joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800089e8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x2b0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x1800ba600]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov ebx, 0x104
mov r8d, ebx
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rcx, eax
test eax, eax
jle 0x180008a87
cmp byte [rsp + rcx + 0x90], 0x5c
je 0x180008a52
dec eax
dec rcx
test rcx, rcx
jg 0x180008a3c
jmp 0x180008a87
movsxd rdx, eax
lea rcx, [rsp + 0x90]
lea rax, [rbx + 0x7ffffefa]
test rax, rax
je 0x180008a7c
mov al, byte [rdx + rcx + 1]
test al, al
je 0x180008a7c
mov byte [rcx], al
inc rcx
sub rbx, 1
jne 0x180008a5d
test rbx, rbx
jne 0x180008a84
dec rcx
mov byte [rcx], 0
lea rdx, str.iexplore.exe
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x180008b08
lea rdx, str.registerrontrol.exe
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x180008b08
lea rdx, str.regsvr32.exe
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x180008b08
lea rdx, str.dtxh.exe
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x180008b08
lea rdx, [0x18008cdc0]
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x180008c4e
call fcn.180045314
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20019
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_Explorer
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x180008bdc
mov dword [rsp + 0x54], reloc.OLEAUT32.dll_SetErrorInfo
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.version
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x50], 0xe2c07dc
lea rdx, [rsp + 0x50]
lea rcx, [0x1800bd6f0]
call fcn.1800088e4
mov rcx, rax
lea rdx, [rsp + 0x1a0]
call fcn.1800077a0
movzx r11d, byte [0x1800b9798]
movzx eax, byte [rsp + 0x1a0]
cmp al, 0x36
cmovg r11d, eax
mov byte [0x1800b9798], r11b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x50], 0x3f2e0487
call fcn.18005ca68
mov rbx, rax
lea rdx, [rsp + 0x50]
lea rcx, [0x1800bd6f0]
call fcn.1800088e4
mov rcx, rax
mov rdx, rbx
call fcn.1800077a0
mov r11d, reloc.OLEAUT32.dll_SafeArrayGetLBound
mov word [rsp + 0x68], r11w
mov dword [rsp + 0x70], 0x1a1500
mov dword [rsp + 0x50], 0x63d0d238
lea rdx, [rsp + 0x50]
lea rcx, [0x1800bd6f0]
call fcn.1800088e4
mov rcx, rax
lea rdx, [rsp + 0x68]
call fcn.180007978
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.180064d20
add rsp, 0x2b0
pop rbx
ret
Function at 0x18000c360
Capabilities:
Check os version

Disassembly:
sub rsp, 0x228
mov rax, qword [0x1800ba600]
xor rax, rsp
mov qword [rsp + 0x210], rax
and qword [0x1800bc248], 0
and qword [0x1800bc240], 0
lea rcx, [rsp + 0x64]
xor edx, edx
mov r8d, SysAllocStringByteLen
call fcn.1800649f0
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], DllRegisterServer
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x18000c47e
cmp dword [rsp + 0x64], 5
jb 0x18000c47e
cmp dword [rsp + 0x68], 1
jb 0x18000c47e
cmp dword [rsp + 0x70], 2
jne 0x18000c47e
and dword [rsp + 0x20], 0
xor edx, edx
lea rcx, [rsp + 0x24]
lea r8d, [rdx + 0x34]
call fcn.1800649f0
lea rcx, [rsp + 0x101]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x100], 0
call fcn.1800649f0
mov rcx, qword [0x1800bc070]
lea rdx, [rsp + 0x100]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rsp + 0x100]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [0x1800bc070]
mov dword [rsp + 0x20], 0x38
mov dword [rsp + 0x24], 0x88
mov qword [rsp + 0x40], 2
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_CreateActCtxA]
mov qword [0x1800bc248], rax
cmp rax, 0xffffffffffffffff
je 0x18000c47e
lea rdx, [0x1800bc240]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.180064d20
add rsp, 0x228
ret

Function at 0x18000ccb4
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
cmp qword [rcx], 0
je 0x18000ccf4
mov r8, qword [rcx + 0x30]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
mov qword [rbx], rax
test rax, rax
je 0x18000ccf4
mov edx, 0x1f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
add rsp, 0x30
pop rbx
ret
Function at 0x18000ecfc
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rbx, qword [rcx + 0x140]
mov rdi, rcx
test rbx, rbx
je 0x18000ed31
cmp qword [rbx + 8], 0
jne 0x18000ed2b
mov rcx, qword [rbx]
call fcn.18007d5b0
mov qword [rbx + 8], rax
mov rcx, qword [rbx + 8]
jmp 0x18000ed33
xor ecx, ecx
test rcx, rcx
je 0x18000ed58
or edx, 0xffffffff
call fcn.18000d1cc
mov qword [rsp + 0xa0], rax
test rax, rax
jne 0x18000ed61
mov ecx, 0x8007000e
call fcn.18000100c
int3
and qword [rsp + 0xa0], 0
lea rdx, str.install.exe
lea rcx, [rsp + 0xa0]
call fcn.18000e9b8
mov ebx, 0x70
lea rcx, [rsp + 0x20]
mov r8, rbx
xor edx, edx
call fcn.1800649f0
lea rax, [0x18008e210]
mov dword [rsp + 0x20], ebx
mov rbx, qword [rsp + 0xa0]
mov qword [rsp + 0x30], rax
lea rax, str._uninstall
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x24], 0x440
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x50], 5
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x18000ee04
mov rcx, qword [rsp + 0x88]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7ed
call qword [sym.imp.USER32.dll_PostMessageA]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
jmp 0x18000ee12
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, 1
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret

Function at 0x18000ee24
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rcx + 0x28]
mov rbx, rcx
mov r9, rcx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8, [0x18000ddac]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x20], rax
add rsp, 0x30
pop rbx
ret
Function at 0x18001b68c
Capabilities:
Create process on windows

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rbx, rcx
lea rcx, [0x1800ba5a8]
mov rax, qword [0x1800ba5a8]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov rcx, qword [rbx + 0xd0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x128]
mov r11, qword [rsp + 0x30]
mov qword [rsp + 0x20], r11
mov r9d, dword [rbx + 0x1c0]
mov r8d, dword [rbx + 0x1bc]
lea rdx, str.ie8_x_click___d___d___d
lea rcx, [rsp + 0x78]
call fcn.1800165f8
lea rdx, str.dtUser.exe
lea rcx, [rsp + 0x80]
call fcn.180019010
nop
lea rcx, [rsp + 0x40]
call fcn.18005f670
nop
lea r8, [rsp + 0x80]
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1800179ec
nop
mov rdx, qword [rax]
lea rcx, [rsp + 0x88]
call fcn.1800080cc
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x18001b765
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x18001b785
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x18001b7a7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x1b0], eax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x88]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [rsp + 0x48]
call fcn.18005f5c4
nop
mov r9, 0xffffffff80000001
xor r8d, r8d
lea rdx, str.Toolbar_AutoShow_Type
mov rcx, qword [rax]
call fcn.18005cc04
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x18001b81a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x18001b83d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x18001b85c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x180022ae0
Capabilities:
Create thread

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x78
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1800ba600]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r9
mov r12, r8
mov rsi, rdx
mov rbx, rcx
mov rcx, r9
call fcn.180064df0
lea rcx, [rbx + 0x90]
mov r8, rax
mov rdx, rdi
call fcn.180005ecc
mov rax, qword [rsp + 0xc0]
mov qword [rbx + 0x10], rax
mov qword [rsp + 0x58], SafeArrayUnaccessData
and qword [rsp + 0x50], 0
mov byte [rsp + 0x40], 0
mov rcx, rsi
call fcn.180064df0
mov r8, rax
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.180005ecc
nop
lea rcx, str._ThrdSync
call fcn.180064df0
mov r8, rax
lea rdx, str._ThrdSync
lea rcx, [rsp + 0x38]
call fcn.180011cd4
mov byte [rbx + 8], 1
lea rax, [rbx + 0xb8]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x18002259c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0xc0], rax
mov rdx, rsi
lea rcx, [rbx + 0x18]
call fcn.180018d1c
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
lea rcx, [rbx + 0x50]
call fcn.180018d1c
lea rcx, [rbx + 0x18]
call fcn.18000ccb4
mov rdx, r12
mov rcx, rbx
call fcn.1800229e8
test eax, eax
jne 0x180022bfb
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx]
call fcn.18000cdb0
lea rcx, [rbx + 0x18]
call fcn.18000ccfc
nop
cmp qword [rsp + 0x58], 0x10
jb 0x180022c18
mov rcx, qword [rsp + 0x40]
call fcn.18006419c
nop
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180064d20
add rsp, 0x78
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x180022c34
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rbx, rcx
call fcn.180022450
lea rcx, [rbx + 0x18]
call fcn.18000ccb4
xor edi, edi
mov dword [rsp + 0x48], edi
mov byte [rbx + 8], dil
mov edx, 0x1388
mov rcx, qword [rbx + 0xc0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x180022c8f
xor edx, edx
mov rcx, qword [rbx + 0xc0]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0xc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx]
test rcx, rcx
je 0x180022ce2
mov rdx, qword [rbx + 0x10]
call fcn.18000ce08
mov edi, eax
mov dword [rsp + 0x48], eax
cmp qword [rbx + 0xb0], 0x10
jb 0x180022cc6
mov rdx, qword [rbx + 0x98]
jmp 0x180022ccd
lea rdx, [rbx + 0x98]
mov rcx, qword [rbx]
call fcn.1800208e8
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
and qword [rbx], 0
mov rcx, qword [rbx + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x180022cfb
test edi, edi
jne 0x180022d13
lea rcx, [rbx + 0x18]
call fcn.18000ccfc
lea rcx, [rbx + 0x50]
call fcn.18000ccfc
jmp 0x180022d1c
lea rcx, [rbx + 0x18]
call fcn.18000ccfc
mov byte [rbx + 8], 0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180034bd4
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
jne 0x180034c11
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx], rax
test rax, rax
je 0x180034c53
mov rbx, qword [rbx]
mov eax, 0xb948
mov word [rbx], ax
mov eax, 0xb848
mov qword [rbx + 2], rdi
mov word [rbx + 0xa], ax
mov eax, 0xe0ff
mov qword [rbx + 0xc], rsi
mov word [rbx + 0x14], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, SafeArrayUnaccessData
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180034d24
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rdx
cmp rdx, rsi
je 0x180034dca
cmp dword [rdx + 8], 0x100
jne 0x180034db1
mov rbx, qword [rdx + 0x10]
cmp rbx, 0x11
je 0x180034dab
lea ecx, [rsi + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, si
jge 0x180034dab
cmp rbx, 0x4e
je 0x180034da4
cmp rbx, 0x50
je 0x180034da4
cmp rbx, 0x4f
je 0x180034da4
cmp rbx, 0x4c
je 0x180034da4
cmp rbx, 0x46
je 0x180034da4
cmp rbx, 0x6b
je 0x180034da4
cmp rbx, 0x6d
je 0x180034da4
cmp rbx, 0x30
je 0x180034da4
cmp rbx, 0xbb
je 0x180034da4
cmp rbx, 0xbd
jne 0x180034dab
mov dword [rdi + 8], esi
xor eax, eax
jmp 0x180034dcf
cmp rbx, 0x74
je 0x180034da4
cmp dword [rdi + 8], 0x20a
jne 0x180034dca
mov ecx, SafeArrayGetLBound
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, si
jl 0x180034da7
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180035518
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x60
mov rdx, qword [str.SoftwareMicrosoftInternet_ExplorerZoom]
mov dword [rax + 0x18], 4
mov dword [rax + 0x10], 4
lea rax, [rax - 0x10]
mov rbx, rcx
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180035638
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.ZoomFactor
add rbx, 0x2dc
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18003562d
cmp dword [rbx], 0x186a0
je 0x18003562d
and qword [rsp + 0x40], 0
mov rdx, qword [str.SoftwareMicrosoftInternet_ExplorerZoom]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x18003562d
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x88]
lea rdx, str.ZoomFactor
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x88], 0x186a0
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x60
pop rbx
ret

Function at 0x180035640
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x50
lea rbx, [rcx + 0x2dc]
cmp dword [rbx], 0x186a0
je 0x1800356c8
and qword [r11 - 0x18], 0
mov rdx, qword [str.SoftwareMicrosoftInternet_ExplorerZoom]
lea rax, [r11 + 8]
mov qword [r11 - 0x20], rax
and qword [r11 - 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1800356c8
mov rcx, qword [rsp + 0x60]
lea r9d, [rax + 4]
lea rdx, str.ZoomFactor
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x60]
mov dword [rbx], 0x186a0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x50
pop rbx
ret

Function at 0x180039bcc
Capabilities:
Log keystrokes via polling

Disassembly:
sub rcx, 0x110
jmp method.CDTHtmlWebView.6.virtual_96
Function at 0x18003e768
Capabilities:
Set global application hook

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
jne 0x18003e789
xor eax, eax
jmp 0x18003e899
call fcn.18005adac
mov rdi, rax
cmp qword [0x1800bd3e8], rax
je 0x18003e874
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x50]
lea rcx, [0x1800bd410]
mov dword [rsp + 0x50], eax
call fcn.18003c9c0
mov qword [rax], rdi
mov qword [0x1800bd3e8], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
lea rdx, [0x18003c89c]
mov r9d, eax
lea ecx, [r8 + 3]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov rcx, rbx
mov byte [0x1800bd474], 1
mov qword [0x1800bd400], rax
call fcn.18005add4
mov rbp, qword [0x1800bd4b0]
mov r12, qword [0x1800bd480]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x20]
lea rcx, [0x1800bd480]
mov rsi, rax
mov qword [rsp + 0x50], rax
call fcn.18003b108
mov rbx, rax
cmp qword [rax], 0
je 0x18003e830
cmp qword [rax], r12
je 0x18003e835
call fcn.180065948
cmp qword [rbx + 8], rbp
jne 0x18003e874
mov ebp, 0xfffffffc
mov rcx, rsi
mov edx, ebp
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
lea rdx, [rsp + 0x50]
lea rcx, [0x1800bd480]
mov rbx, rax
call fcn.18005fc28
lea r8, [0x18003e414]
mov edx, ebp
mov rcx, rsi
mov qword [rax], rbx
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov r8, qword [0x1800bd7a8]
xor r9d, r9d
lea rdx, [0x18003c8e4]
lea ecx, [r9 + 7]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x1800bd3d8], rax
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x18004eb44
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov r10d, r8d
mov r11, rdx
mov r9d, ecx
test rdx, rdx
jne 0x18004eb63
xor eax, eax
jmp 0x18004ec76
not r9d
lea rsi, [0x180095d10]
cmp r10d, 8
jb 0x18004ec4b
mov rbx, r10
shr rbx, 3
movzx ecx, byte [r11]
mov eax, r9d
shr r9d, 8
xor rcx, rax
add r11, 8
add r10d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r11 - 7]
mov edx, dword [rsi + rax*4]
xor edx, r9d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 6]
mov r8d, dword [rsi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 5]
mov edx, dword [rsi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 4]
mov r8d, dword [rsi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 3]
mov edx, dword [rsi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 2]
mov r8d, dword [rsi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 1]
mov edx, dword [rsi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov r9d, dword [rsi + rax*4]
xor r9d, edx
sub rbx, 1
jne 0x18004eb7e
test r10d, r10d
je 0x18004ec70
movzx ecx, byte [r11]
mov eax, r9d
inc r11
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rsi + rdx*4]
xor r9d, eax
add r10d, 0xffffffff
jne 0x18004ec50
not r9d
mov eax, r9d
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
ret

Function at 0x18004ec84
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov r9d, dword [rcx + 8]
mov r10, rcx
mov r11b, dl
mov edx, dword [rcx]
mov r8d, r9d
and r8d, 0xfffd
mov rcx, rdx
shr edx, 8
or r8d, 2
mov eax, r8d
xor eax, 1
imul eax, r8d
lea r8, [0x180095d10]
shr eax, 8
xor r11b, al
movsx rax, r11b
xor rcx, rax
movzx eax, cl
mov ecx, dword [r8 + rax*4]
xor ecx, edx
movzx eax, cl
mov dword [r10], ecx
movzx ecx, r9b
add eax, dword [r10 + 4]
shr r9d, 8
imul eax, eax, 0x8088405
inc eax
mov dword [r10 + 4], eax
movzx eax, byte [r10 + 7]
xor rcx, rax
mov eax, dword [r8 + rcx*4]
xor eax, r9d
mov dword [r10 + 8], eax
mov al, r11b
ret

Function at 0x18004f20c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov rdi, r9
mov rbp, rdx
mov r10, rcx
imul esi, edx
cmp byte [r9], 0
je 0x18004f25c
and qword [rax - 0x18], 0
mov rdx, rcx
mov rcx, qword [rdi + 8]
lea r9, [rax + 0x10]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18004f256
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
jmp 0x18004f283
mov edx, dword [r9 + 0x2c]
mov ecx, dword [r9 + 0x28]
lea eax, [rdx + rsi]
cmp eax, ecx
jbe 0x18004f26f
sub ecx, edx
mov esi, ecx
add rdx, qword [r9 + 0x20]
mov r8d, esi
mov rcx, r10
call fcn.180066290
add dword [rdi + 0x2c], esi
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
xor edx, edx
div rbp
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800510e0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
mov rsi, rdx
mov rdi, rcx
cmp rcx, rbp
jne 0x180051103
mov eax, 0xffffff9a
jmp 0x1800512ca
cmp dword [rcx + 0x1c], ebp
je 0x1800510f9
cmp qword [rcx + 0x80], rbp
je 0x180051116
call fcn.18004fb94
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.18004f9c4
cmp eax, ebp
je 0x18005113b
mov eax, 0xffffff99
jmp 0x1800512ca
mov ecx, 0xb0
call fcn.1800645c8
mov rbx, rax
cmp rax, rbp
jne 0x180051157
mov eax, 0xffffff98
jmp 0x1800512ca
mov ecx, 0x4000
call fcn.1800645c8
mov ecx, dword [rsp + 0x40]
mov dword [rbx + 0x70], ebp
mov dword [rbx + 0x68], ecx
mov ecx, dword [rsp + 0x50]
mov qword [rbx], rax
mov dword [rbx + 0x6c], ecx
cmp rax, rbp
jne 0x180051184
mov rcx, rbx
call fcn.180064680
jmp 0x18005114d
mov dword [rbx + 0x64], ebp
mov eax, dword [rdi + 0x40]
cmp dword [rdi + 0x38], ebp
mov dword [rbx + 0x78], eax
mov dword [rbx + 0x74], ebp
mov eax, dword [rdi + 0x38]
mov dword [rbx + 0x90], eax
mov rax, qword [rdi]
mov ecx, ebp
mov qword [rbx + 0x88], rax
mov eax, dword [rdi + 0x10]
sete cl
mov dword [rbx + 0x24], ebp
mov dword [rbx + 0x94], eax
cmp ecx, ebp
jne 0x1800511db
lea rcx, [rbx + 8]
mov qword [rbx + 0x38], rbp
mov qword [rbx + 0x40], rbp
mov qword [rbx + 0x48], rbp
call fcn.18004ef00
cmp eax, ebp
jne 0x1800511db
mov dword [rbx + 0x64], 1
mov eax, dword [rdi + 0x44]
mov dword [rbx + 0x7c], eax
mov eax, dword [rdi + 0x48]
mov dword [rbx + 0x80], eax
mov al, byte [rdi + 0x34]
and al, 1
mov byte [rbx + 0x98], al
mov eax, dword [rdi + 0x34]
shr eax, 3
test al, 1
je 0x180051204
mov al, byte [rdi + 0x3d]
jmp 0x180051207
mov al, byte [rdi + 0x43]
mov byte [rbx + 0xac], al
mov al, byte [rbx + 0x98]
mov dword [rbx + 0x9c], 0x12345678
neg al
mov dword [rbx + 0xa0], 0x23456789
mov dword [rbx + 0xa4], 0x34567890
sbb ecx, ecx
and ecx, 0xc
mov dword [rbx + 0xa8], ecx
cmp rsi, rbp
je 0x1800512b0
lea r8, [0x180095d10]
cmp byte [rsi], bpl
je 0x1800512b0
movsx rax, byte [rsi]
mov edx, dword [rbx + 0x9c]
mov rcx, rdx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [r8 + rax*4]
xor ecx, edx
mov edx, dword [rbx + 0xa4]
movzx eax, cl
mov dword [rbx + 0x9c], ecx
movzx ecx, dl
add eax, dword [rbx + 0xa0]
shr edx, 8
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0xa0], eax
movzx eax, byte [rbx + 0xa3]
xor rcx, rax
mov eax, dword [r8 + rcx*4]
xor eax, edx
add rsi, 1
mov dword [rbx + 0xa4], eax
jne 0x18005124a
mov ecx, dword [rdi + 0x7c]
mov eax, dword [rsp + 0x58]
mov dword [rbx + 0x10], ebp
lea ecx, [rcx + rax + 0x1e]
xor eax, eax
mov dword [rbx + 0x60], ecx
mov qword [rdi + 0x80], rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret