joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180006ae4
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov esi, dword [rcx + 0x1c]
mov eax, 0x8004
mov rbp, rcx
xor edi, edi
cmp esi, 0x8009
mov r15, rdx
cmove esi, eax
mov ecx, esi
call fcn.180003e68
mov ecx, dword [rbp + 0x28]
call fcn.180003f8c
mov ecx, dword [rbp + 0x28]
mov ebx, eax
call fcn.180003ef8
lea ecx, [rdi + 0x40]
lea r13d, [rax + rbx]
mov edx, r13d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r12, rax
test rax, rax
je 0x180006cee
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x20]
lea r13d, [rdi + 0x14]
lea r14d, [rdi + 0x10]
mov dword [rsp + 0x28], eax
lea r9, [rbp + 0x34]
mov r8d, r13d
mov rdx, r15
mov ecx, esi
mov dword [rsp + 0x20], r14d
call fcn.1800034e8
test eax, eax
je 0x180006ce5
mov ecx, dword [rbp + 0x28]
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov r8d, ebx
mov rdx, r12
mov qword [rsp + 0x20], rax
call fcn.180003bb0
test eax, eax
je 0x180006cd1
mov rcx, qword [rsp + 0x50]
lea r8, [r12 + rbx]
lea edx, [rdi + 1]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x180006ca9
mov eax, dword [rbp + 0x54]
lea ecx, [rdi + 0x40]
mov edx, eax
mov dword [rsp + 0xa0], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x180006ca9
mov r8d, dword [rsp + 0xa0]
mov rdx, qword [rbp + 0x4c]
mov rcx, rax
call fcn.180076230
mov rcx, qword [rsp + 0x50]
lea r11, [rsp + 0xa0]
mov qword [rsp + 0x28], r11
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x180006ca0
cmp dword [rbp + 0x2c], r13d
mov rcx, qword [rsp + 0xb8]
mov rdx, rsi
cmovb r13d, dword [rbp + 0x2c]
mov r8d, r13d
call fcn.180076230
mov ebx, dword [rbp + 0x30]
mov ebp, dword [rbp + 0x2c]
mov rcx, qword [rsp + 0xb0]
cmp ebx, r14d
cmovb r14d, ebx
add rbp, rsi
mov rdx, rbp
mov r8d, r14d
call fcn.180076230
add ebx, 0xfffffff0
mov edi, 1
je 0x180006ca0
xor edx, edx
test ebx, ebx
je 0x180006ca0
lea rcx, [rbp + 0x10]
test edi, edi
je 0x180006ca0
xor eax, eax
cmp byte [rcx], al
sete al
inc edx
inc rcx
and edi, eax
cmp edx, ebx
jb 0x180006c8a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x58]
call fcn.180003214
test eax, eax
jne 0x180006ce5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_dpapi_unprotect_credhist_entry_with_shaDerivedkey___kull_m_crypto_close_hprov_delete_container__0x_08x__n
jmp 0x180006cde
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_dpapi_unprotect_credhist_entry_with_shaDerivedkey___kull_m_crypto_hkey_session__0x_08x__n
mov edx, eax
call fcn.180008f6c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180006d58
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
xor edx, edx
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [rbx + 0x40]
mov edx, eax
mov edi, eax
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x180006db8
test edi, edi
je 0x180006daf
mov rdx, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r11d, eax
lea eax, [rdi - 1]
cmp r11d, eax
jne 0x180006daf
mov ebx, 1
jmp 0x180006db8
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180006eac
Capabilities:
Encode data using base64 via winapi
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
xor ebx, ebx
xor r9d, r9d
mov r12d, r8d
cmp dword [0x1800d7738], ebx
mov r13, rdx
mov rdi, rcx
mov ebp, ebx
mov dword [rax + 0x20], ebx
je 0x180006f8d
lea rax, [rax + 0x20]
lea r8d, [rbx + 1]
mov edx, r12d
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x180006ff2
mov edx, dword [rsp + 0x78]
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x180006ff2
lea rax, [rsp + 0x78]
lea r8d, [rbx + 1]
mov r9, rsi
mov edx, r12d
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov ebp, eax
test eax, eax
je 0x180006f82
lea rcx, str._n_nBase64_of_file_:__s_n_n
mov rdx, rdi
call fcn.180008f6c
cmp dword [rsp + 0x78], ebx
jbe 0x180006f76
mov rdi, rsi
movzx edx, word [rdi]
lea rcx, [0x18009c3a0]
call fcn.180008f6c
inc ebx
add rdi, 2
cmp ebx, dword [rsp + 0x78]
jb 0x180006f5b
lea rcx, str._n
call fcn.180008f6c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x180006ff2
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
test rax, rax
je 0x180006ff2
cmp rax, 0xffffffffffffffff
je 0x180006ff2
lea r9, [rsp + 0x78]
mov r8d, r12d
mov rdx, r13
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180006fe9
cmp r12d, dword [rsp + 0x78]
jne 0x180006fe9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ebp, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov eax, ebp
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x180007010
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rsi, r8
mov rbp, rdx
cmp dword [0x1800d773c], ebx
je 0x18000705c
call fcn.18000ec30
mov ebx, eax
test eax, eax
jne 0x180007101
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_file_readData___kull_m_string_quick_base64_to_Binary__0x_08x__n
mov edx, eax
call fcn.180008f6c
jmp 0x180007101
and qword [rsp + 0x30], rbx
and dword [rsp + 0x28], ebx
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
test rax, rax
je 0x180007101
cmp rax, 0xffffffffffffffff
je 0x180007101
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800070f8
cmp dword [rsp + 0x44], ebx
jne 0x1800070f8
mov rax, qword [rsp + 0x40]
mov ecx, 0x40
mov edx, eax
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp], rax
test rax, rax
je 0x1800070f8
mov r8d, dword [rsi]
and qword [rsp + 0x20], rbx
lea r9, [rsp + 0x78]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800070ee
mov eax, dword [rsp + 0x78]
cmp dword [rsi], eax
jne 0x1800070ee
mov ebx, 1
jmp 0x1800070f8
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x18000838c
Capabilities:
Get domain controller name

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x30
or edx, 0x40020000
lea rax, [r11 + 0x20]
mov rsi, r8
mov qword [r11 - 0x10], rax
mov dword [rsp + 0x20], edx
mov rdx, rcx
xor ebx, ebx
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov qword [r11 + 0x20], rbx
call qword [sym.imp.NETAPI32.dll_DsGetDcNameW]
test eax, eax
jne 0x180008425
mov rax, qword [rsp + 0x58]
or rcx, 0xffffffffffffffff
mov rdi, qword [rax]
xor eax, eax
add rdi, 4
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
lea ecx, [rbx + 0x40]
mov edx, eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, rax
mov qword [rsi], rax
test rax, rax
je 0x180008418
mov rax, qword [rsp + 0x58]
mov r8d, edi
mov ebx, 1
mov rdx, qword [rax]
add rdx, 4
call fcn.180076230
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.NETAPI32.dll_NetApiBufferFree]
jmp 0x180008433
lea rcx, str.ERROR_kull_m_net_getDC___DsGetDcName:__u_n
mov edx, eax
call fcn.180008f6c
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180008448
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
neg ecx
mov rdi, rdx
sbb esi, esi
and dword [rax + 8], ebx
lea r8, [rax + 8]
and esi, 3
xor edx, edx
lea ecx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x1800084d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1800084d5
mov edx, dword [rsp + 0x30]
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x1800084e9
lea r8, [rsp + 0x30]
lea ecx, [rsi + 4]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov ebx, eax
test eax, eax
jne 0x1800084e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_net_getComputerName___GetComputerNameEx_data___0x_08x__n
mov edx, eax
call fcn.180008f6c
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1800084e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_net_getComputerName___GetComputerNameEx_init___0x_08x__n
mov edx, eax
call fcn.180008f6c
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18000864c
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rsi, rcx
mov rcx, qword [rcx + 8]
lea rax, [0x1800d7740]
mov rdi, rdx
mov qword [r11 - 0x28], rbx
mov qword [r11 - 0x20], rax
mov edx, dword [rcx]
mov rbp, r8
test edx, edx
je 0x180008798
dec edx
je 0x180008721
sub edx, 2
je 0x1800086f2
cmp edx, 3
jne 0x18000886f
mov rax, qword [rdi + 8]
cmp dword [rax], ebx
jne 0x180008746
cmp qword [rsi], rbx
je 0x1800086ca
mov rcx, qword [rcx + 8]
mov edx, dword [rsi]
xor r9d, r9d
mov rcx, qword [rcx]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x18000886f
mov rax, qword [rsi + 8]
mov rdx, qword [rdi]
lea r9, [rsp + 0x70]
mov rcx, qword [rax + 8]
mov r8d, ebp
mov qword [rsp + 0x20], rbx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
jmp 0x18000886f
mov rax, qword [rdi + 8]
cmp dword [rax], ebx
jne 0x180008746
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x30], ebx
mov r9d, r8d
mov qword [rsp + 0x28], rbx
mov edx, 0x22c187
mov r8, qword [rdi]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rsi
call fcn.1800075f8
jmp 0x1800086eb
mov rax, qword [rdi + 8]
cmp dword [rax], ebx
jne 0x180008746
mov rcx, qword [rcx + 8]
mov rdx, qword [rsi]
mov r9, r8
mov r8, qword [rdi]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x1800086eb
mov rdx, r8
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18000886f
lea rcx, [rsp + 0x40]
mov r8, rbp
mov rdx, rdi
call fcn.18000864c
test eax, eax
je 0x180008788
lea rdx, [rsp + 0x40]
mov r8, rbp
mov rcx, rsi
call fcn.18000864c
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18000886f
mov rdx, qword [rdi + 8]
mov ecx, dword [rdx]
test ecx, ecx
je 0x18000885f
dec ecx
je 0x18000883f
dec ecx
je 0x180008825
dec ecx
je 0x180008803
cmp ecx, 3
jne 0x18000886f
mov rcx, qword [rdx + 8]
mov edx, dword [rdi]
xor r9d, r9d
mov rcx, qword [rcx]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x18000886f
mov rax, qword [rdi + 8]
mov rdx, qword [rsi]
lea r9, [rsp + 0x70]
mov rcx, qword [rax + 8]
mov r8d, ebp
mov qword [rsp + 0x20], rbx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1800086eb
mov rcx, qword [rdx + 8]
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov edx, 0x22c183
jmp 0x18000870f
mov rcx, qword [rdx + 8]
mov rdx, qword [rsi]
mov r9, r8
mov rcx, qword [rcx]
mov r8, qword [rdi]
call fcn.180008d68
jmp 0x1800086eb
mov rcx, qword [rdx + 8]
mov rdx, qword [rdi]
mov r9, r8
mov r8, qword [rsi]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x1800086eb
mov rdx, qword [rdi]
mov rcx, qword [rsi]
call fcn.180076230
mov ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x180008b38
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov r11, rcx
mov rcx, qword [rcx + 8]
mov rbx, r9
mov r9d, dword [rcx]
xor r10d, r10d
test r9d, r9d
je 0x180008b7a
dec r9d
jne 0x180008b9a
mov rcx, qword [rcx + 8]
mov r9d, r8d
mov r8, rdx
mov rdx, qword [r11]
mov rcx, qword [rcx]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x180008b88
mov rcx, qword [r11]
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r10d, eax
test eax, eax
je 0x180008b9a
test rbx, rbx
je 0x180008b9a
mov eax, dword [rsp + 0x40]
mov dword [rbx], eax
mov eax, r10d
add rsp, 0x30
pop rbx
ret

Function at 0x180008ba4
Capabilities:
Compress data via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rax, qword [rsp + 0x80]
mov ebp, edx
mov r13, rcx
mov edx, dword [rax]
xor ebx, ebx
mov r12, r9
lea ecx, [rbx + 0x40]
mov rdi, r8
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x180008c3c
lea ecx, [rbx + 0x40]
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x180008c33
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r12
mov ecx, 0x102
mov r9, rax
mov r8d, ebp
mov rdx, r13
mov dword [rsp + 0x28], 0x1000
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ntdll.dll_RtlCompressBuffer]
test eax, eax
setns bl
test ebx, ebx
jne 0x180008c33
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret

Function at 0x180008c58
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rdi, rdx
mov rsi, rcx
lea edx, [rbx + 0x10]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x180008d1a
and qword [rsp + 0x28], rbx
and dword [rsp + 0x20], ebx
lea r8d, [rbx + 2]
xor r9d, r9d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r11, rax
mov rax, qword [rdi]
mov qword [rax], r11
mov rcx, qword [rdi]
cmp qword [rcx], rbx
je 0x180008cfa
mov rcx, qword [rcx]
and qword [rsp + 0x20], rbx
lea edx, [rbx + 4]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r11, rax
mov rax, qword [rdi]
mov qword [rax + 8], r11
test r11, r11
je 0x180008cfa
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
cmp dword [rcx], 0x504d444d
jne 0x180008cfa
mov eax, 0xa793
cmp word [rcx + 4], ax
jne 0x180008cfa
mov ebx, 1
jmp 0x180008d1a
mov rdi, qword [rdi]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x180008d0c
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rdi]
test rcx, rcx
je 0x180008d1a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1800094e0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdx, qword [rdx]
mov ebp, ecx
mov ebx, 0xc0000004
test rdx, rdx
je 0x180009514
lea r9, [rax + 0x10]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
jmp 0x18000955a
mov edi, 0x1000
mov edx, edi
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x18000955a
lea r9, [rsp + 0x38]
mov r8d, edi
mov rdx, rax
mov ecx, ebp
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
test eax, eax
jns 0x180009550
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
add edi, edi
cmp ebx, 0xc0000004
je 0x180009519
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000a1cc
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r13
push r14
sub rsp, 0xd0
mov r13d, r8d
mov edi, ecx
mov rsi, rdx
xor ebp, ebp
lea rcx, [rsp + 0x60]
xor edx, edx
lea ebx, [rbp + 0x68]
mov r14d, r9d
or r13d, 0x10
mov r8d, ebx
call fcn.180079090
mov dword [rsp + 0x60], ebx
cmp qword [rsp + 0x128], rbp
je 0x18000a222
mov rbx, qword [rsp + 0x128]
jmp 0x18000a233
mov edx, Ordinal_26
lea ecx, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rbx, rbx
je 0x18000a365
mov rcx, rsi
call fcn.180074c34
mov rsi, rax
test rax, rax
je 0x18000a365
test edi, edi
je 0x18000a2e8
dec edi
je 0x18000a2af
dec edi
jne 0x18000a349
mov r8, qword [rsp + 0x120]
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x110]
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
mov r9d, r14d
mov qword [rsp + 0x48], rax
and qword [rsp + 0x40], rbp
and qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], rsi
and qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
jmp 0x18000a31b
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x48], rax
and qword [rsp + 0x40], rbp
and qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], r13d
and dword [rsp + 0x28], ebp
and qword [rsp + 0x20], rbp
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x18000a31b
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], rbp
and qword [rsp + 0x30], rbp
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov dword [rsp + 0x28], r13d
and dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, eax
test eax, eax
je 0x18000a349
cmp dword [rsp + reloc.WLDAP32.dll_Ordinal_304], 0
jne 0x18000a336
cmp qword [rsp + 0x128], 0
jne 0x18000a35d
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x128], 0
jne 0x18000a35d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call fcn.180074bf4
lea r11, [rsp + 0xd0]
mov eax, ebp
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop rdi
ret
Function at 0x18000a8e8
Capabilities:
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov rax, qword [r9]
xor edi, edi
mov rsi, r9
mov ebp, r8d
mov r12, rdx
mov dword [rax], ecx
test ecx, ecx
je 0x18000aa38
dec ecx
jne 0x18000aa2d
lea edx, [rdi + 0x20]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r11, rax
mov rax, qword [rsi]
mov qword [rax + 8], r11
test r11, r11
je 0x18000aa2d
mov rbx, rax
mov eax, ebp
mov rcx, r12
neg eax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
sbb r8d, r8d
xor r9d, r9d
xor edx, edx
and r8d, 2
add r8d, 2
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r11, rax
mov rax, qword [rbx + 8]
mov qword [rax], r11
mov rax, qword [rbx + 8]
cmp qword [rax], rdi
je 0x18000aa2d
mov rbx, qword [rsi]
neg ebp
mov qword [rsp + 0x20], rdi
mov rcx, qword [rbx + 8]
sbb edx, edx
xor r9d, r9d
mov rcx, qword [rcx]
and edx, 0xfffffffe
xor r8d, r8d
add edx, 4
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r11, rax
mov rax, qword [rbx + 8]
mov qword [rax + 8], r11
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x18000aa2d
cmp dword [rcx], 0x66676572
jne 0x18000aa0f
cmp dword [rcx + 0x1c], edi
jne 0x18000aa0f
add rcx, 0x1000
cmp dword [rcx], 0x6e696268
jne 0x18000aa0f
mov qword [rax + 0x10], rcx
movsxd rax, dword [rcx + 4]
lea rcx, [rax + rcx + 0x20]
mov rax, qword [rbx + 8]
mov qword [rax + 0x18], rcx
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
mov eax, 0x6b6e
cmp word [rcx + 4], ax
jne 0x18000aa0f
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
test byte [rcx + 6], 0xc
jne 0x18000aa38
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov r11, qword [rsi]
mov rcx, qword [r11 + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18000aa3d
mov edi, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x18000b030
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov r10d, dword [rcx]
xor edi, edi
mov r12, r9
mov r11, r8
mov rbx, rdx
mov rbp, rcx
test r10d, r10d
je 0x18000b0cd
dec r10d
jne 0x18000b100
call fcn.18000aee4
test rax, rax
setne dil
test edi, edi
je 0x18000b100
mov ebx, dword [rax + 8]
mov rsi, qword [rsp + 0x60]
btr ebx, 0x1f
test rsi, rsi
je 0x18000b100
test r12, r12
je 0x18000b0c9
xor edi, edi
cmp dword [rsi], ebx
setae dil
test edi, edi
je 0x18000b0c9
test dword [rax + 8], 0x80000000
je 0x18000b0ad
lea rdx, [rax + 0xc]
jmp 0x18000b0be
movsxd rdx, dword [rax + 0xc]
mov rax, qword [rbp + 8]
mov rcx, qword [rax + 0x10]
lea rdx, [rdx + rcx + 4]
mov r8d, ebx
mov rcx, r12
call fcn.180076230
mov dword [rsi], ebx
jmp 0x18000b100
mov rax, qword [rsp + 0x60]
xor r8d, r8d
mov rdx, r11
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
xor r9d, r9d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete dil
test edi, edi
jne 0x18000b100
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x18000b120
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov r10d, dword [rcx]
xor ebx, ebx
mov ebp, r9d
mov r11, r8
mov rsi, rdx
mov rdi, rcx
test r10d, r10d
je 0x18000b1b7
dec r10d
jne 0x18000b1e9
call fcn.18000aee4
test rax, rax
je 0x18000b1e9
mov ecx, dword [rax + 8]
mov r8d, ecx
btr r8d, 0x1f
cmp r8d, dword [rsp + 0x68]
setae bl
test ebx, ebx
je 0x18000b1b0
mov edx, 0x80000000
mov dword [rax + 0x10], ebp
and ecx, edx
or ecx, dword [rsp + 0x68]
mov dword [rax + 8], ecx
test edx, ecx
je 0x18000b193
lea rcx, [rax + 0xc]
jmp 0x18000b1a4
movsxd rdx, dword [rax + 0xc]
mov rax, qword [rdi + 8]
mov rcx, qword [rax + 0x10]
lea rcx, [rdx + rcx + 4]
mov rdx, qword [rsp + 0x60]
call fcn.180076230
jmp 0x18000b1e9
mov ecx, Ordinal_54
jmp 0x18000b1e3
mov eax, dword [rsp + 0x68]
xor r8d, r8d
mov rdx, r11
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
test ebx, ebx
jne 0x18000b1e9
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret