joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180020030
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov eax, dword [rsp + 0x60]
imul rax, rax, 0x38
mov rcx, qword [0x180050f70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], 5
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18002009a
mov rax, qword [rsp + 0x30]
sub rax, 5
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800200c3
mov eax, 0xa
jmp 0x1800201f4
cmp dword [rsp + 0x68], 0
je 0x18002012e
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov byte [rax], 0xe9
mov rax, qword [rsp + 0x30]
add rax, 5
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 1], eax
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18002012c
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov byte [rax], 0xeb
mov rax, qword [rsp + 0x48]
mov byte [rax + 1], 0xf9
jmp 0x18002017a
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18002015e
mov rax, qword [rsp + 0x28]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x18002017a
mov rax, qword [rsp + 0x28]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rsp + 0x68]
and al, 1
shl al, 1
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x20], al
movzx eax, byte [rsp + 0x68]
and al, 1
shl al, 2
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x20], al
xor eax, eax
add rsp, 0x58
ret
Function at 0x1800209f0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x90], 0x40000000
jbe 0x180020a51
mov rax, qword [rsp + 0x90]
sub rax, 0x40000000
cmp qword [rsp + 0x30], rax
jae 0x180020a51
mov rax, qword [rsp + 0x90]
sub rax, 0x40000000
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x90]
add rax, 0x40000000
cmp qword [rsp + 0x28], rax
jbe 0x180020a79
mov rax, qword [rsp + 0x90]
add rax, 0x40000000
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
sub rax, 0xfff
mov qword [rsp + 0x28], rax
mov rax, qword [0x180050f60]
mov qword [rsp + 0x20], rax
jmp 0x180020aa4
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180020ade
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x20], rax
jb 0x180020ac4
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x20], rax
jb 0x180020ac6
jmp 0x180020a97
mov rax, qword [rsp + 0x20]
cmp qword [rax + 8], 0
je 0x180020adc
mov rax, qword [rsp + 0x20]
jmp 0x180020c50
jmp 0x180020a97
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jb 0x180020b47
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call fcn.1800207f0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x180020b1a
jmp 0x180020b47
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1000
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180020b45
jmp 0x180020b47
jmp 0x180020aeb
cmp qword [rsp + 0x20], 0
jne 0x180020bb8
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x40], rax
ja 0x180020bb8
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
call fcn.1800208d0
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x180020b8b
jmp 0x180020bb8
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1000
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180020bb6
jmp 0x180020bb8
jmp 0x180020b5c
cmp qword [rsp + 0x20], 0
je 0x180020c4b
mov rax, qword [rsp + 0x20]
add rax, 0x40
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x10], 0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x48]
add rax, 0x40
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
cmp rax, 0xfc0
jbe 0x180020beb
mov rax, qword [rsp + 0x20]
mov rcx, qword [0x180050f60]
mov qword [rax], rcx
mov rax, qword [rsp + 0x20]
mov qword [0x180050f60], rax
mov rax, qword [rsp + 0x20]
add rsp, 0x88
ret
Function at 0x1800213f0
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x180021449
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0x90
je 0x180021449
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0xcc
je 0x180021449
xor eax, eax
jmp 0x180021490
mov dword [rsp], 1
jmp 0x18002145a
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp], eax
jae 0x18002148b
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x20]
movzx ecx, byte [rdx + rcx]
cmp eax, ecx
je 0x180021489
xor eax, eax
jmp 0x180021490
jmp 0x180021452
mov eax, 1
add rsp, 0x18
ret
Function at 0x180022a3c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x180022a76
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x180022a7b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x180022ac4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180026870]
cmp byte [rcx + rax], 0
je 0x180022ac4
dec r8
sub rdx, 1
jne 0x180022aaa
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x401a20
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov rbx, rcx
lea rcx, [0x00468ec0]
mov qword [rsp + 0x48], rdi
mov rdi, rdx
mov r8d, 0x801
xor edx, edx
call fcn.00420630
lea rdx, [0x00438f90]
mov rcx, rbx
call fcn.004218e0
test rax, rax
mov rbx, rax
jne 0x401a6e
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
lea rcx, [0x00468ec0]
mov r9, rax
mov edx, 1
mov r8d, 0x800
call fcn.00421760
mov rcx, rbx
call fcn.004212d0
lea rcx, [0x00468ec0]
call fcn.004204b0
lea rcx, [0x00468ec0]
mov rdx, rdi
call fcn.0041ff80
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
test rax, rax
setne al
add rsp, 0x28
ret

Function at 0x401ac0
Capabilities:
Modify service

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x78], rbx
mov rbx, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov qword [rsp + 0x88], rdi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
mov rdi, rax
jne 0x401afe
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x78]
add rsp, 0x68
ret
lea rdx, [0x00438f94]
mov r8d, 0xf01ff
mov rcx, rax
mov qword [rsp + 0x80], rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
test rax, rax
mov rsi, rax
jne 0x401b31
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x401b81
mov r8d, dword [rbx + 4]
mov edx, dword [rbx]
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov r9d, 0xffffffff
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x78]
add rsp, 0x68
ret

Function at 0x401ba0
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x401bc1
and eax, 0xfffffffe
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
add rsp, 0x20
pop rbx
ret
Function at 0x402390
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 0x10], r13
xor ebp, ebp
mov rdi, rdx
mov r13, r8
mov dword [rax - 0x28], ebp
mov rsi, rcx
call fcn.00413cb8
test rax, rax
mov rcx, rax
jne 0x4023cd
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x60], r12
call qword [rax + 0x18]
lea r9, [rsp + 0x44]
mov r8d, 7
mov rbx, rax
lea rax, [rsp + 0x40]
mov rdx, rdi
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x40]
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
jne 0x402511
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xd
je 0x40247e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40247e
test rbp, rbp
je 0x40243a
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [rsp + 0x40]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r9, [rsp + 0x44]
mov r8d, 7
mov rbp, rax
lea rax, [rsp + 0x40]
mov rdx, rdi
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x40]
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x402416
test rbp, rbp
je 0x402511
cmp byte [rbp], 0
mov rsi, rbp
mov r12, 0xffffffffffffffff
je 0x4024f6
nop
nop
nop
mov eax, dword [rsp + 0x40]
add rax, rbp
cmp rsi, rax
jae 0x4024f6
mov rcx, rsi
call fcn.004204b0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov rdi, r13
mov rcx, r12
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
movzx eax, byte [rsi + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x4024d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rcx, eax
lea rsi, [rsi + rcx + 1]
cmp byte [rsi], 0
jne 0x4024a0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, rbx
lock xadd dword [rbx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jmp 0x402528
mov rdx, rbx
mov r12, 0xffffffffffffffff
lock xadd dword [rbx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x402533
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x70]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
add rsp, 0x68
ret
Function at 0x404610
Capabilities:
Modify service
Query service configuration

Disassembly:
mov r11, rsp
sub rsp, 0x1a8
mov rax, qword [0x00454a00]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rbp, rcx
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
mov rbx, rax
jne 0x404662
lea rcx, str.error:_OpenSCManager_fail...
call fcn.004042c0
xor eax, eax
jmp 0x40478e
lea rdx, [0x00438f94]
mov r8d, 0xf01ff
mov rcx, rax
mov qword [rsp + 0x1c8], rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
test rax, rax
mov rsi, rax
jne 0x4046a4
lea rcx, str.error:_OpenService_fail...
call fcn.004042c0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x404786
mov qword [rsp + 0x1a0], rdi
lea r9, [rsp + 0x60]
xor edi, edi
mov r8d, 0x3e8
mov rdx, rbp
mov rcx, rax
mov dword [rsp + 0x60], edi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x4046dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.QueryServiceConfig___d
jmp 0x40474d
cmp eax, 1
jne 0x40476a
lea r8, [rsp + 0x68]
mov edx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4046ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rbp]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov r9d, 0xffffffff
mov r8d, 4
mov rcx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
mov edi, eax
jne 0x40476a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.ChangeServiceConfig___d
lea rcx, [rsp + 0x90]
mov r8d, eax
call fcn.004209a0
lea rcx, [rsp + 0x90]
call fcn.004042c0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
mov rdi, qword [rsp + 0x1a0]
mov rsi, qword [rsp + 0x1c8]
mov rbp, qword [rsp + 0x1c0]
mov rbx, qword [rsp + 0x1b8]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.00420600
add rsp, 0x1a8
ret
Function at 0x4048b0
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xf0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x00454a00]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0x30], 0x80
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404a8a
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.Identifier
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
test eax, eax
je 0x4049b9
call fcn.00413cb8
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x40495e
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov r8d, ebx
lea rdx, str.IsVista64_RegQueryValueEx_errorcode:__d_n
lea rcx, [rsp + 0x48]
call fcn.00403500
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.004042c0
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x404a73
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x404a73
call fcn.00413cb8
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x4049d8
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x60]
lea rdx, str.Identifier:__s_n
lea rcx, [rsp + 0x38]
call fcn.00403500
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.004042c0
lea rdx, [0x00439364]
lea rcx, [rsp + 0x60]
call fcn.0041ff80
test rax, rax
je 0x404a55
lea rcx, str.Find_substring_64__So_this_is_a_64bit_OS_n
call fcn.004042c0
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x404a4e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
jmp 0x404a8c
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x404a73
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, str.Cant_find_substring_64__So_this_isnt_a_64bit_OS_n
call fcn.004042c0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.00420600
add rsp, 0xf0
pop rbx
ret
Function at 0x404af0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0x4e8
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
mov rax, qword [0x00454a00]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
mov rbx, rcx
mov qword [r11 - 0x428], 0xf
mov qword [r11 - 0x430], 0
mov byte [rsp + 0xa8], 0
lea rcx, [r11 - 0x448]
call fcn.00403f10
test al, al
jne 0x404b70
cmp qword [rsp + 0xc0], 0x10
jb 0x404b66
mov rcx, qword [rsp + 0xa8]
call fcn.004135ec
mov eax, 0x4e24
jmp 0x404d7f
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0xa0]
call fcn.00402e60
lea r8, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 0x10
cmovae r8, qword [rsp + 0xa8]
lea rdx, str.Excute_file:__s_n
lea rcx, [rsp + 0xd0]
call fcn.004209a0
lea rcx, [rsp + 0xd0]
call fcn.004042c0
lea rcx, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 0x10
cmovae rcx, qword [rsp + 0xa8]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x404d58
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x34], 0x40
lea rax, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 0x10
cmovae rax, qword [rsp + 0xa8]
mov qword [rsp + 0x48], rax
lea rax, [0x0043948d]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
lea rax, str.open
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x60], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x404cd4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r8d, eax
lea rdx, str.Error_:_Excute_error__error_code:__ld_n
lea rcx, [rsp + 0xd0]
call fcn.004209a0
lea rcx, [rsp + 0xd0]
call fcn.004042c0
mov edi, dword [rsp + 0x20]
cmp edi, 2
jne 0x404cb5
cmp qword [rsp + 0xc0], 0x10
jb 0x404cae
mov rcx, qword [rsp + 0xa8]
call fcn.004135ec
xor eax, eax
jmp 0x404d7f
cmp qword [rsp + 0xc0], 0x10
jb 0x404ccd
mov rcx, qword [rsp + 0xa8]
call fcn.004135ec
mov eax, edi
jmp 0x404d7f
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x20], eax
test eax, eax
je 0x404d1d
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rsp + 0x20]
cmp qword [rsp + 0xc0], 0x10
jb 0x404d19
mov rcx, qword [rsp + 0xa8]
call fcn.004135ec
mov eax, edi
jmp 0x404d7f
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov r8d, dword [rsp + 0x20]
lea rdx, str.Info__:_Excute_end__return_code:__ld_n
lea rcx, [rsp + 0xd0]
call fcn.004209a0
lea rcx, [rsp + 0xd0]
call fcn.004042c0
jmp 0x404d65
lea rcx, str.Info__:_File_not_found__return._n
call fcn.004042c0
nop
cmp qword [rsp + 0xc0], 0x10
jb 0x404d7d
mov rcx, qword [rsp + 0xa8]
call fcn.004135ec
xor eax, eax
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.00420600
mov rbx, qword [rsp + 0x500]
mov rdi, qword [rsp + 0x508]
add rsp, 0x4e8
ret
Function at 0x404dd0
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
sub rsp, 0x58
xor ecx, ecx
lea rax, [rsp + 0x68]
lea rdx, str.SYSTEMCurrentControlSetServicesewusbnet
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ecx
xor r9d, r9d
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov dword [rsp + 0x60], 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x404e3d
lea rcx, str.INFO:_RegResetInfo_Open_Key_ewusbnet__error._n
call fcn.004042c0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x4e25
add rsp, 0x58
ret
cmp byte [0x00456474], 0
mov rcx, qword [rsp + 0x68]
lea rdx, str.NetworkCardNotRemovalable
jne 0x404e6a
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x58
ret
lea rax, [rsp + 0x60]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x404e58
lea rcx, str.INFO:_RegResetInfo_SetValue_NetworkCardNotRemovalable__1__error._n
call fcn.004042c0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x4e25
add rsp, 0x58
ret
Function at 0x406f70
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x168
mov rax, qword [0x00454a00]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x178], rbx
mov rbx, rcx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x12c
call fcn.00420630
lea rcx, [rsp + 0x20]
mov edx, 0x12c
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x406fcd
lea rcx, str.Error_:_GetWindowsDirectory_fail._n
call fcn.004042c0
xor al, al
jmp 0x4070d8
mov rdx, qword [rbx + 0x20]
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x188], rdi
xor eax, eax
lea rdi, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
cmp rdx, 0x10
not rcx
lea rsi, [rcx - 1]
jb 0x407008
mov rax, qword [rbx + 8]
lea rdi, [rbx + 8]
jmp 0x40700f
lea rdi, [rbx + 8]
mov rax, rdi
lea rcx, [rsp + 0x20]
cmp rcx, rax
jb 0x407056
cmp rdx, 0x10
jb 0x407024
mov rcx, qword [rdi]
jmp 0x407027
mov rcx, rdi
add rcx, qword [rbx + 0x18]
lea rax, [rsp + 0x20]
cmp rcx, rax
jbe 0x407056
cmp rdx, 0x10
jb 0x40703e
mov rdi, qword [rdi]
lea r8, [rsp + 0x20]
mov r9, rsi
mov rdx, rbx
sub r8, rdi
mov rcx, rbx
call fcn.00402c70
jmp 0x4070c6
cmp rsi, 0xfffffffffffffffe
jbe 0x407061
call fcn.00436ca0
mov rax, qword [rbx + 0x20]
cmp rax, rsi
jae 0x40708d
mov r8, qword [rbx + 0x18]
mov rdx, rsi
mov rcx, rbx
call fcn.00402120
test rsi, rsi
je 0x4070c6
mov rdx, qword [rbx + 0x20]
cmp rdx, 0x10
jb 0x4070a4
mov rcx, qword [rdi]
jmp 0x4070a7
test rsi, rsi
jne 0x407079
cmp rax, 0x10
mov qword [rbx + 0x18], rsi
jb 0x40709f
mov rdi, qword [rdi]
mov byte [rdi], 0
jmp 0x4070c6
mov rcx, rdi
lea r8, [rsp + 0x20]
mov r9, rsi
call fcn.00421090
cmp qword [rbx + 0x20], 0x10
mov qword [rbx + 0x18], rsi
jb 0x4070c2
mov rdi, qword [rdi]
mov byte [rdi + rsi], 0
mov rdi, qword [rsp + 0x188]
mov rsi, qword [rsp + 0x180]
mov al, 1
mov rbx, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.00420600
add rsp, 0x168
ret