joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18006f4c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x2b0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x2f8], rbx
mov rax, qword [0x18013a210]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov r12, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x58], rcx
xor r13d, r13d
mov dword [rsp + 0x3c], r13d
mov qword [rcx + 0x20], 7
mov qword [rcx + 0x18], r13
mov word [rcx + 8], r13w
mov dword [rsp + 0x3c], 1
mov rbx, r13
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x38], 0x104
mov word [rsp + 0x90], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x92]
call fcn.1800c1250
mov qword [rsp + 0x80], 7
mov qword [rsp + 0x78], r13
mov word [rsp + 0x68], r13w
call fcn.180067400
mov ebp, 0x20219
mov ecx, 0x20119
test eax, eax
cmovne ebp, ecx
mov qword [rsp + 0x30], r13
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, ebp
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18006f6b8
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rbx
and ebp, 0x300
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x30], r13d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov ecx, dword [rsp + 0x38]
test ecx, ecx
je 0x18006f672
mov edx, dword [rsp + 0x30]
test edx, edx
je 0x18006f667
cmp edx, 2
jbe 0x18006f646
cmp edx, 7
jne 0x18006f667
test cl, 1
jne 0x18006f63b
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x18006f63b
mov rdx, rcx
shr rdx, 1
cmp word [rsp + rdx*2 + 0x8e], r13w
jne 0x18006f63b
cmp eax, 1
jbe 0x18006f67b
cmp word [rsp + rdx*2 + 0x8c], r13w
je 0x18006f67b
mov word [rsp + 0x90], r13w
jmp 0x18006f6a7
test cl, 1
jne 0x18006f65c
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0x8e], 0
je 0x18006f67b
mov word [rsp + 0x90], r13w
jmp 0x18006f6a7
mov word [rsp + 0x90], r13w
jmp 0x18006f6a7
mov word [rsp + 0x90], r13w
test edi, edi
jne 0x18006f6a7
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x90]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x90]
mov rcx, rsi
call fcn.180012d90
test rbx, rbx
je 0x18006f6b8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r13
cmp qword [rsp + 0x80], 8
jb 0x18006f6cd
mov rcx, qword [rsp + 0x68]
call fcn.1800bd964
mov qword [rsp + 0x80], 7
mov qword [rsp + 0x78], r13
mov word [rsp + 0x68], r13w
test rbx, rbx
je 0x18006f6f7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rsi
jmp 0x18006f6fa
mov rax, rsi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1800bd980
mov rbx, qword [rsp + 0x2f8]
add rsp, 0x2b0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180072020
Capabilities:
Create http request

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rdi, rcx
lea rax, vtable.CWininetCom.0
mov qword [rcx], rax
mov qword [rcx + 0x28], 7
xor eax, eax
mov qword [rcx + 0x20], rax
mov word [rcx + 0x10], ax
mov qword [rcx + 0x30], rax
lea rbx, [rcx + 0x38]
mov qword [rbx], rax
cmp qword [rcx + 0x30], rax
jne 0x18007208a
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.GSD_COMS
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rdi + 0x30], rax
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.180073bf0
mov rsi, rax
cmp rbx, rax
je 0x1800720b8
mov rcx, rbx
call fcn.1800169a0
mov r11, qword [rsi]
mov qword [rbx], r11
test r11, r11
je 0x1800720b8
lock add dword [r11 + 0x10], 1
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x180072108
or eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
add eax, 0xffffffff
jne 0x180072103
test rbx, rbx
je 0x1800720fe
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800720e2
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800720f0
call fcn.1800bd9a0
mov rcx, rbx
call fcn.1800bd964
nop
mov rax, rdi
jmp 0x18007210b
mov rax, rdi
jmp 0x18007210b
mov rax, rdi
jmp 0x18007210b
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180072150
Capabilities:
Create http request

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rsi
mov rax, rdx
mov rdi, rcx
lea rcx, vtable.CWininetCom.0
mov qword [rdi], rcx
mov qword [rdi + 0x28], 7
xor ecx, ecx
mov qword [rdi + 0x20], rcx
mov word [rdi + 0x10], cx
mov qword [rdi + 0x30], rcx
lea rbx, [rdi + 0x38]
mov qword [rbx], rcx
cmp qword [rdi + 0x30], rcx
jne 0x1800721b9
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rdi + 0x30], rax
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.180073bf0
mov rsi, rax
cmp rbx, rax
je 0x1800721e7
mov rcx, rbx
call fcn.1800169a0
mov r11, qword [rsi]
mov qword [rbx], r11
test r11, r11
je 0x1800721e7
lock add dword [r11 + 0x10], 1
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x180072237
or eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
add eax, 0xffffffff
jne 0x180072232
test rbx, rbx
je 0x18007222d
mov rcx, qword [rbx]
test rcx, rcx
je 0x180072211
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18007221f
call fcn.1800bd9a0
mov rcx, rbx
call fcn.1800bd964
nop
mov rax, rdi
jmp 0x18007223a
mov rax, rdi
jmp 0x18007223a
mov rax, rdi
jmp 0x18007223a
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x180072fe0
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x130
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x168], rbx
mov rax, qword [0x18013a210]
xor rax, rsp
mov qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
lea rcx, [rsp + 0x60]
mov rax, qword [str.Accept:___r_n_r_n]
mov qword [rcx], rax
mov rax, qword [0x1801072b8]
mov qword [rcx + 8], rax
mov rax, qword [0x1801072c0]
mov qword [rcx + 0x10], rax
mov rax, qword [0x1801072c8]
mov qword [rcx + 0x18], rax
cmp qword [rbx + 0x30], r12
je 0x1800731cd
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, eax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x4000000
lea r8, [rsp + 0x60]
mov rdx, rdi
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1800731c3
mov dword [rsp + 0x34], RegisterTypeLib
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x80]
lea edx, [r12 + 0x13]
mov rcx, rax
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x1800730ff
lea rcx, [rsp + 0x80]
call fcn.1800bf9c8
cmp eax, 0x194
jne 0x1800730ff
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x1800731d6
lea rdx, [0x1801072d0]
mov rcx, rsi
call fcn.1800bdbec
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x180073133
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x1800731d6
mov dword [rsp + 0x30], r12d
mov ecx, 0x19000
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rsi, rax
nop word [rax + rax]
xor edx, edx
mov r8d, 0x19000
mov rcx, rsi
call fcn.1800c1250
lea r9, [rsp + 0x30]
mov r8d, 0x18fff
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
mov r11d, dword [rsp + 0x30]
test r11d, r11d
je 0x18007319c
mov rdx, r11
mov r9, rbx
mov r8d, 1
mov rcx, rsi
call fcn.1800be1d4
cmp dword [rsp + 0x30], 0
jne 0x180073150
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test rbx, rbx
je 0x1800731ba
mov rcx, rbx
call fcn.1800be7c0
mov rcx, rbx
call fcn.1800bdc84
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov eax, 1
jmp 0x1800731d6
mov rcx, qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal]
xor rcx, rsp
call fcn.1800bd980
mov rbx, qword [rsp + 0x168]
add rsp, 0x130
pop r12
pop rdi
pop rsi
ret
Function at 0x180073a40
Capabilities:
Parse url

Disassembly:
push rbx
push rbp
push rsi
push r13
mov eax, 0x10a8
call fcn.1800db900
sub rsp, rax
mov rax, qword [0x18013a210]
xor rax, rsp
mov qword [rsp + 0x1080], rax
mov r13, r9
mov rbx, r8
mov rbp, rdx
mov rsi, rcx
test rcx, rcx
jne 0x180073a7d
xor eax, eax
jmp 0x180073bb0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x10a0], rdi
mov r9d, 0x2000000
mov qword [rsp + 0x1098], r12
mov dword [rsp + 0x20], 0x824
xor r12d, r12d
call qword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
test eax, eax
jne 0x180073b0f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x180073b08
mov edx, dword [rsp + 0x20]
mov rcx, 0xffffffffffffffff
mov eax, 2
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.1800bd95c
lea r8, [rsp + 0x20]
mov r9d, 0x2000000
mov rcx, rsi
mov rdx, rax
mov r12d, 1
mov rdi, rax
call qword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
test eax, eax
jne 0x180073b14
mov rcx, rdi
call fcn.1800bd9a0
xor eax, eax
jmp 0x180073ba0
lea rdi, [rsp + 0x30]
mov r9, rbp
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCrackUrlW]
mov esi, eax
test r12d, r12d
je 0x180073b34
mov rcx, rdi
call fcn.1800bd9a0
test esi, esi
je case.default.0x180073b5e
movzx eax, word [rbp + 0x24]
mov word [r13], ax
mov eax, dword [rbp + 0x14]
dec eax
cmp eax, 6
ja case.default.0x180073b5e
lea rdx, [0x180000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x73bd0]
add rcx, rdx
jmp rcx
mov dword [rbx], 1
jmp 0x180073b9e
mov dword [rbx], 2
jmp 0x180073b9e
mov dword [rbx], 3
jmp 0x180073b9e
mov dword [rbx], 0x100b
jmp 0x180073b9e
mov dword [rbx], 0x1001
jmp 0x180073b9e
mov dword [rbx], 0x1006
jmp 0x180073b9e
mov dword [rbx], 0x1002
jmp 0x180073b9e
mov dword [rbx], 0x1000
mov eax, esi
mov rdi, qword [rsp + 0x10a0]
mov r12, qword [rsp + 0x1098]
mov rcx, qword [rsp + 0x1080]
xor rcx, rsp
call fcn.1800bd980
add rsp, 0x10a8
pop r13
pop rsi
pop rbp
pop rbx
ret
Function at 0x180073f40
Capabilities:
Hash data with md5

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0xc0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x18013a210]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, r8
mov rbp, rdx
mov r12, rcx
mov qword [rsp + 0x30], r8
xor r13d, r13d
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x54], r13d
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x40], 0x67452301
mov dword [rsp + 0x44], 0xefcdab89
mov dword [rsp + 0x48], 0x98badcfe
mov dword [rsp + 0x4c], 0x10325476
cmp qword [r8 + 0x20], 0x10
jb 0x180073fc2
lea rsi, [r8 + 8]
mov r8, qword [rsi]
jmp 0x180073fc9
lea rsi, [r8 + 8]
mov r8, rsi
mov r9d, dword [rdi + 0x18]
lea rdx, [rsp + 0x40]
mov rcx, qword [rcx]
call fcn.18007f160
mov byte [rsp + 0xa0], 0
xor eax, eax
mov qword [rsp + 0xa1], rax
mov dword [rsp + 0xa9], eax
mov word [rsp + 0xad], ax
mov byte [rsp + 0xaf], al
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0xa0]
mov rcx, qword [r12]
call fcn.18007f270
lea r8, [rsp + 0xa0]
mov rdx, rbp
mov rcx, r12
call fcn.180074080
nop
cmp qword [rdi + 0x20], 0x10
jb 0x18007403b
mov rcx, qword [rsi]
call fcn.1800bd964
mov qword [rdi + 0x20], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rdi + 0x18], r13
mov byte [rsi], 0
mov rax, rbp
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1800bd980
lea r11, [rsp + 0xc0]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x180075b50
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
lea rax, vtable.SystemInfo.0
mov rbx, rcx
mov qword [rcx], rax
mov dword [rcx + 0x260], ebp
mov dword [rcx + 8], ebp
mov dword [rcx + 0xc], ebp
add rcx, 0x10
xor edx, edx
mov r8d, 0x100
mov edi, 1
call fcn.1800c1250
lea rcx, [rbx + 0x110]
xor edx, edx
mov r8d, reloc.OLEAUT32.dll_BSTR_UserUnmarshal
call fcn.1800c1250
lea rcx, [rbx + 0x110]
mov dword [rbx + 0x110], reloc.OLEAUT32.dll_BSTR_UserUnmarshal
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rbx + 0x260], eax
test eax, eax
jne 0x180075be6
lea rcx, [rbx + 0x110]
mov dword [rbx + 0x110], VarUI4FromDisp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
cmove edi, ebp
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbx + 0x230]
test rax, rax
je 0x180075c13
call rax
jmp 0x180075c19
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
test edi, edi
je 0x180075c32
mov rcx, rbx
call fcn.180075c90
mov rcx, rbx
call fcn.180076010
call fcn.180076100
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800761f0
Capabilities:
Get local ipv4 addresses

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x2a0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x18013a210]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rsi, rcx
mov qword [rsp + 0x68], rcx
xor r13d, r13d
mov dword [rsp + 0x54], r13d
mov dword [rsp + 0x50], r13d
mov qword [rcx + 0x20], 7
mov qword [rcx + 0x18], r13
mov word [rcx + 8], r13w
mov dword [rsp + 0x54], 1
mov ecx, VarDecFix
call fcn.1800bf7cc
mov rdi, rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9, rdi
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 2]
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x18007639a
mov rcx, rdi
call fcn.1800bf884
mov ecx, dword [rsp + 0x50]
call fcn.1800bf7cc
mov r12, rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9, r12
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 2]
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x180076398
mov rbx, r12
mov word [rsp + 0x80], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x82]
call fcn.1800c1250
test rbx, rbx
je 0x180076398
cmp dword [rbx + 0x68], 1
jne 0x18007638f
test byte [rbx + 0x64], 6
je 0x18007638f
mov word [rsp + 0x80], r13w
movzx eax, byte [rbx + 0x55]
movzx ecx, byte [rbx + 0x54]
movzx edx, byte [rbx + 0x53]
movzx edi, byte [rbx + 0x52]
movzx r8d, byte [rbx + 0x51]
movzx r9d, byte [rbx + 0x50]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r8d
lea r8, str._02X:_02X:_02X:_02X:_02X:_02X
mov edx, 0x104
lea rcx, [rsp + 0x80]
call fcn.1800bfb00
cmp qword [rsi + 0x18], 0
je 0x180076367
mov edx, 1
lea r8d, [rdx + 0x3a]
mov rcx, rsi
call fcn.180011b30
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.180010af0
mov rbx, qword [rbx + 8]
jmp 0x1800762e1
jmp 0x1800763be
mov dword [rsp + 0x58], 0xffffffff
lea rdx, [0x180136c18]
lea rcx, [rsp + 0x58]
call fcn.1800c1ef0
nop
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
test r12, r12
je 0x1800763cb
mov rcx, r12
call fcn.1800bf884
mov rax, rsi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1800bd980
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x180076ae0
Capabilities:
Delete registry value

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x460
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x498], rbx
mov rax, qword [0x18013a210]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, r8
mov r12, rdx
mov rdi, rcx
xor esi, esi
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x50], si
xor edx, edx
mov r8d, 0x3fe
lea rcx, [rsp + 0x52]
call fcn.1800c1250
cmp qword [r12 + 0x18], rsi
je 0x180076c20
cmp qword [rbx + 0x18], rsi
je 0x180076c20
cmp qword [rdi + 0x30], rsi
jne 0x180076b58
xor al, al
jmp 0x180076c22
cmp qword [rdi + 0x38], 8
jb 0x180076b65
mov r8, qword [rdi + 0x20]
jmp 0x180076b69
lea r8, [rdi + 0x20]
mov edx, 0x200
lea rcx, [rsp + 0x50]
call fcn.1800beefc
cmp qword [r12 + 0x20], 8
jb 0x180076b87
mov r8, qword [r12 + 8]
jmp 0x180076b8c
lea r8, [r12 + 8]
mov edx, 0x200
lea rcx, [rsp + 0x50]
call fcn.1800c0a54
lea r11, [rsp + 0x38]
mov qword [rsp + 0x20], r11
mov r9d, 0x20006
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x30], eax
test eax, eax
je 0x180076be1
mov dword [rsp + 0x40], 0xffffffff
lea rdx, [0x180136c18]
lea rcx, [rsp + 0x40]
call fcn.1800c1ef0
cmp qword [rbx + 0x20], 8
jb 0x180076bee
mov rdx, qword [rbx + 8]
jmp 0x180076bf2
lea rdx, [rbx + 8]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
mov dword [rsp + 0x30], eax
jmp 0x180076c09
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x180076c19
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete al
jmp 0x180076c22
xor al, al
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1800bd980
mov rbx, qword [rsp + 0x498]
add rsp, 0x460
pop r12
pop rdi
pop rsi
ret
Function at 0x18007bf20
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov edx, 0x80000000
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 3
mov qword [rsp + 0x78], rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
xor edx, edx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
lea ecx, [rbp + 2]
lea edx, [rax + 0x2000]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea r9, [rsp + 0x68]
mov r8d, esi
mov rcx, rdi
mov rdx, rax
mov dword [rsp + 0x68], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0x70]
lea edx, [rbp + 1]
mov rcx, rbx
mov qword [rsp + 0x70], rbp
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov rcx, qword [rsp + 0x70]
lea r11, [rsp + 0x78]
lea r9, [0x1800fac10]
xor r8d, r8d
mov edx, esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
test eax, eax
js 0x18007bff5
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x18007cd50
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
cmp qword [rcx + 0x20], 0x10
jb 0x18007cd76
mov rdi, qword [rcx + 8]
jmp 0x18007cd7a
lea rdi, [rcx + 8]
mov rsi, qword [rcx + 0x18]
test rdi, rdi
je 0x18007cdcc
test rsi, rsi
je 0x18007cdcc
cmp qword [rdx + 0x20], 8
jb 0x18007cd95
mov rcx, qword [rdx + 8]
jmp 0x18007cd99
lea rcx, [rdx + 8]
lea rdx, [0x1801072d0]
call fcn.1800bdbec
mov rbx, rax
mov r9, rax
mov r8d, 1
mov rdx, rsi
mov rcx, rdi
call fcn.1800be1d4
mov rcx, rbx
call fcn.1800bdc84
nop
mov eax, 1
jmp 0x18007cdd2
xor eax, eax
jmp 0x18007cdd2
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18007ce90
Capabilities:
Get file size
Read file on windows

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rsi
mov r12, rdx
mov rdi, rcx
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rdx], rax
cmp qword [rcx + 0x20], 8
jb 0x18007ced0
lea rbx, [rcx + 8]
mov rcx, qword [rbx]
jmp 0x18007ced7
lea rbx, [rcx + 8]
mov rcx, rbx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x18007cf0a
xor eax, eax
jmp 0x18007cfa7
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r13d, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13d, r13d
jne 0x18007cf2a
xor eax, eax
jmp 0x18007cfa7
cmp qword [rdi + 0x20], 8
jb 0x18007cf34
mov rbx, qword [rbx]
lea rdx, [0x180106660]
mov rcx, rbx
call fcn.1800bdbec
mov rsi, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x18007cfa7
lea eax, [r13 + 1]
mov ebx, eax
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.1800c1250
mov rdx, r13
mov qword [r12], rdx
mov r9, rsi
mov r8d, 1
mov rcx, rdi
call fcn.1800be018
mov rcx, rsi
call fcn.1800bdc84
nop
jmp 0x18007cfa4
mov rax, rdi
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r13
pop r12
pop rdi
ret
Function at 0x180081840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r12
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov rdi, r9
mov ebp, r8d
mov rbx, rdx
mov rsi, rcx
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r12d, eax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1800818cc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x1800818f7
mov r8d, r12d
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.18007fc10
nop
mov r8d, ebp
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.180081350
movzx ebx, al
lea rcx, [rsp + 0x28]
call fcn.18007fef0
mov al, bl
jmp 0x1800818f9
mov rax, qword [str.Unable_to_load_resource_]
mov qword [rsi + 0x58], rax
mov rax, qword [0x1800f20e8]
mov qword [rsi + 0x60], rax
mov rax, qword [0x1800f20f0]
mov qword [rsi + 0x68], rax
movzx eax, byte [0x1800f20f8]
mov byte [rsi + 0x70], al
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret