joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ad380
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov rdi, r8
xor r12d, r12d
mov rbx, r9
mov rsi, rdx
mov rbp, rcx
mov r8, r9
mov rcx, rdi
xor edx, edx
mov qword [rax - 0x28], r12
mov qword [rax - 0x30], r12
mov dword [rax + 0x20], r12d
mov dword [rax - 0x38], 4
mov dword [rax - 0x34], ebx
call fcn.1800cc600
mov r9d, dword [rsp + 0x90]
lea rcx, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1800ad49c
mov edx, dword [rsp + 0x98]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1800ad47a
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1800ad47a
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x88]
lea edx, [r12 + 4]
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1800ad47a
mov eax, dword [rsp + 0x88]
cmp rbx, rax
jb 0x1800ad47a
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x34]
lea edx, [r12 + 2]
mov r8, rdi
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1800ad48a
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1800ad49c
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret

Function at 0x1800af410
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rdi, rcx
lea rcx, [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm6
mov rbx, rdx
call fcn.1800a4500
lea rcx, [rsp + 0x20]
mov r8, qword [rax]
mov rax, qword [rax + 8]
mov rdx, rbx
mov qword [rcx], r8
mov qword [rcx + 8], rax
mov rcx, rdi
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x1800af4c0
movaps xmm6, xmmword [rsp + 0x20]
nop dword [rax]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.1800a4500
lea rdx, [rsp + 0x30]
mov rcx, qword [rax]
mov rax, qword [rax + 8]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.1800a4590
test rax, rax
js 0x1800af4d2
cmp rax, 0x3e8
jg 0x1800af4d2
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x1800af460
xor eax, eax
mov rbx, qword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
mov rbx, qword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x50]
mov eax, 1
add rsp, 0x60
pop rdi
ret
Function at 0x1800b00b0
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x18015f460]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov edx, 1
mov edi, 2
mov rsi, r9
lea r8d, [rdx + 5]
mov ecx, edi
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov dword [rsp + 0x34], 1
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800b02a5
xor eax, eax
mov ecx, 0x7f000001
mov qword [rsp + 0x38], rax
mov word [rsp + 0x38], di
mov qword [rsp + 0x40], rax
call qword [sym.imp.WS2_32.dll_htonl]
lea r9, [rsp + 0x34]
lea r8d, [rdi + 2]
mov dword [rsp + 0x3c], eax
xor eax, eax
mov edx, 0xffff
mov rcx, rbx
mov qword [rsi + 8], 0xffffffffffffffff
mov qword [rsi], 0xffffffffffffffff
mov word [rsp + 0x3a], ax
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1800b0289
lea r8d, [rdi + 0xe]
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1800b0289
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1800b0289
lea edx, [rdi - 1]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x1800b0289
lea edx, [rdi - 1]
xor r8d, r8d
mov ecx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
je 0x1800b0289
lea r8d, [rdi + 0xe]
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1800b0289
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rsi + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1800b0289
lea r8, [0x180118b5c]
lea edx, [rdi + 0xa]
lea rcx, [rsp + 0x48]
mov r9, rsi
call fcn.1800883d0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x48]
lea rdx, [rsp + 0x48]
xor r9d, r9d
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
lea r8d, [rcx - 1]
mov rcx, qword [rsi]
call qword [sym.imp.WS2_32.dll_send]
movsxd rdx, eax
cmp rdx, rdi
jne 0x1800b0289
mov rcx, qword [rsi + 8]
xor r9d, r9d
lea rdx, [rsp + 0x54]
lea r8d, [r9 + 0xc]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, rdi
jne 0x1800b0289
lea rdx, [rsp + 0x54]
lea rcx, [rsp + 0x48]
mov r8, rdi
call fcn.1800cd760
test eax, eax
jne 0x1800b0289
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x1800b02a8
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rsi]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rsi + 8]
call qword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800c9b90
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1800b03b0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1800cfb44
test rax, rax
je 0x1800b03d9
cmp rax, 0xffffffffffffffff
jne 0x1800b03db
xor eax, eax
add rsp, 0x38
ret
Function at 0x1800b4110
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
xor eax, eax
test edx, edx
lea r8, [rsp + 0x38]
setne al
mov edx, 0x8004667e
mov dword [rsp + 0x38], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret

Function at 0x1800b4280
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x18015f460]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
mov rsi, r8
mov rbx, rdx
lea rcx, [rsp + 0x48]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1800b43cd
movzx edx, byte [rsi + 1]
movzx ecx, byte [rsi]
movzx r8d, byte [rsi + 5]
xor eax, eax
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x64], cl
shl cl, 7
movzx eax, dl
shr al, 1
shl dl, 6
mov byte [rsp + 0x58], 8
or al, cl
movzx ecx, byte [rsi + 2]
mov byte [rsp + 0x59], 2
mov byte [rsp + 0x65], al
movzx eax, cl
shl cl, 5
shr al, 2
mov dword [rsp + 0x5c], 0x6601
mov dword [rsp + 0x60], 8
or al, dl
movzx edx, byte [rsi + 3]
mov byte [rsp + 0x66], al
movzx eax, dl
shl dl, 4
shr al, 3
or al, cl
movzx ecx, byte [rsi + 4]
mov byte [rsp + 0x67], al
movzx eax, cl
shl cl, 3
shr al, 4
or al, dl
mov edx, 8
mov byte [rsp + 0x68], al
movzx eax, r8b
shl r8b, 2
shr al, 5
or al, cl
movzx ecx, byte [rsi + 6]
mov byte [rsp + 0x69], al
movzx eax, cl
add cl, cl
shr al, 6
mov byte [rsp + 0x6b], cl
lea rcx, [rsp + 0x64]
or al, r8b
mov byte [rsp + 0x6a], al
call fcn.1800becc0
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
lea r11, [rsp + 0x50]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x28], r11
lea r8d, [r9 + 0x14]
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x1800b43d1
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x1800b441e
mov ecx, dword [rsp + 0x40]
mov rax, qword [rdi]
xor r9d, r9d
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov qword [rbx], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800c9b90
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1800b4440
Capabilities:
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov r8, rcx
mov rdx, rdi
mov rcx, rsi
call fcn.1800b4280
lea r8, [rbx + 7]
lea rdx, [rdi + 8]
mov rcx, rsi
call fcn.1800b4280
lea r8, [rbx + 0xe]
lea rdx, [rdi + 0x10]
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800b4280

Function at 0x1800b5c50
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
mov rdi, rcx
mov byte [rcx], 0
mov edx, ebx
call qword [sym.imp.WS2_32.dll_gethostname]
mov byte [rbx + rdi - 1], 0
test eax, eax
jne 0x1800b5c89
lea edx, [rax + 0x2e]
mov rcx, rdi
call fcn.1800cc864
test rax, rax
je 0x1800b5c87
mov byte [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800bee20
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rbx, rcx
mov rdi, r8
mov rsi, rdx
lea rcx, [rax - 0x18]
lea r9d, [rbp + 1]
xor r8d, r8d
xor edx, edx
mov qword [rax - 0x18], rbp
mov qword [rax - 0x10], rbp
mov dword [rax - 0x28], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1800bee85
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov rcx, rdi
call fcn.18007db10
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov r8d, eax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
lea edx, [r8 + 2]
lea r9, [rsp + 0x68]
mov dword [rsp + 0x68], ebp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x68], 0x10
jne 0x1800beee3
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x68]
mov r8, rbx
mov edx, 2
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1800beef3
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1800bef05
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1800c0920
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov r12d, r8d
lea r9d, [rax + rax]
mov eax, dword [rcx + 0x20]
mov rbp, rdx
lea rcx, [r9 + rax + 0x18]
call qword [section..data]
mov rdi, rax
test rax, rax
jne 0x1800c0961
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rsp + 0x48], rsi
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rdi + 0x10], rax
cmp r12d, dword [rbx + 0x1c]
jbe 0x1800c09a5
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, r12d
mov rdx, rbp
call qword [rbx + reloc.WS2_32.dll_htonl]
mov ebp, dword [rbx + 0x18]
mov rdx, qword [rdi + 8]
add rbp, qword [rdi + 0x10]
mov rcx, rbp
call qword [rbx + reloc.WS2_32.dll_recv]
mov r12d, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test r12, r12
je 0x1800c0a05
mov rsi, r12
nop dword [rax + rax]
movzx eax, byte [rbp]
lea rdx, [rsp + 0x40]
mov r8d, 1
xor al, 0x36
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx r11d, byte [rbp]
lea rdx, [rsp + 0x40]
xor r11b, 0x5c
mov r8d, 1
inc rbp
mov byte [rsp + 0x40], r11b
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub r12, 1
jne 0x1800c09c0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1800c0a43
nop dword [rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x18011b9b9]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x18011b9ba]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1800c0a10
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
Function at 0x1800c13c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x470
mov rax, qword [0x18015f460]
xor rax, rsp
mov qword [rsp + 0x468], rax
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x498]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov qword [rsp + 0x458], rcx
mov rcx, qword [rsp + 0x458]
add rcx, 1
call fcn.1800cc52c
mov qword [rsp + 0x448], rax
mov r8, qword [rsp + 0x458]
add r8, 1
mov rdx, qword [rsp + 0x498]
mov rcx, qword [rsp + 0x448]
call fcn.1800cc700
mov dword [rsp + 0x450], 0x400
call fcn.1800c12c0
test eax, eax
je 0x1800c1493
lea rax, [rsp + 0x440]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, qword [rsp + 0x488]
mov rcx, qword [rsp + 0x480]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x454], eax
jmp 0x1800c14c6
lea rax, [rsp + 0x440]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x488]
mov rcx, qword [rsp + 0x480]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x454], eax
cmp dword [rsp + 0x454], 0
jne 0x1800c1622
lea rax, [rsp + 0x450]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x440]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x454], eax
mov rcx, qword [rsp + 0x440]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x454], 0
jne 0x1800c1622
mov qword [rsp + 0x460], 0
jmp 0x1800c154c
mov rax, qword [rsp + 0x460]
add rax, 1
mov qword [rsp + 0x460], rax
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp qword [rsp + 0x460], rcx
jae 0x1800c158f
mov rax, qword [rsp + 0x460]
movsx ecx, byte [rsp + rax + 0x40]
call fcn.1800d42b8
mov edx, eax
mov rax, qword [rsp + 0x460]
mov byte [rsp + rax + 0x40], dl
jmp 0x1800c1538
mov qword [rsp + 0x460], 0
jmp 0x1800c15b1
mov rax, qword [rsp + 0x460]
add rax, 1
mov qword [rsp + 0x460], rax
mov rax, qword [rsp + 0x458]
cmp qword [rsp + 0x460], rax
jae 0x1800c15f7
mov rcx, qword [rsp + 0x460]
mov rax, qword [rsp + 0x448]
add rax, rcx
movsx ecx, byte [rax]
call fcn.1800d42b8
mov edx, eax
mov rcx, qword [rsp + 0x460]
mov rax, qword [rsp + 0x448]
add rax, rcx
mov byte [rax], dl
jmp 0x1800c159d
mov rdx, qword [rsp + 0x448]
lea rcx, [rsp + 0x40]
call fcn.1800cd4bc
test rax, rax
je 0x1800c1622
mov rcx, qword [rsp + 0x448]
call fcn.1800cb340
mov eax, 1
jmp 0x1800c1631
mov rcx, qword [rsp + 0x448]
call fcn.1800cb340
xor eax, eax
mov rcx, qword [rsp + 0x468]
xor rcx, rsp
call fcn.1800c9b90
add rsp, 0x470
pop rdi
ret
Function at 0x1800c1650
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x20], 0xffffffff
call fcn.1800c12c0
cmp eax, 1
jne 0x1800c169d
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x28]
call fcn.1800c1200
test eax, eax
je 0x1800c169b
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call fcn.1800c1260
jmp 0x1800c16ac
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
je 0x1800c16bd
mov dword [rsp + 0x30], 1
jmp 0x1800c16c5
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x1800c16d0
Capabilities:
Get local ipv4 addresses

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x18015f460]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x30], 0
mov byte [rsp + 0x40], 0
lea rdi, [rsp + 0x41]
xor eax, eax
mov ecx, 5
rep stosb byte [rdi], al
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0x6f
jne 0x1800c17e3
mov edx, dword [rsp + 0x30]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x48], 0
je 0x1800c17e3
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x48]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp qword [rsp + 0x48], 0
je 0x1800c17d8
mov rax, qword [rsp + 0x48]
cmp dword [rax + 0x58], 6
jne 0x1800c17c8
lea rdi, [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsi, 0x50
mov ecx, 6
rep movsb byte [rdi], byte [rsi]
mov r8d, 3
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call fcn.1800cd760
test eax, eax
jne 0x1800c17c8
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x1800c17e5
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 8]
mov qword [rsp + 0x48], rax
jmp 0x1800c1772
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800c9b90
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x1800c1800
Capabilities:
Get local ipv4 addresses

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x868
mov rax, qword [0x18015f460]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov dword [rsp + 0x30], 0
mov r8d, 0x7fe
mov rdx, qword [rsp + 0x870]
lea rcx, [rsp + 0x40]
call fcn.1800d44f0
lea r11, [rsp + 0x30]
mov qword [rsp + 0x20], r11
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0x6f
jne 0x1800c191d
mov edx, dword [rsp + 0x30]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x840], rax
mov rax, qword [rsp + 0x840]
mov qword [rsp + 0x848], rax
cmp qword [rsp + 0x840], 0
je 0x1800c191d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x840]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x1800c190f
cmp qword [rsp + 0x840], 0
je 0x1800c190f
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x840]
mov rcx, qword [rcx + 0x40]
call fcn.1800d383c
test rax, rax
je 0x1800c18f9
mov rcx, qword [rsp + 0x848]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x1800c191f
mov rax, qword [rsp + 0x840]
mov rax, qword [rax + 8]
mov qword [rsp + 0x840], rax
jmp 0x1800c18be
mov rcx, qword [rsp + 0x848]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1800c9b90
add rsp, 0x868
ret
Function at 0x1800c1940
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x58], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jge 0x1800c1976
xor eax, eax
jmp 0x1800c1aac
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jge 0x1800c19cb
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x1800c1aac
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [0x18011bb00]
mov r8d, 1
xor edx, edx
lea rcx, [0x18011bbd0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jge 0x1800c1a09
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x1800c1aac
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x68], rax
mov r10, qword [rsp + 0x58]
mov r10, qword [r10]
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
call qword [r10 + Ordinal_27]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jge 0x1800c1a7d
mov dword [rsp + 0x70], 0
jmp 0x1800c1a85
mov dword [rsp + 0x70], 1
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x58]
call qword [rax + reloc.WS2_32.dll_recv]
mov eax, dword [rsp + 0x50]
add rsp, 0x88
ret

Function at 0x1800c2220
Capabilities:
Enumerate processes

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x178
mov rax, qword [0x18015f460]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov dword [rsp + 0x20], 0
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x160], rax
cmp qword [rsp + 0x160], 0xffffffffffffffff
je 0x1800c226e
mov dword [rsp + 0x30], 0x130
jmp 0x1800c2272
xor eax, eax
jmp 0x1800c22f0
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x160]
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x1800c229a
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1800c22f0
lea rdx, str.vboxservice.exe
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1800c22b8
mov dword [rsp + 0x20], 1
lea rdx, str.vboxtray.exe
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1800c22d6
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x160]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1800c229a
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1800c9b90
add rsp, 0x178
ret