joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800031d0
Capabilities:
Encode data using base64

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x80
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0xb8], rbx
mov rax, qword [0x1800470b8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r14, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov rcx, qword [rdx + 0x10]
test rcx, rcx
jne 0x180003238
mov qword [rdi + 0x10], rcx
mov qword [rdi + 0x18], 0xf
mov byte [rdi], cl
xor r8d, r8d
lea rdx, [0x180040068]
mov rcx, rdi
call fcn.1800022e0
jmp 0x18000340f
cmp qword [r8 + 0x10], 0
jne 0x18000324c
mov rcx, rdi
call fcn.180002200
jmp 0x18000340f
call fcn.180017cc0
mov rbp, rax
cmp qword [rbx + 0x18], 0x10
jb 0x18000325e
mov rbx, qword [rbx]
mov r9, rbp
mov r10, 0xffffffffffffffff
nop dword [rax + rax]
inc r10
cmp byte [rbx + r10], 0
jne 0x180003270
xor r11d, r11d
test r10d, r10d
jle 0x18000335c
movzx r8d, byte [rsp + 0x20]
nop dword [rax]
movzx eax, byte [rbx]
cmp al, 0x3d
je 0x18000335c
nop dword [rax + rax]
test al, al
je 0x18000335c
lea ecx, [rax - 0x41]
cmp cl, 0x19
ja 0x1800032b4
sub al, 0x41
jmp 0x1800032d6
lea ecx, [rax - 0x61]
cmp cl, 0x19
ja 0x1800032c0
sub al, 0x47
jmp 0x1800032d6
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x1800032cc
add al, 4
jmp 0x1800032d6
cmp al, 0x2b
je 0x1800032ec
cmp al, 0x2f
je 0x1800032e8
mov al, 0x40
inc rbx
cmp al, 0x40
jne 0x1800032e2
movzx eax, byte [rbx]
jmp 0x1800032a0
cmp al, 0x41
je 0x18000335c
jmp 0x1800032f1
mov al, 0x3f
jmp 0x1800032ee
mov al, 0x3e
inc rbx
mov edx, r11d
and edx, 3
je 0x180003348
sub edx, 1
je 0x18000332f
sub edx, 1
je 0x180003316
cmp edx, 1
jne 0x180003350
movzx ecx, r8b
or cl, al
mov byte [r9], cl
inc r9
jmp 0x180003350
movzx ecx, al
shr cl, 2
or cl, r8b
mov byte [r9], cl
inc r9
movzx r8d, al
shl r8b, 6
jmp 0x180003350
movzx ecx, al
shr cl, 4
or cl, r8b
mov byte [r9], cl
inc r9
movzx r8d, al
shl r8b, 4
jmp 0x180003350
movzx r8d, al
shl r8b, 2
inc r11d
cmp r11d, r10d
jl 0x180003290
sub r9d, ebp
movdqa xmm0, xmmword [0x180040ba0]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
movsxd r8, r9d
mov rdx, rbp
lea rcx, [rsp + 0x38]
call fcn.1800022e0
nop
mov r8, r14
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.180002bd0
test rbp, rbp
je 0x1800033a2
mov rcx, rbp
call fcn.180017cb8
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rdi + 0x10], xmm1
movdqa xmm0, xmmword [0x180040ba0]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x18000340f
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000340a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003433
call fcn.180017cb8
mov rax, rdi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180017e50
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r14
pop rdi
pop rbp
ret
call fcn.18001c32c
int3
Function at 0x180003f40
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x1b8]
sub rsp, 0x2b0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800470b8]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, rcx
cmp qword [rcx + 0x10], 0
jne 0x180003f89
xor al, al
jmp 0x180004153
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.180003c10
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x180004056
inc rcx
mov eax, 2
mul rcx
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.180017cc0
mov rsi, rax
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x38]
add r8, r8
mov rcx, rax
call fcn.180019190
xor edx, edx
mov rcx, qword [rsp + 0x38]
mov word [rsi + rcx*2], dx
mov rax, qword [rsp + 0x38]
lea rcx, [rsi + rax*2]
cmp rcx, rsi
jbe 0x180004012
lea rax, [rcx - 2]
cmp word [rax], 0x2f
jne 0x180004012
mov rcx, rax
cmp rax, rsi
ja 0x180004000
mov word [rcx], dx
mov qword [rsp + 0x38], rdx
lea rax, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rax, qword [rsp + 0x28]
mov word [rax], dx
nop
inc rbx
cmp word [rsi + rbx*2], dx
jne 0x180004030
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.180003d10
mov edx, 2
mov rcx, rsi
call fcn.180017cb8
mov edx, 0x5c
lea rcx, [rsp + 0x28]
call fcn.180006720
cmp qword [rsp + 0x38], 3
ja 0x180004096
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jbe 0x180004110
cmp eax, 4
ja 0x180004096
mov bl, 1
jmp 0x180004112
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x1800040f6
mov rcx, qword [rdi + 0x10]
movsxd rdx, ecx
dec rdx
cmp rcx, rdx
jbe 0x180004181
mov rcx, rdi
mov rax, qword [rdi + 0x18]
cmp rax, 8
jb 0x1800040db
mov rcx, qword [rdi]
cmp word [rcx + rdx*2], 0x5c
je 0x1800040f2
cmp rax, 8
jb 0x1800040eb
mov rdi, qword [rdi]
cmp word [rdi + rdx*2], 0x2f
jne 0x180004110
mov bl, 1
jmp 0x180004112
mov rcx, rax
test byte [rsp + 0x50], 0x10
je 0x18000410a
call qword [sym.imp.KERNEL32.dll_FindClose]
mov bl, 1
jmp 0x180004112
call qword [sym.imp.KERNEL32.dll_FindClose]
xor bl, bl
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x180004150
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000414b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000417b
call fcn.180017cb8
movzx eax, bl
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.180017e50
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.18001c32c
nop
call fcn.180003a50
nop
int3
Function at 0x180004190
Capabilities:
Check if file exists
Move file

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800470b8]
xor rax, rsp
mov qword [rbp + 0x47], rax
movzx ebx, dl
mov rdx, rcx
lea rcx, [rbp + 0x27]
call fcn.180003c10
nop
lea rcx, [rbp + 0x27]
call fcn.180006810
cmp qword [rbp + 0x37], 0
je 0x1800042b0
lea rcx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rcx, qword [rbp + 0x27]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800042b0
mov rcx, qword [rbp + 0x37]
add rcx, 2
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180017cc0
mov rdi, rax
lea r8, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae r8, qword [rbp + 0x27]
mov rdx, qword [rbp + 0x37]
add rdx, 2
mov rcx, rax
call fcn.1800205e4
xor esi, esi
mov rcx, qword [rbp + 0x37]
mov word [rdi + rcx*2], si
mov rax, qword [rbp + 0x37]
mov word [rdi + rax*2 + 2], si
mov qword [rbp - 0x11], 3
mov dword [rbp + 9], esi
mov word [rbp + 0xd], si
mov qword [rbp + 0xf], rsi
mov qword [rbp - 0x19], rsi
mov qword [rbp + 0x17], rsi
mov qword [rbp - 9], rdi
mov qword [rbp - 1], rsi
test bl, bl
mov eax, 0x454
jne 0x180004289
mov eax, 0x414
mov word [rbp + 7], ax
mov bl, 1
lea rcx, [rbp - 0x19]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
movzx ebx, bl
test eax, eax
cmovne ebx, esi
test rdi, rdi
je 0x1800042b2
mov rcx, rdi
call fcn.180017cb8
jmp 0x1800042b2
mov bl, 1
mov rdx, qword [rbp + 0x3f]
cmp rdx, 8
jb 0x1800042ee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800042e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004316
call fcn.180017cb8
movzx eax, bl
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180017e50
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.18001c32c
int3
Function at 0x18000ddb0
Capabilities:
Set registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov qword [rbp - 0x21], 0xfffffffffffffffe
mov qword [rsp + 0xe0], rbx
mov rax, qword [0x1800470b8]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rcx, [rbp + 0x27]
call fcn.18000bc40
nop
movdqa xmm0, xmmword [0x180040b90]
movdqu xmmword [rbp + 0x17], xmm0
xor ebx, ebx
mov word [rbp + 7], bx
lea r8d, [rbx + 3]
lea rdx, [0x1800405a0]
lea rcx, [rbp + 7]
call fcn.180003d10
nop
movdqa xmm0, xmmword [0x180040b90]
movdqu xmmword [rbp - 9], xmm0
mov word [rbp - 0x19], bx
lea r8d, [rbx + 0x16]
lea rdx, str.SOFTWAREMicrosoftext
lea rcx, [rbp - 0x19]
call fcn.180003d10
mov qword [rbp - 0x29], rbx
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rdx, qword [rbp - 0x19]
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 0x29]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2011b
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18000dec5
lea rcx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rcx, qword [rbp + 0x27]
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rdx, qword [rbp + 7]
mov eax, dword [rbp + 0x37]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
lea r9d, [rbx + 1]
xor r8d, r8d
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 1]
cmp rdx, 8
jb 0x18000df05
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000df00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000dfb2
call fcn.180017cb8
movdqa xmm0, xmmword [0x180040b90]
movdqu xmmword [rbp - 9], xmm0
mov word [rbp - 0x19], bx
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x18000df53
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000df4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000dfb8
call fcn.180017cb8
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 8
jb 0x18000df8f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000df8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000dfac
call fcn.180017cb8
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180017e50
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rbp
ret
call fcn.18001c32c
nop
call fcn.18001c32c
nop
call fcn.18001c32c
int3
Function at 0x18000f990
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x4c0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x1800470b8]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov esi, edx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
movdqa xmm6, xmmword [0x180040b90]
movdqu xmmword [rsp + 0x40], xmm6
xor ebp, ebp
mov word [rsp + 0x30], bp
xor edx, edx
lea ecx, [rbp + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000fa1c
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x18000fa2d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm6
jmp 0x18000facb
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x290]
call fcn.1800195f0
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x18000fa85
cmp esi, dword [rsp + 0x58]
je 0x18000fa6e
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18000fa54
jmp 0x18000fa85
lea r8, [rsp + 0x7c]
mov edx, 0x104
lea rcx, [rsp + 0x290]
call fcn.1800205e4
lea rax, [rsp + 0x290]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x18000fa94
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x30]
call fcn.180003d10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.180017e50
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rdi
ret
Function at 0x18000fb00
Capabilities:
Enumerate processes

Disassembly:
push rbx
push rsi
push r12
push r13
push r14
sub rsp, 0x4c0
mov rax, qword [0x1800470b8]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
xor ebx, ebx
mov rsi, rdx
mov r14, rcx
mov r13d, ebx
cmp qword [rcx + 0x10], rbx
je 0x18000fb6a
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x18000fb6a
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rcx, r12
test eax, eax
jne 0x18000fb71
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x18000fd44
mov qword [rsp + 0x500], rbp
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x4b8], rdi
mov qword [rsp + 0x4b0], r15
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x18000fd20
nop dword [rax]
cmp qword [r14 + 0x18], 8
mov rcx, r14
jb 0x18000fbad
mov rcx, qword [r14]
lea rdx, [rsp + 0x5c]
call fcn.18002064c
test eax, eax
jne 0x18000fd03
cmp qword [rsi + 0x10], 0
je 0x18000fd1b
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x18000fd03
xor edx, edx
lea rcx, [rsp + 0x290]
mov r8d, 0x208
call fcn.1800195f0
mov r9d, 0x104
lea r8, [rsp + 0x290]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x18000fd03
mov qword [rsp + 0x280], rbx
lea rax, [rsp + 0x290]
mov qword [rsp + 0x288], 7
mov r8, 0xffffffffffffffff
mov word [rsp + 0x270], bx
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18000fc50
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x270]
call fcn.180003d10
cmp qword [rsi + 0x18], 8
mov r9, rsi
jb 0x18000fc7d
mov r9, qword [rsi]
mov rax, qword [rsi + 0x10]
lea rcx, [rsp + 0x270]
mov rdi, qword [rsp + 0x288]
mov rbx, qword [rsp + 0x270]
cmp rdi, 8
mov rdx, qword [rsp + 0x280]
cmovae rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.180004cf0
mov r15, rax
cmp rdi, 8
jb 0x18000fced
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x18000fce5
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000fd64
mov rcx, rbx
call fcn.180017cb8
cmp r15, 0xffffffffffffffff
je 0x18000fd01
mov r13d, dword [rsp + 0x38]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18000fba0
jmp 0x18000fd20
mov r13d, dword [rsp + 0x38]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x4b8]
mov eax, r13d
mov rbp, qword [rsp + 0x500]
mov r15, qword [rsp + 0x4b0]
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.180017e50
add rsp, 0x4c0
pop r14
pop r13
pop r12
pop rsi
pop rbx
ret
call fcn.18001c32c
int3
Function at 0x180010050
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x1800470b8]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov qword [rsp + 0x48], rcx
mov rbx, rcx
mov edi, dword [rdx]
test edi, edi
jne 0x18001008e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x208
call fcn.1800195f0
xor edx, edx
lea rcx, [rbp + 0x190]
mov r8d, 0x208
call fcn.1800195f0
movdqa xmm0, xmmword [0x180040b90]
lea rdx, str.SeDebugPrivilege
xor esi, esi
mov dword [rsp + 0x50], 0x104
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x54], 0x104
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x40], esi
lea r8d, [rsi + 0x10]
mov word [rsp + 0x60], si
movdqu xmmword [rsp + 0x70], xmm0
call fcn.180003d10
lea rcx, [rsp + 0x60]
call fcn.180010280
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x180010142
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001013d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001026e
call fcn.180017cb8
mov r8d, edi
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x180010219
lea r8, [rsp + 0x48]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180010219
mov r9d, dword [rsp + 0x40]
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r8 + 1]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1800101a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x180010219
mov ecx, dword [rsp + 0x40]
call fcn.18001c8b8
mov rdi, rax
test rax, rax
je 0x180010219
mov r9d, dword [rsp + 0x40]
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov r8, rdi
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x180010211
mov rdx, qword [rdi]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x54]
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x80]
lea rax, [rbp + 0x190]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
mov rcx, rdi
call fcn.18001f67c
mov qword [rbx + 0x10], rsi
lea rax, [rbp - 0x80]
mov qword [rbx + 0x18], 7
mov r8, 0xffffffffffffffff
mov word [rbx], si
inc r8
cmp word [rax + r8*2], si
jne 0x180010233
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.180003d10
mov rax, rbx
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.180017e50
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x4b0
pop rdi
pop rsi
pop rbp
ret
call fcn.18001c32c
int3
Function at 0x1800109b0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x50
xor ebp, ebp
mov rbx, r9
cmp qword [rdx + 0x18], 8
mov rdi, r8
mov qword [rsp + 0x60], rbp
jb 0x1800109d6
mov rdx, qword [rdx]
mov eax, dword [rsp + 0x88]
lea r8, [rsp + 0x60]
mov rcx, qword [rcx]
or eax, 0x2001b
mov qword [rsp + 0x40], rbp
xor r9d, r9d
mov qword [rsp + 0x38], r8
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x180010a23
xor al, al
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
cmp qword [rbx + 0x18], 8
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x68], rsi
jb 0x180010a36
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 8
jb 0x180010a40
mov rdi, qword [rdi]
mov r9d, dword [rsp + 0x80]
lea eax, [rax*2 + 2]
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rdi
mov qword [rsp + 0x20], rbx
mov sil, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
test eax, eax
movzx ebx, sil
cmovne ebx, ebp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x68]
movzx eax, bl
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x180010b30
Capabilities:
Check os version

Disassembly:
sub rsp, 0x278
mov rax, qword [0x1800470b8]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
lea rcx, [rsp + 0x144]
mov r8d, 0x118
call fcn.1800195f0
mov rax, qword gs:[0x58]
mov ecx, dword [0x180048370]
mov edx, 4
mov dword [rsp + 0x140], 0x11c
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x18004a018], eax
jg 0x180010c37
mov rax, qword [0x18004a020]
test rax, rax
je 0x180010c18
lea rcx, [rsp + 0x140]
call rax
test eax, eax
jne 0x180010c18
cmp dword [rsp + 0x144], 0xa
sete al
test al, al
jne 0x180010c18
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x110
call fcn.1800195f0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180010c1d
mov eax, dword [rsp + 0x24]
cmp eax, 5
jne 0x180010c0c
cmp dword [rsp + 0x28], 1
jne 0x180010c1d
xor al, al
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180017e50
add rsp, 0x278
ret
cmp eax, 6
jne 0x180010c1d
cmp dword [rsp + 0x28], 1
jne 0x180010c1d
call fcn.180010ab0
mov al, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180017e50
add rsp, 0x278
ret
lea rcx, [0x18004a018]
call fcn.1800180c0
cmp dword [0x18004a018], 0xffffffff
jne 0x180010b90
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x18004a018]
mov qword [0x18004a020], rax
call fcn.180018060
jmp 0x180010b90
Function at 0x180013460
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x3740]
mov eax, 0x3840
call fcn.180017de0
sub rsp, rax
mov rax, qword [0x1800470b8]
xor rax, rsp
mov qword [rbp + 0x3730], rax
xor r14d, r14d
mov esi, r14d
mov ebx, r14d
nop dword [rax]
nop dword [rax + rax]
mov r8d, ebx
lea rdx, str..PhysicalDrive_d
lea rcx, [rsp + 0x60]
call fcn.180013fc0
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, [rsp + 0x60]
xor edx, edx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800136ac
xor edx, edx
mov dword [rsp + 0x40], r14d
mov r8d, 0x2710
mov qword [rsp + 0x4c], r14
lea rcx, [rbp + 0x1020]
mov dword [rsp + 0x48], r14d
call fcn.1800195f0
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x48]
lea rax, [rbp + 0x1020]
mov dword [rsp + 0x28], 0x2710
mov r9d, 0xc
mov qword [rsp + 0x20], rax
mov edx, 0x2d1400
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x18001369d
mov edx, dword [rbp + 0x102c]
mov byte [rbp + 0x840], r14b
test edx, edx
jle 0x180013585
lea r9, [rbp + 0x840]
xor r8d, r8d
lea rcx, [rbp + 0x1020]
call fcn.180013290
mov edx, dword [rbp + 0x1030]
mov byte [rbp + 0x450], r14b
test edx, edx
jle 0x1800135ac
lea r9, [rbp + 0x450]
xor r8d, r8d
lea rcx, [rbp + 0x1020]
call fcn.180013290
mov edx, dword [rbp + 0x1034]
mov byte [rbp + 0xc30], r14b
test edx, edx
jle 0x1800135d3
lea r9, [rbp + 0xc30]
xor r8d, r8d
lea rcx, [rbp + 0x1020]
call fcn.180013290
mov edx, dword [rbp + 0x1038]
xor al, al
mov byte [rbp + 0x60], al
test edx, edx
jle 0x1800135fc
lea r9, [rbp + 0x60]
mov r8d, 1
lea rcx, [rbp + 0x1020]
call fcn.180013290
movzx eax, byte [rbp + 0x60]
cmp byte [0x1800495f0], r14b
jne 0x180013650
movsx ecx, al
call fcn.180020ce0
test eax, eax
jne 0x18001361e
movsx ecx, byte [rbp + 0x73]
call fcn.180020ce0
test eax, eax
je 0x180013650
lea r8, [rbp + 0x60]
mov edx, 0x400
lea rcx, [0x1800495f0]
call fcn.18002104c
lea r8, [rbp + 0x450]
mov edx, 0x400
lea rcx, [0x180049c00]
call fcn.18002104c
mov esi, 1
xor edx, edx
lea rcx, [rbp + 0x1020]
mov r8d, 0x2710
call fcn.1800195f0
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rbp + 0x1020]
mov dword [rsp + 0x28], 0x2710
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x700a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x1800136a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, 0x10
jl 0x1800134b0
mov eax, esi
mov rcx, qword [rbp + 0x3730]
xor rcx, rsp
call fcn.180017e50
lea r11, [rsp + 0x3840]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret