joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001fd20
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
push rbx
push rdi
push r15
sub rsp, 0x50
mov r10d, dword [rcx + 0xc]
mov qword [r11 + 0x20], rbp
mov rdi, rdx
xor edx, edx
xor eax, eax
mov qword [r11 - 0x20], rsi
div r10
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
xor r12d, r12d
mov qword [r11 - 0x38], r14
mov r15, r9
mov r14, rcx
mov rbp, rdx
test rdx, rdx
jne 0x18001fd84
mov eax, 0x200
div r10d
test edx, edx
jne 0x18001fd84
mov ebp, dword [rsp + 0x70]
mov ebx, r12d
mov r13d, 0x200
mov qword [r11 + 0x10], rbx
mov rsi, rdi
jmp 0x18001fdae
lea r13d, [rbp + 0x200]
xor edx, edx
mov ebx, ebp
mov eax, r13d
neg rbx
div r10d
mov qword [rsp + 0x78], rbx
sub r10d, edx
add r13d, r10d
mov ecx, r13d
call fcn.18000f9a8
mov rsi, rax
test rsi, rsi
jne 0x18001fdb8
lea ebx, [rsi + 9]
jmp 0x18001fe02
mov rcx, qword [r14]
lea r8, [rsp + 0x7c]
xor r9d, r9d
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x70], eax
cmp eax, 0xffffffff
jne 0x18001fddb
mov ebx, 0xf
jmp 0x18001fe02
mov rcx, qword [r14]
lea r9, [rsp + 0x70]
mov r8d, r13d
mov rdx, rsi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, 0xf
test eax, eax
cmove r12d, ebx
mov ebx, r12d
mov r14, qword [rsp + 0x30]
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
cmp rsi, rdi
je 0x18001fe35
test ebx, ebx
jne 0x18001fe2d
mov edx, ebp
mov r8d, 0x200
mov rcx, rdi
add rdx, rsi
call fcn.18000f4b0
mov rcx, rsi
call fcn.18000f924
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x88]
test ebx, ebx
jne 0x18001fe9c
mov eax, 0xaa55
cmp word [rdi + 0x1fe], ax
je 0x18001fe60
lea eax, [rbx + 0x12]
add rsp, 0x50
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rdi + 2]
cmp eax, 0x10eb9090
je 0x18001fe7f
cmp eax, 0x20b60251
je 0x18001fe7f
mov eax, 0x15
add rsp, 0x50
pop r15
pop rdi
pop rbx
ret
mov rcx, qword [rdi + 0xe]
mov rax, qword [rsp + 0x80]
shl rcx, 9
mov qword [rax], rcx
movzx ecx, word [rdi + 8]
shl ecx, 9
mov dword [r15], ecx
mov eax, ebx
add rsp, 0x50
pop r15
pop rdi
pop rbx
ret
Function at 0x1800206c0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push r12
push r14
sub rsp, 0x470
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor ebx, ebx
mov qword [rsp + 0x50], r8
mov r14, rdx
mov ebp, ebx
mov r12d, ebx
test rdx, rdx
je 0x18002074e
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
xor r9d, r9d
mov edx, 0xc0000000
mov rcx, r14
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x18002072c
lea eax, [rbx + 0xe]
jmp 0x180020861
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test eax, eax
je 0x180020744
cmp eax, 0x200000
jle 0x18002078d
mov ebx, 0x16
jmp 0x18002083a
call sym.dcapi.dll_dc_disk_open
mov rbp, rax
test rax, rax
jne 0x180020763
lea eax, [rbp + 0xd]
jmp 0x180020861
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x260]
mov rcx, rax
call fcn.18001fd20
mov ebx, eax
test eax, eax
jne 0x180020848
mov esi, dword [rsp + 0x40]
xor ebx, ebx
movsxd rcx, esi
mov qword [rsp + 0x4b8], r13
call fcn.18000f9a8
mov r13, rax
test rax, rax
jne 0x1800207ad
lea ebx, [rax + 9]
jmp 0x180020832
mov r8d, esi
mov rdx, rax
test r14, r14
je 0x1800207d4
lea r9, [rsp + 0x44]
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800207e7
lea ebx, [rax + 0xf]
jmp 0x18002082a
mov r9, qword [rsp + 0x48]
mov rcx, rbp
call sym.dcapi.dll_dc_disk_read
mov ebx, eax
test eax, eax
jne 0x18002082a
mov qword [rsp + 0x4b0], rdi
mov eax, esi
mov rdi, r13
cmp esi, 0x35a
jbe 0x18002081d
nop dword [rax]
cmp dword [rdi], 0x1434a669
jne 0x180020811
cmp dword [rdi + 4], 0x7269da46
je 0x180020880
dec eax
inc rdi
cmp eax, 0x35a
ja 0x180020800
mov ebx, 0x17
mov rdi, qword [rsp + 0x4b0]
mov rcx, r13
call fcn.18000f924
mov r13, qword [rsp + 0x4b8]
test r12, r12
je 0x180020848
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbp, rbp
je 0x18002085f
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call fcn.18000f924
mov eax, ebx
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18000eda0
add rsp, 0x470
pop r14
pop r12
pop rsi
pop rbp
pop rbx
ret
test rdi, rdi
je 0x18002081d
lea rcx, [rsp + 0x60]
lea rdx, [rdi + 0x116]
mov r8d, 0x200
call fcn.18000f4b0
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
mov r8d, 0x35a
call fcn.18000f4b0
lea rcx, [rdi + 0x116]
lea rdx, [rsp + 0x60]
mov r8d, 0x200
call fcn.18000f4b0
mov dword [rdi], 0x1434a669
mov dword [rdi + 4], 0x7269da46
mov dword [rdi + 8], 0x76
test r14, r14
je 0x180020922
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea r9, [rsp + 0x44]
mov r8d, esi
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18002093f
lea ebx, [rax + 0xf]
jmp 0x180020822
mov r9, qword [rsp + 0x48]
mov r8d, esi
mov rdx, r13
mov rcx, rbp
call sym.dcapi.dll_dc_disk_write
mov ebx, eax
test eax, eax
jne 0x180020822
xor ebx, ebx
jmp 0x180020822
Function at 0x180020bb0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push r13
push r14
mov eax, 0x12a0
call fcn.180015940
sub rsp, rax
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rsp + 0x1280], rax
xor r13d, r13d
xor ebp, ebp
mov r14, r8
mov rsi, rdx
mov ebx, ecx
cmp ecx, 0xffffffff
jne 0x180020c21
lea rdx, [rsp + 0x260]
lea rcx, str..GLOBALROOTArcNamemulti_0_disk_0_rdisk_0_partition_1_
call sym.dcapi.dll_dc_get_drive_info
test eax, eax
jne 0x180020c14
cmp dword [rsp + 0x264], 2
ja 0x180020c14
mov ebx, dword [rsp + 0x278]
jmp 0x180020c19
mov eax, 0x1c
test eax, eax
jne 0x180020d92
mov qword [rsp + 0x1298], rdi
test rsi, rsi
je 0x180020c88
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rsi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x180020c66
lea eax, [r13 + 0xf]
jmp 0x180020d8a
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test eax, eax
je 0x180020c7e
cmp eax, 0x200000
jle 0x180020cc6
mov ebx, 0x16
jmp 0x180020d63
xor edx, edx
mov ecx, ebx
call sym.dcapi.dll_dc_disk_open
mov rbp, rax
test rax, rax
jne 0x180020ca1
lea eax, [rbp + 0xd]
jmp 0x180020d8a
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.18001fd20
mov ebx, eax
test eax, eax
jne 0x180020d71
mov edi, dword [rsp + 0x40]
movsxd rcx, edi
mov qword [rsp + 0x1290], r12
call fcn.18000f9a8
mov r12, rax
test rax, rax
jne 0x180020ce3
lea ebx, [rax + 9]
jmp 0x180020d5b
mov r8d, edi
mov rdx, rax
test rsi, rsi
je 0x180020d0e
lea r9, [rsp + 0x50]
mov rcx, r13
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180020d21
lea ebx, [rax + 0xf]
jmp 0x180020d53
mov r9, qword [rsp + 0x48]
mov rcx, rbp
call sym.dcapi.dll_dc_disk_read
mov ebx, eax
test eax, eax
jne 0x180020d53
mov rdx, r12
cmp edi, 0x35a
jbe 0x180020d4e
nop dword [rax]
cmp dword [rdx], 0x1434a669
jne 0x180020d41
cmp dword [rdx + 4], 0x7269da46
je 0x180020db1
dec edi
inc rdx
cmp edi, 0x35a
ja 0x180020d30
mov ebx, 0x17
mov rcx, r12
call fcn.18000f924
mov r12, qword [rsp + 0x1290]
test r13, r13
je 0x180020d71
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbp, rbp
je 0x180020d88
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call fcn.18000f924
mov eax, ebx
mov rdi, qword [rsp + 0x1298]
mov rcx, qword [rsp + 0x1280]
xor rcx, rsp
call fcn.18000eda0
add rsp, 0x12a0
pop r14
pop r13
pop rsi
pop rbp
pop rbx
ret
test rdx, rdx
je 0x180020d4e
mov rcx, r14
mov r8d, 0x35a
call fcn.18000f4b0
xor ebx, ebx
jmp 0x180020d53
Function at 0x180021240
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
xor ebx, ebx
mov r12, rcx
mov edi, ebx
test edx, edx
je 0x18002126e
call fcn.18000edc0
call fcn.18000edc0
mov edx, 0x8d
jmp 0x18002127d
call fcn.18000edc0
call fcn.18000edc0
mov edx, 0x8c
mov rcx, qword [0x18003ccf8]
lea r8, str.EXEFILE
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x1800212c9
mov rcx, qword [0x18003ccf8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [0x18003ccf8]
mov rdx, rbp
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
jmp 0x1800212cd
mov esi, dword [rsp + 0x68]
test rdi, rdi
jne 0x1800212d7
lea eax, [rdi + 1]
jmp 0x180021331
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0x40000000
lea r8d, [r9 + 1]
mov rcx, r12
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x18002132a
lea r9, [rsp + 0x68]
mov r8d, esi
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18002132f
mov ebx, 0xd
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x1800218a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1080
call fcn.180015940
sub rsp, rax
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rsp + 0x1070], rax
mov ebx, r8d
mov ebp, edx
mov esi, ecx
cmp r8d, 0xffffffff
jne 0x180021981
mov ecx, dword [0x18003cd00]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebx, ebx
mov rdi, rax
test rax, rax
jne 0x180021934
mov qword [rsp + 0x30], rbx
lea rcx, str..dcrypt
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180021981
mov ecx, dword [0x18003cd00]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x220058
mov rcx, rdi
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x180021977
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x180021981
mov ebx, dword [rsp + 0x4c]
shr ebx, 5
and ebx, 1
cmp esi, 0xffffffff
jne 0x1800219df
lea rdx, [rsp + 0x50]
lea rcx, str..GLOBALROOTArcNamemulti_0_disk_0_rdisk_0_partition_1_
call sym.dcapi.dll_dc_get_drive_info
test eax, eax
jne 0x1800219ba
mov ecx, dword [rsp + 0x54]
cmp ecx, 2
ja 0x1800219ba
mov edi, dword [rsp + 0x68]
cmp ecx, 1
jbe 0x1800219b6
mov esi, dword [rsp + 0x88]
jmp 0x1800219c7
mov esi, edi
jmp 0x1800219c7
mov esi, dword [rsp + 0x40]
mov edi, dword [rsp + 0x40]
mov eax, 0x1c
test eax, eax
jne 0x1800219eb
mov r8d, ebx
mov edx, ebp
mov ecx, edi
call fcn.180020dd0
test eax, eax
jne 0x1800219eb
cmp edi, esi
je 0x1800219eb
mov r8d, ebx
mov edx, ebp
mov ecx, esi
call fcn.180020dd0
mov rcx, qword [rsp + 0x1070]
xor rcx, rsp
call fcn.18000eda0
lea r11, [rsp + 0x1080]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180021e60
Capabilities:
Get disk information via ioctl

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rsp + 0x280], rax
movzx eax, word [rcx]
mov esi, r8d
mov ebx, edx
cmp ax, 0x5c
je 0x180021eb3
lea r8, str.._c:
lea rcx, [rsp + 0x70]
movzx r9d, ax
mov edx, 0x104
call fcn.18000f09c
jmp 0x180021ec6
mov rdx, rcx
lea rcx, [rsp + 0x70]
mov r8d, 0x104
call fcn.18000fa60
xor ebp, ebp
lea rcx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rbp
lea r8d, [rbp + 3]
mov edx, 0xc0000000
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x180021f01
lea eax, [rbp + 0xd]
jmp 0x180022010
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov edx, 0x70000
mov rcx, rdi
mov dword [rsp + 0x28], 0x18
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x180021f42
lea ebx, [rax + 1]
jmp 0x180021fe3
cmp dword [rsp + 0x60], 0xb
je 0x180021f53
mov ebx, 0x28
jmp 0x180021fe3
test dword [rsp + 0x6c], 0x1ff
je 0x180021f64
mov ebx, 0x22
jmp 0x180021fe3
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x2d1080
mov rcx, rdi
mov dword [rsp + 0x28], 0xc
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x180021fa2
lea ebx, [rax + 1]
jmp 0x180021fe3
test ebx, ebx
jne 0x180021ff5
mov ecx, dword [rsp + 0x4c]
call fcn.18001feb0
test eax, eax
jne 0x180021fde
mov ecx, dword [rsp + 0x4c]
lea edx, [rbx + 1]
mov r8d, esi
call sym.dcapi.dll_dc_set_mbr
mov ebx, eax
cmp eax, 0x14
jne 0x180021fe3
mov ecx, dword [rsp + 0x4c]
mov r8d, esi
xor edx, edx
call sym.dcapi.dll_dc_set_mbr
mov ebx, eax
cmp eax, 0x14
jne 0x180021fe3
mov ebx, 0x29
test rdi, rdi
je 0x180021ff1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x180022010
mov r8d, dword [rsp + 0x4c]
lea r9, [rsp + 0x58]
lea rdx, [rsp + 0x70]
mov rcx, rdi
mov dword [rsp + 0x20], esi
call fcn.180021a20
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.18000eda0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180022040
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
lea r8, [rsp + 0x50]
lea rdx, str.SYSTEMCurrentControlSetServicesdcryptInstances
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], eax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov ebx, eax
test eax, eax
jne 0x180022159
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rdi
lea rdi, [0x180033138]
lea r9d, [rax + 1]
lea rdx, str.DefaultInstance
xor r8d, r8d
mov dword [rsp + 0x28], 0xe
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x180022154
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x48]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov ebx, eax
test eax, eax
jne 0x180022154
mov rcx, qword [rsp + 0x48]
lea rax, str.87150
lea r9d, [rbx + 1]
lea rdx, str.Altitude
xor r8d, r8d
mov dword [rsp + 0x28], 0xc
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x180022154
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r9d, [rbx + 4]
lea rdx, str.Flags
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x180022154
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ebx, eax
test eax, eax
jne 0x180022154
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ebx, eax
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180022169
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x180022179
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x180022190
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov edi, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x1800221e6
lea rdx, str.dcrypt
mov r8d, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x1800221e6
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1800221ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test rdi, rdi
je 0x1800221fc
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rsi, rsi
je 0x18002220a
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180022230
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x850
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov r12, qword [r8]
mov r14, rcx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
mov rbp, rdx
repne scasw ax, word [rdi]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
not rcx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea r13d, [rcx + rcx]
xor r8d, r8d
mov rdx, r14
mov rcx, r12
mov dword [rsp + 0x30], 0x800
lea rbx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
je 0x1800222c5
cmp eax, 2
jne 0x180022394
xor eax, eax
mov r8d, esi
mov word [rsp + 0x40], ax
mov dword [rsp + 0x30], r8d
jmp 0x18002232f
cmp dword [rsp + 0x34], 7
jne 0x18002238f
mov r8d, dword [rsp + 0x30]
lea eax, [r8 + r13]
cmp eax, 0x800
ja 0x18002238f
cmp word [rsp + 0x40], 0
je 0x18002232f
nop dword [rax]
mov rdi, rbp
mov rax, rbx
sub rdi, rbx
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x180022313
add rax, 2
test ecx, ecx
jne 0x180022300
test edx, edx
je 0x180022394
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea rbx, [rbx + rcx*2]
cmp word [rbx], ax
jne 0x1800222f0
lea rcx, [rsp + r13 + 0x40]
lea rdx, [rsp + 0x40]
call fcn.18000f4b0
lea rcx, [rsp + 0x40]
mov r8d, r13d
mov rdx, rbp
call fcn.18000f4b0
mov ecx, dword [rsp + 0x30]
lea rax, [rsp + 0x40]
add ecx, r13d
mov r9d, 7
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x30], ecx
mov rcx, r12
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test eax, eax
jne 0x180022394
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov esi, eax
jmp 0x180022394
mov esi, 0x65d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.18000eda0
add rsp, 0x850
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800223d0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x850
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rsi, qword [r8]
lea rax, [rsp + 0x30]
mov rbp, rdx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r12, rcx
mov rdx, rcx
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x40]
mov dword [rsp + 0x30], 0x800
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x180022563
cmp dword [rsp + 0x34], 7
jne 0x18002255e
mov r8d, dword [rsp + 0x30]
cmp r8d, 2
jb 0x18002255e
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
not rcx
lea r9, [rcx - 1]
add r9d, r9d
je 0x180022533
nop word [rax + rax]
mov rdi, rbp
mov rax, rbx
sub rdi, rbx
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x1800224a3
add rax, 2
test ecx, ecx
jne 0x180022490
test edx, edx
jne 0x18002250b
mov eax, 0xfffffffe
mov rcx, rbx
sub eax, r9d
add r8d, eax
mov eax, r8d
mov dword [rsp + 0x30], r8d
sub rax, rbx
lea r8, [rsp + rax + 0x40]
mov eax, r9d
lea rdx, [rax + rbx + 2]
call fcn.18000f4b0
mov r8d, dword [rsp + 0x30]
test r8d, r8d
je 0x1800224e4
cmp word [rsp + 0x40], 0
jne 0x180022516
mov dword [rsp + 0x30], 0
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
test eax, eax
jne 0x180022563
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edi, eax
jmp 0x180022563
mov eax, r9d
shr rax, 1
lea rbx, [rbx + rax*2 + 2]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
add ecx, ecx
mov r9d, ecx
jne 0x180022480
test r8d, r8d
je 0x1800224ec
mov dword [rsp + 0x28], r8d
lea rax, [rsp + 0x40]
mov r9d, 7
xor r8d, r8d
mov rdx, r12
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1800224f8
mov edi, 0x65d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.18000eda0
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1800226e0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 4]
lea rbx, [rcx + 4]
mov rdi, rcx
mov dword [rsp + 0x50], eax
mov eax, dword [rcx + 8]
lea r8, [rsp + 0x48]
lea rdx, str.SYSTEMCurrentControlSetServicesdcryptconfig
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], 0x34e
mov dword [rsp + 0x54], eax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1800227fd
mov rcx, qword [rsp + 0x48]
lea r9d, [rax + 4]
lea rdx, str.Flags
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x1800227f0
mov rcx, qword [rsp + 0x48]
lea rax, [rdi + 0xc]
lea r9d, [rbx + 3]
lea rdx, str.Hotkeys
xor r8d, r8d
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x1800227f0
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r9d, [rbx + 4]
lea rdx, str.sysBuild
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x1800227f0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ebx, eax
test eax, eax
jne 0x1800227f0
lea r8d, [rax + 8]
lea rdx, [rsp + 0x50]
xor edi, edi
xor r9d, r9d
mov ecx, 0x22005c
mov dword [rsp + 0x20], edi
call sym.dcapi.dll_dc_device_control
mov ebx, eax
cmp eax, 0x591
cmove ebx, edi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret