joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180004c10
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x18], 0x8a0a7fe1
xor ebx, dword [rbp - 0x18]
add edx, 0xc5e5d39a
ror ecx, 0xa
rol esi, 5
sub ecx, 0xd4b13230
sub ebx, 0x70ca4e02
add ebx, ecx
add ebx, edi
and ebx, 0x200000
je 0x18000a10e
rol edx, 0xe
sub esi, 0x155c950c
ror edx, 8
add ebx, edi
add ebx, esi
and ebx, 0x20000
je 0x1800081f5
xor edi, dword [rbp - 0x18]
sub ecx, 0x6ae96cce
rol edi, 2
rol eax, 7
add ebx, ecx
add ebx, esi
add ebx, edx
and ebx, 0x1000
je 0x180008b23
rol eax, 0x1e
sub edi, 0x327951a9
ror esi, 2
jmp 0x1800015d0
add dword [rbp - 0x18], 0x52e28e09
xor ebx, dword [rbp - 0x18]
ror esi, 0xd
xor edi, ebx
ror ebx, 0x15
add ebx, ecx
add ebx, esi
and ebx, 0x800000
je 0x180004631
rol edx, 0x1d
sub ebx, 0xffd0dd0d
rol ecx, 0x11
ror edi, 0xe
add edx, 0x8befcf9e
add ebx, eax
add ebx, edi
and ebx, 0x20000
je 0x180002536
ror ecx, 3
add eax, 0xea82fea8
rol edx, 4
ror edi, 3
add ecx, 0x6d1009e
add ebx, eax
add ebx, edi
and ebx, 0x800000
je 0x1800040ef
add esi, 0x46b63158
sub esi, 0x28bc4e3
rol edx, 0x1c
jmp 0x1800096e0
add byte [rcx], al
add byte [rax], al
je 0x180005b0f
xor edi, dword [rbp - 0x18]
add ebx, 0x4b5539c
add ecx, 0xc9cd6450
xor esi, eax
ror eax, 0xd
add ebx, eax
add ebx, esi
add ebx, ecx
and ebx, 0x20000000
je 0x18000416f
xor eax, 0x983e5baf
add edi, 0x21ebf22a
rol eax, 0xf
sub esi, 0x36b830a5
rol ebx, 3
add ebx, esi
add ebx, edx
add ebx, eax
and ebx, 0x40000000
je 0x18000a2de
rol eax, 0x1a
sub edx, 0x10e33a26
xor ebx, 0x5a7ab67c
jmp 0x180007dc0
mov rsp, rbp
mov esi, 0x97430ef0
mov edx, 0xe409cc50
mov edi, 0x8b0700b4
mov ebx, 0x58491bce
mov ecx, 0x59369e82
mov dword [rbp - 0x18], 0xe730aeb
sub rsp, 0x30
add dword [rbp - 8], 1
mov eax, dword [rbp - 8]
jmp 0x180004d98

Function at 0x180004cc4
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
add ebx, ecx
add ebx, edx
add ebx, eax
and ebx, 0x10000000
je 0x180001e5a
sub edx, 0x4d333c92

Function at 0x180004cdc
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
add edx, 0x8e051e0f
add ecx, 0x4c9c6891
xor edi, 0x6d8fae
add eax, 0x44705f5e
add ebx, edx
add ebx, eax
and ebx, 0x400000
je 0x18000390c
rol eax, 9
ror ebx, 0xa
rol ecx, 0xe
jmp 0x180001213

Function at 0x180004f84
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
add edx, 0xbd80850b
xor ecx, 0x4c5da14f
xor edx, 0xd637a5ee
add ebx, edx
add ebx, ecx
add ebx, eax
and ebx, 0x100
je 0x180007a0a
xor esi, 0xbabc39e0
rol ebx, 0x14
rol edx, 0xa
jmp 0x180006a72
Function at 0x1800059a0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
pop rdi
leave
add eax, 0x4c3a27ab
add ecx, 0x23e8d1a6
add ebx, eax
add ebx, edi
add ebx, edx
and ebx, 2
je 0x1800028c7
ror ebx, 5
ror ecx, 0xa
rol ebx, 7
add ebx, 0xfbc4edf8
jmp 0x180008545
Function at 0x1800061b4
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
je 0x180009130
rol edx, 0x1d
rol edx, 0x11
ror eax, 0xd
sub ecx, 0x642a6144
rol ebx, 2
add ebx, ecx
add ebx, edx
and ebx, 0x40
je 0x180007324
rol edx, 5
rol ebx, 0x1c
sub ecx, 0x587ab6c0
jmp 0x18000864b
mov edx, 0xe409cc50
mov ecx, 0x59369e82
mov esi, 0x97430ef0
mov rsp, rbp
sub rsp, 0x30
mov edi, 0x8b0700b4
mov ebx, 0x58491bce
inc dword [rbp - 8]
mov eax, dword [rbp - 8]
mov dword [rbp - 0x18], 0xe730aeb
jmp 0x180004d98

Function at 0x1800063f0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add ebx, edi
add ebx, esi
and ebx, 0x100000
je 0x18000a10e
xor edi, dword [rbp - 8]
sub esi, 0x12d45b17
rol eax, 0x16
sub edi, 0xbf74fdfd
jmp 0x180007f4c

Function at 0x180006884
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
mov edx, 0xe409cc50
mov esi, 0x97430ef0
mov ecx, 0x59369e82
mov rsp, rbp
mov edi, 0x8b0700b4
mov ebx, 0x58491bce
mov dword [rbp - 0x18], 0xe730aeb
sub rsp, 0x30
add dword [rbp - 8], 1
mov eax, dword [rbp - 8]
jmp 0x180004d98
test byte [rbp + 0x3a], dl
add byte [rax], al
add ebx, 0xdc60ddce
xor edi, dword [rbp - 0x18]
sub edx, 0xf695bfb5
add ebx, eax
add ebx, esi
and ebx, 0x100000
je 0x18000565b
sub esi, 0x47eda0e8
ror ecx, 8
xor esi, 0x297049ff
ror eax, 0x1e
add ebx, edx
add ebx, eax
and ebx, 0x200
je 0x1800096e0
xor eax, dword [rbp - 0x18]
ror edx, 0x1f
ror edi, 3
add edi, 0x52c6e8c3
xor ebx, edx
jmp 0x18000131d
Function at 0x1800089ac
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
je 0x18000615f
add eax, 0x2d512c23
ror edi, 2
ror edx, 2
rol esi, 7
add ecx, 0xa3d6a0f3
add ebx, edx
add ebx, edi
and ebx, 1
je 0x1800024a8
ror edi, 0xb
xor ebx, dword [rbp - 8]
xor ecx, edx
add ebx, edi
add ebx, ecx
add ebx, edx
and ebx, 0x200
je 0x180005387
rol edx, 4
sub ebx, 0x195ee2ee
sub edx, 0x5164e4af
add esi, 0xce4b1feb
jmp 0x180005a88

Function at 0x18000940c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x18], 0xe2fca380
xor ebx, dword [rbp - 0x18]
add esi, 0xe6394c62
sub ebx, 0x739543b7
ror edi, 0x16
rol esi, 0x13
sub ecx, 0xc184cf3
add ebx, ecx
add ebx, edx
and ebx, 0x8000000
je 0x18000340a
add esi, 0x1dc1dd6
rol ebx, 0x1b
add edi, 0x95c3e844
rol ecx, 0x12
rol eax, 6
add ebx, edi
add ebx, ecx
and ebx, 0x40000000
je section..text
add ebx, 0x52c59179
add esi, 0x88748ad
add edx, 0x2428402e
ror ebx, 0x1b
add ebx, ecx
add ebx, edx
and ebx, 0x200
je 0x180005b0f
add edi, 0xa9f5062f
sub edi, 0x653945b1
xor eax, ebx
sub eax, 0xc3f81637
ror ecx, 7
jmp 0x1800040ef
sub edi, 0xb350373e
xor edi, dword [rbp - 0x18]
rol esi, 2
sub ebx, 0x3d8e3be9
add ebx, ecx
add ebx, eax
and ebx, 1
je 0x18000704c
sub eax, 0xaed9aa5c
rol esi, 0xe
sub esi, 0xc25ac27e
rol eax, 9
xor ebx, 0x3a56ff08
add ebx, esi
add ebx, ecx
and ebx, 0x40000000
je 0x1800095dd
rol edx, 0x1a
sub edi, 0x12f8c53c
sub esi, 0x1aaa0e
add ebx, ecx
add ebx, esi
and ebx, 0x2000
je 0x1800052ef
xor ebx, dword [rbp - 8]
sub edx, 0x273c1f5b
rol eax, 0x1f
add edx, 0xdb08faa2
rol eax, 0x1f
jmp 0x180003e96

Function at 0x18000a164
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
sub edi, 0x754164db
rol ecx, 0x14
add ebx, 0xa3ae1c2f
add ebx, ecx
add ebx, esi
and ebx, 0x20000000
je 0x180003ae3
add edi, 0xef37c0ab
rol ebx, 0x18
sub esi, 0xa5aebde4
jmp 0x180001d1c

Function at 0x18000a600
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
pop rcx
mov dword [rbp - 0x18], 0xe730aeb
mov esi, 0x97430ef0
mov edi, 0x8b0700b4
mov ebx, 0x58491bce
add dword [rbp - 8], 1
mov eax, dword [rbp - 8]
mov edx, 0xe409cc50
jmp 0x180004d98

Function at 0x18000aa30
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
sub ecx, 0xa27a558d
add ebx, edi
add ebx, ecx
and ebx, 0x100
je 0x18000864b
add edi, 0xdf3b5b58
ror edi, 0xf
ror edx, 0xb
jmp 0x1800015d0
Function at 0x18000c668
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, qword [rdx + 0x10]
xor r12d, r12d
xor r10d, r10d
mov byte [r9], r12b
mov dword [rsp + 0x78], r10d
mov r14, r9
mov r15, r8
mov dword [r9 + 2], r12d
mov rbp, rdx
mov edi, ecx
mov esi, r12d
mov dword [r9 + 8], r12d
cmp word [r13], r12w
je 0x18000c6cb
mov rax, qword [r13 + 8]
mov ecx, r12d
cmp word [rax], 0x5c
mov eax, r12d
sete cl
cmp qword [rdx + 8], r12
sete al
cmp eax, ecx
jne 0x18001eaf6
mov eax, 0x300
and edi, eax
cmp edi, eax
je 0x18000c793
mov rcx, qword [rdx + 8]
test rcx, rcx
je 0x18000c78c
mov r9d, 4
lea rax, [rsp + 0x88]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 3]
call qword [sym.imp.ntdll.dll_NtQueryKey]
mov r10d, dword [rsp + 0x78]
mov ebx, eax
test eax, eax
js 0x18000c76a
and r10d, 0xf01
mov dword [rsp + 0x78], r10d
test eax, eax
js 0x18000c76a
test edi, edi
jne 0x18000c736
mov eax, 0x300
mov edi, r10d
and edi, eax
cmp edi, eax
je 0x18000c793
mov ecx, r10d
and ecx, 0x401
or ecx, edi
mov dword [r15], ecx
bt r10d, 0xa
jb 0x18000c757
cmp edi, 0x200
je 0x18001eb00
mov ebx, r12d
mov rax, qword [rsp + 0x90]
cmp ecx, r10d
setne cl
mov byte [rax], cl
mov rax, qword [rsp + 0x98]
mov qword [rax], rsi
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [r8], edi
mov ecx, edi
jmp 0x18000c74b
mov ebx, 0xc000000d
jmp 0x18000c76a
mov ebx, 0xc000003b
jmp 0x18000c76a
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, 0x1060
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
jne 0x18001eb2d
mov ebx, 0xc0000017
jmp 0x18000c76a
mov dword [rax], 0x8180000
lea rdi, [rsi + 0x10]
add rax, 0x20
mov word [rdi], r12w
mov qword [rsi + 8], rax
mov ecx, 0x818
lea rax, [rsi + 0x838]
mov word [rsi + 0x12], cx
mov qword [rsi + 0x18], rax
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x18001eb88
mov rdx, rsi
call fcn.18005c47c
mov ebx, eax
test eax, eax
js 0x18001ec02
lea rdx, [0x18006ff34]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
mov ebx, eax
test eax, eax
js 0x18001ec02
mov rdx, r13
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
mov ebx, eax
test eax, eax
js 0x18001ec02
call fcn.18005ca0c
mov word [rsp + 0x28], ax
lea rcx, [0x18006cf40]
mov r9, r14
mov dword [rsp + 0x20], 0x200
mov r8, rdi
mov rdx, rsi
call fcn.18005cdf0
mov ebx, eax
test eax, eax
js 0x18001ec02
mov ecx, dword [r14 + 8]
mov edx, 0x300
test edx, ecx
jne 0x18001ebe1
mov eax, dword [r15]
and eax, edx
or eax, ecx
mov ecx, eax
mov dword [r14 + 8], eax
mov r10d, dword [rsp + 0x78]
mov dword [r15], ecx
cmp byte [r14], r12b
je 0x18000c75a
mov qword [rbp + 8], r12
mov qword [rbp + 0x10], rdi
mov ecx, dword [r15]
jmp 0x18000c75a
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rsi, r12
jmp 0x18000c76a
Function at 0x18000d9e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
push rbx
push r13
push r14
sub rsp, 0x60
xor ebx, ebx
lea rax, [rcx - 1]
mov dword [rsp + 0x30], ebx
mov r13, r9
mov qword [r11 - 0x40], rbx
mov r14, rcx
cmp rax, 0xfffffffffffffffd
ja 0x18001f536
mov qword [r11 + 0x10], rbp
lea rcx, [r11 - 0x48]
mov ebp, dword [rsp + 0xb0]
test ebp, ebp
je 0x18000db49
call qword [sym.imp.ntdll.dll_RtlCreateUnicodeString]
movzx eax, al
mov qword [rsp + 0x50], rdi
test eax, eax
je 0x18001f52c
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x48], r12
mov r12, qword [rsp + 0xa8]
mov qword [rsp + 0x40], r15
mov r15d, dword [r12]
add r15d, 0x10
mov dword [rsp + 0x90], r15d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, r15d
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x18001f50e
lea rax, [rsp + 0x90]
mov r9, rsi
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov r8d, 2
mov dword [rsp + 0x20], r15d
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ecx, 0x80000000
mov edi, eax
add eax, ecx
test ecx, eax
jne 0x18000db54
cmp edi, 0x80000005
je 0x18000db54
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov r15, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
test edi, edi
je 0x18000db30
cmp edi, 0x80000005
je 0x18000dbf0
cmp edi, 0x102
je 0x18001f518
cmp edi, 0x3f
je 0x18000db30
lea eax, [rdi - 0x80]
cmp eax, 0x3f
jbe 0x18001f522
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ebx, eax
mov rdi, qword [rsp + 0x50]
mov eax, ebx
mov rbp, qword [rsp + 0x88]
add rsp, 0x60
pop r14
pop r13
pop rbx
ret
call qword [sym.imp.ntdll.dll_RtlCreateUnicodeStringFromAsciiz]
jmp 0x18000da2b
test r13, r13
je 0x18000db60
mov eax, dword [rsi + 4]
mov dword [r13], eax
mov edx, dword [rsi + 8]
mov dword [r12], edx
test edi, edi
js 0x18000dacb
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x18000dacb
test ebp, ebp
jne 0x18000dbcf
mov r8d, dword [rsi + 4]
lea eax, [r8 - 1]
cmp eax, 1
ja 0x18000dbfa
mov eax, dword [rsp + 0x90]
lea r9, [rsi + 0xc]
lea r8, [rsp + 0x80]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x80], ebx
call qword [sym.imp.ntdll.dll_RtlUnicodeToMultiByteN]
mov edi, eax
test eax, eax
js 0x18000dacb
mov eax, dword [rsp + 0x80]
mov dword [r12], eax
jmp 0x18000dacb
mov eax, dword [rsi + 8]
cmp eax, edx
ja 0x18000dc02
mov r8d, eax
lea rdx, [rsi + 0xc]
call sub.msvcrt.dll_memcpy
mov eax, dword [rsi + 8]
mov edi, ebx
mov dword [r12], eax
jmp 0x18000dacb
mov ebx, 0xea
jmp 0x18000db30
cmp r8d, 7
jne 0x18000dbcf
jmp 0x18000db91
mov edi, 0x80000005
jmp 0x18000dbc6
mov edi, 0xc0000017
jmp 0x18000dadf
mov ebx, 0x102
jmp 0x18000db30
mov ebx, 0x4c7
jmp 0x18000db30
mov edi, 0xc0000017
jmp 0x18000db26
mov eax, 6
jmp 0x18000db3f
Function at 0x18000e764
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x180093630]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor r12d, r12d
mov rsi, r9
mov r15, r8
mov dword [rsp + 0x28], r12d
mov dil, dl
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x30]
xor edx, edx
mov ebx, r12d
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov r14, rax
xor eax, eax
mov qword [rsi], rax
mov word [rsi + 8], ax
cmp r14, 0xffffffffffffffff
je 0x18000e7ed
test dil, dil
jne 0x18001fa8a
mov r8, r15
lea edx, [rax + 5]
mov rcx, rsi
lea ebx, [rax + 1]
call fcn.18000e694
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
neg ebx
sbb rax, rax
and rax, rsi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.180017170
add rsp, 0x2b0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov edi, 5
lea rcx, [rsp + 0x5c]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x18001fa98
cmp eax, 0xc
jne 0x18001fb33
xor eax, eax
lea r8, [rsp + 0x64]
mov rdx, rdi
mov qword [rbp + 0x180], rax
lea rcx, [rbp + 0x180]
mov word [rbp + 0x188], ax
mov qword [rbp + 0x190], rax
mov word [rbp + 0x198], ax
call fcn.18000e694
lea rcx, [rbp + 0x180]
call fcn.180006144
test eax, eax
je 0x18001fb33
and eax, 0x3ff
lea r8, [rbp + 0x190]
mov ecx, eax
mov r9d, edi
mov dl, 1
call fcn.18004bb0c
mov rdx, r15
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNELBASE.dll_lstrcmpiW]
test eax, eax
jne 0x18001fb30
lea r8, [rbp + 0x180]
mov rdx, rdi
mov rcx, rsi
lea ebx, [rax + 1]
call fcn.18000e694
jmp 0x18001fb33
mov ebx, r12d
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18001fa8f
jmp 0x18000e7e4
Function at 0x1800100a4
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x180093630]
xor rax, rsp
mov qword [rsp + 0x260], rax
and dword [rsp + 0x30], 0
lea r8, [0x18005e170]
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x38]
mov edx, 1
call qword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
js 0x180010129
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
mov r8d, 2
mov dword [rsp + 0x20], 0x218
lea rdx, [0x18005e160]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x180020932
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180017170
add rsp, 0x270
pop rbx
ret
cmp dword [rsp + 0x44], 4
jne 0x180010129
cmp dword [rsp + 0x48], 4
jne 0x180010129
mov eax, dword [rsp + 0x4c]
jmp 0x18001012b
Function at 0x1800124b0
Capabilities:
Get hostname

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x268
mov rax, qword [0x180093630]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r14, qword [rsp + 0x2d0]
mov rbp, r9
mov r15, qword [rsp + 0x2d8]
mov rsi, r8
mov rbx, qword [rsp + 0x2e0]
mov rdi, rdx
mov dword [rsp + 0x40], 0x100
mov r12, rcx
mov r13, rcx
test rcx, rcx
jne 0x1800220fc
mov qword [rsp + 0x28], rbx
mov r9, r14
mov r8, rbp
mov qword [rsp + 0x20], r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.api_ms_win_security_lsalookup_l1_1_0.dll_LookupAccountSidLocalW]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180017170
add rsp, 0x268
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
movzx ecx, word [rcx]
test cx, cx
je 0x18001250e
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], 0
jne 0x18002210c
cmp rax, 2
jbe 0x180022130
cmp cx, 0x5c
jne 0x180022130
cmp word [r12 + 2], cx
jne 0x180022130
lea r13, [r12 + 4]
lea r8, [rsp + 0x40]
xor ecx, ecx
lea rdx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetComputerNameExW]
test eax, eax
je 0x180022193
mov rdx, r13
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x18001250e
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], 0x100
lea rdx, [rsp + 0x50]
mov ecx, 3
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetComputerNameExW]
test eax, eax
je 0x180022193
mov rdx, r13
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x18001250e
mov dword [rsp + 0x38], 1
mov r9, rbp
mov qword [rsp + 0x30], rbx
mov r8, rsi
mov qword [rsp + 0x28], r15
mov rdx, rdi
mov rcx, r12
mov qword [rsp + 0x20], r14
call fcn.18003c0fc
nop
jmp 0x18001252a

Function at 0x1800127b0
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
sub rsp, 0x48
cmp rcx, 0xffffffff80000004
je 0x1800127e5
xor eax, eax
lea r9, [r11 + 0x20]
mov qword [r11 - 0x10], rax
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
add rsp, 0x48
ret
mov eax, 6
jmp 0x1800127e0

Function at 0x180012800
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x48
mov rax, qword [rsp + 0x88]
mov qword [r11 - 0x10], rax
mov rax, qword [rsp + 0x80]
mov qword [r11 - 0x18], rax
mov rax, qword [rsp + 0x78]
mov qword [r11 - 0x20], rax
mov rax, qword [rsp + 0x70]
mov qword [r11 - 0x28], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
add rsp, 0x48
ret

Function at 0x180012900
Capabilities:
Get session user name

Disassembly:
sub rsp, 0x28
mov r8, rdx
mov rdx, rcx
mov ecx, 0x10002
call qword [sym.imp.SspiCli.dll_GetUserNameExW]
movzx eax, al
add rsp, 0x28
ret
Function at 0x180012980
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x18], 0xff7c023d
xor ebx, dword [rbp - 0x18]
add eax, 0x373908ef
ror eax, 0x15
rol eax, 6
add ebx, edi
add ebx, esi
and ebx, 2
je 0x180006f3d
sub ecx, 0xbb7bde6a
rol ebx, 0x1d
sub ecx, 0x51096b16
ror esi, 0x12
add ebx, ecx
add ebx, eax
add ebx, esi
and ebx, 0x10000000
add byte [rax], al
adc byte [rdi], cl
test cl, bh
mov es, word [rax]
invalid
xor ebx, dword [rbp - 8]
xor edx, dword [rbp - 0x18]
rol edx, 7
sub edx, 0x1f03a34f
add ebx, edx
add ebx, edi
and ebx, 0x40000
je 0x180008545
rol eax, 0xb
add ebx, 0x1e0a71fd
ror esi, 0x1d
sub eax, 0x2553e2ae
jmp 0x180003e96
add dword [rbp - 0x18], 0x745f2663
xor ebx, dword [rbp - 0x18]
add edi, 0xcbd015e5
sub eax, 0x93fbf6ea
ror edx, 0x13
ror edi, 0x1a
sub edi, 0x3390313d
add ebx, edx
add ebx, eax
and ebx, 0x2000
je 0x180004488
rol edx, 2
rol edi, 0x1d
xor esi, dword [rbp - 0x18]
xor edi, 0xbb272ee8
ror eax, 0x16
add ebx, esi
add ebx, ecx
add ebx, edx
and ebx, 0x200000
je 0x1800037fd
rol ecx, 0xa
ror edi, 0xf
sub eax, 0x5a6135e1
rol ebx, 8
xor ebx, 0xa330955
add ebx, edx
add ebx, edi
and ebx, 0x100
je 0x180006a72
rol edx, 0xa
sub ebx, 0xbcb4e596
add esi, 0xfe34b0ef
jmp 0x18000139e
add dword [rbp - 0x18], 0xbc42512f
xor ebx, dword [rbp - 0x18]
sub edx, 0x50756930
rol edx, 2
rol esi, 0x1d
add ebx, edi
add ebx, ecx
and ebx, 0x100000
je 0x180007a0a
sub ecx, 0xc11be299
xor edi, ebx
sub edx, 0x24a491
add ebx, edi
add ebx, esi
and ebx, 0x100
je 0x180003ae3
ror ebx, 6
add ecx, 0xb6a38c50
rol edx, 0x19
add edx, 0x882de609
add esi, 0x3bf865b0
add ebx, esi
add ebx, eax
and ebx, 2
je 0x180008ba5
ror ecx, 0x13
sub edx, 0xa25607a1
ror ecx, 0xe
sub eax, 0x9bb3f180
sub esi, 0xe35ed48a
jmp 0x180004488
add dword [rbp - 0x18], 0x1bc9239e
xor ebx, dword [rbp - 0x18]
ror ebx, 0x12
ror edx, 0x18
rol eax, 0xe
xor esi, dword [rbp - 8]
sub esi, 0x903b5f69
nop
push rbp
mov rbp, rsp
sub rsp, 0x30
invalid
clc
invalid
push rbp