joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001e70c
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get common file path
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xae8
mov rax, qword [0x180071080]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov rsi, qword [rsp + 0xb30]
mov rdi, rcx
mov rcx, qword [rsp + 0xb38]
mov qword [rsp + 0x40], rcx
xor ecx, ecx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x48], r8
mov dword [rsp + 0x30], edx
cmp r8, rcx
jne 0x18001e760
cmp rsi, rcx
je 0x18001e919
cmp word [rdi + 2], 0x3a
je 0x18001e7b7
cmp word [rdi + 2], 0x5c
je 0x18001e7b7
mov word [rsp + 0x6c0], cx
lea rcx, [rsp + 0x6c2]
xor edx, edx
mov r8d, 0x40e
call fcn.18003e8c0
lea rdx, [rsp + 0x6c0]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rsp + 0x6c0]
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdi, [rsp + 0x6c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18001e919
test al, 0x10
je 0x18001e919
lea rcx, [rsp + 0x4b0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x18005c730]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x18001e919
mov ebx, 1
lea rdx, [0x18005dd18]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x18001e8f0
lea rdx, [0x18005dd1c]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x18001e8f0
cmp dword [rsp + 0x50], 0xffffffff
je 0x18001e8f0
lea rcx, [rsp + 0x2a0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test byte [rsp + 0x50], 0x10
je 0x18001e8d3
test rsi, rsi
je 0x18001e89e
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x2a0]
call rsi
test eax, eax
je 0x18001e907
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x18001e8f0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x38]
mov r8, qword [rsp + 0x48]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x2a0]
mov edx, eax
mov qword [rsp + 0x20], rsi
call fcn.18001e70c
cmp eax, 2
jmp 0x18001e8ee
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x18001e8f0
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x2a0]
call rax
test eax, eax
je 0x18001e907
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x18001e90c
jmp 0x18001e81c
mov ebx, 2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
jmp 0x18001e91b
xor eax, eax
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.18003c160
add rsp, 0xae8
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18001e938
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x740
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x180071080]
xor rax, rsp
mov qword [rsp + 0x730], rax
mov rdi, r9
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x50], rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
lea rcx, [rsp + 0x60]
call fcn.180004040
nop
cmp rbp, r12
jne 0x18001e9ae
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1800040b0
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x60]
call fcn.180004130
mov rax, rbx
jmp 0x18001eb12
mov rdx, rbp
lea rcx, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, rdi
lea rcx, [rsp + 0x520]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18001eaf0
lea rdx, [0x18005dd18]
lea rcx, [rsp + 0xec]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, r12d
je 0x18001eacd
lea rdx, [0x18005dd1c]
lea rcx, [rsp + 0xec]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, r12d
je 0x18001eacd
cmp dword [rsp + 0xc0], 0xffffffff
je 0x18001eacd
mov rdx, rbp
lea rcx, [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xec]
lea rcx, [rsp + 0x310]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x310]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0x28]
call fcn.180005ca0
nop
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x60]
call fcn.180008480
nop
cmp qword [rsp + 0x48], 8
jb 0x18001eacd
mov rcx, qword [rsp + 0x30]
call fcn.18003c784
lea rdx, [rsp + 0xc0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r12d
jne 0x18001e9f3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1800040b0
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x60]
call fcn.180004130
mov rax, rbx
mov rcx, qword [rsp + 0x730]
xor rcx, rsp
call fcn.18003c160
add rsp, 0x740
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18001eb34
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x180071080]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor edi, edi
mov rbx, rcx
cmp rcx, rdi
je 0x18001ec42
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jge 0x18001ec42
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], di
call fcn.18003e8c0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.18001fce8
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18001ebb3
shr eax, 4
not eax
and eax, 1
jmp 0x18001ec44
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x250]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rsp + 0x250]
call fcn.18001ec68
cmp eax, edi
je 0x18001ec42
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, rdi
je 0x18001ec20
mov ecx, 1
cmp rax, 0xffffffffffffffff
jne 0x18001ec22
mov ecx, edi
cmp cl, dil
mov ebx, edi
setne bl
cmp rax, 0xffffffffffffffff
je 0x18001ec3e
cmp rax, rdi
je 0x18001ec3e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x18001ec44
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18003c160
mov rbx, qword [rsp + 0x488]
add rsp, 0x470
pop rdi
ret
Function at 0x18001f3f0
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
sub rsp, 0xad0
mov rax, qword [0x180071080]
xor rax, rsp
mov qword [rsp + 0xac0], rax
xor esi, esi
mov rbx, rcx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
cmp rcx, rsi
je 0x18001f5ac
lea r12, [fcn.18001f5dc]
cmp r12, rsi
je 0x18001f5ac
cmp word [rcx + 2], 0x3a
je 0x18001f498
cmp word [rcx + 2], 0x5c
je 0x18001f498
lea rcx, [r11 - 0x426]
xor edx, edx
mov r8d, 0x40e
mov word [rsp + 0x6b0], si
call fcn.18003e8c0
lea rdx, [rsp + 0x6b0]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rsp + 0x6b0]
mov rdx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rbx, [rsp + 0x6b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18001f5ac
test al, 0x10
je 0x18001f5ac
lea rcx, [rsp + 0x4a0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x18005c730]
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18001f5ac
lea rdx, [0x18005dd18]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, esi
je 0x18001f58d
lea rdx, [0x18005dd1c]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, esi
je 0x18001f58d
cmp dword [rsp + 0x40], 0xffffffff
je 0x18001f58d
lea rcx, [rsp + 0x290]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x290]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test byte [rsp + 0x40], 0x10
lea rcx, [rsp + 0x290]
je 0x18001f57f
lea r9, [rsp + 0x30]
mov r8, r12
mov edx, 1
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call fcn.18001e70c
cmp eax, 2
jmp 0x18001f58b
lea rdx, [rsp + 0x30]
call fcn.18001f5dc
cmp eax, esi
je 0x18001f5a3
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, esi
jne 0x18001f4f8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xac0]
xor rcx, rsp
call fcn.18003c160
lea r11, [rsp + 0xad0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x18001f60c
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2070
call fcn.1800517b0
sub rsp, rax
mov rax, qword [0x180071080]
xor rax, rsp
mov qword [rsp + 0x2060], rax
xor esi, esi
mov rbx, rdx
mov rdi, rcx
cmp rcx, rsi
je 0x18001f7d9
cmp rdx, rsi
je 0x18001f7d9
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
jne 0x18001f664
mov esi, 1
jmp 0x18001f7d9
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x28], esi
mov rdi, rax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rdi, rsi
je 0x18001f7b1
cmp rdi, 0xffffffffffffffff
je 0x18001f7b1
cmp rax, rsi
je 0x18001f7b1
cmp rax, 0xffffffffffffffff
je 0x18001f7c5
xor eax, eax
lea rdx, [rsp + 0x50]
mov rcx, rdi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x4c], eax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, esi
je 0x18001f71c
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, esi
je 0x18001f71c
mov rax, qword [rsp + 0x48]
cmp qword [rsp + 0x50], rax
je 0x18001f72a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18001f7d0
mov dword [rsp + 0x40], esi
jmp 0x18001f780
mov r8d, dword [rsp + 0x40]
cmp r8d, esi
je 0x18001f7a7
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x1060]
mov rcx, rbx
mov dword [rsp + 0x44], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, esi
je 0x18001f71c
mov eax, dword [rsp + 0x40]
cmp eax, dword [rsp + 0x44]
jne 0x18001f71c
lea rdx, [rsp + 0x1060]
lea rcx, [rsp + 0x60]
mov r8, rax
call fcn.180048a20
cmp eax, esi
jne 0x18001f71c
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov r8d, 0x1000
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, esi
jne 0x18001f730
jmp 0x18001f71c
mov esi, 1
jmp 0x18001f71c
cmp rax, 0xffffffffffffffff
je 0x18001f7c5
cmp rax, rsi
je 0x18001f7c5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, 0xffffffffffffffff
je 0x18001f7d9
cmp rdi, rsi
je 0x18001f7d9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.18003c160
lea r11, [rsp + 0x2070]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18001f8c8
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov ebp, r8d
mov r12, rdx
mov rdi, rcx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
test eax, eax
jne 0x18001f901
xor edx, edx
mov rcx, rdi
call fcn.18001eb34
test eax, eax
je 0x18001f9ad
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
test rax, rax
je 0x18001f98c
cmp rax, 0xffffffffffffffff
je 0x18001f98c
and dword [rsp + 0x78], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, ebp
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18001f96f
cmp dword [rsp + 0x78], ebp
jne 0x18001f96f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x18001f9af
test esi, esi
jne 0x18001f999
mov rcx, rbx
or rbx, 0xffffffffffffffff
cmp rcx, rbx
je 0x18001f990
test rcx, rcx
je 0x18001f990
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18001f990
test esi, esi
jne 0x18001f999
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp rbx, 0xffffffffffffffff
je 0x18001f9ad
test rbx, rbx
je 0x18001f9ad
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret

Function at 0x18001fc58
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x180071080]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x21]
xor ebx, ebx
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], bl
call fcn.18003e8c0
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.18001fb48
mov r11d, 0x179b06cc
movzx edx, byte [rsp + rbx + 0x20]
movzx eax, r11b
mov ecx, r11d
xor rdx, rax
shr ecx, 8
lea rax, [0x180073760]
mov r11d, dword [rax + rdx*4]
inc rbx
xor r11d, ecx
cmp rbx, 0x24
jl 0x18001fca0
not r11d
mov eax, r11d
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18003c160
add rsp, 0x140
pop rbx
ret

Function at 0x18001fdd4
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x180071080]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x18001fe6b
test rdx, rdx
je 0x18001fe6b
mov ecx, 0x3a
cmp word [rbx + 2], cx
jne 0x18001fe6b
movzx eax, word [rbx]
mov word [rsp + 0x22], cx
lea rdx, [rsp + 0x30]
mov word [rsp + 0x20], ax
xor eax, eax
lea rcx, [rsp + 0x20]
mov r8d, 0x208
mov dword [rsp + 0x24], eax
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x18001fe6b
lea rdx, [rbx + 4]
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call qword [sym.imp.SHLWAPI.dll_StrNCatW]
lea rdx, [rsp + 0x30]
mov r8d, 0x208
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, 1
jmp 0x18001fe6d
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18003c160
mov rbx, qword [rsp + 0x470]
add rsp, 0x450
pop rdi
ret
Function at 0x18001fe90
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x180071080]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov ebx, ecx
mov rdi, rdx
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x434
call fcn.18003e8c0
mov edx, ebx
mov ecx, 8
mov dword [rsp + 0x20], 0x438
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
test rax, rax
je 0x18001ff19
cmp rax, 0xffffffffffffffff
je 0x18001ff2d
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Module32FirstW
jmp 0x18001ff15
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.180020424
test eax, eax
je 0x18001ff19
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x18001fef7
cmp rbx, 0xffffffffffffffff
je 0x18001ff2d
test rbx, rbx
je 0x18001ff2d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18003c160
mov rbx, qword [rsp + 0x490]
add rsp, 0x470
pop rdi
ret

Function at 0x18001ff50
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x180071080]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
test rax, rax
je 0x18001ffd5
cmp rax, 0xffffffffffffffff
je 0x18001ffe9
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x234
mov dword [rsp + 0x20], 0x238
call fcn.18003e8c0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32FirstW
jmp 0x18001ffd1
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.1800203c0
test eax, eax
je 0x18001ffd5
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x18001ffb3
cmp rbx, 0xffffffffffffffff
je 0x18001ffe9
test rbx, rbx
je 0x18001ffe9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18003c160
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret

Function at 0x18002000c
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xe0
xor ebx, ebx
mov rdi, rcx
cmp rcx, rbx
jne 0x18002002a
xor eax, eax
jmp 0x1800200b4
xor edx, edx
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x70], 0x68
lea r8d, [rdx + 0x60]
call fcn.18003e8c0
xor eax, eax
mov rcx, rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
call fcn.18001e6c0
xor r9d, r9d
xor r8d, r8d
mov rdi, rax
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rdx, rdi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebx
je 0x1800200a9
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.18003dd10
mov rax, rbx
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rdi
ret
Function at 0x1800201fc
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x100
mov rsi, rcx
call fcn.1800200c8
xor edi, edi
mov dword [rsp + 0x60], eax
lea rax, [fcn.1800203c0]
mov dword [rsp + 0x64], edi
mov dword [rsp + 0x68], edi
cmp rax, rdi
je 0x1800203a7
lea rcx, [rsp + 0x60]
call fcn.18001ff50
cmp dword [rsp + 0x68], edi
je 0x1800203a7
mov r8d, dword [rsp + 0x64]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
cmp rax, rdi
je 0x180020393
cmp rax, 0xffffffffffffffff
je 0x1800203a7
lea r8, [rsp + 0x70]
mov edx, 0xf01ff
mov rcx, rax
mov qword [rsp + 0x70], rdi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, edi
je 0x180020385
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x60], rdi
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
cmp eax, edi
je 0x18002037a
mov rcx, rsi
call fcn.18001e6c0
lea r8d, [rdi + 0x60]
lea rcx, [rsp + 0x98]
xor edx, edx
mov dword [rsp + 0x90], 0x68
mov rsi, rax
call fcn.18003e8c0
mov rcx, qword [rsp + 0x70]
lea eax, [rdi + 5]
mov word [rsp + 0xd0], ax
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x90]
mov r8, rsi
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x420
xor edx, edx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0xcc], 1
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp eax, edi
je 0x180020367
mov rcx, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.18003dd10
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
jmp 0x1800203a9
cmp rax, 0xffffffffffffffff
je 0x1800203a7
cmp rax, rdi
je 0x1800203a7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x180020cd0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
sub rsp, 0x38
lea rax, [r11 + 0x20]
mov r9d, 4
mov rcx, 0xffffffff80000002
mov dword [r11 - 0x10], r9d
mov qword [r11 - 0x18], rax
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor ecx, ecx
cmp eax, ecx
sete cl
mov eax, ecx
add rsp, 0x38
ret
Function at 0x180020d08
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x180071080]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor ebx, ebx
mov rdi, r9
mov rbp, r8
mov rsi, rdx
cmp r9, rbx
je 0x180020d3e
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x180020d40
mov eax, ebx
lea ecx, [rax + rax + 2]
mov r9d, 1
mov r8, rbp
mov dword [rsp + 0x28], ecx
mov rcx, 0xffffffff80000002
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp eax, ebx
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18003c160
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x180020d88
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x868
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x180071080]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov r12, r9
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rcx + 0x20], 7
mov qword [rcx + 0x18], r13
mov word [rcx + 8], r13w
mov dword [rsp + 0x38], 1
mov rsi, r13
cmp r8, r13
je 0x180020ef8
mov word [rsp + 0x50], r13w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0x52]
call fcn.18003e8c0
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x34], r13d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x34]
mov r8, r12
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [rsp + 0x34], 1
je 0x180020e48
cmp dword [rsp + 0x34], 2
jne 0x180020ef8
mov eax, dword [rsp + 0x30]
cmp eax, r13d
je 0x180020ef8
cmp eax, 0x800
jbe 0x180020e9e
lea rcx, [rax + 2]
call fcn.18003dc58
mov rsi, rax
mov r8d, dword [rsp + 0x30]
add r8, 2
xor edx, edx
mov rcx, rax
call fcn.18003e8c0
lea r11, [rsp + 0x30]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, r12
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
jmp 0x180020ec4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, r12
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea rdx, [rsp + 0x50]
cmp rsi, r13
cmovne rdx, rsi
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.180005ca0
cmp rsi, r13
je 0x180020ef8
mov rcx, rsi
call fcn.18003dd10
mov rax, rbx
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.18003c160
add rsp, 0x868
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret