joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800101c0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov word [rsp + 0x18], r8w
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
movzx ebx, word [rsp + 0xe0]
movzx r10d, word [rcx + 0x60]
movzx r13d, word [rsp + 0xe8]
movzx r11d, r8w
mov r15, rdx
mov eax, ebx
sub eax, r11d
mov rsi, rcx
mov dword [rsp + 0x30], r11d
inc eax
mov dword [rsp + 0xd8], eax
imul r10d, eax
add r10d, 0x1f
mov eax, 0xe000
sar r10d, 3
cdq
and r10d, 0xfffffffc
idiv r10d
cmp r9w, r13w
jae 0x1800103e5
movzx r10d, ax
mov dword [rsp + 0x34], r10d
movzx edx, r9w
movzx ecx, r13w
mov eax, ecx
mov ecx, r10d
sub eax, edx
cmp eax, r10d
cmovl ecx, eax
mov rax, qword [rsi + 0x68]
mov word [rax + 0x12], bx
mov word [rax + 0x10], r8w
mov word [rax + 0x14], r9w
add cx, r9w
mov ebx, 8
movzx ebp, cx
mov word [rax + 0x16], bp
movzx r12d, word [rsi + 0x60]
movzx r14d, word [rsi + 0x62]
movzx edi, word [rsi + 0x64]
imul r14d, r12d
mov eax, r12d
sub edi, edx
add r14d, 0x1f
mov dword [rsp + 0xc0], ebp
imul r12d, dword [rsp + 0xd8]
imul eax, r11d
add eax, 0x1f
dec edi
add r12d, 0x1f
sar r14d, 3
sar eax, 3
sar r12d, 3
and r14d, 0xfffffffc
and eax, 0xfffffffc
and r12d, 0xfffffffc
imul edi, r14d
add edi, eax
cmp edx, ebp
jge 0x180010305
movsxd r13, r12d
sub ebp, edx
mov rax, qword [rsi + 0x68]
movsxd rcx, ebx
movsxd rdx, edi
lea rcx, [rcx + rax + 0x10]
add rdx, r15
mov r8, r13
call fcn.18001ca04
add ebx, r12d
sub edi, r14d
dec rbp
jne 0x1800102d0
mov ebp, dword [rsp + 0xc0]
movzx r13d, word [rsp + 0xe8]
mov rax, qword [rsi + 0x68]
xor edi, edi
mov dword [rax], 0x2d2f2757
mov rax, qword [rsi + 0x68]
mov dword [rax + 4], 0x20004001
mov rax, qword [rsi + 0x68]
mov dword [rax + 8], ebx
mov rax, qword [rsi + 0x68]
mov dword [rax + 0xc], edi
mov rax, qword [0x18002a808]
test rax, rax
jne 0x1800103a6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.PI__8.8X_
lea rcx, [rsp + 0x40]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x40]
lea ecx, [rdi + 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
jne 0x18001036d
mov eax, edi
jmp 0x1800103a6
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x18002a808], rax
test rax, rax
jne 0x180010396
mov rax, rdi
jmp 0x1800103a6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x18002a808]
mov rdx, qword [rsi + 0x68]
mov rcx, qword [rsi + 8]
mov r8d, 0x7530
call qword [rax + 0x70]
test eax, eax
jne 0x1800103e7
movzx r9d, bp
cmp bp, r13w
jae 0x1800103e5
movzx r8d, word [rsp + 0xd0]
mov r11d, dword [rsp + 0x30]
movzx ebx, word [rsp + 0xe0]
mov r10d, dword [rsp + 0x34]
jmp 0x18001023c
xor eax, eax
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180011350
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x18002a810]
test rax, rax
jne 0x1800113e5
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.PI__8.8X_
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x1800113c4
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x18002a810], rax
test rax, rax
jne 0x1800113d0
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x18002a810]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x180012940
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x18002a818]
test rax, rax
jne 0x1800129d5
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.PI__8.8X_
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x1800129b4
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x18002a818], rax
test rax, rax
jne 0x1800129c0
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x18002a818]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x1800134b0
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x18002a830]
test rax, rax
jne 0x180013545
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.PI__8.8X_
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x180013524
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x18002a830], rax
test rax, rax
jne 0x180013530
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x18002a830]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x180013f10
Capabilities:
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rbx, rdx
mov r13, rcx
lea rdx, [rax + 0x20]
xor r14d, r14d
mov rcx, r8
mov r12, r8
mov word [rax + 0x20], r14w
call qword [sym.imp.ODBC32.dll_SQLNumResultCols]
mov rcx, r12
call qword [sym.imp.ODBC32.dll_SQLFetch]
test ax, 0xfffe
jne 0x1800140b2
mov r15d, 1
nop word [rax + rax]
mov esi, r15d
cmp r15w, word [rsp + 0xc8]
jg 0x18001409f
nop word [rax + rax]
lea rax, [rsp + 0x30]
lea r9, [rbx + 0x10]
mov r8d, 0xfffffff8
mov qword [rsp + 0x28], rax
movzx edx, si
mov rcx, r12
mov qword [rsp + 0x20], 0xf000
mov qword [rsp + 0x30], r14
call qword [sym.imp.ODBC32.dll_SQLGetData]
mov r11, qword [rsp + 0x30]
cmp r11, 0xffffffffffffffff
jne 0x180013fe5
lea rdx, str.NULL
lea rcx, [rbx + 0x10]
call qword [sym.imp.USER32.dll_wsprintfW]
movsxd r11, eax
add r11, r11
mov qword [rsp + 0x30], r11
lea eax, [r11 + 2]
mov dword [rbx], 0x2d2f2757
mov dword [rbx + 4], 0xc007
mov dword [rbx + 8], eax
mov rax, qword [0x18002a830]
mov dword [rbx + 0xc], r14d
test rax, rax
jne 0x18001407a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.PI__8.8X_
lea rcx, [rsp + 0x40]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x40]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rdi, rax
test rax, rax
jne 0x180014041
mov rax, r14
jmp 0x18001407a
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x18002a830], rax
test rax, rax
jne 0x18001406a
mov rax, r14
jmp 0x18001407a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x18002a830]
mov r8d, 0x7530
mov rdx, rbx
mov rcx, r13
call qword [rax + 0x70]
test eax, eax
jne 0x1800140d7
movsx eax, word [rsp + 0xc8]
inc esi
cmp esi, eax
jle 0x180013f90
mov rcx, r12
call qword [sym.imp.ODBC32.dll_SQLFetch]
test ax, 0xfffe
je 0x180013f70
mov dword [rbx], 0x2d2f2757
mov dword [rbx + 4], 0xc007
mov qword [rbx + 8], r14
call fcn.1800134b0
mov r8d, 0x7530
mov rdx, rbx
mov rcx, r13
call qword [rax + 0x70]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180014260
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x2002
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rdi, rax
test rax, rax
je 0x180014320
mov edx, 0x1000
mov rcx, rax
mov word [rax + 0x2000], 0
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1800142bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rbx
mov ebp, eax
add ebp, ebp
mov edx, ebp
call fcn.180004470
mov esi, eax
test eax, eax
jne 0x180014313
mov rcx, qword [rbx + 8]
movsxd r8, ebp
mov rdx, rdi
call fcn.18001ca04
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov eax, esi
jmp 0x1800142fe
mov eax, 8
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180014330
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x2002
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rdi, rax
test rax, rax
je 0x1800143f0
mov edx, 0x1000
mov rcx, rax
mov word [rax + 0x2000], 0
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x18001438d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rbx
mov ebp, eax
add ebp, ebp
mov edx, ebp
call fcn.180004470
mov esi, eax
test eax, eax
jne 0x1800143e3
mov rcx, qword [rbx + 8]
movsxd r8, ebp
mov rdx, rdi
call fcn.18001ca04
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov eax, esi
jmp 0x1800143ce
mov eax, 8
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180014400
Capabilities:
Create directory

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [rdi], 0x5c
movsxd rbp, eax
jne 0x180014463
cmp word [rdi + 2], 0x5c
jne 0x180014463
mov ebx, 2
mov eax, ebx
cmp rbx, rbp
jge 0x180014441
nop dword [rax]
cmp word [rdi + rax*2], 0x5c
je 0x180014441
inc rax
inc ebx
cmp rax, rbp
jl 0x180014430
inc ebx
movsxd rax, ebx
cmp rax, rbp
jge 0x18001447e
nop dword [rax + rax]
cmp word [rdi + rax*2], 0x5c
je 0x18001447e
inc rax
inc ebx
cmp rax, rbp
jl 0x180014450
jmp 0x18001447e
cmp word [rdi + 2], 0x3a
jne 0x180014500
cmp word [rdi + 4], 0x5c
jne 0x180014500
mov ebx, 3
mov qword [rsp + 0x40], rsi
movsxd rsi, ebx
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r13
cmp rsi, rbp
jge 0x1800144d7
xor r13d, r13d
mov r12d, 0x5c
nop
cmp word [rdi + rsi*2], r12w
jne 0x1800144cd
xor edx, edx
mov rcx, rdi
mov word [rdi + rsi*2], r13w
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1800144c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1800144f0
mov word [rdi + rsi*2], r12w
inc rsi
inc ebx
cmp rsi, rbp
jl 0x1800144a0
xor eax, eax
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r13, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
movsxd rax, ebx
mov word [rdi + rax*2], r12w
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1800144d9
mov eax, 3
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x180014980
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x2002
mov rbx, rdx
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rdi, rax
test rax, rax
je 0x180014a4c
mov r8d, 0x1000
mov rdx, rax
mov rcx, rbx
mov word [rax + 0x2000], 0
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1800149ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
mov qword [rsp + 0x30], rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rsi
mov ebp, eax
add ebp, ebp
mov edx, ebp
call fcn.180004470
mov ebx, eax
test eax, eax
jne 0x180014a3f
mov rcx, qword [rsi + 8]
movsxd r8, ebp
mov rdx, rdi
call fcn.18001ca04
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov eax, ebx
jmp 0x180014a2a
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, 8
add rsp, 0x20
pop rdi
ret
Function at 0x180014bc0
Capabilities:
Compare security identifiers

Disassembly:
mov r11, rsp
push rbp
push rsi
sub rsp, 0x88
xor esi, esi
lea rax, [r11 - 0x38]
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x48], rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov r12, rcx
mov dword [rsp + 0x30], esi
lea r8d, [rsi + 0x20]
lea rcx, [r11 + 0x18]
mov r9d, 0x220
mov dl, 2
mov dword [rsp + 0x28], esi
mov ebp, esi
mov qword [r11 + 0x20], rsi
mov qword [r11 - 0x38], rsi
mov dword [r11 + 0x18], esi
mov dword [rsp + 0x20], esi
mov word [r11 + 0x1c], 0x500
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x180014c31
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x180014d54
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0xb8]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x180014c5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x180014d54
mov rcx, qword [rsp + 0xb8]
xor r9d, r9d
lea rax, [rsp + 0xa8]
lea edx, [r9 + 2]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x180014c9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x180014c9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x180014d54
mov qword [rsp + 0x80], rbx
mov ebx, dword [rsp + 0xa8]
add ebx, 0x10
lea eax, [rbx + 2]
movsxd rcx, eax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov r9d, esi
mov rbp, rax
test rax, rax
je 0x180014cd2
movsxd rcx, ebx
mov r9d, ebx
mov word [rcx + rax], si
mov rcx, qword [rsp + 0xb8]
lea rax, [rsp + 0xa8]
mov r8, rbp
mov edx, 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x180014d03
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x180014d4c
mov ebx, esi
mov dword [r12], esi
cmp dword [rbp], ebx
jle 0x180014d4c
mov qword [rsp + 0x78], rdi
lea rdi, [rbp + 8]
nop word [rax + rax]
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x180014d3f
inc ebx
add rdi, 0x10
cmp ebx, dword [rbp]
jl 0x180014d20
jmp 0x180014d47
mov dword [r12], 1
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
mov r12, qword [rsp + 0x70]
test rcx, rcx
je 0x180014d69
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x180014d7c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbp, rbp
je 0x180014d8a
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov eax, esi
add rsp, 0x88
pop rsi
pop rbp
ret
Function at 0x180014e50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x40
xor ebx, ebx
mov rdi, r9
mov rsi, r8
cmp qword [0x18002a838], rbx
mov rbp, rdx
mov r12, rcx
mov dword [rsp + 0x30], ebx
jne 0x180014eb4
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18002a838], rax
test rax, rax
jne 0x180014eb4
mov dword [rsp + 0x30], ebx
jmp 0x180014ed6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [0x18002a838]
test eax, eax
jne 0x180014ed2
mov dword [rsp + 0x30], ebx
jmp 0x180014ed6
mov ebx, dword [rsp + 0x30]
mov eax, 0x101
mov r9d, 1
test ebx, ebx
cmovne r9d, eax
lea rax, [rsp + 0x38]
mov rdx, rbp
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180014f50
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
test eax, eax
je 0x180014f3c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x180014f50
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x70]
mov r11, qword [rsp + 0x78]
mov dword [r11], eax
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x180014f70
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x60
xor ebp, ebp
mov ebx, r8d
mov rdi, rdx
cmp qword [0x18002a838], rbp
mov rsi, rcx
mov dword [rax + 0x20], ebp
jne 0x180014fcf
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18002a838], rax
test rax, rax
jne 0x180014fcf
mov ecx, ebp
mov dword [rsp + 0x88], ecx
jmp 0x180014ffc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x88]
mov rcx, rax
call qword [0x18002a838]
test eax, eax
jne 0x180014ff5
mov ecx, ebp
mov dword [rsp + 0x88], ecx
jmp 0x180014ffc
mov ecx, dword [rsp + 0x88]
test ecx, ecx
mov qword [rsp + 0x40], rbp
mov eax, 2
lea rcx, [rsp + 0x50]
mov edx, 0x102
cmovne eax, edx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], eax
lea rdx, str.SoftwareCLASSESFAST
mov rcx, rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180015080
mov rcx, qword [rsp + 0x50]
lea r9d, [rax + 3]
lea rdx, str.CLSID
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
test eax, eax
je 0x180015078
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x180015080
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x1800150a0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rdi, rcx
cmp qword [0x18002a838], rbx
mov dword [rsp + 0x48], ebx
jne 0x1800150eb
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18002a838], rax
test rax, rax
jne 0x1800150eb
mov dword [rsp + 0x48], ebx
jmp 0x18001510d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [0x18002a838]
test eax, eax
jne 0x180015109
mov dword [rsp + 0x48], ebx
jmp 0x18001510d
mov ebx, dword [rsp + 0x48]
mov eax, 0x102
mov r9d, 2
test ebx, ebx
cmovne r9d, eax
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180015177
mov rcx, qword [rsp + 0x50]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
test eax, eax
je 0x18001516f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180015230
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x1002
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x180015260
mov eax, 0x1000
mov word [rbx + 0x1000], 0
lea rdx, [rsp + 0x38]
mov rcx, rbx
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x180015285
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1800152bb
mov rcx, rbx
mov qword [rsp + 0x30], rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rsi
mov ebp, eax
add ebp, ebp
mov edx, ebp
call fcn.180004470
mov edi, eax
test eax, eax
jne 0x1800152b6
mov rcx, qword [rsi + 8]
movsxd r8, ebp
mov rdx, rbx
call fcn.18001ca04
mov rbp, qword [rsp + 0x30]
test rbx, rbx
je 0x1800152c9
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret