joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180028800
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [rcx + 0x10]
xor ebx, ebx
mov rsi, rcx
movsxd r15, dword [rax + 0x10]
mov r8d, ebx
test r15d, r15d
jle 0x180028845
nop
mov rax, qword [rcx + 0x10]
inc r8
mov rdx, qword [rax + 8]
mov byte [r8 + rdx - 1], bl
cmp r8, r15
jl 0x180028830
mov rax, qword [rcx + 0x10]
mov r14, qword [rcx + 0x30]
mov r12, qword [rax + 8]
test r14, r14
je 0x180028999
test r12, r12
je 0x180028999
cmp r15d, 0x10000
ja 0x180028999
cmp byte [r14 + 0x18], 1
je 0x180028881
mov eax, 0xffffff39
jmp 0x18002899e
mov rcx, qword [r14 + 0x10]
mov r8d, r15d
mov rdx, r12
call fcn.180021dc0
mov ecx, eax
cmp eax, 3
jne 0x18002894f
lea ecx, [rax - 2]
call fcn.180022550
test eax, eax
jne 0x18002895c
lea r9d, [rax + 1]
xor r8d, r8d
xor edx, edx
mov rcx, r14
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov edi, 0x20
test eax, eax
je 0x18002892e
mov rcx, qword [r14]
lea r8, [rsp + 0x30]
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x18002892e
mov rcx, qword [r14]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [r14 + 0x10]
lea rdx, [rsp + 0x30]
mov r8d, edi
call fcn.180021970
test eax, eax
jne 0x18002892e
mov rcx, qword [r14 + 0x10]
xor r8d, r8d
xor edx, edx
call fcn.180021dc0
mov ecx, eax
test eax, eax
jne 0x180028933
mov rcx, qword [r14 + 0x10]
mov r8d, r15d
mov rdx, r12
call fcn.180021dc0
mov ecx, eax
jmp 0x180028933
mov ecx, 2
lea rax, [rsp + 0x30]
nop dword [rax + rax]
mov byte [rax], bl
lea rax, [rax + 1]
dec edi
jne 0x180028940
mov rdi, qword [rsp + 0x70]
test ecx, ecx
jne 0x180028957
mov eax, ebx
jmp 0x180028972
cmp ecx, 4
jne 0x180028968
mov eax, 0xffffff2f
mov byte [r14 + 0x18], 3
jmp 0x180028972
mov eax, 0xffffff39
mov byte [r14 + 0x18], 2
test eax, eax
jne 0x18002899e
test r15d, r15d
jle 0x180028995
nop dword [rax + rax]
mov rax, qword [rsi + 0x10]
inc rbx
mov rcx, qword [rax + 8]
mov byte [rbx + rcx - 1], 0
cmp rbx, r15
jl 0x180028980
xor eax, eax
jmp 0x18002899e
mov eax, 0xffffff53
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x18002b360
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xe0
mov rbx, rcx
mov edi, 0x68
lea rcx, [rsp + 0x70]
mov r8d, edi
xor edx, edx
call fcn.18002ed60
xor eax, eax
lea ecx, [rdi - 0x67]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], edi
xor edi, edi
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov dword [rsp + 0xac], ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ecx
lea rdx, [rbx + 0xc]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov word [rsp + 0xb0], di
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x18002b3ed
mov ebx, edi
jmp 0x18002b3f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x18002b40f
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov r8d, ebx
xor edx, edx
mov cl, reloc.WS2_32.dll_inet_addr
call fcn.18002c9c4
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rdi
ret

Function at 0x18002b430
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x28
movzx edx, byte [rcx + 5]
mov r8d, 1
dec edx
je 0x18002b46f
dec edx
je 0x18002b468
dec edx
je 0x18002b461
dec edx
je 0x18002b45a
cmp edx, 2
jne 0x18002b483
call fcn.18002b48c
jmp 0x18002b480
call fcn.18002b758
jmp 0x18002b480
call fcn.18002b8dc
jmp 0x18002b480
call fcn.18002b4d8
jmp 0x18002b480
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [0x180050ae0], eax
call fcn.18002ca1c
mov r8d, eax
mov eax, r8d
add rsp, 0x28
ret

Function at 0x18002b48c
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rbx, [rcx + 0xc]
mov edx, 0x80
xor edi, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call fcn.18002c380
test eax, eax
jne 0x18002b4be
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor r9d, r9d
mov r8d, edi
mov dl, 6
mov cl, 3
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18002c9c4
Function at 0x18002b758
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r14, qword [0x180050ad0]
mov rsi, qword [0x180050ad8]
mov rbp, rcx
mov ebx, 1
xor r12d, r12d
add rcx, 0x10
mov qword [rax - 0x38], r12
mov dword [rax - 0x40], 0x80
xor r9d, r9d
mov r8d, ebx
mov edx, 0x80000000
mov dword [rax - 0x48], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18002b7c6
mov dl, 4
mov cl, 3
call fcn.18002c990
jmp 0x18002b8c3
mov edx, dword [rbp + 0xc]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x18002b8a6
mov rcx, qword [0x180050ad0]
xor edx, edx
mov r8d, 0x800c
call fcn.18002ed60
mov rdx, qword [0x180050ad0]
lea r9, [rsp + 0x70]
add rdx, 0xc
mov r8d, 0x8000
mov rcx, rdi
movzx r15d, r12w
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb ebp, ebp
and ebp, dword [rsp + 0x70]
mov dword [rsp + 0x70], ebp
cmp ebp, 0x8000
jae 0x18002b833
mov r15d, 4
xor eax, eax
mov rcx, r14
mov qword [r14], rax
mov dword [r14 + 8], eax
lea edx, [rax + 0xc]
mov word [r14 + 4], 0x403
mov dword [r14], ebp
mov word [r14 + 6], r15w
call fcn.18002c29c
lea edx, [rbp + 0xc]
mov word [r14 + 0xa], ax
mov rcx, qword [0x180050ad0]
call fcn.18002e5b0
test eax, eax
jle 0x18002b8b5
xor eax, eax
mov rcx, rsi
mov qword [rsi], rax
lea edx, [rax + 0xc]
mov dword [rsi + 8], eax
call fcn.18002e4f4
cmp eax, 0xffffffff
je 0x18002b8b5
mov edx, recv
mov rcx, rsi
call fcn.18002c8d8
test eax, eax
je 0x18002b8b8
test byte [rsi + 6], bl
jne 0x18002b8b8
cmp dword [rsp + 0x70], 0x8000
jb 0x18002b8b8
cmp dword [0x180050ab0], r12d
je 0x18002b7dd
jmp 0x18002b8b8
or ebx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x18002b8dc
Capabilities:
Get file size
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rsi, qword [0x180050ad0]
xor r12d, r12d
add rcx, 0xc
mov qword [rax - 0x38], r12
lea r14d, [r12 + 1]
mov dword [rax - 0x40], 0x80
lea r15d, [r12 + 4]
xor r9d, r9d
mov edx, 0x40000000
mov r8d, r14d
mov dword [rax + 8], r12d
mov edi, r14d
mov dword [rax - 0x48], r15d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x18002b949
mov dl, 3
mov cl, dl
call fcn.18002c990
jmp 0x18002babb
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rsi
mov ebx, eax
xor eax, eax
mov qword [rsi], rax
lea edx, [rax + 0xc]
mov qword [rsi + 4], 0x303
mov dword [rsi], r15d
call fcn.18002c29c
mov word [rsi + 0xa], ax
mov dword [rsi + 0xc], ebx
mov edx, dword [rsi]
mov rcx, qword [0x180050ad0]
add edx, 0xc
call fcn.18002e5b0
test eax, eax
jg 0x18002b995
or eax, 0xffffffff
jmp 0x18002babb
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x18002ba92
mov rcx, qword [0x180050ad8]
xor edx, edx
mov r8d, 0x800c
call fcn.18002ed60
mov rbx, qword [0x180050ad8]
mov edx, recv
mov rcx, rbx
call fcn.18002e4f4
cmp eax, 0xffffffff
je 0x18002baad
mov edx, recv
mov rcx, rbx
call fcn.18002c8d8
test eax, eax
je 0x18002baa6
mov edx, dword [rbx]
lea rcx, [rbx + 0xc]
call fcn.18002e4f4
cmp eax, 0xffffffff
je 0x18002baad
mov rcx, rbx
call fcn.18002c918
test eax, eax
je 0x18002baad
mov r8d, dword [rbx]
lea r9, [rsp + 0x70]
lea rdx, [rbx + 0xc]
mov rcx, rbp
movzx r14d, r12w
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002ba42
mov eax, dword [rbx]
cmp dword [rsp + 0x70], eax
je 0x18002ba4a
mov edi, 1
mov r14d, edi
xor eax, eax
mov rcx, rsi
mov qword [rsi], rax
mov dword [rsi + 8], eax
lea r15d, [rax + 0xc]
mov edx, r15d
mov word [rsi + 4], 0x303
mov dword [rsi], r12d
mov word [rsi + 6], r14w
call fcn.18002c29c
mov edx, r15d
mov word [rsi + 0xa], ax
mov rcx, qword [0x180050ad0]
call fcn.18002e5b0
test eax, eax
jle 0x18002baad
test r14b, 1
jne 0x18002bab0
test byte [rbx + 6], 4
jne 0x18002baa1
cmp dword [0x180050ab0], r12d
je 0x18002b9ae
jmp 0x18002bab0
mov edi, r12d
jmp 0x18002bab0
mov edi, 1
jmp 0x18002bab0
or edi, 0xffffffff
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x18002bad4
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
cmp eax, dword [0x180050ae0]
je 0x18002baf9
mov dword [0x180050ae0], eax
call fcn.18002ca1c
jmp 0x18002bb38
mov rbx, qword [0x180050ad0]
xor eax, eax
xor edi, edi
mov qword [rbx], rax
lea edx, [rax + 0xc]
mov rcx, rbx
mov qword [rbx + 4], 0x20f
mov dword [rbx], edi
call fcn.18002c29c
mov word [rbx + 0xa], ax
mov rcx, qword [0x180050ad0]
lea edx, [rdi + 0xc]
call fcn.18002e5b0
test eax, eax
setg dil
lea eax, [rdi - 1]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18002bb6c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0xc]
xor edi, edi
call fcn.18002c564
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x18002bba2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x18002bbc2
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x18002bbb9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov r8d, edi
mov dl, 2
mov cl, 5
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18002c9c4
Function at 0x18002bbdc
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x260
mov rbx, qword [0x180050ad0]
xor esi, esi
lea r14, [rbx + 0xc]
mov ebp, esi
call fcn.18002c564
lea ecx, [rsi + 2]
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18002bc2c
mov dl, 1
mov cl, 5
call fcn.18002c990
jmp 0x18002bd94
mov r15d, 0x238
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, r15d
call fcn.18002ed60
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov dword [rsp + 0x20], r15d
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x18002bc62
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18002bc1e
mov rcx, qword [0x180050ad0]
mov r15d, 0x800c
xor edx, edx
mov r8d, r15d
call fcn.18002ed60
mov eax, dword [rsp + 0x28]
lea rcx, [r14 + 8]
lea rdx, [rsp + 0x4c]
mov dword [r14], eax
mov eax, dword [rsp + 0x40]
mov r8d, 0x3c
mov dword [r14 + 4], eax
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ecx, dword [rsp + 0x28]
lea rdx, [r14 + 0x80]
mov r8d, 0x104
call fcn.18002c5f8
add ebp, 0x288
add r14, 0x288
mov eax, ebp
add rax, 0x294
cmp rax, r15
jb 0x18002bd40
xor eax, eax
mov rcx, rbx
mov qword [rbx], rax
lea edx, [rax + 0xc]
mov qword [rbx + 4], 0x505
mov dword [rbx], ebp
call fcn.18002c29c
lea edx, [rbp + 0xc]
mov word [rbx + 0xa], ax
mov rcx, qword [0x180050ad0]
call fcn.18002e5b0
test eax, eax
jle 0x18002bdb1
mov rcx, qword [0x180050ad8]
xor eax, eax
mov qword [rcx], rax
lea edx, [rax + 0xc]
mov dword [rcx + 8], eax
call fcn.18002e4f4
cmp eax, 0xffffffff
je 0x18002bdb1
mov rcx, qword [0x180050ad0]
mov r8, r15
xor edx, edx
mov ebp, esi
call fcn.18002ed60
mov rbx, qword [0x180050ad0]
lea r14, [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x18002bc79
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, rbx
mov qword [rbx], rax
lea edx, [rax + 0xc]
mov qword [rbx + 4], 0x40105
mov dword [rbx], ebp
call fcn.18002c29c
lea edx, [rbp + 0xc]
mov word [rbx + 0xa], ax
mov rcx, qword [0x180050ad0]
call fcn.18002e5b0
test eax, eax
setg sil
lea eax, [rsi - 1]
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x18002bd94
Function at 0x18002bdc0
Capabilities:
Get hostname
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [0x180050ad0]
xor eax, eax
mov ebx, 0x88
mov qword [rsi], rax
lea edx, [rax + 0xc]
mov rcx, rsi
mov qword [rsi + 4], 2
mov dword [rsi], ebx
xor ebp, ebp
call fcn.18002c29c
lea rcx, [rsi + 0xc]
mov r8d, ebx
xor edx, edx
mov word [rsi + 0xa], ax
call fcn.18002ed60
call qword [sym.imp.KERNEL32.dll_GetACP]
mov dword [rsi + 0x18], 0x10008
mov dword [rsi + 0xc], eax
call fcn.18002c740
lea edx, [rbp + 0x14]
lea rcx, [rsi + 0x1c]
mov dword [rsi + 0x14], eax
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rsi + 0x1c]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx]
mov ecx, dword [rdx]
lea edx, [rbp + 0x64]
mov dword [rsi + 0x10], ecx
lea rcx, [rsi + 0x30]
call fcn.18002c7b8
mov edx, dword [rsi]
mov rcx, qword [0x180050ad0]
add edx, 0xc
call fcn.18002e5b0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
test eax, eax
setg bpl
mov eax, ebp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18002c1e0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x180050ae8]
mov r8d, 0x3e9
test rcx, rcx
je 0x18002c240
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x180050ae8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x180050af8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x180050af0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [0x180050ae8], 0
and qword [0x180050af8], 0
and qword [0x180050af0], 0
xor r8d, r8d
xor r9d, r9d
mov dl, 2
mov cl, reloc.WS2_32.dll_recv
add rsp, 0x28
jmp fcn.18002c9c4

Function at 0x18002c380
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x998]
sub rsp, 0xa90
mov rdi, rcx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ebx, ebx
test eax, eax
je 0x18002c548
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x18002c52a
lea rcx, [rbp + 0x580]
xor edx, edx
mov r8d, 0x410
call fcn.18002ed60
lea rcx, [rbp + 0x580]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str..
lea rcx, [rbp + 0x580]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x250
call fcn.18002ed60
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x580]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x18002c438
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [rsi + 2]
jmp 0x18002c548
test byte [rsp + 0x20], 0x10
je 0x18002c4b1
lea rdx, [0x18003e5b8]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x18002c500
lea rdx, [0x18003e5bc]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x18002c500
lea rcx, [rbp + 0x170]
xor edx, edx
mov r8d, 0x410
call fcn.18002ed60
lea r9, [rsp + 0x4c]
lea rdx, str._s_s
lea rcx, [rbp + 0x170]
mov r8, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x170]
call fcn.18002c380
jmp 0x18002c500
lea rcx, [rbp + 0x170]
xor edx, edx
mov r8d, 0x410
call fcn.18002ed60
lea r9, [rsp + 0x4c]
lea rdx, str._s_s
lea rcx, [rbp + 0x170]
mov r8, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x170]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18002c438
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x18002c541
mov edx, 0x80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov eax, ebx
lea r11, [rsp + 0xa90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18002c564
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
sub rsp, 0x40
and qword [rsp + 0x50], 0
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
lea edx, [rbx + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18002c5d8
lea r8, [rsp + 0x34]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x18002c5d8
mov rcx, qword [rsp + 0x50]
and qword [rsp + 0x28], rbx
and qword [rsp + 0x20], rbx
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x3c], 2
mov dword [rsp + 0x30], 1
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x18002c5e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18002c5f0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x18002c5f8
Capabilities:
Enumerate process modules

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x3a8]
sub rsp, 0x490
mov edi, r8d
mov rbx, rdx
mov r8d, r8d
mov esi, ecx
xor edx, edx
add r8, r8
mov rcx, rbx
call fcn.18002ed60
xor r15d, r15d
mov rcx, rbx
test esi, esi
jne 0x18002c676
lea r8d, [rdi - 1]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x53005b
mov dword [rsp + 0x24], 0x730079
mov dword [rsp + 0x28], 0x650074
mov dword [rsp + 0x2c], 0x5d006d
mov word [rsp + 0x30], r15w
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x18002c720
lea r14d, [rdi - 1]
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x38], 0x55005b
mov r8d, r14d
mov dword [rsp + 0x3c], 0x4b004e
mov dword [rsp + 0x40], 0x4f004e
mov dword [rsp + 0x44], 0x4e0057
mov dword [rsp + 0x48], 0x5d
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edx, esi
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18002c720
mov esi, 0x438
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, esi
call fcn.18002ed60
lea rdx, [rsp + 0x50]
mov rcx, rdi
mov dword [rsp + 0x50], esi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x18002c717
cmp dword [rsp + 0x54], 1
je 0x18002c704
lea rdx, [rsp + 0x50]
mov rcx, rdi
call sub.KERNEL32.dll_Module32NextW
jmp 0x18002c6ea
lea rdx, [rbp + 0x180]
mov r8d, r14d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x490]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18002c740
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x250
lea rcx, [rsp + 0x40]
xor ebx, ebx
xor edx, edx
mov r8d, 0x208
mov dword [rax + 8], ebx
call fcn.18002ed60
lea rdx, [rsp + 0x40]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x260]
lea rcx, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov word [rsp + 0x46], bx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [rsp + 0x260]
add rsp, 0x250
pop rbx
ret

Function at 0x18002c7b8
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x118]
sub rsp, 0x210
mov rbx, rcx
movsxd rdi, edx
mov esi, 0x9c
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, esi
call fcn.18002ed60
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x18002c8be
mov esi, 0x100
lea rcx, [rbp + 0x10]
xor edx, edx
mov r8d, esi
call fcn.18002ed60
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rbp - 0x20], 9
je 0x18002c839
cmp word [rbp - 0x20], 6
lea rcx, [0x18003e588]
jne 0x18002c840
lea rcx, [0x18003e570]
movzx eax, word [rsp + 0x4c]
mov r9d, dword [rsp + 0x44]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x54]
lea r8, str._d._d__s__d__s
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x48]
lea rcx, [rbp + 0x10]
mov rdx, rsi
mov dword [rsp + 0x20], eax
call fcn.18002cc24
lea rax, [rdi - 1]
mov edx, 0x7ffffffe
mov rcx, rdi
cmp rax, rdx
ja 0x18002c8b9
lea r8, [rbp + 0x10]
sub rdx, rcx
sub r8, rbx
lea rax, [rdx + rcx]
test rax, rax
je 0x18002c8ae
mov al, byte [r8 + rbx]
test al, al
je 0x18002c8ae
mov byte [rbx], al
inc rbx
dec rcx
jne 0x18002c893
test rcx, rcx
jne 0x18002c8b6
dec rbx
mov byte [rbx], 0
mov eax, 1
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret