joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180074110
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rbp - 0x58]
cmp rdi, 0x40000000
jbe 0x18007415a
lea rax, [rdi - 0x40000000]
cmp rsi, rax
cmovb rsi, rax
mov rbx, qword [0x1800c9050]
lea r15, [rdi + 0x40000000]
cmp qword [rbp - 0x50], r15
cmovbe r15, qword [rbp - 0x50]
sub r15, 0xfff
test rbx, rbx
je 0x180074197
cmp rbx, rsi
jb 0x180074192
cmp rbx, r15
jae 0x180074192
cmp qword [rbx + 8], 0
jne 0x1800742f3
mov rbx, qword [rbx]
jmp 0x180074178
mov r14, rdi
cmp rdi, rsi
jb 0x18007421b
mov r12d, dword [rbp - 0x38]
xor edx, edx
mov rax, r14
div r12
sub r14, rdx
sub r14, r12
cmp r14, rsi
jb 0x180074212
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180074212
cmp dword [rbp - 0x10], 0x10000
je 0x1800741e2
mov r14, qword [rbp - 0x28]
cmp r14, r12
jb 0x180074212
jmp 0x1800741ae
test r14, r14
je 0x180074212
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1800742b3
cmp r14, rsi
jae 0x18007419f
test rbx, rbx
jne 0x1800742b3
cmp rdi, r15
ja 0x1800742f3
mov r14d, dword [rbp - 0x38]
xor edx, edx
mov rax, rdi
mov esi, r14d
div r14
mov eax, r14d
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x1800742f3
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800742f3
cmp dword [rbp - 0x10], 0x10000
je 0x180074289
xor edx, edx
lea edi, [r14 - 1]
add rdi, qword [rbp - 0x18]
add rdi, qword [rbp - 0x30]
mov rax, rdi
div rsi
sub rdi, rdx
cmp rdi, r15
jmp 0x180074242
test rdi, rdi
je 0x1800742f3
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jmp 0x180074215
and qword [rbx + 8], 0
lea rcx, [rbx + 0x40]
and dword [rbx + 0x10], 0
mov rdx, rcx
sub rdx, rbx
mov rax, qword [rbx + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rbx + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x1800742c6
mov rax, qword [0x1800c9050]
mov qword [rbx], rax
mov qword [0x1800c9050], rbx
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400020c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rax, qword [rcx]
mov rbx, rcx
cmp rax, qword [rcx + 8]
je 0x1400020ef
mov qword [rcx + 8], rax
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000215f
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140002156
nop
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140002137
mov eax, dword [rsp + 0x28]
mov dword [rdx], eax
add qword [rbx + 8], 4
jmp 0x140002144
lea r8, [rsp + 0x28]
mov rcx, rbx
call fcn.140003a30
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002120
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140004130
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x140002180
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x290
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x280], rax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x20], xmm1
xor esi, esi
mov qword [rsp + 0x30], rsi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002243
mov dword [rsp + 0x40], 0x238
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rdi, qword [rsp + 0x28]
test eax, eax
je 0x140002238
cmp rdi, rsi
je 0x14000220a
mov eax, dword [rsp + 0x48]
mov dword [rdi], eax
add rdi, 4
mov qword [rsp + 0x28], rdi
jmp 0x140002226
lea r8, [rsp + 0x48]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140003a30
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400021f4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002248
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x20]
mov r14, rbp
cmp rbp, rdi
je 0x1400022d6
nop dword [rax]
mov rbx, qword [0x14000bae8]
mov r8d, dword [r14]
mov rdx, rbx
mov rcx, qword [0x14000bae0]
call fcn.140004070
cmp rax, rbx
jne 0x1400022cd
mov r8d, dword [r14]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400022cd
lea rcx, [0x140006990]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400022c4
lea rdx, str.NtTerminateProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400022c4
xor edx, edx
mov rcx, rbx
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add r14, 4
cmp r14, rdi
jne 0x140002260
sub rdi, rbp
sar rdi, 2
mov r8, rdi
mov rdx, rbp
call fcn.1400035b0
nop
test rbp, rbp
je 0x140002328
sub rsi, rbp
and rsi, 0xfffffffffffffffc
mov rax, rbp
cmp rsi, 0x1000
jb 0x14000231d
add rsi, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000231d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rsi
mov rcx, rbp
call fcn.1400043cc
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140004130
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140003ee0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140003f41
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140003f00
mov ecx, dword [r9]
jmp 0x14000402b
cmp ecx, 0x4e0
jb 0x14000402b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140003f60
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140003fb0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140004cec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004d36
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004d36
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004d36
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004d36
cmp dword [rcx + 0x84], 0xe
jbe 0x140004d36
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004d38
xor al, al
add rsp, 0x28
ret
Function at 0x140017a50
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rsi
push rdi
sub rsp, 0xc88
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0xc60], rax
mov rdi, r8
mov rsi, rcx
cmp edx, dword [rcx + 0x10]
jg 0x140017c31
cmp byte [rcx + 9], 0
jne 0x140017a9a
cmp byte [rcx + 0xa], 0
jne 0x140017a9a
cmp byte [rcx + 8], 0
je 0x140017c31
mov qword [rsp + 0xc80], rbx
xor ecx, ecx
mov qword [rsp + 0xc78], rbp
lea rbp, [rsp + 0xcb8]
call fcn.14013a0f0
lea rcx, [rsi + 0x328]
cmp rax, qword [rcx]
je 0x140017ad8
mov qword [rcx], rax
call fcn.14014b708
mov rdx, rax
mov rcx, rsi
call fcn.1400769f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140019de0
mov qword [rsp + 0x28], rbp
lea rdx, [rsp + 0x50]
xor ebp, ebp
mov r9, rdi
mov r8d, 0x400
mov qword [rsp + 0x20], rbp
mov rcx, qword [rax]
or rcx, 1
call fcn.1401430f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x140017b8f
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0x860]
mov dword [rsp + 0x28], 0x400
mov r9d, 0x400
mov r8d, ebx
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140017b62
mov r8d, ebx
lea rdx, str.error_code_0x_08X
lea rcx, [rsp + 0x860]
call fcn.14002c330
lea r8, [0x1401ceea4]
mov edx, 0x801
lea rcx, [rsp + 0x50]
call fcn.14013a030
lea r8, [rsp + 0x860]
mov edx, 0x801
lea rcx, [rsp + 0x50]
call fcn.14013a030
cmp byte [rsi + 9], bpl
je 0x140017ba0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rbx, 0xffffffffffffffff
cmp byte [rsi + 0xa], bpl
je 0x140017be4
lea rax, [rsp + 0x50]
mov rdi, rbx
inc rdi
cmp byte [rax + rdi], bpl
jne 0x140017bb5
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
cmp byte [rsi + 8], bpl
je 0x140017c21
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x140017c21
lea rax, [rsp + 0x50]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], bpl
jne 0x140017c00
mov r8, rbx
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0xc80]
mov rbp, qword [rsp + 0xc78]
mov rcx, qword [rsp + 0xc60]
xor rcx, rsp
call fcn.1401312c0
add rsp, 0xc88
pop rdi
pop rsi
ret
Function at 0x140017c50
Capabilities:
Check os version
Create process on windows

Disassembly:
sub rsp, 0x258
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x90], __WSAFDIsSet
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x94], 6
jb 0x140017d00
mov r8d, 0x104
lea rdx, [rsp + 0x130]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rsp + 0x20], WSACleanup
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x130]
mov qword [rsp + 0x38], rax
lea rax, str._softwarecad
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401312c0
add rsp, 0x258
ret
Function at 0x14001a9a0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
lea rax, vtable.DeskDupEngine.0
mov qword [rcx], rax
xor esi, esi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rsi
mov qword [rcx + 0x20], rsi
mov qword [rcx + 0x70], rsi
mov qword [rcx + 0x78], rsi
mov qword [rcx + 0x80], rsi
mov qword [rcx + 0x88], rsi
mov byte [rcx + 0x2d], 1
mov qword [rcx + 0x30], rsi
mov qword [rcx + 0x38], rsi
mov qword [rcx + 0x40], rsi
mov qword [rcx + 0x48], rsi
mov qword [rcx + 0x50], rsi
mov qword [rcx + 0x58], rsi
mov qword [rcx + 0x60], rsi
mov qword [rcx + 0x68], rsi
lea edi, [rsi + 4]
mov r8w, 3
mov dx, 1
mov cx, 5
call fcn.140026d50
mov ecx, 5
test al, al
cmovne edi, ecx
xor r8d, r8d
xor edx, edx
mov cx, 6
call fcn.140026d50
mov ecx, 6
test al, al
cmovne edi, ecx
xor r8d, r8d
lea edx, [rsi + 2]
call fcn.140026d50
test al, al
je 0x14001ab88
mov dword [rbx + 8], 0xa
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14001aab5
lea edx, [rsi + 0x5c]
lea rcx, [rsp + 0x30]
call fcn.140133228
test rax, rax
je 0x14001ab99
mov byte [rax], sil
lea r8, str.ddengine64.dll
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.14013a030
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbx + 0x30], rax
test rax, rax
je 0x14001ab82
lea rdx, str.StartW8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x38], rax
lea rdx, str.StartW8V2
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x40], rax
lea rdx, str.StopW8
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x48], rax
lea rdx, str.LockW8
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x50], rax
lea rdx, str.UnlockW8
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x58], rax
lea rdx, str.ShowCursorW8
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x60], rax
lea rdx, str.HideCursorW8
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x68], rax
cmp qword [rbx + 0x38], rsi
je 0x14001ab82
cmp qword [rbx + 0x48], rsi
je 0x14001ab82
cmp qword [rbx + 0x50], rsi
je 0x14001ab82
cmp qword [rbx + 0x58], rsi
je 0x14001ab82
cmp qword [rbx + 0x60], rsi
je 0x14001ab82
test rax, rax
jne 0x14001ab8b
mov byte [rbx + 0x2d], sil
jmp 0x14001ab8b
mov dword [rbx + 8], edi
mov qword [rbx + 0x90], rsi
mov qword [rbx + 0x98], rsi
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1401312c0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14001b6c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x38
mov rbx, rdx
lea rax, [rsp + 0x68]
xor edi, edi
mov qword [rsp + 0x20], rax
lea rdx, str.SystemCurrentControlSetControlProductOptions
mov qword [rsp + 0x68], rdi
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14001b842
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.ProductSuite
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x50], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001b837
mov ecx, dword [rsp + 0x50]
mov qword [rsp + 0x30], rsi
call fcn.14013132c
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x60]
mov rsi, rax
lea rdx, str.ProductSuite
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001b82a
mov rdi, rsi
cmp byte [rsi], al
je 0x14001b82a
nop word [rax + rax]
lea rdx, str.Terminal_Server
mov rcx, rdi
call fcn.140143c30
test eax, eax
jne 0x14001b7ac
or dword [rbx + 0x130], 0x10
jmp 0x14001b811
lea rdx, [0x1401c3720]
mov rcx, rdi
call fcn.140143c30
test eax, eax
je 0x14001b80a
lea rdx, str.Small_Business
mov rcx, rdi
call fcn.140143c30
test eax, eax
je 0x14001b80a
lea rdx, str.Enterprise
mov rcx, rdi
call fcn.140143c30
test eax, eax
jne 0x14001b7ee
or dword [rbx + 0x130], 2
jmp 0x14001b811
lea rdx, str.Personal
mov rcx, rdi
call fcn.140143c30
test eax, eax
jne 0x14001b811
or dword [rbx + 0x130], 0x40
jmp 0x14001b811
or dword [rbx + 0x130], 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cdqe
add rdi, rax
cmp byte [rdi], 0
jne 0x14001b790
mov rcx, rsi
call fcn.1401312e0
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x14001e420
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x2c0
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rbx, rcx
lea rdx, [rsp + 0x1a0]
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [0x140195cc0]
mov edx, 0x104
lea rcx, [rsp + 0x90]
call fcn.140139fd0
lea r8, [0x1401c48a4]
mov edx, 0x104
lea rcx, [rsp + 0x90]
call fcn.14013a030
mov r8, rbx
lea rcx, [rsp + 0x90]
mov edx, 0x104
call fcn.14013a030
xorps xmm0, xmm0
xor ebx, ebx
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSACleanup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1401312c0
add rsp, 0x2c0
pop rbx
ret
Function at 0x1400204e0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSACleanup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [0x140195d18]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1401312c0
add rsp, 0x1b8
ret

Function at 0x1400205b0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSACleanup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [0x140195d00]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1401312c0
add rsp, 0x1b8
ret

Function at 0x140020680
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSACleanup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [0x140195ce0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1401312c0
add rsp, 0x1b8
ret
Function at 0x140020750
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSACleanup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [0x140195cd0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1401312c0
add rsp, 0x1b8
ret

Function at 0x140020820
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], WSACleanup
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [0x140195cf0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1401312c0
add rsp, 0x1b8
ret