joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001140
Capabilities:
Parse pe header
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0xc8
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
cmp word [0x140000000], 0x5a4d
je 0x14000117d
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
lea rdi, [0x140000000]
jmp 0x14000120b
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x1400011a1
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x14000120b
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x1400011e8
cmp ecx, 0x20b
je 0x1400011c0
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x14000120b
cmp dword [rax + 0x84], 0xe
ja 0x1400011d4
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x14000120b
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
jmp 0x14000120b
cmp dword [rax + 0x74], 0xe
ja 0x1400011f9
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x14000120b
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
mov ecx, 2
call qword [sym.imp.msvcrt.dll___set_app_type]
mov qword [0x1400302a8], 0xffffffffffffffff
mov qword [0x1400302b0], 0xffffffffffffffff
mov rcx, qword [sym.imp.msvcrt.dll__fmode]
mov eax, dword [0x14002f26c]
mov dword [rcx], eax
mov rcx, qword [sym.imp.msvcrt.dll__commode]
mov eax, dword [0x14002f268]
mov dword [rcx], eax
call fcn.140001000
cmp dword [section..data], 0
jne 0x140001265
lea rcx, [fcn.140001000]
call qword [sym.imp.msvcrt.dll___setusermatherr]
lea rdx, [0x140027890]
lea rcx, [0x140027888]
call sub.msvcrt.dll__initterm
mov r11d, dword [0x14002f264]
mov dword [rsp + 0xd8], r11d
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x14002f260]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3c]
call qword [sym.imp.msvcrt.dll___getmainargs]
lea rdx, [0x140027880]
lea rcx, [0x140027828]
call sub.msvcrt.dll__initterm
mov r11, qword [sym.imp.msvcrt.dll__acmdln]
mov r8, qword [r11]
mov qword [rsp + 0x30], r8
cmp byte [r8], 0x22
jne 0x140001306
nop
nop
inc r8
mov qword [rsp + 0x30], r8
movzx eax, byte [r8]
test al, al
je 0x1400012f6
cmp al, 0x22
je 0x1400012f6
jmp 0x1400012e0
cmp byte [r8], 0x22
jne 0x140001316
inc r8
mov qword [rsp + 0x30], r8
jmp 0x140001316
cmp byte [r8], 0x20
jbe 0x140001316
inc r8
mov qword [rsp + 0x30], r8
jmp 0x140001306
movzx eax, byte [r8]
test al, al
je 0x14000132c
cmp al, 0x20
ja 0x14000132c
inc r8
mov qword [rsp + 0x30], r8
jmp 0x140001316
test byte [rsp + 0x8c], 1
je 0x140001341
movzx r9d, word [rsp + 0x90]
jmp 0x140001347
mov r9d, 0xa
xor edx, edx
mov rcx, rdi
call fcn.140013d50
mov edi, eax
mov dword [rsp + 0x38], eax
test ebx, ebx
jne 0x140001363
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
call qword [sym.imp.msvcrt.dll__cexit]
jmp 0x140001387
mov eax, edi
jmp 0x140001390
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
add rsp, 0xc8
ret
Function at 0x1400043e0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x370
mov rsi, rcx
mov rdi, r8
mov rbx, rdx
lea rcx, [rsp + 0x271]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x270], 0
call sub.msvcrt.dll_memset
lea rdx, str._sRegistration
lea rcx, [rsp + 0x270]
xor ebp, ebp
mov r8, rdi
mov qword [rsp + 0x40], rbp
call sub.msvcrt.dll_sprintf
lea r11, [rsp + 0x40]
lea rdx, [rsp + 0x270]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140004632
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x60], bpl
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400044fb
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x398]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, str.InstallDir
xor r8d, r8d
mov dword [rsp + 0x398], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400044f0
mov eax, dword [rsp + 0x398]
add eax, 0xffffffff
mov byte [rsp + rax + 0x60], bpl
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x40]
lea r9, [rsp + 0x60]
mov r8, rdi
mov rcx, rsi
call fcn.140003fc0
lea rcx, [rsp + 0x171]
mov ebx, ebp
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x170], bl
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x398]
lea r8, [rsp + 0x170]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x398], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140004627
nop
nop
nop
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x398]
lea rdx, [rsp + 0x170]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x398], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400045db
mov rdx, qword [rsp + 0x398]
lea r9, [rsp + 0x60]
mov r8, rdi
mov rcx, rsi
call fcn.140003fc0
mov rcx, qword [rsp + 0x398]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
add ebx, 1
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x398]
lea r8, [rsp + 0x170]
mov edx, ebx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x398], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x140004580
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140004be0
Capabilities:
Reference sql statements

Disassembly:
push rbx
mov eax, 0x1e40
call fcn.1400261c0
sub rsp, rax
mov rax, qword [0x14002fec0]
mov rbx, rcx
cmp dword [rax + 0x598], 0
je 0x140004d98
test rdx, rdx
mov word [rsp + 0x1240], 0
mov word [rsp + 0x1440], 0
mov word [rsp + 0x30], 0
mov word [rsp + 0x830], 0
mov dword [rsp + 0x1030], 1
mov dword [rsp + 0x1034], 0x3a98
mov word [rsp + 0x103c], 0
mov dword [rsp + 0x123c], 0
je 0x140004c84
lea rcx, [rsp + 0x103c]
mov dword [rsp + 0x1038], 2
sub rcx, rdx
movzx eax, word [rdx]
add rdx, 2
test ax, ax
mov word [rcx + rdx - 2], ax
jne 0x140004c71
jmp 0x140004c8f
mov dword [rsp + 0x1038], 1
lea rcx, [rsp + 0x1642]
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x1640], 0
call sub.msvcrt.dll_memset
xor r11d, r11d
lea rcx, str.rootCIMV2
nop
nop
movzx eax, word [r11 + rcx]
add r11, 2
test ax, ax
mov word [rsp + r11 + 0x2e], ax
jne 0x140004cc0
cmp dword [rsp + 0x1038], 1
je 0x140004d46
movzx eax, word [rsp + 0x103c]
test ax, ax
je 0x140004d46
cmp word [rsp + 0x30], 0x5c
jne 0x140004cfb
cmp word [rsp + 0x32], 0x5c
je 0x140004d46
cmp ax, 0x5c
lea r9, [rsp + 0x103c]
jne 0x140004d21
cmp word [rsp + 0x103e], 0x5c
lea rax, [rsp + 0x1040]
cmovne rax, r9
mov r9, rax
lea rax, [rsp + 0x30]
lea r8, str._s_s
lea rcx, [rsp + 0x1640]
mov edx, 0x3ff
mov qword [rsp + 0x20], rax
call sub.msvcrt.dll__snwprintf
jmp 0x140004d66
xor ecx, ecx
nop
nop
movzx eax, word [rsp + rcx + 0x30]
add rcx, 2
test ax, ax
mov word [rsp + rcx + 0x163e], ax
jne 0x140004d50
lea rcx, [rbx + 0x270]
lea r8, str.SELECT__FROM_SoftwareLicensingProduct_WHERE_PartialProductKey_IS_NOT_NULL
lea rdx, [rsp + 0x1640]
mov r9d, 2
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x7530
call fcn.140009020
add rsp, 0x1e40
pop rbx
ret
Function at 0x140005480
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x150
mov rdi, rcx
lea rcx, [r11 + 0x20]
mov rax, rdx
mov qword [rsp + 0x20], rcx
lea rdx, str.MicrosoftVisualStudio
xor esi, esi
mov rcx, rax
mov r9d, 0x20019
xor r8d, r8d
mov qword [r11 + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400055a3
mov qword [rsp + 0x160], rbx
lea rcx, [rsp + 0x51]
mov ebx, esi
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x50], bl
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x178]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x170]
lea r8, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x170], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14000558d
nop
nop
mov rdx, qword [rsp + 0x178]
lea r8, [rsp + 0x50]
mov rcx, rdi
call fcn.1400043e0
mov rcx, qword [rsp + 0x178]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
add ebx, 1
lea r9, [rsp + 0x170]
lea r8, [rsp + 0x50]
mov edx, ebx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x170], 0xff
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x140005530
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x140005630
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r14
sub rsp, 0x6c0
mov r12, rcx
mov rbx, r8
mov rbp, rdx
lea rcx, [rsp + 0x71]
xor edx, edx
mov r8d, 0x101
mov dword [rsp + 0x60], 0xff
mov byte [rsp + 0x70], 0
call sub.msvcrt.dll_memset
xor r14d, r14d
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x2b0]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x64]
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov dword [rsp + 0x64], r14d
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x68], 0x3ff
mov esi, r14d
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x14000580f
mov qword [rsp + 0x6e0], rdi
mov qword [rsp + 0x6e8], r13
lea r13, [0x140027e59]
nop
nop
lea rdx, str.productid
lea rcx, [rsp + 0x70]
mov r8d, 9
call sub.msvcrt.dll__strnicmp
test eax, eax
jne 0x1400057b9
lea rcx, [rsp + 0x181]
xor edx, edx
mov r8d, 0x12b
call sub.msvcrt.dll_memset
mov rax, qword [str.DigitalProductID]
lea rdx, [rsp + 0x180]
mov qword [rdx], rax
mov rax, qword [0x140028f98]
or rcx, 0xffffffffffffffff
mov qword [rdx + 8], rax
movzx eax, byte [0x140028fa0]
lea rdi, [rsp + 0x180]
mov byte [rdx + 0x10], al
xor eax, eax
lea rdx, [rsp + 0x79]
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x140005760
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x180]
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
mov r8, rbx
mov rdx, rbp
mov rcx, r12
mov qword [rsp + 0x20], rbx
call fcn.140004660
lea rax, [rsp + 0x68]
add esi, 1
lea r9, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x2b0]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x64]
mov edx, esi
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x1400056e0
mov r13, qword [rsp + 0x6e8]
mov rdi, qword [rsp + 0x6e0]
lea r11, [rsp + 0x6c0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rsi
ret
Function at 0x1400062f0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x3b0
mov rbp, rcx
mov rax, rdx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
lea rdx, str.MicrosoftOffice
mov r9d, 0x20019
mov rcx, rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140006582
mov qword [rsp + 0x3a8], rdi
mov qword [rsp + 0x3a0], r12
xor r12d, r12d
lea rcx, [rsp + 0x61]
mov edi, r12d
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x60], dil
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x3d0]
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x3d0], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140006567
mov qword [rsp + 0x3c0], rbx
mov qword [rsp + 0x3c8], rsi
nop
mov rsi, qword [rsp + 0x40]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_atof
cvttsd2si ebx, xmm0
cmp ebx, 8
jle 0x14000650e
lea rcx, [rsp + 0x161]
xor edx, edx
mov r8d, 0x12b
mov byte [rsp + 0x160], r12b
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x291]
xor edx, edx
mov r8d, 0x105
mov byte [rsp + 0x290], r12b
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x60]
lea rdx, str._sCommonInstallRoot
lea rcx, [rsp + 0x160]
call sub.msvcrt.dll_sprintf
lea r11, [rsp + 0x48]
lea rdx, [rsp + 0x160]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400064aa
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x3d0]
lea r9, [rsp + 0x3d8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x290]
lea rdx, str.Path
xor r8d, r8d
mov dword [rsp + 0x3d0], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000649f
mov eax, dword [rsp + 0x3d0]
add eax, 0xffffffff
mov byte [rsp + rax + 0x290], r12b
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0x60]
lea rdx, str._sRegistration
lea rcx, [rsp + 0x160]
call sub.msvcrt.dll_sprintf
lea r11, [rsp + 0x50]
lea rdx, [rsp + 0x160]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000650e
mov rdx, qword [rsp + 0x50]
lea r9, [rsp + 0x290]
mov r8d, ebx
mov rcx, rbp
call fcn.140005830
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
add edi, 1
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x3d0]
lea r8, [rsp + 0x60]
mov edx, edi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x3d0], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1400063b0
mov rsi, qword [rsp + 0x3c8]
mov rbx, qword [rsp + 0x3c0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, qword [rsp + 0x3a0]
mov rdi, qword [rsp + 0x3a8]
add rsp, 0x3b0
pop rbp
ret
Function at 0x1400065a0
Capabilities:
Query or enumerate registry key

Disassembly:
push rdi
sub rsp, 0x150
mov rdi, rcx
mov rax, rdx
lea rcx, [rsp + 0x178]
mov qword [rsp + 0x20], rcx
lea rdx, str.MicrosoftMicrosoft_SQL_Server
mov r9d, 0x20019
mov rcx, rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400066cb
mov qword [rsp + 0x160], rbx
mov qword [rsp + 0x168], rsi
xor esi, esi
lea rcx, [rsp + 0x51]
mov ebx, esi
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x50], bl
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x178]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x170]
lea r8, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x170], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1400066ad
nop
mov rdx, qword [rsp + 0x178]
lea r8, [rsp + 0x50]
mov rcx, rdi
call fcn.140005e30
mov rcx, qword [rsp + 0x178]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
add ebx, 1
lea r9, [rsp + 0x170]
lea r8, [rsp + 0x50]
mov edx, ebx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x170], 0xff
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x140006650
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x168]
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
Function at 0x140006fd0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rsi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x141]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x140], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x30], 0
call sub.msvcrt.dll_memset
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
xor ebp, ebp
mov r12d, 0x103
repne scasb al, byte [rdi]
mov rdx, rbx
not rcx
sub rcx, 1
cmp ecx, 0x104
cmovge ecx, r12d
movsxd rdi, ecx
lea rcx, [rsp + 0x30]
mov r8, rdi
call sub.msvcrt.dll_memcpy
lea edx, [rbp + 0x5c]
lea rcx, [rsp + 0x30]
mov byte [rsp + rdi + 0x30], bpl
call sub.msvcrt.dll_strrchr
test rax, rax
je 0x1400070cb
lea edx, [rbp + 0x5c]
lea rcx, [rsp + 0x30]
mov byte [rax], bpl
call sub.msvcrt.dll_strrchr
test rax, rax
je 0x1400070cb
or rcx, 0xffffffffffffffff
mov byte [rax], bpl
xor eax, eax
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp ecx, 0x104
cmovge ecx, r12d
movsxd rdi, ecx
lea rcx, [rsp + 0x140]
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov byte [rsp + rdi + 0x140], bpl
lea rbp, [rsp + 0x140]
lea rcx, [rsi + 0xc78]
lea rdx, [rsp + 0x270]
mov dword [rsp + 0x270], 0x104
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
cmp dword [0x14002fa84], 0
jne 0x14000710b
lea rcx, [0x14002fa80]
mov dword [0x14002fa80], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [0x14002fa90], 2
jne 0x140007147
lea rdx, str.SeRestorePrivilege
lea rcx, [rsp + 0x270]
mov qword [rsp + 0x270], 0
call fcn.14000ccc0
mov rcx, qword [rsp + 0x270]
test rcx, rcx
je 0x140007147
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rdx, str.__PRODUCKEY_TEMP_HIVE__
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyA]
lea rdx, str.__PRODUCKEY_TEMP_HIVE__
mov r8, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyA]
test eax, eax
jne 0x140007236
lea rax, [rsp + 0x280]
lea rdx, str.__PRODUCKEY_TEMP_HIVE__
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov ebx, eax
jne 0x140007220
mov rdi, qword [rsp + 0x280]
xor r9d, r9d
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call fcn.1400066e0
lea r11, [rsp + 0x270]
lea rdx, str.Wow6432Node
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140007212
mov rdx, qword [rsp + 0x270]
lea r9d, [rbx + 1]
mov r8, rbp
mov rcx, rsi
call fcn.1400066e0
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.__PRODUCKEY_TEMP_HIVE__
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyA]
mov eax, ebx
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140007ed0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x135
mov byte [rsp + 0x20], 0
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x20]
sub rdx, rdi
nop
nop
nop
nop
movzx eax, byte [rdi]
add rdi, 1
test al, al
mov byte [rdx + rdi - 1], al
jne 0x140007f10
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
test ecx, ecx
jle 0x140007f59
movsxd rax, ecx
cmp byte [rsp + rax + 0x1f], 0x5c
je 0x140007f59
xor eax, eax
lea rdi, [rsp + 0x20]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x140027f78]
mov word [rdi - 1], ax
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
mov rax, qword [str.system32config_software]
lea rcx, [rsp + 0x20]
mov qword [rdi - 1], rax
mov rax, qword [0x140029420]
mov qword [rdi + 7], rax
mov rax, qword [0x140029428]
mov qword [rdi + 0xf], rax
movzx eax, byte [0x140029430]
mov byte [rdi + 0x17], al
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140007fbf
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140006fd0
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x1400081d0
Capabilities:
Enumerate network shares

Disassembly:
push rbx
push rbp
sub rsp, 0x48
mov rbp, rcx
mov rbx, rdx
lea rcx, [0x14002fed0]
mov edx, 0xa
call fcn.14001bf40
mov rcx, qword [rbp + 0xd90]
xor r8d, r8d
mov r9, rax
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageA]
xor edx, edx
lea r11, [rsp + 0x30]
lea ecx, [rdx + 2]
mov r9, rbx
xor r8d, r8d
mov qword [rsp + 0x20], r11
call sub.MPR.dll_WNetOpenEnumA
test eax, eax
jne 0x140008377
lea edx, [rax + 0xa]
lea rcx, [0x14002fed0]
mov dword [rsp + 0x70], 0xffffffff
mov dword [rsp + 0x78], 1
call fcn.14001bf40
mov rcx, qword [rbp + 0xd90]
mov r9, rax
xor r8d, r8d
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
call sub.MPR.dll_WNetEnumResourceA
mov r11d, dword [rsp + 0x78]
cmp r11d, 1
jbe 0x14000836d
mov qword [rsp + 0x68], rsi
add r11d, 0x1000
mov qword [rsp + 0x40], rdi
xor edi, edi
cmp r11d, 0xffffffff
mov dword [rsp + 0x78], r11d
mov rsi, rdi
mov eax, edi
jne 0x1400082b3
xor ecx, ecx
call sub.msvcrt.dll_free
jmp 0x1400082dd
test r11d, r11d
js 0x1400082dd
nop
nop
add eax, 0x100
cmp r11d, eax
jge 0x1400082c0
movsxd rcx, eax
call sub.msvcrt.dll_malloc
test rax, rax
mov rsi, rax
je 0x1400082dd
mov byte [rax], dil
mov rcx, qword [rsp + 0x30]
lea rbx, [0x140027e59]
test rsi, rsi
mov r8, rbx
lea r9, [rsp + 0x78]
lea rdx, [rsp + 0x70]
cmovne r8, rsi
mov dword [rsp + 0x70], 0xffffffff
call sub.MPR.dll_WNetEnumResourceA
test eax, eax
jne 0x140008356
test rsi, rsi
cmovne rbx, rsi
cmp dword [rsp + 0x70], edi
jbe 0x140008356
add rbx, 0x18
nop
lea rdx, [rbx - 0x18]
test rdx, rdx
je 0x140008349
cmp dword [rbx - 0x10], 1
jne 0x140008341
mov rdx, qword [rbx]
test rdx, rdx
je 0x140008349
mov rcx, rbp
call fcn.140007560
jmp 0x140008349
mov rcx, rbp
call fcn.1400081d0
add edi, 1
add rbx, 0x30
cmp edi, dword [rsp + 0x70]
jb 0x140008320
test rsi, rsi
mov rdi, qword [rsp + 0x40]
je 0x140008368
mov rcx, rsi
call sub.msvcrt.dll_free
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x30]
call sub.MPR.dll_WNetCloseEnum
xor eax, eax
add rsp, 0x48
pop rbp
pop rbx
ret