joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001b0c0
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x180037b10]
test rax, rax
jne 0x18001b155
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.360SD_8.8X
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x18001b134
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x180037b10], rax
test rax, rax
jne 0x18001b140
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180037b10]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x18001be10
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x2002
call fcn.1800251fc
mov rdi, rax
test rax, rax
je 0x18001becc
mov edx, 0x1000
mov rcx, rax
mov word [rax + 0x2000], 0
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x18001be6b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call sub.KERNEL32.dll_LocalFree
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rbx
mov ebp, eax
add ebp, ebp
mov edx, ebp
call fcn.180005b40
mov esi, eax
test eax, eax
jne 0x18001bec0
mov rcx, qword [rbx + 8]
movsxd r8, ebp
mov rdx, rdi
call fcn.18002525c
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
mov eax, esi
jmp 0x18001beab
mov eax, 8
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18001bee0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x2002
call fcn.1800251fc
mov rdi, rax
test rax, rax
je 0x18001bf9c
mov edx, 0x1000
mov rcx, rax
mov word [rax + 0x2000], 0
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x18001bf3b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call sub.KERNEL32.dll_LocalFree
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rbx
mov ebp, eax
add ebp, ebp
mov edx, ebp
call fcn.180005b40
mov esi, eax
test eax, eax
jne 0x18001bf90
mov rcx, qword [rbx + 8]
movsxd r8, ebp
mov rdx, rdi
call fcn.18002525c
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
mov eax, esi
jmp 0x18001bf7b
mov eax, 8
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18001c1b0
Capabilities:
Create directory

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [rdi], 0x5c
movsxd rbp, eax
jne 0x18001c213
cmp word [rdi + 2], 0x5c
jne 0x18001c213
mov ebx, 2
mov eax, ebx
cmp rbx, rbp
jge 0x18001c1f1
nop dword [rax]
cmp word [rdi + rax*2], 0x5c
je 0x18001c1f1
inc rax
inc ebx
cmp rax, rbp
jl 0x18001c1e0
inc ebx
movsxd rax, ebx
cmp rax, rbp
jge 0x18001c22e
nop dword [rax + rax]
cmp word [rdi + rax*2], 0x5c
je 0x18001c22e
inc rax
inc ebx
cmp rax, rbp
jl 0x18001c200
jmp 0x18001c22e
cmp word [rdi + 2], 0x3a
jne 0x18001c2b0
cmp word [rdi + 4], 0x5c
jne 0x18001c2b0
mov ebx, 3
mov qword [rsp + 0x40], rsi
movsxd rsi, ebx
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r13
cmp rsi, rbp
jge 0x18001c287
xor r13d, r13d
mov r12d, 0x5c
nop
cmp word [rdi + rsi*2], r12w
jne 0x18001c27d
xor edx, edx
mov rcx, rdi
mov word [rdi + rsi*2], r13w
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x18001c278
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x18001c2a0
mov word [rdi + rsi*2], r12w
inc rsi
inc ebx
cmp rsi, rbp
jl 0x18001c250
xor eax, eax
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r13, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
movsxd rax, ebx
mov word [rdi + rax*2], r12w
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18001c289
mov eax, 3
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x18001c720
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x2002
mov rbx, rdx
call fcn.1800251fc
mov rdi, rax
test rax, rax
je 0x18001c7e8
mov r8d, 0x1000
mov rdx, rax
mov rcx, rbx
mov word [rax + 0x2000], 0
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x18001c78c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call sub.KERNEL32.dll_LocalFree
mov eax, ebx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
mov qword [rsp + 0x30], rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rsi
mov ebp, eax
add ebp, ebp
mov edx, ebp
call fcn.180005b40
mov ebx, eax
test eax, eax
jne 0x18001c7dc
mov rcx, qword [rsi + 8]
movsxd r8, ebp
mov rdx, rdi
call fcn.18002525c
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
mov eax, ebx
jmp 0x18001c7c7
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, 8
add rsp, 0x20
pop rdi
ret
Function at 0x18001c950
Capabilities:
Compare security identifiers

Disassembly:
