joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180013bdc
Capabilities:
Delete registry key

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
and qword [rsp + 0x60], 0
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.1800074fc
cmp qword [rsp + 0x60], 0
jne 0x180013c11
lea rcx, [rsp + 0x60]
call fcn.1800088c8
nop
lea rax, [rsp + 0x78]
mov qword [rsp + 0x68], rax
lea rdx, str.OutlookMC.COMAddin
lea rcx, [rsp + 0x78]
call fcn.180004fdc
mov rbx, rax
lea rcx, [rsp + 0x60]
call fcn.180008cc0
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.180004fdc
nop
mov dword [rsp + 0x20], 0xa
mov r9d, 5
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.180012dc0
nop
lea rcx, [0x180057958]
mov rax, qword [0x180057958]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov r8, qword [rsp + 0x70]
lea rdx, str.SoftwareMicrosoftOfficeOutlookAddins_s
lea rcx, [rsp + 0x68]
call fcn.18000e784
mov rbx, qword [rsp + 0x68]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov ecx, ebx
lock xadd dword [rdx + 0x10], ecx
add ecx, ebx
test ecx, ecx
jg 0x180013ccc
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x180013cec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180013cfc
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x18001c834
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x180057b40]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.180026db0
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x180000000]
mov esi, SysAllocStringByteLen
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.180026db0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x18001c8c7
cmp dword [rsp + 0x24], 5
jb 0x18001c8e1
jmp 0x18001c8dd
cmp dword [rsp + 0x30], esi
jne 0x18001c8e1
cmp dword [rsp + 0x24], 4
ja 0x18001c8dd
jne 0x18001c8e1
cmp dword [rsp + 0x28], 0
jbe 0x18001c8e1
mov byte [rbx + 0x18], sil
lea rax, [0x180044180]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.1800072fc
movzx ecx, byte [0x1800594c0]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x1800594c0], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180026cf0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18001d190
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor esi, esi
test rcx, rcx
mov rax, rdx
mov rdi, rcx
je 0x18001d1b3
test rdx, rdx
mov ebx, esi
jne 0x18001d1b8
mov ebx, 0x80070057
test ebx, ebx
mov qword [rsp + 0x60], rsi
js 0x18001d26b
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x18001d209
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18001d209
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x18001d25b
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
mov ebx, eax
js 0x18001d25b
mov r8d, dword [rdi + 0x18]
mov rdx, qword [rsp + 0x60]
lea r9, [rsp + 0x50]
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18001d25b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18001d25b
movzx ebx, ax
or ebx, 0x80070000
cmp qword [rsp + 0x60], rsi
je 0x18001d26b
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x18001d280
Capabilities:
Check mutex on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x120
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x180057b40]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rsi, rdx
test rdx, rdx
je 0x18001d2c6
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
jmp 0x18001d2c8
xor ebp, ebp
lea r12d, [rbp + rbp]
xor edi, edi
lea ebx, [r12 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x18001d42e
mov r8d, r12d
mov rdx, rsi
mov rcx, rax
call fcn.180028480
movsxd r11, ebp
mov word [rbx + r11*2], di
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharLowerW]
lea rcx, [rsp + 0x30]
call fcn.180021c50
nop
lea rcx, [rsp + 0x30]
call fcn.180020750
mov r8d, r12d
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.180021ca0
lea rcx, [rsp + 0x30]
call fcn.180021d20
lea rcx, [rsp + 0x30]
call fcn.1800207c0
mov rsi, rax
test rax, rax
je 0x18001d40a
cmp byte [rax], dil
je 0x18001d40a
movabs rax, 0x5c6c61626f6c47
mov qword [rsp + 0xe0], rax
xor eax, eax
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rax
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8d, 0x30
sub r8d, eax
cdqe
lea rcx, [rsp + rax + 0xe0]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
