joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ac440
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp qword [rdx + 0x18], 0x10
mov r8, rdx
mov r9, qword [rdx + 0x10]
jb 0x1800ac451
mov r8, qword [rdx]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
test r9, r9
je 0x1800ac484
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [r8 + rdx]
inc rdx
xor rcx, rax
imul rcx, r10
cmp rdx, r9
jb 0x1800ac470
mov rax, rcx
ret

Function at 0x1800b08f0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x60
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r14, rdx
mov rbx, rcx
mov qword [rax - 0x20], rcx
call fcn.1800bd1f0
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
mov dword [rsp + 0x30], r9d
lea rsi, [rbx + 0x70]
movzx r8d, al
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rdx, 0x100000001b3
imul r8, rdx
movzx ecx, byte [rsp + 0x31]
xor r8, rcx
imul r8, rdx
movzx eax, byte [rsp + 0x32]
xor r8, rax
imul r8, rdx
movzx eax, byte [rsp + 0x33]
xor r8, rax
imul r8, rdx
mov rdx, qword [rsi + 0x30]
and rdx, r8
mov r8, qword [rsi + 0x18]
mov rax, rdx
add rax, rax
mov rax, qword [r8 + rax*8]
mov rcx, qword [rsi + 8]
add rdx, rdx
mov r10, qword [r8 + rdx*8]
lea r11, [r8 + rdx*8]
cmp r10, rcx
jne 0x1800b09a0
mov rdx, rcx
jmp 0x1800b09a7
mov rdx, qword [r11 + 8]
mov rdx, qword [rdx]
cmp rax, rdx
je 0x1800b09bd
cmp r9d, dword [rax + 0x10]
je 0x1800b09b7
mov rax, qword [rax]
jmp 0x1800b0996
cmovne rax, rcx
jmp 0x1800b09c0
mov rax, rcx
cmp rax, rcx
jne 0x1800b0a57
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rbx, qword [rcx]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [0x180092050]
mov r8, qword [rbx + 8]
mov rdx, rbx
lea rcx, [rsi + 8]
call fcn.1800b1870
mov rdx, rax
mov rax, qword [rsi + 0x10]
movabs rcx, 0xaaaaaaaaaaaaaa9
sub rcx, rax
cmp rcx, 1
jae 0x1800b0a28
lea rcx, [0x180092030]
call fcn.1802b9a30
int3
inc rax
mov qword [rsi + 0x10], rax
mov qword [rbx + 8], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdx
mov r9, qword [rsi + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.1800b1470
mov rax, qword [rsp + 0x38]
movzx ecx, byte [r14]
mov byte [rax + 0x14], cl
lea rcx, [rsp + 0x48]
call fcn.1800b0c90
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1800b0a80
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rbx, rcx
mov qword [rsp + 0x28], rcx
call fcn.1800bd060
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
mov dword [rsp + 0x20], r9d
movzx edx, al
movabs rsi, 0xcbf29ce484222325
xor rdx, rsi
movabs rdi, 0x100000001b3
imul rdx, rdi
movzx ecx, byte [rsp + 0x21]
xor rdx, rcx
imul rdx, rdi
movzx eax, byte [rsp + 0x22]
xor rdx, rax
imul rdx, rdi
movzx eax, byte [rsp + 0x23]
xor rdx, rax
imul rdx, rdi
mov rcx, qword [rbx + 0xa0]
and rcx, rdx
mov rdx, qword [rbx + 0x88]
mov rax, rcx
add rax, rax
mov rax, qword [rdx + rax*8]
mov r8, qword [rbx + 0x78]
add rcx, rcx
mov r10, qword [rdx + rcx*8]
lea r11, [rdx + rcx*8]
cmp r10, r8
jne 0x1800b0b2b
mov rcx, r8
jmp 0x1800b0b32
mov rcx, qword [r11 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1800b0b48
cmp r9d, dword [rax + 0x10]
je 0x1800b0b42
mov rax, qword [rax]
jmp 0x1800b0b21
cmovne rax, r8
jmp 0x1800b0b4b
mov rax, r8
cmp rax, r8
je 0x1800b0b5e
lea rbx, [rax + 0x14]
lea rcx, [rsp + 0x28]
jmp 0x1800b0c35
lea rcx, [rsp + 0x28]
call fcn.1800b0cb0
lea rdx, [rbx + 0xb0]
mov rcx, rbx
call fcn.1800b08f0
mov qword [rsp + 0x30], rbx
mov rcx, rbx
call fcn.1800bd060
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
mov dword [rsp + 0x20], r9d
movzx r8d, al
xor r8, rsi
imul r8, rdi
movzx ecx, byte [rsp + 0x21]
xor r8, rcx
imul r8, rdi
movzx eax, byte [rsp + 0x22]
xor r8, rax
imul r8, rdi
movzx eax, byte [rsp + 0x23]
xor r8, rax
imul r8, rdi
mov rdx, qword [rbx + 0xa0]
and rdx, r8
mov r8, qword [rbx + 0x88]
mov rax, rdx
add rax, rax
mov rax, qword [r8 + rax*8]
mov rcx, qword [rbx + 0x78]
add rdx, rdx
mov r10, qword [r8 + rdx*8]
lea r11, [r8 + rdx*8]
nop dword [rax]
cmp r10, rcx
jne 0x1800b0bfa
mov rdx, rcx
jmp 0x1800b0c01
mov rdx, qword [r11 + 8]
mov rdx, qword [rdx]
cmp rax, rdx
je 0x1800b0c17
cmp r9d, dword [rax + 0x10]
je 0x1800b0c11
mov rax, qword [rax]
jmp 0x1800b0bf0
cmovne rax, rcx
jmp 0x1800b0c1a
mov rax, rcx
cmp rax, rcx
jne 0x1800b0c2c
lea rcx, [0x180092010]
call fcn.1802b9a54
int3
lea rbx, [rax + 0x14]
lea rcx, [rsp + 0x30]
call fcn.1800b0cb0
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1800b1470
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov r9, rcx
mov qword [rsp + 0x28], rcx
movabs rcx, 0xcbf29ce484222325
mov qword [rsp + 0x20], rcx
xor edx, edx
movabs r10, 0x100000001b3
mov qword [rsp + 0x30], rdx
cmp rdx, 4
jae 0x1800b14e0
movzx eax, byte [r8 + rdx]
xor rcx, rax
mov qword [rsp + 0x20], rcx
imul rcx, r10
mov qword [rsp + 0x20], rcx
inc rdx
jmp 0x1800b14ba
mov r10, qword [r9 + 0x30]
and r10, rcx
mov qword [rsp + 0x40], r10
mov rbx, qword [r9 + 8]
shl r10, 4
mov rcx, qword [r9 + 0x18]
cmp qword [rcx + r10], rbx
je 0x1800b1510
mov rax, qword [rcx + r10 + 8]
mov qword [rsp + 0x50], rax
mov rbx, qword [rax]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rbx
cmp rbx, qword [rcx + r10]
je 0x1800b1561
mov rbx, qword [rbx + 8]
mov eax, dword [rbx + 0x10]
cmp dword [r8], eax
je 0x1800b1529
jmp 0x1800b1515
mov r8, qword [rsp + 0xa8]
mov rdx, qword [r8]
mov rcx, qword [r8 + 8]
mov qword [rcx], rdx
mov rdx, qword [r8 + 8]
mov rcx, qword [r8]
mov qword [rcx + 8], rdx
dec qword [r9 + 0x10]
mov rcx, r8
call fcn.18011da90
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1800b1600
mov rdi, qword [rsp + 0xa8]
mov qword [rsp + 0x50], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x1800b15a3
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rcx, qword [r9 + 0x18]
add rcx, r10
mov rax, qword [rcx]
cmp rax, qword [r9 + 8]
jne 0x1800b15c1
mov qword [rcx], rdi
mov rax, qword [r9 + 0x18]
mov qword [rax + r10 + 8], rdi
jmp 0x1800b15ed
cmp rax, rbx
jne 0x1800b15cb
mov qword [rcx], rdi
jmp 0x1800b15ed
mov rax, qword [rcx + 8]
mov rdx, qword [rax]
mov qword [rcx + 8], rdx
cmp rdx, rdi
je 0x1800b15ed
mov r8, qword [r9 + 0x18]
mov rax, qword [r8 + r10 + 8]
mov rdx, qword [rax + 8]
mov qword [r8 + r10 + 8], rdx
mov rcx, r9
call fcn.1800b1660
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1802b85a0
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800b1770
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x30
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov rdi, rdx
mov r10, rcx
movzx edx, byte [r8 + 0x10]
movabs rcx, 0x100000001b3
mov r9, r8
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movzx eax, byte [r8 + 0x11]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x12]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x13]
mov r8, qword [r10 + 0x30]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r10 + 0x18]
and r8, rdx
shl r8, 4
add rcx, r8
cmp qword [rcx + 8], r9
jne 0x1800b1818
cmp qword [rcx], r9
jne 0x1800b180e
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [r8 + rcx + 8], rax
jmp 0x1800b1823
mov rax, qword [r9 + 8]
mov qword [rcx + 8], rax
jmp 0x1800b1823
cmp qword [rcx], r9
jne 0x1800b1828
mov rax, qword [r9]
mov qword [rcx], rax
mov r9, qword [rsp + 0x50]
mov rdx, qword [r9 + 8]
mov rcx, r9
mov rbx, qword [r9]
mov qword [rdx], rbx
mov r8, qword [r9]
mov rdx, qword [r9 + 8]
mov qword [r8 + 8], rdx
dec qword [r10 + 0x10]
call fcn.18011da90
mov rax, rdi
mov qword [rdi], rbx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1802b85a0
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1800b1a90
Capabilities:
Read file on windows

Disassembly:
push rbx
mov eax, 0x1060
call fcn.1802b8650
sub rsp, rax
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0x1058], rax
mov rcx, qword [rcx]
lea r9, [rsp + 0x1050]
mov ebx, edx
mov rax, r8
xor edx, edx
mov r8d, ebx
mov dword [rsp + 0x1050], edx
mov qword [rsp + 0x20], rdx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800b1aff
mov eax, dword [rsp + 0x1050]
mov rcx, qword [rsp + 0x1058]
xor rcx, rsp
call fcn.1802b85a0
add rsp, 0x1060
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, ebx
lea rdx, [0x1800921a8]
mov r9d, eax
lea rcx, [rsp + 0x30]
call fcn.1800b0450
lea rdx, [0x1803f5e58]
lea rcx, [rsp + 0x30]
call fcn.1802c76f0
int3

Function at 0x1800b1ee0
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.1800ac4e0
nop
cmp qword [rax + 0x18], 8
jb 0x1800b1f07
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x1800b1f2f
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.1800ae240
mov qword [rsp + 0x40], 7
xor eax, eax
mov qword [rsp + 0x38], rax
mov word [rsp + 0x28], ax
cmp ebx, 0xffffffff
je 0x1800b1f50
test bl, 0x10
jne 0x1800b1f50
mov al, 1
add rsp, 0x50
pop rbx
ret
Function at 0x1800b90e0
Capabilities:
Get file attributes

Disassembly:
jmp 0x1800b90e0
push rbx
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.1800ac4e0
nop
cmp qword [rax + 0x18], 8
jb 0x1800b9107
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x1800b912f
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.1800ae240
mov qword [rsp + 0x40], 7
xor eax, eax
mov qword [rsp + 0x38], rax
mov word [rsp + 0x28], ax
cmp ebx, 0xffffffff
je 0x1800b9150
test bl, 0x10
je 0x1800b9150
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x1800bac20
Capabilities:
Create thread
Resume thread

Disassembly:
push rdi
mov eax, 0x1080
call fcn.1802b8650
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x1098], rbx
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0x1078], rax
mov rdi, rcx
xor eax, eax
mov qword [rsp + 0x1070], rax
lea rdx, [rcx + 0x10]
lea rcx, [rsp + 0x1070]
call fcn.1800b5cb0
nop
lea rax, [rdi + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
mov r9, rdi
lea r8, [0x1800baef0]
xor edx, edx
xor ecx, ecx
call fcn.1802d0f10
mov rbx, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x30], 0
mov rcx, qword [rdi]
cmp rax, rcx
je 0x1800bacf3
test rcx, rcx
je 0x1800bacf0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1800bace9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x180091ee8]
lea rcx, [rsp + 0x50]
call fcn.1800b0450
lea rdx, [0x1803f5e58]
lea rcx, [rsp + 0x50]
call fcn.1802c76f0
int3
mov qword [rdi], 0
mov qword [rdi], rbx
lea rcx, [rsp + 0x30]
call fcn.1800b01a0
mov qword [rsp + 0x38], 0
cmp qword [rdi], 0
sete bl
lea rcx, [rsp + 0x38]
call fcn.1800b01a0
test bl, bl
je 0x1800bad3e
lea rdx, [0x180092b98]
lea rcx, [rsp + 0x50]
call fcn.1800b0450
lea rdx, [0x1803f5e58]
lea rcx, [rsp + 0x50]
call fcn.1802c76f0
int3
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
lea rcx, [rsp + 0x1070]
call fcn.1800b5d40
mov rcx, qword [rsp + 0x1078]
xor rcx, rsp
call fcn.1802b85a0
mov rbx, qword [rsp + 0x1098]
add rsp, 0x1080
pop rdi
ret

Function at 0x1800bad80
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
xor eax, eax
mov qword [rsp + 0x28], rax
lea rdx, [rcx + 0x10]
lea rcx, [rsp + 0x28]
call fcn.1800b5cb0
nop
movzx eax, byte [rbx + 0x80]
test al, al
je 0x1800badd2
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800badd2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor eax, eax
xchg byte [rbx + 0x80], al
lea rcx, [rsp + 0x28]
call fcn.1800b5d40
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1802b85a0
add rsp, 0x40
pop rbx
ret
Function at 0x1800bc100
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xfd0]
mov eax, 0x10d0
call fcn.1802b8650
sub rsp, rax
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x1118], rbx
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rbp + 0xfc8], rax
mov rbx, r8
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x70], rdx
xor r15d, r15d
mov dword [rsp + 0x40], r15d
mov dword [rbp + 0xfa0], r15d
mov rdx, r8
lea rcx, [rsp + 0x48]
call fcn.1800ac4e0
nop
cmp qword [rax + 0x18], 8
jb 0x1800bc174
mov rax, qword [rax]
lea rcx, [rbp + 0xfa0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov r9d, 2
mov r8, rax
xor edx, edx
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x1800bc1bd
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.1800ae240
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r15
mov word [rsp + 0x48], r15w
test esi, esi
je 0x1800bc214
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1800ac490
nop
cmp qword [rax + 0x18], 0x10
jb 0x1800bc1ed
mov rax, qword [rax]
mov r9d, esi
mov r8, rax
lea rdx, [0x180092d00]
lea rcx, [rbp - 0x80]
call fcn.1800b0450
lea rdx, [0x1803f5e58]
lea rcx, [rbp - 0x80]
call fcn.1802c76f0
nop
mov edx, dword [rbp + 0xfa0]
shr rdx, 1
mov qword [rbp + 0xfb8], r15
mov qword [rbp + 0xfc0], r15
mov qword [rbp + 0xfc0], 7
mov qword [rbp + 0xfb8], r15
mov word [rbp + 0xfa8], r15w
xor r8d, r8d
lea rcx, [rbp + 0xfa8]
call fcn.1800ad410
nop
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1800ac4e0
nop
lea rcx, [rbp + 0xfa8]
cmp qword [rbp + 0xfc0], 8
cmovae rcx, qword [rbp + 0xfa8]
cmp qword [rax + 0x18], 8
jb 0x1800bc284
mov rax, qword [rax]
lea rdx, [rbp + 0xfa0]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r15
mov r9d, 2
mov r8, rax
xor edx, edx
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x1800bc2cd
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.1800ae240
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r15
mov word [rsp + 0x48], r15w
test esi, esi
je 0x1800bc32c
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1800ac490
mov rbx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1800bc2ff
mov rbx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8, rbx
lea rdx, [0x180092d60]
lea rcx, [rbp - 0x80]
call fcn.1800b0450
lea rdx, [0x1803f5e58]
lea rcx, [rbp - 0x80]
call fcn.1802c76f0
nop
lea rdx, [rbp + 0xfa8]
cmp qword [rbp + 0xfc0], 8
cmovae rdx, qword [rbp + 0xfa8]
mov r8d, dword [rbp + 0xfa0]
shr r8d, 1
dec r8d
mov rcx, rdi
call fcn.1800ac3f0
nop
mov dword [rsp + 0x40], 1
mov r8, qword [rbp + 0xfc0]
cmp r8, 8
jb 0x1800bc384
inc r8
mov rdx, qword [rbp + 0xfa8]
lea rcx, [rbp + 0xfa8]
call fcn.1800ae240
mov qword [rbp + 0xfc0], 7
mov qword [rbp + 0xfb8], r15
mov word [rbp + 0xfa8], r15w
mov rax, rdi
mov rcx, qword [rbp + 0xfc8]
xor rcx, rsp
call fcn.1802b85a0
mov rbx, qword [rsp + 0x1118]
add rsp, 0x10d0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800bc3d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
mov eax, 0x10a0
call fcn.1802b8650
sub rsp, rax
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x10c0], rbx
mov qword [rsp + 0x10c8], rsi
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0x1098], rax
mov rbx, rdx
mov rdi, rcx
xor esi, esi
mov dword [rsp + 0x1090], esi
mov dword [rsp + 0x1094], 4
lea rcx, [rsp + 0x40]
call fcn.1800ac4e0
nop
cmp qword [rax + 0x18], 8
jb 0x1800bc439
mov rax, qword [rax]
lea rcx, [rsp + 0x1094]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x1090]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rsi
mov r9d, reloc.WSOCK32.dll_recv
mov r8, rax
xor edx, edx
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edi, eax
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x1800bc48b
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.1800ae240
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
test edi, edi
je 0x1800bc4eb
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1800ac490
mov rbx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1800bc4bc
mov rbx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8, rbx
lea rdx, [0x180092da0]
lea rcx, [rsp + 0x70]
call fcn.1800b0450
lea rdx, [0x1803f5e58]
lea rcx, [rsp + 0x70]
call fcn.1802c76f0
nop
mov eax, dword [rsp + 0x1090]
mov rcx, qword [rsp + 0x1098]
xor rcx, rsp
call fcn.1802b85a0
lea r11, [rsp + 0x10a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1800bc670
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
mov eax, 0x1080
call fcn.1802b8650
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x1090], rbx
mov qword [rsp + 0x1098], rsi
mov rdi, rdx
mov rbx, rcx
lea rcx, [rsp + 0x30]
call fcn.1800ac4e0
nop
cmp qword [rax + 0x18], 8
jb 0x1800bc6b3
mov rax, qword [rax]
xor esi, esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov r8, qword [rsp + 0x48]
cmp r8, 8
jb 0x1800bc6f0
inc r8