mov r11, rsp
push rbp
push rsi
sub rsp, 0x88
xor esi, esi
lea rax, [r11 - 0x38]
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x48], rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov r12, rcx
mov dword [rsp + 0x30], esi
lea r8d, [rsi + 0x20]
lea rcx, [r11 + 0x18]
mov r9d, 0x220
mov dl, 2
mov dword [rsp + 0x28], esi
mov ebp, esi
mov qword [r11 + 0x20], rsi
mov qword [r11 - 0x38], rsi
mov dword [r11 + 0x18], esi
mov dword [rsp + 0x20], esi
mov word [r11 + 0x1c], 0x500
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x18001c9c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x18001cae4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0xb8]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x18001c9ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x18001cae4
mov rcx, qword [rsp + 0xb8]
xor r9d, r9d
lea rax, [rsp + 0xa8]
lea edx, [r9 + 2]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x18001ca2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x18001ca2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x18001cae4
mov qword [rsp + 0x80], rbx
mov ebx, dword [rsp + 0xa8]
add ebx, 0x10
lea eax, [rbx + 2]
movsxd rcx, eax
call fcn.1800251fc
mov r9d, esi
mov rbp, rax
test rax, rax
je 0x18001ca61
movsxd rcx, ebx
mov r9d, ebx
mov word [rcx + rax], si
mov rcx, qword [rsp + 0xb8]
lea rax, [rsp + 0xa8]
mov r8, rbp
mov edx, 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x18001ca92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x18001cadc
mov ebx, esi
mov dword [r12], esi
cmp dword [rbp], ebx
jle 0x18001cadc
mov qword [rsp + 0x78], rdi
lea rdi, [rbp + 8]
nop word [rax + rax]
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x18001cacf
inc ebx
add rdi, 0x10
cmp ebx, dword [rbp]
jl 0x18001cab0
jmp 0x18001cad7
mov dword [r12], 1
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
mov r12, qword [rsp + 0x70]
test rcx, rcx
je 0x18001caf9
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x18001cb0c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbp, rbp
je 0x18001cb19
mov rcx, rbp
call sub.KERNEL32.dll_LocalFree
mov eax, esi
add rsp, 0x88
pop rsi
pop rbp
ret
Function at 0x18001cbe0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rdi
push r12
push r13
mov rbp, rsp
sub rsp, 0x40
cmp qword [0x180037b18], 0
mov rdi, rcx
mov dword [rbp + 0x48], 4
mov dword [rbp + 0x30], 0
jne 0x18001cc37
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180037b18], rax
test rax, rax
jne 0x18001cc37
xor ecx, ecx
jmp 0x18001cc51
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rbp + 0x30]
mov rcx, rax
call qword [0x180037b18]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
lea rax, [rbp - 0x10]
mov dword [rbp + 0x30], ecx
mov r12d, 1
mov r13d, 0x101
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov r9d, r12d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
cmovne r9d, r13d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x18001ccc8
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x48]
lea rdx, str.EnableLUA
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x10]
mov ebx, eax
test eax, eax
je 0x18001ccd6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbp + 0x38]
test ebx, ebx
cmovne eax, r12d
mov dword [rbp + 0x38], eax
jmp 0x18001ccdc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [0x180037b18], 0
mov dword [rbp + 0x48], 4
mov dword [rbp + 0x30], 0
jne 0x18001cd21
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180037b18], rax
test rax, rax
jne 0x18001cd21
xor ecx, ecx
jmp 0x18001cd3b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rbp + 0x30]
mov rcx, rax
call qword [0x180037b18]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
mov r9d, r12d
lea rax, [rbp - 0x10]
mov dword [rbp + 0x30], ecx
cmovne r9d, r13d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x18001cda6
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x48]
lea rdx, str.ConsentPromptBehaviorAdmin
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x10]
mov ebx, eax
test eax, eax
je 0x18001cdb5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbp + 0x40]
mov ecx, 5
test ebx, ebx
cmovne eax, ecx
jmp 0x18001cdbe
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbp + 0x40]
cmp dword [rbp + 0x38], 0
je 0x18001cdda
cmp eax, 2
jne 0x18001cdda
mov dword [rdi], r12d
xor eax, eax
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret
mov dword [rdi], 0
xor eax, eax
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret
Function at 0x18001cdf0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x60
xor r12d, r12d
mov rbx, r9
mov rdi, r8
cmp qword [0x180037b18], r12
mov rsi, rdx
mov rbp, rcx
mov dword [rsp + 0x50], r12d
jne 0x18001ce55
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180037b18], rax
test rax, rax
jne 0x18001ce55
mov ecx, r12d
jmp 0x18001ce71
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [0x180037b18]
mov ecx, r12d
test eax, eax
setne cl
test ecx, ecx
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x50], ecx
lea rcx, [rsp + 0x58]
mov eax, 2
mov edx, 0x102
cmovne eax, edx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], eax
mov rcx, rbp
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18001cefd
mov eax, dword [rsp + 0x90]
mov r9d, dword [rsp + 0x98]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
test eax, eax
je 0x18001cef5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x18001cefd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret

Function at 0x18001cf20
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rdi, rcx
cmp qword [0x180037b18], rbx
mov dword [rsp + 0x48], ebx
jne 0x18001cf65
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180037b18], rax
test rax, rax
je 0x18001cf7e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [0x180037b18]
test eax, eax
setne bl
mov eax, 0x102
mov r9d, 2
test ebx, ebx
cmovne r9d, eax
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18001cfec
mov rcx, qword [rsp + 0x50]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
test eax, eax
je 0x18001cfe4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18001d000
Capabilities:
Set file attributes
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x18], r8d
push rdi
sub rsp, 0x40
mov rbp, rdx
mov rsi, rcx
xor ebx, ebx
call fcn.18001c1b0
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
xor r9d, r9d
mov edx, 0x40000000
mov rcx, rsi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18001d068
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18001d0c8
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x18001d0ad
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x60]
mov rdx, rbp
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18001d0ad
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x18001d0b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.18001dfb0
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18001d180
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x1002
call fcn.1800251fc
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x18001d1af
mov eax, 0x1000
mov word [rbx + 0x1000], 0
lea rdx, [rsp + 0x38]
mov rcx, rbx
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x18001d1d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x18001d20a
mov rcx, rbx
mov qword [rsp + 0x30], rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rsi
mov ebp, eax
add ebp, ebp
mov edx, ebp
call fcn.180005b40
mov edi, eax
test eax, eax
jne 0x18001d205
mov rcx, qword [rsi + 8]
movsxd r8, ebp
mov rdx, rbx
call fcn.18002525c
mov rbp, qword [rsp + 0x30]
test rbx, rbx
je 0x18001d217
mov rcx, rbx
call sub.KERNEL32.dll_LocalFree
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x18001d230
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rdi, rcx
mov dword [rsp + 0x50], 4
cmp qword [0x180037b18], rbx
mov dword [rsp + 0x48], ebx
jne 0x18001d27d
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180037b18], rax
test rax, rax
je 0x18001d296
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [0x180037b18]
test eax, eax
setne bl
mov eax, 0x101
mov r9d, 1
test ebx, ebx
cmovne r9d, eax
lea rax, [rsp + 0x58]
lea rdx, str.HARDWAREDESCRIPTIONSYSTEMCENTRALPROCESSOR0
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x18001d30a
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, str.MHZ
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
test eax, eax
je 0x18001d31b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x18001d321
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18001dfb0
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x290
mov rsi, rcx
mov ecx, 0x1002
call fcn.1800251fc
xor edi, edi
mov rbx, rax
test rax, rax
je 0x18001dfe7
mov edi, 0x1000
mov word [rax + 0x1000], 0
lea rcx, str.NTDLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x18001e033
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test rbx, rbx
je 0x18001e02c
mov rcx, rbx
call sub.KERNEL32.dll_LocalFree
mov eax, edi
jmp 0x18001e0bc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor r9d, r9d
mov qword [rsp + 0x30], 0
lea r8d, [r9 + 1]
mov edx, 0x100
mov rcx, rsi
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18001e017
lea r9, [rsp + 0x54]
lea r8, [rsp + 0x4c]
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test rbx, rbx
je 0x18001e0ba
mov rcx, rbx
call sub.KERNEL32.dll_LocalFree
xor eax, eax
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x18001e0e0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xe0
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.1800252b0
mov eax, 1
lea rcx, [rsp + 0x50]
lea r8d, [rax + 0x17]
xor edx, edx
mov dword [rsp + 0x70], SQLExecDirectW
mov dword [rsp + 0xac], eax
mov word [rsp + 0xb0], ax
call fcn.1800252b0
xor edi, edi
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x18001e180
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rdi
ret
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x18001e1a4
mov edi, 0x5b4
mov ecx, 0x54f
cmp eax, 0x102
cmovne edi, ecx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0xf0]
mov eax, edi
add rsp, 0xe0
pop rdi
ret
Function at 0x18001e650
Capabilities:
Get token membership

Disassembly:
mov rax, rsp
sub rsp, 0x68
xor ecx, ecx
mov word [rax + 0x14], 0x500
lea rax, [rax + 0x18]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], ecx
mov dword [rax - 0x10], ecx
mov dword [rax - 8], ecx
mov dword [rsp + 0x28], ecx
lea r8d, [rcx + 0x12]
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x78]
xor r9d, r9d
mov dl, 1
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x18001e6c1
mov rdx, qword [rsp + 0x80]
lea r8, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x180020690
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push r12
sub rsp, 0x58
mov ebp, r8d
mov rsi, rdx
mov r12, rcx
mov dword [rsp + 0x98], 0
xor ebx, ebx
mov r8d, SQLNumResultCols
movsxd rdx, ebx
lea r9, [rsp + 0x98]
mov rcx, r12
sub r8d, ebx
add rdx, rsi
mov dword [rsp + 0x20], ebp
call fcn.180020470
test eax, eax
jne 0x18002084f
add ebx, dword [rsp + 0x98]
cmp ebx, 0x10
jl 0x1800206b0
mov rax, qword [0x180033c60]
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x50], r14
test rax, rax
jne 0x180020724
lea ecx, [rax + 0x38]
call fcn.1800251fc
test rax, rax
je 0x18002071d
mov rcx, rax
call fcn.180009d40
mov qword [0x180033c60], rax
lea r14, [rax + 0x10]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rsi]
lea rax, [rsp + 0x38]
mov r8, rsi
xor r13d, r13d
mov r9d, r11d
mov r10d, r11d
mov edi, r11d
sub r8, rax
nop dword [rax + rax]
mov eax, r11d
lea rdx, [rsp + r13 + 0x38]
mov ecx, r10d
shr eax, 3
shl ecx, 7
inc r13
lea r11d, [r11 + rax - 0x11111111]
mov eax, r9d
shr eax, 5
lea r9d, [r9 + rax - 0x22222222]
mov eax, 0x33333333
sub eax, ecx
mov ecx, edi
add r10d, eax
shl ecx, 9
mov eax, 0x44444444
sub eax, ecx
add edi, eax
lea eax, [r9 + r11]
add al, r10b
add al, dil
xor al, byte [r8 + rdx]
mov byte [rdx], al
cmp r13, 0x10
jl 0x180020750
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx edi, word [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x88]
add edi, 0x10
mov dword [rsp + 0x30], edi
cmp edi, 0xf000
jle 0x1800207d9
mov eax, reloc.ODBC32.dll_SQLFetch
jmp 0x180020847
cmp ebx, edi
jge 0x18002080f
nop dword [rax]
mov r8d, edi
movsxd rdx, ebx
lea r9, [rsp + 0x98]
mov rcx, r12
sub r8d, ebx
add rdx, rsi
mov dword [rsp + 0x20], ebp
call fcn.180020470
test eax, eax
jne 0x180020847
add ebx, dword [rsp + 0x98]
cmp ebx, edi
jl 0x1800207e0
mov rax, qword [0x180033c60]
test rax, rax
jne 0x180020837
lea ecx, [rax + 0x38]
call fcn.1800251fc
test rax, rax
je 0x180020830
mov rcx, rax
call fcn.180009d40
mov qword [0x180033c60], rax
lea r8, [rsp + 0x30]
mov rdx, rsi
mov rcx, rax
call fcn.180009f60
mov rdi, qword [rsp + 0x80]
add rsp, 0x58
pop r12
pop rsi
pop rbp
pop rbx
ret