joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180151ce0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, r9
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
call fcn.180150b30
cmp qword [0x180241d10], 0
mov rdx, rbx
mov rcx, rdi
je 0x180151d2b
mov eax, dword [rsp + 0x60]
mov r9, rsi
mov r8, rbp
mov dword [rsp + 0x20], eax
call qword [0x180241d18]
jmp 0x180151d31
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180151ea0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x180241fa4]
test ecx, ecx
jne 0x180151fbf
mov eax, dword [0x180241fa0]
cmp eax, 3
ja 0x180151fbf
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x180241fa0], eax
call fcn.18012a2e0
test eax, eax
je 0x180151ee6
lea rcx, str.shlwapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x180151ef3
lea rcx, [0x1801db150]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180151f05
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.AssocQueryStringA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.AssocQueryStringW
mov rcx, rbx
mov qword [0x180241f68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.AssocQueryStringByKeyA
mov rcx, rbx
mov qword [0x180241f70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.AssocQueryStringByKeyW
mov rcx, rbx
mov qword [0x180241f78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.StrRetToBufW
mov rcx, rbx
mov qword [0x180241f80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ParseURLW
mov rcx, rbx
mov qword [0x180241f88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PathCreateFromUrlW
mov rcx, rbx
mov qword [0x180241f90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x180241fa4], 1
mov qword [0x180241f98], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret
Function at 0x180151fd0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x180241ffc]
test ecx, ecx
jne 0x180152134
mov eax, dword [0x180241ff8]
cmp eax, 3
ja 0x180152134
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x180241ff8], eax
call fcn.18012a2e0
test eax, eax
je 0x180152016
lea rcx, str.psapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x180152023
lea rcx, [0x1801db270]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180152035
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.EnumProcesses
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EnumProcessModules
mov rcx, rbx
mov qword [0x180241fa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessMemoryInfo
mov rcx, rbx
mov qword [0x180241fb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleFileNameExA
mov rcx, rbx
mov qword [0x180241fb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleFileNameExW
mov rcx, rbx
mov qword [0x180241fc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleInformation
mov rcx, rbx
mov qword [0x180241fc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x180241fd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x180241fd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetMappedFileNameA
mov rcx, rbx
mov qword [0x180241fe0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetMappedFileNameW
mov rcx, rbx
mov qword [0x180241fe8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov qword [0x180241ff0], rax
mov dword [0x180241ffc], 1
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret
Function at 0x180152140
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x18024203c]
test ecx, ecx
jne 0x18015225f
mov eax, dword [0x180242038]
cmp eax, 3
ja 0x18015225f
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x180242038], eax
call fcn.18012a2e0
test eax, eax
je 0x180152186
lea rcx, str.Userenv.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x180152193
lea rcx, [0x1801db360]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1801521a5
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.CreateEnvironmentBlock
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DestroyEnvironmentBlock
mov rcx, rbx
mov qword [0x180242000], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ExpandEnvironmentStringsForUserA
mov rcx, rbx
mov qword [0x180242008], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ExpandEnvironmentStringsForUserW
mov rcx, rbx
mov qword [0x180242010], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LoadUserProfileA
mov rcx, rbx
mov qword [0x180242018], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LoadUserProfileW
mov rcx, rbx
mov qword [0x180242020], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnloadUserProfile
mov rcx, rbx
mov qword [0x180242028], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x18024203c], 1
mov qword [0x180242030], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret

Function at 0x180153dd0
Capabilities:
Delete service

Disassembly:
push rdi
sub rsp, 0x50
mov rdi, rcx
call fcn.18012a260
test eax, eax
je 0x180153df4
mov dword [0x180242090], 0x32
xor eax, eax
add rsp, 0x50
pop rdi
ret
test rdi, rdi
jne 0x180153e0b
mov dword [0x180242090], 0x57
xor eax, eax
add rsp, 0x50
pop rdi
ret
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x20]
xor ebx, ebx
mov r9d, 0xf01ff
mov r8d, 0xf003f
mov rdx, rdi
mov dword [0x180242090], ebx
call fcn.180153ab0
lea rcx, [rsp + 0x20]
call fcn.180153b50
test rax, rax
je 0x180153e67
lea rcx, [rsp + 0x20]
call fcn.180153b50
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebx, eax
test eax, eax
jne 0x180153e85
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180242090], eax
jmp 0x180153e6d
mov eax, dword [0x180242090]
test eax, eax
jne 0x180153e85
mov eax, dword [rsp + 0x20]
test eax, eax
jne 0x180153e7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180242090], eax
lea rcx, [rsp + 0x20]
call fcn.180153bb0
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180153ea0
Capabilities:
Start service

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, r8
mov ebp, edx
mov rdi, rcx
call fcn.18012a260
test eax, eax
je 0x180153edc
mov dword [0x180242090], 0x32
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
test rdi, rdi
jne 0x180153efd
mov dword [0x180242090], 0x57
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov qword [rsp + 0x60], rbx
xor ebx, ebx
lea rcx, [rsp + 0x20]
lea r9d, [rbx + 0x10]
lea r8d, [rbx + 2]
mov rdx, rdi
mov dword [0x180242090], ebx
call fcn.180153ab0
lea rcx, [rsp + 0x20]
call fcn.180153b50
test rax, rax
je 0x180153f66
lea rcx, [rsp + 0x20]
call fcn.180153b50
mov r8, rsi
mov edx, ebp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebx, eax
test eax, eax
jne 0x180153f84
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180242090], eax
cmp eax, 0x420
jne 0x180153f6c
mov ebx, 1
jmp 0x180153f84
mov eax, dword [0x180242090]
test eax, eax
jne 0x180153f84
mov eax, dword [rsp + 0x20]
test eax, eax
jne 0x180153f7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180242090], eax
lea rcx, [rsp + 0x20]
call fcn.180153bb0
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x180154140
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x180222e50]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rdx
mov rsi, rcx
call fcn.18012a260
test eax, eax
je 0x18015417c
mov dword [0x180242090], 0x32
xor eax, eax
jmp 0x18015421f
xor eax, eax
mov qword [rsp + 0x90], rbx
xor ebx, ebx
lea rcx, [rsp + 0x20]
lea r9d, [rbx + 4]
lea r8d, [rbx + 1]
mov rdx, rsi
mov dword [0x180242090], ebx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], eax
call fcn.180153ab0
lea rcx, [rsp + 0x20]
call fcn.180153b50
test rax, rax
je 0x1801541f7
lea rcx, [rsp + 0x20]
call fcn.180153b50
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebx, eax
test eax, eax
jne 0x1801541ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x1801541fb
mov eax, dword [rsp + 0x54]
mov dword [rdi], eax
jmp 0x18015420b
mov eax, dword [rsp + 0x20]
test eax, eax
jne 0x180154205
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180242090], eax
lea rcx, [rsp + 0x20]
call fcn.180153bb0
mov eax, ebx
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800fbf40
mov rsi, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
Function at 0x180154740
Capabilities:
Modify service

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x8c8
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov rax, qword [0x180222e50]
xor rax, rsp
mov qword [rsp + 0x8b0], rax
mov r15d, r9d
mov r14d, r8d
mov r13d, edx
mov rsi, rcx
mov rax, qword [rsp + 0x930]
mov qword [rsp + 0xa0], rax
mov rdi, qword [rsp + 0x938]
mov rax, qword [rsp + 0x940]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x948]
mov qword [rsp + 0x80], rax
mov r12, qword [rsp + 0x950]
mov rbx, qword [rsp + 0x958]
mov rax, qword [rsp + 0x960]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x968]
mov qword [rsp + 0x98], rax
xor eax, eax
mov ebp, eax
lea rcx, [rsp + 0x68]
call fcn.1800e9c50
nop
test r12, r12
je 0x180154807
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.1800ec7a0
test rbx, rbx
je 0x180154819
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.1800ec7a0
xor ebx, ebx
mov word [rsp + 0xb0], bx
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0xb2]
call fcn.1800fb1e0
mov dword [rsp + 0x60], 0x400
cmp dword [rsp + 0x70], ebx
jle 0x18015487c
xor edx, edx
lea r9, [rsp + 0x60]
lea r8, [rsp + 0xb0]
lea rcx, [rsp + 0x68]
call fcn.1800f1db0
test eax, eax
jne 0x180154874
lea rcx, [rsp + 0x68]
call fcn.1800ec600
xor eax, eax
jmp 0x1801548fc
lea rbp, [rsp + 0xb0]
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, r15d
mov r8d, r14d
mov edx, r13d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov ebx, eax
test eax, eax
je 0x1801548f0
test rdi, rdi
je 0x1801548f0
mov rdx, rdi
mov rcx, rsi
call fcn.180153d00
nop
lea rcx, [rsp + 0x68]
call fcn.1800ec600
mov eax, ebx
mov rcx, qword [rsp + 0x8b0]
xor rcx, rsp
call fcn.1800fbf40
add rsp, 0x8c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180154b80
Capabilities:
Enumerate services

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, r9
mov rdi, r8
mov ebp, edx
mov r12d, ecx
call fcn.18012a260
test eax, eax
je 0x180154bca
mov dword [0x180242090], 0x32
xor eax, eax
jmp 0x180154ce2
xor ebx, ebx
mov qword [rdi], rbx
mov dword [rsi], ebx
mov dword [0x180242090], ebx
xor r9d, r9d
xor edx, edx
mov r8d, 0x80000000
lea rcx, [rsp + 0x50]
call fcn.180153ab0
nop
lea rcx, [rsp + 0x50]
call fcn.180153ad0
test rax, rax
je 0x180154cb8
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x44], ebx
lea rcx, [rsp + 0x50]
call fcn.180153ad0
mov rcx, rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, ebp
mov edx, r12d
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
mov r11d, dword [rsp + 0x40]
test r11d, r11d
je 0x180154cb8
mov ecx, r11d
call fcn.1800fb374
mov qword [rdi], rax
test rax, rax
je 0x180154cb8
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call fcn.1800fb1e0
lea rcx, [rsp + 0x50]
call fcn.180153ad0
mov rcx, rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov r9, qword [rdi]
mov r8d, ebp
mov edx, r12d
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
je 0x180154cb8
mov eax, dword [rsp + 0x44]
mov dword [rsi], eax
mov ebx, 1
jmp 0x180154cd6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180242090], eax
mov rcx, qword [rdi]
test rcx, rcx
je 0x180154cd6
call fcn.1800fb418
mov qword [rdi], rbx
mov dword [rsi], ebx
lea rcx, [rsp + 0x50]
call fcn.180153bb0
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x1801552a0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov esi, r9d
mov edi, r8d
mov rbx, rcx
cmp r8d, 0xffffffff
je 0x1801552e0
cmp r8d, 4
jbe 0x1801552e0
mov dword [0x180242094], 0x57
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbp
mov rbp, qword [rcx]
cmp edx, 0xffffffff
je 0x1801552fc
mov r8d, edx
mov rdx, qword [0x1802254a0]
call fcn.1800f4a70
cmp edi, 0xffffffff
je 0x180155313
mov rdx, qword [str.Start]
mov r8d, edi
mov rcx, rbx
call fcn.1800f4a70
cmp esi, 0xffffffff
je 0x18015532a
mov rdx, qword [str.ErrorControl]
mov r8d, esi
mov rcx, rbx
call fcn.1800f4a70
mov r8, qword [rsp + 0x60]
test r8, r8
je 0x180155343
mov rdx, qword [str.DisplayName]
mov rcx, rbx
call fcn.1800f4af0
mov r8, qword [rsp + 0x68]
test r8, r8
je 0x18015535c
mov rdx, qword [str.Description]
mov rcx, rbx
call fcn.1800f4af0
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x18015539a
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
mov r9d, 2
xor r8d, r8d
not rcx
lea eax, [rcx + rcx]
mov rcx, rbp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov rdx, qword [str.ImagePath]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x40]
test r8, r8
je 0x1801553b8
mov rdx, qword [str.Group]
mov rcx, rbx
call fcn.1800f4af0
mov r8, qword [rsp + 0x80]
test r8, r8
je 0x1801553d4
mov rdx, qword [str.DependOnGroup]
mov rcx, rbx
call fcn.1800f6160
mov r8, qword [rsp + 0x88]
test r8, r8
je 0x1801553f0
mov rdx, qword [str.DependOnService]
mov rcx, rbx
call fcn.1800f6160
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x180155410
Capabilities:
Persist via run registry key

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rbx, rcx
test rcx, rcx
jne 0x180155433
xor eax, eax
jmp 0x1801554e1
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x1801554e1
xor edi, edi
lea rcx, [rsp + 0x28]
call fcn.1800f62e0
nop
mov r9d, 0x2001f
mov r8, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800f5ce0
test rax, rax
je 0x180155498
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1800f4b10
mov edi, eax
lea rcx, [rsp + 0x28]
call fcn.1800f48f0
test edi, edi
jne 0x1801554d5
mov r9d, 0x2001f
mov r8, qword [str.SystemCurrentControlSetServicesVxD]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800f5ce0
test rax, rax
je 0x1801554d5
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1800f4b10
mov edi, eax
lea rcx, [rsp + 0x28]
call fcn.1800f48f0
nop
lea rcx, [rsp + 0x28]
call fcn.1800f5c60
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180155af0
Capabilities:
Persist via run registry key

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x180155b6c
cmp word [rcx], 0
je 0x180155b6c
lea rcx, [rsp + 0x28]
call fcn.1800f62e0
nop
mov r9d, 0x20019
mov r8, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800f5ce0
test rax, rax
je 0x180155bb5
mov r8d, 1
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.1800f62d0
test eax, eax
jne 0x180155b73
lea rcx, [rsp + 0x28]
call fcn.1800f5c60
xor eax, eax
jmp 0x180155c6d
test rsi, rsi
je 0x180155ba1
mov r8, rdi
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.1800f5da0
nop
mov rdx, rax
mov rcx, rsi
call fcn.1800e8390
nop
lea rcx, [rsp + 0x68]
call fcn.1800e8250
test rbx, rbx
je 0x180155c5e
mov dword [rbx], reloc.WS2_32.dll_recv
jmp 0x180155c5e
mov rax, qword [0x1801d0c28]
mov qword [rsp + 0x50], rax
mov r9, rdi
mov r8, qword [str.SystemCurrentControlSetServicesVxD]
lea rdx, [0x1801aa048]
lea rcx, [rsp + 0x50]
call fcn.1800e9330
mov r9d, 0x20019
mov r8, qword [rsp + 0x50]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800f5ce0
test rax, rax
jne 0x180155c16
lea rcx, [rsp + 0x50]
call fcn.1800e8250
nop
lea rcx, [rsp + 0x28]
call fcn.1800f5c60
xor eax, eax
jmp 0x180155c6d
test rsi, rsi
je 0x180155c48
mov r8, qword [str.StaticVxD]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.1800f5da0
nop
mov rdx, rax
mov rcx, rsi
call fcn.1800e8390
nop
lea rcx, [rsp + 0x68]
call fcn.1800e8250
test rbx, rbx
je 0x180155c53
mov dword [rbx], 1
lea rcx, [rsp + 0x50]
call fcn.1800e8250
nop
lea rcx, [rsp + 0x28]
call fcn.1800f5c60
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180155c80
Capabilities:
Persist via run registry key

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rbx, r8
mov esi, edx
mov rdi, rcx
test rcx, rcx
je 0x180155e32
test rbx, rbx
je 0x180155e32
cmp word [rcx], 0
je 0x180155e32
cmp word [r8], 0
je 0x180155e32
lea rcx, [rsp + 0x28]
call fcn.1800f62e0
nop
cmp esi, 2
je 0x180155d3f
cmp esi, 1
je 0x180155d3f
mov r9d, 0x2001f
mov r8, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800f5ce0
test rax, rax
jne 0x180155d28
mov r9d, 0x2001f
mov r8, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800f4910
test rax, rax
jne 0x180155d28
jmp 0x180155e28
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.1800f4af0
mov ebx, eax
jmp 0x180155e0f
mov rax, qword [0x1801d0c28]
mov qword [rsp + 0x50], rax
mov r9, rdi
mov r8, qword [str.SystemCurrentControlSetServicesVxD]
lea rdx, [0x1801aa048]
lea rcx, [rsp + 0x50]
call fcn.1800e9330
mov r9d, 0x2001f
mov r8, qword [rsp + 0x50]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800f5ce0
test rax, rax
jne 0x180155d97
lea rcx, [rsp + 0x50]
call fcn.1800e8250
nop
jmp 0x180155e28
mov rax, qword [0x1801d0c28]
mov qword [rsp + 0x68], rax
mov edx, 0x5c
mov rcx, rbx
call fcn.1800fc238
test rax, rax
je 0x180155dc3
lea rdx, [rax + 2]
lea rcx, [rsp + 0x68]
call fcn.1800e8410
mov r8, qword [rsp + 0x68]
cmp dword [r8 - 8], 0
jne 0x180155de7
lea rcx, [rsp + 0x68]
call fcn.1800e8250
nop
lea rcx, [rsp + 0x50]
call fcn.1800e8250
nop
jmp 0x180155e28
mov rdx, qword [str.StaticVxD]
lea rcx, [rsp + 0x28]
call fcn.1800f4af0
mov ebx, eax
lea rcx, [rsp + 0x68]
call fcn.1800e8250
nop
lea rcx, [rsp + 0x50]
call fcn.1800e8250
lea rcx, [rsp + 0x28]
call fcn.1800f48f0
nop
lea rcx, [rsp + 0x28]
call fcn.1800f5c60
mov eax, ebx
jmp 0x180155e34
lea rcx, [rsp + 0x28]
call fcn.1800f5c60
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180155e50
Capabilities:
Persist via run registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov rsi, r8
mov r14, rdx
mov rdi, rcx
mov rax, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov qword [rbp - 0x28], rax
mov rax, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce]
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x38]
call fcn.1800f62e0
nop
lea r12, [rbp - 0x28]
mov r13d, 2
xor r15d, r15d
nop dword [rax]
mov r9d, 0x20019
mov r8, qword [r12]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x38]
call fcn.1800f5ce0
test rax, rax
je 0x180155f80
lea rcx, [rbp - 0x18]
call fcn.1800e9c50
nop
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x38]
call fcn.1800f62c0
test eax, eax
je 0x180155f6d
mov ebx, r15d
cmp dword [rbp - 0x10], ebx
jle 0x180155f6d
nop word [rax + rax]
mov r8d, ebx
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x18]
call fcn.1800f4ce0
nop
mov r8, qword [rbp + 0x58]
cmp dword [r8 - 8], 0
je 0x180155f5d
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x38]
call fcn.1800f5da0
nop
mov rax, qword [rbp + 0x40]
cmp dword [rax - 8], 0
je 0x180155f53
lea r8, [rbp + 0x58]
mov edx, dword [rdi + 8]
mov rcx, rdi
call fcn.1800ec880
lea r8, [rbp + 0x40]
mov edx, dword [rsi + 8]
mov rcx, rsi
call fcn.1800ec880
nop
lea rcx, [rbp + 0x40]
call fcn.1800e8250
nop
lea rcx, [rbp + 0x58]
call fcn.1800e8250
inc ebx
cmp ebx, dword [rbp - 0x10]
jl 0x180155f00
lea rcx, [rbp - 0x38]
call fcn.1800f48f0
nop
lea rcx, [rbp - 0x18]
call fcn.1800ec600
add r12, 8
dec r13
jne 0x180155eb0
or r8d, 0xffffffff
xor edx, edx
mov rcx, r14
call fcn.1800f2470
mov esi, r15d
cmp dword [rdi + 8], r15d
jle 0x180155ffe
mov rbx, r15
nop word [rax + rax]
mov dword [rbp + 0x40], r15d
lea rdx, [0x1801a9e70]
lea rcx, [rbp + 0x58]
call fcn.1800ebc90
nop
mov rax, qword [rdi]
lea r8, [rbp + 0x58]
lea rdx, [rbp + 0x40]
mov rcx, qword [rbx + rax]
call fcn.180155af0
mov r8d, dword [rbp + 0x40]
mov edx, dword [r14 + 8]
mov rcx, r14
call fcn.1800f26d0
nop
lea rcx, [rbp + 0x58]
call fcn.1800e8250
inc esi
add rbx, 8
cmp esi, dword [rdi + 8]
jl 0x180155fb0
lea rcx, [rbp - 0x38]
call fcn.1800f5c60
mov eax, 1
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret