joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180035fa4
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get common file path
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xae8
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov rsi, qword [rsp + 0xb30]
mov rdi, rcx
mov rcx, qword [rsp + 0xb38]
mov qword [rsp + 0x40], rcx
xor ecx, ecx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x48], r8
mov dword [rsp + 0x30], edx
cmp r8, rcx
jne 0x180035ff8
cmp rsi, rcx
je 0x1800361b1
cmp word [rdi + 2], 0x3a
je 0x18003604f
cmp word [rdi + 2], 0x5c
je 0x18003604f
mov word [rsp + 0x6c0], cx
lea rcx, [rsp + 0x6c2]
xor edx, edx
mov r8d, 0x40e
call fcn.1800413a0
lea rdx, [rsp + 0x6c0]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rsp + 0x6c0]
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdi, [rsp + 0x6c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800361b1
test al, 0x10
je 0x1800361b1
lea rcx, [rsp + 0x4b0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x18005d3f4]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1800361b1
mov ebx, 1
lea rdx, [0x18005e498]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x180036188
lea rdx, [0x18005d8e4]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x180036188
cmp dword [rsp + 0x50], 0xffffffff
je 0x180036188
lea rcx, [rsp + 0x2a0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test byte [rsp + 0x50], 0x10
je 0x18003616b
test rsi, rsi
je 0x180036136
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x2a0]
call rsi
test eax, eax
je 0x18003619f
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x180036188
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x38]
mov r8, qword [rsp + 0x48]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x2a0]
mov edx, eax
mov qword [rsp + 0x20], rsi
call fcn.180035fa4
cmp eax, 2
jmp 0x180036186
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x180036188
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x2a0]
call rax
test eax, eax
je 0x18003619f
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1800361a4
jmp 0x1800360b4
mov ebx, 2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
jmp 0x1800361b3
xor eax, eax
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.18003c180
add rsp, 0xae8
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800361d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jge 0x1800362d5
lea rcx, [rsp + 0x42]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], di
call fcn.1800413a0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180036bc0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180036246
shr eax, 4
not eax
and eax, 1
jmp 0x1800362d7
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x250]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rsp + 0x250]
call fcn.1800362f8
cmp eax, edi
je 0x1800362d5
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, rdi
je 0x1800362b3
mov ecx, 1
cmp rax, 0xffffffffffffffff
jne 0x1800362b5
mov ecx, edi
cmp cl, dil
mov ebx, edi
setne bl
cmp rax, 0xffffffffffffffff
je 0x1800362d1
cmp rax, rdi
je 0x1800362d1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x1800362d7
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18003c180
mov rbx, qword [rsp + 0x488]
add rsp, 0x470
pop rdi
ret
Function at 0x180036b30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x21]
xor ebx, ebx
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], bl
call fcn.1800413a0
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.180036a2c
mov r11d, 0x179b06cc
movzx edx, byte [rsp + rbx + 0x20]
movzx eax, r11b
mov ecx, r11d
xor rdx, rax
shr ecx, 8
lea rax, [0x180077e40]
mov r11d, dword [rax + rdx*4]
inc rbx
xor r11d, ecx
cmp rbx, 0x24
jl 0x180036b78
not r11d
mov eax, r11d
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18003c180
add rsp, 0x140
pop rbx
ret

Function at 0x180036cac
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor r12d, r12d
mov rsi, rdx
mov rdi, rcx
cmp rdx, r12
je 0x180036d8e
lea rdx, str.deviceMup_
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp rax, rdi
jne 0x180036d17
lea r8, [0x180060584]
lea rdx, str.deviceMup_
mov r9, rsi
mov rcx, rdi
call fcn.180037ee4
mov eax, 1
jmp 0x180036d90
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, r12d
mov ebp, eax
bt ebp, ebx
jae 0x180036d87
lea ecx, [rbx + 0x61]
mov eax, 0x3a
xor edx, edx
mov word [rsp + 0x20], cx
mov word [rsp + 0x22], ax
xor eax, eax
lea rcx, [rsp + 0x32]
mov r8d, 0x206
mov word [rsp + 0x30], r12w
mov dword [rsp + 0x24], eax
call fcn.1800413a0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
cmp eax, r12d
jbe 0x180036d87
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov rcx, rdi
call fcn.180038010
cmp eax, r12d
jne 0x180036db8
inc ebx
cmp ebx, 0x1a
jl 0x180036d22
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18003c180
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
jmp 0x180036d05

Function at 0x1800372b0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov ebx, ecx
mov rdi, rdx
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x434
call fcn.1800413a0
mov edx, ebx
mov ecx, 8
mov dword [rsp + 0x20], 0x438
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
test rax, rax
je 0x180037339
cmp rax, 0xffffffffffffffff
je 0x18003734d
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Module32FirstW
jmp 0x180037335
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.18003795c
test eax, eax
je 0x180037339
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x180037317
cmp rbx, 0xffffffffffffffff
je 0x18003734d
test rbx, rbx
je 0x18003734d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18003c180
mov rbx, qword [rsp + 0x490]
add rsp, 0x470
pop rdi
ret
Function at 0x180037370
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rdx
mov rdi, rcx
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x18003740b
cmp rax, 0xffffffffffffffff
je 0x18003740b
mov dword [rsp + 0x30], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x34]
call fcn.1800413a0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x18003740b
mov rdx, rsi
lea rcx, [rsp + 0x30]
call rdi
test eax, eax
je 0x18003740b
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1800373ec
cmp rbx, 0xffffffffffffffff
je 0x18003741f
test rbx, rbx
je 0x18003741f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.18003c180
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x180037444
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xe0
xor ebx, ebx
mov rdi, rcx
cmp rcx, rbx
jne 0x180037462
xor eax, eax
jmp 0x1800374ec
xor edx, edx
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x70], 0x68
lea r8d, [rdx + 0x60]
call fcn.1800413a0
xor eax, eax
mov rcx, rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
call fcn.180035f58
xor r9d, r9d
xor r8d, r8d
mov rdi, rax
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rdx, rdi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebx
je 0x1800374e1
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.18003cea0
mov rax, rbx
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rdi
ret
Function at 0x1800376f8
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, rdx
mov r8d, ecx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edi, edi
mov rbx, rax
cmp rax, rdi
je 0x18003778c
cmp rax, 0xffffffffffffffff
je 0x1800377a0
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.1800413a0
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rbx
call sub.PSAPI.DLL_GetProcessImageFileNameW
cmp eax, edi
jbe 0x18003777f
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.180036cac
mov edi, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x1800377a2
cmp rax, 0xffffffffffffffff
je 0x1800377a0
cmp rax, rdi
je 0x1800377a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18003c180
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1800377c8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebx, eax
jne 0x1800377e7
mov eax, 1
jmp 0x18003782a
xor edx, edx
mov r8d, ebx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x180037812
cmp rax, 0xffffffffffffffff
je 0x180037812
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, eax
jmp 0x180037814
xor edi, edi
cmp rbx, 0xffffffffffffffff
je 0x180037828
test rbx, rbx
je 0x180037828
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180038234
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
sub rsp, 0x38
lea rax, [r11 + 0x20]
mov r9d, 4
lea r8, str.NacSafeCheck
mov dword [r11 - 0x10], r9d
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
mov qword [r11 - 0x18], rax
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor ecx, ecx
cmp eax, ecx
sete cl
mov eax, ecx
add rsp, 0x38
ret

Function at 0x18003827c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor ebx, ebx
mov rdi, r9
mov rbp, r8
mov rsi, rdx
cmp r9, rbx
je 0x1800382b2
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x1800382b4
mov eax, ebx
lea ecx, [rax + rax + 2]
mov r9d, 1
mov r8, rbp
mov dword [rsp + 0x28], ecx
mov rcx, 0xffffffff80000002
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp eax, ebx
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18003c180
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800382fc
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x860
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rbp, r9
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor r12d, r12d
mov dword [rsp + 0x38], r12d
mov qword [rcx + 0x20], 7
mov qword [rcx + 0x18], r12
mov word [rcx + 8], r12w
mov dword [rsp + 0x38], 1
mov rsi, r12
cmp r8, r12
je 0x180038475
mov word [rsp + 0x50], r12w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0x52]
call fcn.1800413a0
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x34], r12d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x34]
mov r8, rbp
mov rdx, rdi
mov r13, 0xffffffff80000002
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [rsp + 0x34], 1
je 0x1800383c5
cmp dword [rsp + 0x34], 2
jne 0x180038475
mov eax, dword [rsp + 0x30]
cmp eax, r12d
je 0x180038475
cmp eax, 0x800
jbe 0x18003841b
lea rcx, [rax + 2]
call fcn.18003cee0
mov rsi, rax
mov r8d, dword [rsp + 0x30]
add r8, 2
xor edx, edx
mov rcx, rax
call fcn.1800413a0
lea r11, [rsp + 0x30]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, rbp
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
jmp 0x180038441
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rbp
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea rdx, [rsp + 0x50]
cmp rsi, r12
cmovne rdx, rsi
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.180001df4
cmp rsi, r12
je 0x180038475
mov rcx, rsi
call fcn.18003cea0
mov rax, rbx
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.18003c180
mov rbx, qword [rsp + 0x898]
add rsp, 0x860
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180039a28
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
mov eax, 0x2070
call fcn.180050b90
sub rsp, rax
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0x2060], rax
call fcn.180039b40
xor ebx, ebx
cmp al, bl
je 0x180039b26
lea rdx, str.__ls__ls
lea rcx, [rsp + 0x60]
mov word [rsp + 0x60], bx
mov word [rsp + 0x860], bx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x1800605fc]
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
lea rcx, [rsp + 0x30]
call fcn.180039908
cmp qword [rax + 0x20], 8
jb 0x180039ab2
mov r9, qword [rax + 8]
jmp 0x180039ab6
lea r9, [rax + 8]
mov rax, qword [rsp + 0x2080]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x860]
mov edx, 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
cmp qword [rsp + 0x50], 8
jb 0x180039aed
mov rcx, qword [rsp + 0x38]
call fcn.18003c1d8
lea r9, [rsp + 0x2088]
lea r8, [rsp + 0x860]
lea rcx, [rsp + 0x1060]
mov edx, 0x800
mov word [rsp + 0x1060], bx
call qword [sym.imp.SHLWAPI.dll_wvnsprintfW]
lea rcx, [rsp + 0x1060]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.18003c180
add rsp, 0x2070
pop rbx
ret

Function at 0x180039b40
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
lea rax, [r11 + 8]
lea r9, [r11 + 0x10]
lea r8, [0x180060600]
mov qword [r11 - 0x10], rax
lea rax, [r11 + 0x18]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smpcache_
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], 4
mov qword [r11 - 0x18], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor ecx, ecx
cmp eax, ecx
jne 0x180039b8f
cmp dword [rsp + 0x48], 4
mov eax, dword [rsp + 0x50]
je 0x180039b91
mov eax, ecx
cmp eax, 1
sete al
add rsp, 0x38
ret
Function at 0x18003acc4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor eax, eax
xor esi, esi
mov rbp, r8
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov eax, dword [rcx + 0x10]
shl eax, 2
mov r10, rdx
mov rbx, rcx
cmp eax, esi
mov r9d, esi
jle 0x18003ad32
mov eax, r9d
inc r9d
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [r10]
inc r10
mov byte [rcx + rdx*4], al
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp r9d, eax
jl 0x18003acfe
mov edx, dword [rbx + 0x18]
mov rcx, rbx
call fcn.18003ae38
mov edi, dword [rbx + 0x18]
lea r14, [0x180076f10]
jmp 0x18003ad8d
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x18003ad4c
add r11, 4
sub r8, 1
jne 0x18003ad49
mov edx, edi
mov rcx, rbx
call fcn.18003ae38
mov rcx, rbx
call fcn.18003af78
mov rcx, rbx
dec edi
call fcn.18003aef0
cmp edi, 1
mov r11, rbx
mov r8d, 4
jge 0x18003ad49
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x18003ada8
add r11, 4
sub r8, 1
jne 0x18003ada5
xor edx, edx
mov rcx, rbx
call fcn.18003ae38
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp eax, esi
jle 0x18003ae1c
mov eax, esi
inc esi
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [rcx + rdx*4]
mov byte [rbp], al
mov eax, dword [rbx + 0x10]
inc rbp
shl eax, 2
cmp esi, eax
jl 0x18003adeb
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x18003ae38
Capabilities:
Encode data using xor

Disassembly:
movsxd rax, edx
mov r11d, 4
add rax, rax
mov r10, r11
lea rdx, [rcx + rax*8 + 0x3c]
xor r8d, r8d
mov r9, rdx
mov al, byte [r9]
add r9, r11
xor byte [rcx + r8], al
inc r8
cmp r8, r11
jl 0x18003ae52
inc rdx
add rcx, r11
sub r10, 1
jne 0x18003ae4c
repz ret
Function at 0x18003bd24
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x1800754d0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, rdx
mov rbx, rcx
and dword [rsp + 0x20], 0
xor esi, esi
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov r13, rcx
mov qword [r11 - 0x38], 0xf
mov qword [r11 - 0x40], rax
mov byte [rsp + 0x38], al
je 0x18003bf16
lea rdi, [0x18005f8d0]
movsx rax, byte [r12 + rsi]
mov cl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x18003bdaa
cmp cl, r14b
je 0x18003bd95
cmp cl, r14b
je 0x18003bf16
movsx rax, byte [r12 + rsi]
mov bpl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x18003bdc9
cmp bpl, r14b
je 0x18003bdb3
cmp bpl, r14b
je 0x18003bf16
mov r8b, bpl
sar r8b, 4
and r8b, 3
shl cl, 2
or r8b, cl
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.180021cc0
jmp 0x18003bdfb
lea rdi, [0x18005f8d0]
mov al, byte [r12 + rsi]
inc rsi
cmp al, 0x3d
je 0x18003beda
movsx rax, al
mov dil, byte [rax + rdi]
cmp rsi, r13
jae 0x18003be1c
cmp dil, r14b
je 0x18003bdf4
cmp dil, r14b
je 0x18003bf16
mov r8b, dil
sar r8b, 2
and r8b, 0xf
shl bpl, 4
or r8b, bpl
mov ebp, 1
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.180021cc0
lea rdx, [0x18005f8d0]
mov al, byte [r12 + rsi]
add rsi, rbp
cmp al, 0x3d
je 0x18003be9e
movsx rax, al
mov cl, byte [rax + rdx]
cmp rsi, r13
jae 0x18003be6c
cmp cl, r14b
je 0x18003be50
cmp cl, r14b
je 0x18003bf16
shl dil, 6
or dil, cl
mov r8b, dil
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.180021cc0
cmp rsi, r13
lea rdi, [0x18005f8d0]
jb 0x18003bd95
jmp 0x18003bf16
mov qword [rbx + 0x20], 0xf
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180001864
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18003bed5
mov rcx, qword [rsp + 0x38]
call fcn.18003c1d8
mov rax, rbx
jmp 0x18003bf50
mov qword [rbx + 0x20], 0xf
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180001864
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18003bf11
mov rcx, qword [rsp + 0x38]
call fcn.18003c1d8
mov rax, rbx
jmp 0x18003bf50
mov qword [rbx + 0x20], 0xf
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180001864
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18003bf4d
mov rcx, qword [rsp + 0x38]
call fcn.18003c1d8
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18003c180
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18003e673
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1800754d0]
jne 0x18003c19a
rol rcx, 0x10
test cx, 0xffff
jne 0x18003c196
repz ret
ror rcx, 0x10
jmp 0x18003e5cc
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180078330]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x180078428]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18003e651
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180078330]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18003e673
mov rax, qword [rsp + 0x88]
mov qword [0x180078428], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1800783c8], rax
mov rax, qword [0x180078428]
mov qword [0x1800782a0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1800783b0], rax
mov dword [0x180078290], 0xc0000409
mov dword [0x180078294], 1
mov rax, qword [0x1800754d0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1800754d8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180078328], eax
mov ecx, 1
call fcn.180041380
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18005a8f8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180078328], 0
jne 0x18003e6fa
mov ecx, 1
call fcn.180041380
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x180041a1c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x180041890