joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011104
Capabilities:
Capture public ip
Create http request
Read data from internet
Receive data

Disassembly:
jmp 0x1400188c0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x238
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x52
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x258]
mov rax, qword [0x14002b040]
xor rax, rbp
mov qword [rbp + 0x1f8], rax
mov dword [rbp + 0x1e4], 0
lea rcx, [0x1400310fe]
call fcn.140011889
nop
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.IPFetcher
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14001896d
lea rdx, [0x140026fb2]
mov rcx, qword [rbp + 0x220]
call fcn.1400113d4
mov eax, dword [rbp + 0x1e4]
or eax, 1
mov dword [rbp + 0x1e4], eax
mov rax, qword [rbp + 0x220]
jmp 0x140018aa0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
lea rdx, str.https:__api.ipify.org_
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x1400189d9
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
lea rdx, [0x140026fb2]
mov rcx, qword [rbp + 0x220]
call fcn.1400113d4
mov eax, dword [rbp + 0x1e4]
or eax, 1
mov dword [rbp + 0x1e4], eax
mov rax, qword [rbp + 0x220]
jmp 0x140018aa0
mov dword [rbp + 0xa4], 0
lea rcx, [rbp + 0xc8]
call fcn.14001187a
nop
lea r9, [rbp + 0xa4]
mov r8d, 0x3f
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140018a54
cmp dword [rbp + 0xa4], 0
jbe 0x140018a54
mov eax, dword [rbp + 0xa4]
mov qword [rbp + 0x1c8], rax
cmp qword [rbp + 0x1c8], 0x40
jae 0x140018a31
jmp 0x140018a37
call fcn.14001165e
nop
mov rax, qword [rbp + 0x1c8]
mov byte [rbp + rax + 0x50], 0
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0xc8]
call fcn.140011055
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
lea rdx, [rbp + 0xc8]
mov rcx, qword [rbp + 0x220]
call fcn.14001181b
mov eax, dword [rbp + 0x1e4]
or eax, 1
mov dword [rbp + 0x1e4], eax
lea rcx, [rbp + 0xc8]
call fcn.14001119f
nop
mov rax, qword [rbp + 0x220]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400262d0]
call fcn.140011726
mov rax, rdi
mov rcx, qword [rbp + 0x1f8]
xor rcx, rbp
call fcn.140011433
lea rsp, [rbp + 0x208]
pop rdi
pop rbp
ret

Function at 0x1400114e7
Capabilities:
Terminate process

Disassembly:
jmp 0x14001bcf0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x140011613
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001ebb0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001ebd0
xor al, al
jmp 0x14001ec51
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001ebe3
xor al, al
jmp 0x14001ec51
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001ec0d
xor al, al
jmp 0x14001ec51
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001ec21
xor al, al
jmp 0x14001ec51
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001ec33
xor al, al
jmp 0x14001ec51
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001ec4f
xor al, al
jmp 0x14001ec51
mov al, 1
add rsp, 0x38
ret
Function at 0x14001c9f0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400118ca
movzx eax, al
test eax, eax
jne 0x14001ca10
mov ecx, 7
call fcn.14001173f
nop
mov byte [rsp + 0x20], 0
call fcn.140011780
mov byte [rsp + 0x21], al
cmp dword [0x14002bba8], 1
jne 0x14001ca34
mov ecx, 7
call fcn.14001173f
nop
jmp 0x14001ca8c
cmp dword [0x14002bba8], 0
jne 0x14001ca87
mov dword [0x14002bba8], 1
lea rdx, [0x140025770]
lea rcx, [0x140025440]
call fcn.14001141a
test eax, eax
je 0x14001ca68
mov eax, 0xff
jmp 0x14001cb91
lea rdx, [0x140025330]
lea rcx, [section..rdata]
call fcn.140011767
mov dword [0x14002bba8], 2
jmp 0x14001ca8c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001171c
call fcn.140011645
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x14001cae9
mov rcx, qword [rsp + 0x30]
call fcn.14001134d
movzx eax, al
test eax, eax
je 0x14001cae9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140032020]
nop
call fcn.1400116ae
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001cb1d
mov rcx, qword [rsp + 0x38]
call fcn.14001134d
movzx eax, al
test eax, eax
je 0x14001cb1d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14001185c
nop
call fcn.14001cc40
mov dword [rsp + 0x28], eax
call fcn.140011613
movzx eax, al
test eax, eax
jne 0x14001cb3c
mov ecx, dword [rsp + 0x28]
call fcn.1400110b9
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001cb4b
call fcn.140011870
nop
xor edx, edx
mov cl, 1
call fcn.14001131b
mov eax, dword [rsp + 0x28]
jmp 0x14001cb91
add rsp, 0x68
ret
Function at 0x140004958
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400049a2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400049a2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400049a2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400049a2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400049a2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400049a4
xor al, al
add rsp, 0x28
ret

Function at 0x14000b3f0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000b21c

Function at 0x1417a5058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1417a51df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1417a5089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1417a506f
add dl, dl
jne 0x1417a5096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1417a50f6
xor eax, eax
add dl, dl
jne 0x1417a50a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1417a51ad
add dl, dl
jne 0x1417a50b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1417a50c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1417a50d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1417a50dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1417a50ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1417a507e
mov eax, 1
add dl, dl
jne 0x1417a5106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1417a5113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1417a50fb
sub eax, ebx
mov ebx, 1
jne 0x1417a514c
mov ecx, 1
add dl, dl
jne 0x1417a512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1417a513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1417a5123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1417a507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1417a5168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1417a5175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1417a515d
cmp eax, 0x7d00
jae 0x1417a519b
cmp eax, 0x500
jb 0x1417a5196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1417a507e
cmp eax, 0x7f
ja 0x1417a519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1417a507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1417a51d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1417a507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
invalid
adc dword [rax], ecx
invalid
or cl, byte [rax + rdx*4]
call [rbx]
or al, 0xae
dec dword [rdi]
or eax, 0xd1affa2
mov dh, 0xff
femms
test eax, 0xbc0e1aff
dec dword [rdi]
cmpxchg bh, bh
sbb cl, byte [rdi]
ret 0xfff
sar edi, 0x35
sub cl, dl
inc dword [rsi + 0x64]
invalid
js 0x14003f615
mov dl, 0xba
outsd dx, dword [rsi]
jbe 0x14003f68a
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
pop rax
pop rdi
push 0xffffffffcba99173
out dx, al
xchg ebp, eax
mov edx, 0x928fffe6
mov ch, 0xff
sbb r15d, dword [r8]
invalid
Function at 0x180003310
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x260
mov rax, qword [0x180028018]
xor rax, rsp
mov qword [rsp + 0x258], rax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov byte [rsp + 0x150], 0
lea rax, [rsp + 0x151]
mov rdi, rax
xor eax, eax
mov ecx, 0xff
rep stosb byte [rdi], al
mov byte [rsp + 0x50], 0
lea rax, [rsp + 0x51]
mov rdi, rax
xor eax, eax
mov ecx, 0xff
rep stosb byte [rdi], al
cmp dword [rsp + 0x270], 4
jge 0x18000338c
lea rcx, [0x180021cc8]
call fcn.180001c70
mov rax, qword [rsp + 0x278]
mov rax, qword [rax + 0x10]
movsx eax, byte [rax]
cmp eax, 0x7b
jne 0x1800033b1
lea rax, [0x1800212c4]
mov qword [rsp + 0x250], rax
jmp 0x1800033c0
lea rax, [0x180021ce8]
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x278]
mov r9, qword [rax + 0x10]
mov r8, qword [rsp + 0x250]
mov edx, 0x100
lea rcx, [rsp + 0x150]
call fcn.18000ef40
lea r9, [rsp + 0x150]
lea r8, [0x180021cf0]
mov edx, 0x100
lea rcx, [rsp + 0x50]
call fcn.18000ef40
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x180003444
mov edx, dword [rsp + 0x38]
lea rcx, str.ERROR:_Cannot_open_AppID_registry_key.
call fcn.180001f70
lea rdx, str.LAUNCHING_USER
mov rax, qword [rsp + 0x278]
mov rcx, qword [rax + 0x18]
call fcn.180009e20
test eax, eax
jne 0x1800034a3
lea rdx, [0x180021d38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 2
jne 0x180003487
mov dword [rsp + 0x38], 0
jmp 0x18000349e
cmp dword [rsp + 0x38], 0
je 0x18000349e
mov edx, dword [rsp + 0x38]
lea rcx, str.ERROR:_Cannot_remove_RunAs_registry_value.
call fcn.180001f70
jmp 0x180003575
lea rdx, str.INTERACTIVE_USER
mov rax, qword [rsp + 0x278]
mov rcx, qword [rax + 0x18]
call fcn.180009e20
test eax, eax
je 0x180003519
cmp dword [rsp + 0x270], 5
jge 0x1800034d5
lea rcx, str.Invalid_number_of_arguments.
call fcn.180001c70
mov rax, qword [rsp + 0x278]
mov r8, qword [rax + 0x20]
mov rax, qword [rsp + 0x278]
mov rdx, qword [rax + 0x18]
mov rax, qword [rsp + 0x278]
mov rcx, qword [rax + 0x10]
call fcn.18000c2a0
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x180003519
mov edx, dword [rsp + 0x38]
lea rcx, str.ERROR:_Cannot_set_RunAs_password.
call fcn.180001f70
mov rax, qword [rsp + 0x278]
mov rcx, qword [rax + 0x18]
call fcn.18000f0c0
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x278]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.RunAs
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x180003575
mov edx, dword [rsp + 0x38]
lea rcx, str.ERROR:_Cannot_set_RunAs_registry_value.
call fcn.180001f70
cmp qword [rsp + 0x30], 0
je 0x180003588
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x258]
xor rcx, rsp
call fcn.18000ddd0
add rsp, 0x260
pop rdi
ret
Function at 0x180009e50
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x260
mov rax, qword [0x180028018]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x240], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x248], 0
mov byte [rsp + 0x40], 0
lea rax, [rsp + 0x41]
mov rdi, rax
xor eax, eax
mov ecx, 0x1ff
rep stosb byte [rdi], al
mov dword [rsp + 0x34], 0
lea rax, [rsp + 0x240]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_NTDCOM
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180009f94
mov dword [rsp + 0x248], 0x200
lea rax, [rsp + 0x248]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [0x180021ef0]
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 2
je 0x180009f30
lea rcx, str.WARNING:_Machine_wide_Access_Group_Policy_may_override_these_settings___n
call fcn.18000e7f8
mov dword [rsp + 0x248], 0x200
lea rax, [rsp + 0x248]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [0x180021f88]
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 2
je 0x180009f86
lea rcx, str.WARNING:_Machine_wide_Launch_Activate_Group_Policy_may_override_these_settings___n
call fcn.18000e7f8
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18000ddd0
add rsp, 0x260
pop rdi
ret

Function at 0x18000b2d0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
lea r9, [0x180022147]
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0
je 0x18000b357
jmp 0x18000b396
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorLength]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x5c], eax
cmp qword [rsp + 0x50], 0
je 0x18000b3a9
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x5c]
add rsp, 0x68
ret
Function at 0x18000b3c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x30], 0
cmp qword [rsp + 0x78], 0
jne 0x18000b40b
mov eax, 0xa0
jmp 0x18000b56f
cmp qword [rsp + 0x80], 0
je 0x18000b424
mov rax, qword [rsp + 0x80]
mov dword [rax], 0
mov rax, qword [rsp + 0x78]
mov qword [rax], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x18000b478
cmp dword [rsp + 0x40], 2
jne 0x18000b46f
jmp 0x18000b4ff
mov eax, dword [rsp + 0x40]
jmp 0x18000b56f
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x18000b4b9
cmp dword [rsp + 0x40], 0x7a
je 0x18000b4b9
jmp 0x18000b4ff
mov eax, dword [rsp + 0x30]
mov ecx, eax
call fcn.18000de80
mov rcx, qword [rsp + 0x78]
mov qword [rcx], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x18000b558
mov rax, qword [rsp + 0x78]
cmp qword [rax], 0
je 0x18000b51e
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
call fcn.18000ddf0
mov rax, qword [rsp + 0x78]
mov qword [rax], 0
cmp qword [rsp + 0x80], 0
je 0x18000b558
mov rcx, qword [rsp + 0x78]
call fcn.18000a6b0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x18000b558
mov rax, qword [rsp + 0x80]
mov dword [rax], 1
cmp qword [rsp + 0x38], 0
je 0x18000b56b
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x18000c540
Capabilities:
Manipulate user privileges

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2a0
mov rax, qword [0x180028018]
xor rax, rsp
mov qword [rsp + 0x298], rax
mov qword [rsp + 0x280], 0
mov dword [rsp + 0x38], 0
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
mov qword [rsp + 0x30], 0
xor eax, eax
mov word [rsp + 0x288], ax
lea rax, [rsp + 0x28a]
mov rdi, rax
xor eax, eax
mov ecx, 0xe
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x80], ax
lea rax, [rsp + 0x82]
mov rdi, rax
xor eax, eax
mov ecx, 0x1fe
rep stosb byte [rdi], al
mov dword [rsp + 0x68], 0
mov rcx, qword [rsp + 0x2b8]
call fcn.18000f0c0
inc rax
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x2b8]
mov r8d, 0x100
lea rdx, [rsp + 0x80]
xor ecx, ecx
call fcn.18000ff58
lea r9, [rsp + 0x280]
mov r8d, 0x810
lea rdx, [rsp + 0x38]
xor ecx, ecx
call sub.ADVAPI32.dll_LsaOpenPolicy
mov dword [rsp + 0x68], eax
mov ecx, dword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaNtStatusToWinError
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
je 0x18000c644
jmp 0x18000c6d2
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x2b0]
call fcn.18000cce0
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
je 0x18000c665
jmp 0x18000c6d2
lea rcx, [rsp + 0x80]
call fcn.18000fbac
shl rax, 1
mov word [rsp + 0x288], ax
movzx eax, word [rsp + 0x288]
add rax, 2
mov word [rsp + 0x28a], ax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x290], rax
mov r9d, 1
lea r8, [rsp + 0x288]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x280]
call sub.ADVAPI32.dll_LsaAddAccountRights
mov dword [rsp + 0x68], eax
mov ecx, dword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaNtStatusToWinError
mov dword [rsp + 0x68], eax
cmp qword [rsp + 0x30], 0
je 0x18000c6e4
mov rcx, qword [rsp + 0x30]
call fcn.18000ddf0
cmp qword [rsp + 0x280], 0
je 0x18000c6fc
mov rcx, qword [rsp + 0x280]
call sub.ADVAPI32.dll_LsaClose
mov eax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x298]
xor rcx, rsp
call fcn.18000ddd0
add rsp, 0x2a0
pop rdi
ret
Function at 0x18000cce0
Capabilities:
Get user security identifier

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x170
mov rax, qword [0x180028018]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov dword [rsp + 0x154], 0
mov byte [rsp + 0x50], 0
lea rax, [rsp + 0x51]
mov rdi, rax
xor eax, eax
mov ecx, 0xff
rep stosb byte [rdi], al
mov dword [rsp + 0x158], 0
mov dword [rsp + 0x150], 0
mov dword [rsp + 0x154], 0
mov dword [rsp + 0x158], 0xff
mov rdx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x180]
call fcn.18000c970
test eax, eax
je 0x18000cd71
xor eax, eax
jmp 0x18000ce81
lea rax, [rsp + 0x15c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x158]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x154]
mov rax, qword [rsp + 0x188]
mov r8, qword [rax]
mov rdx, qword [rsp + 0x180]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x150], eax
cmp dword [rsp + 0x150], 0x7a
je 0x18000cdd9
jmp 0x18000ce7a
mov dword [rsp + 0x150], 0
mov eax, dword [rsp + 0x154]
mov ecx, eax
call fcn.18000de80
mov rcx, qword [rsp + 0x188]
mov qword [rcx], rax
cmp qword [rsp + 0x188], 0
jne 0x18000ce17
mov dword [rsp + 0x150], 0xe
jmp 0x18000ce7a
mov dword [rsp + 0x158], 0xff
lea rax, [rsp + 0x15c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x158]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x154]
mov rax, qword [rsp + 0x188]
mov r8, qword [rax]
mov rdx, qword [rsp + 0x180]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x18000ce7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x150], eax
mov eax, dword [rsp + 0x150]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.18000ddd0
add rsp, 0x170
pop rdi
ret

Function at 0x18000cf30
Capabilities:
Check os version

Disassembly:
push rdi
sub rsp, 0xe0
mov rax, qword [0x180028018]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x30], 0x9c
lea rax, [rsp + 0x34]
mov rdi, rax
xor eax, eax
mov ecx, 0x98
rep stosb byte [rdi], al
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x18000cfde
cmp dword [rsp + 0x34], 5
jne 0x18000cfcf
cmp dword [rsp + 0x38], 1
jae 0x18000cf93
mov dword [rsp + 0x20], 1
jmp 0x18000cfcd
cmp dword [rsp + 0x38], 1
jne 0x18000cfb1
movzx eax, word [rsp + 0xc4]
cmp eax, 2
jge 0x18000cfaf
mov dword [rsp + 0x20], 1
jmp 0x18000cfcd
cmp dword [rsp + 0x38], 2
jne 0x18000cfcd
movzx eax, word [rsp + 0xc4]
cmp eax, 1
jge 0x18000cfcd
mov dword [rsp + 0x20], 1
jmp 0x18000cfde
cmp dword [rsp + 0x34], 5
jae 0x18000cfde
mov dword [rsp + 0x20], 1
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.18000ddd0
add rsp, 0xe0
pop rdi
ret

Function at 0x18000e308
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.18000e178