joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000cc70
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
xor ecx, ecx
mov rsi, r8
mov rdi, rdx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rcx, rbx
call fcn.18000ce80
xor ebp, ebp
cmp al, bpl
je 0x18000cd36
lea rax, [rsp + 0x30]
lea r9, [0x18005de00]
lea r8d, [rbp + 1]
lea rcx, [0x18005ddf0]
xor edx, edx
mov bl, bpl
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rbp
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebp
jl 0x18000cd1d
mov rcx, qword [rsp + 0x30]
cmp rcx, rbp
je 0x18000cd32
mov word [rsp + 0x68], bp
mov word [rsp + 0x78], bp
mov rax, qword [rcx]
lea r8, [rsp + 0x68]
lea edx, [rbp + 2]
call qword [rax + 0x40]
cmp eax, ebp
jl 0x18000cd1d
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x78]
lea edx, [rbp + 4]
mov rax, qword [rcx]
call qword [rax + 0x40]
cmp eax, ebp
jl 0x18000cd1d
cmp word [rsp + 0x68], bp
jne 0x18000cd1b
cmp word [rsp + 0x78], bp
je 0x18000cd1d
mov bl, 1
mov rcx, qword [rsp + 0x30]
cmp rcx, rbp
je 0x18000cd2d
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp bl, bpl
jne 0x18000cd36
mov dword [rdi], ebp
jmp 0x18000cd3c
mov dword [rdi], 1
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [rdi], ebp
jne 0x18000cd5b
lea rdx, [0x18005dce8]
mov r8d, 8
mov rcx, rsi
call fcn.180002a18
mov al, 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000cd6c
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rcx, rbx
call fcn.18000ce80
test al, al
je 0x18000ce71
and qword [rsp + 0x30], 0
xor edx, edx
lea rax, [rsp + 0x30]
lea r9, [0x18005de00]
lea rcx, [0x18005ddf0]
lea r8d, [rdx + 1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18000ce55
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x18000ce55
mov rax, qword [rcx]
lea r8, [rsp + 0x60]
mov edx, 2
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x68]
mov r9, qword [rcx]
mov edx, 4
mov ebx, eax
call qword [r9 + 0x40]
lea rcx, str.h1:_d__0x_08x_h2:_d_0x_08x
mov edx, ebx
mov r8d, eax
call fcn.180039ab0
lea rcx, str.open_firewall1
or ebx, 0xffffffff
mov word [rsp + 0x60], bx
call fcn.180039ab0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
movzx r8d, word [rsp + 0x60]
lea edx, [rbx + 3]
call qword [rax + 0x48]
lea rcx, str.open_firewall2
mov word [rsp + 0x68], bx
call fcn.180039ab0
mov rcx, qword [rsp + 0x30]
movzx r8d, word [rsp + 0x68]
mov rax, qword [rcx]
lea edx, [rbx + 5]
call qword [rax + 0x48]
jmp 0x18000ce61
lea rcx, str.CoCreateInstance_err
call fcn.180039ab0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x18000ce71
mov rdx, qword [rcx]
call qword [rdx + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov al, 1
add rsp, 0x40
pop rbx
ret
Function at 0x18000ce80
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x114
call fcn.180041420
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 5
seta al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18003c1d0
add rsp, 0x158
ret
Function at 0x18000efc4
Capabilities:
Delete file
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rdx
xor esi, esi
lea rdx, [rsp + 0x50]
mov ecx, 0x100
mov rdi, r8
mov dword [rsp + 0x20], esi
mov word [rsp + 0x50], si
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp qword [rdi + 0xc8], 8
jb 0x18000f01c
mov r8, qword [rdi + 0xb0]
jmp 0x18000f023
lea r8, [rdi + 0xb0]
lea rdx, str.popatch_ls
lea rcx, [rsp + 0x28]
call fcn.18002297c
cmp qword [rax + 0x20], 8
jb 0x18000f041
mov rdx, qword [rax + 8]
jmp 0x18000f045
lea rdx, [rax + 8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp qword [rsp + 0x48], 8
jb 0x18000f062
mov rcx, qword [rsp + 0x30]
call fcn.18003c228
lea rcx, [rsp + 0x50]
call fcn.18002088c
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
or rcx, 0xffffffffffffffff
xor eax, eax
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rsi
mov word [rbx + 8], si
lea rdi, [rsp + 0x50]
lea rdx, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.180002a18
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18003c1d0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18000f6b4
Capabilities:
Create process on windows
Delete file

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xd0
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rdx
mov qword [r11 - 0x20], 7
xor edi, edi
mov qword [r11 - 0x28], rdi
mov word [r11 - 0x38], di
lea r8, [r11 - 0x40]
call fcn.18000f2c8
cmp al, dil
jne 0x18000f731
lea rcx, str.download_patch_err
call fcn.180039ab0
nop
cmp qword [rsp + 0xb8], 8
jb 0x18000f72a
mov rcx, qword [rsp + 0xa0]
call fcn.18003c228
xor al, al
jmp 0x18000f878
cmp qword [rbx + 0x148], 8
jb 0x18000f744
mov r8, qword [rbx + 0x130]
jmp 0x18000f74b
lea r8, [rbx + 0x130]
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rdx, qword [rsp + 0xa0]
lea rcx, str.install_patch_file:_ls__argv:_ls
call fcn.180039ab0
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rsp + 0x24]
call fcn.180041420
mov dword [rsp + 0x20], 0x70
mov dword [rsp + 0x24], 0x40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rax, qword [rsp + 0xa0]
mov qword [rsp + 0x38], rax
cmp qword [rbx + 0x148], 8
jb 0x18000f7d2
mov rax, qword [rbx + 0x130]
mov qword [rsp + 0x40], rax
jmp 0x18000f7de
lea rax, [rbx + 0x130]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x58], rdi
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov rcx, qword [rsp + 0x88]
cmp rcx, rdi
je 0x18000f829
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.ShellExecuteW_success
call fcn.180039ab0
jmp 0x18000f83d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ShellExecuteW_Err:_d
call fcn.180039ab0
lea rcx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
cmp qword [rsp + 0xb8], 8
jb 0x18000f876
mov rcx, qword [rsp + 0xa0]
call fcn.18003c228
mov al, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.18003c1d0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xd0
pop rdi
ret
Function at 0x1800144ac
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
and dword [rsp + 0x20], 0
cmp qword [rdx + 0x18], 0xc8
jbe 0x180014504
mov qword [rcx + 0x20], 0xf
and qword [rcx + 0x18], 0
mov byte [rcx + 8], 0
xor r8d, r8d
lea rdx, [0x18005d383]
call fcn.180002794
mov rax, rbx
jmp 0x180014593
lea rcx, [rsp + 0x30]
call fcn.180003e90
nop
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180014564
mov qword [rbx + 0x20], 0xf
and qword [rbx + 0x18], 0
mov byte [rbx + 8], al
xor r8d, r8d
lea rdx, [0x18005d383]
mov rcx, rbx
call fcn.180002794
nop
cmp qword [rsp + 0x50], 8
jb 0x18001455f
mov rcx, qword [rsp + 0x38]
call fcn.18003c228
mov rax, rbx
jmp 0x180014593
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.180014490
nop
cmp qword [rsp + 0x50], 8
jb 0x180014590
mov rcx, qword [rsp + 0x38]
call fcn.18003c228
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18003c1d0
add rsp, 0x60
pop rbx
ret
Function at 0x180020660
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get common file path
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xae8
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov rsi, qword [rsp + 0xb30]
mov rdi, rcx
mov rcx, qword [rsp + 0xb38]
mov qword [rsp + 0x40], rcx
xor ecx, ecx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x48], r8
mov dword [rsp + 0x30], edx
cmp r8, rcx
jne 0x1800206b4
cmp rsi, rcx
je 0x18002086d
cmp word [rdi + 2], 0x3a
je 0x18002070b
cmp word [rdi + 2], 0x5c
je 0x18002070b
mov word [rsp + 0x6c0], cx
lea rcx, [rsp + 0x6c2]
xor edx, edx
mov r8d, 0x40e
call fcn.180041420
lea rdx, [rsp + 0x6c0]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rsp + 0x6c0]
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdi, [rsp + 0x6c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18002086d
test al, 0x10
je 0x18002086d
lea rcx, [rsp + 0x4b0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x18005d4ac]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x18002086d
mov ebx, 1
lea rdx, [0x18005e538]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x180020844
lea rdx, [0x18005d994]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x180020844
cmp dword [rsp + 0x50], 0xffffffff
je 0x180020844
lea rcx, [rsp + 0x2a0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test byte [rsp + 0x50], 0x10
je 0x180020827
test rsi, rsi
je 0x1800207f2
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x2a0]
call rsi
test eax, eax
je 0x18002085b
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x180020844
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x38]
mov r8, qword [rsp + 0x48]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x2a0]
mov edx, eax
mov qword [rsp + 0x20], rsi
call fcn.180020660
cmp eax, 2
jmp 0x180020842
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x180020844
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x2a0]
call rax
test eax, eax
je 0x18002085b
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x180020860
jmp 0x180020770
mov ebx, 2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
jmp 0x18002086f
xor eax, eax
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.18003c1d0
add rsp, 0xae8
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18002088c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jge 0x180020991
lea rcx, [rsp + 0x42]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], di
call fcn.180041420
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.18002127c
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180020902
shr eax, 4
not eax
and eax, 1
jmp 0x180020993
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x250]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rsp + 0x250]
call fcn.1800209b4
cmp eax, edi
je 0x180020991
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, rdi
je 0x18002096f
mov ecx, 1
cmp rax, 0xffffffffffffffff
jne 0x180020971
mov ecx, edi
cmp cl, dil
mov ebx, edi
setne bl
cmp rax, 0xffffffffffffffff
je 0x18002098d
cmp rax, rdi
je 0x18002098d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x180020993
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18003c1d0
mov rbx, qword [rsp + 0x488]
add rsp, 0x470
pop rdi
ret
Function at 0x1800211ec
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x21]
xor ebx, ebx
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], bl
call fcn.180041420
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.1800210e8
mov r11d, 0x179b06cc
movzx edx, byte [rsp + rbx + 0x20]
movzx eax, r11b
mov ecx, r11d
xor rdx, rax
shr ecx, 8
lea rax, [0x1800777f0]
mov r11d, dword [rax + rdx*4]
inc rbx
xor r11d, ecx
cmp rbx, 0x24
jl 0x180021234
not r11d
mov eax, r11d
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18003c1d0
add rsp, 0x140
pop rbx
ret

Function at 0x180021368
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor r12d, r12d
mov rsi, rdx
mov rdi, rcx
cmp rdx, r12
je 0x18002144a
lea rdx, str.deviceMup_
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp rax, rdi
jne 0x1800213d3
lea r8, [0x18005f21c]
lea rdx, str.deviceMup_
mov r9, rsi
mov rcx, rdi
call fcn.18002277c
mov eax, 1
jmp 0x18002144c
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, r12d
mov ebp, eax
bt ebp, ebx
jae 0x180021443
lea ecx, [rbx + 0x61]
mov eax, 0x3a
xor edx, edx
mov word [rsp + 0x20], cx
mov word [rsp + 0x22], ax
xor eax, eax
lea rcx, [rsp + 0x32]
mov r8d, 0x206
mov word [rsp + 0x30], r12w
mov dword [rsp + 0x24], eax
call fcn.180041420
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
cmp eax, r12d
jbe 0x180021443
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov rcx, rdi
call fcn.1800228a8
cmp eax, r12d
jne 0x180021474
inc ebx
cmp ebx, 0x1a
jl 0x1800213de
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18003c1d0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
jmp 0x1800213c1

Function at 0x18002196c
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov ebx, ecx
mov rdi, rdx
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x434
call fcn.180041420
mov edx, ebx
mov ecx, 8
mov dword [rsp + 0x20], 0x438
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
test rax, rax
je 0x1800219f5
cmp rax, 0xffffffffffffffff
je 0x180021a09
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Module32FirstW
jmp 0x1800219f1
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.180022018
test eax, eax
je 0x1800219f5
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1800219d3
cmp rbx, 0xffffffffffffffff
je 0x180021a09
test rbx, rbx
je 0x180021a09
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18003c1d0
mov rbx, qword [rsp + 0x490]
add rsp, 0x470
pop rdi
ret
Function at 0x180021a2c
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rdx
mov rdi, rcx
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x180021ac7
cmp rax, 0xffffffffffffffff
je 0x180021ac7
mov dword [rsp + 0x30], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x34]
call fcn.180041420
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x180021ac7
mov rdx, rsi
lea rcx, [rsp + 0x30]
call rdi
test eax, eax
je 0x180021ac7
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x180021aa8
cmp rbx, 0xffffffffffffffff
je 0x180021adb
test rbx, rbx
je 0x180021adb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.18003c1d0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x180021b00
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xe0
xor ebx, ebx
mov rdi, rcx
cmp rcx, rbx
jne 0x180021b1e
xor eax, eax
jmp 0x180021ba8
xor edx, edx
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x70], 0x68
lea r8d, [rdx + 0x60]
call fcn.180041420
xor eax, eax
mov rcx, rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
call fcn.180020614
xor r9d, r9d
xor r8d, r8d
mov rdi, rax
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rdx, rdi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebx
je 0x180021b9d
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.18003cf20
mov rax, rbx
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rdi
ret
Function at 0x180021db4
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, rdx
mov r8d, ecx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edi, edi
mov rbx, rax
cmp rax, rdi
je 0x180021e48
cmp rax, 0xffffffffffffffff
je 0x180021e5c
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.180041420
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rbx
call sub.PSAPI.DLL_GetProcessImageFileNameW
cmp eax, edi
jbe 0x180021e3b
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.180021368
mov edi, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x180021e5e
cmp rax, 0xffffffffffffffff
je 0x180021e5c
cmp rax, rdi
je 0x180021e5c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18003c1d0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x180021e84
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebx, eax
jne 0x180021ea3
mov eax, 1
jmp 0x180021ee6
xor edx, edx
mov r8d, ebx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x180021ece
cmp rax, 0xffffffffffffffff
je 0x180021ece
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, eax
jmp 0x180021ed0
xor edi, edi
cmp rbx, 0xffffffffffffffff
je 0x180021ee4
test rbx, rbx
je 0x180021ee4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180022acc
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
sub rsp, 0x38
lea rax, [r11 + 0x20]
mov r9d, 4
lea r8, str.NacSafeCheck
mov dword [r11 - 0x10], r9d
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
mov qword [r11 - 0x18], rax
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor ecx, ecx
cmp eax, ecx
sete cl
mov eax, ecx
add rsp, 0x38
ret

Function at 0x180022b14
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor ebx, ebx
mov rdi, r9
mov rbp, r8
mov rsi, rdx
cmp r9, rbx
je 0x180022b4a
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x180022b4c
mov eax, ebx
lea ecx, [rax + rax + 2]
mov r9d, 1
mov r8, rbp
mov dword [rsp + 0x28], ecx
mov rcx, 0xffffffff80000002
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp eax, ebx
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18003c1d0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x180022b94
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x860
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rbp, r9
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor r12d, r12d
mov dword [rsp + 0x38], r12d
mov qword [rcx + 0x20], 7
mov qword [rcx + 0x18], r12
mov word [rcx + 8], r12w
mov dword [rsp + 0x38], 1
mov rsi, r12
cmp r8, r12
je 0x180022d0d
mov word [rsp + 0x50], r12w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0x52]
call fcn.180041420
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x34], r12d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x34]
mov r8, rbp
mov rdx, rdi
mov r13, 0xffffffff80000002
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [rsp + 0x34], 1
je 0x180022c5d
cmp dword [rsp + 0x34], 2
jne 0x180022d0d
mov eax, dword [rsp + 0x30]
cmp eax, r12d
je 0x180022d0d
cmp eax, 0x800
jbe 0x180022cb3
lea rcx, [rax + 2]
call fcn.18003cf60
mov rsi, rax
mov r8d, dword [rsp + 0x30]
add r8, 2
xor edx, edx
mov rcx, rax
call fcn.180041420
lea r11, [rsp + 0x30]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, rbp
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
jmp 0x180022cd9
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rbp
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea rdx, [rsp + 0x50]
cmp rsi, r12
cmovne rdx, rsi
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.180002a18
cmp rsi, r12
je 0x180022d0d
mov rcx, rsi
call fcn.18003cf20
mov rax, rbx
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.18003c1d0
mov rbx, qword [rsp + 0x898]
add rsp, 0x860
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret