joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800352f0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov ebp, r8d
mov rsi, rdx
mov edi, ecx
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x24]
call fcn.180113150
xor edx, edx
mov dword [rsp + 0x20], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180035381
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180035378
nop dword [rax]
cmp edi, dword [rsp + 0x28]
je 0x1800353a6
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180035360
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
pop rsi
pop rbp
ret
lea edx, [rbp - 1]
mov rcx, rsi
lea r8, [rsp + 0x4c]
call fcn.1801259f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x180035383

Function at 0x1800353d0
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov ebp, r8d
mov r14, rdx
mov ebx, ecx
test ecx, ecx
jne 0x1800353ff
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov r8d, ebx
mov qword [rsp + 0x38], rdi
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x180035434
mov r8d, ebx
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x18003544a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rcx, rdi
cmp ebx, eax
je 0x18003546a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, ebp
mov rdx, r14
mov ecx, ebx
call fcn.1800351a0
test eax, eax
jne 0x1800354ca
mov r8d, ebp
mov rdx, r14
mov ecx, ebx
call fcn.1800352f0
jmp 0x1800354ca
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, r14
xor edx, edx
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov esi, eax
test eax, eax
jne 0x180035494
mov r8d, ebp
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x1800354c3
mov r8d, ebp
mov rdx, r14
mov ecx, ebx
call fcn.1800351a0
mov esi, eax
test eax, eax
jne 0x1800354c3
mov r8d, ebp
mov rdx, r14
mov ecx, ebx
call fcn.1800352f0
mov esi, eax
mov eax, esi
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180035520
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
mov edi, 0xffffffff
call fcn.180113150
xor edx, edx
mov dword [rsp + 0x20], 0x238
lea ecx, [rdi + 3]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800355c2
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1800355b9
nop dword [rax]
lea rdx, [rsp + 0x4c]
mov rcx, rsi
call fcn.1801153c8
test eax, eax
je 0x1800355b5
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180035590
jmp 0x1800355b9
mov edi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1800355f0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xf0
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x74]
lea r8d, [rdx + 0x64]
call fcn.180113150
xor eax, eax
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x50], rax
xor r9d, r9d
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov qword [rsp + 0x60], rax
xor edx, edx
lea rax, [rsp + 0x50]
mov rcx, rbx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0xf0
pop rbx
ret

Function at 0x1800356b0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xf0
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov ebx, edx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x74]
lea r8d, [rdx + 0x64]
call fcn.180113150
xor eax, eax
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x50], rax
xor r9d, r9d
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov qword [rsp + 0x60], rax
mov rdx, rdi
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x18003573e
xor eax, eax
jmp 0x18003574e
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x110]
add rsp, 0xf0
pop rdi
ret
Function at 0x180035770
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor ebp, ebp
mov ebx, r8d
mov esi, edx
mov dword [rsp + 0x68], ebp
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x74]
lea r8d, [rbp + 0x64]
call fcn.180113150
xor eax, eax
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x50], rax
xor r9d, r9d
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov qword [rsp + 0x60], rax
mov rdx, rdi
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x180035847
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x180035847
test esi, esi
je 0x180035838
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x68]
jmp 0x18003584c
mov eax, 0xffffffff
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x118]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
Function at 0x180035910
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
mov eax, 0x4250
call fcn.180110950
sub rsp, rax
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x4240], rax
mov dword [rsp + 0x20], 0
mov r15d, edx
mov r14, rcx
test rcx, rcx
je 0x1800359ff
lea r8, [rsp + 0x20]
mov edx, 0x4000
lea rcx, [rsp + 0x30]
call qword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x1800359ff
mov ebp, dword [rsp + 0x20]
xor edi, edi
shr ebp, 2
test ebp, ebp
je 0x1800359ff
lea rsi, [rsp + 0x30]
nop dword [rax]
mov r8d, dword [rsi]
xor edx, edx
mov ecx, 0x411
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1800359f5
xor edx, edx
lea rcx, [rsp + 0x4030]
mov r8d, 0x208
call fcn.180113150
mov r9d, 0x104
lea r8, [rsp + 0x4030]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov rdx, r14
lea rcx, [rsp + 0x4030]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180035a2e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
add rsi, 4
cmp edi, ebp
jb 0x180035990
xor eax, eax
mov rcx, qword [rsp + 0x4240]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x4250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
test r15d, r15d
je 0x180035a73
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [rsp + 0x24]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x180035a68
mov edx, 0x1f4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x180035a01

Function at 0x180035b40
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
call fcn.180113150
xor esi, esi
mov dword [rsp + 0x20], 0x238
xor edx, edx
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180035bb2
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x180035bc0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x180035bf5
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call fcn.1801153c8
test eax, eax
je 0x180035be5
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180035bc0
jmp 0x180035bea
mov esi, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180035c20
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x40
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbp, r8
mov rbx, rdx
mov esi, 1
test rcx, rcx
jne 0x180035c4e
xor eax, eax
jmp 0x180035d69
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x38], r14
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r14, rax
test rax, rax
jne 0x180035c7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ParseCommnadLine:_szArglist_NULL_err_x
call sym.SafeBase64.dll_DbgPrintW
jmp 0x180035d62
mov r8, qword [rax]
mov edx, 0x1ff
mov rcx, rbx
call fcn.1801259f0
mov r9d, dword [rsp + 0x20]
cmp r9d, 2
jl 0x180035d62
mov r8, qword [r14 + 8]
lea rcx, str.ParseCommnadLine:_arg_0__s__arg_1__s__arc_d
mov rdx, qword [r14]
mov qword [rsp + 0x78], rdi
lea rdi, [r14 + 8]
call sym.SafeBase64.dll_DbgPrintW
mov ecx, dword [rsp + 0x20]
mov ebx, esi
cmp ecx, ebx
jle 0x180035d54
mov qword [rsp + 0x30], r15
mov r15d, 0xfffd
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdi]
movzx eax, word [rdx]
sub ax, 0x2d
test r15w, ax
jne 0x180035d32
lea rcx, [rdx + 2]
lea rdx, [0x180159970]
call fcn.1801153c8
test eax, eax
je 0x180035d2b
mov rcx, qword [rdi]
lea rdx, [0x180159978]
add rcx, 2
call fcn.1801153c8
test eax, eax
je 0x180035d2b
mov ecx, dword [rsp + 0x20]
inc ebx
add rdi, 8
cmp ebx, ecx
jl 0x180035ce0
jmp 0x180035d4f
mov esi, 5
jmp 0x180035d4f
cmp ebx, ecx
jge 0x180035d4f
movsxd r8, ebx
mov edx, 0x1ff
mov rcx, rbp
mov r8, qword [r14 + r8*8]
call fcn.1801259f0
mov esi, 3
mov r15, qword [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x38]
mov eax, esi
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x40
pop rsi
pop rbp
pop rbx
ret
Function at 0x180035e10
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x70
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor eax, eax
mov rsi, rcx
lea rcx, [r11 - 0x40]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx edx, word [rsp + 0x38]
lea rcx, str.IsX86Process:_wProcessorArchitecture_x_n
call sym.SafeBase64.dll_DbgPrintW
xor eax, eax
cmp ax, word [rsp + 0x38]
jne 0x180035e80
mov eax, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x70
pop rsi
ret
mov qword [rsp + 0x88], rbx
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov qword [rsp + 0x90], rdi
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, dword [rsp + 0x30]
lea rcx, str.IsX86Process:_bRet_x_Wow64Process_x_hProcess_x_Pid_d_Err_x_n
mov r9, rsi
mov dword [rsp + 0x28], ebx
mov edx, edi
mov dword [rsp + 0x20], eax
call sym.SafeBase64.dll_DbgPrintW
mov eax, dword [rsp + 0x30]
mov rdi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x70
pop rsi
ret

Function at 0x180035f00
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x70
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r8d, ecx
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x180035f40
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x70
pop rsi
ret
xor eax, eax
mov qword [rsp + 0x88], rbx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx edx, word [rsp + 0x38]
lea rcx, str.IsX86Process:_wProcessorArchitecture_x_n
call sym.SafeBase64.dll_DbgPrintW
xor eax, eax
cmp ax, word [rsp + 0x38]
jne 0x180035f92
lea ebx, [rax + 1]
jmp 0x180035fe6
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x90], rdi
mov rcx, rsi
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, dword [rsp + 0x30]
lea rcx, str.IsX86Process:_bRet_x_Wow64Process_x_hProcess_x_Pid_d_Err_x_n
mov r9, rsi
mov dword [rsp + 0x28], ebx
mov edx, edi
mov dword [rsp + 0x20], eax
call sym.SafeBase64.dll_DbgPrintW
mov ebx, dword [rsp + 0x30]
mov rdi, qword [rsp + 0x90]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x70
pop rsi
ret
Function at 0x180036090
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r8, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
test rax, rax
je 0x1800360cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1800360cc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1800360e0
Capabilities:
Get process image filename

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x240
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbp, rdx
mov edi, ecx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.180113150
test edi, edi
je 0x18003625d
mov r8d, edi
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x18003614c
mov r8d, edi
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1800361b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rcx, rbx
cmp edi, eax
je 0x180036164
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800361b0
mov r9d, 0x104
mov qword [rsp + 0x270], rsi
lea r8, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov esi, eax
test eax, eax
jne 0x18003619b
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
mov esi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
mov rsi, qword [rsp + 0x270]
jne 0x1800361e0
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov ecx, edi
call fcn.1800351a0
test eax, eax
jne 0x1800361e0
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov ecx, edi
call fcn.1800352f0
test eax, eax
je 0x18003625d
lea rcx, [rsp + 0x20]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1800361f0
lea rcx, [rsp + 0x20]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x20]
cmp rcx, rax
je 0x18003624a
movabs r8, 0x200000000801
nop dword [rax]
movzx eax, word [rcx - 2]
mov rdx, rcx
sub rcx, 2
sub ax, 0x2f
cmp ax, 0x2d
ja 0x18003623b
bt r8, rax
jb 0x180036247
lea rax, [rsp + 0x20]
cmp rcx, rax
jne 0x180036220
jmp 0x18003624a
mov rcx, rdx
mov rdx, rbp
call fcn.1801153c8
test eax, eax
jne 0x18003625d
mov eax, 1
jmp 0x18003625f
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x240
pop rdi
pop rbp
pop rbx
ret
Function at 0x18003a500
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
mov r10d, dword [rcx]
mov rbx, rdx
mov eax, dword [rcx + 4]
mov r11, rcx
test r8d, r8d
je 0x18003a56a
mov qword [rsp + 0x10], rdi
mov edi, r8d
nop dword [rax + rax]
inc r10b
lea rbx, [rbx + 1]
movzx r10d, r10b
movzx r9d, byte [r10 + r11 + 8]
add al, r9b
movzx eax, al
movzx edx, byte [rax + r11 + 8]
mov byte [r10 + r11 + 8], dl
add dl, r9b
mov byte [rax + r11 + 8], r9b
movzx ecx, dl
movzx edx, byte [rcx + r11 + 8]
xor byte [rbx - 1], dl
sub rdi, 1
jne 0x18003a520
mov rdi, qword [rsp + 0x10]
mov dword [r11], r10d
mov dword [r11 + 4], eax
pop rbx
ret
mov dword [rcx], r10d
mov dword [rcx + 4], eax
pop rbx
ret

Function at 0x18003a580
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x90]
lea rax, [rsp + 0x30]
xor edi, edi
mov qword [rsp + 0x20], rax
mov rsi, r9
mov qword [rsp + 0x30], rdi
mov rbx, r8
xor r8d, r8d
lea r9d, [rdi + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18003a5cc
xor eax, eax
jmp 0x18003a5ff
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rbp
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete dil
mov eax, edi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x18003a620
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0xc0]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
xor edi, edi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x38], rax
mov esi, r9d
mov qword [rsp + 0x30], rdi
mov rbx, r8
mov dword [rsp + 0x28], 0x20006
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x18003a686
xor eax, eax
jmp 0x18003a6bf
mov ecx, dword [rsp + 0xc8]
mov r9d, esi
mov dword [rsp + 0x28], ecx
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete dil
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18003a6e0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
lea rax, [rsp + 0x30]
xor edi, edi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov r9d, 0x20007
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18003a724
xor eax, eax
jmp 0x18003a747
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete dil
mov eax, edi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18003a760
Capabilities:
Delete registry key

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov rsi, r8
lea rcx, str.Advapi32.dll
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RegRenameKey
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18003a7ad
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
lea r8, [rsp + 0x20]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov r8, qword [rsp + 0x20]
xor r9d, r9d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_SHCopyKeyW]
mov r8d, eax
test eax, eax
jne 0x18003a7e8
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov r8d, eax
xor eax, eax
test r8d, r8d
sete al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x18003ac00
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x38], eax
mov rbx, rdx
mov qword [rsp + 0x30], rax
mov rdx, rcx
lea rax, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18003ac85
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x38]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x50
pop rbx
ret

Function at 0x18003ad00
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x268
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
mov rbp, r9
call fcn.180113150
mov r9, rbx
mov qword [rsp + 0x20], rdi
lea r8, [0x180154c70]
mov edx, 0x103
lea rcx, [rsp + 0x40]
call fcn.18000f870
xor edi, edi
mov dword [rsp + 0x38], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000001
lea r9d, [rdi + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18003adc6
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete dil
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x268
pop rdi
pop rsi
pop rbp
pop rbx
ret