joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400aef18
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1400ef700]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x1400aef62
call fcn.140094108
mov dword [rax], reloc.WS2_32.dll_ntohs
call fcn.140094128
mov dword [rax], reloc.WS2_32.dll_listen
call fcn.140091290
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140088b30
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x1400aef6d
lea eax, [rbx + 1]
jmp 0x1400aef4f
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x1400aef4d
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x1400aef4f
Function at 0x1400b03b4
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140094148
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400b043e
cmp byte [rbp - 0x21], r15b
je 0x1400b0439
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400b0474
call fcn.1400a3610
test eax, eax
jne 0x1400b0460
cmp byte [rbp - 0x21], r15b
je 0x1400b0458
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400b0474
cmp byte [rbp - 0x21], r15b
je 0x1400b0471
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14009c998
test eax, eax
jne 0x1400b0514
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140094148
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400b04b3
cmp byte [rbp - 0x21], r15b
je 0x1400b04e8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400b04e8
call fcn.1400a3610
test eax, eax
jne 0x1400b04d4
cmp byte [rbp - 0x21], r15b
je 0x1400b04cd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400b04e8
cmp byte [rbp - 0x21], r15b
je 0x1400b04e5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14009c998
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400b0514
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400b0517
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400b0525
mov rcx, rdi
call fcn.1400a3368
cmp byte [rbp + 0x3f], r15b
je 0x1400b0534
mov rcx, qword [rbp + 0x27]
call fcn.1400a3368
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18000adb4
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov rsi, rcx
mov edi, ebx
test rcx, rcx
je 0x18000ae56
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rcx, rsi
mov ebp, eax
call fcn.1800d9868
lea edx, [rbp + 1]
add rdx, rax
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x18000ae59
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebp, eax
mov eax, 0x5c
lea ecx, [rbp - 1]
cmp word [rdi + rcx*2], ax
je 0x18000ae28
mov word [rdi + rbp*2], ax
inc ebp
mov rcx, rsi
call fcn.1800d9868
test rax, rax
je 0x18000ae56
mov r14, rbx
movzx eax, word [rsi + r14*2]
lea ecx, [rbx + rbp]
mov word [rdi + rcx*2], ax
inc ebx
mov rcx, rsi
mov r14d, ebx
call fcn.1800d9868
cmp r14, rax
jb 0x18000ae38
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18000b8fc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rsi, rcx
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x18000babc
mov rcx, rsi
call fcn.18000ae74
test eax, eax
jne 0x18000babc
mov rcx, rsi
call fcn.18000b1e4
mov rdi, rax
test rax, rax
je 0x18000ba01
call fcn.18000c064
mov rbp, rax
test rax, rax
je 0x18000b9f9
mov rcx, rdi
call fcn.18000ae74
test eax, eax
je 0x18000b9e2
lea rax, str.system32_
mov qword [rsp + 0x20], rax
lea rsi, [rsp + 0x20]
lea rax, str.SystemRoot_system32_
mov qword [rsp + 0x28], rax
mov rcx, qword [rsi]
call fcn.1800d9868
mov rdx, qword [rsi]
mov r8, rax
mov rcx, rdi
mov r14, rax
call fcn.1800d9bb8
test eax, eax
je 0x18000b9b6
add rsi, 8
lea rax, [rsp + 0x30]
cmp rsi, rax
jb 0x18000b989
jmp 0x18000b9c5
lea rdx, [rdi + r14*2]
mov rcx, rbp
call fcn.18000c208
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rsi, rax
jne 0x18000b9f0
mov rcx, rdi
call fcn.18000aed4
test eax, eax
je 0x18000b9f0
mov rbx, rdi
xor edi, edi
jmp 0x18000b9f0
mov rdx, rdi
mov rcx, rbp
call fcn.18000c208
mov rbx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
jmp 0x18000ba95
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x18000baa4
mov rcx, rsi
call fcn.18000cba4
mov rsi, rax
test rax, rax
je 0x18000baa4
mov ecx, 0x37e4
call fcn.18000c740
test eax, eax
je 0x18000ba39
call fcn.18000bcb8
jmp 0x18000ba3e
call fcn.18000c064
mov rdi, rax
test rax, rax
je 0x18000ba92
mov rdx, rsi
mov rcx, rax
call fcn.18000c208
mov rbx, rax
test rax, rax
je 0x18000ba89
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18000ba6b
test al, 0x50
je 0x18000ba89
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x18000ba7e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbx, rbx
je 0x18000baa4
xor ecx, ecx
jmp 0x18000bab1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18000bab7
lea ecx, [rax + 0x7e]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
jmp 0x18000bac9
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x18000c064
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov ecx, 0x40
add rdx, rdx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x18000c0b8
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x18000c0ad
cmp edi, eax
jae 0x18000c0b8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ebx, ebx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000d798
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x168]
sub rsp, 0x268
mov rax, qword [0x1801aed20]
xor rax, rsp
mov qword [rbp + 0x150], rax
xor esi, esi
mov r14, rdx
mov dword [rdx], esi
mov rdi, rcx
mov qword [r8], rsi
lea rcx, str.DriverErrorErrorCode
mov r13, r9
mov dword [r9], esi
lea edx, [rsi + 0x5c]
mov r15, r8
mov r12b, sil
call fcn.1800cf450
mov rbx, rax
test rax, rax
jne 0x18000d806
movzx eax, si
lea rbx, str.DriverErrorErrorCode
mov word [rsp + 0x40], ax
jmp 0x18000d82e
lea r8, str.DriverErrorErrorCode
mov r9, rbx
sub r9, r8
lea rcx, [rsp + 0x40]
sar r9, 1
mov edx, 0x104
call fcn.1800dd388
movzx eax, word [rsp + 0x40]
add rbx, 2
cmp si, ax
setne sil
xor eax, eax
mov qword [rsp + 0x38], rax
test sil, sil
je 0x18000d86f
lea rax, [rsp + 0x38]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000d9ad
mov rax, qword [rsp + 0x38]
and dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
test sil, sil
mov dword [rsp + 0x34], 4
mov rcx, rdi
mov rdx, rbx
cmovne rcx, rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18000d8b3
and dword [r14], 0
jmp 0x18000d9ad
test sil, sil
mov rcx, rdi
mov rdx, rbx
cmovne rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [rsp + 0x30], 4
jne 0x18000d8aa
mov edx, 0x5c
lea rcx, str.DriverErrorErrorContext
mov r12b, 1
call fcn.1800cf450
xor r14d, r14d
mov rbx, rax
test rax, rax
jne 0x18000d8f7
lea rbx, str.DriverErrorErrorContext
jmp 0x18000d8fb
add rbx, 2
lea rax, [rsp + 0x34]
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
test sil, sil
mov dword [rsp + 0x34], r14d
mov rcx, rdi
mov qword [rsp + 0x20], r14
cmovne rcx, qword [rsp + 0x38]
mov rdx, rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000d9ad
cmp dword [rsp + 0x30], 3
jne 0x18000d9ad
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x18000d9ad
mov ecx, eax
call fcn.1800dd380
mov qword [r15], rax
test rax, rax
je 0x18000d9ad
lea rdx, [rsp + 0x34]
test sil, sil
mov qword [rsp + 0x28], rdx
lea r9, [rsp + 0x30]
mov rcx, rdi
mov qword [rsp + 0x20], rax
cmovne rcx, qword [rsp + 0x38]
mov rdx, rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18000d990
mov rcx, qword [r15]
call fcn.1800dd360
mov qword [r15], r14
jmp 0x18000d9ad
mov eax, dword [rsp + 0x34]
test sil, sil
mov rcx, rdi
mov dword [r13], eax
cmovne rcx, qword [rsp + 0x38]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x18000d9cb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov al, r12b
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1800a6240
add rsp, 0x268
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18000e290
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, qword [rcx + 0x10]
mov rsi, rdx
mov rdi, rcx
test rbx, rbx
je 0x18000e322
cmp qword [rbx], 0
mov rbp, qword [rcx]
je 0x18000e310
lea rcx, [0x180158b10]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000e31b
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x18000e31b
mov rcx, rax
call qword [fcn.18000e000]
mov rdx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbp
mov rdx, rsi
call rdi
jmp 0x18000e39f
cmp dword [rbx + 8], 0
je 0x18000e31b
mov rcx, rbp
jmp 0x18000e399
mov eax, 1
jmp 0x18000e39f
cmp byte [0x1801fc198], 0
jne 0x18000e36d
lea rcx, [0x180158b10]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000e359
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x1801fc178], rax
jmp 0x18000e360
mov rbx, qword [0x1801fc178]
mov eax, 1
mov byte [0x1801fc198], al
jmp 0x18000e374
mov rbx, qword [0x1801fc178]
test rbx, rbx
je 0x18000e393
mov rcx, rbx
call qword [fcn.18000e000]
mov r8d, dword [rdi + 8]
xor r9d, r9d
mov rcx, qword [rdi]
mov rdx, rsi
call rbx
jmp 0x18000e39f
mov rcx, qword [rdi]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18000ea34
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1801aed20]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
xor edi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x70], rdi
xor edx, edx
lea r8d, [rdi + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x18000eac1
xor edx, edx
lea r8d, [rdi + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x18000eac1
call fcn.18000e158
mov ebx, eax
jmp 0x18000ebd2
mov r8, r15
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x18000eae2
call fcn.18000e158
jmp 0x18000ebc1
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18000ead8
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x18000eb1d
mov ebx, 0x8007000e
jmp 0x18000ebc3
mov ecx, eax
test eax, eax
je 0x18000eb55
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x18000eb4b
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x18000eb55
lea rcx, [rsp + 0x70]
call fcn.1800215c0
jmp 0x18000eb5f
mov ecx, 0x80070216
call fcn.18000e0a4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x18000eb71
cmp qword [rsp + 0x70], rdi
je 0x18000eb13
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x18000ead8
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], di
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.18000f8cc
mov ebx, eax
test rsi, rsi
je 0x18000ebd2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x18000ebe9
lea rcx, [rsp + 0x70]
call fcn.18001fb94
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1800a6240
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x180013434
Capabilities:
Query environment variable

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rdi, rcx
mov ecx, 0xfffe
call fcn.1800a6d90
mov rbx, rax
mov qword [rsp + 0x40], rax
cmp qword [rdi + 0x18], 8
jb 0x180013469
mov rcx, qword [rdi]
jmp 0x18001346c
mov rcx, rdi
mov r8d, 0x7fff
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
cmp word [rbx], ax
je 0x18001348a
mov rcx, rbx
call fcn.1800d9868
mov r8, rax
mov rdx, rbx
mov rcx, rdi
call fcn.18001eca0
nop
mov edx, 2
mov rcx, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.18006b9e0

Function at 0x180013e28
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rsi, r8
mov rdi, rdx
mov r15, rcx
mov ebx, 0x800
mov ecx, ebx
call fcn.1800a6d90
mov qword [rbp - 0x18], rax
mov r8b, byte [rbp + 0x30]
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.18002e194
nop
mov dword [rbp + 0x30], ebx
cmp qword [rdi + 0x18], 8
jb 0x180013e7e
mov rdx, qword [rdi]
jmp 0x180013e81
mov rdx, rdi
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
mov rbx, qword [rbp - 0x18]
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x38]
xor r8d, r8d
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14d, eax
cmp eax, 0xea
jne 0x180013f3b
mov ecx, dword [rbp + 0x30]
inc ecx
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1800a6d90
mov qword [rbp - 0x28], rax
mov r8b, byte [rbp + 0x30]
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.18002e194
mov r14, qword [rbp - 0x28]
mov qword [rbp - 0x28], rbx
mov rbx, r14
mov qword [rbp - 0x18], rbx
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x20], rcx
lea rcx, [rbp - 0x20]
call fcn.18001269c
cmp qword [rdi + 0x18], 8
jb 0x180013f17
mov rdi, qword [rdi]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x38]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14d, eax
xor ecx, ecx
test r14d, r14d
jne 0x180013fa5
mov r8d, dword [rbp + 0x30]
shr r8, 1
mov eax, dword [rbp + 0x38]
dec eax
cmp eax, 1
jbe 0x180013f5b
mov r14d, 0x3bc6
jmp 0x180013fa5
cmp word [rbx + r8*2 - 2], cx
jne 0x180013f83
cmp word [rbx], cx
je 0x180013f73
mov rcx, rbx
call fcn.1800d9868
mov rcx, rax
mov r8, rcx
mov rdx, rbx
mov rcx, rsi
call fcn.18001eca0
jmp 0x180013fa5
mov qword [rsi + 0x10], rcx
cmp qword [rsi + 0x18], 8
jb 0x180013f93
mov rax, qword [rsi]
jmp 0x180013f96
mov rax, rsi
mov word [rax], cx
mov rdx, rbx
mov rcx, rsi
call fcn.18001c3cc
nop
lea rcx, [rbp - 0x10]
call fcn.18001269c
mov eax, r14d
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180013fd4
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x90
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1801aed20]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x30], 4
cmp qword [rdx + 0x18], 8
jb 0x18001400a
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x180014049
cmp dword [rsp + 0x34], 4
je 0x180014043
mov ebx, 0x3bc6
jmp 0x180014049
mov eax, dword [rsp + 0x38]
jmp 0x18001408b
lea rdx, str.RegQueryValueEx
lea rcx, [rsp + 0x60]
call fcn.18001c6c0
nop
mov r8d, ebx
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.180013848
nop
mov r9d, 0x1f8
lea r8, str.c:dvsp4_build_sw_relgpu_drv_r565_r565_00driversuilogginglogging.libRegistryKey.h
lea rdx, str.void___cdecl_Nvidia::Logging::RegistryKey::CheckErrorCode_long_const_char__
mov rcx, rax
call fcn.180023874
nop
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800a6240
add rsp, 0x90
pop rbx
ret

Function at 0x180015ab0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1801aed20]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdx, r8
lea rcx, [rsp + 0x20]
lea r8, [0x18015a51c]
call fcn.180023908
cmp qword [rax + 0x18], 8
jb 0x180015ae1
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor r8d, r8d
lea rcx, [rsp + 0x20]
mov dl, 1
call fcn.18001ea24
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800a6240
add rsp, 0x58
ret

Function at 0x180016f2c
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rdi, rdx
mov r14, rcx
xor ebx, ebx
cmp qword [rcx], 0xffffffffffffffff
je 0x18001701b
mov ebp, ebx
mov r15, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x180016f6a
mov r8, qword [rdx]
jmp 0x180016f6d
mov r8, rdi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9d, r15d
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rsi, eax
mov qword [rsp + 0x90], rbx
test eax, eax
jle 0x180016fe1
mov rcx, rsi
call fcn.1800a6d90
mov rbp, rax
xor ecx, ecx
call fcn.18006b9e0
cmp qword [rdi + 0x18], 8
jb 0x180016fbb
mov rdi, qword [rdi]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbp
mov r9d, r15d
mov r8, rdi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rsp + 0x80], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x80]
mov r8d, esi
mov rdx, rbp
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180017013
cmp dword [rsp + 0x80], esi
jne 0x180017013
mov bl, 1
mov rcx, rbp
call fcn.18006b9e0
mov al, bl
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001aad4
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1801aed20]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rdx
xor ebx, ebx
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18001ab6b
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x238
call fcn.1800cf2b0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18001ab62
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call fcn.1800d903c
test eax, eax
je 0x18001ab5e
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x18001ab39
mov ebx, dword [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1800a6240
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x18001e410
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1801aed20]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbp, rcx
mov rbx, rdx
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
movabs rcx, 0xfe624e212ac18000
movabs rax, 0xcccccccccccccccd
add rcx, qword [rsp + 0x28]
mul rcx
movabs rax, 0x431bde82d7b634db
mov rcx, rbx
mov rdi, rdx
shr rdi, 3
mul rdi
mov rsi, rdx
shr rsi, 0x12
mov qword [rsp + 0x30], rsi
call qword [fcn.18000e000]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call rbx
mov r8d, 1
mov rbx, rax
movzx r9d, word [rax + 0xc]
lea eax, [r8 + r9]
cmp eax, 2
jb 0x18001e56d
cmp r9w, 0x1f
ja 0x18001e57d
movzx edx, word [rbx + 0x10]
add dx, r8w
movzx eax, dx
add eax, r8d
cmp eax, 2
jb 0x18001e58a
cmp dx, 0xc
ja 0x18001e596
movzx r10d, word [rbx + 0x14]
mov eax, 0x76c
add r10w, ax
movzx eax, r10w
add eax, r8d
cmp eax, 0x579
jb 0x18001e59f
mov eax, 0x2710
cmp r10w, ax
ja 0x18001e5b1
movzx r8d, dx
lea rcx, [rsp + 0x20]
movzx edx, r10w
call fcn.1800127fc
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
imul ecx, esi, 0xf4240
sub edi, ecx
mov ecx, dword [rbx + 8]
mov r9d, edi
call fcn.18001e97c
mov ecx, dword [rsp + 0x20]
lea r8, [rsp + 0x38]
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x20]
mov rcx, rbp
mov qword [rsp + 0x38], rax
call fcn.180020a30
mov rax, rbp
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800a6240
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
mov ecx, r8d
movzx edx, r9w
xor r8d, r8d
call fcn.180020af4
int3
mov ecx, r8d
movzx edx, r9w
call fcn.180020af4
int3
mov ecx, r8d
xor r8d, r8d
call fcn.180020aac
int3
mov ecx, r8d
call fcn.180020aac
int3
mov ecx, 0x578
xor r8d, r8d
movzx edx, r10w
call fcn.180020ad0
int3
mov ecx, 0x578
movzx edx, r10w
call fcn.180020ad0
int3