joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140078a04
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
mov r14, r9
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
cmp byte [rcx + 8], bl
je 0x140078bf7
test r9, r9
je 0x140078bd4
movsxd rcx, dword [rcx + 0x3d0]
xor edx, edx
mov rax, r9
div rcx
test rdx, rdx
jne 0x140078bd4
cmp dword [rsp + 0x80], 1
jne 0x140078b06
mov r12d, ebx
test rax, rax
je 0x140078ae7
lea r15, [rdi + 0x3f8]
mov r8, rsi
mov rdx, rbp
mov rcx, rdi
call fcn.140007c78
mov rcx, rsi
cmp byte [rdi + 8], bl
je 0x140078c1a
mov eax, dword [rdi + 0x3d0]
mov r8d, ebx
test eax, eax
jle 0x140078ab9
mov rdx, r15
sub rdx, rsi
mov al, byte [rdx + rcx]
inc r8d
xor byte [rcx], al
inc rcx
mov eax, dword [rdi + 0x3d0]
cmp r8d, eax
jl 0x140078aa3
movsxd r8, eax
mov rdx, rbp
mov rcx, r15
call fcn.140043700
movsxd rcx, dword [rdi + 0x3d0]
xor edx, edx
mov rax, r14
inc r12d
div rcx
add rbp, rcx
add rsi, rcx
movsxd rcx, r12d
cmp rcx, rax
jb 0x140078a76
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
cmp dword [rsp + 0x80], 2
jne 0x140078b99
mov r12d, ebx
test rax, rax
je 0x140078ae7
lea r15, [rdi + 0x3f8]
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call fcn.1400111ec
mov rcx, rsi
cmp byte [rdi + 8], bl
je 0x140078c3d
mov eax, dword [rdi + 0x3d0]
mov r8d, ebx
test eax, eax
jle 0x140078b66
mov rdx, rbp
sub rdx, rsi
mov al, byte [rdx + rcx]
inc r8d
xor byte [rcx], al
inc rcx
mov eax, dword [rdi + 0x3d0]
cmp r8d, eax
jl 0x140078b50
movsxd r8, eax
mov rdx, rbp
mov rcx, r15
call fcn.140043700
movsxd rcx, dword [rdi + 0x3d0]
xor edx, edx
mov rax, r14
inc r12d
div rcx
add rbp, rcx
add rsi, rcx
movsxd rcx, r12d
cmp rcx, rax
jb 0x140078b23
jmp 0x140078ae7
test rax, rax
je 0x140078ae7
mov r8, rsi
mov rdx, rbp
mov rcx, rdi
call fcn.140007c78
movsxd rcx, dword [rdi + 0x3d0]
xor edx, edx
mov rax, r14
inc ebx
div rcx
add rbp, rcx
add rsi, rcx
movsxd rcx, ebx
cmp rcx, rax
jb 0x140078ba2
jmp 0x140078ae7
mov rdx, qword [0x1400aa0d0]
lea rcx, [rsp + 0x20]
call fcn.140018e58
lea rdx, [0x1400a7910]
lea rcx, [rsp + 0x20]
call fcn.140044578
int3
mov rdx, qword [0x1400aa0c8]
lea rcx, [rsp + 0x20]
call fcn.140018e58
lea rdx, [0x1400a7910]
lea rcx, [rsp + 0x20]
call fcn.140044578
int3
mov rdx, qword [0x1400aa0c8]
lea rcx, [rsp + 0x20]
call fcn.140018e58
lea rdx, [0x1400a7910]
lea rcx, [rsp + 0x20]
call fcn.140044578
int3
mov rdx, qword [0x1400aa0c8]
lea rcx, [rsp + 0x20]
call fcn.140018e58
lea rdx, [0x1400a7910]
lea rcx, [rsp + 0x20]
call fcn.140044578
int3
Function at 0x1800023e0
Capabilities:
Enumerate processes

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x2a8
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1803a0f20]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x28], 0xffffffffffffffff
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x50], 0x238
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
je 0x1800024f2
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x1800024e7
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x30]
call fcn.180001860
nop
lea rcx, [rsp + 0x30]
call fcn.180003220
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x2b0]
call fcn.180001e40
movzx eax, al
test eax, eax
je 0x1800024c5
mov dword [rsp + 0x24], 0
lea rdx, [rsp + 0x24]
mov ecx, dword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp dword [rsp + 0x24], 0x3e8
ja 0x1800024c0
mov eax, dword [rsp + 0x2b8]
cmp dword [rsp + 0x24], eax
jne 0x1800024c5
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x30]
call fcn.180001bd0
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x18000245f
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x21], al
mov rcx, qword [rsp + 0x2b0]
call fcn.180001bd0
movzx eax, byte [rsp + 0x21]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1800edcb0
add rsp, 0x2a8
ret
Function at 0x180006780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov dword [rsp + 4], 0
mov dword [rsp + 8], 0
mov dword [rsp + 0xc], 0
jmp 0x1800067b1
mov eax, dword [rsp + 0xc]
inc eax
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0xc], eax
jae 0x1800068b7
mov eax, dword [rsp + 4]
inc eax
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov dword [rsp + 4], eax
movsxd rax, dword [rsp + 4]
lea rcx, [0x1803a1b50]
movzx eax, byte [rcx + rax]
mov ecx, dword [rsp + 8]
add ecx, eax
mov eax, ecx
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov dword [rsp + 8], eax
movsxd rax, dword [rsp + 4]
lea rcx, [0x1803a1b50]
movzx eax, byte [rcx + rax]
mov byte [rsp], al
movsxd rax, dword [rsp + 8]
lea rcx, [0x1803a1b50]
movsxd rdx, dword [rsp + 4]
lea r8, [0x1803a1b50]
movzx eax, byte [rcx + rax]
mov byte [r8 + rdx], al
movsxd rax, dword [rsp + 8]
lea rcx, [0x1803a1b50]
movzx edx, byte [rsp]
mov byte [rcx + rax], dl
movsxd rax, dword [rsp + 4]
lea rcx, [0x1803a1b50]
movzx eax, byte [rcx + rax]
movsxd rcx, dword [rsp + 8]
lea rdx, [0x1803a1b50]
movzx ecx, byte [rdx + rcx]
add eax, ecx
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0xc]
movsxd rcx, dword [rsp + 0x10]
lea rdx, [0x1803a1b50]
movzx ecx, byte [rdx + rcx]
mov rdx, qword [rsp + 0x30]
movzx eax, byte [rdx + rax]
xor eax, ecx
mov ecx, dword [rsp + 0xc]
mov rdx, qword [rsp + 0x30]
mov byte [rdx + rcx], al
jmp 0x1800068b2
jmp 0x1800067a7
mov al, 1
add rsp, 0x28
ret

Function at 0x180007d30
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180007d9a
mov r8d, 0xf01ff
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180007d8f
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add rsp, 0x38
ret
Function at 0x180009260
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x308
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x1803a0f20]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x30], 0xffffffffffffffff
mov dword [rsp + 0xb0], 0x238
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x48], eax
cmp qword [rsp + 0x30], 0xffffffffffffffff
je 0x180009476
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x18000946b
mov dword [rsp + 0x28], 1
lea rdx, [rsp + 0xdc]
lea rcx, [rsp + 0x40]
call fcn.180001860
nop
mov byte [rsp + 0x20], 0
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x310]
call fcn.18000b400
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
jmp 0x18000933d
lea rcx, [rsp + 0x38]
call fcn.180007a10
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x310]
call fcn.18000b770
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.180007990
movzx eax, al
test eax, eax
je 0x1800093ec
lea rcx, [rsp + 0x38]
call fcn.1800079d0
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
call fcn.180009220
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1800044a0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.180007c60
test eax, eax
jne 0x1800093bc
mov dword [rsp + 0x24], 1
jmp 0x1800093c4
mov dword [rsp + 0x24], 0
movzx eax, byte [rsp + 0x24]
mov byte [rsp + 0x21], al
lea rcx, [rsp + 0x68]
call fcn.180001bd0
movzx eax, byte [rsp + 0x21]
test eax, eax
je 0x1800093e7
mov byte [rsp + 0x20], 1
jmp 0x1800093ec
jmp 0x180009333
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x180009446
lea rcx, [rsp + 0x40]
call fcn.1800044a0
lea r8, [0x180108de0]
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.180007550
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x310]
call fcn.18000baf0
nop
lea rcx, [rsp + 0xa0]
call fcn.1800076f0
nop
lea rcx, [rsp + 0x40]
call fcn.180001bd0
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x1800092f4
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1800edcb0
add rsp, 0x308
ret
Function at 0x180009880
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x298
mov rax, qword [0x1803a0f20]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov dword [rsp + 0x2c], 0
mov qword [rsp + 0x20], 0xffffffffffffffff
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0x238
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x180009964
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x180009959
lea rdx, [rsp + 0x6c]
mov rcx, qword [rsp + 0x2a0]
call fcn.1800f8604
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jne 0x180009945
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x401
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x30], rax
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x2c], 1
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x1800098f1
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1800edcb0
add rsp, 0x298
ret

Function at 0x180009980
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x2a8
mov rax, qword [0x1803a0f20]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0xffffffffffffffff
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x50], 0x238
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
je 0x180009a64
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x180009a59
lea rdx, [rsp + 0x7c]
mov rcx, qword [rsp + 0x2b0]
call fcn.1800f8604
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x180009a45
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x401
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x38], rax
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x1800099f1
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1800edcb0
add rsp, 0x2a8
ret
Function at 0x180009ae0
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x1803a0f20]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x80]
call fcn.180009d10
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x180009b84
mov r8d, 0x20
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180009b79
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x180009b6e
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
sub qword [rsp + 0x20], 2
add qword [rsp + 0x20], 2
mov rax, qword [rsp + 0x20]
cmp word [rax], 0
jne 0x180009b97
mov rax, qword [rsp + 0x20]
lea rcx, str..exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x80]
call fcn.180009880
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800edcb0
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x180009bf0
Capabilities:
Stop service

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1803a0f20]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 0
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x180009c8f
mov r8d, 0x20
lea rdx, str.SEGURAZOKD
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180009c84
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x180009c79
mov dword [rsp + 0x20], 1
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800edcb0
add rsp, 0x68
ret
Function at 0x18000a100
Capabilities:
Delete service

Disassembly:
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18000a164
mov r8d, 0x10000000
lea rdx, str.SEGURAZOKD
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18000a164
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
cmp qword [rsp + 0x28], 0
je 0x18000a177
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp qword [rsp + 0x20], 0
je 0x18000a18a
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add rsp, 0x40
pop rdi
ret
Function at 0x18000cab0
Capabilities:
Get system firmware table

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov byte [rsp + 0x20], 0x42
mov byte [rsp + 0x21], 0x4d
mov byte [rsp + 0x22], 0x53
mov byte [rsp + 0x23], 0x52
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x3c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, dword [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
mov ecx, eax
call fcn.1800f76b0
mov qword [rsp + 0x50], rax
mov r9d, dword [rsp + 0x38]
mov r8, qword [rsp + 0x50]
xor edx, edx
mov ecx, dword [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
add rax, 8
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 4]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
mov byte [rsp + 0x40], al
cmp byte [rsp + 0x40], 0
je 0x18000cb7a
cmp byte [rsp + 0x40], 2
je 0x18000cbe5
jmp 0x18000cc26
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x30]
call fcn.180010360
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x60]
movzx edx, byte [rax + 4]
mov rcx, qword [rsp + 0x68]
call fcn.18000f480
mov r8, rax
mov edx, 0x21
mov rcx, qword [rsp + 0xa0]
call fcn.1800f877c
mov rax, qword [rsp + 0x60]
movzx edx, byte [rax + 5]
mov rcx, qword [rsp + 0x68]
call fcn.18000f480
mov r8, rax
mov edx, 0x21
mov rcx, qword [rsp + 0xa8]
call fcn.1800f877c
jmp 0x18000cc26
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x30]
call fcn.180010360
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x70]
movzx edx, byte [rax + 7]
mov rcx, qword [rsp + 0x78]
call fcn.18000f480
mov r8, rax
mov edx, 0x21
mov rcx, qword [rsp + 0xb0]
call fcn.1800f877c
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax + 1]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 1]
or eax, ecx
test eax, eax
je 0x18000cc65
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
jmp 0x18000cc3f
mov rax, qword [rsp + 0x28]
add rax, 2
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x80]
cmp qword [rsp + 0x28], rax
jb 0x18000cc84
jmp 0x18000cc93
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
jmp 0x18000cb51
mov rcx, qword [rsp + 0x50]
call fcn.1800f76a8
add rsp, 0x98
ret
Function at 0x18000f0a0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x6a0
mov rax, qword [0x1803a0f20]
xor rax, rsp
mov qword [rsp + 0x690], rax
lea rdx, [0x180108844]
lea rcx, [rsp + 0x58]
call fcn.180001860
xor eax, eax
mov word [rsp + 0x480], ax
lea rax, [rsp + 0x482]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x270], ax
lea rax, [rsp + 0x272]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x40], 0
mov rax, qword [0x180108888]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
mov eax, 2
imul rax, rax, 3
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0x208
jae 0x18000f154
jmp 0x18000f159
call fcn.1800ede08
xor eax, eax
mov rcx, qword [rsp + 0x50]
mov word [rsp + rcx + 0x60], ax
mov dword [rsp + 0x38], 0x105
lea rax, [rsp + 0x270]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x6b0]
mov r8d, 0x105
lea rdx, [rsp + 0x480]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x58]
call fcn.180001bd0
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.1800edcb0
add rsp, 0x6a0
pop rdi
ret
Function at 0x18000fed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x230
mov rax, qword [0x1803a0f20]
xor rax, rsp
mov qword [rsp + 0x220], rax
call fcn.1800d2820
test eax, eax
jge 0x18000feff
xor eax, eax
jmp 0x1800101a7
mov byte [rsp + 0x88], 0x90
mov byte [rsp + 0x89], 0x86
mov byte [rsp + 0x8a], 0xd5
mov byte [rsp + 0x8b], 0x44
mov byte [rsp + 0x8c], 0x57
mov byte [rsp + 0x8d], 0x92
mov byte [rsp + 0x8e], 0x70
mov byte [rsp + 0x8f], 0x5a
mov byte [rsp + 0x90], 0x17
mov byte [rsp + 0x91], 0x5d
mov byte [rsp + 0x92], 0x45
mov byte [rsp + 0x93], 0x3c
mov byte [rsp + 0x94], 0xcc
mov byte [rsp + 0x95], 0x9f
mov byte [rsp + 0x96], 0xaf
mov byte [rsp + 0x97], 0xab
mov byte [rsp + 0x98], 0xff
mov byte [rsp + 0x99], 0x73
mov byte [rsp + 0x9a], 0xf4
mov byte [rsp + 0x9b], 0xc9
mov byte [rsp + 0x9c], 0xaa
mov byte [rsp + 0x9d], 0x5e
mov byte [rsp + 0x9e], 3
mov byte [rsp + 0x9f], 2
mov byte [rsp + 0xa0], 0x16
mov byte [rsp + 0xa1], 0xea
mov byte [rsp + 0xa2], 0xf6
mov byte [rsp + 0xa3], 0x7b
mov byte [rsp + 0xa4], 0x22
mov byte [rsp + 0xa5], 0x6a
mov byte [rsp + 0xa6], 0xfe
mov byte [rsp + 0xa7], 0x99
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x81
mov r8, qword [rsp + 0x240]
mov edx, 0x40
lea rcx, [rsp + 0x1e0]
call fcn.1800d36b0
mov byte [rsp + 0xb0], 0
lea rax, [rsp + 0xb1]
mov rdi, rax
xor eax, eax
mov ecx, 0x41
rep stosb byte [rdi], al
mov byte [rsp + 0x100], 0
lea rax, [rsp + 0x101]
mov rdi, rax
xor eax, eax
mov ecx, 0x41
rep stosb byte [rdi], al
mov byte [rsp + 0x150], 0
lea rax, [rsp + 0x151]
mov rdi, rax
xor eax, eax
mov ecx, 0x81
rep stosb byte [rdi], al
lea rcx, [rsp + 0xb0]
call sym.SegurazoEngine.dll_GetHardwareId
lea rcx, [rsp + 0x100]
call sym.SegurazoEngine.dll_GetSoftwareId
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax]
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0x50]
movzx ecx, byte [rsp + 0x40]
mov byte [rax], cl
mov rax, qword [rsp + 0x60]
inc rax
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
cmp byte [rsp + 0x40], 0
jne 0x1800100d1
lea rax, [rsp + 0x150]
mov qword [rsp + 0x48], rax
dec qword [rsp + 0x48]
inc qword [rsp + 0x48]
mov rax, qword [rsp + 0x48]
cmp byte [rax], 0
jne 0x18001011c
mov rax, qword [rsp + 0x48]
lea rcx, [rsp + 0x100]
xor edx, edx
movzx edi, byte [rcx + rdx]
mov byte [rax + rdx], dil
inc rdx
test dil, dil
jne 0x18001013a
lea rax, [rsp + 0x150]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x58], 0xffffffffffffffff
inc qword [rsp + 0x58]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
cmp byte [rax + rcx], 0
jne 0x180010160
mov rax, qword [rsp + 0x58]
lea r9, [rsp + 0x88]
mov r8, rax
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x1e0]
call fcn.1800d2b20
test eax, eax
je 0x1800101a2
xor eax, eax
jmp 0x1800101a7
mov eax, 1
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1800edcb0
add rsp, 0x230
pop rdi
ret
Function at 0x180013080
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov qword [rax], 0
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x6a09e667
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0xbb67ae85
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x3c6ef372
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0xa54ff53a
mov eax, 4
imul rax, rax, 4
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x510e527f
mov eax, 4
imul rax, rax, 5
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x9b05688c
mov eax, 4
imul rax, rax, 6
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x1f83d9ab
mov eax, 4
imul rax, rax, 7
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x5be0cd19
ret