joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d710
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
call fcn.0040d630
movzx edx, word [rbx + 8]
mov rcx, qword [rbx]
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rbx + 0x250], rax
test rax, rax
jne 0x40d74d
xor eax, eax
jmp 0x40d8fb
mov rcx, qword [rbx]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbx + 0x258], rax
test rax, rax
je 0x40d746
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbx + 0x260], rax
test rax, rax
je 0x40d746
mov rdx, qword [rbx + 0x250]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [rbx + 0x260]
lea rdx, [rbx + 0x268]
and dword [rdx], 0
mov dword [rbx + 0x26c], eax
test rcx, rcx
jne 0x40d7aa
xor eax, eax
jmp 0x40d7b2
mov r8d, eax
call fcn.00401458
mov qword [rbx + 0x230], rax
test rax, rax
je 0x40d746
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.00401288
mov rsi, qword [rbx + 0x230]
mov r11d, dword [rsp + 0x34]
mov eax, dword [rsp + 0x38]
mov dword [rbx + 0x27c], r11d
mov dword [rbx + 0x280], eax
test rsi, rsi
jne 0x40d7f1
xor edi, edi
jmp 0x40d80e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rax
call fcn.0040130c
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rbx + 0x218], rdi
test rdi, rdi
je 0x40d746
mov rcx, qword [rbx + 0x230]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, 1
cmp word [rax + 0xe], 0x18
je 0x40d857
mov dword [rbx + 0x240], edi
mov ecx, dword [rax]
xor edx, edx
add rcx, rax
cmp dword [rax + 0x20], edx
jle 0x40d857
mov word [rcx], dx
add edx, edi
add rcx, 2
cmp edx, dword [rax + 0x20]
jl 0x40d849
mov rcx, qword [rbx + 0x230]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [rbx + 0x26c]
mov rcx, qword [rbx + 0x260]
mov dword [rbx + 0x244], edi
call fcn.00401164
cmp dword [rsp + 0x40], 0
mov qword [rbx + 0x220], rax
je 0x40d89c
test rax, rax
jne 0x40d8a1
mov rcx, rbx
call fcn.0040d630
jmp 0x40d746
test rax, rax
je 0x40d8f9
cmp dword [rbx + 0x248], 0
jne 0x40d8f9
mov rdx, qword [rbx + 0x218]
mov rcx, rax
call fcn.00401868
mov qword [rbx + 0x228], rax
test rax, rax
je 0x40d88f
mov r9d, dword [rbx + 0x278]
mov r8d, dword [rbx + 0x274]
mov rdx, qword [rbx + 0x218]
lea rcx, [rbx + 0x270]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx + 0x220]
call fcn.00401738
mov qword [rbx + 0x238], rax
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x40ddbc
Capabilities:
Check os version
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x980
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x970], rax
xor esi, esi
mov rbx, rdx
mov edi, ecx
cmp rdx, rsi
je 0x40df93
xor eax, eax
dec ecx
mov qword [rdx], rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
je 0x40df93
cmp eax, edi
ja 0x40df93
mov edi, VarUI4FromDisp
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8, rdi
call fcn.00449860
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, esi
je 0x40de3b
cmp dword [rsp + 0x54], 5
ja 0x40de61
mov ecx, 0x1000
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, esi
jne 0x40de61
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx - 1]
jmp 0x40df95
lea rax, [rsp + 0x38]
lea rdx, str.SystemCurrentControlSetControlTerminal_Server
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov edi, esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x40df5a
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea rdx, str.PerSessionTempDir
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x40deda
cmp dword [rsp + 0x30], esi
sete dil
cmp edi, esi
jne 0x40df47
lea rcx, [rsp + 0x172]
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x170], si
call fcn.00449860
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea rdx, str.FlatTempDir
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x170]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 0x400
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x40df47
lea rcx, [rsp + 0x170]
call fcn.0044531c
mov edi, esi
cmp eax, esi
setne dil
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jne 0x40de4a
mov edi, 0x5c
mov rcx, rbx
mov edx, edi
call fcn.00444ed8
cmp rax, rsi
je 0x40df77
cmp word [rax + 2], si
jne 0x40df77
mov word [rax], si
mov edx, edi
mov rcx, rbx
call fcn.00444ed8
cmp rax, rsi
je 0x40de4a
mov word [rax + 2], si
jmp 0x40de4a
xor eax, eax
mov rcx, qword [rsp + 0x970]
xor rcx, rsp
call fcn.00443d60
lea r11, [rsp + 0x980]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x40dfc0
Capabilities:
Check os version
Shutdown system

Disassembly:
push rbx
sub rsp, 0x190
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x180], rax
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x60], VarUI4FromDisp
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40e0f9
cmp dword [rsp + 0x70], 2
jne 0x40e0e7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x38]
lea edx, [rbx + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40e07d
lea r8, [rsp + 0x50]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov r11, qword [rsp + 0x50]
mov qword [rsp + 0x44], r11
mov ebx, 1
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x4c], 2
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
jmp 0x40e082
mov ebx, 1
cmp dword [rsp + 0x64], 5
ja 0x40e0b8
cmp dword [rsp + 0x64], 5
jne 0x40e097
cmp dword [rsp + 0x68], 0
ja 0x40e0b8
mov dword [rsp + 0x20], ebx
mov r9d, ebx
xor r8d, r8d
lea rdx, [0x004998e4]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
mov ebx, eax
mov dword [rsp + 0x30], eax
jmp 0x40e0df
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], ebx
mov r9d, ebx
xor r8d, r8d
lea rdx, [0x004998e4]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
mov ebx, eax
mov dword [rsp + 0x30], eax
jmp 0x40e0f9
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
setne al
jmp 0x40e0fe
test ebx, ebx
setne al
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.00443d60
add rsp, 0x190
pop rbx
ret
Function at 0x40e408
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x470
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbp, rcx
xor ecx, ecx
mov r12, r9
mov rdi, r8
call fcn.004456bc
mov rcx, rax
call fcn.00445720
mov ebx, 0x208
lea rcx, [rsp + 0x252]
xor r14d, r14d
mov r8, rbx
xor edx, edx
mov word [rsp + 0x250], r14w
call fcn.00449860
lea rcx, [rsp + 0x42]
mov r8, rbx
xor edx, edx
mov word [rsp + 0x40], r14w
call fcn.00449860
call fcn.0044573c
lea edx, [r14 + 2]
mov rcx, rdi
mov ebx, eax
mov esi, r14d
call fcn.00445770
cmp eax, r14d
je 0x40e4b9
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
mov rcx, rdi
call fcn.00445770
cmp eax, r14d
je 0x40e4b9
xor eax, eax
jmp 0x40e589
mov r8, rdi
mov edi, 0x105
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.004444bc
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rcx, [rsp + 0x40]
mov r8, r12
mov rdx, rdi
call fcn.00444f54
or r12, 0xffffffffffffffff
mov eax, ebx
lea r9, str._s_04X._s
lea rcx, [rsp + 0x250]
cdq
mov r8, r12
movzx edx, dx
add eax, edx
movzx ebx, ax
lea rax, [0x0049d3f8]
mov qword [rsp + 0x30], rax
sub ebx, edx
lea rax, [rsp + 0x40]
mov rdx, rdi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call fcn.00445024
lea rcx, [rsp + 0x250]
xor edx, edx
inc ebx
inc esi
call fcn.00445770
cmp eax, r14d
jne 0x40e54e
cmp esi, 0x10000
jl 0x40e4ed
xor edx, edx
mov r8d, 0x104
mov rcx, rbp
call fcn.00449860
lea r8, [rsp + 0x250]
mov edx, 0x103
mov rcx, rbp
call fcn.004444bc
xor eax, eax
lea rdi, [rsp + 0x250]
mov rcx, r12
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx - 1]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.00443d60
mov rbx, qword [rsp + 0x4a8]
add rsp, 0x470
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x40e5b8
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x20], di
call fcn.00449860
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x105
call fcn.004444bc
lea edx, [rdi + 0x5c]
lea rcx, [rsp + 0x20]
call fcn.00444ed8
cmp rax, rdi
jne 0x40e61b
xor eax, eax
jmp 0x40e65c
lea rcx, [rsp + 0x20]
xor edx, edx
mov word [rax], di
call fcn.00445770
cmp eax, edi
je 0x40e63c
lea rcx, [rsp + 0x20]
call fcn.0040e5b8
cmp eax, edi
je 0x40e617
xor edx, edx
mov rcx, rbx
call fcn.00445770
cmp eax, edi
jne 0x40e651
mov eax, 1
jmp 0x40e65c
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.00443d60
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret
Function at 0x411b68
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x1a0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov r13, r8
mov rbx, rdx
xor edi, edi
cmp qword [rdx + 0x20], 8
jb 0x411bad
mov rcx, qword [rdx + 8]
jmp 0x411bb1
lea rcx, [rdx + 8]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x411c40
mov r8, rbx
lea rdx, str.Failed_to_open_file:
lea rcx, [rsp + 0x50]
call fcn.0040621c
nop
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
mov rcx, qword [0x004c5758]
call fcn.00429edc
nop
cmp qword [rsp + 0x70], 8
jb 0x411c25
mov rcx, qword [rsp + 0x58]
call fcn.00443d3c
mov ebx, 7
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rdi
mov word [rsp + 0x58], di
xor al, al
jmp 0x411dab
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
add eax, 2
mov r12d, eax
mov ecx, eax
call fcn.004444b0
mov rbx, rax
cmp rax, rdi
jne 0x411cd2
mov ebx, 7
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rdi
mov word [rsp + 0x58], di
lea r8d, [rbx + 0x34]
lea rdx, str.new_allocation_failed_in_CPropertyBag::GetArgsFromArgFile__
lea rcx, [rsp + 0x50]
call fcn.00404e54
nop
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
mov rcx, qword [0x004c5758]
call fcn.00429edc
nop
cmp qword [rsp + 0x70], 8
jb 0x411cbc
mov rcx, qword [rsp + 0x58]
call fcn.00443d3c
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rdi
mov word [rsp + 0x58], di
xor al, al
jmp 0x411dab
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.00449860
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x40]
mov r8d, ebp
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
je 0x411d97
mov eax, 0xfeff
cmp word [rbx], ax
jne 0x411d2f
lea rdx, [rbx + 2]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r13
call fcn.00404e54
jmp 0x411d94
lea rax, [rsp + 0x88]
mov qword [rsp + 0x80], rax
mov r8d, 3
mov rdx, rbx
lea rcx, [rsp + 0x80]
call fcn.00411dd8
nop
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdx, qword [rsp + 0x80]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r13
call fcn.00404e54
nop
lea rax, [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
cmp rcx, rax
je 0x411d94
call fcn.0044460c
mov dil, 1
mov rcx, rbx
call fcn.00444544
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, dil
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.00443d60
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1a0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x418098
Capabilities:
Create process on windows

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rbx, rcx
call fcn.0040e684
cmp eax, 1
jne 0x4180f8
cmp qword [rbx + 0x388], 8
jb 0x4180cc
mov r8, qword [rbx + 0x370]
jmp 0x4180d3
lea r8, [rbx + 0x370]
xor edi, edi
mov dword [rsp + 0x28], edi
lea r9, [0x004998e4]
mov qword [rsp + 0x20], r9
lea rdx, str.print
mov rcx, qword [rbx + 8]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x418135
cmp qword [rbx + 0x360], 8
jb 0x41810b
mov r8, qword [rbx + 0x348]
jmp 0x418112
lea r8, [rbx + 0x348]
xor edi, edi
mov dword [rsp + 0x28], edi
lea r9, [0x004998e4]
mov qword [rsp + 0x20], r9
lea rdx, str.print
mov rcx, qword [rbx + 8]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
ja 0x4181a0
cmp qword [rbx + 0x360], 8
jb 0x41814e
mov r8, qword [rbx + 0x348]
jmp 0x418155
lea r8, [rbx + 0x348]
mov edx, 0x122c
lea rcx, [rsp + 0x38]
call fcn.004524d0
nop
mov rcx, qword [rbx + 0x48]
add rcx, 0x50
mov r9, qword [rcx]
xor r8d, r8d
mov rdx, rax
call qword [r9 + 0x18]
nop
cmp qword [rsp + 0x58], 8
jb 0x41818d
mov rcx, qword [rsp + 0x40]
call fcn.00443d3c
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rdi
mov word [rsp + 0x40], di
movabs rax, 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x41a10c
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r9, qword [rsp + 0xa0]
xor edi, edi
mov ebx, edi
lea esi, [rdi + 1]
sub edx, 0x100
je 0x41a17b
sub edx, 0x11
je 0x41a164
cmp edx, 0xf1
jne 0x41a31c
mov ebx, dword [rcx + 0x324]
jmp 0x41a191
mov rax, r8
shr rax, 0x10
cmp ax, si
jne 0x41a176
movzx ebx, r8w
jmp 0x41a191
mov dword [r9], edi
jmp 0x41a191
cmp r8, 0xd
je 0x41a18b
cmp r8, 0x20
jne 0x41a31c
mov ebx, dword [rcx + 0x320]
cmp ebx, edi
je 0x41a2b2
mov r9, qword [rcx + 0x388]
lea r8d, [rbx - 0x148]
mov eax, r8d
cmp rax, r9
jae 0x41a2b2
lea eax, [rbx - 0x148]
cmp eax, edi
jl 0x41a2b2
mov rax, qword [rcx + 0x380]
mov rax, qword [rax]
mov edx, edi
cmp r8d, edi
jbe 0x41a1e3
mov ecx, edx
cmp rcx, r9
jae 0x41a1e3
mov rax, qword [rax]
add edx, esi
cmp edx, r8d
jb 0x41a1d2
lea rcx, [rax + 0x10]
lea rdx, [rsp + 0x38]
call fcn.00418c98
nop
mov qword [rsp + 0x20], rdi
lea r9, [0x004998e4]
mov r8, qword [rsp + 0x50]
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.00406604
cmp eax, edi
je 0x41a28d
mov qword [rsp + 0x20], 3
lea r9, [0x0049e8a0]
mov r8, qword [rsp + 0x50]
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.00406604
cmp eax, edi
jne 0x41a260
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
lea r9, str.appwiz.cpl
lea r8, str.control.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x41a28d
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r8, qword [rsp + 0x40]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
cmp qword [rsp + 0x58], 8
jb 0x41a29f
mov rcx, qword [rsp + 0x40]
call fcn.00443d3c
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rdi
mov word [rsp + 0x40], di
cmp ebx, 0x26d
jne 0x41a31c
mov edx, 0x12cb
lea rcx, [rsp + 0x38]
call fcn.00452494
nop
cmp qword [rax + 0x20], 8
jb 0x41a2d7
mov r8, qword [rax + 8]
jmp 0x41a2db
lea r8, [rax + 8]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
cmp qword [rsp + 0x58], 8
jb 0x41a309
mov rcx, qword [rsp + 0x40]
call fcn.00443d3c
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rdi
mov word [rsp + 0x40], di
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.00443d60
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x41b098
Capabilities:
Hide graphical window

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rbp, rcx
mov rax, qword [rcx + 0x348]
mov rbx, qword [rax]
or dword [r11 + 8], 0xffffffff
cmp rbx, rax
je 0x41b244
mov esi, 0x145
lea eax, [rsi - 0x145]
cmp eax, 3
jge 0x41b244
lea edx, [rsi - 0x23]
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r12, rax
mov edx, esi
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r13, rax
mov edx, 5
mov rcx, r12
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 5
mov rcx, r13
call qword [sym.imp.USER32.dll_ShowWindow]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x40]
lea rcx, [rbx + 0x10]
call fcn.0041a7c0
nop
mov r8, rax
mov rdx, r12
mov rcx, rbp
call fcn.0041d3ac
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x40]
lea rcx, [rbx + 0x10]
call fcn.0041a7c0
nop
mov dword [rsp + 0x20], 0x64
mov r9, rax
lea r8, [rsp + 0x90]
mov rdx, r12
mov rcx, rbp
call fcn.0041b7a4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x40]
lea rcx, [rbx + 0x10]
call fcn.0041a818
nop
mov r8, rax
mov rdx, r13
mov rcx, rbp
call fcn.00425e18
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x40]
lea rcx, [rbx + 0x10]
call fcn.0041a818
nop
mov dword [rsp + 0x20], 0x64
mov r9, rax
lea r8, [rsp + 0x90]
mov rdx, r13
mov rcx, rbp
call fcn.0041b7a4
cmp byte [rbx + 0xa0], 0
je 0x41b1ff
xor r9d, r9d
mov edx, 0xf1
lea r8d, [r9 + 1]
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x41b213
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf1
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [rbx + 0xa1], 0
jne 0x41b232
xor edx, edx
mov rcx, r12
call qword [sym.imp.USER32.dll_EnableWindow]
xor edx, edx
mov rcx, r13
call qword [sym.imp.USER32.dll_EnableWindow]
mov rbx, qword [rbx]
inc esi
cmp rbx, qword [rbp + 0x348]
jne 0x41b0d9
mov rax, qword [rsp + 0xb0]
mov dword [rax], 1
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x427ea4
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r10, qword [rsp + 0xa0]
xor ebx, ebx
mov r9d, ebx
lea edi, [rbx + 1]
sub edx, 0x100
je 0x427f11
sub edx, 0x11
je 0x427efa
cmp edx, 0xf1
jne 0x427fea
mov r9d, dword [rcx + 0x324]
jmp 0x427f28
mov rax, r8
shr rax, 0x10
cmp ax, di
jne 0x427f0c
movzx r9d, r8w
jmp 0x427f28
mov dword [r10], ebx
jmp 0x427f28
cmp r8, 0xd
je 0x427f21
cmp r8, 0x20
jne 0x427fea
mov r9d, dword [rcx + 0x320]
cmp r9d, ebx
je 0x427fea
cmp r9d, 0x26b
jne 0x427fea
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
mov rax, qword [0x004c5760]
mov rdx, qword [rax + 0x28]
add rdx, 0x2e8
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.004020b0
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r8, qword [rsp + 0x40]
lea rdx, str.Shell_Execute_of_URL__s
mov rcx, qword [0x004c5758]
call fcn.0042a050
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r8, qword [rsp + 0x40]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
cmp qword [rsp + 0x58], 8
jb 0x427fd7
mov rcx, qword [rsp + 0x40]
call fcn.00443d3c
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.00443d60
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x42809c
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x310
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x300], rax
cmp qword [rdx + 0x20], 8
mov rdi, rdx
lea rbx, [rdx + 8]
jb 0x4280d3
mov r8, qword [rbx]
jmp 0x4280d6
mov r8, rbx
mov rcx, qword [0x004c5758]
lea rdx, str.Attempt_to_spawn_process_from_regkey__s
call fcn.0042a050
xor esi, esi
cmp qword [rdi + 0x20], 8
mov qword [rsp + 0x50], rsi
jb 0x4280fa
mov rbx, qword [rbx]
lea rax, [rsp + 0x50]
mov edi, 1
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
mov r9d, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x42813b
mov rcx, qword [0x004c5758]
lea rdx, str.Key_not_found
call fcn.00429b54
jmp 0x42826c
lea rcx, [rsp + 0xf2]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0xf0], si
call fcn.00449860
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
lea r9, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
xor edx, edx
mov dword [rsp + 0x5c], 0x103
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x4281ac
mov rcx, qword [0x004c5758]
lea rdx, str.Error_reading_key
call fcn.00429b54
jmp 0x428261
mov ebx, 0x68
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8, rbx
call fcn.00449860
xor eax, eax
lea rdx, [rsp + 0xf0]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x80], ebx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [0x004c5758]
lea r8, [rsp + 0xf0]
cmp eax, esi
je 0x428255
lea rdx, str.Spawned_process_with_command_line__s
call fcn.0042a050
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x428261
lea rdx, str.Error_trying_to_spawn_process_with_command_line__s
call fcn.0042a0e8
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.00443d60
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x429a48
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [rcx + 8], 0xffffffffffffffff
mov rbx, rcx
jne 0x429b37
cmp qword [rcx + 0x30], 8
jb 0x429a78
mov rcx, qword [rcx + 0x18]
jmp 0x429a7c
add rcx, 0x18
and qword [rsp + 0x30], 0
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
mov dword [rsp + 0x28], 0x80000080
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x429ab5
xor al, al
jmp 0x429b39
cmp dword [rbx + 0x40], 0
jne 0x429b04
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x429b04
mov rcx, qword [rbx + 8]
and qword [rsp + 0x20], 0
lea r8d, [rax + 6]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x44]
mov dword [rsp + 0x40], r8d
mov byte [rsp + 0x44], 0xff
mov byte [rsp + 0x45], 0xfe
mov byte [rsp + 0x46], 0xd
mov byte [rsp + 0x47], al
mov byte [rsp + 0x48], 0xa
mov byte [rsp + 0x49], al
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbx + 8]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rdx, str._Logging_started_
mov rcx, rbx
call fcn.00429b54
lea rdx, [0x0049fe30]
mov rcx, rbx
call fcn.00429b54
mov al, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.00443d60
add rsp, 0x60
pop rbx
ret