joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021a3c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140021a6c
xor eax, eax
jmp 0x140021b2f
mov rbp, rbx
cmp word [rax], si
je 0x140021a91
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140021a78
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140021a74
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14001f088
movsxd r14, eax
test eax, eax
jne 0x140021acf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140021a65
mov rcx, r14
call fcn.14001ca9c
mov rdi, rax
test rax, rax
jne 0x140021ae8
xor ecx, ecx
call fcn.140019de8
jmp 0x140021ac4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14001f088
test eax, eax
jne 0x140021b19
mov rcx, rdi
call fcn.140019de8
jmp 0x140021b23
xor ecx, ecx
call fcn.140019de8
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140021b4c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140021bd3
mov rsi, rbx
cmp word [rax], bp
je 0x140021b92
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140021b7c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140021b78
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14001ca9c
mov rdi, rax
test rax, rax
je 0x140021bc0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000bb30
mov rbp, rdi
xor ecx, ecx
call fcn.140019de8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140026594
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400149ec
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14002661e
cmp byte [rbp - 0x21], r15b
je 0x140026619
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140026654
call fcn.14001df9c
test eax, eax
jne 0x140026640
cmp byte [rbp - 0x21], r15b
je 0x140026638
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140026654
cmp byte [rbp - 0x21], r15b
je 0x140026651
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400144d4
test eax, eax
jne 0x1400266f4
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400149ec
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140026693
cmp byte [rbp - 0x21], r15b
je 0x1400266c8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400266c8
call fcn.14001df9c
test eax, eax
jne 0x1400266b4
cmp byte [rbp - 0x21], r15b
je 0x1400266ad
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400266c8
cmp byte [rbp - 0x21], r15b
je 0x1400266c5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400144d4
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400266f4
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400266f7
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140026705
mov rcx, rdi
call fcn.140019de8
cmp byte [rbp + 0x3f], r15b
je 0x140026714
mov rcx, qword [rbp + 0x27]
call fcn.140019de8
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140027d80
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001b724
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001b724
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140027ed0
cmp rax, 0xffffffffffffffff
je 0x140027ed0
xor edi, edi
test rbp, rbp
jle 0x140027e7b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001dd10
mov rbx, rax
test rax, rax
jne 0x140027e08
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140027e71
mov edx, 0x8000
mov ecx, r14d
call fcn.1400158c8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001c400
cmp eax, 0xffffffff
je 0x140027e51
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140027e18
mov edx, r15d
mov ecx, r14d
call fcn.1400158c8
jmp 0x140027e71
cmp byte [rsi + 0x38], dil
je 0x140027e68
cmp dword [rsi + 0x34], 5
jne 0x140027e68
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140027e71
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140019de8
jmp 0x140027ee4
jns 0x140027ee4
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001b724
cmp rax, 0xffffffffffffffff
jne 0x140027e9c
cmp byte [rsi + 0x30], dil
je 0x140027ee4
mov edi, dword [rsi + 0x2c]
jmp 0x140027ee4
mov ecx, r14d
call fcn.140016ec8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140027ee4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140027ee4
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140027edd
mov eax, dword [rsi + 0x2c]
jmp 0x140027ee2
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001b724
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1800040a8
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x180013070]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov eax, dword [0x18000d250]
lea rdx, str.SYSTEMSetupDJOIN
and qword [rsp + 0x40], 0
xor r9d, r9d
movaps xmm0, xmmword [str.NetpApplyComputerNameSetToRegistry]
xor r8d, r8d
movaps xmm1, xmmword [0x18000d220]
mov rcx, 0xffffffff80000002
and qword [rbp - 0x19], 0
mov dword [rbp + 0x37], eax
movzx eax, word [0x18000d254]
mov word [rbp + 0x3b], ax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
movaps xmmword [rbp - 9], xmm0
movaps xmm0, xmmword [0x18000d230]
movaps xmmword [rbp + 7], xmm1
movaps xmm1, xmmword [0x18000d240]
mov dword [rsp + 0x28], 0x20006
and dword [rsp + 0x20], 0
movaps xmmword [rbp + 0x17], xmm0
movaps xmmword [rbp + 0x27], xmm1
mov dword [rbp - 0x11], 1
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x18000416c
lea r8, str.SYSTEMSetupDJOIN
lea rcx, str._ws:_RegCreateKeyEx__ws__failed:_0x_x._n
jmp 0x1800041c5
mov rcx, qword [rbp - 0x19]
lea rdx, str.UJoinComputerNameSet
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 0x11]
mov r9d, 4
lea rdx, str.UJoinComputerNameSet
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x1800041d1
lea r8, str.UJoinComputerNameSet
lea rcx, str._ws:_RegSetValueEx__ws__failed:_0x_x._n
mov r9d, eax
lea rdx, [rbp - 9]
call fcn.180008608
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x1800041e6
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180009470
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rbp
ret
Function at 0x18000420c
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xb0
mov rax, qword [0x180013070]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [str.NetpApplyComputerNameSetToRegistryDirect]
lea rdx, str.ODJComputerNameSet
movaps xmm1, xmmword [0x18000d360]
mov rbx, rcx
movzx eax, word [0x18000d3a0]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [0x18000d370]
movaps xmmword [rsp + 0x50], xmm1
movaps xmm1, xmmword [0x18000d380]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [0x18000d390]
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [r11 - 0x38], xmm0
mov word [r11 - 0x28], ax
mov dword [rsp + 0x30], 1
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
mov r9d, 4
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], r9d
lea rdx, str.ODJComputerNameSet
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x1800042de
mov r9d, eax
lea r8, str.ODJComputerNameSet
lea rdx, [rsp + 0x40]
lea rcx, str._ws:_RegSetValueEx__ws__failed:_0x_x._n
call fcn.180008608
mov eax, ebx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180009470
add rsp, 0xb0
pop rbx
ret
Function at 0x180004848
Capabilities:
Delete registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb8
mov rax, qword [0x180013070]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov eax, dword [0x18000d8c8]
mov rdi, r8
and qword [rsp + 0x40], 0
mov r15, r9
movups xmm0, xmmword [str.NetpApplyPartsToRegistryDirect]
and qword [rbp - 0x39], 0
mov r14d, edx
movups xmm1, xmmword [0x18000d8a0]
mov dword [rbp + 7], eax
lea rdx, str.SetupDJOIN
movzx eax, word [0x18000d8cc]
mov rsi, rcx
mov word [rbp + 0xb], ax
xor r9d, r9d
lea rax, [rbp - 0x39]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rdi
and qword [rsp + 0x30], 0
movups xmmword [rbp - 0x31], xmm0
mov dword [rsp + 0x28], 0x20006
movups xmm0, xmmword [0x18000d8b0]
and dword [rsp + 0x20], 0
movups xmmword [rbp - 0x21], xmm1
movsd xmm1, qword [0x18000d8c0]
movups xmmword [rbp - 0x11], xmm0
movsd qword [rbp - 1], xmm1
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x18000491e
mov r9d, eax
lea r8, str.SetupDJOIN
lea rdx, [rbp - 0x31]
lea rcx, str._ws:_RegCreateKeyEx__ws__failed:_0x_x._n
call fcn.180008608
jmp 0x18000497b
mov rcx, qword [rbp - 0x39]
call fcn.18000420c
lea rdx, [rbp - 0x31]
mov ebx, eax
test eax, eax
je 0x180004942
mov r8d, eax
lea rcx, str._ws:_NetpApplyComputerNameSetToRegistryDirect_failed:_0x_x._n
call fcn.180008608
jmp 0x18000497b
lea rcx, str._ws:_NetpApplyComputerNameSetToRegistryDirect_succeeded._n
call fcn.180008608
lea rax, [rbp - 0x41]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov r8d, r14d
mov qword [rsp + 0x38], rdi
xor edx, edx
mov qword [rsp + 0x30], r15
mov rcx, rsi
mov dword [rsp + 0x20], 6
call fcn.1800049d0
mov ebx, eax
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x1800049ab
test ebx, ebx
je 0x18000499f
lea rdx, str.ODJComputerNameSet
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.180009470
add rsp, 0xb8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180006000
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [rcx]
mov rdi, rcx
cmp rbx, rcx
je 0x1800060c6
mov rax, qword [rbx]
cmp qword [rax + 8], rbx
jne 0x1800060d2
mov rcx, qword [rbx + 8]
cmp qword [rcx], rbx
jne 0x1800060d2
mov qword [rcx], rax
mov qword [rax + 8], rcx
cmp byte [rbx + 0x2c], 0
je 0x18000608b
mov rcx, qword [rbx + 0x10]
lea rax, [rbx + 0x30]
mov dword [rsp + 0x28], 4
lea rdx, str.Status
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
je 0x18000608b
mov r8d, eax
lea rdx, str.Status
lea rcx, str.NetpFreePartList:_Failed_to_set_part__ws_value:_0x_x._n
call fcn.180008608
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.netutils.dll_NetApiBufferFree]
nop dword [rax + rax]
mov rbx, qword [rdi]
cmp rbx, rdi
jne 0x180006019
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, 3
int 0x29
int3
Function at 0x1800060e0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x180013070]
xor rax, rsp
mov qword [rsp + 0x90], rax
movaps xmm0, xmmword [str.NetpStartImageStateMonitorThread]
mov edx, 0x18
movaps xmm1, xmmword [0x18000e950]
movzx eax, word [0x18000e980]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [0x18000e960]
lea ecx, [rdx + 0x28]
movaps xmmword [rsp + 0x50], xmm1
movaps xmm1, xmmword [0x18000e970]
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm1
mov word [rsp + 0x80], ax
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x180006288
call fcn.1800084e0
mov r9d, 0x20019
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSetupState
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x180006197
lea rcx, str._ws:_Failed_to_open_the_WSS_key:_0x_x._n
jmp 0x180006229
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 1]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
nop dword [rax + rax]
mov qword [rbx + 8], rax
test rax, rax
je 0x180006236
lea r8, [rbx + 0x10]
mov ecx, 4
lea rdx, [fcn.1800060e0]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
nop dword [rax + rax]
test eax, eax
je 0x180006236
lea rax, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x1800062b0]
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
nop dword [rax + rax]
test rax, rax
je 0x180006216
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
jmp 0x180006288
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
lea rcx, str._ws:_CreateThread___failed:_0x_x._n
mov r8d, eax
lea rdx, [rsp + 0x40]
call fcn.180008608
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x18000624b
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180006260
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbx]
test rcx, rcx
je 0x180006274
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
call fcn.180008584
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180009470
add rsp, 0xa0
pop rbx
ret
Function at 0x18000778c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
and qword [rsp + 0x58], 0
lea rax, [rsp + 0x58]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.ServicesNTDSParameters
xor bl, bl
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x18000783e
and dword [rsp + 0x50], eax
lea r9, [rsp + 0x50]
and dword [rsp + 0x48], eax
lea rdx, str.DSA_Database_file
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
xor r8d, r8d
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
mov dword [rsp + 0x20], eax
lea rcx, str.loaded
sete bl
lea r8, str.failed_to_load
test eax, eax
lea rdx, str.this_is_not_a
lea r9, str.ServicesNTDSParametersDSA_Database_file
cmove r8, rcx
lea rcx, str.this_is_a
cmove rdx, rcx
lea rcx, str.NetpIsTargetImageADC:_Determined__ws_DC_image_as_RegQueryValueExW__ws__ws:_0x_1x_n
call fcn.180008608
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180007854
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov al, bl
add rsp, 0x30
pop rbx
ret

Function at 0x180007864
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
lea r10d, [rdx + 2]
mov r11d, edx
mov eax, 0xaaaaaaab
xor r14d, r14d
mul r10d
mov rax, qword [rsp + 0x38]
mov rbx, r8
shr edx, 1
mov rdi, rcx
lea edx, [rdx*4 + 1]
test rax, rax
je 0x1800078a8
mov dword [rax], edx
test r9d, r9d
jne 0x1800078b6
test rbx, rbx
je 0x1800079c7
cmp r9d, edx
jae 0x1800078c5
mov eax, 0x8007000e
jmp 0x1800079c9
mov r10d, r14d
mov r9d, r14d
test r11d, r11d
je 0x18000798c
lea r13, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_debug
mov eax, r9d
inc r9d
movzx ebp, byte [rax + rdi]
cmp r9d, r11d
jae 0x1800078f6
lfence
mov dl, byte [r9 + rdi]
inc r9d
jmp 0x1800078f9
mov dl, r14b
cmp r9d, r11d
jae 0x18000790a
lfence
mov sil, byte [r9 + rdi]
inc r9d
jmp 0x18000790d
mov sil, r14b
mov ecx, r10d
mov rax, rbp
shr rax, 2
inc r10d
movzx r8d, dl
mov rdx, rbp
and edx, 3
shl rdx, 4
movzx eax, word [r13 + rax*2]
mov word [rbx + rcx*2], ax
mov eax, r8d
shr rax, 4
and r8d, 0xf
or rdx, rax
shl r8d, 2
mov ecx, r8d
movzx eax, word [r13 + rdx*2]
mov word [rbx + r10*2], ax
inc r10d
movzx eax, sil
shr rax, 6
or rcx, rax
movzx ecx, word [r13 + rcx*2]
mov word [rbx + r10*2], cx
inc r10d
movzx ecx, sil
and ecx, 0x3f
movzx ecx, word [r13 + rcx*2]
mov word [rbx + r10*2], cx
inc r10d
cmp r9d, r11d
jb 0x1800078db
mov eax, 0xaaaaaaab
mul r11d
shr edx, 1
lea eax, [rdx + rdx*2]
mov edx, 0x3d
sub r11d, eax
sub r11d, 1
je 0x1800079af
cmp r11d, 1
je 0x1800079b7
jmp 0x1800079bf
lea eax, [r10 - 2]
mov word [rbx + rax*2], dx
lea eax, [r10 - 1]
mov word [rbx + rax*2], dx
mov eax, r10d
mov word [rbx + rax*2], r14w
xor eax, eax
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r14
pop r13
ret
Function at 0x180007ab8
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x90
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rdi
mov rax, qword [0x180013070]
xor rax, rbp
mov qword [rbp + 0x68], rax
and dword [rbp], 0
mov eax, dword [rsp]
sub rsp, 0x10
lea r14, [rsp + 0x20]
mov eax, dword [r14]
mov r8d, 0x30
lea rdx, [rbp + 8]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualQuery]
nop dword [rax + rax]
test rax, rax
je 0x180007bdb
mov r15, qword [rbp + 0x10]
lea rcx, [rbp + 0x38]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemInfo]
nop dword [rax + rax]
mov edi, dword [rbp + 0x3c]
lea rcx, [rbp]
xor ebx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetThreadStackGuarantee]
nop dword [rax + rax]
cmp eax, 1
jne 0x180007b58
mov eax, dword [rbp]
test eax, eax
cmovne ebx, eax
lea ecx, [rdi - 1]
add ecx, ebx
lea edx, [rdi - 1]
cmp ecx, ebx
jb 0x180007bdb
mov eax, edx
not eax
and ecx, eax
je 0x180007b75
lea eax, [rcx + rdi]
cmp eax, ecx
jb 0x180007bdb
mov ecx, eax
lea eax, [rdi + rdi*2]
mov ebx, edx
cmp ecx, eax
not rbx
cmovae eax, ecx
and rbx, r14
mov esi, eax
lea rax, [r15 + rdi]
sub rbx, rsi
cmp rbx, rax
jb 0x180007bdb
mov r9d, 4
mov r8d, 0x1000
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualAlloc]
nop dword [rax + rax]
test rax, rax
je 0x180007bdb
lea r9, [rbp + 4]
mov r8d, 0x104
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualProtect]
nop dword [rax + rax]
test eax, eax
je 0x180007bdb
mov eax, 1
jmp 0x180007bdd
xor eax, eax
mov rcx, qword [rbp + 0x68]
xor rcx, rbp
call fcn.180009470
mov rbx, qword [rbp + 0x90]
mov rsi, qword [rbp + 0x98]
mov rdi, qword [rbp + 0xa0]
lea rsp, [rbp + 0x70]
pop r15
pop r14
pop rbp
ret

Function at 0x180007c10
Capabilities:
Access pe header
Check for peb beingdebugged flag

Disassembly:
sub rsp, 0x28
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov edx, 0x3000
cmp byte [rcx + 2], 0
jne 0x180007c5a
test rax, rax
je 0x180007c53
mov rcx, qword [rax + 0x60]
sub rcx, qword [rax + 0x68]
cmp rcx, rdx
jb 0x180007c5a
mov ecx, 0x20e
jmp 0x180007c5c
xor ecx, ecx
mov qword [0x180013748], rcx
test rax, rax
jne 0x180007c71
or rcx, 0xffffffffffffffff
mov rax, rcx
jmp 0x180007c8d
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x1748]
mov eax, ecx
test rcx, rcx
jne 0x180007c8d
mov rcx, rdx
mov rax, rdx
add rax, 8
mov rdx, 0xfffffffffffffff7
cmp rax, 8
lea rax, [0x180007d00]
mov qword [0x180013750], rax
lea rax, [0x180007cd0]
cmovb rcx, rdx
mov qword [0x180013760], rax
mov qword [0x180013758], rcx
add rsp, 0x28
ret