joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180092d4
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push esi
push edi
push str.Global_MSIExecute
xor edi, edi
push edi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov esi, eax
test esi, esi
jne 0x18009309
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1800934a
test eax, eax
jle 0x18009338
movzx edi, ax
or edi, 0x80070000
jmp 0x1800934a
push 0x493e0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x18009343
cmp eax, 0x80
je 0x18009343
cmp eax, 0x102
je 0x1800933c
cmp eax, 0xffffffff
je 0x18009333
mov edi, 0x80004005
jmp 0x1800934e
call fcn.18015f1f
mov edi, eax
jmp 0x1800934a
mov edi, 0x800705b4
jmp 0x1800934a
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test esi, esi
je 0x18009355
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret

Function at 0x18009680
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, ecx
mov edi, edx
mov dword [ebp - 8], edi
cmp esi, 0x40
ja 0x180096a6
push dword [ebp + 8]
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
jmp 0x1800973a
push ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
mov dword [ebp - 0xc], eax
mov byte [ebp - 1], bl
mov ecx, ebx
lea eax, [ecx + 0x40]
mov dword [ebp - 0x10], eax
cmp eax, esi
ja 0x180096c6
push 0x40
pop edi
jmp 0x180096ca
mov edi, esi
sub edi, ecx
mov eax, dword [ebp + 8]
sub eax, ebx
push eax
push 1
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ecx, eax
cmp ecx, 0x102
je 0x18009737
cmp ecx, 0xffffffff
je 0x18009737
cmp ecx, 0x80
jb 0x18009701
lea eax, [edi + 0x80]
cmp ecx, eax
jae 0x18009701
mov byte [ebp - 1], 1
cmp dword [ebp + 8], 0xffffffff
je 0x1800971a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
sub ebx, dword [ebp - 0xc]
cmp ebx, dword [ebp + 8]
jbe 0x1800971a
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
add dword [ebp - 8], 0x100
cmp ecx, esi
jb 0x180096b7
movzx eax, byte [ebp - 1]
neg eax
sbb eax, eax
and eax, 0x80
jmp 0x18009739
mov eax, ecx
pop ebx
pop edi
pop esi
leave
ret
Function at 0x1800995e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push str.Get_AppxVersion.exe
lea ecx, [ebp - 8]
call fcn.18005bdc
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
call fcn.180110b2
mov edx, eax
lea ecx, [ebp - 4]
call fcn.180114a5
pop ecx
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.18003140
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18003140
push dword [ebp - 4]
lea ecx, [ebp - 0xc]
call fcn.18005bdc
mov esi, dword [ebp - 0xc]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esi - 0x10]
mov edi, eax
call fcn.18003140
test edi, edi
jne 0x180099c8
xor bl, bl
jmp 0x18009a28
push ecx
push dword [ebp - 4]
lea ecx, [ebp - 0x38]
call fcn.180131d5
push 0x180e4828
lea ecx, [ebp - 0xc]
call fcn.18005bdc
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x38]
mov esi, dword [ebp - 0xc]
xor ebx, ebx
push ebx
push ebx
push esi
call dword [eax + 8]
test eax, eax
js 0x18009a18
push 0x1388
lea ecx, [ebp - 0x38]
call fcn.1801341e
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea ecx, [ebp - 0x38]
call fcn.18013461
test al, al
je 0x18009a18
mov bl, 1
lea ecx, [esi - 0x10]
call fcn.18003140
lea ecx, [ebp - 0x38]
call fcn.180132d5
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.18003140
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x18009a3a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
movzx ecx, byte [0x18101323]
sub esp, 0x4c
neg ecx
sbb ecx, ecx
push ebx
push esi
push edi
push 7
pop ebx
push 6
pop eax
and ecx, 0x18101240
je 0x18009a7f
push eax
push ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], eax
call fcn.1800457f
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push str._ASUS__LaunchUpdater_
push eax
call fcn.18002ca6
pop ecx
pop ecx
push str.AsusUpdater.exe
lea ecx, [ebp - 8]
call fcn.18005bdc
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.180110b2
mov edx, eax
lea ecx, [ebp - 4]
call fcn.180114a5
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.18003140
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18003140
push dword [ebp - 4]
lea ecx, [ebp - 0x10]
call fcn.18005bdc
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esi - 0x10]
mov edi, eax
call fcn.18003140
test edi, edi
jne 0x18009b25
movzx ecx, byte [0x18101323]
neg ecx
sbb ecx, ecx
and ecx, 0x18101240
je 0x18009b1e
push 6
pop edx
push edx
push ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edx
call fcn.1800457f
push dword [ebp - 4]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push str.AsusUpdater.exe
push str._ASUS__File__s_not_exists___s_
push eax
call fcn.18002ca6
add esp, 0x10
xor bl, bl
jmp 0x18009bb4
xor ebx, ebx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
call fcn.18015ef2
push ecx
push dword [ebp - 4]
lea ecx, [ebp - 0x4c]
call fcn.180131d5
push str.FORCE_UPDATE
lea ecx, [ebp - 0x10]
call fcn.18005bdc
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x4c]
mov esi, dword [ebp - 0x10]
push ebx
push dword [ebp - 0xc]
push esi
call dword [eax + 8]
mov edi, eax
test edi, edi
jns 0x18009ba2
movzx ecx, byte [0x18101323]
neg ecx
sbb ecx, ecx
and ecx, 0x18101240
je 0x18009ba4
push 7
pop eax
push 6
pop edx
push edx
push eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
call fcn.1800457f
push edi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push str._ASUS__LaunchUpdater__p.Start_FAILED__0x_08x_
push eax
call fcn.18002ca6
add esp, 0xc
jmp 0x18009ba4
mov bl, 1
lea ecx, [esi - 0x10]
call fcn.18003140
lea ecx, [ebp - 0x4c]
call fcn.180132d5
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.18003140
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x1800aa69
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
mov esi, dword [edi]
test esi, esi
je 0x1800aabc
and dword [edi], 0
mov eax, 0x400000
cmp esi, 0x400000
ja 0x1800aa90
mov eax, esi
and dword [ebp + 8], 0
lea edx, [ebp + 8]
push 0
push edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x1800aac3
test ecx, ecx
je 0x1800aabc
mov ecx, dword [ebp - 4]
test esi, esi
jne 0x1800aa81
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1800aabe

Function at 0x1800af0b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, edx
xor edi, edi
mov ebx, ecx
or esi, 0x100
mov ecx, esi
mov eax, esi
shr ecx, 7
add esi, esi
shr eax, 8
and ecx, 1
neg ecx
sar ecx, 4
and ecx, 0x7f
movzx edx, word [ebx + eax*2]
mov eax, dword [ebp + 8]
shr edx, 4
xor edx, ecx
add edi, dword [eax + edx*4]
cmp esi, 0x10000
jb 0x1800af1d
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1800af52
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x100
mov dword [ebp - 4], ecx
xor edi, edi
or edx, esi
add ebx, ebx
mov ecx, esi
and ecx, ebx
mov eax, edx
add ecx, esi
shr eax, 8
add eax, ecx
mov ecx, dword [ebp - 4]
movzx ecx, word [ecx + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp + 0xc]
add edi, dword [eax + ecx*4]
mov ecx, edx
xor ecx, ebx
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x1800af68
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1800b03a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
bts esi, edx
mov ebx, ecx
cmp esi, 1
je 0x1800b075
push edi
mov edi, dword [ebp + 0xc]
mov edx, esi
and esi, 1
shr edx, 1
neg esi
sar esi, 4
and esi, 0x7f
movzx ecx, word [ebx + edx*2]
shr ecx, 4
xor ecx, esi
mov esi, edx
add eax, dword [edi + ecx*4]
cmp esi, 1
jne 0x1800b052
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1800b079
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor esi, esi
inc edi
test ebx, ebx
je 0x1800b0c0
mov eax, dword [ebp + 8]
mov edx, eax
movzx ecx, word [ecx + edi*2]
and edx, 1
shr eax, 1
add edi, edi
mov dword [ebp + 8], eax
or edi, edx
mov eax, edx
shr ecx, 4
neg eax
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp + 0xc]
add esi, dword [eax + ecx*4]
mov ecx, dword [ebp - 4]
sub ebx, 1
jne 0x1800b08e
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1800cbd1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
xor ecx, ecx
push edi
push 8
pop edi
mov dword [esi + 0x3bcd4], ecx
lea ebx, [esi + 0x20c]
mov dword [esi + 0x3bcd0], ecx
mov edx, ecx
mov dword [esi + 0x1cc], ecx
mov dword [esi + 0x1e8], ecx
mov dword [esi + 0x1bc], ecx
mov dword [esi + 0x1c8], 0x20
mov dword [esi + 0x1f0], 1
mov dword [esi + 0x1e4], 4
mov dword [esi + 0x1f4], ecx
mov dword [ebp - 8], edi
mov ecx, edx
mov dword [ebp - 4], edi
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
sub edi, 1
jne 0x1800cc33
mov dword [ebx], ecx
inc edx
add ebx, 4
push 8
pop edi
cmp edx, 0x100
jb 0x1800cc2e
xor ebx, ebx
lea eax, [esi + 0x19c]
lea ecx, [ebp - 0x38]
mov dword [esi + 0x118], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x170], ebx
mov dword [esi + 0x174], ebx
mov dword [esi + 0x158], ebx
mov dword [esi + 0x15c], ebx
mov dword [esi + 0x160], ebx
mov dword [esi + 0x164], ebx
mov dword [esi + 0x168], ebx
mov dword [esi + 0x16c], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x198], eax
call fcn.1800ab48
mov edx, ecx
mov ecx, esi
call fcn.1800ac48
push 2
pop edi
mov word [esi + 0x306a0], 0x100
mov ebx, edi
mov ecx, ebx
xor edx, edx
sar ecx, 1
inc edx
dec ecx
shl edx, cl
mov dword [ebp - 4], edx
test edx, edx
je 0x1800cd04
push edx
lea eax, [esi + 0x306a0]
add eax, edi
push ebx
push eax
call fcn.180a89f0
add esp, 0xc
add edi, dword [ebp - 4]
inc ebx
cmp ebx, 0x16
jl 0x1800ccdd
mov edi, dword [ebp - 8]
push 4
mov ecx, edi
xor edx, edx
pop ebx
imul ecx, ecx
mov eax, 0x10000
add edx, edx
jmp 0x1800cd23
shr ecx, 1
inc edx
cmp ecx, eax
jae 0x1800cd20
sub ebx, 1
jne 0x1800cd14
mov eax, edi
mov ecx, 0xa1
shr eax, 4
sub ecx, edx
add edi, 0x10
mov dword [esi + eax*4 + 0x30ea0], ecx
cmp edi, 0x800
jb 0x1800cd0d
and dword [esi + 0x325ac], ebx
and dword [esi + 0x3bd14], ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1800d7db
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
jne 0x1800d7ee
xor eax, eax
jmp 0x1800d7f5
push esi
call fcn.180ac191
pop ecx
push eax
push esi
lea ecx, [edi + 4]
call fcn.18005f0f
mov bl, byte [ebp + 0xc]
push 0
push 0x10000000
movzx eax, bl
add eax, 3
push eax
xor eax, eax
test bl, bl
push 0
push dword [ebp + 0x14]
sete al
dec eax
and eax, 0x102
inc eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x1800d839
call fcn.18015f1f
jmp 0x1800d859
test bl, bl
je 0x1800d84d
push 0x2000
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1800d832
and dword [edi + 0xc], 0
xor bl, 1
mov byte [edi + 8], bl
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x1800d90a
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x180fd00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push ecx
mov edi, edx
mov edx, ecx
push ecx
lea ecx, [ebp - 0x25c]
call fcn.1800f797
mov edx, edi
lea ecx, [ebp - 0x26c]
call fcn.1800f797
push esi
lea edx, [ebp - 0x25c]
lea ecx, [ebp - 0x268]
call fcn.18005b2d
push 0x250
xor ebx, ebx
lea eax, [ebp - 0x258]
push ebx
push eax
call fcn.180a89f0
add esp, 0x18
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x268]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [ebp - 0x264], edi
cmp edi, 0xffffffff
jne 0x1800d996
call fcn.18015f1f
mov ebx, eax
jmp 0x1800da88
cmp dword [ebp - 0x258], 0x80
je 0x1800d9af
test byte [ebp - 0x258], 0x10
jne 0x1800da42
lea eax, [ebp - 0x22c]
push eax
lea edx, [ebp - 0x25c]
lea ecx, [ebp - 0x260]
call fcn.18005b2d
lea eax, [ebp - 0x22c]
push eax
lea edx, [ebp - 0x26c]
lea ecx, [ebp - 0x270]
call fcn.18005b2d
mov esi, dword [ebp - 0x270]
pop ecx
pop ecx
cmp byte [ebp + 0xc], bl
jne 0x1800da0f
mov ecx, esi
call fcn.1800d860
test al, al
je 0x1800da0f
lea ecx, [esi - 0x10]
call fcn.18003140
mov ecx, dword [ebp - 0x260]
lea ecx, [ecx - 0x10]
call fcn.18003140
jmp 0x1800da42
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x260]
mov edx, esi
mov ecx, edi
call fcn.1800dac3
mov dword [ebp - 0x274], eax
pop ecx
lea ecx, [esi - 0x10]
test eax, eax
js 0x1800da68
call fcn.18003140
lea ecx, [edi - 0x10]
call fcn.18003140
mov edi, dword [ebp - 0x264]
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1800d996
call fcn.18015f1f
cmp eax, 0x80070012
je 0x1800da81
mov ebx, eax
jmp 0x1800da81
call fcn.18003140
lea ecx, [edi - 0x10]
call fcn.18003140
mov ebx, dword [ebp - 0x274]
mov edi, dword [ebp - 0x264]
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x268]
lea ecx, [ecx - 0x10]
call fcn.18003140
mov ecx, dword [ebp - 0x26c]
lea ecx, [ecx - 0x10]
call fcn.18003140
mov ecx, dword [ebp - 0x25c]
lea ecx, [ecx - 0x10]
call fcn.18003140
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.180a61d8
leave
ret
Function at 0x1800df69
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push 0
push eax
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800df93
call fcn.18015f1f
jmp 0x1800dfae
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
test ecx, ecx
je 0x1800df9f
mov dword [ecx], eax
add dword [esi + 0xc], eax
sub eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 0x80004005
pop esi
leave
ret 0xc

Function at 0x1800e535
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x180fd00c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp edi, reloc.WS2_32.dll_closesocket
jne 0x1800e562
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.180a61d8
leave
ret
push esi
push 0x802
lea eax, [ebp - 0x808]
push 0
push eax
call fcn.180a89f0
mov esi, dword [0x1810131c]
lea ecx, [ebp - 0x80c]
xor edx, edx
call fcn.18011062
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push str.baselogging.cc
push 0
push esi
push dword [ebp - 0x80c]
push edi
push str.Exception__x_in__s__s__u_r_n_r_n_hs:_d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x80c]
add esp, 0x2c
lea ecx, [ecx - 0x10]
call fcn.18003140
lea ecx, [ebp - 0x808]
call fcn.18017bba
push 0x250012
push str.Exception
lea eax, [ebp - 0x808]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop esi
sub eax, 3
je 0x1800e5f6
sub eax, 1
jne 0x1800e5ee
int3
xor eax, eax
inc eax
jmp 0x1800e555
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1801139c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x264
mov eax, dword [0x180fd00c]
xor eax, esp
mov dword [esp + 0x260], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
mov dword [esp + 0xc], eax
push dword [ebx + 4]
mov esi, ecx
push dword [ebx]
call fcn.18006068
mov eax, dword [ebx]
mov dword [ebx + 4], eax
mov ecx, dword [esi]
call fcn.1800d860
test al, al
jne 0x180113eb
mov eax, 0x80070003
jmp 0x18011490
push edi
mov edx, esi
lea ecx, [esp + 0x14]
call fcn.180114a5
xor edi, edi
mov dword [esp], 0x250
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], edi
push edi
push eax
call fcn.180a89f0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x18011431
call fcn.18015f1f
mov edi, eax
jmp 0x18011482
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
call edi
pop ecx
test al, al
je 0x18011467
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x10]
call fcn.18005bdc
lea eax, [esp + 0xc]
mov ecx, ebx
push eax
call fcn.18009bc6
mov ecx, dword [esp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.18003140
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18011435
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.18003140
mov eax, edi
mov ecx, dword [esp + 0x26c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.180a61d8
mov esp, ebp
pop ebp
ret
Function at 0x1801229b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push ecx
lea ecx, [ebp - 8]
mov dword [ebp - 4], edx
mov edi, 0x80070003
call fcn.18005bdc
lea ecx, [ebp - 8]
call fcn.18012dbb
mov esi, dword [ebp - 8]
test eax, eax
je 0x180123e5
and dword [ebp - 0x10], 0
or edx, 0xf003f
push 0
push ecx
push edx
push ecx
push ecx
push esi
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x180e49a8
mov dword [ebp - 0xc], 0x200
call fcn.1801206c
mov edi, eax
test edi, edi
jne 0x180123d0
mov eax, dword [ebp + 8]
sub eax, 1
je 0x1801238d
sub eax, 1
je 0x18012389
sub eax, 1
je 0x1801235d
sub eax, 1
je 0x1801234e
sub eax, 3
je 0x1801233b
sub eax, 4
je 0x18012329
mov edi, 0x8007065d
jmp 0x1801239d
push dword [ebx + 4]
lea ecx, [ebp - 0x14]
push dword [ebx]
push dword [ebp - 4]
call fcn.18012853
jmp 0x1801239b
push 7
push dword [ebp + 0x10]
lea ecx, [ebp - 0x14]
push ebx
push dword [ebp - 4]
call fcn.180128b8
jmp 0x1801239b
push dword [ebx]
lea ecx, [ebp - 0x14]
push dword [ebp - 4]
call fcn.1801282a
jmp 0x1801239b
mov eax, ebx
neg eax
sbb eax, eax
and eax, dword [ebp + 0x10]
push eax
push ebx
push 3
push 0
push dword [ebp - 4]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
jle 0x1801239d
movzx edi, di
or edi, 0x80070000
jmp 0x1801239d
push 2
jmp 0x1801238f
push 1
push ebx
push dword [ebp - 4]
lea ecx, [ebp - 0x14]
call fcn.1801287c
mov edi, eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
test eax, eax
je 0x180123c8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, eax
test ecx, ecx
jle 0x180123bc
movzx ecx, cx
or ecx, 0x80070000
xor eax, eax
mov dword [ebp - 0xc], 0x200
mov dword [ebp - 0x10], eax
test edi, edi
jne 0x180123d3
mov edi, ecx
jmp 0x180123d3
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], 0x180e49a8
test eax, eax
je 0x180123e5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esi - 0x10]
call fcn.18003140
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1801265f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
lea eax, [ebp - 4]
push eax
xor ecx, ecx
lea eax, [ebp - 8]
push ecx
push eax
push ecx
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push dword [edi + 4]
mov dword [ebp - 8], ecx
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
mov esi, eax
test esi, esi
jle 0x18012697
movzx esi, si
or esi, 0x80070000
test esi, esi
jne 0x180126ee
mov eax, dword [ebp - 4]
xor ecx, ecx
shr eax, 1
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.180a6a99
cmp dword [ebp - 4], 0
pop ecx
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
je 0x180126e9
lea eax, [ebp - 4]
push eax
push ecx
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
mov esi, eax
test esi, esi
jle 0x180126ee
movzx esi, si
or esi, 0x80070000
jmp 0x180126ee
xor eax, eax
mov word [ecx], ax
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x180126f6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov ebx, ecx
lea eax, [ebp - 4]
push eax
xor ecx, ecx
lea eax, [ebp - 8]
push ecx
push eax
push ecx
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push dword [ebx + 4]
mov dword [ebp - 8], ecx
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
mov esi, eax
test esi, esi
jle 0x1801272e
movzx esi, si
or esi, 0x80070000
test esi, esi
jne 0x180127a2
mov edx, dword [ebp - 4]
test edx, edx
je 0x1801279a
shr edx, 1
add edx, 1
js 0x180127aa
push edi
mov edi, dword [ebp + 0xc]
xor ecx, ecx
inc ecx
mov esi, dword [edi]
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or ecx, eax
jge 0x1801275d
push edx
mov ecx, edi
call fcn.18006135
mov esi, dword [edi]
test esi, esi
jne 0x18012768
mov esi, 0x8007000e
jmp 0x1801278e
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ebx + 4]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
mov esi, eax
test esi, esi
jle 0x1801278e
movzx esi, si
or esi, 0x80070000
push 0xffffffffffffffff
mov ecx, edi
call fcn.18005c62
pop edi
jmp 0x180127a2
mov ecx, dword [ebp + 0xc]
call fcn.18005cb1
mov eax, esi
pop esi
pop ebx
leave
ret 8
push 0x80070057
call fcn.18002f74
int3

Function at 0x18012cb8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x180fd00c]
xor eax, esp
mov dword [esp + 0x228], eax
mov eax, dword [ecx + 8]
mov edx, dword [ebp + 8]
or eax, 0xf003f
and dword [esp + 8], 0
push esi
push eax
push edx
push dword [ecx + 4]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], edx
mov dword [esp + 0x14], 0x180e49a8
mov dword [esp + 0x1c], 0x200
call fcn.18012186
mov esi, eax
cmp esi, 0x80070002
je 0x18012d1b
cmp esi, 0x80070003
jne 0x18012d5e
xor esi, esi
inc esi
cmp dword [esp + 0xc], 0
mov dword [esp + 8], 0x180e49a8
je 0x18012d37
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.180a61d8
mov esp, ebp
pop ebp
ret 4
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0xc]
call fcn.18012cb8
mov esi, eax
test esi, esi
jne 0x18012d1e
lea eax, [esp + 0x20]
mov dword [esp + 0x14], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x18012d4e
cmp dword [esp + 0xc], esi
je 0x18012da7
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x200
push dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
call fcn.18011fe0
mov esi, eax
jmp 0x18012d1e