + 0x44]
mov rcx, qword [0x01965a38]
lea r9, [0x01965a38]
test esi, esi
jne 0x18fa5a7
test rdi, rdi
je 0x18fa60a
test rbx, rbx
mov rax, qword [rdi + 0x10]
movdqu xmm0, xmmword [rax + 8]
movdqu xmmword [rsp + 0x40], xmm0
je 0x18fa50a
mov rax, qword [rdi + 0x10]
cmp dword [rax + 0x1c], esi
je 0x18fa50a
cmp rcx, r9
je 0x18fa59b
bt dword [rcx + 0x1c], 0x16
jae 0x18fa59b
cmp byte [rcx + 0x19], 3
jb 0x18fa59b
mov dx, 0x2e
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4500]
lea r9, [rsp + 0x40]
call fcn.018ec028
jmp 0x18fa58d
mov rax, qword [rbp + 0xb8]
lea rdx, [0x018e5ef0]
mov r8, qword [rax + 0x70]
cmp r8, qword [rdx]
jne 0x18fa52f
mov r8, qword [rax + 0x78]
cmp r8, qword [rdx + 8]
jne 0x18fa52f
xor eax, eax
jmp 0x18fa534
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x18fa550
cmp rcx, r9
je 0x18fa59b
bt dword [rcx + 0x1c], 0x16
jae 0x18fa59b
cmp byte [rcx + 0x19], 3
jb 0x18fa59b
mov dx, 0x2f
jmp 0x18fa4f0
cmp dword [rsp + 0x44], r14d
jne 0x18fa565
cmp dword [rsp + 0x48], r13d
jne 0x18fa565
cmp dword [rsp + 0x4c], r12d
je 0x18fa59b
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov rcx, rbp
call fcn.018fa338
test rax, rax
jne 0x18fa58d
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.018fa11c
test eax, eax
mov esi, eax
js 0x18fa5cf
mov rcx, qword [0x01965a38]
lea r9, [0x01965a38]
mov rdi, qword [rdi]
test rdi, rdi
jne 0x18fa4a0
mov eax, esi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.018fdad0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov rcx, qword [0x01965a38]
lea rax, [0x01965a38]
cmp rcx, rax
je 0x18fa5a7
bt dword [rcx + 0x1c], 8
jae 0x18fa5a7
mov rcx, qword [rcx + 0x10]
lea r9, [0x018e6b58]
lea r8, [0x018e4500]
mov dx, 0x30
mov dword [rsp + 0x20], esi
call fcn.018ec180
jmp 0x18fa5a7
mov ecx, 0x80004005
call fcn.018e7be8
int3
Function at 0x18fcfd4
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x0195c138]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call sub.msvcrt.dll_memset
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x01800000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x18fd067
cmp dword [rsp + 0x24], 5
jb 0x18fd081
jmp 0x18fd07d
cmp dword [rsp + 0x30], esi
jne 0x18fd081
cmp dword [rsp + 0x24], 4
ja 0x18fd07d
jne 0x18fd081
cmp dword [rsp + 0x28], 0
jbe 0x18fd081
mov byte [rbx + 0x18], sil
lea rax, [0x01801590]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.018e7c18
movzx ecx, byte [0x01986688]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x01986688], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.018fdad0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x18fe017
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x0195c138]
jne 0x18fdaea
rol rcx, 0x10
test cx, 0xffff
jne 0x18fdae6
repz ret
ror rcx, 0x10
jmp 0x18fdf70
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x01966280]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x01966378]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18fdff5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x01966280]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18fe017
mov rax, qword [rsp + 0x88]
mov qword [0x01966378], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x01966318], rax
mov rax, qword [0x01966378]
mov qword [0x019661f0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x01966300], rax
mov dword [0x019661e0], 0xc0000409
mov dword [0x019661e4], 1
mov rax, qword [0x0195c138]
mov qword [rsp + 0x68], rax
mov rax, qword [0x0195c140]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x01801678]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x18fe0a4
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x18fe10f
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x18fe12f
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x01801688]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret

Function at 0x18feb30
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x0195c138]
xor rax, rsp
mov qword [rsp + 0x440], rax
lea rax, [rsp + 0x30]
mov rbx, rcx
lea rdx, [0x01801700]
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18feb89
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x18febd2
lea rdx, [rsp + 0x40]
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
je 0x18febc5
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x18febc5
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x18febc7
xor ebx, ebx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.018fdad0
add rsp, 0x450
pop rbx
ret
Function at 0x19025a0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
lea rax, [0x01849690]
mov rbx, rcx
mov qword [rcx], rax
lea rcx, [0x01849660]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x190b190
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xor ebx, ebx
test edx, edx
mov qword [rsp + 0x20], rdi
movzx r10d, r8w
movsxd r11, edx
mov rdi, rcx
jle 0x190b215
mov qword [rsp + 0x18], rsi
lea rsi, [0x0195ed30]
nop
nop
nop
movzx r9d, word [rdi + rbx*2]
movzx edx, r10w
shl r10w, 8
shr rdx, 8
movzx eax, r9w
inc rbx
movzx r8d, word [rsi + rdx*2]
sar ax, 8
movzx ecx, al
movzx eax, r9b
xor r8w, cx
xor r8w, r10w
movzx edx, r8w
shl r8w, 8
shr rdx, 8
mov r10w, word [rsi + rdx*2]
xor r10w, ax
xor r10w, r8w
cmp rbx, r11
jl 0x190b1c0
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
mov ax, r10w
ret

Function at 0x190b230
Capabilities:
Encode data using xor

Disassembly:
push rbx
lea eax, [rdx - 1]
xor r9w, r9w
mov r11, rcx
test eax, eax
movsxd r10, eax
js 0x190b293
lea rbx, [0x0195ef30]
nop
nop
movzx r8d, word [r11 + r10*2]
movzx edx, r9b
sar r9w, 8
movzx ecx, word [rbx + rdx*2]
movzx eax, r9b
xor cx, ax
movzx eax, r8w
shl ax, 8
xor cx, ax
movzx eax, cl
sar cx, 8
movzx r9d, word [rbx + rax*2]
xor cl, r8b
movzx ecx, cl
xor r9w, cx
xor r9w, r8w
dec r10
jns 0x190b250
mov ax, r9w
pop rbx
ret