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.1800ae240
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x30], si
cmp ebx, 2
jne 0x1800bc70c
xor al, al
jmp 0x1800bc753
test ebx, ebx
je 0x1800bc751
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1800ac490
nop
cmp qword [rax + 0x18], 0x10
jb 0x1800bc728
mov rax, qword [rax]
mov r9d, ebx
mov r8, rax
lea rdx, [0x180092e28]
lea rcx, [rsp + 0x60]
call fcn.1800b0450
lea rdx, [0x1803f5e58]
lea rcx, [rsp + 0x60]
call fcn.1802c76f0
nop
mov al, 1
lea r11, [rsp + 0x1080]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1800bcac0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x68]
mov ebx, edx
mov rax, r8
xor edx, edx
mov r8d, ebx
mov dword [rsp + 0x68], edx
mov qword [rsp + 0x20], rdx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800bcb1b
mov eax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1802b85a0
add rsp, 0x80
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, ebx
lea rdx, [0x180092eb0]
mov r9d, eax
lea rcx, [rsp + 0x30]
call fcn.1800bca10
lea rdx, [0x1803f6118]
lea rcx, [rsp + 0x30]
call fcn.1802c76f0
int3
Function at 0x1800beb80
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0xfe0]
mov eax, 0x10e0
call fcn.1802b8650
sub rsp, rax
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rbp + 0xfd8], rax
mov rsi, r9
mov rbx, rcx
mov qword [rsp + 0x70], rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rbp + 0xfb8]
call fcn.1800bee70
nop
xor eax, eax
mov qword [rbp + 0xfa0], rax
mov qword [rbp + 0xfa8], rax
mov qword [rbp + 0xfb0], rax
test rsi, rsi
je 0x1800bec10
mov dword [rbp + 0xfa0], reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp + 0xfb0], 1
mov rax, qword [rsi]
mov qword [rbp + 0xfa8], rax
lea rax, [0x180093588]
mov qword [rbx], rax
mov qword [rbx + 8], r14
mov dword [rsp + 0x20], 1
lea rdx, [rbp + 0xfb8]
lea rcx, [rsp + 0x30]
call fcn.1800ac4e0
nop
cmp qword [rax + 0x18], 8
jb 0x1800bec42
mov rax, qword [rax]
lea rcx, [rbp + 0xfa0]
test rsi, rsi
cmove rcx, r14
mov r8, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x28]
lea rcx, [rbx + 8]
call fcn.1800b0110
nop
lea rcx, [rsp + 0x28]
call fcn.1800b01a0
nop
mov r8, qword [rsp + 0x48]
cmp r8, 8
jb 0x1800bec97
inc r8
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.1800ae240
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r14
mov word [rsp + 0x30], r14w
cmp qword [rbx + 8], 0
jne 0x1800bed46
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1800becfb
lea r8, [rbp + 0xfb8]
cmp qword [rbp + 0xfd0], 0x10
cmovae r8, qword [rbp + 0xfb8]
lea rdx, [0x1800934a8]
lea rcx, [rsp + 0x30]
call fcn.1800beae0
lea rdx, [0x1803f6158]
lea rcx, [rsp + 0x30]
call fcn.1802c76f0
int3
lea rdx, [rbp + 0xfb8]
lea rcx, [rsp + 0x30]
call fcn.1800ac490
mov rbx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1800bed19
mov rbx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8, rbx
lea rdx, [0x1800934d8]
lea rcx, [rbp - 0x80]
call fcn.1800b0450
lea rdx, [0x1803f5e58]
lea rcx, [rbp - 0x80]
call fcn.1802c76f0
nop
lea rcx, [rbp + 0xfb8]
call fcn.1800ad110
mov rax, rbx
mov rcx, qword [rbp + 0xfd8]
xor rcx, rsp
call fcn.1802b85a0
add rsp, 0x10e0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret