joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140018300
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.140042190
sub rsp, rax
mov rax, qword [0x14005a040]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov word [rsp + 0x30], bp
lea edi, [rbp + 0x28]
test al, al
je 0x1400183b2
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.140036680
cmp rax, 1
jne 0x14001840e
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14001838f
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140018383
cmp rcx, 1
jb 0x14001840e
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140018350
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x1400183e3
lea rcx, [rsp + 0x80]
call fcn.140037a8c
jmp 0x1400183e5
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.140026c50
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.14002b270
int3

Function at 0x140018420
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14005a040]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor ebp, ebp
lea rsi, str.NUITKA_PYTHONPATH
mov word [rsp + 0x30], bp
lea rbx, [rsp + 0x30]
mov al, 0x4e
lea edi, [rbp + 0x28]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.140036680
cmp rax, 1
jne 0x1400184f5
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14001849c
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140018490
cmp rcx, 1
jb 0x1400184f5
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140018461
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140026c50
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14002b270
int3
Function at 0x140027658
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400276a2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400276a2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400276a2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400276a2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400276a2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400276a4
xor al, al
add rsp, 0x28
ret

Function at 0x14002b5dc
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002b43b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002b43b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002b43b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002b43b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002b43b
cmp dword [rcx + 0x84], 0xe
jbe 0x14002b43b
cmp dword [rcx + 0xf8], 0
je 0x14002b43b
mov ecx, ebx
call fcn.14002b4f8
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14002b2c8
nop
cmp dword [rbp + 0x20], 0
je 0x14002b489
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14002b494
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002b3cc
Function at 0x14003c32c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14003c3b3
mov rsi, rbx
cmp word [rax], bp
je 0x14003c372
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14003c35c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14003c358
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140039f78
mov rdi, rax
test rax, rax
je 0x14003c3a0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140042770
mov rbp, rdi
xor ecx, ecx
call fcn.1400380d4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400420a0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400420c8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400420c8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140010000
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rax, rsp
mov rbp, rsp
sub rsp, 0x10
movaps xmmword [rsp], xmm6
sub rsp, 0x10
movaps xmmword [rsp], xmm7
mov r10, rcx
mov r11, rdx
push r12
mov r12, r8
push rsi
push rdi
mov rsi, r12
mov rdx, r11
mov rdi, r10
mov eax, 2
movdqa xmm4, xmmword [rsi]
movdqa xmm5, xmmword [rsi + 0x10]
movdqa xmm6, xmmword [rsi + 0x20]
movdqa xmm7, xmmword [rsi + 0x30]
movdqa xmm0, xmm4
movdqa xmm1, xmm5
movdqa xmm2, xmm6
movdqa xmm3, xmm7
psraw xmm4, 0xf
psraw xmm5, 0xf
psraw xmm6, 0xf
psraw xmm7, 0xf
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
psubw xmm0, xmm4
psubw xmm1, xmm5
psubw xmm2, xmm6
psubw xmm3, xmm7
paddw xmm0, xmmword [rdx + 0x80]
paddw xmm1, xmmword [rdx + 0x90]
paddw xmm2, xmmword [rdx + 0xa0]
paddw xmm3, xmmword [rdx + 0xb0]
pmulhuw xmm0, xmmword [rdx]
pmulhuw xmm1, xmmword [rdx + 0x10]
pmulhuw xmm2, xmmword [rdx + 0x20]
pmulhuw xmm3, xmmword [rdx + 0x30]
pmulhuw xmm0, xmmword [rdx + 0x100]
pmulhuw xmm1, xmmword [rdx + 0x110]
pmulhuw xmm2, xmmword [rdx + 0x120]
pmulhuw xmm3, xmmword [rdx + 0x130]
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
psubw xmm0, xmm4
psubw xmm1, xmm5
psubw xmm2, xmm6
psubw xmm3, xmm7
movdqa xmmword [rdi], xmm0
movdqa xmmword [rdi + 0x10], xmm1
movdqa xmmword [rdi + 0x20], xmm2
movdqa xmmword [rdi + 0x30], xmm3
add rsi, 0x40
add rdx, 0x40
add rdi, 0x40
dec rax
jne 0x140010032
pop rdi
pop rsi
pop r12
movaps xmm7, xmmword [rsp]
add rsp, 0x10
movaps xmm6, xmmword [rsp]
add rsp, 0x10
pop rbp
ret
Function at 0x140018d00
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rsi
push rdi
sub rsp, 0xc88
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0xc60], rax
mov rdi, r8
mov rsi, rcx
cmp edx, dword [rcx + 0x10]
jg 0x140018ee1
cmp byte [rcx + 9], 0
jne 0x140018d4a
cmp byte [rcx + 0xa], 0
jne 0x140018d4a
cmp byte [rcx + 8], 0
je 0x140018ee1
mov qword [rsp + 0xc80], rbx
xor ecx, ecx
mov qword [rsp + 0xc78], rbp
lea rbp, [rsp + 0xcb8]
call fcn.140150920
lea rcx, [rsi + 0x328]
cmp rax, qword [rcx]
je 0x140018d88
mov qword [rcx], rax
call fcn.140162180
mov rdx, rax
mov rcx, rsi
call fcn.140078430
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140019d10
mov qword [rsp + 0x28], rbp
lea rdx, [rsp + 0x50]
xor ebp, ebp
mov r9, rdi
mov r8d, 0x400
mov qword [rsp + 0x20], rbp
mov rcx, qword [rax]
or rcx, 1
call fcn.140159920
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x140018e3f
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0x860]
mov dword [rsp + 0x28], 0x400
mov r9d, 0x400
mov r8d, ebx
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140018e12
mov r8d, ebx
lea rdx, str.error_code_0x_08X
lea rcx, [rsp + 0x860]
call fcn.14002d0c0
lea r8, [0x1401fb404]
mov edx, 0x801
lea rcx, [rsp + 0x50]
call fcn.140150860
lea r8, [rsp + 0x860]
mov edx, 0x801
lea rcx, [rsp + 0x50]
call fcn.140150860
cmp byte [rsi + 9], bpl
je 0x140018e50
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rbx, 0xffffffffffffffff
cmp byte [rsi + 0xa], bpl
je 0x140018e94
lea rax, [rsp + 0x50]
mov rdi, rbx
inc rdi
cmp byte [rax + rdi], bpl
jne 0x140018e65
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
cmp byte [rsi + 8], bpl
je 0x140018ed1
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x140018ed1
lea rax, [rsp + 0x50]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], bpl
jne 0x140018eb0
mov r8, rbx
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0xc80]
mov rbp, qword [rsp + 0xc78]
mov rcx, qword [rsp + 0xc60]
xor rcx, rsp
call fcn.140147af0
add rsp, 0xc88
pop rdi
pop rsi
ret
Function at 0x140018f00
Capabilities:
Check os version
Create process on windows

Disassembly:
sub rsp, 0x258
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x90], __WSAFDIsSet
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x94], 6
jb 0x140018fb0
mov r8d, 0x104
lea rdx, [rsp + 0x130]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rsp + 0x20], WSAStartup
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x130]
mov qword [rsp + 0x38], rax
lea rax, str._softwarecad
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x258
ret
Function at 0x14001a410
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x310]
test rcx, rcx
je 0x14001a42b
call qword [rbx + 0x2e8]
mov rcx, qword [rbx + 0x318]
test rcx, rcx
je 0x14001a43d
call qword [rbx + 0x2e8]
xor eax, eax
mov qword [rbx + 0x310], rax
mov qword [rbx + 0x318], rax
mov byte [rbx + 0x38], al
call qword [rbx + 0x2b8]
test eax, eax
je 0x14001a493
mov rcx, qword [rbx + 0x1a0]
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
lea rcx, [rbx + 0x1a8]
setne dil
cmp byte [rcx], 0
je 0x14001a484
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
movzx eax, dil
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14001a8c0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
lea rax, vtable.DeskDupEngine.0
mov qword [rcx], rax
xor esi, esi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rsi
mov qword [rcx + 0x20], rsi
mov qword [rcx + 0x70], rsi
mov qword [rcx + 0x78], rsi
mov qword [rcx + 0x80], rsi
mov qword [rcx + 0x88], rsi
mov byte [rcx + 0x2d], 1
mov qword [rcx + 0x30], rsi
mov qword [rcx + 0x38], rsi
mov qword [rcx + 0x40], rsi
mov qword [rcx + 0x48], rsi
mov qword [rcx + 0x50], rsi
mov qword [rcx + 0x58], rsi
mov qword [rcx + 0x60], rsi
mov qword [rcx + 0x68], rsi
lea edi, [rsi + 4]
mov r8w, 3
mov dx, 1
mov cx, 5
call fcn.140027490
mov ecx, 5
test al, al
cmovne edi, ecx
xor r8d, r8d
xor edx, edx
mov cx, 6
call fcn.140027490
mov ecx, 6
test al, al
cmovne edi, ecx
xor r8d, r8d
lea edx, [rsi + 2]
call fcn.140027490
test al, al
je 0x14001aaa8
mov dword [rbx + 8], 0xa
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14001a9d5
lea edx, [rsi + 0x5c]
lea rcx, [rsp + 0x30]
call fcn.140149b38
test rax, rax
je 0x14001aab9
mov byte [rax], sil
lea r8, str.ddengine64.dll
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140150860
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbx + 0x30], rax
test rax, rax
je 0x14001aaa2
lea rdx, str.StartW8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x38], rax
lea rdx, str.StartW8V2
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x40], rax
lea rdx, str.StopW8
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x48], rax
lea rdx, str.LockW8
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x50], rax
lea rdx, str.UnlockW8
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x58], rax
lea rdx, str.ShowCursorW8
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x60], rax
lea rdx, str.HideCursorW8
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x68], rax
cmp qword [rbx + 0x38], rsi
je 0x14001aaa2
cmp qword [rbx + 0x48], rsi
je 0x14001aaa2
cmp qword [rbx + 0x50], rsi
je 0x14001aaa2
cmp qword [rbx + 0x58], rsi
je 0x14001aaa2
cmp qword [rbx + 0x60], rsi
je 0x14001aaa2
test rax, rax
jne 0x14001aaab
mov byte [rbx + 0x2d], sil
jmp 0x14001aaab
mov dword [rbx + 8], edi
mov qword [rbx + 0x90], rsi
mov qword [rbx + 0x98], rsi
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140147af0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14001abf0
Capabilities:
Print debug messages
Read file via mapping
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x2d], 0
mov edi, r9d
mov rbx, rcx
mov dword [rcx + 0x28], 1
je 0x14001ada2
mov ecx, 0x4e
mov qword [rsp + 0x40], rsi
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4f
mov esi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, dword [rsp + 0x60]
jne 0x14001ac3c
cmp esi, edi
jne 0x14001ac3c
xor cl, cl
jmp 0x14001ac3e
mov cl, 1
mov r9, qword [rbx + 0x40]
mov rsi, qword [rsp + 0x40]
test r9, r9
je 0x14001ac87
mov eax, 0x3e8
cdq
idiv dword [rsp + 0x70]
movzx edx, byte [rsp + 0x68]
mov r8d, eax
call r9
test al, al
jne 0x14001ac9f
lea r8, str.DeskDupEngine::videoDriver_start_:_DDengine_V2_failed__not_supported_by_video_driver_n
mov edx, 8
lea rcx, vtable.VNCLog.0
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.140018d00
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x14001ac9f
call rax
test al, al
jne 0x14001ac9f
lea r8, str.DeskDupEngine::videoDriver_start_:_DDengine_failed__not_supported_by_video_driver_n
jmp 0x14001ac6c
cmp qword [rbx + 0x70], 0
jne 0x14001ada2
xor edx, edx
lea r8, str.3DA76AC7_62E7_44AF_A8D1_45022044BB3E
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov qword [rbx + 0x70], rax
test rax, rax
je 0x14001ada2
xor edi, edi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rcx, rax
lea edx, [rdi + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x78], rax
test rax, rax
je 0x14001ada2
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x80], rdi
jne 0x14001ada2
lea r8, str.0E3D996F_B070_4503_9090_198A9DA092D5
xor edx, edx
lea ecx, [rdi + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov qword [rbx + 0x80], rax
test rax, rax
je 0x14001ada2
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
lea edx, [rdi + 6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x88], rax
test rax, rax
je 0x14001ada2
cmp qword [rbx + 0x90], rdi
jne 0x14001ada2
lea r8, str.3BFBA3A0_2133_48B5_B5BD_E58C72853FFB
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov qword [rbx + 0x90], rax
test rax, rax
je 0x14001ada2
cmp qword [rbx + 0x98], rdi
jne 0x14001ada2
lea r8, str.3A77E11C_B0B4_40F9_BC8B_D249116A76FE
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov qword [rbx + 0x98], rax
test rax, rax
je 0x14001ada2
mov rax, qword [rbx + 0x88]
mov qword [rbx + 0x18], rax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14001b670
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x38
mov rbx, rdx
lea rax, [rsp + 0x68]
xor edi, edi
mov qword [rsp + 0x20], rax
lea rdx, str.SystemCurrentControlSetControlProductOptions
mov qword [rsp + 0x68], rdi
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14001b7f4
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.ProductSuite
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x50], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001b7e9
mov ecx, dword [rsp + 0x50]
mov qword [rsp + 0x30], rsi
call fcn.140147b5c
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x60]
mov rsi, rax
lea rdx, str.ProductSuite
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001b7dc
mov rdi, rsi
cmp byte [rsi], al
je 0x14001b7dc
nop word [rax + rax]
lea rdx, str.Terminal_Server
mov rcx, rdi
call fcn.14015a460
test eax, eax
jne 0x14001b75c
or dword [rbx + 0x130], 0x10
jmp 0x14001b7c1
lea rdx, [0x1401efb00]
mov rcx, rdi
call fcn.14015a460
test eax, eax
je 0x14001b7ba
lea rdx, str.Small_Business
mov rcx, rdi
call fcn.14015a460
test eax, eax
je 0x14001b7ba
lea rdx, str.Enterprise
mov rcx, rdi
call fcn.14015a460
test eax, eax
jne 0x14001b79e
or dword [rbx + 0x130], 2
jmp 0x14001b7c1
lea rdx, str.Personal
mov rcx, rdi
call fcn.14015a460
test eax, eax
jne 0x14001b7c1
or dword [rbx + 0x130], 0x40
jmp 0x14001b7c1
or dword [rbx + 0x130], 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc rdi
movsxd rcx, eax
add rdi, rcx
cmp byte [rdi], 0
jne 0x14001b740
mov rcx, rsi
call fcn.140147b10
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x14001ebc0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x2c0
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rbx, rcx
lea rdx, [rsp + 0x1a0]
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [0x1401ea6b0]
mov edx, 0x104
lea rcx, [rsp + 0x90]
call fcn.140150800
lea r8, [0x1401f0c9c]
mov edx, 0x104
lea rcx, [rsp + 0x90]
call fcn.140150860
mov r8, rbx
lea rcx, [rsp + 0x90]
mov edx, 0x104
call fcn.140150860
xorps xmm0, xmm0
xor ebx, ebx
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSAStartup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x2c0
pop rbx
ret
Function at 0x140020c80
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSAStartup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [0x1401ea708]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x1b8
ret

Function at 0x140020d50
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSAStartup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [0x1401ea6f0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x1b8
ret

Function at 0x140020e20
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSAStartup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [0x1401ea6d0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x1b8
ret