joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800a4560
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [rsp + 0x90]
mov rbx, 0xffffffffffffffff
mov rax, rbx
mov qword [rsp + 0x30], r8
mov r15, r9
mov r14, r8
mov r10, rdx
nop
cmp word [rdi + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1800a45a0
mov rdx, qword [r14]
lea ebp, [rax*2 + 2]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
test eax, eax
sete sil
test eax, eax
jne 0x1800a461d
mov rcx, qword [rsp + 0x30]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], ebp
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
xor esi, esi
test eax, eax
sete sil
test rcx, rcx
je 0x1800a461d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x1800a4638
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800a5130
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800a65c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r10d, edx
mov r9, rcx
test rcx, rcx
je 0x1800a66fb
test edx, edx
je 0x1800a66fb
mov qword [rsp], rbx
lea rbx, [0x1801248b0]
mov eax, 0xffffffff
cmp r10d, 8
jb 0x1800a66c8
mov r11d, r10d
shr r11, 3
nop dword [rax]
movzx edx, byte [r9]
mov ecx, eax
xor rdx, rcx
shr eax, 8
movzx ecx, dl
add r10d, 0xfffffff8
mov edx, dword [rbx + rcx*4]
movzx ecx, byte [r9 + 1]
xor edx, eax
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 2]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 3]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 4]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 5]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 6]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 7]
add r9, 8
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov eax, dword [rbx + rax*4]
xor eax, edx
sub r11, 1
jne 0x1800a6600
test r10d, r10d
je 0x1800a66f0
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov ecx, eax
xor rdx, rcx
shr ecx, 8
movzx r8d, dl
mov eax, dword [rbx + r8*4]
xor eax, ecx
add r10d, 0xffffffff
jne 0x1800a66d0
mov rbx, qword [rsp]
not eax
add rsp, 8
ret
xor eax, eax
add rsp, 8
ret
Function at 0x1800a6c10
Capabilities:
Check if file exists

Disassembly:
push rsi
push r14
sub rsp, 0x268
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov r14, rdx
mov rsi, rcx
test rcx, rcx
je 0x1800a6e08
cmp dword [rcx], 2
jne 0x1800a6e08
cmp qword [rdx + 0x18], 8
mov qword [rsp + 0x290], rbx
jb 0x1800a6c57
mov r14, qword [rdx]
cmp dword [rcx + 0x20], 0
je 0x1800a6c6e
xor ebx, ebx
mov eax, ebx
mov rbx, qword [rsp + 0x290]
jmp 0x1800a6e0a
test r14, r14
je 0x1800a6c5d
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1800a6c8f
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
jne 0x1800a6c5d
mov rcx, qword [rsi + 0x38]
xor ebx, ebx
mov qword [rsp + 0x260], rbp
movabs rax, 0xa3d70a3d70a3d70b
mov qword [rsp + 0x258], rdi
mov ebp, 1
mov rdi, qword [rsi + 0x30]
sub rcx, rdi
mov qword [rsp + 0x250], r12
imul rcx
mov r12d, ebx
add rdx, rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1800a6de2
mov qword [rsp + 0x248], r13
lea r13d, [rbp + 0x5b]
mov qword [rsp + 0x240], r15
mov r15d, ebx
nop word [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1800d4600
lea r8, [rdi + 8]
mov rdx, r14
add r8, r15
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rax, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], bx
jne 0x1800a6d33
mov rax, rbx
test rcx, rcx
je 0x1800a6d5a
cmp word [rsp + rax*2 + 0x20], 0x2f
jne 0x1800a6d52
mov word [rsp + rax*2 + 0x20], r13w
inc rax
cmp rax, rcx
jb 0x1800a6d44
mov rax, qword [rsi + 0x30]
mov rcx, qword [rax + r15]
test byte [rcx + 0x26], 0x10
je 0x1800a6d77
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
jmp 0x1800a6d96
test ebp, ebp
je 0x1800a6d94
lea r8, [rsp + 0x20]
mov rdx, r12
mov rcx, rsi
call fcn.1800a6e30
mov ebp, 1
test eax, eax
jne 0x1800a6d96
mov ebp, ebx
mov rdi, qword [rsi + 0x30]
movabs rax, 0xa3d70a3d70a3d70b
mov rcx, qword [rsi + 0x38]
inc r12
sub rcx, rdi
add r15, 0x320
imul rcx
add rdx, rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r12, rdx
jb 0x1800a6d00
mov r15, qword [rsp + 0x240]
mov r13, qword [rsp + 0x248]
mov r12, qword [rsp + 0x250]
mov ebx, ebp
mov rdi, qword [rsp + 0x258]
mov eax, ebx
mov rbx, qword [rsp + 0x290]
mov rbp, qword [rsp + 0x260]
jmp 0x1800a6e0a
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x268
pop r14
pop rsi
ret
Function at 0x1800a72b0
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rdi, rcx
mov ecx, 0xa0
call fcn.1800a5060
mov rbx, rax
mov qword [rsp + 0x60], rax
xor esi, esi
test rax, rax
je 0x1800a7302
xor edx, edx
mov r8d, SHCreateDirectory
mov rcx, rax
call fcn.1800d4600
mov rcx, rbx
call fcn.1800a6310
mov rbx, rax
jmp 0x1800a7305
mov rbx, rsi
cmp qword [rdi + 0x18], 8
jb 0x1800a730f
mov rdi, qword [rdi]
test rdi, rdi
je 0x1800a73e2
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800a73e2
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1800a73e2
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbx + 0x24], eax
cmp eax, 0x16
jb 0x1800a73e2
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbx + 0x10], rax
cmp qword [rbx + 8], 0
je 0x1800a73e2
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x1800a73e2
mov r8d, dword [rbx + 0x24]
mov rdx, rax
mov rcx, rbx
call fcn.1800a6710
test eax, eax
je 0x1800a73e2
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
test rbx, rbx
je 0x1800a73fc
mov rcx, rbx
call fcn.1800a6400
mov edx, 0xa0
mov rcx, rbx
call fcn.1800a4c5c
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1800aae60
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x34], 1
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x34]
mov dword [rsp + 0x30], 0x208
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x48
ret

Function at 0x1800aaf90
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x50], rax
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x1800ab082
nop dword [rax]
lea rax, [rbx - 0x50000000]
cmp rax, 0x30000000
ja 0x1800aafe9
mov ebx, 0x4fff0000
jmp 0x1800ab079
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
lea r8d, [rax + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800ab082
cmp dword [rsp + 0x40], 0x10000
jne 0x1800ab05d
cmp qword [rsp + 0x38], 0x10000
jb 0x1800ab05d
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1800ab084
sub rbx, 0x10000
jmp 0x1800ab079
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x1800aafd0
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800a5130
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1800ab0a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x1800ab0d1
sub rbx, rax
add rbx, 0x10000
mov qword [rsp + 0x78], rsi
cmp rbx, rdi
jae 0x1800ab1a2
mov esi, 0x80010000
nop dword [rax]
nop dword [rax + rax]
lea rax, [rbx - 0x50000000]
cmp rax, 0x30000000
ja 0x1800ab107
mov rbx, rsi
jmp 0x1800ab199
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
lea r8d, [rax + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800ab1a2
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x1800ab17e
cmp rcx, 0x10000
jb 0x1800ab17e
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1800ab1a4
add rbx, 0x10000
jmp 0x1800ab199
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x1800ab199
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x1800ab0f0
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800a5130
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x1800ab1d0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
lea rdi, [rcx - 0x7ff80000]
mov rbx, rcx
cmp rcx, 0x7ff80000
ja 0x1800ab1f2
mov edi, 0x10000
mov qword [rsp + 0x38], rsi
lea rsi, [rcx + 0x7ff80000]
cmp rbx, 0xffffffff80000000
jb 0x1800ab20e
mov rsi, 0xfffffffffff80000
mov rax, qword [0x18017a040]
mov rcx, qword [0x18017a038]
mov qword [rsp + 0x30], rbp
test rax, rax
jne 0x1800ab235
test rcx, rcx
je 0x1800ab24c
mov rax, rcx
mov qword [0x18017a040], rcx
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x1800ab24c
cmp rdx, rdi
jb 0x1800ab24c
cmp rdx, rsi
jbe 0x1800ab379
mov qword [0x18017a040], rcx
mov rax, rcx
test rcx, rcx
je 0x1800ab287
test rcx, rcx
je 0x1800ab277
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x1800ab277
cmp rcx, rdi
jb 0x1800ab277
cmp rcx, rsi
jbe 0x1800ab379
mov rax, qword [rax + 8]
mov qword [0x18017a040], rax
test rax, rax
jne 0x1800ab260
movzx eax, bx
sub rbx, rax
cmp rbx, 0x40000000
jbe 0x1800ab2aa
lea rdx, [rbx - 0x40000000]
mov rcx, rdi
call fcn.1800aaf90
test rax, rax
jne 0x1800ab327
movabs rbp, 0xffffffff40000000
cmp rbx, rbp
jae 0x1800ab2cd
lea rcx, [rbx + 0x40000000]
mov rdx, rsi
call fcn.1800ab0a0
test rax, rax
jne 0x1800ab327
cmp rbx, 0x40000000
jbe 0x1800ab2ea
lea rcx, [rbx - 0x40000000]
mov rdx, rbx
call fcn.1800ab0a0
test rax, rax
jne 0x1800ab327
cmp rbx, rbp
jae 0x1800ab303
lea rdx, [rbx + 0x40000000]
mov rcx, rbx
call fcn.1800aaf90
test rax, rax
jne 0x1800ab327
mov rdx, rbx
mov rcx, rdi
call fcn.1800aaf90
test rax, rax
jne 0x1800ab327
mov rdx, rsi
mov rcx, rbx
call fcn.1800ab0a0
test rax, rax
je 0x1800ab3a5
mov dword [rax], 0x52727464
lea rdx, [rax + 0xffa8]
xor r8d, r8d
mov qword [0x18017a040], rax
mov qword [rax + 0x10], r8
mov r9d, 0x2a7
mov rcx, qword [0x18017a038]
mov qword [rax + 8], rcx
lea rcx, [rax + 0xff60]
mov qword [0x18017a038], rax
mov qword [rdx], r8
lea rdx, [rdx - 0x60]
mov r8, rcx
sub rcx, 0x60
sub r9, 1
jne 0x1800ab361
mov qword [rax + 0x10], r8
mov rbx, qword [rax + 0x10]
cmp rbx, rdi
jb 0x1800ab3a5
cmp rbx, rsi
ja 0x1800ab3a5
mov rcx, qword [rbx + 0x48]
mov edx, 0xcc
mov qword [rax + 0x10], rcx
mov rcx, rbx
lea r8d, [rdx - 0x6c]
call fcn.1800d4600
mov rax, rbx
jmp 0x1800ab3a7
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800ab3c0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x1800ab3fd
xor al, al
jmp 0x1800ab43b
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x1800ab40e
xor al, al
jmp 0x1800ab43b
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x1800ab435
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x1800ab435
mov al, 1
jmp 0x1800ab43b
xor al, al
jmp 0x1800ab43b
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x60
pop rbx
ret
Function at 0x1800ab910
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp dword [0x18017a050], 0
jne 0x1800ab9ab
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor eax, eax
lock cmpxchg dword [0x18017a050], ecx
jne 0x1800ab9ab
xor eax, eax
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18017a038]
mov qword [0x18017a068], rax
mov qword [0x18017a060], rax
mov dword [0x18017a054], eax
mov qword [0x18017a058], rax
test rbx, rbx
je 0x1800ab992
nop
lea r9, [rsp + 0x20]
mov edx, 0x10000
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x1800ab970
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x38
ret
mov eax, 0x10dd
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x38
ret
Function at 0x1800abf50
Capabilities:
Suspend thread

Disassembly:
push rdi
sub rsp, 0x20
mov eax, dword [0x18017a054]
mov rdi, rcx
test eax, eax
jne 0x1800abff3
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rdi, rax
jne 0x1800abf7a
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov ecx, 0x10
mov qword [rsp + 0x30], rbx
call fcn.1800a5060
mov rbx, rax
test rax, rax
jne 0x1800abf96
lea edi, [rax + 8]
jmp 0x1800abfb9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1800abfd7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov edx, 0x10
mov rcx, rbx
call fcn.1800a4c5c
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov dword [0x18017a054], edi
mov qword [0x18017a058], 0
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x18017a060]
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 8], rdi
mov qword [0x18017a060], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800ad5b0
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x480
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rdi, r9
mov rbx, rdx
mov rbp, rcx
mov qword [rsp + 0x40], r9
xor r14d, r14d
mov esi, r14d
test rdx, rdx
je 0x1800ad65d
cmp word [rdx], r14w
je 0x1800ad65d
test r8, r8
je 0x1800ad618
cmp word [r8], r14w
je 0x1800ad618
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x1800ad65d
jmp 0x1800ad658
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x60]
call fcn.1800d4600
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
mov r9d, 0x104
lea r8, [rsp + 0x60]
mov rdx, rbx
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x1800ad65d
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, 1
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1800ad6c2
mov eax, dword [rbp + 0x40]
test eax, eax
js 0x1800ad6c2
lea rcx, vtable._BaseModule::CAutoLocker.0
mov qword [rsp + 0x48], rcx
lea rbx, [rbp + 0x58]
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x1800ad692
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, dword [rbp + 0x40]
test eax, eax
js 0x1800ad6af
mov dword [rsp + 0x30], esi
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1800ad6f7
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x10]
nop
test rbx, rbx
je 0x1800ad6be
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1800ad6d7
mov rax, qword [rcx]
cmp rcx, rdi
setne dl
call qword [rax + 0x20]
mov qword [rdi + 0x38], r14
xor eax, eax
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x480
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1800764f0
nop
int3
Function at 0x1800af090
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x550
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x540], rax
mov ebx, edx
mov rdi, rcx
test rcx, rcx
je 0x1800af250
cmp ebx, 0x20
jb 0x1800af250
xor edx, edx
mov dword [rsp + 0x34], 1
mov r8d, 0x400
mov dword [rsp + 0x30], 0x400
lea rcx, [rsp + 0x140]
call fcn.1800d4600
lea rax, [rsp + 0x30]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x140]
lea r8, str.mid64
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareWow6432NodeComMaster
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x1800af250
lea rcx, [rsp + 0x140]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1800af140
cmp rax, 0x40
jne 0x1800af250
mov edx, 0x80
lea r9, [rsp + 0x140]
lea rax, [rsp + 0x40]
mov r8d, edx
sub r9, rax
lea rcx, [rsp + 0x40]
lea rax, [r8 - 0x60]
test rax, rax
je 0x1800af18d
movzx eax, byte [r9 + rcx]
test al, al
je 0x1800af18d
mov byte [rcx], al
inc rcx
sub r8, 1
jne 0x1800af170
test r8, r8
lea rax, [rcx - 1]
lea r9, [rsp + 0x160]
cmovne rax, rcx
lea rcx, [rsp + 0xc0]
mov byte [rax], 0
lea rax, [rsp + 0xc0]
sub r9, rax
nop word [rax + rax]
lea rax, [rdx + 0x7fffff7e]
test rax, rax
je 0x1800af1e0
movzx eax, byte [r9 + rcx]
test al, al
je 0x1800af1e0
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1800af1c0
test rdx, rdx
lea rax, [rcx - 1]
mov r8d, 0x400
cmovne rax, rcx
xor edx, edx
lea rcx, [rsp + 0x140]
mov byte [rax], 0
call fcn.1800d4600
mov r8d, 0x400
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x40]
call fcn.1800af280
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1800af250
mov rdx, rbx
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.1800b0230
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
jmp 0x1800af252
xor eax, eax
mov rcx, qword [rsp + 0x540]
xor rcx, rsp
call fcn.1800a5130
mov rbx, qword [rsp + 0x570]
add rsp, 0x550
pop rdi
ret
Function at 0x1800afc90
Capabilities:
Get storage device properties

Disassembly:
push rbp
push r14
mov eax, 0x2c88
call fcn.1800a51e0
sub rsp, rax
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x2c60], rax
mov r14d, edx
mov rbp, rcx
test rcx, rcx
je 0x1800afeb9
test edx, edx
je 0x1800afeb9
mov qword [rsp + 0x2ca8], rbx
mov qword [rsp + 0x2cb0], rsi
mov qword [rsp + 0x2cb8], rdi
mov qword [rsp + 0x2c80], r12
mov qword [rsp + 0x2c78], r13
mov r13d, 0x80070057
mov qword [rsp + 0x2c70], r15
xor r15d, r15d
mov ebx, r15d
mov edi, r15d
lea r12d, [r15 + 1]
nop dword [rax]
mov r9d, edi
lea r8, [0x180128cf0]
mov edx, 0x100
lea rcx, [rsp + 0x60]
call fcn.1800a4aa0
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
lea rcx, [rsp + 0x60]
xor edx, edx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800afe7a
xor eax, eax
mov dword [rsp + 0x40], r15d
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x550]
xor edx, edx
mov qword [rsp + 0x4c], rax
mov r8d, 0x2710
mov dword [rsp + 0x48], r15d
call fcn.1800d4600
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x48]
lea rax, [rsp + 0x550]
mov dword [rsp + 0x28], 0x2710
mov r9d, ntohs
mov qword [rsp + 0x20], rax
mov edx, 0x2d1400
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1800afe6d
xor edx, edx
lea rcx, [rsp + 0x160]
mov r8d, 0x3e8
call fcn.1800d4600
mov edx, dword [rsp + 0x568]
lea r9, [rsp + 0x160]
mov r8d, r12d
lea rcx, [rsp + 0x550]
call fcn.1800b0c30
lea rax, [r14 - 1]
mov ecx, r15d
cmp rax, 0x7ffffffe
mov rdx, r14
cmova ecx, r13d
test ecx, ecx
js 0x1800afe69
mov rax, rbp
test r14d, r14d
je 0x1800afe50
mov r8d, 0x7ffffffe
lea r9, [rsp + 0x160]
sub r8, rdx
sub r9, rbp
lea rcx, [r8 + rdx]
test rcx, rcx
je 0x1800afe50
movzx ecx, byte [r9 + rax]
test cl, cl
je 0x1800afe50
mov byte [rax], cl
inc rax
sub rdx, r12
jne 0x1800afe34
test rdx, rdx
lea rcx, [rax - 1]
cmovne rcx, rax
mov byte [rcx], r15b
mov ecx, 0x8007007a
cmovne ecx, r15d
test ecx, ecx
cmove ebx, r12d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x1800afe85
inc edi
cmp edi, 0x10
jl 0x1800afd10
mov r15, qword [rsp + 0x2c70]
mov eax, ebx
mov rbx, qword [rsp + 0x2ca8]
mov r13, qword [rsp + 0x2c78]
mov r12, qword [rsp + 0x2c80]
mov rdi, qword [rsp + 0x2cb8]
mov rsi, qword [rsp + 0x2cb0]
jmp 0x1800afebb
xor eax, eax
mov rcx, qword [rsp + 0x2c60]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x2c88
pop r14
pop rbp
ret
Function at 0x1800afee0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
test rcx, rcx
je 0x1800affae
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1800d4600
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1800affae
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x1800aff40
mov ecx, 0x103
mov eax, eax
sub rcx, rdx
cmp rax, rcx
jae 0x1800affae
lea rcx, [rsp + 0x20]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1800aff62
mov eax, dword [0x180128ce0]
mov dword [rcx], eax
lea rcx, [rsp + 0x20]
sub rcx, 2
nop
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1800aff80
xor edx, edx
nop dword [rax]
movzx eax, word [rbx + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1800aff90
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x1800affb0
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x240
pop rbx
ret