joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180048b2c
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x180122658]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, rdx
mov rbp, rcx
mov rcx, rsi
mov edx, 0x10
mov r14, r8
call fcn.18000e9b4
test eax, eax
jne 0x180048b74
mov eax, 0x80070057
jmp 0x180048cf7
test rbp, rbp
jne 0x180048b83
mov ebx, 0x800401ea
jmp 0x180048cea
mov rcx, rbp
xor ebx, ebx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180048b9f
bt eax, 0xa
mov eax, 0x100000
cmovb ebx, eax
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], ebx
mov edx, 0x80000100
mov rcx, rbp
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x180048c04
and qword [rsp + 0x30], 0
lea r8d, [rax + 4]
mov dword [rsp + 0x28], ebx
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x180048c42
jmp 0x180048b79
movdqa xmm0, xmmword [0x1800f4b40]
lea r8, [rsp + 0x50]
and dword [rsp + 0x70], 0
lea rdx, [rsp + 0x40]
movdqa xmm1, xmm0
mov dword [rsp + 0x20], 4
mov r9d, 0x28
mov rcx, rax
movdqu xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.coml2.dll_Ordinal_11]
mov rdx, qword [0x1800f3178]
mov ebx, eax
mov rcx, qword [0x1800f3170]
test eax, eax
jne 0x180048c76
mov rax, qword [rsi]
sub rax, rcx
jne 0x180048c71
mov rax, qword [rsi + 8]
sub rax, rdx
test rax, rax
jne 0x180048cd7
mov rax, qword [r14]
sub rax, rcx
jne 0x180048c85
mov rax, qword [r14 + 8]
sub rax, rdx
test rax, rax
je 0x180048c96
movups xmm0, xmmword [r14]
xor ebx, ebx
movdqu xmmword [rsi], xmm0
jmp 0x180048cd7
mov rdx, rsi
mov rcx, rdi
call fcn.18004da8c
mov ebx, eax
cmp eax, 0x80040154
jne 0x180048cd7
mov rcx, rbp
call sym.ole32.dll_FindExt
test rax, rax
jne 0x180048cbe
mov ebx, 0x800401e6
jmp 0x180048cd7
mov rdx, rsi
mov rcx, rax
call fcn.18004d96c
xor ecx, ecx
mov ebx, 0x800401e6
test eax, eax
cmovne ecx, ebx
mov ebx, ecx
cmp rdi, 0xffffffffffffffff
je 0x180048ce6
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test ebx, ebx
je 0x180048cf5
movups xmm0, xmmword [0x1800f3170]
movdqu xmmword [rsi], xmm0
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180023ec0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18004df68
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x240
mov rax, qword [0x180122658]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, r8
mov r14, rdx
mov r15, rcx
xor r12d, r12d
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
mov edi, r12d
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8, r14
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.18000dd00
mov ebx, eax
test eax, eax
jns 0x18004dfe8
mov rcx, qword [rsp + 0x278]
lea r8, str.comole32comclasspexttbl.cxx
mov r9d, eax
mov edx, 0xdc
call fcn.18000deb0
mov eax, ebx
jmp 0x18004e0f6
lea rcx, [rsp + 0x20]
call fcn.18001e718
lea rdx, [rsp + 0x20]
or rax, 0xffffffffffffffff
lea rcx, [rsp + 0x20]
mov ebx, r12d
inc rax
cmp word [rcx + rax*2], r12w
jne 0x18004e003
test eax, eax
je 0x18004e031
mov r8d, eax
mov ecx, ebx
mov eax, ebx
shl eax, 8
shr ecx, 0x18
mov ebx, ecx
xor ebx, eax
movzx eax, word [rdx]
xor ebx, eax
lea rdx, [rdx + 2]
sub r8, 1
jne 0x18004e014
mov r8d, 0xe1
lea rdx, str.comole32comclasspexttbl.cxx
lea rcx, [0x180122230]
call fcn.180004bac
lea r8, [rsp + 0x20]
mov edx, ebx
lea rcx, [r15 + 0x10]
call fcn.1800bae54
test rax, rax
jne 0x18004e0d9
dec dword [0x180122234]
lea rcx, [0x180122250]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov r8, rsi
mov rdx, r14
call fcn.18004e118
mov r8d, 0xec
lea rdx, str.comole32comclasspexttbl.cxx
lea rcx, [0x180122230]
mov edi, eax
call fcn.180004bac
test edi, edi
jns 0x18004e0ad
mov rdx, rsi
mov rcx, r14
call fcn.18004e320
mov edi, eax
test eax, eax
js 0x18004e0e1
lea r8, [rsp + 0x20]
mov edx, ebx
lea rcx, [r15 + 0x10]
call fcn.1800bae54
test rax, rax
jne 0x18004e0e1
mov r9d, ebx
lea r8, [rsp + 0x20]
mov rdx, rsi
mov rcx, r15
call fcn.18004ddd4
mov edi, eax
jmp 0x18004e0e1
movups xmm0, xmmword [rax + 0x20]
movdqu xmmword [rsi], xmm0
dec dword [0x180122234]
lea rcx, [0x180122250]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov eax, edi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180023ec0
add rsp, 0x240
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18004e320
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x180122658]
xor rax, rsp
mov qword [rsp + 0x240], rax
and qword [rsp + 0x38], 0
mov rdi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x200
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [rsp + 0x38]
mov dword [rsp + 0x30], 0x200
mov edx, 0x20019
mov rcx, rbx
call fcn.18000d8c8
test eax, eax
je 0x18004e395
cmp eax, 2
je 0x18004e38e
cmp eax, 0x3f2
je 0x18004e38e
mov ebx, 0x80040150
jmp 0x18004e3e7
mov ebx, 0x80040154
jmp 0x18004e3e7
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x18004e3d7
xor r9d, r9d
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov rdx, rdi
call fcn.18004ee14
mov ebx, eax
jmp 0x18004e3dc
mov ebx, 0x80040154
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180023ec0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
Function at 0x18004e854
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbp, qword [rsp + 0x90]
mov rsi, rdx
mov edx, dword [r8 + 0x14]
mov r14, r9
mov r15, qword [rsp + 0x98]
mov rdi, r8
mov r12, rcx
mov ebx, 1
cmp edx, dword [rbp]
jne 0x18004e8a1
mov eax, dword [r15]
cmp dword [r8 + 0x18], eax
jbe 0x18004e97a
and dword [rsp + 0x80], 0
lea r8, [rsp + 0x90]
and dword [r14], 0
mov r9d, edx
sar r9d, 0x1f
mov dword [rsp + 0x90], r9d
and r9d, 2
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x18004e92a
mov r8d, dword [rdi + 0x18]
lea r9, [rsp + 0x80]
and qword [rsp + 0x20], 0
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
je 0x18004e906
mov eax, dword [rdi + 0x14]
mov dword [rbp], eax
mov eax, dword [rdi + 0x18]
mov dword [r15], eax
mov dword [r14], ebx
jmp 0x18004e980
cmp dword [0x180122f00], 0
je 0x18004e97a
mov rax, qword [section..data]
test byte [rax + 0x1c], 8
je 0x18004e97a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r9d, 0x79
jmp 0x18004e94c
cmp dword [0x180122f00], 0
je 0x18004e97a
mov rax, qword [section..data]
test byte [rax + 0x1c], 8
je 0x18004e97a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r9d, 0x7e
mov dword [rsp + 0x30], eax
lea r8, [0x180103040]
lea rax, str.__WINERROR_
or ecx, 0xffffffff
mov qword [rsp + 0x28], rax
lea rdx, str.comole32comclasspattbl.cxx
mov dword [rsp + 0x20], 3
call fcn.1800107c0
cmp dword [r14], 0
je 0x18004e9af
mov r9d, dword [rdi + 0x18]
lea rdx, [rdi + 0x1c]
xor r8d, r8d
lea rcx, [rdx + r9]
test r9d, r9d
je 0x18004e9b1
mov al, byte [rsi]
and al, byte [rdx]
cmp al, byte [rcx]
jne 0x18004e9af
add rdx, rbx
add rsi, rbx
add rcx, rbx
add r8d, ebx
cmp r8d, r9d
jb 0x18004e994
jmp 0x18004e9b1
xor ebx, ebx
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x18004f02c
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x180122658]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rdx
mov dword [rbp - 0x31], 0x4e
xor r14d, r14d
lea r8, [rbp - 0x39]
mov edx, 0x2001f
mov qword [rbp - 0x39], r14
mov rdi, rcx
call fcn.18000d7f0
mov esi, eax
test eax, eax
jne 0x18004f1ba
movups xmm0, xmmword [rbx]
lea r8d, [r14 + 0x27]
mov rcx, rbx
lea rdx, [rbp - 0x19]
movdqu xmmword [rbp - 0x29], xmm0
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
mov rax, qword [rdi]
sub rax, qword [rbx]
jne 0x18004f0a9
mov rax, qword [rdi + 8]
sub rax, qword [rbx + 8]
test rax, rax
jne 0x18004f116
mov rcx, qword [rbp - 0x39]
lea r9, [rbp - 0x31]
lea r8, [rbp - 0x19]
lea rdx, str.AutoTreatAs
call fcn.18001bf04
test eax, eax
jne 0x18004f10a
movzx eax, word [rbp - 0x19]
test ax, ax
je 0x18004f100
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x19]
cmp ax, 0x7b
je 0x18004f0ee
xor r9d, r9d
xor r8d, r8d
call fcn.18004ee14
jmp 0x18004f0fc
call fcn.18003d898
test eax, eax
jne 0x18004f116
mov eax, 0x800401f3
test eax, eax
je 0x18004f116
mov eax, 0x80040153
jmp 0x18004f1ba
movups xmm0, xmmword [0x1800f3170]
movdqu xmmword [rbp - 0x29], xmm0
mov rcx, rbx
call sym.ole32.dll_CoIsOle1Class
test eax, eax
je 0x18004f12c
mov eax, 0x80070057
jmp 0x18004f1ba
mov rax, qword [rbp - 0x29]
sub rax, qword [0x1800f3170]
jne 0x18004f144
mov rax, qword [rbp - 0x21]
sub rax, qword [0x1800f3178]
test rax, rax
jne 0x18004f178
mov rcx, qword [rbp - 0x39]
lea rdx, str.TreatAs
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
mov rcx, qword [rbp - 0x39]
neg eax
sbb ebx, ebx
and ebx, 0x80040151
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
jmp 0x18004f1ba
lea rcx, [rbp - 0x19]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x18004f180
mov rcx, qword [rbp - 0x39]
lea r9, [rbp - 0x19]
inc eax
lea rdx, str.TreatAs
mov dword [rsp + 0x20], eax
call fcn.1800c1c8c
test eax, eax
mov ecx, 0x80040151
cmovne esi, ecx
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.180023ec0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
test rcx, rcx
je 0x18004f32e
test rdx, rdx
jne 0x18004f02c
mov eax, 0x80070057
ret
Function at 0x18004f320
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x180122658]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rdx
mov dword [rbp - 0x31], 0x4e
xor r14d, r14d
lea r8, [rbp - 0x39]
mov edx, 0x2001f
mov qword [rbp - 0x39], r14
mov rdi, rcx
call fcn.18000d7f0
mov esi, eax
test eax, eax
jne 0x18004f1ba
movups xmm0, xmmword [rbx]
lea r8d, [r14 + 0x27]
mov rcx, rbx
lea rdx, [rbp - 0x19]
movdqu xmmword [rbp - 0x29], xmm0
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
mov rax, qword [rdi]
sub rax, qword [rbx]
jne 0x18004f0a9
mov rax, qword [rdi + 8]
sub rax, qword [rbx + 8]
test rax, rax
jne 0x18004f116
mov rcx, qword [rbp - 0x39]
lea r9, [rbp - 0x31]
lea r8, [rbp - 0x19]
lea rdx, str.AutoTreatAs
call fcn.18001bf04
test eax, eax
jne 0x18004f10a
movzx eax, word [rbp - 0x19]
test ax, ax
je 0x18004f100
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x19]
cmp ax, 0x7b
je 0x18004f0ee
xor r9d, r9d
xor r8d, r8d
call fcn.18004ee14
jmp 0x18004f0fc
call fcn.18003d898
test eax, eax
jne 0x18004f116
mov eax, 0x800401f3
test eax, eax
je 0x18004f116
mov eax, 0x80040153
jmp 0x18004f1ba
movups xmm0, xmmword [0x1800f3170]
movdqu xmmword [rbp - 0x29], xmm0
mov rcx, rbx
call sym.ole32.dll_CoIsOle1Class
test eax, eax
je 0x18004f12c
mov eax, 0x80070057
jmp 0x18004f1ba
mov rax, qword [rbp - 0x29]
sub rax, qword [0x1800f3170]
jne 0x18004f144
mov rax, qword [rbp - 0x21]
sub rax, qword [0x1800f3178]
test rax, rax
jne 0x18004f178
mov rcx, qword [rbp - 0x39]
lea rdx, str.TreatAs
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
mov rcx, qword [rbp - 0x39]
neg eax
sbb ebx, ebx
and ebx, 0x80040151
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
jmp 0x18004f1ba
lea rcx, [rbp - 0x19]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x18004f180
mov rcx, qword [rbp - 0x39]
lea r9, [rbp - 0x19]
inc eax
lea rdx, str.TreatAs
mov dword [rsp + 0x20], eax
call fcn.1800c1c8c
test eax, eax
mov ecx, 0x80040151
cmovne esi, ecx
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.180023ec0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
test rcx, rcx
je 0x18004f32e
test rdx, rdx
jne 0x18004f02c
mov eax, 0x80070057
ret
Function at 0x18005d7e4
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x180122658]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r8d, 0x10
lea rdx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_wcstoul]
mov rcx, qword [rsp + 0x20]
xor ebx, ebx
cmp word [rcx], bx
jne 0x18005d838
lea r9d, [rbx + 0x20]
mov edx, 0x80000001
lea r8, [rsp + 0x30]
mov ecx, eax
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoW]
test eax, eax
jle 0x18005d838
lea eax, [rbx + 1]
jmp 0x18005d83a
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180023ec0
add rsp, 0x80
pop rbx
ret

Function at 0x1800635a0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, r8
test rdx, rdx
je 0x1800635fe
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], di
jne 0x1800635b8
test rax, rax
je 0x1800635fe
lea rax, [rsp + 0x48]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x180063607
mov rcx, qword [rsp + 0x48]
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x180063607
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180063700
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], r8
push rdi
sub rsp, 0x40
mov rdi, r9
lea rax, [r11 - 0x10]
mov r9d, 0x20019
mov qword [r11 - 0x28], rax
xor r8d, r8d
xor ebx, ebx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x180063772
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [0x1800f2ed8]
mov dword [rsp + 0x60], 0x208
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
cmove rbx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180063780
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rax, [rsp + 0x60]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x18006383f
and qword [rsp + 0x58], 0
lea rax, [rsp + 0x98]
and qword [rsp + 0x50], 0
xor r9d, r9d
and qword [rsp + 0x48], 0
xor r8d, r8d
and qword [rsp + 0x40], 0
xor edx, edx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x90]
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyA]
mov rcx, qword [rsp + 0x60]
test eax, eax
jne 0x180063839
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp dword [rsp + 0x90], 0
ja 0x18006383f
cmp dword [rsp + 0x98], 1
ja 0x18006383f
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
jmp 0x18006383f
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x180064098
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
xor esi, esi
mov rbx, r9
mov qword [rsp + 0x78], rsi
mov rdi, r8
test r9, r9
je 0x1800640bc
mov qword [r9], rsi
test rcx, rcx
je 0x1800641b7
test rdx, rdx
je 0x1800641b7
test rdi, rdi
jne 0x1800640e0
cmp dword [rsp + 0x80], esi
je 0x1800641b7
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea r9, [0x1800f2ed8]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
jne 0x18006415a
test rdi, rdi
je 0x180064198
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], si
jne 0x180064122
mov rcx, qword [rsp + 0x78]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, [0x1800f2ed8]
mov r9d, 1
mov qword [rsp + 0x20], rdi
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x180064198
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18006416a
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x18006417c
movzx eax, ax
or eax, 0x80070000
mov edx, 1
cdqe
mov r8d, edx
mov qword [rsp + 0x60], rax
lea r9, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_RaiseException]
test rbx, rbx
je 0x1800641a7
mov rax, qword [rsp + 0x78]
mov qword [rbx], rax
jmp 0x1800641b7
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1800641b7
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1800641c8
Capabilities:
Set registry value

Disassembly:
test r8, r8
je 0x18006423d
push rbx
sub rsp, 0x30
xor ebx, ebx
test rcx, rcx
je 0x180064238
or rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], bx
jne 0x1800641dd
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x180064238
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x18006421c
movzx eax, ax
or eax, 0x80070000
mov edx, 1
cdqe
mov r8d, edx
mov qword [rsp + 0x50], rax
lea r9, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_RaiseException]
add rsp, 0x30
pop rbx
ret
Function at 0x180065734
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180122658]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor edi, edi
movabs rax, 0x5c003a0041
mov qword [rsp + 0x28], rax
mov rbx, rcx
test rcx, rcx
je 0x1800657ed
cmp word [rcx + 2], 0x3a
jne 0x1800657ed
movzx ecx, word [rcx]
call fcn.18001e718
lea rcx, [rsp + 0x28]
mov word [rsp + 0x28], ax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
cmp eax, 4
jne 0x1800657ed
mov rax, qword [0x180123a20]
mov dword [rsp + 0x20], 0x100
mov word [rsp + 0x2c], di
test rax, rax
jne 0x1800657c3
mov rcx, qword [0x180123080]
xor edx, edx
mov r8d, 0x200
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov qword [0x180123a20], rax
lea r8, [rsp + 0x20]
mov rdx, rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.MPR.dll_WNetGetConnectionW]
test eax, eax
jne 0x1800657ed
movzx ecx, word [rbx]
call fcn.18001e718
mov word [0x180123a28], ax
xor eax, eax
jmp 0x1800657f2
mov eax, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180023ec0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x18006d0f4
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rdi, qword [rcx + 0x58]
mov rbp, rcx
test rdi, rdi
je 0x18006d1ef
mov r13d, 0x3e1
mov rcx, rdi
call qword [sym.imp.KERNELBASE.dll_LocalLock]
mov rsi, rax
test rax, rax
je 0x18006d1ef
lea r12, [rax + 0xa8]
lea rbx, [rax + 8]
jmp 0x18006d1d1
mov r15, qword [rbx]
test r15, r15
je 0x18006d1cd
mov r14, qword [rbp + 0x50]
mov rcx, r15
call fcn.18006f714
test eax, eax
je 0x18006d1ca
mov rcx, r14
call fcn.18006f714
test eax, eax
je 0x18006d1ca
xor r9d, r9d
mov r8, r14
mov edx, r13d
mov rcx, r15
call fcn.18006f968
test eax, eax
je 0x18006d1ca
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov r15d, eax
jmp 0x18006d19f
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, r15d
cmp eax, 0x3e8
ja 0x18006d1c1
mov r9d, r13d
mov dword [rsp + 0x20], 1
mov r8d, r13d
lea rcx, [rsp + 0x30]
mov rdx, r14
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x18006d18f
jmp 0x18006d1ca
mov rcx, r14
call qword [sym.imp.USER32.dll_IsWindow]
dec dword [rbp + 0x64]
add rbx, 0x10
cmp rbx, r12
jb 0x18006d14b
mov rcx, rdi
mov rdi, qword [rsi]
call qword [sym.imp.KERNELBASE.dll_LocalUnlock]
test rdi, rdi
jne 0x18006d126
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x18007bae0
Capabilities:
Read clipboard data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
xor edi, edi
mov dword [rbx], eax
lea rcx, [rsp + 0x30]
mov qword [rsi], rdi
xor r8d, r8d
mov byte [rsp + 0x30], dil
call fcn.180010fbc
mov ebx, eax
test eax, eax
jns 0x18007bb27
mov r9d, eax
mov edx, 0xc43
jmp 0x18007bbae
movzx ecx, word [0x180123324]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rcx, rax
xor edx, edx
call fcn.18001d0bc
mov rbx, rax
test rax, rax
jne 0x18007bb52
mov ebx, 0x8007000e
mov edx, 0xc4a
jmp 0x18007bbab
lea rcx, [rsp + 0x30]
call fcn.180011038
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], rdi
mov edx, 1
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CreateStreamOnHGlobal]
mov ebx, eax
test eax, eax
js 0x18007bba6
mov rcx, qword [rsp + 0x38]
lea rdx, [0x1800f24b0]
mov r8, rsi
call sym.ole32.dll_OleLoadFromStream
mov rcx, qword [rsp + 0x38]
mov ebx, eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1800248fe.0]
test ebx, ebx
jns 0x18007bbc1
mov edx, 0xc50
mov r9d, ebx
mov rcx, qword [rsp + 0x28]
lea r8, str.comole32ole232clipbrdclipapi.cpp
call fcn.18000deb0
mov edi, ebx
lea rcx, [rsp + 0x30]
call fcn.180011038
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret