joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180020010
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x50
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [0x1800cfca0]
lea rcx, [rsp + 0x20]
mov r8d, eax
call fcn.180053a60
cmp qword [rax + 0x20], 8
jb 0x18002003d
mov r8, qword [rax + 8]
jmp 0x180020041
lea r8, [rax + 8]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_volatilecryptoMode_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp qword [rsp + 0x40], 8
jb 0x180020067
mov rcx, qword [rsp + 0x28]
call fcn.18009a864
xor ebx, ebx
cmp dword [0x18010b59c], ebx
je 0x1800200b7
lea rdx, str.SecureWindowFini
lea rcx, str.athenwDbg
call fcn.18005c640
mov rcx, qword [0x18010b5a0]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, qword [0x18010b5a0]
call qword [sym.imp.USER32.dll_UpdateWindow]
lea rdx, str.SecureWindowFini_window_destroy
lea rcx, str.athenwDbg
call fcn.18005c640
mov dword [0x18010b59c], ebx
call fcn.1800a5780
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.1800a6230
call fcn.18003b270
call fcn.18004e7e0
call fcn.180043a60
call fcn.180024da0
cmp dword [0x18010b1d0], ebx
je 0x1800200f9
lea rdx, [0x18001d780]
lea rcx, [0x18010b1c8]
call fcn.1800a7660
mov dword [0x18010b1d0], ebx
cmp dword [0x18010b1d4], ebx
je 0x18002011a
lea rdx, [0x18001f1d0]
lea rcx, [0x18010b1d8]
call fcn.1800a7660
mov dword [0x18010b1d4], ebx
cmp dword [0x18010b1bc], ebx
je 0x18002013b
lea rdx, [0x18001d690]
lea rcx, [0x18010b1c0]
call fcn.1800a7660
mov dword [0x18010b1bc], ebx
cmp dword [0x18010b18c], ebx
je 0x18002015c
lea rdx, [0x18001d200]
lea rcx, [0x18010b190]
call fcn.1800a7660
mov dword [0x18010b18c], ebx
cmp dword [0x18010b1a0], ebx
je 0x18002017d
lea rdx, [0x18001d580]
lea rcx, [0x18010b198]
call fcn.1800a7660
mov dword [0x18010b1a0], ebx
cmp dword [0x18010b1a4], ebx
je 0x18002019e
lea rdx, [0x18001d4d0]
lea rcx, [0x18010b1a8]
call fcn.1800a7660
mov dword [0x18010b1a4], ebx
cmp dword [0x18010b1b8], ebx
je 0x1800201bf
lea rdx, [0x18001d420]
lea rcx, [0x18010b1b0]
call fcn.1800a7660
mov dword [0x18010b1b8], ebx
cmp dword [0x18010b188], ebx
je 0x1800201e0
lea rdx, [0x18001cb70]
lea rcx, [0x18010b180]
call fcn.1800a7660
mov dword [0x18010b188], ebx
cmp dword [0x18010b1e8], ebx
je 0x180020201
lea rdx, [0x18001d870]
lea rcx, [0x18010b1e0]
call fcn.1800a7660
mov dword [0x18010b1e8], ebx
call fcn.1800170d0
cmp dword [0x18010b304], ebx
je 0x180020227
lea rdx, [0x180044240]
lea rcx, [0x18010b308]
call fcn.1800a7660
mov dword [0x18010b304], ebx
cmp dword [0x18010b318], ebx
je 0x180020248
lea rdx, [0x180044440]
lea rcx, [0x18010b310]
call fcn.1800a7660
mov dword [0x18010b318], ebx
add rsp, 0x50
pop rbx
jmp fcn.1800a5a50
Function at 0x180023940
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x48]
lea r8, [0x1800cf9d0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor ecx, ecx
test eax, eax
jne 0x180023991
cmp dword [rsp + 0x48], 4
mov eax, dword [rsp + 0x50]
je 0x180023993
mov eax, ecx
test eax, eax
setne al
add rsp, 0x38
ret

Function at 0x180024c40
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x60
call fcn.180046e00
mov edi, 1
cmp dword [rax + 8], edi
je 0x180024c64
call fcn.180046e00
cmp dword [rax + 8], 3
jne 0x180024d2d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [0x1800cfca0]
lea rcx, [rsp + 0x30]
mov r8d, eax
call fcn.180053a60
cmp qword [rax + 0x20], 8
jb 0x180024c8b
mov r8, qword [rax + 8]
jmp 0x180024c8f
lea r8, [rax + 8]
mov eax, dword [0x180108d2c]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smpcacheencDragProcs_
mov r9d, 4
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp qword [rsp + 0x50], 8
jb 0x180024cd7
mov rcx, qword [rsp + 0x38]
call fcn.18009a864
cmp dword [0x18010b204], 0
jne 0x180024d2d
lea rdx, str.DoDragDrop
lea rcx, [0x1800cf160]
mov dword [0x18010b204], 0
call fcn.1800a7b40
mov qword [0x18010b208], rax
test rax, rax
je 0x180024d2d
lea rdx, [0x1800245b0]
lea rcx, [0x18010b208]
call fcn.1800a6320
mov ecx, dword [0x18010b204]
test eax, eax
cmove ecx, edi
mov dword [0x18010b204], ecx
cmp dword [0x180108d38], 0
je 0x180024d95
cmp dword [0x180108d44], 0
jne 0x180024d95
cmp dword [0x18010b220], 0
jne 0x180024d95
lea rdx, str.DragQueryFileW
lea rcx, [0x1800d09f8]
mov dword [0x18010b220], 0
call fcn.1800a7b40
mov qword [0x18010b218], rax
test rax, rax
je 0x180024d95
lea rdx, [0x180024660]
lea rcx, [0x18010b218]
call fcn.1800a6320
mov ecx, dword [0x18010b220]
test eax, eax
cmove ecx, edi
mov dword [0x18010b220], ecx
add rsp, 0x60
pop rdi
ret

Function at 0x180024da0
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x58
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [0x1800cfca0]
lea rcx, [rsp + 0x20]
mov r8d, eax
call fcn.180053a60
cmp qword [rax + 0x20], 8
jb 0x180024dcb
mov r8, qword [rax + 8]
jmp 0x180024dcf
lea r8, [rax + 8]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smpcacheencDragProcs_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp qword [rsp + 0x40], 8
jb 0x180024df5
mov rcx, qword [rsp + 0x28]
call fcn.18009a864
cmp dword [0x18010b204], 0
je 0x180024e11
lea rdx, [0x1800245b0]
lea rcx, [0x18010b208]
call fcn.1800a7660
cmp dword [0x18010b220], 0
mov dword [0x18010b204], 0
je 0x180024e37
lea rdx, [0x180024660]
lea rcx, [0x18010b218]
call fcn.1800a7660
mov dword [0x18010b220], 0
add rsp, 0x58
ret
Function at 0x1800269a0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov eax, 0x3a
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov word [rsp + 0x2a], ax
xor eax, eax
lea rcx, [rsp + 0x28]
mov word [rsp + 0x28], dx
mov dword [rsp + 0x2c], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
jne 0x180026b01
lea rcx, [rsp + 0x252]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x250], di
call fcn.18009e990
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x28]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x180026b01
movzx ecx, word [rsp + 0x252]
movzx eax, cx
or ax, 0x20
cmp ax, 0x64
jne 0x180026ae9
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], di
call fcn.18009e990
lea rcx, str.mpr.dll
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x180026a93
lea rcx, str.mpr.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180026b01
lea rdx, str.WNetGetConnectionW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180026b01
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call rax
test eax, eax
jne 0x180026b01
mov qword [rbx + 0x18], rdi
or rcx, 0xffffffffffffffff
mov qword [rbx + 0x20], 7
mov word [rbx + 8], di
lea rdi, [rsp + 0x40]
xor eax, eax
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x40]
not rcx
lea r8, [rcx - 1]
jmp 0x180026b1b
cmp cx, 0x3f
jne 0x180026b01
movzx edx, word [rsp + 0x258]
mov rcx, rbx
call fcn.1800269a0
jmp 0x180026b23
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rdi
lea rdx, [0x1800cda60]
mov word [rbx + 8], di
xor r8d, r8d
mov rcx, rbx
call fcn.18000f510
mov rax, rbx
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.180099fe0
mov rbx, qword [rsp + 0x490]
add rsp, 0x470
pop rdi
ret

Function at 0x180026e30
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x68
movzx r8d, cx
lea rdx, [0x1800d0b50]
lea rcx, [rsp + 0x30]
call fcn.180053a60
cmp qword [rax + 0x20], 8
jb 0x180026e56
mov r8, qword [rax + 8]
jmp 0x180026e5a
lea r8, [rax + 8]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x78]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smpcachedriveType_
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x70], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x180026eab
cmp dword [rsp + 0x78], 4
jne 0x180026eab
mov ebx, dword [rsp + 0x80]
jmp 0x180026eb0
mov ebx, 0x64
cmp qword [rsp + 0x50], 8
jb 0x180026ec2
mov rcx, qword [rsp + 0x38]
call fcn.18009a864
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x18002a9e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov rbx, rcx
lea rsi, [0x1801088a0]
mov qword [rsp + 0x68], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov qword [rsp + 0x48], 7
xor ebp, ebp
mov qword [rsp + 0x40], rbp
mov word [rsp + 0x30], bp
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.18000f510
nop
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetTickCount64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18002aa76
call rax
mov rdi, rax
jmp 0x18002aa7e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
lea rdx, [rsp + 0x28]
lea rcx, [0x18010cb50]
call fcn.18000d650
sub rdi, qword [rax]
cmp rdi, 0xbb8
setb dil
cmp qword [rsp + 0x48], 8
jb 0x18002aaaf
mov rcx, qword [rsp + 0x30]
call fcn.18009a864
test dil, dil
je 0x18002aac4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
jmp 0x18002ab5b
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbp
mov word [rsp + 0x30], bp
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.18000f510
nop
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetTickCount64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18002ab21
call rax
mov rdi, rax
jmp 0x18002ab29
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
lea rdx, [rsp + 0x28]
lea rcx, [0x18010cb50]
call fcn.18000d650
mov qword [rax], rdi
cmp qword [rsp + 0x48], 8
jb 0x18002ab50
mov rcx, qword [rsp + 0x30]
call fcn.18009a864
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x18002bb10
Capabilities:
Create thread

Disassembly:
mov eax, 0x1058
call fcn.1800b3cb0
sub rsp, rax
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x1040], rax
cmp dword [0x18010575c], 0
je 0x18002bbdf
mov qword [rsp + 0x1050], rbx
lea rcx, [0x1801088c8]
xor ebx, ebx
mov dword [0x18010575c], ebx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, str._UsbLetterFetchThread
mov qword [rsp + 0x28], r11
lea r9, str.._filemon.cpp
lea r8, str._s._d:_s
lea rcx, [rsp + 0x40]
mov edx, 0x800
mov dword [rsp + 0x20], QISearch
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea rax, [rsp + 0x30]
lea r8, [0x18002b8d0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x18002bbce
mov edx, dword [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rcx, str.thread__d_created:__s
call fcn.180057ba8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x1050]
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.180099fe0
add rsp, 0x1058
ret
Function at 0x180036b80
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x3c]
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x38]
lea r8, str.BackupToServer
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x3c], 4
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x180036c69
cmp dword [rsp + 0x38], 4
jne 0x180036c69
cmp dword [rsp + 0x30], eax
je 0x180036c69
lea rdx, [0x1800d1670]
lea rcx, [rsp + 0x40]
mov r9, rdi
mov r8, rbx
call fcn.180053a60
cmp qword [rsp + 0x60], 8
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x48]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_backupupload_
mov r9d, 4
cmovae r8, qword [rsp + 0x48]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor ebx, ebx
test eax, eax
sete bl
cmp qword [rsp + 0x60], 8
jb 0x180036c65
mov rcx, qword [rsp + 0x48]
call fcn.18009a864
mov eax, ebx
jmp 0x180036c6b
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180099fe0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x180036fe0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [0x180108d44], 0
mov rbx, rcx
jne 0x180037014
cmp dword [0x180108d48], 0
je 0x18003715d
mov qword [rsp + 0x290], rdi
lea rcx, [rsp + 0x62]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x60], di
call fcn.18009e990
test rbx, rbx
je 0x1800370a5
mov r9d, 0x5c
mov edx, edi
mov eax, edi
cmp word [rbx], r9w
jne 0x180037059
mov word [rsp + 0x60], r9w
mov eax, 1
add rbx, 2
movzx ecx, word [rbx]
movsxd r8, eax
test cx, cx
je 0x1800370a5
lea rax, [rsp + r8*2 + 0x60]
nop dword [rax]
cmp cx, r9w
je 0x180037087
cmp cx, 0x2f
je 0x180037087
mov word [rax], cx
add rax, 2
mov edx, edi
jmp 0x180037098
test edx, edx
jne 0x180037093
mov word [rax], r9w
add rax, 2
mov edx, 1
mov cx, word [rbx + 2]
add rbx, 2
test cx, cx
jne 0x180037070
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetTickCount64
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800370cb
call rax
jmp 0x1800370d3
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_volatile_shlProcessing_
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rdi, qword [rsp + 0x290]
test eax, eax
jne 0x18003715d
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov r9d, 0xb
xor r8d, r8d
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180099fe0
add rsp, 0x280
pop rbx
ret
Function at 0x1800387e0
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x260
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x270], rbx
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, r9
mov r9, r8
test r8, r8
je 0x1800388f3
test rbx, rbx
je 0x1800388ef
cmp dword [rsp + 0x290], 0
jl 0x1800388eb
xor edi, edi
mov qword [rsp + 0x30], rdi
mov rax, qword [r8]
lea r8, [rsp + 0x30]
mov edx, 0x80058000
mov rcx, r9
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x30]
test eax, eax
cmovs rcx, rdi
mov qword [rsp + 0x30], rcx
test rcx, rcx
je 0x1800388d8
mov r8d, 0x104
mov rdx, rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rdx, [0x1800d1a48]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800388d3
mov rbx, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
mov r9d, eax
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x40]
mov rdx, rbx
lea ecx, [rdi + 4]
call fcn.18002ac00
mov rcx, qword [rsp + 0x30]
jmp 0x1800388d8
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1800388e7
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
jmp 0x1800388f5
xor eax, eax
jmp 0x1800388f5
xor eax, eax
jmp 0x1800388f5
xor eax, eax
jmp 0x1800388f5
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180099fe0
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
Function at 0x180038920
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x270
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, r9
mov r9, r8
mov rdi, qword [rsp + 0x2a0]
test r8, r8
je 0x180038ad0
test rbx, rbx
je 0x180038ad0
test rdi, rdi
je 0x180038ad0
cmp dword [rsp + 0x2a8], 0
jl 0x180038ad0
xor esi, esi
mov qword [rsp + 0x30], rsi
mov rax, qword [r8]
lea r8, [rsp + 0x30]
mov edx, 0x80058000
mov rcx, r9
call qword [rax + 0x28]
mov rdx, qword [rsp + 0x30]
test eax, eax
cmovs rdx, rsi
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rsi
mov rax, qword [rbx]
lea r8, [rsp + 0x38]
mov edx, 0x80058000
mov rcx, rbx
call qword [rax + 0x28]
mov rbx, qword [rsp + 0x38]
test eax, eax
cmovs rbx, rsi
mov qword [rsp + 0x38], rbx
cmp qword [rsp + 0x30], rsi
je 0x180038aad
test rbx, rbx
je 0x180038aad
mov word [rsp + 0x50], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x52]
call fcn.18009e990
mov r8d, 0x104
mov rdx, rbx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x50]
call fcn.180036fe0
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180038aa8
mov rbx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
mov r9d, eax
mov qword [rsp + 0x20], rsi
lea r8, [rsp + 0x50]
mov rdx, rbx
lea ecx, [rsi + 3]
call fcn.18002ac00
mov rbx, qword [rsp + 0x30]
lea edx, [rsi + 1]
lea rcx, [rsp + 0x50]
call fcn.18007e6a4
test eax, eax
je 0x180038a8c
lea r8d, [rsi + 3]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1800378a0
mov r8d, 3
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call fcn.180038220
mov rbx, qword [rsp + 0x38]
jmp 0x180038aad
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x180038ac0
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x38], rsi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180038ad0
call qword [sym.imp.ole32.dll_CoTaskMemFree]
call fcn.18001c0c0
test rax, rax
je 0x180038add
dec rax
mov rcx, rax
call fcn.18001c020
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180099fe0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180038b30
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x270
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, r9
mov r9, r8
mov rdi, qword [rsp + 0x2a0]
test r8, r8
je 0x180038ce0
test rbx, rbx
je 0x180038ce0
test rdi, rdi
je 0x180038ce0
cmp dword [rsp + 0x2a8], 0
jl 0x180038ce0
xor esi, esi
mov qword [rsp + 0x30], rsi
mov rax, qword [r8]
lea r8, [rsp + 0x30]
mov edx, 0x80058000
mov rcx, r9
call qword [rax + 0x28]
mov rdx, qword [rsp + 0x30]
test eax, eax
cmovs rdx, rsi
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rsi
mov rax, qword [rbx]
lea r8, [rsp + 0x38]
mov edx, 0x80058000
mov rcx, rbx
call qword [rax + 0x28]
mov rbx, qword [rsp + 0x38]
test eax, eax
cmovs rbx, rsi
mov qword [rsp + 0x38], rbx
cmp qword [rsp + 0x30], rsi
je 0x180038cbd
test rbx, rbx
je 0x180038cbd
mov word [rsp + 0x50], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x52]
call fcn.18009e990
mov r8d, 0x104
mov rdx, rbx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x50]
call fcn.180036fe0
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180038cb8
mov rbx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
mov r9d, eax
mov qword [rsp + 0x20], rsi
lea r8, [rsp + 0x50]
mov rdx, rbx
lea ecx, [rsi + 2]
call fcn.18002ac00
mov rbx, qword [rsp + 0x30]
lea edx, [rsi + 1]
lea rcx, [rsp + 0x50]
call fcn.18007e6a4
test eax, eax
je 0x180038c9c
lea r8d, [rsi + 2]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1800378a0
mov r8d, 2
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call fcn.180038220
mov rbx, qword [rsp + 0x38]
jmp 0x180038cbd
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x180038cd0
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x38], rsi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180038ce0
call qword [sym.imp.ole32.dll_CoTaskMemFree]
call fcn.18001c0c0
test rax, rax
je 0x180038ced
dec rax
mov rcx, rax
call fcn.18001c020
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180099fe0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x18003b060
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rcx, [0x1801088f0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ebx, ebx
mov dword [0x18010bc58], ebx
cmp byte [0x18010699b], bl
je 0x18003b088
call fcn.18007cd9c
lea rdx, str.simw.exe
lea rcx, [0x180108f60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18003b261
mov qword [rsp + 0x58], rdi
mov edi, 1
cmp dword [0x180108d3c], ebx
je 0x18003b172
cmp dword [0x180108d44], ebx
je 0x18003b242
cmp dword [0x18010b2a8], ebx
jne 0x18003b117
lea rdx, str.SHFileOperationW
lea rcx, [0x1800d09f8]
mov dword [0x18010b2a8], ebx
call fcn.1800a7b40
mov qword [0x18010b2a0], rax
test rax, rax
je 0x18003b117
lea rdx, [0x18003aef0]
lea rcx, [0x18010b2a0]
call fcn.1800a6320
mov edx, dword [0x18010b2a8]
test eax, eax
cmove edx, edi
mov dword [0x18010b2a8], edx
cmp dword [0x18010b2ac], ebx
jne 0x18003b242
lea rdx, str.ShellExecuteExW
lea rcx, [0x1800d09f8]
mov dword [0x18010b2ac], ebx
call fcn.1800a7b40
mov qword [0x18010b2b0], rax
test rax, rax
je 0x18003b242
lea rdx, [0x18003aff0]
lea rcx, [0x18010b2b0]
call fcn.1800a6320
test eax, eax
jne 0x18003b242
mov dword [0x18010b2ac], edi
jmp 0x18003b242
cmp dword [0x180108d44], 0
mov ebx, edi
jne 0x18003b18a
cmp dword [0x180108d48], 0
je 0x18003b22e
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x48]
lea r8, [0x1800cfb30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18003b1de
cmp dword [rsp + 0x48], 4
jne 0x18003b1de
cmp dword [rsp + 0x50], 0
mov eax, 5
cmovne ebx, eax
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x48]
lea r8, [0x1800cfb58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18003b22e
cmp dword [rsp + 0x48], 4
jne 0x18003b22e
cmp dword [rsp + 0x50], eax
je 0x18003b22e
or ebx, 8
or dword [0x180108d28], ebx
cmp dword [0x180108d14], 0
jne 0x18003b242
call fcn.180017250
call fcn.180024c40
call fcn.1800437b0
cmp dword [0x180108d44], 0
je 0x18003b25c
mov ecx, edi
call fcn.180016460
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbx
ret