joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100003668
Capabilities:
Listen for remote procedure calls

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
or rcx, 0xffffffffffffffff
xor eax, eax
lea rsi, str.InitShutdown
mov rdi, rsi
lea edx, [rax + 8]
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx + rcx + 0xe]
mov rcx, qword [0x10001d220]
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor ebp, ebp
mov rbx, rax
cmp rax, rbp
je 0x100008767
shr rdi, 1
mov r10d, 0x7fffffff
cmp rdi, rbp
je 0x10000370e
cmp rdi, r10
ja 0x10000370e
lea r8d, [r10 - 1]
lea r9, str.PIPE_
mov rdx, rdi
sub r8, rdi
sub r9, rax
mov rcx, rax
lea rax, [r8 + rdx]
cmp rax, rbp
je 0x100003702
movzx eax, word [rcx + r9]
cmp ax, bp
je 0x100003702
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1000036e2
cmp rdx, rbp
je 0x10000876f
mov word [rcx], bp
mov eax, ebp
mov r8d, 0x80070057
cmp rdi, rbp
je 0x100008778
cmp rdi, r10
ja 0x100008778
cmp eax, ebp
jl 0x100008783
mov rcx, rdi
mov rdx, rbx
mov eax, ebp
cmp rdi, rbp
je 0x100008780
cmp word [rdx], bp
je 0x100003750
add rdx, 2
sub rcx, 1
jne 0x100003741
cmp rcx, rbp
je 0x100008780
mov r8, rdi
sub r8, rcx
jmp 0x100003761
cmp eax, ebp
jl 0x1000037b2
mov rdx, rdi
lea rcx, [rbx + r8*2]
sub rdx, r8
je 0x10000878b
mov rax, rdx
sub rax, rdi
sub rsi, rcx
lea rax, [rax + r8 + 0x7fffffff]
cmp rax, rbp
je 0x1000037a6
movzx edi, word [rsi + rcx]
cmp di, bp
je 0x1000037a6
dec rdx
mov word [rcx], di
dec rax
add rcx, 2
cmp rdx, rbp
jne 0x100003786
cmp rdx, rbp
je 0x10000878b
mov word [rcx], bp
xor r9d, r9d
lea rcx, str.ncacn_np
mov r8, rbx
lea esi, [r9 + 0xa]
mov edx, esi
call qword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
mov edi, eax
cmp eax, ebp
jne 0x100008794
lea rax, [fcn.10000b7f0]
lea rcx, [0x100016250]
mov r9d, 0x10
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0x4d2
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
mov edi, eax
cmp eax, ebp
jne 0x1000087ce
mov ecx, 1
mov edx, 0x3039
mov dword [0x10001d19c], 1
mov r8d, ecx
call qword [sym.imp.RPCRT4.dll_RpcServerListen]
mov edi, eax
cmp eax, 0x6b1
cmove edi, ebp
mov rcx, qword [0x10001d220]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x30
pop rdi
ret
lea edi, [rbp + 0xe]
jmp 0x100003844
sub rcx, 2
jmp 0x10000370b
mov eax, r8d
jmp 0x100003728
mov eax, r8d
mov r8, rbp
jmp 0x100003761
sub rcx, 2
jmp 0x1000037af
cmp eax, 0x6cc
je 0x1000037d5
mov rcx, qword [0x10001d1e0]
lea rax, [0x10001d1e0]
cmp rcx, rax
je 0x100003832
test byte [rcx + 0x1c], 8
je 0x100003832
cmp byte [rcx + 0x19], 2
jb 0x100003832
mov edx, esi
jmp 0x1000087fe
mov rcx, qword [0x10001d1e0]
lea rax, [0x10001d1e0]
cmp rcx, rax
je 0x100003832
test byte [rcx + 0x1c], 8
je 0x100003832
cmp byte [rcx + 0x19], 2
jb 0x100003832
mov edx, 0xb
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
mov r9d, edi
call fcn.100001e70
jmp 0x100003832
Function at 0x100003b44
Capabilities:
Get hostname
Query environment variable
Query or enumerate registry value
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x10a0
call fcn.100003b00
sub rsp, rax
mov rax, qword [0x10001d1d0]
xor rax, rsp
mov qword [rsp + 0x1090], rax
mov rsi, rcx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x30], 0x10
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x100003ba7
lea r8, [rsp + 0x48]
lea rdx, str.COMPUTERNAME
mov r9d, 1
mov rcx, rsi
call fcn.100003cac
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x100003c7b
lea rbx, str.ProgramFiles
lea edi, [rax + 6]
mov rdx, qword [rbx - 8]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
lea r9, [rsp + 0x40]
xor r8d, r8d
mov dword [rsp + 0x34], 0x802
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x100003c62
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x880]
mov r8d, 0x401
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x100003c62
cmp eax, 0x401
jae 0x100003c62
mov rdx, qword [rbx]
lea r8, [rsp + 0x70]
mov r9d, 1
mov rcx, rsi
call fcn.100003cac
mov rcx, qword [rbx]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rbx, 0x10
sub rdi, 1
jne 0x100003be0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rsp + 0x1090]
xor rcx, rsp
call fcn.100001000
lea r11, [rsp + 0x10a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x100004e00
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0xe0
mov rbp, rcx
movsxd r12, r8d
mov rbx, rdx
xor esi, esi
lea rcx, [rsp + 0x70]
xor edx, edx
lea r13d, [rsi + 0x68]
mov edi, r9d
mov r8, r13
call sub.msvcrt.dll_memset
mov eax, dword [rsp + 0x120]
bts edi, 0xa
or eax, 1
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0xac], eax
lea eax, [rsi + 5]
mov rdx, rbp
mov word [rsp + 0xb0], ax
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov dword [rsp + 0x70], r13d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x78], rbp
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x80], rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, esi
je 0x100007d5b
mov rcx, qword [rsp + 0x138]
cmp rcx, rsi
jne 0x100007d4e
mov r8d, dword [rsp + 0x130]
cmp r8d, esi
je 0x100007d3e
lea r13, [0x100000000]
test r8b, 1
jne 0x100007cf9
test r8b, 2
je 0x100004f80
mov rcx, qword [0x10001d210]
mov edi, 8
lea r8d, [rdi + 0x18]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [rsp + 0x100], rax
cmp rax, rsi
je 0x100007d3e
mov rcx, rbp
call fcn.100004fb4
lea r8, [0x10000ad24]
mov r9, rbx
mov qword [rbx], rax
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], edi
or dword [rsp + 0x20], 0xffffffff
mov qword [rbx + 8], rcx
mov dword [rbx + 0x1c], r12d
mov rdx, qword [rsp + 0x50]
lea rcx, [rbx + 0x10]
mov dword [r13 + r12*4 + 0x1d8d0], 1
call qword [sym.imp.ntdll.dll_RtlRegisterWait]
cmp eax, esi
mov edi, eax
jl 0x100007d22
mov qword [r13 + r12*8 + 0x1d8f0], rbx
jmp 0x100004f80
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100004f8d
lea r11, [rsp + 0xe0]
mov eax, esi
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
mov edx, dword [0x10001de1c]
cmp edx, 0x40
jae 0x100004ef0
mov rax, qword [rsp + 0x50]
mov qword [r13 + rdx*8 + 0x1de20], rax
inc edx
mov dword [0x10001de1c], edx
jmp 0x100004ef0
lea rcx, [rsp + 0x100]
call fcn.1000031b0
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
jmp 0x100004f80
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100004f80
mov rax, qword [rsp + 0x50]
mov qword [rcx], rax
jmp 0x100004f80
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x10001d1e0]
lea rax, [0x10001d1e0]
cmp rcx, rax
je 0x100004f8d
test byte [rcx + 0x1c], 2
je 0x100004f8d
cmp byte [rcx + 0x19], 2
jb 0x100004f8d
mov rcx, qword [rcx + 0x10]
lea r8, [0x100015650]
mov edx, 0x3d
mov r9, rbp
mov dword [rsp + 0x20], esi
call fcn.10000a918
nop
jmp 0x100004f8d
Function at 0x100005410
Capabilities:
Listen for remote procedure calls

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor r9d, r9d
lea r8, str.WindowsShutdown
lea rcx, str.ncalrpc
lea edx, [r9 + 0xa]
call qword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
xor edi, edi
mov ebx, eax
cmp eax, edi
jne 0x100008816
lea rax, [0x10000b950]
lea rcx, [0x100015520]
mov r9d, 8
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0x4d2
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
mov ebx, eax
cmp eax, edi
jne 0x100008846
mov ecx, 1
mov edx, 0x4d2
mov r8d, ecx
mov dword [0x10001d198], ecx
call qword [sym.imp.RPCRT4.dll_RpcServerListen]
cmp eax, 0x6b1
mov ebx, eax
cmove ebx, edi
cmp ebx, edi
jne 0x100008878
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rax, qword [0x10001d1e0]
lea rcx, [0x10001d1e0]
cmp rax, rcx
je 0x1000054a2
test byte [rax + 0x1c], 8
je 0x1000054a2
cmp byte [rax + 0x19], 2
jb 0x1000054a2
lea edx, [rdi + 0x11]
jmp 0x1000088a8
mov rax, qword [0x10001d1e0]
lea rcx, [0x10001d1e0]
cmp rax, rcx
je 0x1000054a2
test byte [rax + 0x1c], 8
je 0x1000054a2
cmp byte [rax + 0x19], 2
jb 0x1000054a2
mov edx, 0x12
jmp 0x1000088a8
mov rax, qword [0x10001d1e0]
lea rcx, [0x10001d1e0]
cmp rax, rcx
je 0x1000054a2
test byte [rax + 0x1c], 8
je 0x1000054a2
cmp byte [rax + 0x19], 2
jb 0x1000054a2
mov edx, 0x13
mov rcx, qword [rax + 0x10]
lea r8, [0x1000155d0]
mov r9d, ebx
call fcn.100001e70
nop
jmp 0x1000054a2
Function at 0x100005610
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x48
lea rax, [rsp + 0x30]
lea rdx, str.SystemCurrentControlSetControlLsa
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
xor edi, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x100009247
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
lea rdx, str.SecureBoot
xor r8d, r8d
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, edi
jne 0x1000091fe
cmp dword [rsp + 0x68], 1
jne 0x1000091b3
mov rcx, qword [0x10001d1e0]
lea rbx, [0x10001d1e0]
cmp rcx, rbx
je 0x1000056c3
test byte [rcx + 0x1c], 1
je 0x1000056c3
cmp byte [rcx + 0x19], 4
jb 0x1000056c3
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x14]
lea r8, [0x100015660]
call fcn.10000121c
mov ecx, 1
call fcn.10000571c
lea r11, [rsp + 0x78]
lea r8, [0x100002c54]
mov qword [rsp + 0x28], r11
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x10001d230], rax
cmp rax, rdi
je 0x10000916c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x10000570c
mov eax, edi
add rsp, 0x48
pop rdi
pop rbx
ret
mov rax, qword [0x10001d1e0]
cmp rax, rbx
je 0x1000091a9
test byte [rax + 0x1c], 1
je 0x1000091a9
cmp byte [rax + 0x19], 2
jb 0x1000091a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x10001d1e0]
lea r8, [0x100015660]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x15
call fcn.100001e70
mov edi, 0xc000009a
jmp 0x1000056ff
call fcn.100002b00
cmp eax, edi
je 0x1000056ff
mov rcx, qword [0x10001d1e0]
lea rbx, [0x10001d1e0]
cmp rcx, rbx
je 0x1000091f4
test byte [rcx + 0x1c], 1
je 0x1000091f4
cmp byte [rcx + 0x19], 2
jb 0x1000091f4
mov rcx, qword [rcx + 0x10]
lea r8, [0x100015660]
mov edx, 0x16
call fcn.10000121c
mov edi, 0xc0000260
jmp 0x1000056ff
mov rcx, qword [0x10001d1e0]
lea rbx, [0x10001d1e0]
cmp rcx, rbx
je 0x1000056ff
test byte [rcx + 0x1c], 1
je 0x1000056ff
cmp byte [rcx + 0x19], 2
jb 0x1000056ff
mov rcx, qword [rcx + 0x10]
lea r8, [0x100015660]
mov edx, 0x17
mov r9d, eax
call fcn.100001e70
nop
jmp 0x1000056ff
mov rcx, qword [0x10001d1e0]
lea rbx, [0x10001d1e0]
cmp rcx, rbx
je 0x10000570c
test byte [rcx + 0x1c], 1
je 0x10000570c
cmp byte [rcx + 0x19], 2
jb 0x10000570c
mov rcx, qword [rcx + 0x10]
lea r8, [0x100015660]
mov edx, 0x18
mov r9d, eax
call fcn.100001e70
nop
jmp 0x10000570c
Function at 0x10000590c
Capabilities:
Listen for remote procedure calls

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x10001d1d0]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0xd
call qword [sym.imp.ntdll.dll_NtAllocateLocallyUniqueId]
xor edi, edi
cmp eax, edi
jl 0x100009555
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov ecx, dword [rax + 0x2c0]
mov dword [rsp + 0x28], ecx
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbx + 4]
lea r8, str.WMsgKRpc_X_X_X
mov edx, 0x91
lea rcx, [rsp + 0x40]
call fcn.100002858
cmp eax, edi
jl 0x100009640
xor r9d, r9d
lea r8, [rsp + 0x40]
lea edx, [r9 + 0xa]
lea rcx, str.ncalrpc
call qword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
mov ebx, eax
mov dword [rsp + 0x30], eax
cmp eax, edi
jne 0x100009568
lea rax, [0x100012230]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x4d2
mov r9d, 0x28
xor r8d, r8d
xor edx, edx
lea rcx, [0x1000168a0]
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
mov ebx, eax
mov dword [rsp + 0x30], eax
cmp eax, edi
jne 0x1000095b0
mov dword [0x10001d1c4], 1
mov edx, 0x4d2
mov ecx, 1
mov r8d, ecx
call qword [sym.imp.RPCRT4.dll_RpcServerListen]
mov ebx, eax
mov dword [rsp + 0x30], eax
cmp eax, 0x6b1
cmove ebx, edi
mov dword [rsp + 0x30], ebx
cmp ebx, edi
jne 0x1000095f8
cmp ebx, edi
jne 0x100009649
mov eax, ebx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.100001000
mov rbx, qword [rsp + 0x198]
add rsp, 0x180
pop rdi
ret
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ebx, eax
mov dword [rsp + 0x30], eax
jmp 0x100005a1d
lea rax, [0x10001d1e0]
mov rcx, qword [0x10001d1e0]
cmp rcx, rax
je 0x100005a1d
test byte [rcx + 0x1c], 1
je 0x100005a1d
cmp byte [rcx + 0x19], 2
jb 0x100005a1d
mov edx, 0x12
mov r9d, ebx
lea r8, [0x100016dd0]
mov rcx, qword [rcx + 0x10]
call fcn.100001e70
jmp 0x100005a1d
lea rax, [0x10001d1e0]
mov rcx, qword [0x10001d1e0]
cmp rcx, rax
je 0x100005a1d
test byte [rcx + 0x1c], 1
je 0x100005a1d
cmp byte [rcx + 0x19], 2
jb 0x100005a1d
mov edx, 0x13
mov r9d, ebx
lea r8, [0x100016dd0]
mov rcx, qword [rcx + 0x10]
call fcn.100001e70
jmp 0x100005a1d
lea rax, [0x10001d1e0]
mov rcx, qword [0x10001d1e0]
cmp rcx, rax
je 0x100005a1d
test byte [rcx + 0x1c], 1
je 0x100005a1d
cmp byte [rcx + 0x19], 2
jb 0x100005a1d
mov edx, 0x14
mov r9d, ebx
lea r8, [0x100016dd0]
mov rcx, qword [rcx + 0x10]
call fcn.100001e70
jmp 0x100005a1d
mov ebx, dword [rsp + 0x30]
jmp 0x100005a1d
call fcn.1000122f4
nop
jmp 0x100005a25
Function at 0x100005db8
Capabilities:
Check for peb beingdebugged flag
Get system information on windows
Make suspicious ntquerysysteminformation call
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov ebx, 1
lea rdx, [rsp + 0x58]
xor r9d, r9d
lea r8d, [rbx + 1]
lea ecx, [rbx + 0x22]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp byte [rsp + 0x58], 0
je 0x100009b50
lea rcx, [0x100012768]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x100005e6e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea rdx, str.NoDebugThread
xor r8d, r8d
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x100009b6c
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
test ebx, ebx
je 0x100005ed4
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor edx, edx
lea ecx, [rdx + 0x20]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtSystemDebugControl]
mov ebx, eax
mov rcx, qword [0x10001d1e0]
lea rax, [0x10001d1e0]
cmp rcx, rax
je 0x100005ea9
test byte [rcx + 0x1c], 8
jne 0x100009b85
xor r8d, r8d
test ebx, ebx
mov r9d, 0xea60
sets r8b
and dword [rsp + 0x28], 0
lea rdx, [0x100001134]
dec r8
xor ecx, ecx
mov dword [rsp + 0x20], r9d
call qword [sym.imp.KERNEL32.dll_SetTimerQueueTimer]
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
cmp byte [rcx + 2], 0
jne 0x100005de3
jmp 0x100005ed4
cmp dword [rsp + 0x68], 4
jne 0x100005e5f
xor ebx, ebx
cmp dword [rsp + 0x30], ebx
sete bl
jmp 0x100005e5f
cmp byte [rcx + 0x19], 5
jb 0x100005ea9
mov rcx, qword [rcx + 0x10]
lea r8, [0x100016ca0]
mov edx, 0x15
mov r9d, ebx
call fcn.100001e70
nop
jmp 0x100005ea9
Function at 0x100006150
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xb8
mov rax, qword [0x10001d1d0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
and dword [rsp + 0x30], 0
and dword [rsp + 0x34], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rbx, [rsp + 0x40]
lea rax, [rsp + 0x40]
mov rbp, r9
mov rsi, r8
mov r13, rdx
mov qword [rsp + 0x20], rax
mov r12, rcx
mov qword [rsp + 0x38], rbx
jmp 0x1000061a8
lea r9, [rsp + 0x34]
xor r8d, r8d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
movsxd rdi, eax
cmp rdi, 0xea
je 0x10000622d
test rdi, rdi
jne 0x100007bec
mov eax, dword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
movsxd rdi, eax
jmp 0x1000061f1
test rbx, rbx
je 0x10000620a
lea rax, [rsp + 0x40]
cmp rbx, rax
je 0x10000620a
lea rcx, [rsp + 0x38]
call fcn.1000031b0
mov rax, rdi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.100001000
add rsp, 0xb8
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
test rbx, rbx
je 0x100006240
lea rax, [rsp + 0x40]
cmp rbx, rax
jne 0x100007bd2
mov r8d, dword [rsp + 0x30]
mov rcx, qword [0x10001d210]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x100007be2
lea rax, [rsp + 0x30]
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
jmp 0x1000061a8
lea rcx, [rsp + 0x38]
call fcn.1000031b0
nop
jmp 0x100006240
mov edi, 0xe
jmp 0x10000620a
cmp dword [rsp + 0x110], 0
je 0x1000061f1
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteValueW]
nop
jmp 0x1000061f1
Function at 0x100006290
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.100005f60
add rsp, 0x28
jmp 0x1000062a8
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
push r12
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x10001d180], rdi
jne 0x10000a746
mov eax, dword [0x10001d1c8]
cmp eax, 1
je 0x10000a765
mov eax, dword [0x10001d1c8]
test eax, eax
jne 0x10000a77c
mov dword [0x10001d1c8], 1
lea r12, [0x1000163f8]
lea rdi, [0x1000163e0]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], eax
cmp rdi, r12
jae 0x10000634c
test eax, eax
jne 0x10000634c
mov rcx, qword [rdi]
test rcx, rcx
je 0x100006341
call rcx
mov dword [rsp + 0x30], eax
add rdi, 8
mov qword [rsp + 0x38], rdi
jmp 0x10000632a
test eax, eax
jne 0x10000a772
mov eax, dword [0x10001d1c8]
cmp eax, 1
jne 0x10000637c
lea rdx, [0x1000163d8]
lea rcx, [0x1000163c8]
call fcn.1000af000
mov dword [0x10001d1c8], 2
test esi, esi
jne 0x100006389
xor eax, eax
xchg qword [0x10001d180], rax
cmp qword [0x10001dbe0], 0
jne 0x10000a78b
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rdi, qword [rax]
mov qword [rsp + 0x28], rdi
mov esi, dword [rsp + 0x20]
cmp byte [rdi], 0x20
jbe 0x1000063d3
cmp byte [rdi], 0x22
je 0x10000a805
movzx ecx, byte [rdi]
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
jne 0x10000a817
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x1000063aa
cmp byte [rdi], 0
jne 0x10000a7b4
cmp byte [rdi], 0
jne 0x10000a7c1
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rdi
xor edx, edx
lea rcx, [0x100000000]
call fcn.100001fe0
nop
jmp 0x10000a7d7
cmp rax, rdi
jne 0x10000a755
mov esi, 1
jmp 0x1000062ec
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000062db
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x100006354
mov eax, 0xff
jmp 0x10000a851
mov dword [0x10001de18], 1
jmp 0x100006354
lea rcx, [0x10001dbe0]
call fcn.10001325c
test eax, eax
je 0x100006397
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x10001dbe0]
nop
jmp 0x100006397
test esi, esi
je 0x1000063dc
jmp 0x1000063af
cmp byte [rdi], 0x20
ja 0x1000063e5
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x1000063dc
mov dword [0x10001de14], eax
cmp dword [0x10001d188], 0
jne 0x10000a7ee
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x10001de18], 0
jne 0x10000a803
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x10001de14]
jmp 0x10000a851
xor eax, eax
test esi, esi
sete al
mov esi, eax
mov dword [rsp + 0x20], eax
jmp 0x1000063b8
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x1000063c9
lea r11, [rsp + 0xb0]
mov rsi, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r12
ret
Function at 0x10000641c
Capabilities:
Set environment variable

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x10001d1d0]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor edx, edx
mov ebx, 0x104
lea r8, [rsp + 0x20]
lea ecx, [rdx + 5]
mov r9, rbx
call sub.profapi.dll_Ordinal_104
test eax, eax
js 0x100009bad
lea rdx, [rsp + 0x20]
lea rcx, str.USERPROFILE
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x10000646a
xor edx, edx
lea r8, [rsp + 0x20]
mov r9, rbx
lea ecx, [rdx + 3]
call sub.profapi.dll_Ordinal_104
test eax, eax
js 0x100006492
lea rdx, [rsp + 0x20]
lea rcx, str.PUBLIC
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor edx, edx
lea r8, [rsp + 0x20]
mov r9, rbx
lea ecx, [rdx + 4]
call sub.profapi.dll_Ordinal_104
test eax, eax
js 0x1000064cc
lea rdx, [rsp + 0x20]
lea rcx, str.ProgramData
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [rsp + 0x20]
lea rcx, str.ALLUSERSPROFILE
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.100001000
add rsp, 0x240
pop rbx
ret
mov rax, qword [0x10001d1e0]
lea rcx, [0x10001d1e0]
cmp rax, rcx
je 0x10000646a
test byte [rax + 0x1c], 1
je 0x10000646a
cmp byte [rax + 0x19], 2
jb 0x10000646a
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x10001d1e0]
lea r8, [0x100014810]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0xa
call fcn.100001e70
nop
jmp 0x10000646a
Function at 0x1000069dc
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub rsp, 0x38
and dword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x100006a5c
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.DisableLockWorkstation
xor r8d, r8d
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp dword [rsp + 0x40], 2
je 0x100008f83
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
add rsp, 0x38
ret
mov rcx, qword [rsp + 0x58]
and dword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
lea rdx, str.DisableLockWorkstation
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
nop
jmp 0x100006a51