joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800053a0
Capabilities:
Delete service
Query service status

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x60
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x1800053d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rsi
ret
cmp qword [0x1800290a8], rbx
mov qword [rsp + 0x78], rdi
jne 0x18000540c
mov ecx, 0x1994
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
test rax, rax
je 0x180005405
mov dword [rax + 0x1990], ebx
mov qword [0x1800290a8], rax
jmp 0x18000540c
mov qword [0x1800290a8], rbx
lea rdx, [0x180029bec]
mov r8d, 0xf01ff
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x18000543d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x424
jne 0x18000548d
xor ebx, ebx
jmp 0x18000548d
lea rax, [rsp + 0x70]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x18000547c
cmp dword [rsp + 0x34], 1
je 0x18000546f
mov ebx, SQLDriversW
jmp 0x180005484
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x180005484
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rsi
ret
Function at 0x180005df0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
push rbp
push r12
sub rsp, 0x40
mov eax, r8d
mov rbp, rdx
lea r9, [rdx + 0x4c]
lea r8, [rdx + 8]
mov dword [rdx + 0x110], eax
lea rdx, [rsp + 0x78]
xor ebx, ebx
mov r12, rcx
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x78], rbx
call fcn.180006070
test eax, eax
jne 0x18000602c
mov qword [rsp + 0x60], rsi
mov ecx, 0xf010
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r13
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
lea rcx, [rsp + 0x68]
mov qword [rax], 0x2d2f2757
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11d, dword [0x18002a840]
mov dword [rdi + 0xc], ebx
imul r11d, r11d, 0x7f
add r11d, dword [rsp + 0x6c]
mov ecx, r11d
shr ecx, 3
add ecx, dword [rsp + 0x68]
add r11d, ecx
mov dword [0x18002a840], r11d
and r11d, 0x1f
mov dword [rdi + 8], r11d
jle 0x180005ece
lea rsi, [rdi + 0x10]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11d, dword [0x18002a840]
inc ebx
inc rsi
imul r11d, r11d, 0x7f
add r11d, dword [rsp + 0x6c]
mov eax, r11d
shr eax, 3
add eax, dword [rsp + 0x68]
add r11d, eax
mov byte [rsi - 1], r11b
mov dword [0x18002a840], r11d
cmp ebx, dword [rdi + 8]
jl 0x180005e91
mov rbx, qword [rsp + 0x78]
mov r8d, 0x7530
mov rdx, rdi
mov rcx, rbx
call fcn.180018160
lea rcx, [r12 + 0x69b0]
mov r8d, 0x120
mov rdx, rbp
mov esi, eax
call fcn.18001ca04
test esi, esi
jne 0x180005fc3
lea rbp, [0x180000000]
nop dword [rax + rax]
mov r8d, 0x493e0
mov rdx, rdi
mov rcx, rbx
call fcn.180017f90
mov esi, eax
test eax, eax
jne 0x180005fc3
mov eax, dword [rdi + 4]
dec eax
cmp eax, 9
ja case.0x180005f3f.2
mov ecx, dword [rbp + rax*4 + 0x6040]
add rcx, rbp
jmp rcx
mov r8, rdi
mov rdx, rbx
mov rcx, r12
call fcn.180006510
jmp 0x180005f9d
mov rdx, rdi
mov rcx, r12
call fcn.1800069d0
jmp 0x180005f9d
mov rdx, rdi
mov rcx, rbx
call fcn.180006b60
jmp 0x180005f9d
mov rdx, rdi
mov rcx, rbx
call fcn.180006df0
jmp 0x180005f9d
mov rdx, rdi
mov rcx, rbx
call fcn.180006c40
jmp 0x180005f9d
mov rcx, rdi
call fcn.180006cd0
jmp 0x180005f9d
mov r8, rdi
mov rdx, rbx
mov rcx, r12
call fcn.180006f20
mov esi, eax
test eax, eax
je case.0x180005f3f.2
jmp 0x180005fc3
mov edx, dword [rdi + 0x10]
lea rcx, [r12 + 0x158]
call fcn.180003f50
jmp case.0x180005f3f.2
mov esi, 0x2746
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov rcx, rbx
call qword [rbx + 0x28]
mov eax, dword [rbx + 0x84]
mov rdi, qword [rsp + 0x38]
sub eax, 2
je 0x180005fee
dec eax
je 0x180006035
dec eax
je 0x180005fee
dec eax
jne 0x18000600b
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
lea rcx, [r12 + 0x69b0]
xor edx, edx
mov r8d, 0x120
call fcn.18001ca58
mov r13, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop r12
pop rbp
pop rbx
ret
mov rcx, rbx
call fcn.180019b20
jmp 0x180006002
Function at 0x180006070
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x450
mov ebx, dword [rsp + 0x490]
mov rsi, r9
mov rbp, r8
mov r10d, ebx
mov r12, rdx
mov r13, rcx
sub r10d, 2
lea rdi, [0x180023a04]
je 0x1800060d8
dec r10d
je 0x1800060cf
dec r10d
je 0x1800060c6
dec r10d
jne 0x1800060df
lea rdi, str.ICMP
jmp 0x1800060df
lea rdi, [0x180023b84]
jmp 0x1800060df
lea rdi, str.HTTP
jmp 0x1800060df
lea rdi, [0x180023b78]
movzx edx, word [r9 + 2]
movzx r11d, word [r9]
movzx r8d, word [r8 + 2]
lea rcx, [r9 + 0x44]
lea rax, [r9 + 0x84]
lea r10, [r9 + 4]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], edx
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], r8d
lea r9, [rbp + 4]
lea rdx, str.Protocol:__4s___Host:___s:_d___Proxy:___d:_s:_d:_s:_s__r_n
lea rcx, [rsp + 0x50]
mov r8, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x50]
call sub.KERNEL32.dll_OutputDebugStringA
sub ebx, 2
je 0x180006181
dec ebx
je 0x18000616e
dec ebx
je 0x18000615b
dec ebx
je 0x180006154
mov eax, 0x54f
jmp 0x180006192
mov eax, 0x32
jmp 0x180006192
mov r9, rsi
mov r8, rbp
mov rdx, r12
mov rcx, r13
call fcn.1800063e0
jmp 0x180006192
mov r9, rsi
mov r8, rbp
mov rdx, r12
mov rcx, r13
call fcn.180006330
jmp 0x180006192
mov r9, rsi
mov r8, rbp
mov rdx, r12
mov rcx, r13
call fcn.180006210
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1800069d0
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 0x120
mov rdi, rdx
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
lea rdx, [rbx + 0x38]
mov r8d, 0x120
mov rcx, rax
mov rbp, rax
call fcn.18001ca04
mov ecx, dword [rdi + 0x10]
mov rbx, qword [0x1800290b0]
mov dword [rbp + 0x118], ecx
mov ecx, dword [rdi + 0x14]
mov dword [rbp + 0x11c], ecx
test rbx, rbx
jne 0x180006a5b
lea ecx, [rbx + 0x40]
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rbx, rax
test rax, rax
je 0x180006a52
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [rbx + 0x28]
mov qword [r11], r11
mov qword [r11 + 8], r11
mov dword [r11 + 0x10], 0
jmp 0x180006a54
xor ebx, ebx
mov qword [0x1800290b0], rbx
mov ecx, 0x38
mov qword [rsp + 0x48], rsi
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rdi, rax
test rax, rax
jne 0x180006a86
mov rcx, rbp
lea ebx, [rax + 8]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov eax, ebx
jmp 0x180006b3f
lea rax, [rsp + 0x40]
lea r8, [0x18001c790]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test rax, rax
jne 0x180006ad6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
test ebx, ebx
je 0x180006b34
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov eax, ebx
jmp 0x180006b3f
mov qword [rdi + 0x18], rbx
mov eax, dword [rsp + 0x40]
mov rcx, rbx
mov dword [rdi + 0x10], eax
lea rax, str.OlProcManager
mov qword [rdi + 0x28], rbp
mov qword [rdi + 0x30], rax
lea rax, [0x180007000]
mov qword [rdi + 0x20], rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r11, [rbx + 0x28]
mov qword [rdi], r11
mov rax, qword [r11 + 8]
mov rcx, rbx
mov qword [rdi + 8], rax
mov rax, qword [r11 + 8]
mov qword [rax], rdi
mov qword [r11 + 8], rdi
inc dword [r11 + 0x10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180007cc0
Capabilities:
Compress data via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x18002a730]
mov rbx, r9
mov rdi, r8
mov esi, edx
mov rbp, rcx
test rax, rax
jne 0x180007d22
mov rax, qword [0x18002a710]
test rax, rax
jne 0x180007d0b
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x18002a710], rax
lea rdx, str.RtlCompressBuffer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18002a730], rax
mov rcx, qword [rsp + 0x70]
mov r9, rdi
mov r8d, esi
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rbx
mov ecx, 2
mov rdx, rbp
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xf000
call rax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180008a90
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
mov eax, 0x1060
call fcn.180022e80
sub rsp, rax
mov rsi, rdx
xor edx, edx
mov rdi, rcx
lea r8d, [rdx + 0x30]
lea rcx, [rsp + 0x30]
call fcn.18001ca58
mov ebp, 0x5a4d
mov r12d, 0x80000000
nop dword [rax]
mov rbx, qword [rsp + 0x48]
add rbx, qword [rsp + 0x30]
cmp rbx, r12
jae 0x180008b69
lea r8, [rsp + 0x30]
mov r9d, 0x30
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x180008b69
cmp dword [rsp + 0x50], 0x1000
jne 0x180008ad0
cmp dword [rsp + 0x58], 0x1000000
jne 0x180008ad0
lea rax, [rsp + 0x1090]
lea r8, [rsp + 0x60]
mov r9d, 0x1000
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x180008b69
cmp bp, word [rsp + 0x60]
jne 0x180008ad0
movsxd rax, dword [rsp + 0x9c]
cmp dword [rsp + rax + 0x60], 0x4550
jne 0x180008ad0
mov eax, dword [rsp + rax + 0x88]
add rax, rbx
mov qword [rsi], rax
xor eax, eax
jmp 0x180008b6e
mov eax, 0x490
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x180009360
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor r12d, r12d
mov rdi, rcx
mov ecx, 0x1002
mov qword [rax - 0x40], r12
mov qword [rax - 0x30], r12
mov qword [rax - 0x38], r12
mov dword [rax - 0x48], r12d
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rbp, rax
test rax, rax
je 0x1800093ad
mov word [rax + 0x1000], r12w
cmp qword [0x1800290a8], r12
jne 0x1800093dd
mov ecx, 0x1994
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
test rax, rax
je 0x1800093d6
mov dword [rax + 0x1990], r12d
mov qword [0x1800290a8], rax
jmp 0x1800093dd
mov qword [0x1800290a8], r12
lea rdx, [0x1800299ec]
lea rcx, [rsp + 0x40]
call fcn.180014980
mov r15, qword [rsp + 0x58]
lea r14, [rdi + 0x2010]
add rdi, 8
mov esi, r12d
nop word [rax + rax]
lea rdx, str._s_d.plg
mov r9d, esi
mov r8, r15
mov rcx, rbp
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, r14
xor r13d, r13d
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, 0xffffffff
cmp ebx, ecx
je 0x180009451
cmp qword [rdi], r13
jne 0x18000946c
lea r12d, [r13 + 1]
jmp 0x18000946c
mov rax, qword [rdi]
test rax, rax
je 0x18000946c
cmp rax, rcx
je 0x18000946c
mov r13d, 1
mov qword [rsp + 0x98], rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r12d, r12d
je 0x1800094e4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r12d, r12d
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x20], r12d
call fcn.180004500
test eax, eax
je 0x1800094ba
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1800094e7
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
jmp 0x1800094e7
mov rbx, qword [rsp + 0x28]
mov r8d, dword [rsp + 0x20]
lea rcx, [rsp + 0x98]
mov rdx, rbx
call fcn.180007d70
test rbx, rbx
je 0x1800094e7
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
jmp 0x1800094e7
xor r12d, r12d
test r13d, r13d
je 0x1800094f2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
inc esi
add rdi, 0x40
cmp esi, 0x80
jl 0x180009410
test rbp, rbp
je 0x180009512
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180009522
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180009910
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x18002a738]
test rax, rax
jne 0x1800099a5
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.PI__8.8X_
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x180009984
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x18002a738], rax
test rax, rax
jne 0x180009990
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x18002a738]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x18000af80
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x290
mov r13, r8
mov rbx, rdx
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
add ebp, ebp
lea r9d, [rbp + 2]
movsxd rcx, r9d
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
xor esi, esi
mov rdi, rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], esi
test rax, rax
je 0x18000aff3
movsxd r8, ebp
mov rdx, r12
mov rcx, rax
mov esi, ebp
mov dword [rsp + 0x20], ebp
mov word [r8 + rax], 0
call fcn.18001ca04
mov eax, esi
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
cmp word [rdi + rcx*2 - 2], 0x5c
jne 0x18000b011
cmp word [rbx], 0x5c
jne 0x18000b02e
lea rcx, [rbx + 2]
jmp 0x18000b031
cmp word [rbx], 0x5c
je 0x18000b02e
lea rdx, [0x180023a00]
lea rcx, [rsp + 0x20]
mov r8d, 2
call fcn.1800046d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x20]
mov rdx, rbx
lea r8d, [rax + rax]
call fcn.1800046d0
mov eax, dword [rsp + 0x20]
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
mov rax, qword [rsp + 0x38]
cmp word [rax + rcx*2 - 2], 0x5c
je 0x18000b078
lea rdx, [0x180023a00]
lea rcx, [rsp + 0x20]
mov r8d, 2
call fcn.1800046d0
lea rcx, [0x180023d18]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [0x180023d18]
lea rcx, [rsp + 0x20]
lea r8d, [rax + rax]
call fcn.1800046d0
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000b10c
mov dword [r13], 0
nop
cmp word [rsp + 0x6c], 0x2e
jne 0x18000b0e0
movzx eax, word [rsp + 0x6e]
test ax, ax
je 0x18000b0e7
cmp ax, 0x2e
jne 0x18000b0e0
cmp word [rsp + 0x70], 0
je 0x18000b0e7
test byte [rsp + 0x40], 0x10
jne 0x18000b0fb
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18000b0c0
jmp 0x18000b103
mov dword [r13], 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
test rbx, rbx
je 0x18000b11a
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
lea r11, [rsp + 0x290]
xor eax, eax
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x18000b140
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x18002a740]
test rax, rax
jne 0x18000b1d5
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.PI__8.8X_
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x18000b1b4
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x18002a740], rax
test rax, rax
jne 0x18000b1c0
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x18002a740]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x18000b5c0
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x18002a768]
test rax, rax
jne 0x18000b655
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.PI__8.8X_
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x18000b634
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x18002a768], rax
test rax, rax
jne 0x18000b640
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x18002a768]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x18000c5e0
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x18002a7a8]
test rax, rax
jne 0x18000c675
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.PI__8.8X_
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x18000c654
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x18002a7a8], rax
test rax, rax
jne 0x18000c660
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x18002a7a8]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x18000c9f0
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x18002a7b0]
test rax, rax
jne 0x18000ca85
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.PI__8.8X_
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x18000ca64
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x18002a7b0], rax
test rax, rax
jne 0x18000ca70
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x18002a7b0]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x18000e400
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x18002a7d8]
test rax, rax
jne 0x18000e495
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.PI__8.8X_
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x18000e474
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x18002a7d8], rax
test rax, rax
jne 0x18000e480
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x18002a7d8]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x18000f070
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x60
mov rdi, r8
xor r8d, r8d
lea rax, [r11 - 0x18]
mov qword [r11 - 0x28], r8
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], r8
mov ebx, r9d
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
mov dword [r11 - 0x48], r8d
mov qword [r11 - 0x18], r8
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18000f0ed
mov eax, dword [rsp + 0x98]
mov rcx, qword [rsp + 0x50]
mov r9d, ebx
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x18000f100
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x250
lea rax, [rsp + 0x40]
mov rdi, r8
xor esi, esi
mov r9d, 0x20019
xor r8d, r8d
mov dword [rsp + 0x278], 0x100
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000f1a3
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x278]
lea r8, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x260], rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
test eax, eax
je 0x18000f188
cmp eax, 0x103
jne 0x18000f18e
mov dword [rdi], esi
mov ebx, esi
jmp 0x18000f18e
mov dword [rdi], 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x260]
mov rsi, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret

Function at 0x18000f2c0
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x78
mov rax, qword [0x18002a808]
test rax, rax
jne 0x18000f355
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.PI__8.8X_
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x18000f334
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x18002a808], rax
test rax, rax
jne 0x18000f340
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x18002a808]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret