joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rax, qword [0x1801d7768]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov ebx, edx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x1f4
call fcn.1800d4040
movdqa xmm0, xmmword [str.redirectYesidx]
lea r9, [rsi + 0x428]
mov r8d, ebx
mov dword [rsp + 0x50], 0x2664253d
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x54], 0x3d6d756e
lea rcx, [rsp + 0x70]
mov word [rsp + 0x58], 0x7325
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x5a], 0
call fcn.180007ea0
xor edx, edx
lea rcx, [rbp + 0x170]
mov r8d, 0x1f4
call fcn.1800d4040
movdqa xmm0, xmmword [str.SESSIONID__d__d]
mov rbx, 0xffffffffffffffff
movdqu xmmword [rsp + 0x60], xmm0
mov rax, rbx
nop
inc rax
cmp word [rsi + rax*2 + 0x3c], 0
jne 0x180007b10
test rax, rax
je 0x180007b41
mov r8d, dword [rsi + 0x38]
test r8d, r8d
je 0x180007b41
mov r9d, 0x3157e
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x170]
call qword [sym.imp.USER32.dll_wsprintfA]
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x70]
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x180007b50
mov dword [rsp + 0x28], 0
lea r9, [rsp + 0x70]
lea r8, [rbp + 0x170]
mov dword [rsp + 0x20], ebx
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 8]
call fcn.180008740
test eax, eax
je 0x180007c50
cmp qword [rsp + 0x30], 0
je 0x180007c50
mov edx, 0x20000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea rdx, [rsp + 0x30]
mov rbx, rax
lea rcx, [rsi + 8]
test rax, rax
je 0x180007bea
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 0
mov r9d, 0x20000
mov qword [rsp + 0x20], rax
mov r8, rbx
call fcn.180008a60
test eax, eax
jne 0x180007bf1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 8]
call fcn.180008380
jmp 0x180007c50
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 8]
call fcn.180008380
cmp dword [rsp + 0x38], 0x12
jb 0x180007c47
movabs rax, 0x69746164696c6156
cmp qword [rbx], rax
jne 0x180007c47
movabs rax, 0x6563637553206e6f
cmp qword [rbx + 8], rax
jne 0x180007c47
cmp word [rbx + 0x10], 0x7373
jne 0x180007c47
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 1
mov dword [rsi + 0x424], 1
jmp 0x180007c52
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.1800d1ba0
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x480
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800083c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
add rcx, 8
jmp 0x1800083c0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
xor esi, esi
nop dword [rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1800083f8
call qword [sym.imp.WININET.dll_InternetCloseHandle]
cmp eax, 1
jne 0x18000840c
mov qword [rbx + 0x10], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18000842c
call qword [sym.imp.WININET.dll_InternetCloseHandle]
cmp eax, 1
je 0x180008428
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0xea60
ja 0x18000842c
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800083e0
mov qword [rbx + 8], rsi
mov dword [rbx + 0x28], esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180008a60
Capabilities:
Check http status code
Query remote server for available data
Read data from internet
Receive data

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x1801d7768]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r14, qword [rsp + 0x2a0]
mov rdi, rdx
mov esi, r9d
mov rbp, r8
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], ebx
mov rcx, qword [rdi]
xor edx, edx
mov dword [rsp + 0x34], ebx
call qword [sym.imp.WININET.dll_HttpEndRequestW]
test eax, eax
je 0x180008b01
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x200
call fcn.1800d4040
mov rcx, qword [rdi]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x38], 0x200
lea edx, [rbx + 0x13]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x180008b01
lea rcx, [rsp + 0x40]
call fcn.1800daac4
cmp eax, 0xc8
je 0x180008b21
mov dword [r14], 0xffffffff
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1800d1ba0
add rsp, 0x250
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [rdi]
lea rdx, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.WININET.dll_InternetQueryDataAvailable]
cmp eax, 1
jne 0x180008b8c
nop word [rax + rax]
mov r8d, dword [rsp + 0x34]
test r8d, r8d
je 0x180008b8c
mov eax, esi
sub eax, ebx
cmp r8d, eax
ja 0x180008b01
mov rcx, qword [rdi]
lea r9, [rsp + 0x30]
mov edx, ebx
add rdx, rbp
mov dword [rsp + 0x30], r8d
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x180008b01
mov rcx, qword [rdi]
lea rdx, [rsp + 0x34]
add ebx, dword [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.WININET.dll_InternetQueryDataAvailable]
cmp eax, 1
je 0x180008b40
mov r8d, 0x10
mov dword [r14], ebx
lea rdx, str.Validation_Error
mov rcx, rbp
call fcn.1800da020
test eax, eax
je 0x180008b01
mov eax, 1
jmp 0x180008b03

Function at 0x1800576e0
Capabilities:
Read file on windows

Disassembly:
mov r9, qword [rcx + 8]
mov rax, rdx
test r9, r9
je 0x1800576f9
mov edx, 1
mov rcx, rax
jmp fcn.1800dcff0
xor eax, eax
ret

Function at 0x180060770
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor edi, edi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 0xf
mov byte [rcx], dil
mov qword [rcx + 0x20], rdi
mov qword [rcx + 0x28], rdi
lea ecx, [rdi + 0x18]
call fcn.1800d16c8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x40], rdi
mov qword [rbx + 0x48], 0xf
mov byte [rbx + 0x30], dil
mov byte [rbx + 0xb8], dil
mov qword [rbx + 0x60], rdi
mov dword [rbx + 0x50], 0x67452301
mov dword [rbx + 0x54], 0xefcdab89
mov dword [rbx + 0x58], 0x98badcfe
mov dword [rbx + 0x5c], 0x10325476
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180061b20
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
xor ebx, ebx
mov r10, r8
mov eax, ebx
mov r11, rdx
mov r9, rcx
nop dword [rax]
nop word [rax + rax]
mov byte [rcx], al
lea rcx, [rcx + 1]
inc eax
cmp eax, 0x100
jl 0x180061b40
mov qword [r9 + 0x100], rbx
nop word [rax + rax]
movsxd rax, dword [r9 + 0x100]
xor edx, edx
movzx ecx, byte [rax + r9]
lea r8, [rax + r9]
div r10
movzx eax, byte [rdx + r11]
add eax, ecx
add eax, dword [r9 + 0x104]
and eax, 0x800000ff
jge 0x180061b93
dec eax
or eax, 0xffffff00
inc eax
mov dword [r9 + 0x104], eax
movzx edx, byte [r8]
movsxd rcx, eax
movzx eax, byte [rcx + r9]
mov byte [r8], al
mov byte [rcx + r9], dl
inc dword [r9 + 0x100]
cmp dword [r9 + 0x100], 0x100
jl 0x180061b60
mov qword [r9 + 0x100], rbx
mov rbx, qword [rsp + 8]
ret

Function at 0x180067c00
Capabilities:
Write file on windows

Disassembly:
mov r9, qword [rcx + 8]
mov rax, rdx
test r9, r9
je 0x180067c19
mov edx, 1
mov rcx, rax
jmp fcn.1800dddec
xor eax, eax
ret

Function at 0x180098420
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov r9, qword [rcx + 0xb60]
lea r8, [0x180005140]
xor eax, eax
mov rbx, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rbx + 0x590]
call sym.PDFWriter.dll_public_virtual:_void___cdecl_PDFParser::destructor_void____ptr64
lea rcx, [rbx + 0x560]
call sym.PDFWriter.dll_public:_void___cdecl_InputFile::destructor_void____ptr64
lea rcx, [rbx + 0x530]
call sym.PDFWriter.dll_public:_void___cdecl_OutputFile::destructor_void____ptr64
lea rcx, [rbx + 0x70]
call sym.PDFWriter.dll_public:_void___cdecl_PDFHummus::DocumentContext::destructor_void____ptr64
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp sym.PDFWriter.dll_public:_void___cdecl_ObjectsContext::destructor_void____ptr64
Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
scasb al, byte [rdi]
sar bh, 1
cmpsd dword [esi], dword [edi]
leave
jmp qword [rax - 0x62]
xchg ebp, eax
inc dword [rdx + rdi*2 - 0x6a]
inc dword [rdx + rdi*2 - 0x6a]
inc dword [rdx + rdi*2 - 0x6a]
inc dword [rdx + rdi*2 - 0x6a]
inc dword [rdx + rdi*2 - 0x6a]
inc dword [rdx + rdi*2 - 0x6a]
xchg esi, eax
xchg esi, eax
inc dword [rdx + rdi*2 - 0x6a]
inc dword [rbp + 0x7b]
xchg edi, eax
call [rdx - 0x6a]
mov dh, 0xff
jae 0x14003f65d
invalid
cmc
inc dword [rbp - 0x7a000a32]
invalid
test esi, ecx
cmc
inc dword [rbp - 0x7a000a32]
invalid
test esi, ecx
cmc
inc dword [rbp - 0x7a000a32]
invalid
cmc
inc dword [rbp - 0x7a000a32]
invalid
cmc
inc dword [rbp - 0x7a000a32]
invalid
cmc
inc dword [rbp - 0x7a000a32]
invalid
test esi, ecx
cmc
inc dword [rsi + 0x77fff7d0]
mov ebx, 0x985bffe0
loopne 0x14003f713
pop rbx
cwde
pop rbx
cwde
mov eax, 0x977b45ff
inc dword [rdx + rdi*2 - 0x6a]
inc dword [rdx + rdi*2 - 0x6a]
inc dword [rdx + rdi*2 - 0x6a]
inc dword [rdx + rdi*2 - 0x6a]
inc dword [rdx + rdi*2 - 0x6a]
inc dword [rdx + rdi*2 - 0x6a]
inc dword [rdx + rdi*2 - 0x6a]
xchg edx, eax
jnp 0x14003f6d0
sbb dword [rbx + rdi*2 - 0x6b], eax
add dword [rbx + rdi*2 - 0x6b], eax
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rsp + rax*4 - 0x46], ah
add byte [rcx + 0x78], al
xchg edx, eax
add byte [rcx + rdi*2 - 0x6b], al
jns case.0x140007272.7
mov dword [rdx + rdi*2 - 0x6a], 0x967a44fb
inc dword [rdx + rdi*2 - 0x6a]
inc dword [rdx + rdi*2 - 0x6a]
inc dword [rdx + rdi*2 - 0x6a]
inc dword [rdx + rdi*2 - 0x6a]
inc dword [rdi + 0x7d]
invalid
Function at 0x1800045e0
Capabilities:
Check if file exists

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0x90
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x180036b70]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rdx
mov rbx, rcx
mov qword [r11 - 0x60], rcx
mov qword [r11 - 0x50], rdx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rbp
mov word [rcx], bp
or rdi, 0xffffffffffffffff
mov r9, rdi
xor r8d, r8d
call fcn.180003450
mov dword [rsp + 0x20], 1
cmp qword [rbx + 0x18], 8
jb 0x180004651
mov rcx, qword [rbx]
jmp 0x180004654
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180004729
cmp qword [rbx + 0x18], 8
jb 0x18000466e
mov rcx, qword [rbx]
jmp 0x180004671
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rbp
mov word [rsp + 0x60], bp
cmp word [rax], 0
jne 0x180004695
mov rdi, rbp
jmp 0x18000469f
inc rdi
cmp word [rax + rdi*2], 0
jne 0x180004695
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1800035a0
nop
mov r9, qword [rsp + 0x70]
test r9, r9
je 0x180004716
dec r9
mov r8d, 1
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x60]
call fcn.180006750
mov rdi, rax
cmp rbx, rax
je 0x180004703
cmp qword [rbx + 0x18], 8
jb 0x1800046e9
mov rcx, qword [rbx]
call fcn.180013808
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rbp
mov word [rbx], bp
mov rdx, rdi
mov rcx, rbx
call fcn.180003110
cmp qword [rsp + 0x40], 8
jb 0x180004716
mov rcx, qword [rsp + 0x28]
call fcn.180013808
nop
cmp qword [rsp + 0x78], 8
jb 0x1800047a6
mov rcx, qword [rsp + 0x60]
jmp 0x1800047a0
mov r9d, 1
mov r8, rdi
lea rdx, [0x180025b94]
mov rcx, rbx
call fcn.1800063f0
cmp rax, 0xffffffffffffffff
je 0x1800047a6
mov r9, qword [rbx + 0x10]
sub r9, rax
dec r9
lea r8, [rax + 1]
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.180006750
mov rdi, rax
cmp rbx, rax
je 0x180004793
cmp qword [rbx + 0x18], 8
jb 0x180004779
mov rcx, qword [rbx]
call fcn.180013808
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rbp
mov word [rbx], bp
mov rdx, rdi
mov rcx, rbx
call fcn.180003110
cmp qword [rsp + 0x40], 8
jb 0x1800047a6
mov rcx, qword [rsp + 0x28]
call fcn.180013808
nop
cmp qword [rsi + 0x18], 8
jb 0x1800047b5
mov rcx, qword [rsi]
call fcn.180013808
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbp
mov word [rsi], bp
mov rax, rbx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180014660
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800048c0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x80
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov rax, qword [0x180036b70]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rdx
mov rsi, rcx
lea rdx, [0x180025b08]
lea rcx, [0x180025b18]
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbp, rax
xor ebx, ebx
test rax, rax
je 0x180004a20
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
cmp word [rdi], bx
je 0x18000493e
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x180004934
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.1800035a0
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1800049bd
lea rax, [rsp + 0x50]
mov r10, qword [rsp + 0x50]
mov r11, qword [rsp + 0x68]
cmp r11, 8
cmovae rax, r10
lea r9, [rax + rcx*2]
lea r8, [rsp + 0x50]
cmovae r8, r10
cmp r8, r9
jae 0x1800049bd
mov ecx, 1
lea rax, [0x180025b3c]
movzx edx, word [r8]
cmp word [rax], dx
je 0x1800049a2
add rax, 2
dec rcx
je 0x1800049a8
jmp 0x180004992
add r8, 2
jmp 0x18000497d
lea rax, [rsp + 0x50]
cmp r11, 8
cmovae rax, r10
sub r8, rax
sar r8, 1
jmp 0x1800049c1
or r8, 0xffffffffffffffff
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1800036f0
mov eax, dword [rsp + 0x60]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rax, qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x38]
mov edx, 0x4a
lea r8d, [rdx - 0x45]
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
cmp qword [rsp + 0x68], 8
jb 0x180004a48
mov rcx, qword [rsp + 0x50]
call fcn.180013808
jmp 0x180004a48
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rbx
mov r9, rdi
mov r8, rsi
lea rdx, [0x180025b40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
setg bl
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180014660
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x180008090
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x1800080be
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180008d60
cmp byte [0x180038d80], 0
jne 0x180008109
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800080f9
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x180038d80], 1
mov qword [0x180038d78], rax
jmp 0x180008110
mov rax, qword [0x180038d78]
mov byte [0x180038d80], 1
jmp 0x180008110
mov rax, qword [0x180038d78]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x18000812f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x180008dd4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180008df6
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180008df6
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je 0x180008df6
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x180008ac0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x180036b70]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor eax, eax
xor ebp, ebp
mov rsi, rdx
mov r8, rdx
mov rdx, qword [rcx]
mov rdi, rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x40]
or r9d, 0x2001f
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x50], rbp
call fcn.180008620
mov ebx, eax
test eax, eax
jne 0x180008be7
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x58], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180008bc1
nop dword [rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.180008ac0
mov ebx, eax
test eax, eax
jne 0x180008be7
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x58], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x180008b70
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180008bd6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x48], ebp
call fcn.180008090
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180008bf7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180014660
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x180008d60
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x1800080be
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180008d60
cmp byte [0x180038d80], 0
jne 0x180008109
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800080f9
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x180038d80], 1
mov qword [0x180038d78], rax
jmp 0x180008110
mov rax, qword [0x180038d78]
mov byte [0x180038d80], 1
jmp 0x180008110
mov rax, qword [0x180038d78]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x18000812f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x180008dd4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180008df6
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180008df6
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je 0x180008df6
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x180008ff0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x180036b70]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x50], r14
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], r14
xor edx, edx
mov r8d, 0x408
lea rcx, [rsp + 0x70]
call fcn.180014690
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x18000909c
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x18000909c
call fcn.180007370
mov ebx, eax
jmp 0x1800091c4
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x1800090bd
call fcn.180007370
jmp 0x1800091b3
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1800090e0
call fcn.180007370
jmp 0x1800091b3
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x180009102
mov ebx, 0x8007000e
jmp 0x1800091b5
mov ecx, eax
test eax, eax
je 0x18000913a
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x180009130
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x18000913a
lea rcx, [rsp + 0x70]
call fcn.1800070f0
jmp 0x180009144
mov ecx, 0x80070216
call fcn.180007d00
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x180009157
cmp qword [rsp + 0x70], 0
jne 0x180009166
mov ebx, 0x8007000e
jmp 0x1800091b5
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x180009190
call fcn.180007370
jmp 0x1800091b3
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.180008e10
mov ebx, eax
test rdi, rdi
je 0x1800091c4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x1800091db
lea rcx, [rsp + 0x70]
call fcn.1800083c0
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.180014660
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret