joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180062030
Capabilities:
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x68
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, qword [rsp + 0xb0]
mov rdi, r9
mov rsi, r8
mov dword [rsp + 0x20], 0x1a
mov r14, rdx
lea r8, [rsp + 0x40]
mov r9d, 0x18
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
jns 0x18006208d
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x1800620f6
test r14, r14
je 0x180062099
mov eax, dword [rsp + 0x40]
mov dword [r14], eax
test rsi, rsi
je 0x1800620a4
mov eax, dword [rsp + 0x48]
mov dword [rsi], eax
test rdi, rdi
je 0x1800620af
mov eax, dword [rsp + 0x4c]
mov dword [rdi], eax
test rbx, rbx
je 0x1800620f1
mov rcx, qword [rsp + 0x50]
or eax, 0xffffffff
cmp dword [rsp + 0x54], eax
jne 0x1800620ca
cmp ecx, eax
jne 0x1800620ca
mov dword [rbx], eax
jmp 0x1800620f1
neg rcx
movabs rax, 0x346dc5d63886594b
mul rcx
mov ecx, 0xfffffffe
shr rdx, 0xb
mov rax, rdx
shr rax, 0x20
test eax, eax
cmove ecx, edx
mov dword [rbx], ecx
mov eax, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180024680
add rsp, 0x68
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x180062120
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x48
or eax, 0xffffffff
mov r10, rcx
cmp edx, eax
jne 0x180062139
or dword [rsp + 0x64], 0xffffffff
mov dword [rsp + 0x60], eax
jmp 0x180062147
mov eax, edx
imul rcx, rax, 0xffffffffffffd8f0
mov qword [rsp + 0x60], rcx
lea rax, [rsp + 0x60]
mov dword [rsp + 0x20], 0x1b
mov r9d, 8
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x68]
mov rcx, r10
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
test eax, eax
jns 0x180062187
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x18006218c
mov eax, 1
add rsp, 0x48
ret
Function at 0x180062330
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x70
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r12d, r12d
mov edi, r12d
mov dword [rax - 0x54], r12d
mov dword [rdx], r12d
mov qword [rdx + 8], r12
mov qword [r8], r12
lea r9, [rax - 0x38]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlDosPathNameToRelativeNtPathName_U]
nop dword [rax + rax]
test al, al
jne 0x18006238b
mov ebx, 0xc000003a
mov dword [rsp + 0x30], ebx
jmp 0x1800624bc
mov edi, 1
mov dword [rsp + 0x34], edi
mov rax, qword [rbx + 8]
mov qword [rsi], rax
cmp word [rsp + 0x50], r12w
je 0x1800623b3
movups xmm0, xmmword [rsp + 0x50]
movdqu xmmword [rbx], xmm0
mov rax, qword [rsp + 0x60]
jmp 0x1800623bb
mov rax, r12
mov qword [rsp + 0x60], rax
mov rsi, qword [rsp + 0xb0]
mov dword [rsi], 0x30
mov qword [rsi + 8], rax
mov dword [rsi + 0x18], 0x40
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x20], r12
mov qword [rsi + 0x28], r12
mov r14d, dword [rsp + 0xb8]
mov edx, r14d
or edx, 0x100080
mov dword [rsp + 0x28], 0x604020
mov dword [rsp + 0x20], 7
lea r9, [rsp + 0x40]
mov r8, rsi
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x18006242f
cmp eax, 0xc000000d
jne 0x1800624bc
jmp 0x180062487
mov dword [rsp + 0x20], 0x23
mov r9d, 8
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov rcx, qword [r15]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x1800624bc
test dword [rsp + 0x38], 0x400
je 0x1800624bc
cmp dword [rsp + 0x3c], 0xa0000003
je 0x1800624bc
mov rcx, qword [r15]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
or qword [r15], 0xffffffffffffffff
mov dword [rsp + 0x28], 0x404020
bts r14d, 0x14
mov dword [rsp + 0x20], 7
lea r9, [rsp + 0x40]
mov r8, rsi
mov edx, r14d
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
mov dword [rsp + 0x30], eax
mov ebx, eax
test edi, edi
je 0x1800624d1
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
nop dword [rax + rax]
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x1800631c0
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov esi, edx
mov r14, rcx
xor ebx, ebx
lea rax, [r8 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x180063234
call qword [sym.imp.ntdll.dll_RtlGetCurrentTransaction]
nop dword [rax + rax]
test rax, rax
je 0x180063201
mov ecx, 0x1a45
jmp 0x180063239
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlSetCurrentTransaction]
nop dword [rax + rax]
nop
mov edx, esi
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
nop dword [rax + rax]
mov ebx, eax
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlSetCurrentTransaction]
nop dword [rax + rax]
jmp 0x180063245
mov ecx, 0x1a2c
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x180063530
Capabilities:
Map section object

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rdi, rdx
test rdx, rdx
je 0x18006360a
cmp qword [rdx], 0x20
jne 0x18006360a
mov dword [rsp + 0x48], 4
lea rax, [r11 + 0x20]
mov dword [rsp + 0x40], ebx
lea r8, [r11 + 0x10]
mov dword [rsp + 0x38], 1
xor r9d, r9d
mov qword [r11 - 0x28], rax
or rdx, 0xffffffffffffffff
lea rax, [r11 + 0x18]
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rbx
mov qword [r11 + 0x20], rbx
mov qword [r11 + 0x10], rbx
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
nop dword [rax + rax]
test eax, eax
jns 0x1800635a7
mov ecx, eax
jmp 0x18006360f
mov rcx, qword [rsp + 0x68]
cmp dword [rcx], ebx
jne 0x1800635d5
mov r8, qword [rdi]
lea rcx, [rdi + 8]
sub r8, 8
xor edx, edx
call sub.ntdll.dll_memset
mov ecx, 0x12
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x1800635f1
mov rax, qword [rcx + 0x10]
mov ebx, 1
movups xmm0, xmmword [rax + rcx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + rcx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov dword [rcx + 0x30], ebx
mov rdx, qword [rsp + 0x68]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
nop dword [rax + rax]
mov eax, ebx
jmp 0x180063616
mov ecx, 0xc0000004
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180063630
Capabilities:
Map section object

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rdi, rdx
test rdx, rdx
je 0x180063703
cmp qword [rdx], 0x20
jne 0x180063703
mov dword [rsp + 0x48], 4
lea rax, [r11 + 0x20]
mov dword [rsp + 0x40], ebx
lea r8, [r11 + 0x10]
mov dword [rsp + 0x38], 1
xor r9d, r9d
mov qword [r11 - 0x28], rax
or rdx, 0xffffffffffffffff
lea rax, [r11 + 0x18]
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rbx
mov qword [r11 + 0x20], rbx
mov qword [r11 + 0x10], rbx
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
nop dword [rax + rax]
test eax, eax
jns 0x1800636a7
mov ecx, eax
jmp 0x180063708
mov rdx, qword [rsp + 0x68]
mov eax, dword [rdx + 0x30]
cmp eax, dword [rdx]
jae 0x1800636d9
mov ecx, eax
mov ebx, 1
shl rcx, 5
add rcx, qword [rdx + 0x10]
inc eax
mov dword [rdx + 0x30], eax
movups xmm0, xmmword [rcx + rdx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rcx + rdx + 0x10]
movups xmmword [rdi + 0x10], xmm1
jmp 0x1800636ea
mov ecx, 0x12
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x68]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
nop dword [rax + rax]
mov eax, ebx
jmp 0x18006370f
mov ecx, 0xc0000004
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180063ef0
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x10], rdx
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor edi, edi
mov r12d, r8d
xorps xmm0, xmm0
mov r15d, edi
movups xmmword [rbp - 0x30], xmm0
test rcx, rcx
je 0x180063f3d
mov rdx, rcx
lea rcx, [rbp - 0x30]
call sym.KERNEL32.dll_Basep8BitStringToDynamicUnicodeString
test eax, eax
je 0x180063f9a
mov rbx, qword [rbp - 0x28]
jmp 0x180063f40
mov rbx, rdi
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, r12
add r8, r8
mov edx, dword [rax]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov r13, rax
test rax, rax
jne 0x180063fa1
lea ecx, [rax + 8]
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
cmp qword [rbp - 0x28], rdi
je 0x180063f9a
lea rcx, [rbp - 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
xor eax, eax
jmp 0x1800640ca
mov r8d, r12d
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_QueryDosDeviceW]
nop dword [rax + rax]
mov r14d, eax
lea esi, [rax - 1]
test eax, eax
jne 0x180063fc2
mov esi, edi
xor ecx, ecx
test esi, esi
je 0x180064092
mov edx, 0xffff
mov r8d, 0x7ffe
mov eax, esi
movzx ebx, r8w
sub eax, edi
cmp eax, r8d
jae 0x180063fea
movzx ebx, si
sub bx, di
mov eax, r15d
add rax, qword [rbp + 0x38]
mov qword [rbp - 0x18], rax
mov eax, r12d
sub eax, r15d
mov word [rbp - 0x20], cx
cmp eax, edx
jbe 0x180064009
mov word [rbp - 0x1e], dx
jmp 0x180064015
movzx eax, r12w
sub ax, r15w
mov word [rbp - 0x1e], ax
mov eax, edi
lea rcx, [rax*2]
add rcx, r13
mov qword [rbp - 8], rcx
movzx eax, bx
add ax, ax
mov word [rbp - 0x10], ax
add ax, 2
mov word [rbp - 0xe], ax
call qword [sym.imp.KERNELBASE.dll_GetUnicodeStringToEightBitStringRoutine]
nop dword [rax + rax]
xor r8d, r8d
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x20]
call qword [case.0x1800532bc.0]
cmp eax, 0xc00000f0
jne 0x180064061
shr bx, 1
jmp 0x180064026
xor ecx, ecx
test eax, eax
js 0x180064088
movzx eax, word [rbp - 0x20]
mov edx, 0xffff
add r15d, eax
mov r8d, 0x7ffe
movzx eax, bx
add edi, eax
cmp edi, esi
jb 0x180063fd7
jmp 0x180064092
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
xor r14d, r14d
mov rcx, qword gs:[0x60]
mov r8, r13
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
cmp qword [rbp - 0x28], 0
je 0x1800640c7
lea rcx, [rbp - 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
mov eax, r14d
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180064140
Capabilities:
Access peb ldr_data

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push r14
sub rsp, 0x50
mov esi, edx
mov qword [r11 - 0x18], rcx
lea eax, [rdx - 1]
mov word [rsp + 0x38], ax
mov word [rsp + 0x3a], si
xor r14d, r14d
mov qword [r11 - 0x28], r14
mov dword [r11 - 0x30], r14d
movzx ebx, si
add bx, bx
mov word [rsp + 0x68], bx
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov ecx, dword [rax]
mov dword [rsp + 0x60], ecx
movzx r8d, bx
mov rcx, qword gs:[0x60]
mov edx, dword [rsp + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rcx, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x1800641d7
lea ecx, [rax + 8]
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
or rbx, 0xffffffffffffffff
mov qword [rsp + 0x20], rbx
jmp 0x18006425d
movzx eax, word [rsp + 0x68]
mov word [rsp + 0x2a], ax
mov edx, esi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstVolumeW]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
je 0x18006425d
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
call qword [sym.imp.KERNELBASE.dll_GetUnicodeStringToEightBitStringRoutine]
nop dword [rax + rax]
xor r8d, r8d
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x38]
call qword [case.0x1800532bc.0]
test eax, eax
jns 0x18006423f
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x1800641c9
movzx eax, word [rsp + 0x38]
cmp eax, esi
jb 0x18006424f
mov ecx, 0x80000005
jmp 0x180064238
movzx ecx, word [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov byte [rcx + rax], r14b
cmp qword [rsp + 0x30], r14
je 0x180064289
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x30]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x20]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x180064760
Capabilities:
Access peb ldr_data

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov edi, r8d
mov rsi, rcx
mov qword [r11 - 0x28], rdx
lea eax, [r8 - 1]
mov word [rsp + 0x38], ax
mov word [rsp + 0x3a], di
xor r14d, r14d
mov qword [r11 - 0x38], r14
mov dword [r11 - 0x40], r14d
movzx ebx, di
add bx, bx
mov word [r11 + 0x18], bx
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov ecx, dword [rax]
mov dword [rsp + 0x78], ecx
movzx r8d, bx
mov rcx, qword gs:[0x60]
mov edx, dword [rsp + 0x78]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdx, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x1800647f8
lea ecx, [rax + 8]
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
mov ebx, r14d
mov dword [rsp + 0x20], ebx
jmp 0x180064881
movzx eax, word [rsp + 0x80]
mov word [rsp + 0x2a], ax
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextVolumeW]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x20], eax
test eax, eax
je 0x180064881
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
call qword [sym.imp.KERNELBASE.dll_GetUnicodeStringToEightBitStringRoutine]
nop dword [rax + rax]
xor r8d, r8d
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x38]
call qword [case.0x1800532bc.0]
test eax, eax
jns 0x180064863
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x1800647ec
movzx eax, word [rsp + 0x38]
cmp eax, edi
jb 0x180064873
mov ecx, 0x80000005
jmp 0x18006485c
movzx ecx, word [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov byte [rcx + rax], r14b
cmp qword [rsp + 0x30], r14
je 0x1800648ac
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x30]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ebx, dword [rsp + 0x20]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x180064900
Capabilities:
Access peb ldr_data

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov edi, r8d
mov rsi, rcx
mov qword [r11 - 0x28], rdx
lea eax, [r8 - 1]
mov word [rsp + 0x38], ax
mov word [rsp + 0x3a], di
xor r14d, r14d
mov qword [r11 - 0x38], r14
mov dword [r11 - 0x40], r14d
movzx ebx, di
add bx, bx
mov word [r11 + 0x18], bx
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov ecx, dword [rax]
mov dword [rsp + 0x78], ecx
movzx r8d, bx
mov rcx, qword gs:[0x60]
mov edx, dword [rsp + 0x78]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdx, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x180064998
lea ecx, [rax + 8]
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
mov ebx, r14d
mov dword [rsp + 0x20], ebx
jmp 0x180064a1d
movzx eax, word [rsp + 0x80]
mov word [rsp + 0x2a], ax
xor r9d, r9d
mov r8d, edi
mov rcx, rsi
call fcn.180064a98
mov ebx, eax
mov dword [rsp + 0x20], eax
test eax, eax
je 0x180064a1d
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
call qword [sym.imp.KERNELBASE.dll_GetUnicodeStringToEightBitStringRoutine]
nop dword [rax + rax]
xor r8d, r8d
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x38]
call qword [case.0x1800532bc.0]
test eax, eax
jns 0x1800649ff
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x18006498c
movzx eax, word [rsp + 0x38]
cmp eax, edi
jb 0x180064a0f
mov ecx, 0x80000005
jmp 0x1800649f8
movzx ecx, word [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov byte [rcx + rax], r14b
cmp qword [rsp + 0x30], r14
je 0x180064a48
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x30]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ebx, dword [rsp + 0x20]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x180065260
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x60
mov rsi, r9
mov ebx, r8d
mov rdi, rdx
mov rdx, rcx
lea rcx, [rax - 0x18]
call sym.KERNEL32.dll_Basep8BitStringToDynamicUnicodeString
xor r14d, r14d
test eax, eax
je 0x1800653fe
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x42], bx
mov qword [rsp + 0x38], r14
mov word [rsp + 0x32], r14w
movzx edi, bx
add di, di
mov word [rsp + 0x32], di
je 0x180065311
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov ecx, dword [rax]
mov dword [rsp + 0x28], ecx
movzx r8d, word [rsp + 0x32]
mov rcx, qword gs:[0x60]
mov edx, dword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x180065319
lea ecx, [rax + 8]
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
mov ebx, r14d
mov dword [rsp + 0x20], ebx
jmp 0x1800653c0
mov rax, r14
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x24]
mov r8d, ebx
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x20], eax
test eax, eax
jne 0x180065352
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0xea
jne 0x1800653c0
test ebx, ebx
je 0x180065365
movzx ecx, word [rsp + 0x24]
add cx, cx
mov word [rsp + 0x30], cx
jmp 0x18006536a
mov word [rsp + 0x30], di
call qword [sym.imp.KERNELBASE.dll_GetUnicodeStringToEightBitStringRoutine]
nop dword [rax + rax]
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call qword [case.0x1800532bc.0]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x1800653a8
cmp eax, 0x80000005
je 0x1800653a8
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x180065305
test rsi, rsi
je 0x1800653c0
test ebx, ebx
je 0x1800653b8
movzx eax, word [rsp + 0x40]
jmp 0x1800653be
mov eax, dword [rsp + 0x24]
add eax, eax
mov dword [rsi], eax
cmp qword [rsp + 0x38], r14
je 0x1800653eb
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ebx, dword [rsp + 0x20]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
Function at 0x180066200
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x38]
sub rsp, 0x130
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov ebx, edx
mov rsi, rcx
test edx, edx
jns 0x1800662b7
xor r8d, r8d
mov qword [rsp + 0x58], 0x30
lea r9, [rsp + 0x58]
lea rcx, [rbp - 0x10]
lea edx, [r8 + 1]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_InitializeProcThreadAttributeList]
nop dword [rax + rax]
test eax, eax
je 0x1800663b1
and qword [rsp + 0x30], 0
lea r9, [rsp + 0x50]
and qword [rsp + 0x28], 0
lea rcx, [rbp - 0x10]
xor edx, edx
mov qword [rsp + 0x20], 4
mov r8d, 0x60001
mov dword [rsp + 0x50], 1
mov edi, 0x80000
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_UpdateProcThreadAttribute]
nop dword [rax + rax]
test eax, eax
jne 0x1800662ad
xor ebx, ebx
jmp 0x18006639f
lea rax, [rbp - 0x10]
mov qword [rbp - 0x18], rax
jmp 0x1800662b9
xor edi, edi
xor edx, edx
lea rcx, [rbp - 0x80]
lea r8d, [rdx + 0x68]
call sub.ntdll.dll_memset
mov eax, edi
mov dword [rbp - 0x44], 1
neg eax
mov word [rbp - 0x40], bx
lea rax, [rsp + 0x60]
mov rdx, rsi
sbb ecx, ecx
mov qword [rsp + 0x48], rax
and ecx, 8
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
add ecx, 0x68
and qword [rsp + 0x38], 0
xor r9d, r9d
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rbp - 0x80], ecx
xor ecx, ecx
mov dword [rsp + 0x28], edi
and dword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessA]
nop dword [rax + rax]
test eax, eax
je 0x18006636a
mov rax, qword [0x1800b2cc8]
test rax, rax
je 0x180066341
mov rcx, qword [rsp + 0x60]
mov edx, 0x7530
call qword [case.0x1800532bc.0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov ebx, 0x21
jmp 0x18006639b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, 2
sub eax, ebx
je 0x18006639b
sub eax, 1
je 0x180066396
cmp eax, 0xbe
je 0x18006638f
xor ebx, ebx
jmp 0x18006639b
mov ebx, 0xb
jmp 0x18006639b
mov ebx, 3
test edi, edi
je 0x1800663af
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_DeleteProcThreadAttributeList]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.180024680
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180066da0
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x430
mov rdi, rdx
movzx ebx, cx
lea rdx, [rsp + 0x20]
mov ecx, 0x3c
lea r9, [rax + 0x18]
mov r8d, 0x408
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
jns 0x180066de4
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x180066e0a
cmp ebx, dword [rsp + 0x20]
jbe 0x180066dfd
mov ecx, 0x57
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x180066de0
mov rcx, qword [rsp + rbx*8 + 0x28]
mov eax, 1
mov qword [rdi], rcx
mov rbx, qword [rsp + 0x440]
add rsp, 0x430
pop rdi
ret

Function at 0x180066eb0
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x430
cmp word [rcx], 0x14
mov rsi, rdx
mov rdi, rcx
jae 0x180066f42
cmp byte [rcx + 2], 0x40
jae 0x180066f42
xor ebx, ebx
cmp byte [rcx + 3], bl
jne 0x180066f42
lea r9, [rax + 8]
mov r8d, 0x408
lea rdx, [rsp + 0x20]
lea ecx, [rbx + 0x37]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
jns 0x180066f0f
mov ecx, 0xffff
mov word [rsi], cx
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x180066f5b
mov cl, byte [rdi + 2]
mov r8d, 1
mov edx, r8d
shl rdx, cl
movzx ecx, word [rdi]
movzx eax, bx
add rax, rax
cmp word [rsp + rax*8 + 0x30], cx
jne 0x180066f35
test qword [rsp + rax*8 + 0x28], rdx
jne 0x180066f73
add bx, r8w
movzx eax, bx
cmp eax, dword [rsp + 0x20]
jbe 0x180066f21
mov ecx, 0xffff
mov word [rsi], cx
mov ecx, 0x57
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor eax, eax
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov word [rsi], bx
mov eax, r8d
jmp 0x180066f5d