joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003f070
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r15
lea rbp, [rax - 0x3b8]
sub rsp, 0x4a0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800c5470]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov rsi, rcx
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x1800902a8]
lea rcx, [rsp + 0x48]
call fcn.180056700
nop
xor ebx, ebx
and qword [rsp + 0x58], rbx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov r15, 0xffffffff80000002
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18003f2a3
mov edi, 0x20a
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
and dword [rsp + 0x44], ebx
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x180]
call sub.msvcrt.dll_memset
xor edi, edi
mov dword [rsp + 0x40], 0x104
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov edx, edi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.SHLWAPI.dll_SHEnumValueW]
test eax, eax
je 0x18003f176
cmp eax, 0xea
je 0x18003f297
jmp 0x18003f289
mov eax, dword [rsp + 0x44]
sub eax, 1
je 0x18003f234
sub eax, 3
je 0x18003f1e4
cmp eax, 7
jne 0x18003f289
mov dword [rsp + 0x40], 8
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18003f289
mov r8, rsi
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.180040aa0
jmp 0x18003f286
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18003f289
lea r9d, [rax + 2]
mov r8, rsi
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.1800409b4
jmp 0x18003f286
mov dword [rsp + 0x40], 0x104
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x180]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18003f289
lea r9d, [rax + 2]
mov r8, rsi
lea rdx, [rbp + 0x180]
lea rcx, [rsp + 0x70]
call fcn.18003efc4
add rbx, rax
inc edi
cmp edi, 0x3e8
jl 0x18003f12d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x18003f2c3
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, rbx
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.1800782d0
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
Function at 0x180040358
Capabilities:
Get common file path
Get program files directory

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x1800c5470]
xor rax, rsp
mov qword [rsp + 0x250], rax
and dword [rsp + 0x30], 0
mov rbx, rcx
and dword [rsp + 0x34], 0
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x20a
call sub.msvcrt.dll_memset
xor r9d, r9d
lea rdx, [rsp + 0x40]
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, str.Internet_ExplorerIEXPLORE.EXE
lea rcx, [rsp + 0x40]
call fcn.180041588
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x40]
call fcn.180019044
test eax, eax
je 0x1800403fd
mov r8d, dword [rsp + 0x34]
lea rdx, str._u._u._u
mov eax, dword [rsp + 0x30]
mov rcx, rbx
shr eax, 0x10
movzx r9d, r8w
shr r8d, 0x10
mov dword [rsp + 0x20], eax
call fcn.18000cf30
mov eax, 1
jmp 0x1800403ff
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1800782d0
add rsp, 0x260
pop rbx
ret
Function at 0x180041950
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov r14, rdx
mov rdi, rcx
xor esi, esi
mov r8, qword [rcx + 0x48]
sub r8, qword [rcx + 0x40]
movabs rax, 0x6666666666666667
imul r8
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea eax, [rdx + rdx*4]
lea eax, [rax*4 + 0x40]
and qword [rbp - 0x18], rsi
and qword [rbp - 0x10], rsi
and qword [rbp - 8], rsi
mov ebx, eax
mov edx, eax
lea rcx, [rbp - 0x18]
call fcn.18000d19c
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
sub rax, rcx
cmp rax, rbx
jne 0x180041a3e
movups xmm0, xmmword [rdi + 0x18]
movups xmmword [rcx + 0x18], xmm0
movups xmm1, xmmword [rdi + 0x28]
movups xmmword [rcx + 0x28], xmm1
movsd xmm0, qword [rdi + 0x38]
movsd qword [rcx + 0x38], xmm0
lea r9d, [rsi + 0x40]
mov rax, qword [rdi + 0x40]
jmp 0x180041a0f
mov r8d, r9d
mov rdx, qword [rbp - 0x18]
movups xmm0, xmmword [rax]
movups xmmword [r8 + rdx], xmm0
mov ecx, dword [rax + 0x10]
mov dword [r8 + rdx + 0x10], ecx
add r9d, 0x14
add rax, 0x14
cmp rax, qword [rdi + 0x48]
jne 0x1800419f0
lea r8, [rdi + 8]
lea edx, [r9 - 0x18]
mov rcx, qword [rbp - 0x18]
add rcx, 0x18
call fcn.180066050
mov rax, qword [rbp - 0x18]
movaps xmm0, xmmword [rdi]
movups xmmword [rax], xmm0
movsd xmm1, qword [rdi + 0x10]
movsd qword [rax + 0x10], xmm1
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180041ab4
and dword [rbp + 0x20], 0
mov r8, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
sub r8, rdx
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180041aaa
mov rcx, qword [rbp - 0x10]
sub rcx, qword [rbp - 0x18]
mov eax, dword [rbp + 0x20]
mov edx, 1
cmp rax, rcx
cmove esi, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x180041af7
mov rdx, qword [rbp - 8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180041ae5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180041b0e
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
and qword [rbp - 8], 0
mov eax, esi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.180070720
int3
Function at 0x180041cd0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push rbx
sub rsp, 0x260
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1800c5470]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
and dword [rsp + 0x20], 0
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll_memset
xor r9d, r9d
lea r8d, [r9 + 0x1a]
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, str.360Safe
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180041d55
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180005348
nop
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1800782d0
add rsp, 0x260
pop rbx
ret

Function at 0x1800444b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10, rdx
test rdx, rdx
je 0x180044547
test r8d, r8d
jle 0x180044547
or r9d, 0xffffffff
lea rdi, [0x180090780]
cmp r8d, 8
jl 0x180044517
mov r11d, r8d
shr r11, 3
mov eax, r11d
neg eax
lea r8d, [r8 + rax*8]
mov ebx, 8
movzx ecx, byte [r10]
mov eax, r9d
xor rcx, rax
inc r10
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
sub rbx, 1
jne 0x1800444f1
sub r11, 1
jne 0x1800444ec
test r8d, r8d
je 0x18004453f
movzx ecx, byte [r10]
mov eax, r9d
xor rcx, rax
inc r10
movzx eax, cl
mov ecx, r9d
shr ecx, 8
mov r9d, dword [rdi + rax*4]
xor r9d, ecx
sub r8d, 1
jne 0x18004451c
not r9d
mov eax, r9d
jmp 0x180044549
xor eax, eax
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x180048e38
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov ebx, r9d
mov ecx, 0x45
mov rdi, rdx
call fcn.18000a354
mov r9d, ebx
mov rdx, rdi
mov rcx, rsi
test rax, rax
je 0x180048e83
mov r8d, dword [rsp + 0x68]
mov dword [rsp + 0x28], r8d
mov r8, qword [rsp + 0x60]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call rax
jmp 0x180048e9e
mov eax, dword [rsp + 0x68]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180049aec
Capabilities:
Check for time delay via gettickcount
Modify service
Query service status
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1800c5470]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor ebx, ebx
xor edx, edx
xor ecx, ecx
lea r8d, [rbx + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x180049bfc
lea r8d, [rbx + 0x16]
mov rcx, rax
lea rdx, str.seclogon
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x180049bf3
mov qword [rsp + 0x50], rbx
lea r8d, [rbx + 3]
mov qword [rsp + 0x48], rbx
or edx, 0xffffffff
mov qword [rsp + 0x40], rbx
mov r9d, edx
mov qword [rsp + 0x38], rbx
mov rcx, rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x180049bea
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
jmp 0x180049bc6
mov ecx, dword [rsp + 0x64]
cmp ecx, 2
jne 0x180049bdc
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, 0x3a98
ja 0x180049bd8
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x180049ba3
mov ecx, dword [rsp + 0x64]
cmp ecx, 4
movzx ebx, bl
mov edx, 1
cmove ebx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, bl
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800782d0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180049e0c
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rbp, r9
mov r14, r8
mov r15, rdx
mov r12, rcx
call fcn.18004b584
xor ebx, ebx
test eax, eax
je 0x180049f74
mov edi, 1
mov ecx, edi
call fcn.18004b898
mov rsi, rax
test rax, rax
jne 0x180049eb4
mov rcx, qword [rsp + 0xb0]
mov r9, rbp
mov rax, qword [rsp + 0xc8]
mov r8, r14
mov dword [rsp + 0x50], edi
mov rdx, r15
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], rcx
mov ecx, dword [rsp + 0xa8]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0xa0]
mov dword [rsp + 0x20], ecx
mov rcx, r12
call fcn.18004b1a4
test eax, eax
sete bl
jmp 0x180049f72
mov rdi, qword [rsp + 0xc0]
mov rcx, rbx
test rdi, rdi
jne 0x180049eee
lea rdx, [0x1800c8054]
lea ecx, [rdi + 0x68]
call fcn.18006f9b0
mov rcx, rax
test rax, rax
je 0x180049f07
mov dword [rax], 0x68
lea rax, str.winsta0default
mov qword [rcx + 0x10], rax
jmp 0x180049f07
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x180049efc
cmp word [rax], bx
jne 0x180049f07
lea rax, str.winsta0default
mov qword [rdi + 0x10], rax
mov rax, qword [rsp + 0xc8]
test rdi, rdi
mov qword [rsp + 0x50], rax
mov r9, r14
mov rax, qword [rsp + 0xb8]
cmovne rcx, rdi
mov qword [rsp + 0x48], rcx
mov r8, r15
mov qword [rsp + 0x40], rax
mov rdx, r12
mov rax, qword [rsp + 0xb0]
mov rcx, rsi
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret

Function at 0x18004a310
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [rcx + 0x48]
mov r10, qword [rcx + 0x40]
mov r11, qword [rcx + 0x38]
mov rbx, qword [rcx + 0x30]
mov rax, qword [rax]
mov rdi, qword [rcx + 0x28]
mov rsi, qword [rcx + 0x20]
mov r9, qword [rcx + 0x18]
mov r8, qword [rcx + 0x10]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
mov r9, qword [r9]
mov r8, qword [r8]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rax
mov rax, qword [r10]
mov qword [rsp + 0x40], rax
mov rax, qword [r11]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
mov eax, dword [rdi]
mov dword [rsp + 0x28], eax
mov eax, dword [rsi]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rbx, qword [rsp + 0x60]
test eax, eax
mov rsi, qword [rsp + 0x68]
setne al
add rsp, 0x50
pop rdi
ret
Function at 0x18004ae80
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, rcx
mov rcx, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov rax, qword [rax]
mov rcx, qword [rcx]
lea edx, [r9 + 6]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x18004aefd
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rcx]
mov rcx, qword [rax + 0x1424]
mov qword [rdx + 0x38], rcx
xor edx, edx
mov r8d, dword [rax + 0x1664]
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rcx]
mov qword [rdx + 0x68], rax
mov rcx, qword [rbx + 0x18]
mov eax, dword [rdi + 0x1668]
mov dword [rcx], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x18004af08
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xa0
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
call fcn.18004b584
test eax, eax
jne 0x18004af7b
call fcn.180049474
test eax, eax
je 0x18004af4f
call fcn.1800495a4
test eax, eax
je 0x18004af4f
call fcn.1800494c4
test eax, eax
jne 0x18004af7b
mov eax, dword [rsp + 0xd8]
mov r9, rbx
mov dword [rsp + 0x28], eax
mov r8, rdi
mov rax, qword [rsp + 0xd0]
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x18004afdb
xor edx, edx
mov dword [rsp + 0x30], WSACleanup
lea rcx, [rsp + 0x34]
lea r8d, [rdx + 0x6c]
call sub.msvcrt.dll_memset
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbx
call fcn.18004b584
mov r8d, eax
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
call fcn.18004a650
mov rax, qword [rsp + 0x68]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18004b780
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1800c5470]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor ebp, ebp
mov edi, edx
mov rsi, rcx
cmp word [rcx], bp
je 0x18004b85d
cmp edx, 0xffffffff
je 0x18004b85d
xor edx, edx
lea ecx, [rbp + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18004b85d
xor edx, edx
lea rcx, [rsp + 0x34]
mov r8d, 0x234
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18004b85d
mov rdx, rsi
lea rcx, [rsp + 0x5c]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x18004b842
mov ecx, dword [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x18004b842
cmp dword [rsp + 0x20], edi
jne 0x18004b842
mov ecx, dword [rsp + 0x38]
call fcn.18004b630
test eax, eax
jne 0x18004b889
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18004b806
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1800782d0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
jmp 0x18004b860
Function at 0x18004de5c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x1800c5470]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rdi, rcx
mov rbx, rdx
mov rcx, rdx
call fcn.1800055b8
mov esi, 0x208
lea rdx, [rsp + 0x430]
xor ebp, ebp
mov r8d, esi
mov rcx, rdi
mov word [rsp + 0x430], bp
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jle 0x18004deb9
cdqe
cmp rax, rsi
jbe 0x18004decc
mov r8, rdi
lea rcx, [rsp + 0x430]
mov rdx, rsi
call fcn.18000aaec
mov r8d, esi
mov word [rsp + 0x20], bp
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x430]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jle 0x18004def2
cdqe
cmp rax, rsi
jbe 0x18004df07
lea r8, [rsp + 0x430]
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.18000aaec
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.1800709c0
mov rax, qword [rbx]
cmp dword [rax - 0x10], ebp
jne 0x18004df3e
lea rcx, [rsp + 0x20]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bp
jne 0x18004df25
mov r8d, eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180005498
mov eax, 1
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1800782d0
mov rbx, qword [rsp + 0x880]
add rsp, 0x850
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800503b8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2a0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800c5470]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rbx, rcx
xor r14d, r14d
cmp dword [rcx + 0x88], r14d
jne 0x1800505b5
mov dword [rcx + 0x88], 1
lea rdi, [rcx + 0x40]
mov qword [rsp + 0x48], r14
test rdi, rdi
je 0x18005042c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov qword [rsp + 0x48], rdi
lea rsi, [rbx + 0x78]
mov rdi, r14
lea r13, [0x180000000]
mov r15d, 0x104
mov bl, byte [rsp + 0x30]
mov word [rbp - 0x80], r14w
mov r8d, r15d
lea rdx, [rbp - 0x80]
mov rcx, qword [rdi + r13 + 0x92020]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.1800709c0
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x38]
call fcn.180005348
nop
mov byte [rsp + 0x20], bl
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.180036d2c
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800504af
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rdi, 8
cmp rdi, 0x10
jb 0x180050444
mov rbx, qword [0x18016b408]
test rbx, rbx
jne 0x180050523
lea rdi, [0x18016b438]
mov qword [rsp + 0x58], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rbx, qword [0x18016b408]
test rbx, rbx
jne 0x18005051a
mov eax, dword [0x18016b410]
test al, 1
jne 0x18005050c
or eax, 1
mov dword [0x18016b410], eax
call fcn.1800432c8
lea rcx, [0x1800856ec]
call fcn.18006f680
nop
lea rbx, [0x18016b418]
mov qword [0x18016b408], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [rbx + 8], r14d
je 0x1800505a5
mov rdi, r14
mov bl, byte [rsp + 0x30]
mov word [rbp - 0x80], r14w
mov r8d, r15d
lea rdx, [rbp - 0x80]
mov rcx, qword [rdi + r13 + 0x92010]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.1800709c0
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.180005348
nop
mov byte [rsp + 0x20], bl
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.180036d2c
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18005059b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rdi, 8
cmp rdi, 0x10
jb 0x180050530
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1800505b5
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1800782d0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret