joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402470
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov qword [rbp - 8], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x40], 0
mov ecx, 0x30
call sub.msvcrt.dll_malloc
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x4024af
mov eax, 0
jmp 0x4026fb
mov rax, qword [rbp - 8]
mov qword [rax], 0
mov rax, qword [rbp - 8]
mov qword [rax + 8], 0
mov dword [rbp - 0x30], 0x18
mov qword [rbp - 0x28], 0
mov dword [rbp - 0x20], 1
mov rax, qword [rbp - 8]
lea rcx, [rbp - 0x30]
lea rdx, [rbp - 0x40]
mov r9d, 0
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreatePipe]
call rax
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0
jne 0x40255e
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov r8d, 0xa
lea rdx, [0x0040ba50]
mov ecx, eax
call sub.msvcrt.dll__itoa
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
lea rcx, str.Failed_to_create_shell_stdout_pipe__error___s
call fcn.004034eb
jmp 0x402678
mov rax, qword [rbp - 8]
lea rdx, [rax + 8]
lea rcx, [rbp - 0x30]
lea rax, [rbp - 0x38]
mov r9d, 0
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreatePipe]
call rax
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0
jne 0x4025e4
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov r8d, 0xa
lea rdx, [0x0040ba50]
mov ecx, eax
call sub.msvcrt.dll__itoa
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
lea rcx, str.Failed_to_create_shell_stdin_pipe__error___s
call fcn.004034eb
jmp 0x402678
mov rdx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x38]
mov rcx, rax
call fcn.00402ae4
mov rdx, qword [rbp - 8]
mov qword [rdx + 0x10], rax
mov rax, qword [rbp - 0x38]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x402663
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rcx, str.Failed_to_execute_shell
call fcn.004034eb
jmp 0x402678
mov rax, qword [rbp - 8]
mov qword [rax + 0x18], 0xffffffffffffffff
mov rax, qword [rbp - 8]
jmp 0x4026fb
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x402691
mov rax, qword [rbp - 0x38]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x40]
test rax, rax
je 0x4026aa
mov rax, qword [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 8]
mov rax, qword [rax]
test rax, rax
je 0x4026c9
mov rax, qword [rbp - 8]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
test rax, rax
je 0x4026ea
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
call sub.msvcrt.dll_free
mov eax, 0
leave
ret
Function at 0x402ae4
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Create process suspended

Disassembly:
push rbp
mov rbp, rsp
push rbx
sub rsp, 0xe8
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp - 0x18], 0
mov dword [rbp - 0xa0], 0x68
mov qword [rbp - 0x98], 0
mov qword [rbp - 0x88], 0
mov qword [rbp - 0x90], 0
mov dword [rbp - 0x74], 0
mov eax, dword [rbp - 0x74]
mov dword [rbp - 0x78], eax
mov eax, dword [rbp - 0x78]
mov dword [rbp - 0x7c], eax
mov eax, dword [rbp - 0x7c]
mov dword [rbp - 0x80], eax
mov word [rbp - 0x60], 0
mov qword [rbp - 0x58], 0
mov word [rbp - 0x5e], 0
mov dword [rbp - 0x64], 0x101
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x48], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
lea rdx, [rbp - 0xa0]
lea rcx, [rdx + 0x60]
mov rdx, qword [rbp + 0x18]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 2
mov r9, rcx
mov r8, rbx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DuplicateHandle]
call rax
mov rax, qword [0x0040b0e8]
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0xa0]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
je 0x402c36
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x402c89
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov r8d, 0xa
lea rdx, [0x0040ba50]
mov ecx, eax
call sub.msvcrt.dll__itoa
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
lea rcx, str.Failed_to_execute_shell__error___s
call fcn.004034eb
mov rax, qword [rbp - 0x18]
add rsp, 0xe8
pop rbx
leave
ret

Function at 0x402f70
Capabilities:
Initialize winsock library

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1c0
mov word [rbp - 2], 0x101
movzx eax, word [rbp - 2]
lea rdx, [rbp - 0x1a0]
mov ecx, eax
mov rax, qword [sym.imp.WSOCK32.dll_WSAStartup]
call rax
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 0
jne 0x402fc6
movzx eax, word [rbp - 0x1a0]
cmp al, 1
jne 0x402fba
movzx eax, word [rbp - 0x1a0]
shr ax, 8
cmp al, 1
je 0x402fc7
mov rax, qword [sym.imp.WSOCK32.dll_WSACleanup]
call rax
nop
jmp 0x402fc7
nop
leave
ret
Function at 0x404773
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
push rbx
sub rsp, 0x28
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov rdx, qword [0x0040bba8]
mov eax, dword [rbp + 0x10]
cdqe
mov r9d, 0
mov r8d, 1
mov rcx, rax
mov rax, qword [sym.imp.WSOCK32.dll_send]
call rax
mov ebx, eax
cmp ebx, 1
je 0x4047c7
mov rax, qword [sym.imp.msvcrt.dll__errno]
call rax
mov eax, dword [rax]
mov edx, eax
lea rcx, str.udptest_first_write_failed___errno__d
call fcn.004034eb
mov eax, dword [0x0040b0dc]
test eax, eax
je 0x4047e4
mov eax, dword [0x0040b0dc]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__sleep]
call rax
jmp 0x40485a
mov word [0x0040b0d8], 0
mov dword [0x0040b0dc], 5
mov rax, qword [rbp + 0x18]
mov r9d, 0
mov r8d, 0
mov edx, 0x7a69
mov rcx, rax
call fcn.00403ec7
mov ebx, eax
test ebx, ebx
jle 0x404830
mov eax, dword [rbp + 0x10]
cdqe
mov edx, 2
mov rcx, rax
mov rax, qword [sym.imp.WSOCK32.dll_shutdown]
call rax
movsxd rax, ebx
mov rcx, rax
mov rax, qword [sym.imp.WSOCK32.dll_closesocket]
call rax
mov dword [0x0040b0dc], 0
movzx eax, word [0x0040b0d8]
add eax, 1
mov word [0x0040b0d8], ax
mov rax, qword [sym.imp.msvcrt.dll__errno]
call rax
mov dword [rax], 0
mov rdx, qword [0x0040bba8]
mov eax, dword [rbp + 0x10]
cdqe
mov r9d, 0
mov r8d, 1
mov rcx, rax
mov rax, qword [sym.imp.WSOCK32.dll_send]
call rax
mov ebx, eax
cmp ebx, 1
jne 0x404899
mov eax, dword [rbp + 0x10]
jmp 0x4048c5
mov eax, dword [rbp + 0x10]
cdqe
mov edx, 2
mov rcx, rax
mov rax, qword [sym.imp.WSOCK32.dll_shutdown]
call rax
mov eax, dword [rbp + 0x10]
cdqe
mov rcx, rax
mov rax, qword [sym.imp.WSOCK32.dll_closesocket]
call rax
mov eax, 0xffffffff
add rsp, 0x28
pop rbx
leave
ret

Function at 0x404abb
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov edi, 0
mov rbx, qword [rbp + 0x10]
mov esi, dword [rbp + 0x18]
jmp 0x404b6b
movzx eax, byte [rbx]
cmp al, 0xff
jne 0x404b63
mov byte [0x0040b0f2], 0xff
add rbx, 1
sub esi, 1
movzx eax, byte [rbx]
cmp al, 0xfb
je 0x404b01
movzx eax, byte [rbx]
cmp al, 0xfc
jne 0x404b06
mov edi, 0xfffffffe
movzx eax, byte [rbx]
cmp al, 0xfd
je 0x404b14
movzx eax, byte [rbx]
cmp al, 0xfe
jne 0x404b19
mov edi, 0xfffffffc
test dil, dil
je 0x404b64
mov byte [0x0040b0f3], dil
add rbx, 1
sub esi, 1
movzx eax, byte [rbx]
mov byte [0x0040b0f4], al
lea rdx, [0x0040b0f2]
mov eax, dword [0x00408010]
cdqe
mov r9d, 0
mov r8d, 3
mov rcx, rax
mov rax, qword [sym.imp.WSOCK32.dll_send]
call rax
mov edi, 0
jmp 0x404b64
nop
add rbx, 1
sub esi, 1
test esi, esi
jg 0x404ade
add rsp, 0x28
pop rbx
pop rsi
pop rdi
leave
ret
Function at 0x406490
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub rsp, 0x98
test r8, r8
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rbx, r8
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rbp
mov rsi, rcx
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], r13
mov rdi, rdx
mov qword [rsp + 0x90], r14
jne 0x406505
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov r13, qword [rsp + 0x88]
mov r14, qword [rsp + 0x90]
add rsp, 0x98
ret
lea rdx, [rsp + 0x20]
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4065b1
mov eax, dword [rsp + 0x44]
cmp eax, 4
jne 0x406540
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_memcpy
jmp 0x4064d1
cmp eax, 0x40
je 0x406528
lea r12, [rsp + 0x5c]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r9, r12
call rbp
mov eax, dword [rsp + 0x44]
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
cmp eax, 0x40
setne r13b
cmp eax, 4
setne r14b
call sub.msvcrt.dll_memcpy
test r14b, r14b
je 0x4064d1
test r13b, r13b
je 0x4064d1
mov r9, r12
mov r8d, dword [rsp + 0x5c]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call rbp
jmp 0x4064d1
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, rsi
mov edx, 0x30
call fcn.00406430
nop word cs:[rax + rax]

Function at 0x406e30
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov eax, dword [0x0040b9c0]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rbp
test eax, eax
jne 0x406e70
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rcx, [0x0040b9e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0040ba08]
test rbx, rbx
je 0x406ec4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop word [rax + rax]
mov ecx, dword [rbx]
call rdi
mov rbp, rax
call rsi
test eax, eax
jne 0x406ebb
test rbp, rbp
je 0x406ebb
mov rax, qword [rbx + 8]
mov rcx, rbp
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x406ea0
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x28]
lea rcx, [0x0040b9e0]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
jmp rax
Function at 0x407150
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rsi
xor ebx, ebx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rbp
mov rsi, rcx
call sub.msvcrt.dll_strlen
cmp rax, 8
jbe 0x407194
mov rax, rbx
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp word [0x00400000], 0x5a4d
jne 0x407178
movsxd rdx, dword [0x0040003c]
lea rax, [0x00400000]
lea rax, [rdx + rax]
cmp dword [rax], 0x4550
jne 0x407178
cmp word [rax + 0x18], 0x20b
jne 0x407178
movzx ebp, word [rax + 6]
movzx edx, word [rax + 0x14]
test ebp, ebp
je 0x407178
movzx edx, dx
xor edi, edi
lea rbx, [rax + rdx + 0x18]
jmp 0x4071e4
add rbx, 0x28
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sub.msvcrt.dll_strncmp
test eax, eax
je 0x407178
add edi, 1
cmp edi, ebp
jb 0x4071e0
xor ebx, ebx
jmp 0x407178

Function at 0x407210
Capabilities:
Parse pe header

Disassembly:
sub rsp, 8
xor eax, eax
cmp word [0x00400000], 0x5a4d
je 0x407230
add rsp, 8
ret
movsxd r8, dword [0x0040003c]
lea rdx, [0x00400000]
lea rdx, [r8 + rdx]
cmp dword [rdx], 0x4550
jne 0x407221
cmp word [rdx + 0x18], 0x20b
jne 0x407221
movzx r8d, word [rdx + 6]
movzx r9d, word [rdx + 0x14]
test r8d, r8d
je 0x407221
movzx r9d, r9w
lea rax, [rdx + r9 + 0x18]
xor edx, edx
jmp 0x407274
add rax, 0x28
test byte [rax + 0x27], 0x20
je 0x407283
test rcx, rcx
je 0x407221
sub rcx, 1
add edx, 1
cmp edx, r8d
jb 0x407270
xor eax, eax
jmp 0x407221

Function at 0x407290
Capabilities:
Parse pe header

Disassembly:
sub rsp, 8
xor eax, eax
cmp word [0x00400000], 0x5a4d
lea rdx, [0x00400000]
je 0x4072b0
add rsp, 8
ret
movsxd rcx, dword [0x0040003c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x4072a8
cmp word [rcx + 0x18], 0x20b
cmove rax, rdx
jmp 0x4072a8
Function at 0x1800021a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov esi, edx
mov rdi, rcx
xor r14d, r14d
mov dword [rbp - 0x50], r14d
lea rcx, [rbp - 0x30]
call fcn.1800011a0
nop
call fcn.180002c40
mov rcx, rax
test rax, rax
je 0x180002398
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
mov dword [rbp - 0x50], 1
call fcn.180002c40
mov rcx, rax
test rax, rax
je 0x180002382
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x48], rbx
mov dword [rbp - 0x50], 3
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x1000
or eax, ecx
jge 0x180002244
mov edx, 0x1000
lea rcx, [rbp - 0x48]
call fcn.180004d30
mov rbx, qword [rbp - 0x48]
mov dword [rbp + 0x40], 0x2000
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x48]
xor r8d, r8d
lea rdx, str.AppDataPath
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000228e
mov eax, dword [rbp + 0x48]
dec eax
cmp eax, 1
ja 0x18000228e
test rbx, rbx
je 0x18000228e
cmp dword [rbp + 0x40], 0
jne 0x18000228e
mov word [rbx], r14w
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.18000e100
test eax, eax
js 0x18000238d
cmp eax, dword [rbx - 0xc]
jg 0x18000238d
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r14w
lea rdx, [rbp - 0x48]
mov rcx, rdi
call fcn.180001340
mov dword [rbp - 0x50], 1
lea rdx, [rbx - 0x18]
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800022e6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rdi]
cmp dword [rax - 0x10], 0
jne 0x180002325
mov edx, esi
lea rcx, [rbp - 0x40]
call fcn.180003000
nop
mov rdx, rax
mov rcx, rdi
call fcn.180001340
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180002325
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rax, vtable.CCfgOPBaseT_int_.0
mov qword [rbp - 0x30], rax
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x180002343
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x28], r14
mov dword [rbp - 0x20], r14d
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x180002362
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x180002371
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.1800016f0
int3
mov ecx, 0x80070057
call fcn.1800016f0
nop
mov ecx, 0x80004005
call fcn.1800016f0
int3
Function at 0x1800057f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x180005865
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x180005865
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x180005855
nop
cmp rbx, rcx
jae 0x180005865
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x180005840
cmp rbx, rcx
jae 0x180005865
cmp word [rbx], 0
je 0x180005865
mov rax, rbx
jmp 0x180005867
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800059a0
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x20
mov rax, rdx
mov ebx, ecx
test rdx, rdx
je 0x1800059dc
mov r8d, 5
lea rdx, str.user
mov rcx, rax
call fcn.18000e4f8
movzx edx, byte [0x18002fe18]
test eax, eax
mov ecx, 1
cmove edx, ecx
mov byte [0x18002fe18], dl
test ebx, ebx
je 0x1800059f8
call sym.Shell.DLL_DllRegisterServer
mov ebx, eax
test eax, eax
jns 0x180005a02
call sym.Shell.DLL_DllUnregisterServer
mov eax, ebx
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp sym.Shell.DLL_DllUnregisterServer
add rsp, 0x20
pop rbx
ret
Function at 0x180005ff0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
xor ecx, ecx
call fcn.180004f30
xor edi, edi
lea rbx, str._shellexContextMenuHandlersCouponShell
nop word [rax + rax]
mov rdx, qword [rbx]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
inc edi
lea rbx, [rbx + 8]
cmp edi, 4
jb 0x180006010
call fcn.180002c40
mov rcx, rax
test rax, rax
je 0x18000609d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
lea r8, str.CouponShell
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers_s
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
call fcn.180001fb0
mov rbx, qword [rsp + 0x30]
mov rcx, 0xffffffff80000002
mov rdx, rbx
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180006090
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80004005
call fcn.1800016f0
int3

Function at 0x1800061c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x58
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
xor ebp, ebp
mov dword [rcx + 0x10], ebp
lea rax, vtable.CShellExt.0
mov qword [rcx], rax
lea rax, vtable.CShellExt.1.0
mov qword [rcx + 8], rax
call fcn.180002c40
mov rcx, rax
test rax, rax
je 0x18000634b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx + 0x78], rax
mov dword [rbx + 0x14], 0xffffffff
mov qword [rbx + 0x80], rbp
mov qword [rbx + 0x88], rbp
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x88], 0x60
lea ecx, [rbp + 0x31]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
mov r9d, 0x20119
lea r8, str.Control_PanelDesktopWindowMetrics
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x38]
call fcn.180004bd0
mov rdi, qword [rsp + 0x38]
test eax, eax
jne 0x1800062c2
mov dword [rsp + 0x90], 4
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x98]
xor r8d, r8d
lea rdx, str.AppliedDPI
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test rdi, rdi
je 0x1800062c2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, ebp
mov eax, dword [rsp + 0x88]
cmp eax, 0x60
je 0x1800062f4
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x180022170]
mulsd xmm0, qword [0x180022168]
cvttsd2si esi, xmm0
mov eax, 0x30
cmp esi, eax
cmovg esi, eax
cmp qword [rbx + 0x88], 0
jne 0x180006328
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], esi
mov r9d, esi
mov edx, 0xcc
mov r8d, 1
mov rcx, qword [0x18002fe00]
call qword [sym.imp.USER32.dll_LoadImageW]
mov qword [rbx + 0x88], rax
test rdi, rdi
je 0x180006336
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.180008d20
nop
mov rax, rbx
add rsp, 0x58
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.1800016f0
int3
Function at 0x180006790
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov esi, edx
mov rdi, rcx
xor r14d, r14d
mov dword [rbp - 0x50], r14d
lea rcx, [rbp - 0x30]
call fcn.1800011a0
nop
call fcn.180002c40
mov rcx, rax
test rax, rax
je 0x180006988
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
mov dword [rbp - 0x50], 1
call fcn.180002c40
mov rcx, rax
test rax, rax
je 0x180006972
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x48], rbx
mov dword [rbp - 0x50], 3
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x1000
or eax, ecx
jge 0x180006834
mov edx, 0x1000
lea rcx, [rbp - 0x48]
call fcn.180004d30
mov rbx, qword [rbp - 0x48]
mov dword [rbp + 0x40], 0x2000
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x48]
xor r8d, r8d
lea rdx, str.AppDataPath
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000687e
mov eax, dword [rbp + 0x48]
dec eax
cmp eax, 1
ja 0x18000687e
test rbx, rbx
je 0x18000687e
cmp dword [rbp + 0x40], 0
jne 0x18000687e
mov word [rbx], r14w
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.18000e100
test eax, eax
js 0x18000697d
cmp eax, dword [rbx - 0xc]
jg 0x18000697d
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r14w
lea rdx, [rbp - 0x48]
mov rcx, rdi
call fcn.180001340
mov dword [rbp - 0x50], 1
lea rdx, [rbx - 0x18]
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800068d6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rdi]
cmp dword [rax - 0x10], 0
jne 0x180006915
mov edx, esi
lea rcx, [rbp - 0x40]
call fcn.180007850
nop
mov rdx, rax
mov rcx, rdi
call fcn.180001340
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180006915
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rax, vtable.CCfgOPBaseT_int_.0
mov qword [rbp - 0x30], rax
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x180006933
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x28], r14
mov dword [rbp - 0x20], r14d
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x180006952
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x180006961
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.1800016f0
int3
mov ecx, 0x80070057
call fcn.1800016f0
nop
mov ecx, 0x80004005
call fcn.1800016f0
int3