mov byte [rsp + 0x10f], dil
lea r8, [rsp + 0xe0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rdi, rax
test rax, rax
je 0x18001d40a
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x18001d40a
cmp eax, 0x80
je 0x18001d40a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
lea rcx, [rsp + 0x30]
call fcn.180020740
mov rax, rdi
jmp 0x18001d431
mov rax, rdi
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.180026cf0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x18001d7e0
Capabilities:
Get user security identifier

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0xb0
mov rax, qword [0x180057b40]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, qword [rcx + 8]
xor eax, eax
mov byte [rsp + 0x50], 0
xor r13d, r13d
test rbx, rbx
mov rdi, rcx
mov qword [r11 - 0x77], rax
mov qword [r11 - 0x6f], rax
mov qword [r11 - 0x67], rax
mov qword [r11 - 0x5f], rax
mov qword [r11 - 0x57], rax
mov qword [r11 - 0x4f], rax
mov qword [r11 - 0x47], rax
mov qword [r11 - 0x3f], rax
mov word [r11 - 0x37], ax
mov byte [r11 - 0x35], al
mov dword [rsp + 0x44], 0x44
mov dword [rsp + 0x40], r13d
je 0x18001d871
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi + 8], r13
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x18001d884
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rdi + 0x10], r13
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x18001d897
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x18], r13
mov esi, 2
nop
mov rdx, qword [rdi]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rax, qword [rdi + 8]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ecx, dword [rsp + 0x40]
test ecx, ecx
mov r12d, eax
je 0x18001d904
cmp qword [rdi + 8], r13
jne 0x18001d904
mov rbx, rcx
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 8], rax
sub rsi, 1
jne 0x18001d8a0
test r12d, r12d
je 0x18001d999
lea rdx, [rdi + 0x10]
lea rcx, [rsp + 0x50]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x18001d933
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x18001d999
mov rbx, qword [rdi]
test rbx, rbx
je 0x18001d952
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi], r13
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x18001d973
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi + 8], r13
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x18001d986
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rdi + 0x10], r13
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x18001d999
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x18], r13
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180026cf0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x18001dc70
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
test r9b, r9b
mov rbp, rdx
lea rsi, [rcx + 0x6a6]
jne 0x18001dc9a
lea rsi, [rcx + 0x8c]
mov edi, r8d
add rdi, rdi
mov r8, rdi
xor edx, edx
mov rcx, rbp
call fcn.180026db0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r11d, eax
call fcn.18001d070
mov ecx, 1
lock xadd dword [0x180059d50], ecx
add ecx, 1
mov qword [rsp + 0x30], rax
lea rdx, str._s_u__u__u_s
mov dword [rsp + 0x28], ecx
mov r9d, ebx
mov r8, rsi
mov rcx, rbp
mov dword [rsp + 0x20], r11d
call fcn.1800287c0
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18001dca0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1800205b0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rdi, rcx
mov esi, dword [rcx]
add esi, esi
cmp qword [rcx + 0x10], 0
jne 0x1800205f7
test esi, esi
je 0x1800205f7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, esi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0x10], rax
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x18002066d
mov word [rax], 0
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x180020669
lea rcx, [rdi + 0x18]
call fcn.180020300
nop
mov r8, rsi
mov rdx, rbx
mov rcx, qword [rdi + 0x10]
call fcn.180028480
nop
jmp 0x180020651
lea rcx, [rdi + 0x18]
call fcn.180020360
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rax, qword [rdi + 0x10]
jmp 0x18002066d
mov rax, qword [rdi + 0x10]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180020750
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0xc3d2e1f0
mov dword [rcx + 0x1c], eax
mov dword [rcx + 0x20], eax
mov word [rcx + 0x24], ax
mov qword [rcx + 0x68], rax
mov qword [rcx + 0x70], rax
mov dword [rcx + 0x78], eax
mov qword [rcx + 0x7c], rax
mov qword [rcx + 0x84], rax
mov qword [rcx + 0x8c], rax
mov qword [rcx + 0x94], rax
mov qword [rcx + 0x9c], rax
mov byte [rcx + 0xa4], al
ret

Function at 0x180020dc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
movzx eax, word [rcx + 0x24]
mov rbx, rcx
cmp ax, 0x37
movzx eax, ax
mov byte [rax + rcx + 0x26], 0x80
jbe 0x180020e37
add word [rcx + 0x24], 1
movzx eax, word [rcx + 0x24]
cmp ax, 0x40
jae 0x180020e07
nop
nop
movzx eax, ax
mov byte [rax + rcx + 0x26], 0
add word [rcx + 0x24], 1
mov ax, word [rcx + 0x24]
cmp ax, 0x40
jb 0x180020df0
call fcn.1800208b0
cmp word [rbx + 0x24], 0x38
jae 0x180020e67
nop
nop
nop
nop
movzx eax, word [rbx + 0x24]
mov byte [rax + rbx + 0x26], 0
add word [rbx + 0x24], 1
cmp word [rbx + 0x24], 0x38
jb 0x180020e20
jmp 0x180020e67
add word [rcx + 0x24], 1
movzx eax, word [rcx + 0x24]
cmp ax, 0x38
jae 0x180020e67
nop
nop
nop
movzx eax, ax
mov byte [rax + rcx + 0x26], 0
add word [rcx + 0x24], 1
mov ax, word [rcx + 0x24]
cmp ax, 0x38
jb 0x180020e50
mov ecx, dword [rbx + 0x20]
mov eax, ecx
shr eax, 0x18
mov byte [rbx + 0x5e], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rbx + 0x60], cl
mov ecx, dword [rbx + 0x1c]
mov byte [rbx + 0x5f], al
movzx eax, byte [rbx + 0x20]
mov byte [rbx + 0x61], al
mov eax, ecx
shr eax, 0x18
mov byte [rbx + 0x62], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rbx + 0x64], cl
mov rcx, rbx
mov byte [rbx + 0x63], al
movzx eax, byte [rbx + 0x1c]
mov byte [rbx + 0x65], al
add rsp, 0x20
pop rbx
jmp fcn.1800208b0
Function at 0x180020ed0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
test rdx, rdx
mov r13d, r9d
mov r15, r8
mov r12, rdx
je 0x180020ef9
test r8, r8
je 0x180020ef9
xor edi, edi
jmp 0x180020efe
mov edi, 0x80070057
lea eax, [r9 + 8]
mov r14d, 0x10000
cmp eax, r14d
cmovb r14d, eax
test edi, edi
js 0x18002107d
cmp qword [rcx + 8], 0
jne 0x180020f31
mov eax, 0x80070005
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x48], rbp
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, r14d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbp, rax
jne 0x180020f64
mov edi, 0x8007000e
jmp 0x180021047
mov qword [rsp + 0x40], rsi
xor esi, esi
nop
nop
cmp esi, r13d
jae 0x180021042
mov eax, r13d
lea ebx, [r14 - 8]
mov edx, esi
sub eax, esi
mov rcx, rbp
cmp eax, ebx
cmovb ebx, eax
add rdx, r15
mov r8d, ebx
mov dword [rsp + 0x98], ebx
call fcn.180028480
xor r8d, r8d
lea rax, [rsp + 0x98]
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax + 8]
add ebx, esi
mov qword [rsp + 0x20], rbp
cmp ebx, r13d
sete r8b
xor r9d, r9d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x180020ff3
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov edi, eax
jle 0x180021033
movzx edi, ax
or edi, 0x80070000
jmp 0x180021033
mov rax, qword [r12]
mov r8d, dword [rsp + 0x98]
lea r9, [rsp + 0x88]
mov rdx, rbp
mov rcx, r12
mov dword [rsp + 0x88], 0
call qword [rax + 0x20]
test eax, eax
mov edi, eax
js 0x180021042
mov ecx, dword [rsp + 0x98]
cmp dword [rsp + 0x88], ecx
jne 0x18002103d
mov esi, ebx
test edi, edi
jns 0x180020f70
jmp 0x180021042
mov edi, 0x8000ffff
mov rsi, qword [rsp + 0x40]
test rbp, rbp
mov rbx, qword [rsp + 0x90]
je 0x180021068
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, edi
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800213c0
Capabilities:
Encrypt data using des via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
xor r12d, r12d
mov ebx, 0x80070005
mov rbp, rdx
cmp qword [rcx], r12
mov rdi, rcx
mov qword [rsp + 0x60], r12
cmovne ebx, r12d
test ebx, ebx
js 0x1800213fb
mov eax, 0x80070057
test rdx, rdx
cmove ebx, eax
lea rsi, [rcx + 8]
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x180021411
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rsi], r12
test ebx, ebx
js 0x180021506
mov rcx, qword [rdi]
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x180021450
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x180021450
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x180021506
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
lea rdx, [rsp + 0x50]
lea r8d, [r9 + 4]
mov dword [rsp + 0x50], 0x420042
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x180021490
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x180021490
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x180021506
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
lea r8d, [rax + rax]
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1800214cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x1800214cb
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x180021506
mov r8, qword [rsp + 0x60]
mov rcx, qword [rdi]
mov r9d, 0xc00000
mov edx, 0x6603
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x180021506
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x180021506
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180021516
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x180021db0
Capabilities:
Delete file

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov r13d, r9d
mov rbp, r8
mov rdi, rdx
mov r12, rcx
test rdx, rdx
je 0x180021dec
test r8, r8
je 0x180021dec
xor ebx, ebx
jmp 0x180021df1
mov ebx, 0x80070057
xor ecx, ecx
mov qword [rsp + 0x58], rcx
xor sil, sil
test ebx, ebx
js 0x180021e74
cmp qword [r12 + 8], 0
jne 0x180021e0e
mov ebx, 0x80070005
jmp 0x180021e74
lea r8, [rsp + 0x58]
mov edx, 0x1011
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_SHCreateStreamOnFileW]
mov ebx, eax
test eax, eax
js 0x180021e3f
mov sil, 1
mov r9d, r13d
mov r8, rbp
mov rdx, qword [rsp + 0x58]
mov rcx, r12
call fcn.180020ed0
mov ebx, eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180021e5d
mov qword [rsp + 0x58], 0
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rsp + 0x58]
test ebx, ebx
jns 0x180021e74
test sil, sil
je 0x180021e74
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180021e83
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov eax, ebx
jmp 0x180021e85
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x180021fc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x270
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x180057b40]
xor rax, rsp
mov qword [rsp + 0x260], rax
movzx ebx, r9b
mov rsi, rdx
mov r12, rcx
mov qword [rsp + 0x40], rcx
mov dword [rcx], r8d
xor r14d, r14d
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
add rcx, 0x18
call fcn.180021530
nop
test rsi, rsi
je 0x180022206
cmp word [rsi], r14w
je 0x180022206
test bl, bl
je 0x18002207d
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.180010414
lea rdx, [0x180041500]
mov rbx, qword [rsp + 0x38]
test rbx, rbx
cmovne rdx, rbx
mov rcx, r12
call fcn.180021920
test rbx, rbx
je 0x180022206
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180022206
mov word [rsp + 0x50], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x52]
call fcn.180026db0
mov rdi, r14
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180022128
mov rdi, qword [rsp + 0x38]
mov dword [rsp + 0x30], 0x206
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.ProductId
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180022128
mov eax, dword [rsp + 0x40]
cmp eax, 1
je 0x180022114
cmp eax, 2
jne 0x180022128
movzx eax, word [rsp + 0x50]
cmp dword [rsp + 0x30], 0
cmove ax, r14w
mov word [rsp + 0x50], ax
mov rbx, r14
mov ebp, r14d
cmp word [rsi], bx
je 0x1800221cf
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r13d, eax
lea ebx, [r13 + r13 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1800221cf
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r11d, eax
mov rcx, r14
test r13d, r13d
je 0x1800221c3
mov r9, rbx
sub r9, rsi
mov r8, r13
cmp ebp, r11d
jb 0x18002218e
mov ebp, r14d
mov rcx, r14
movzx eax, word [rsi]
movzx edx, word [rsp + rcx*2 + 0x50]
cmp ax, dx
je 0x18002219e
xor ax, dx
test ax, ax
je 0x1800221a9
cmp ax, 0x5c
jne 0x1800221ad
mov ax, 0x2a
mov word [r9 + rsi], ax
add ebp, 1
add rcx, 1
add rsi, 2
sub r8, 1
jne 0x180022183
mov word [rbx + r13*2], 0
mov rdx, rbx
jmp 0x1800221d6
lea rdx, [0x180041500]
mov rcx, r12
call fcn.180021920
test rbx, rbx
je 0x1800221f7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rdi, rdi
je 0x180022206
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, r12
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180026cf0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret