joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000eaa0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.orcshk364.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
mov qword [0x1800d0778], rax
test rax, rax
je 0x18000eb96
lea rdx, str.SetHooks
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800d0778]
lea rdx, str.UnSetHooks
mov qword [0x1800d5760], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800d0778]
lea rdx, str.SetKeyboardFilterHook
mov qword [0x1800d5768], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800d0778]
lea rdx, str.SetMouseFilterHook
mov qword [0x1800d5770], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800d0778]
lea rdx, str.GetHookThreadMsgId
mov qword [0x1800d5778], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800d0778]
lea rdx, str.SetLocalInputsExtraInfo
mov qword [0x1800d5780], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800d5788], rax
mov rax, qword [0x1800d0778]
test rax, rax
je 0x18000eb96
cmp qword [0x1800d5760], rbx
je 0x18000eb96
cmp qword [0x1800d5768], rbx
je 0x18000eb96
cmp qword [0x1800d5770], rbx
je 0x18000eb96
cmp qword [0x1800d5778], rbx
lea ecx, [rbx + 1]
jne 0x18000eb98
mov ecx, ebx
test rax, rax
mov dword [0x1800d0780], ecx
setne bl
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x18000eca0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1800bc650]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov rsi, r8
mov rdi, rdx
lea rcx, [rsp + 0x52]
xor ebp, ebp
xor edx, edx
mov r8d, 0x1fe
mov word [rsp + 0x50], bp
call fcn.180031610
lea r8, [rbx + 8]
lea rdx, [0x180091930]
lea rcx, [rsp + 0x50]
mov r9, rdi
call fcn.18000e530
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x38], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x18000ed60
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x34], ebp
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18002f7c0
mov rbx, qword [rsp + 0x298]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000ed90
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1800bc650]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov rsi, r8
mov rdi, rdx
lea rcx, [rsp + 0x52]
xor ebp, ebp
xor edx, edx
mov r8d, 0x1fe
mov word [rsp + 0x50], bp
call fcn.180031610
lea r8, [rbx + 8]
lea rdx, [0x180091930]
lea rcx, [rsp + 0x50]
mov r9, rdi
call fcn.18000e530
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
xorpd xmm5, xmm5
movsd qword [rsp + 0x40], xmm5
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x18000ee56
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x38], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsd xmm0, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18002f7c0
mov rbx, qword [rsp + 0x298]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000ee80
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x1800bc650]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov rdi, rdx
lea rcx, [rsp + 0x42]
xor r12d, r12d
xor edx, edx
mov r8d, 0x1fe
mov esi, r9d
mov word [rsp + 0x40], r12w
call fcn.180031610
lea r8, [rbx + 8]
lea rdx, [0x180091930]
lea rcx, [rsp + 0x40]
mov r9, rdi
call fcn.18000e530
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x18000ef36
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea r9d, [r12 + 4]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18002f7c0
add rsp, 0x250
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000ef60
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x268
movaps xmmword [rsp + 0x250], xmm6
mov rax, qword [0x1800bc650]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rsi, r8
mov rdi, rdx
lea rcx, [rsp + 0x42]
xor ebp, ebp
xor edx, edx
movapd xmm6, xmm3
mov r8d, 0x1fe
mov word [rsp + 0x40], bp
call fcn.180031610
lea r8, [rbx + 8]
lea rdx, [0x180091930]
lea rcx, [rsp + 0x40]
mov r9, rdi
call fcn.18000e530
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
movsd qword [rsp + 0x38], xmm6
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x18000f01c
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea r9d, [rbp + 3]
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18002f7c0
movaps xmm6, xmmword [rsp + 0x250]
add rsp, 0x268
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x18000f040
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
xor ebx, ebx
mov rsi, rcx
lea rax, [rsp + 0x50]
mov rdx, rcx
mov rcx, qword [rdi]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, dword [rsp + 0x50]
cmp r11d, 2
jb 0x18000f0e2
add r11d, 2
mov eax, 2
mov dword [rsp + 0x50], r11d
shr r11d, 1
mov ecx, r11d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.18002f858
mov rbx, rax
test rax, rax
je 0x18000f0e2
mov rcx, qword [rdi]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18000f130
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x30
or rbp, 0xffffffffffffffff
xor eax, eax
lea rbx, [0x1800d09a8]
mov rdi, rbx
mov rcx, rbp
repne scasw ax, word [rdi]
not rcx
dec rcx
jne 0x18000f298
lea r8, [rsp + 0x60]
lea rdx, [0x1800d0798]
xor ebx, ebx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x60], rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x18000f217
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rdx, str.PATH
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x50], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x50]
cmp edx, 2
jb 0x18000f20c
add edx, 2
mov eax, 2
mov dword [rsp + 0x50], edx
shr edx, 1
mov ecx, edx
mul rcx
cmovo rax, rbp
mov rcx, rax
call fcn.18002f858
mov rbx, rax
test rax, rax
je 0x18000f20c
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rdx, str.PATH
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x18000f237
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
jne 0x18000f28d
mov rcx, rbx
call fcn.18002f7e0
mov ecx, 3
mov eax, 2
mul rcx
cmovo rax, rbp
mov rcx, rax
call fcn.18002f858
mov rdi, rax
test rax, rax
je 0x18000f2e9
xor eax, eax
lea rcx, [0x18009b1d4]
mov rdx, rdi
mov dword [rdi], eax
sub rdx, rcx
mov word [rdi + 4], ax
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x18000f271
mov rax, rdi
add rsp, 0x30
pop rdi
pop rbp
pop rbx
ret
mov rax, rbx
add rsp, 0x30
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x68], rsi
lea esi, [rcx + 1]
mov eax, 2
mul rsi
cmovo rax, rbp
mov rcx, rax
call fcn.18002f858
mov rdi, rax
test rax, rax
je 0x18000f2e4
lea r8, [rsi + rsi]
xor edx, edx
mov rcx, rax
call fcn.180031610
mov rcx, rdi
sub rcx, rbx
movzx eax, word [rbx]
add rbx, 2
mov word [rcx + rbx - 2], ax
test ax, ax
jne 0x18000f2d0
mov rax, rdi
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rbp
pop rbx
ret
Function at 0x180010840
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x6a0
mov rax, qword [0x1800bc650]
xor rax, rsp
mov qword [rsp + 0x690], rax
mov rbx, rcx
test rcx, rcx
je 0x180010a74
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x180010a74
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x180010a74
test al, 1
je 0x1800108a9
and edi, 0xfffffffe
mov rcx, rbx
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test dil, 0x10
je 0x180010a69
mov qword [rsp + 0x6b8], rbp
lea rcx, [rsp + 0x482]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x6c0], rsi
mov word [rsp + 0x480], bp
call fcn.180031610
lea rcx, [rsp + 0x480]
sub rcx, rbx
mov rdx, rbx
movzx eax, word [rdx]
add rdx, 2
mov word [rcx + rdx - 2], ax
test ax, ax
jne 0x1800108f0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x480]
repne scasw ax, word [rdi]
mov eax, dword [0x18009b688]
lea rcx, [rsp + 0x24]
mov dword [rdi - 2], eax
movzx eax, word [0x18009b68c]
xor edx, edx
mov r8d, 0x24c
mov dword [rsp + 0x20], ebp
mov word [rdi + 2], ax
call fcn.180031610
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180010a4e
nop dword [rax]
lea rdx, [0x18009b6bc]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x180010a2f
lea rdx, [0x18009b6c4]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x180010a2f
lea rcx, [rsp + 0x272]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x270], bp
call fcn.180031610
lea rcx, [rsp + 0x270]
sub rcx, rbx
mov rdx, rbx
nop
movzx eax, word [rdx]
add rdx, 2
mov word [rcx + rdx - 2], ax
test ax, ax
jne 0x1800109c0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x270]
repne scasw ax, word [rdi]
mov eax, dword [0x1800959d0]
or rcx, 0xffffffffffffffff
mov dword [rdi - 2], eax
xor eax, eax
lea rdi, [rsp + 0x270]
repne scasw ax, word [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x4c]
nop word [rax + rax]
movzx eax, word [rdx + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x180010a10
lea rcx, [rsp + 0x270]
call fcn.180010840
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180010960
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rsi, qword [rsp + 0x6c0]
mov rbp, qword [rsp + 0x6b8]
jmp 0x180010a76
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x180010a76
xor eax, eax
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.18002f7c0
mov rbx, qword [rsp + 0x6c8]
add rsp, 0x6a0
pop rdi
ret
Function at 0x180010aa0
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Get file attributes
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x430
mov rax, qword [0x1800bc650]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rsi, rcx
mov rcx, rdx
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x180010b8d
test al, 1
je 0x180010af0
and ebx, 0xfffffffe
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test bl, 0x10
je 0x180010b8d
lea rcx, [rsp + 0x22]
xor ebx, ebx
xor edx, edx
mov r8d, 0x3fe
mov word [rsp + 0x20], bx
call fcn.180031610
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, [0x18009b6c8]
lea rcx, [rsp + 0x20]
mov r9d, eax
mov r8, rdi
call fcn.1800304b4
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180010b7f
nop
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, [0x18009b6c8]
lea rcx, [rsp + 0x20]
mov r9d, eax
mov r8, rdi
call fcn.1800304b4
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc ebx
cmp ebx, 0xa
jge 0x180010bc1
cmp eax, 0xffffffff
jne 0x180010b40
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.18002f7c0
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
xor eax, eax
jmp 0x180010b9c
Function at 0x1800115a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
mov rbx, rcx
lea rdx, str.SOFTWAREMicrosoftDriver_Signing
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], 3
mov dword [rsp + 0x40], 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x50]
lea r11, [rsp + 0x40]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x48]
lea rdx, str.Policy
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x50]
lea rdx, str.SOFTWAREMicrosoftNon_Driver_Signing
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea r11, [rbx + 1]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, str.Policy
xor r8d, r8d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x50]
lea rdx, str.SOFTWAREMicrosoftDriver_Signing
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea r11, [rbx + 2]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, str.Policy
xor r8d, r8d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x50]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionSetup
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x50]
lea rax, [rbx + 3]
lea r9, [rsp + 0x48]
lea rdx, str.PrivateHash
xor r8d, r8d
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret
Function at 0x180011740
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x40]
mov rbx, rcx
lea rdx, str.SOFTWAREMicrosoftDriver_Signing
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x40]
lea rdx, str.Policy
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x40]
lea rdx, str.SOFTWAREMicrosoftNon_Driver_Signing
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x40]
lea r11, [rbx + 1]
lea rdx, str.Policy
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x40]
lea rdx, str.SOFTWAREMicrosoftDriver_Signing
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x40]
lea r11, [rbx + 2]
lea rdx, str.Policy
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x40]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionSetup
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x40]
lea r11, [rbx + 3]
lea rdx, str.PrivateHash
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret
Function at 0x1800138e0
Capabilities:
Copy file

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x58
mov qword [rbp - 0x28], 0xfffffffffffffffe
cmp dword [0x1800d658c], 0
jne 0x180013919
mov dword [0x1800d658c], 1
xor r8d, r8d
mov edx, 0x104
lea rcx, [0x1800d6590]
call fcn.18002dd40
call fcn.18000e130
mov rbx, rax
mov r8d, 1
lea rdx, [0x1800d0be0]
lea rcx, [rbp - 0x20]
call fcn.180023840
nop
mov rcx, qword [0x18007cb48]
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x28], rcx
lea rcx, [rbp + 0x30]
call fcn.1800219e0
mov r9, qword [str.baksda64.sys]
mov r8, rbx
lea rdx, [0x180091930]
lea rcx, [rbp + 0x30]
call fcn.180021100
lea rcx, [rbp + 0x28]
call fcn.1800219e0
mov r9, qword [str.sdagent64.dll]
lea r8, [0x1800d6590]
lea rdx, [0x180091930]
lea rcx, [rbp + 0x28]
call fcn.180021100
xor r11d, r11d
mov qword [rbp - 0x38], r11
mov qword [rbp - 0x30], r11
mov dword [rbp + 0x20], r11d
mov dword [rbp + 0x18], r11d
lea r8, [rbp + 0x20]
lea rdx, [rbp - 0x38]
mov rcx, qword [rbp + 0x30]
call fcn.1800106b0
lea r8, [rbp + 0x18]
lea rdx, [rbp - 0x30]
mov rcx, qword [rbp + 0x28]
call fcn.1800106b0
mov r11d, dword [rbp + 0x18]
cmp dword [rbp + 0x20], r11d
jne 0x1800139da
mov rax, qword [rbp - 0x38]
cmp rax, qword [rbp - 0x30]
je 0x1800139ec
xor r8d, r8d
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop
lea rcx, [rbp + 0x28]
call fcn.180020550
nop
lea rcx, [rbp + 0x30]
call fcn.180020550
nop
lea rcx, [rbp - 0x20]
call fcn.180023880
add rsp, 0x58
pop rbx
pop rbp
ret

Function at 0x180014dd0
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
mov rbx, rcx
lea rdx, [rcx + 8]
mov r8d, 1
lea rcx, [rsp + 0x38]
call fcn.180023840
nop
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
test eax, eax
je 0x180014e5f
test rsi, rsi
je 0x180014e5f
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor r11d, r11d
mov dword [rsp + 0x60], r11d
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx + rcx - 2]
mov qword [rsp + 0x20], r11
lea r9, [rsp + 0x60]
mov rdx, rsi
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
lea rcx, [rsp + 0x38]
call fcn.180023880
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x18001bfc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r12
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
call fcn.18000c9a0
mov r12d, 1
cmp dword [rdi + 0x50], 0
jbe 0x18001c0a2
mov dword [rdi + 0x50], 0
call fcn.180010490
test eax, eax
jne 0x18001c017
call fcn.180045ac0
test eax, eax
jne 0x18001c084
cmp qword [rdi + 0x40], 0
jne 0x18001c04c
call fcn.18000c3a0
test eax, eax
je 0x18001c04c
mov ecx, 0xa8
call fcn.18002f858
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18001c046
xor edx, edx
mov rcx, rax
call fcn.180011ad0
nop
mov qword [rdi + 0x40], rax
jmp 0x18001c077
cmp qword [rdi + 0x48], 0
jne 0x18001c084
mov ecx, 0xa8
call fcn.18002f858
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18001c073
mov edx, r12d
mov rcx, rax
call fcn.180011ad0
nop
mov qword [rdi + 0x48], rax
test rax, rax
je 0x18001c084
mov rcx, rax
call fcn.180025240
mov rax, qword [rdi + 0x40]
test rax, rax
je 0x18001c093
inc dword [rax + 0xa0]
mov rax, qword [rdi + 0x48]
test rax, rax
je 0x18001c0a2
inc dword [rax + 0xa0]
mov eax, dword [0x1800d7a88]
test eax, eax
je 0x18001c0b9
cmp esi, eax
jb 0x18001c0b9
add eax, 0x7530
cmp eax, esi
jae 0x18001c12a
call fcn.180011900
xor ecx, ecx
test eax, eax
cmovne ecx, r12d
call fcn.1800042b0
mov ebx, dword [rdi + 0x18]
call fcn.180011900
xor ecx, ecx
test eax, eax
cmovne ecx, r12d
xor r8d, r8d
mov edx, ebx
call fcn.180004bf0
mov dword [rdi + 0x18], 0
call fcn.18001c230
cmp dword [0x1800d7a84], 0
jne 0x18001c119
call fcn.180001100
test eax, eax
je 0x18001c119
call fcn.1800138e0
call fcn.1800135b0
call fcn.1800136f0
mov dword [0x1800d7a84], r12d
call fcn.18001c9b0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1800d7a88], eax
mov eax, dword [0x1800d7a8c]
test eax, eax
je 0x18001c141
cmp esi, eax
jb 0x18001c141
add eax, 0x1d4c0
cmp eax, esi
jae 0x18001c197
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [0x1800d6384]
cmp ecx, 0x1d4c0
jb 0x18001c18b
mov dword [0x1800d6384], eax
lea r8, str.TICKCOUNT
lea rdx, [0x1800d5b68]
lea rcx, vtable.CDbgCfgMgr.0
call fcn.18000eca0
cmp eax, dword [0x1800d5d7c]
je 0x18001c18b
lea rcx, [0x1800d5a90]
call fcn.18000fbb0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1800d7a8c], eax
mov eax, dword [0x1800d7a90]
test eax, eax
je 0x18001c1ae
cmp esi, eax
jb 0x18001c1ae
add eax, 0x493e0
cmp eax, esi
jae 0x18001c20f
cmp dword [0x1800d5b50], 0
je 0x18001c1d6
lea r9, str.CAgentU64::DoMonitor__M5________
lea r8, str.CheckApp
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800d5a98]
call fcn.180015620
call fcn.1800018b0
cmp dword [0x1800d5b50], 0
je 0x18001c203
lea r9, str.CAgentU64::DoMonitor__M5____
lea r8, str.CheckApp
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800d5a98]
call fcn.180015620
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1800d7a90], eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret