joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005ea0
Capabilities:
Read .ini file

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor ebx, ebx
xor eax, eax
mov r12, rcx
mov byte [rsp + 0x40], bl
mov qword [r11 - 0x37], rax
mov byte [rsp + 0x30], bl
mov qword [r11 - 0x47], rax
mov dword [rsp + 0x49], eax
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
mov dword [rsp + 0x39], eax
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
mov esi, ebx
mov ebp, ebx
mov edi, ebx
cmp ebp, 0xc8
ja 0x180005f85
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x10]
call fcn.180052810
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x10]
call fcn.180052810
lea r8, str.User_d
lea rcx, [rsp + 0x30]
mov r9d, edi
mov edx, SQLNumResultCols
call fcn.1800528fc
lea r11, [0x18009b470]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], r11
lea rdx, str.AccountStatus
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x20], SQLNumResultCols
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, ebx
jbe 0x180005f75
lea esi, [rdi + 1]
jmp 0x180005f77
inc ebp
inc edi
cmp edi, 0x3e8
jb 0x180005ef9
cmp esi, ebx
mov dword [r12], esi
seta bl
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800527e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret

Function at 0x18000600c
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor eax, eax
xor edi, edi
mov ebx, ecx
lea rcx, [rsp + 0x41]
lea r8d, [rdi + 0x7f]
xor edx, edx
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x31], rax
mov dword [rsp + 0x39], eax
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
mov byte [rsp + 0x40], dil
call fcn.180052810
lea r8d, [rdi + 0x10]
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.180052810
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x80
call fcn.180052810
lea r8, str.User_d
lea edx, [rdi + 0xf]
lea rcx, [rsp + 0x30]
mov r9d, ebx
call fcn.1800528fc
lea r11, [0x18009b470]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], r11
lea rdx, str.UserName
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, edi
seta dil
mov eax, edi
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800527e0
mov rbx, qword [rsp + 0xe8]
add rsp, 0xd0
pop rdi
ret
Function at 0x1800062f4
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
mov rdi, rcx
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x41], rax
mov dword [rsp + 0x49], eax
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
mov byte [rsp + 0x30], al
mov qword [rsp + 0x31], rax
mov dword [rsp + 0x39], eax
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
xor ebx, ebx
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x10]
call fcn.180052810
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x10]
call fcn.180052810
lea r8, str.User_d
lea rcx, [rsp + 0x30]
mov r9d, ebx
mov edx, SQLNumResultCols
call fcn.1800528fc
lea r11, [0x18009b470]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], r11
lea rdx, str.AccountStatus
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x20], SQLNumResultCols
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x1800063b6
lea eax, [rbx + 1]
cmp eax, 0x3e8
jne 0x1800063da
inc ebx
cmp ebx, 0x3e8
jb 0x180006341
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800527e0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov dword [rdi], ebx
mov eax, 1
jmp 0x1800063c2

Function at 0x18000667c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov dword [r11 + 0x20], r9d
push rdi
sub rsp, 0x40
lea rax, [r11 - 0x18]
mov rdi, r8
xor ebx, ebx
mov r9d, 0xf003f
xor r8d, r8d
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x18], rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x1800066e2
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [rbx + 1]
cmp eax, ebx
cmove ebx, ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x180006730
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
mov dword [rax + 0x18], 4
lea rax, [rax + 0x20]
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
lea rdx, str.HardwareDescriptionSystemCentralProcessor0
mov qword [rax], rbx
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x1800067a8
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0x50]
lea rdx, str.MHz
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [rbx + 1]
cmp eax, ebx
cmove ebx, ecx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180006a80
Capabilities:
Read .ini file

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x70
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov byte [rsp + 0x30], 0
xor ebx, ebx
mov byte [rsp + 0x40], al
mov qword [r11 - 0x37], rax
mov qword [r11 - 0x2f], rax
mov qword [r11 - 0x27], rax
mov qword [r11 - 0x47], rax
mov dword [rsp + 0x39], eax
mov dword [rsp + 0x59], eax
mov word [rsp + 0x5d], ax
mov byte [rsp + 0x5f], al
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x10]
call fcn.180052810
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x20]
call fcn.180052810
lea r8, str.DeniedIP_d
lea rcx, [rsp + 0x30]
mov r9d, ebx
mov edx, SQLNumResultCols
call fcn.1800528fc
lea r11, [0x18009b470]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], r11
lea rdx, [rsp + 0x30]
lea rcx, str.DeniedSettings
xor r8d, r8d
mov dword [rsp + SQLSetConnectAttr], 0x20
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x180006b45
inc ebx
cmp ebx, 0x40
jb 0x180006ace
or eax, 0xffffffff
jmp 0x180006b47
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800527e0
add rsp, 0x70
pop rbx
ret

Function at 0x180007e74
Capabilities:
Get memory capacity

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x60
mov rbp, rcx
lea rcx, str.Kernel32.DLL
mov rsi, rdx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x180007f0f
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test rax, rax
je 0x180007f02
lea r8d, [rdi + 0x40]
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.180052810
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call r12
test eax, eax
je 0x180007f02
mov rax, qword [rsp + 0x30]
mov edi, 1
shr rax, 0x14
mov dword [rbp], eax
mov rax, qword [rsp + 0x28]
shr rax, 0x14
mov dword [rsi], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
jne 0x180007f42
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x38]
call fcn.180052810
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov r11, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
shr r11, 0x14
shr rcx, 0x14
mov dword [rbp], r11d
mov dword [rsi], ecx
lea r11, [rsp + 0x60]
mov eax, 1
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x18000922c
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x18009b6a0], rax
test rax, rax
je 0x180009319
lea rdx, str.CreateTimerQueue
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18009b6a0]
lea rdx, str.CreateTimerQueueTimer
mov qword [0x1800849e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18009b6a0]
lea rdx, str.DeleteTimerQueueEx
mov qword [0x18009acd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18009b6a0]
lea rdx, str.DeleteTimerQueueTimer
mov qword [0x18009ae38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18009b6a0]
lea rdx, str.ChangeTimerQueueTimer
mov qword [0x1800849c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1800849e0], 0
mov qword [0x1800849d0], rax
je 0x180009304
cmp qword [0x18009acd8], 0
je 0x180009304
cmp qword [0x18009ae38], 0
je 0x180009304
cmp qword [0x1800849c0], 0
je 0x180009304
test rax, rax
je 0x180009304
mov eax, 1
jmp 0x18000931b
mov rcx, qword [0x18009b6a0]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
and qword [0x18009b6a0], 0
xor eax, eax
add rsp, 0x28
ret
Function at 0x18000a658
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor edx, edx
mov rsi, rcx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x10]
call fcn.180052810
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rcx, [rsp + 0x61]
xor ebx, ebx
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x60], bl
call fcn.180052810
mov rcx, qword [0x18009b638]
mov dword [rsp + 0x48], ebx
mov edi, 0xf000
cmp rcx, rbx
je 0x18000a6d1
mov r8, rdi
xor edx, edx
call fcn.180052810
mov rcx, qword [0x18009b630]
cmp rcx, rbx
je 0x18000a858
call fcn.1800529c0
cmp eax, ebx
jbe 0x18000a858
lea rcx, [0x18009ae10]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, qword [0x18009b630]
mov rcx, qword [0x18009b638]
call fcn.180053170
mov rcx, qword [0x18009b630]
mov r8, rdi
xor edx, edx
call fcn.180052810
lea rcx, [0x18009ae10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov edi, 3
mov word [rsp + 0x45], ax
mov byte [rsp + 0x47], al
mov word [rsp + 0x41], ax
mov byte [rsp + 0x43], al
movzx eax, word [rsp + 0x52]
mov byte [rsp + 0x44], bl
mov byte [rsp + 0x40], bl
lea rcx, [rsp + 0x44]
mov rdx, rdi
movzx r9d, ax
lea r8, [0x180067f84]
cmp ax, 0xa
jb 0x18000a772
lea r8, [0x180067848]
call fcn.1800528fc
movzx eax, word [rsp + 0x56]
mov rdx, rdi
lea rcx, [rsp + 0x40]
lea r8, [0x180067f84]
movzx r9d, ax
cmp ax, 0xa
jb 0x18000a79c
lea r8, [0x180067848]
call fcn.1800528fc
movzx eax, word [rsp + 0x50]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x44]
lea r8, str._s_d_s_s.kql
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r9, rsi
mov edx, 0x3ff
mov dword [rsp + 0x20], eax
call fcn.1800528fc
xor r9d, r9d
mov qword [rsp + 0x30], rbx
lea esi, [r9 + 2]
lea rcx, [rsp + 0x60]
mov edx, 0xc0000000
mov r8d, esi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18000a813
xor eax, eax
jmp 0x18000a85a
mov r9d, esi
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [0x18009b638]
call fcn.1800529c0
mov rdx, qword [0x18009b638]
lea r9, [rsp + 0x48]
mov r8, rax
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1800527e0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18000b3bc
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xe0
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov ebx, 0x9c
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8, rbx
call fcn.180052810
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], ebx
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
xor ebx, ebx
cmp eax, ebx
jne 0x18000b40c
or eax, 0xffffffff
jmp 0x18000b4e4
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x20]
mov dil, bl
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x24], ebx
call fcn.1800039d4
mov ecx, 1
lea r8d, [rcx + 1]
cmp al, bl
je 0x18000b446
cmp dword [rsp + 0x20], 6
ja 0x18000b443
jne 0x18000b446
cmp dword [rsp + 0x24], r8d
jbe 0x18000b446
mov dil, cl
cmp dword [rsp + 0x40], r8d
jne 0x18000b4e2
mov eax, dword [rsp + 0x34]
cmp eax, 4
ja 0x18000b461
mov eax, ecx
jmp 0x18000b4e4
cmp eax, 5
jne 0x18000b48a
mov edx, dword [rsp + 0x38]
cmp edx, ebx
jne 0x18000b473
mov eax, r8d
jmp 0x18000b4e4
cmp edx, ecx
jne 0x18000b47e
mov eax, 3
jmp 0x18000b4e4
cmp edx, r8d
jne 0x18000b4e2
mov eax, 4
jmp 0x18000b4e4
cmp eax, 6
jne 0x18000b4e2
mov eax, dword [rsp + 0x38]
cmp eax, ebx
jne 0x18000b4a6
cmp byte [rsp + 0xca], cl
setne bl
lea eax, [rbx + 5]
jmp 0x18000b4e4
cmp eax, ecx
jne 0x18000b4ba
sub cl, byte [rsp + 0xca]
neg cl
sbb eax, eax
add eax, 8
jmp 0x18000b4e4
cmp eax, r8d
jne 0x18000b4e2
cmp dil, bl
jne 0x18000b4d3
cmp byte [rsp + 0xca], cl
setne bl
lea eax, [rbx + 9]
jmp 0x18000b4e4
cmp byte [rsp + 0xca], cl
setne bl
lea eax, [rbx + 0xb]
jmp 0x18000b4e4
xor eax, eax
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1800527e0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rdi
ret

Function at 0x18000b508
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
mov r8, rcx
cmp dword [rcx + 0x130], r11d
jbe 0x18000b549
cmp dword [rcx + 0x54], r11d
mov r9d, r11d
mov r10, r11
jle 0x18000b53e
mov rdx, qword [r8 + 0x48]
mov cl, byte [r8 + 0x130]
inc r9d
xor byte [rdx + r10], cl
inc r10
cmp r9d, dword [r8 + 0x54]
jl 0x18000b523
mov rcx, qword [r8 + 0x48]
movsxd rdx, r9d
mov byte [rdx + rcx], r11b
mov eax, 1
ret

Function at 0x18000b550
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
test rcx, rcx
je 0x18000b581
test edx, edx
je 0x18000b581
xor eax, eax
test edx, edx
je 0x18000b576
mov r8, rcx
mov eax, edx
mov ecx, edx
xor byte [r8], 7
inc r8
sub rcx, 1
jne 0x18000b569
mov byte [rax + r9], 0
mov eax, 1
ret
xor eax, eax
ret
Function at 0x18000b8bc
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x448
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x430], rax
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x30], 0
call fcn.180052810
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x400
call fcn.180052810
lea r11, [0x18009b470]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], r11
lea rdx, str.DNSSERVER
lea rcx, str.GlobalSettings
xor r8d, r8d
mov dword [rsp + 0x20], 0x400
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jle 0x18000b955
lea rcx, [rsp + 0x30]
call fcn.1800529c0
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.18000b550
lea rcx, [rsp + 0x30]
call fcn.18000b848
jmp 0x18000b957
xor eax, eax
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1800527e0
add rsp, 0x448
ret
Function at 0x18000c4f0
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
xor ebx, ebx
mov bpl, r8b
mov r12, rdx
lea r8, [rax - 0x30]
lea rdx, [rax + 0x20]
xor r9d, r9d
mov rdi, rcx
mov qword [rax - 0x38], rbx
mov qword [rax + 0x20], rbx
mov dword [rax - 0x30], 0x18
mov qword [rax - 0x28], rbx
mov dword [rax - 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
cmp eax, ebx
jne 0x18000c562
cmp qword [rdi], rbx
je 0x18000c54b
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
cmp rcx, rbx
je 0x18000c55b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x18000c5ea
lea r8, [rsp + 0x28]
lea rdx, [rdi + 8]
lea rcx, [rsp + 0x20]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreatePipe]
cmp eax, ebx
jne 0x18000c5b2
cmp qword [rdi], rbx
je 0x18000c58b
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
cmp rcx, rbx
je 0x18000c59b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rdi + 8], rbx
je 0x18000c5ab
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x20]
jmp 0x18000c550
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x20]
mov r9b, bpl
mov r8, r12
call fcn.18000bf5c
mov rcx, qword [rsp + 0x20]
mov qword [rdi + 0x10], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rdi + 0x10], rbx
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret

Function at 0x18000c7c8
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xe0
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.180052810
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x18]
call fcn.180052810
xor ecx, ecx
mov edx, 1
lea rax, [rsp + 0x50]
mov dword [rsp + 0xac], edx
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + SQLDriverConnect], 0x28
mov dword [rsp + 0x20], edx
mov rdx, rbx
mov dword [rsp + 0x70], 0x68
mov word [rsp + 0xb0], cx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
add rsp, 0xe0
pop rbx
ret
Function at 0x18000cd24
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x260
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
movsxd r12, r8d
mov rbp, rdx
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x50], 0
call fcn.180052810
xor eax, eax
and qword [rsp + 0x30], rax
lea rdx, [0x180066920]
lea rcx, [rsp + 0x38]
mov byte [rsp + 0x38], 0
mov qword [rsp + 0x39], rax
mov dword [rsp + 0x41], eax
mov word [rsp + 0x45], ax
mov byte [rsp + 0x47], al
call fcn.180053170
lea rdx, str.SAMSAMDomainsAccountUsers_
lea rcx, [rsp + 0x50]
call fcn.180053170
mov rdx, rbx
mov rcx, rax
call fcn.1800530d0
and qword [rbp + 8], 0
mov esi, 5
lea ebx, [rsi - 4]
mov byte [rbp + 0x42], 0
mov byte [rbp + 0x43], 0
lea rdi, [r12 + rbp - 1]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x80808081
mul ecx
mov eax, SQLFreeHandle
shr edx, 7
imul edx, edx, 0xff
sub ecx, edx
cmove ecx, eax
mov byte [rdi], cl
call qword [sym.imp.KERNEL32.dll_Sleep]
sub rdi, rbx
sub rsi, rbx
jne 0x18000cdc9
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18000ce49
mov rcx, qword [rsp + 0x30]
lea r9d, [rsi + 3]
lea rdx, [rsp + 0x38]
xor r8d, r8d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x18000ce4b
xor ebx, ebx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1800527e0
add rsp, 0x260
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x18000ce78
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rsi, rdx
mov rbx, rcx
lea rdx, [0x180066920]
lea rcx, [rsp + 0x40]
xor edi, edi
mov rbp, r8
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x38], 3
call fcn.180053170
lea rdx, str.SAMSAMDomainsAccountUsers_
lea rcx, [rsp + 0x50]
call fcn.180053170
mov rdx, rbx
mov rcx, rax
call fcn.1800530d0
lea r11, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x18000cf32
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, edi
jne 0x18000cf32
mov edi, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1800527e0
mov rbx, qword [rsp + 0x298]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000cf64
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rsi, rdx
mov rbx, rcx
lea rdx, [0x1800677bc]
lea rcx, [rsp + 0x50]
xor edi, edi
mov byte [rsp + 0x40], 0x30
mov byte [rsp + 0x41], 0x31
mov byte [rsp + 0x42], 0x32
mov byte [rsp + 0x43], 0x33
mov byte [rsp + 0x44], 0x34
mov byte [rsp + 0x45], 0x35
mov byte [rsp + 0x46], 0x36
mov byte [rsp + 0x47], 0x37
mov byte [rsp + 0x48], 0x38
mov byte [rsp + 0x49], 0x39
mov byte [rsp + 0x4a], 0x41
mov byte [rsp + 0x4b], 0x42
mov byte [rsp + 0x4c], 0x43
mov byte [rsp + 0x4d], 0x44
mov byte [rsp + 0x4e], 0x45
mov byte [rsp + 0x4f], 0x46
mov qword [rsp + 0x30], rdi
call fcn.180053170
lea rdx, str.SAMSAMDomainsAccountUsersNames_
lea rcx, [rsp + 0x60]
call fcn.180053170
mov rdx, rbx
mov rcx, rax
call fcn.1800530d0
lea r11, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x18000d09e
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, edi
jne 0x18000d09e
mov ecx, dword [rsp + 0x38]
mov byte [rsi + 3], dil
mov edi, 1
mov rax, rcx
shr rax, 8
and eax, 0xf
mov al, byte [rsp + rax + 0x40]
mov byte [rsi], al
mov rax, rcx
shr rax, 4
and eax, 0xf
and ecx, 0xf
mov al, byte [rsp + rax + 0x40]
mov byte [rsi + 1], al
mov al, byte [rsp + rcx + 0x40]
mov byte [rsi + 2], al
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1800527e0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret