joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002b360
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xe0
mov rbx, rcx
mov edi, 0x68
lea rcx, [rsp + 0x70]
mov r8d, edi
xor edx, edx
call fcn.18002ec70
xor eax, eax
lea ecx, [rdi - 0x67]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], edi
xor edi, edi
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov dword [rsp + 0xac], ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ecx
lea rdx, [rbx + 0xc]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov word [rsp + 0xb0], di
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x18002b3ed
mov ebx, edi
jmp 0x18002b3f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x18002b40f
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov r8d, ebx
xor edx, edx
mov cl, reloc.WS2_32.dll_inet_addr
call fcn.18002c9d0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rdi
ret

Function at 0x18002b430
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x28
movzx edx, byte [rcx + 5]
mov r8d, 1
dec edx
je 0x18002b46f
dec edx
je 0x18002b468
dec edx
je 0x18002b461
dec edx
je 0x18002b45a
cmp edx, 2
jne 0x18002b483
call fcn.18002b48c
jmp 0x18002b480
call fcn.18002b758
jmp 0x18002b480
call fcn.18002b8dc
jmp 0x18002b480
call fcn.18002b4d8
jmp 0x18002b480
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [0x180050ae0], eax
call fcn.18002ca28
mov r8d, eax
mov eax, r8d
add rsp, 0x28
ret

Function at 0x18002b48c
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rbx, [rcx + 0xc]
mov edx, 0x80
xor edi, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call fcn.18002c38c
test eax, eax
jne 0x18002b4be
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor r9d, r9d
mov r8d, edi
mov dl, 6
mov cl, 3
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18002c9d0
Function at 0x18002b758
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r14, qword [0x180050ad0]
mov rsi, qword [0x180050ad8]
mov rbp, rcx
mov ebx, 1
xor r12d, r12d
add rcx, 0x10
mov qword [rax - 0x38], r12
mov dword [rax - 0x40], 0x80
xor r9d, r9d
mov r8d, ebx
mov edx, 0x80000000
mov dword [rax - 0x48], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18002b7c6
mov dl, 4
mov cl, 3
call fcn.18002c99c
jmp 0x18002b8c3
mov edx, dword [rbp + 0xc]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x18002b8a6
mov rcx, qword [0x180050ad0]
xor edx, edx
mov r8d, 0x800c
call fcn.18002ec70
mov rdx, qword [0x180050ad0]
lea r9, [rsp + 0x70]
add rdx, 0xc
mov r8d, 0x8000
mov rcx, rdi
movzx r15d, r12w
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb ebp, ebp
and ebp, dword [rsp + 0x70]
mov dword [rsp + 0x70], ebp
cmp ebp, 0x8000
jae 0x18002b833
mov r15d, 4
xor eax, eax
mov rcx, r14
mov qword [r14], rax
mov dword [r14 + 8], eax
lea edx, [rax + 0xc]
mov word [r14 + 4], 0x403
mov dword [r14], ebp
mov word [r14 + 6], r15w
call fcn.18002c2a8
lea edx, [rbp + 0xc]
mov word [r14 + 0xa], ax
mov rcx, qword [0x180050ad0]
call fcn.18002e4dc
test eax, eax
jle 0x18002b8b5
xor eax, eax
mov rcx, rsi
mov qword [rsi], rax
lea edx, [rax + 0xc]
mov dword [rsi + 8], eax
call fcn.18002e420
cmp eax, 0xffffffff
je 0x18002b8b5
mov edx, recv
mov rcx, rsi
call fcn.18002c8e4
test eax, eax
je 0x18002b8b8
test byte [rsi + 6], bl
jne 0x18002b8b8
cmp dword [rsp + 0x70], 0x8000
jb 0x18002b8b8
cmp dword [0x180050ab0], r12d
je 0x18002b7dd
jmp 0x18002b8b8
or ebx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x18002b8dc
Capabilities:
Get file size
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rsi, qword [0x180050ad0]
xor r12d, r12d
add rcx, 0xc
mov qword [rax - 0x38], r12
lea r14d, [r12 + 1]
mov dword [rax - 0x40], 0x80
lea r15d, [r12 + 4]
xor r9d, r9d
mov edx, 0x40000000
mov r8d, r14d
mov dword [rax + 8], r12d
mov edi, r14d
mov dword [rax - 0x48], r15d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x18002b949
mov dl, 3
mov cl, dl
call fcn.18002c99c
jmp 0x18002babb
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rsi
mov ebx, eax
xor eax, eax
mov qword [rsi], rax
lea edx, [rax + 0xc]
mov qword [rsi + 4], 0x303
mov dword [rsi], r15d
call fcn.18002c2a8
mov word [rsi + 0xa], ax
mov dword [rsi + 0xc], ebx
mov edx, dword [rsi]
mov rcx, qword [0x180050ad0]
add edx, 0xc
call fcn.18002e4dc
test eax, eax
jg 0x18002b995
or eax, 0xffffffff
jmp 0x18002babb
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x18002ba92
mov rcx, qword [0x180050ad8]
xor edx, edx
mov r8d, 0x800c
call fcn.18002ec70
mov rbx, qword [0x180050ad8]
mov edx, recv
mov rcx, rbx
call fcn.18002e420
cmp eax, 0xffffffff
je 0x18002baad
mov edx, recv
mov rcx, rbx
call fcn.18002c8e4
test eax, eax
je 0x18002baa6
mov edx, dword [rbx]
lea rcx, [rbx + 0xc]
call fcn.18002e420
cmp eax, 0xffffffff
je 0x18002baad
mov rcx, rbx
call fcn.18002c924
test eax, eax
je 0x18002baad
mov r8d, dword [rbx]
lea r9, [rsp + 0x70]
lea rdx, [rbx + 0xc]
mov rcx, rbp
movzx r14d, r12w
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002ba42
mov eax, dword [rbx]
cmp dword [rsp + 0x70], eax
je 0x18002ba4a
mov edi, 1
mov r14d, edi
xor eax, eax
mov rcx, rsi
mov qword [rsi], rax
mov dword [rsi + 8], eax
lea r15d, [rax + 0xc]
mov edx, r15d
mov word [rsi + 4], 0x303
mov dword [rsi], r12d
mov word [rsi + 6], r14w
call fcn.18002c2a8
mov edx, r15d
mov word [rsi + 0xa], ax
mov rcx, qword [0x180050ad0]
call fcn.18002e4dc
test eax, eax
jle 0x18002baad
test r14b, 1
jne 0x18002bab0
test byte [rbx + 6], 4
jne 0x18002baa1
cmp dword [0x180050ab0], r12d
je 0x18002b9ae
jmp 0x18002bab0
mov edi, r12d
jmp 0x18002bab0
mov edi, 1
jmp 0x18002bab0
or edi, 0xffffffff
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x18002bad4
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
cmp eax, dword [0x180050ae0]
je 0x18002baf9
mov dword [0x180050ae0], eax
call fcn.18002ca28
jmp 0x18002bb38
mov rbx, qword [0x180050ad0]
xor eax, eax
xor edi, edi
mov qword [rbx], rax
lea edx, [rax + 0xc]
mov rcx, rbx
mov qword [rbx + 4], 0x20f
mov dword [rbx], edi
call fcn.18002c2a8
mov word [rbx + 0xa], ax
mov rcx, qword [0x180050ad0]
lea edx, [rdi + 0xc]
call fcn.18002e4dc
test eax, eax
setg dil
lea eax, [rdi - 1]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18002bb6c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0xc]
xor edi, edi
call fcn.18002c570
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x18002bba2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x18002bbc2
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x18002bbb9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov r8d, edi
mov dl, 2
mov cl, 5
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18002c9d0
Function at 0x18002bbdc
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x260
mov rbx, qword [0x180050ad0]
xor esi, esi
lea r14, [rbx + 0xc]
mov ebp, esi
call fcn.18002c570
lea ecx, [rsi + 2]
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18002bc2c
mov dl, 1
mov cl, 5
call fcn.18002c99c
jmp 0x18002bd94
mov r15d, 0x238
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, r15d
call fcn.18002ec70
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov dword [rsp + 0x20], r15d
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x18002bc62
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18002bc1e
mov rcx, qword [0x180050ad0]
mov r15d, 0x800c
xor edx, edx
mov r8d, r15d
call fcn.18002ec70
mov eax, dword [rsp + 0x28]
lea rcx, [r14 + 8]
lea rdx, [rsp + 0x4c]
mov dword [r14], eax
mov eax, dword [rsp + 0x40]
mov r8d, 0x3c
mov dword [r14 + 4], eax
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ecx, dword [rsp + 0x28]
lea rdx, [r14 + 0x80]
mov r8d, 0x104
call fcn.18002c604
add ebp, 0x288
add r14, 0x288
mov eax, ebp
add rax, 0x294
cmp rax, r15
jb 0x18002bd40
xor eax, eax
mov rcx, rbx
mov qword [rbx], rax
lea edx, [rax + 0xc]
mov qword [rbx + 4], 0x505
mov dword [rbx], ebp
call fcn.18002c2a8
lea edx, [rbp + 0xc]
mov word [rbx + 0xa], ax
mov rcx, qword [0x180050ad0]
call fcn.18002e4dc
test eax, eax
jle 0x18002bdb1
mov rcx, qword [0x180050ad8]
xor eax, eax
mov qword [rcx], rax
lea edx, [rax + 0xc]
mov dword [rcx + 8], eax
call fcn.18002e420
cmp eax, 0xffffffff
je 0x18002bdb1
mov rcx, qword [0x180050ad0]
mov r8, r15
xor edx, edx
mov ebp, esi
call fcn.18002ec70
mov rbx, qword [0x180050ad0]
lea r14, [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x18002bc79
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, rbx
mov qword [rbx], rax
lea edx, [rax + 0xc]
mov qword [rbx + 4], 0x40105
mov dword [rbx], ebp
call fcn.18002c2a8
lea edx, [rbp + 0xc]
mov word [rbx + 0xa], ax
mov rcx, qword [0x180050ad0]
call fcn.18002e4dc
test eax, eax
setg sil
lea eax, [rsi - 1]
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x18002bd94
Function at 0x18002bdc0
Capabilities:
Get hostname
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, qword [0x180050ad0]
xor eax, eax
mov ebx, 0x88
mov qword [rsi], rax
lea edx, [rax + 0xc]
mov rcx, rsi
mov qword [rsi + 4], 2
mov dword [rsi], ebx
xor ebp, ebp
call fcn.18002c2a8
lea rcx, [rsi + 0xc]
mov r8d, ebx
xor edx, edx
mov word [rsi + 0xa], ax
call fcn.18002ec70
call qword [sym.imp.KERNEL32.dll_GetACP]
mov dword [rsi + 0x18], 0x20008
mov dword [rsi + 0xc], eax
call fcn.18002c74c
lea edx, [rbp + 0x14]
lea rcx, [rsi + 0x1c]
mov dword [rsi + 0x14], eax
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rsi + 0x1c]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx]
mov ecx, dword [rdx]
lea edx, [rbp + 0x64]
mov dword [rsi + 0x10], ecx
lea rcx, [rsi + 0x30]
call fcn.18002c7c4
mov edx, dword [rsi]
mov rcx, qword [0x180050ad0]
add edx, 0xc
call fcn.18002e4dc
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
test eax, eax
setg bpl
mov eax, ebp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x18002c1ec
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x180050ae8]
mov r8d, 0x3e9
test rcx, rcx
je 0x18002c24c
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x180050ae8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x180050af8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x180050af0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [0x180050ae8], 0
and qword [0x180050af8], 0
and qword [0x180050af0], 0
xor r8d, r8d
xor r9d, r9d
mov dl, 2
mov cl, reloc.WS2_32.dll_recv
add rsp, 0x28
jmp fcn.18002c9d0

Function at 0x18002c38c
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x998]
sub rsp, 0xa90
mov rdi, rcx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ebx, ebx
test eax, eax
je 0x18002c554
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x18002c536
lea rcx, [rbp + 0x580]
xor edx, edx
mov r8d, 0x410
call fcn.18002ec70
lea rcx, [rbp + 0x580]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str..
lea rcx, [rbp + 0x580]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x250
call fcn.18002ec70
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x580]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x18002c444
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [rsi + 2]
jmp 0x18002c554
test byte [rsp + 0x20], 0x10
je 0x18002c4bd
lea rdx, [0x18003e5b8]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x18002c50c
lea rdx, [0x18003e5bc]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x18002c50c
lea rcx, [rbp + 0x170]
xor edx, edx
mov r8d, 0x410
call fcn.18002ec70
lea r9, [rsp + 0x4c]
lea rdx, str._s_s
lea rcx, [rbp + 0x170]
mov r8, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x170]
call fcn.18002c38c
jmp 0x18002c50c
lea rcx, [rbp + 0x170]
xor edx, edx
mov r8d, 0x410
call fcn.18002ec70
lea r9, [rsp + 0x4c]
lea rdx, str._s_s
lea rcx, [rbp + 0x170]
mov r8, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x170]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18002c444
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x18002c54d
mov edx, 0x80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov eax, ebx
lea r11, [rsp + 0xa90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18002c570
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
sub rsp, 0x40
and qword [rsp + 0x50], 0
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
lea edx, [rbx + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18002c5e4
lea r8, [rsp + 0x34]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x18002c5e4
mov rcx, qword [rsp + 0x50]
and qword [rsp + 0x28], rbx
and qword [rsp + 0x20], rbx
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x3c], 2
mov dword [rsp + 0x30], 1
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x18002c5ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18002c5fc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x18002c604
Capabilities:
Enumerate process modules

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x3a8]
sub rsp, 0x490
mov edi, r8d
mov rbx, rdx
mov r8d, r8d
mov esi, ecx
xor edx, edx
add r8, r8
mov rcx, rbx
call fcn.18002ec70
xor r15d, r15d
mov rcx, rbx
test esi, esi
jne 0x18002c682
lea r8d, [rdi - 1]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x53005b
mov dword [rsp + 0x24], 0x730079
mov dword [rsp + 0x28], 0x650074
mov dword [rsp + 0x2c], 0x5d006d
mov word [rsp + 0x30], r15w
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x18002c72c
lea r14d, [rdi - 1]
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x38], 0x55005b
mov r8d, r14d
mov dword [rsp + 0x3c], 0x4b004e
mov dword [rsp + 0x40], 0x4f004e
mov dword [rsp + 0x44], 0x4e0057
mov dword [rsp + 0x48], 0x5d
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edx, esi
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18002c72c
mov esi, 0x438
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, esi
call fcn.18002ec70
lea rdx, [rsp + 0x50]
mov rcx, rdi
mov dword [rsp + 0x50], esi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x18002c723
cmp dword [rsp + 0x54], 1
je 0x18002c710
lea rdx, [rsp + 0x50]
mov rcx, rdi
call sub.KERNEL32.dll_Module32NextW
jmp 0x18002c6f6
lea rdx, [rbp + 0x180]
mov r8d, r14d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x490]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18002c74c
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x250
lea rcx, [rsp + 0x40]
xor ebx, ebx
xor edx, edx
mov r8d, 0x208
mov dword [rax + 8], ebx
call fcn.18002ec70
lea rdx, [rsp + 0x40]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x260]
lea rcx, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov word [rsp + 0x46], bx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [rsp + 0x260]
add rsp, 0x250
pop rbx
ret

Function at 0x18002c7c4
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x118]
sub rsp, 0x210
mov rbx, rcx
movsxd rdi, edx
mov esi, 0x9c
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, esi
call fcn.18002ec70
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x18002c8ca
mov esi, 0x100
lea rcx, [rbp + 0x10]
xor edx, edx
mov r8d, esi
call fcn.18002ec70
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rbp - 0x20], 9
je 0x18002c845
cmp word [rbp - 0x20], 6
lea rcx, [0x18003e588]
jne 0x18002c84c
lea rcx, [0x18003e570]
movzx eax, word [rsp + 0x4c]
mov r9d, dword [rsp + 0x44]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x54]
lea r8, str._d._d__s__d__s
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x48]
lea rcx, [rbp + 0x10]
mov rdx, rsi
mov dword [rsp + 0x20], eax
call fcn.18002cc30
lea rax, [rdi - 1]
mov edx, 0x7ffffffe
mov rcx, rdi
cmp rax, rdx
ja 0x18002c8c5
lea r8, [rbp + 0x10]
sub rdx, rcx
sub r8, rbx
lea rax, [rdx + rcx]
test rax, rax
je 0x18002c8ba
mov al, byte [r8 + rbx]
test al, al
je 0x18002c8ba
mov byte [rbx], al
inc rbx
dec rcx
jne 0x18002c89f
test rcx, rcx
jne 0x18002c8c2
dec rbx
mov byte [rbx], 0
mov eax, 1
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18002ca28
Capabilities:
Get disk information
Get file system object information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x308]
sub rsp, 0x3f0
mov rsi, qword [0x180050ad0]
xor edi, edi
xor edx, edx
mov rcx, rsi
mov r8d, 0x800c
mov r15d, edi
call fcn.18002ec70
mov rbx, qword [0x180050ad0]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0xc8
add rbx, 0xc
call fcn.18002ec70
lea rdx, [0x18003e58c]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov r14b, 0x41
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x40], r14b
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [rbx + 4], edi
sub eax, 2
je 0x18002cb92
dec eax
je 0x18002cb35
dec eax
je 0x18002cad0
dec eax
jne 0x18002cba8
mov dword [rbx + 4], 5
jmp 0x18002cb99
lea rcx, [rbp + 0x30]
xor edx, edx
mov r8d, 0x2b8
mov dword [rbx + 4], 4
call fcn.18002ec70
lea r8, [rbp + 0x30]
lea rcx, [rsp + 0x40]
mov r9d, 0x2b8
xor edx, edx
mov dword [rsp + 0x20], 0x200
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbx + 8]
test eax, eax
je 0x18002cb9d
lea r8, [rbp + 0x40]
lea r9, [rsp + 0x40]
lea rdx, str._s___s_
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x18002cba8
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0xc8
mov dword [rbx + 4], 3
call fcn.18002ec70
mov dword [rsp + 0x38], edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
lea r8d, [r9 + 0x64]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbx + 8]
test eax, eax
je 0x18002cb9d
lea r8, [rsp + 0x60]
jmp 0x18002cb21
mov dword [rbx + 4], 2
lea rcx, [rbx + 8]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rbx + 4], edi
je 0x18002cbce
lea rcx, [rbx + 8]
mov dword [rbx], 8
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
add dword [rbx], eax
mov eax, dword [rbx]
add r15d, eax
add rbx, rax
inc r14b
cmp r14b, 0x5a
jle 0x18002ca98
xor eax, eax
mov rcx, rsi
mov qword [rsi], rax
lea edx, [rax + 0xc]
mov qword [rsi + 4], 0x103
mov dword [rsi], r15d
call fcn.18002c2a8
lea edx, [r15 + 0xc]
mov word [rsi + 0xa], ax
mov rcx, qword [0x180050ad0]
call fcn.18002e4dc
lea r11, [rsp + 0x3f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
test eax, eax
setg dil
lea eax, [rdi - 1]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18002cc98
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov dword [rsp + 0x20], 0x760073
mov dword [rsp + 0x24], 0x680063
mov dword [rsp + 0x28], 0x73006f
mov dword [rsp + 0x2c], 0x2e0074
mov dword [rsp + 0x30], 0x780065
mov dword [rsp + 0x34], 0x65
dec edx
jne 0x18002cd2f
mov qword [0x180050a88], rcx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.18002ec70
lea rdx, [rsp + 0x40]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x18002cd2f
call fcn.18002e8d8
jmp 0x18002cd34
mov eax, 1
mov rbx, qword [rsp + 0x260]
add rsp, 0x250
pop rbp
ret