joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180016470
Capabilities:
Encrypt data using aes via x86 extensions
Reference processor manufacturer constants

Disassembly:
push rbx
sub rsp, 0x20
mov r8d, 1
mov eax, r8d
xor ecx, ecx
cpuid
mov dword [rsp + 0x10], eax
mov dword [rsp + 0x14], ebx
mov dword [rsp + 0x1c], edx
bt ecx, 0x19
jae 0x18001649a
mov eax, r8d
jmp 0x180016510
test ecx, ecx
jns 0x18001650e
mov eax, 0x40000000
xor ecx, ecx
cpuid
mov dword [rsp + 0x10], eax
cmp ebx, 0x7263694d
jne 0x18001650e
cmp ecx, 0x666f736f
jne 0x18001650e
cmp edx, 0x76482074
jne 0x18001650e
movdqa xmm0, xmmword [0x1800276e0]
aesenc xmm0, xmmword [0x1800276f0]
movdqa xmmword [rsp + 0x10], xmm0
movabs rax, 0x5f77774d4b7b7b54
cmp qword [rsp + 0x10], rax
jne 0x1800164fc
movabs rax, 0x63636367427c7c58
cmp qword [rsp + 0x18], rax
je 0x1800164ff
xor r8d, r8d
mov dword [rsp], r8d
jmp 0x180016495
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x180016a40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [rsp + 0x90]
mov rbp, r8
mov rdi, rdx
mov r13, rcx
shr r9, 9
mov qword [rsp + 0x28], 0
lea r15, [rax + 0x1670]
lea r14, [rax + 0x1e0]
nop dword [rax + rax]
inc r9
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8, r15
mov qword [rsp + 0x20], r9
call fcn.18000dd70
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov r12d, 0x20
nop word [rax + rax]
mov rax, qword [r13]
mov r8, r14
mov rdx, rdi
xor rax, rbx
mov rcx, rdi
mov qword [rdi], rax
mov rax, qword [r13 + 8]
xor rax, rsi
mov qword [rdi + 8], rax
call fcn.18000e530
xor qword [rdi], rbx
xor qword [rdi + 8], rsi
mov rdx, rsi
mov rcx, rbx
shr rdx, 0x3f
shr rcx, 0x3f
lea rax, [rsi + rsi]
add rbx, rbx
mov rsi, rcx
add r13, 0x10
imul rdx, rdx, 0x87
xor rbx, rdx
add rdi, 0x10
or rsi, rax
dec r12
jne 0x180016ac0
sub rbp, 0x200
je 0x180016b2f
mov r9, qword [rsp + 0x20]
jmp 0x180016a90
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180016b60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [rsp + 0x90]
mov rbp, r8
mov rdi, rdx
mov r13, rcx
shr r9, 9
mov qword [rsp + 0x28], 0
lea r15, [rax + 0x1670]
lea r14, [rax + 0x1e0]
nop dword [rax + rax]
inc r9
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8, r15
mov qword [rsp + 0x20], r9
call fcn.18000dd70
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov r12d, 0x20
nop word [rax + rax]
mov rax, qword [r13]
mov r8, r14
mov rdx, rdi
xor rax, rbx
mov rcx, rdi
mov qword [rdi], rax
mov rax, qword [r13 + 8]
xor rax, rsi
mov qword [rdi + 8], rax
call fcn.18000dd70
xor qword [rdi], rbx
xor qword [rdi + 8], rsi
mov rdx, rsi
mov rcx, rbx
shr rdx, 0x3f
shr rcx, 0x3f
lea rax, [rsi + rsi]
add rbx, rbx
mov rsi, rcx
add r13, 0x10
imul rdx, rdx, 0x87
xor rbx, rdx
add rdi, 0x10
or rsi, rax
dec r12
jne 0x180016be0
sub rbp, 0x200
je 0x180016c4f
mov r9, qword [rsp + 0x20]
jmp 0x180016bb0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1800174e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or r8d, 0xffffffff
lea r9, [rcx + 1]
mov r10d, 0x1ee
lea r11, [0x180027090]
nop word [rax + rax]
movzx ecx, byte [r9 - 1]
movzx eax, r8b
shr r8d, 8
xor rcx, rax
movzx eax, byte [r9]
add r9, 4
mov edx, dword [r11 + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
xor rcx, rax
mov r8d, dword [r11 + rcx*4]
movzx ecx, byte [r9 - 3]
xor r8d, edx
movzx eax, r8b
shr r8d, 8
xor rcx, rax
mov edx, dword [r11 + rcx*4]
movzx ecx, byte [r9 - 2]
xor edx, r8d
movzx eax, dl
shr edx, 8
xor rcx, rax
mov r8d, dword [r11 + rcx*4]
xor r8d, edx
dec r10
jne 0x180017500
not r8d
mov eax, r8d
ret
Function at 0x180017820
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov r11, rsp
push rbx
push rdi
sub rsp, 0x58
mov qword [r11 + 0x18], rbp
mov qword [r11 - 0x20], r12
mov rbp, rdx
xor edx, edx
mov r12, rcx
mov ecx, dword [rcx + 0xc]
mov rax, r9
mov qword [r11 - 0x28], r13
mov qword [r11 - 0x30], r14
div rcx
mov qword [r11 - 0x38], r15
mov rbx, r9
movsxd r14, r8d
test rdx, rdx
jne 0x180017873
mov eax, r14d
div ecx
test edx, edx
jne 0x180017873
mov r15d, dword [rsp + 0x70]
mov qword [r11 + 0x10], rbx
mov r13d, r14d
mov rdi, rbp
jmp 0x1800178a9
mov ecx, dword [r12 + 0xc]
xor edx, edx
mov rax, rbx
div rcx
mov eax, edx
mov r15, rdx
lea r13d, [rdx + r14]
sub rbx, rax
xor edx, edx
mov eax, r13d
mov qword [rsp + 0x78], rbx
div ecx
sub ecx, edx
add r13d, ecx
mov ecx, r13d
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
test rdi, rdi
jne 0x1800178b6
lea ebx, [rdi + 9]
jmp 0x18001795e
mov rcx, qword [r12]
lea r8, [rsp + 0x7c]
xor r9d, r9d
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x70], eax
cmp eax, 0xffffffff
jne 0x1800178dd
mov ebx, 0xf
jmp 0x18001795e
mov rcx, qword [r12]
mov qword [rsp + 0x50], rsi
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x70]
mov r8d, r13d
mov rdx, rdi
cmp rdi, rbp
je 0x180017947
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18001790c
lea ebx, [rsi + 0xf]
jmp 0x180017959
mov ecx, r15d
mov r8, r14
mov rdx, rbp
add rcx, rdi
call sub.msvcrt.dll_memcpy
mov edx, dword [rsp + 0x78]
mov rcx, qword [r12]
lea r8, [rsp + 0x7c]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [r12]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x70]
mov r8d, r13d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, 0xf
test eax, eax
cmove esi, ebx
mov ebx, esi
mov rsi, qword [rsp + 0x50]
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
cmp rdi, rbp
mov rbp, qword [rsp + 0x80]
je 0x180017988
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov eax, ebx
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x1800179a0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rbp, rdx
xor edx, edx
mov rdi, rcx
mov ecx, dword [rcx + 0xc]
mov rax, r9
mov qword [rsp + 0x70], rbx
div rcx
mov qword [rsp + 0x78], r14
mov rbx, r9
movsxd r12, r8d
test rdx, rdx
jne 0x1800179ed
mov eax, r12d
div ecx
test edx, edx
jne 0x1800179ed
mov r13d, dword [rsp + 0x60]
mov qword [rsp + 0x68], rbx
mov r14d, r12d
mov rsi, rbp
jmp 0x180017a21
mov ecx, dword [rdi + 0xc]
xor edx, edx
mov rax, rbx
div rcx
mov eax, edx
mov r13, rdx
lea r14d, [rdx + r12]
sub rbx, rax
xor edx, edx
mov eax, r14d
mov qword [rsp + 0x68], rbx
div ecx
sub ecx, edx
add r14d, ecx
mov ecx, r14d
call qword [sym.imp.msvcrt.dll_malloc]
mov rsi, rax
test rsi, rsi
jne 0x180017a2b
lea edi, [rsi + 9]
jmp 0x180017a75
mov rcx, qword [rdi]
lea r8, [rsp + 0x6c]
xor r9d, r9d
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x60], eax
cmp eax, 0xffffffff
jne 0x180017a4e
mov edi, 0xf
jmp 0x180017a75
mov rcx, qword [rdi]
lea r9, [rsp + 0x60]
xor ebx, ebx
mov r8d, r14d
mov rdx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, 0xf
test eax, eax
cmove ebx, edi
mov edi, ebx
mov r14, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
cmp rsi, rbp
je 0x180017aa2
test edi, edi
jne 0x180017a99
mov edx, r13d
mov r8, r12
mov rcx, rbp
add rdx, rsi
call sub.msvcrt.dll_memcpy
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov eax, edi
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x180017d50
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rbp, r8
mov rsi, rdx
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x180017d9d
lea eax, [rbx + 0xd]
jmp 0x180017dfd
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
movsxd rcx, eax
mov dword [rbp], eax
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rsi], rax
test rax, rax
jne 0x180017dc1
lea ebx, [rax + 9]
jmp 0x180017ded
mov r8d, dword [rbp]
lea r9, [rsp + 0x68]
mov rdx, rax
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180017ded
mov rcx, qword [rsi]
call qword [sym.imp.msvcrt.dll_free]
mov ebx, 0xf
test rdi, rdi
je 0x180017dfb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180017e20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor r9d, r9d
mov edi, r8d
mov rsi, rdx
mov qword [rsp + 0x30], 0
lea r8d, [r9 + 1]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180017ea1
lea r9, [rsp + 0x68]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov eax, 0xd
add rsp, 0x40
pop rdi
ret

Function at 0x180017ec0
Capabilities:
Get token membership

Disassembly:
push rdi
sub rsp, 0x80
mov rax, qword [0x18002d000]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor edi, edi
lea rax, [rsp + 0x68]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
lea r8d, [rdi + 0x20]
mov r9d, 0x220
mov dl, 2
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x70], 0
mov word [rsp + 0x74], 0x500
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x60], edi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov rdx, qword [rsp + 0x68]
test rdx, rdx
jne 0x180017f3a
lea eax, [rdi + 9]
jmp 0x180017f7e
lea r8, [rsp + 0x60]
xor ecx, ecx
mov qword [rsp + 0x90], rbx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x180017f58
lea ebx, [rax + 1]
jmp 0x180017f64
cmp dword [rsp + 0x60], edi
mov ebx, 0x1b
cmovne ebx, edi
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x180017f74
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18000ee20
add rsp, 0x80
pop rdi
ret

Function at 0x1800181c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x40
mov dword [rsp + 0x38], ecx
mov ebx, ecx
mov edx, ecx
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x1800181f2
add rsp, 0x40
pop rbx
ret
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov ecx, 0x2201f0
lea r8d, [r9 + 0xc]
mov dword [rsp + 0x20], 0
call sym.dcapi.dll_dc_device_control
test eax, eax
je 0x180018222
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualLock]
mov rax, qword [rsp + 0x30]
add rsp, 0x40
pop rbx
ret
Function at 0x180018b10
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
push rbx
push rdi
push r15
sub rsp, 0x50
mov r10d, dword [rcx + 0xc]
mov qword [r11 + 0x20], rbp
mov rdi, rdx
xor edx, edx
xor eax, eax
mov qword [r11 - 0x20], rsi
div r10
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
xor r12d, r12d
mov qword [r11 - 0x38], r14
mov r15, r9
mov r14, rcx
mov rbp, rdx
test rdx, rdx
jne 0x180018b74
mov eax, 0x200
div r10d
test edx, edx
jne 0x180018b74
mov ebp, dword [rsp + 0x70]
mov ebx, r12d
mov r13d, 0x200
mov qword [r11 + 0x10], rbx
mov rsi, rdi
jmp 0x180018b9f
lea r13d, [rbp + 0x200]
xor edx, edx
mov ebx, ebp
mov eax, r13d
neg rbx
div r10d
mov qword [rsp + 0x78], rbx
sub r10d, edx
add r13d, r10d
mov ecx, r13d
call qword [sym.imp.msvcrt.dll_malloc]
mov rsi, rax
test rsi, rsi
jne 0x180018ba9
lea ebx, [rsi + 9]
jmp 0x180018bf3
mov rcx, qword [r14]
lea r8, [rsp + 0x7c]
xor r9d, r9d
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x70], eax
cmp eax, 0xffffffff
jne 0x180018bcc
mov ebx, 0xf
jmp 0x180018bf3
mov rcx, qword [r14]
lea r9, [rsp + 0x70]
mov r8d, r13d
mov rdx, rsi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, 0xf
test eax, eax
cmove r12d, ebx
mov ebx, r12d
mov r14, qword [rsp + 0x30]
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
cmp rsi, rdi
je 0x180018c27
test ebx, ebx
jne 0x180018c1e
mov edx, ebp
mov r8d, 0x200
mov rcx, rdi
add rdx, rsi
call sub.msvcrt.dll_memcpy
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x88]
test ebx, ebx
jne 0x180018c8e
mov eax, 0xaa55
cmp word [rdi + 0x1fe], ax
je 0x180018c52
lea eax, [rbx + 0x12]
add rsp, 0x50
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rdi + 2]
cmp eax, 0x10eb9090
je 0x180018c71
cmp eax, 0x20b60251
je 0x180018c71
mov eax, 0x15
add rsp, 0x50
pop r15
pop rdi
pop rbx
ret
mov rcx, qword [rdi + 0xe]
mov rax, qword [rsp + 0x80]
shl rcx, 9
mov qword [rax], rcx
movzx ecx, word [rdi + 8]
shl ecx, 9
mov dword [r15], ecx
mov eax, ebx
add rsp, 0x50
pop r15
pop rdi
pop rbx
ret
Function at 0x180019bc0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
xor ebx, ebx
mov r12, rcx
mov rcx, qword [0x18002dba8]
test edx, edx
lea r8, str.EXEFILE
mov edi, ebx
mov edx, 0x8d
jne 0x180019bf5
mov edx, 0x8c
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x180019c33
mov rcx, qword [0x18002dba8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [0x18002dba8]
mov rdx, rbp
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
jmp 0x180019c37
mov esi, dword [rsp + 0x68]
test rdi, rdi
jne 0x180019c41
lea eax, [rdi + 1]
jmp 0x180019c9b
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0x40000000
lea r8d, [r9 + 1]
mov rcx, r12
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x180019c94
lea r9, [rsp + 0x68]
mov r8d, esi
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180019c99
mov ebx, 0xd
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x18001a250
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push r13
push r14
mov eax, 0x12a0
call fcn.180020aa0
sub rsp, rax
mov rax, qword [0x18002d000]
xor rax, rsp
mov qword [rsp + 0x1280], rax
xor r13d, r13d
xor ebp, ebp
mov r14, r8
mov rsi, rdx
mov ebx, ecx
cmp ecx, 0xffffffff
jne 0x18001a2c1
lea rdx, [rsp + 0x260]
lea rcx, str..GLOBALROOTArcNamemulti_0_disk_0_rdisk_0_partition_1_
call sym.dcapi.dll_dc_get_drive_info
test eax, eax
jne 0x18001a2b4
cmp dword [rsp + 0x264], 2
ja 0x18001a2b4
mov ebx, dword [rsp + 0x278]
jmp 0x18001a2b9
mov eax, 0x1c
test eax, eax
jne 0x18001a434
mov qword [rsp + 0x1298], rdi
test rsi, rsi
je 0x18001a328
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rsi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x18001a306
lea eax, [r13 + 0xf]
jmp 0x18001a42c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test eax, eax
je 0x18001a31e
cmp eax, 0x200000
jle 0x18001a366
mov ebx, 0x16
jmp 0x18001a404
xor edx, edx
mov ecx, ebx
call sym.dcapi.dll_dc_disk_open
mov rbp, rax
test rax, rax
jne 0x18001a341
lea eax, [rbp + 0xd]
jmp 0x18001a42c
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.180018b10
mov ebx, eax
test eax, eax
jne 0x18001a412
mov edi, dword [rsp + 0x40]
movsxd rcx, edi
mov qword [rsp + 0x1290], r12
call qword [sym.imp.msvcrt.dll_malloc]
mov r12, rax
test rax, rax
jne 0x18001a384
lea ebx, [rax + 9]
jmp 0x18001a3fc
mov r8d, edi
mov rdx, rax
test rsi, rsi
je 0x18001a3af
lea r9, [rsp + 0x50]
mov rcx, r13
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18001a3c2
lea ebx, [rax + 0xf]
jmp 0x18001a3f3
mov r9, qword [rsp + 0x48]
mov rcx, rbp
call sym.dcapi.dll_dc_disk_read
mov ebx, eax
test eax, eax
jne 0x18001a3f3
mov rdx, r12
cmp edi, 0x5c8
jbe 0x18001a3ee
nop dword [rax]
cmp dword [rdx], 0x1434a669
jne 0x18001a3e1
cmp dword [rdx + 4], 0x7269da46
je 0x18001a453
dec edi
inc rdx
cmp edi, 0x5c8
ja 0x18001a3d0
mov ebx, 0x17
mov rcx, r12
call qword [sym.imp.msvcrt.dll_free]
mov r12, qword [rsp + 0x1290]
test r13, r13
je 0x18001a412
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbp, rbp
je 0x18001a42a
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
mov eax, ebx
mov rdi, qword [rsp + 0x1298]
mov rcx, qword [rsp + 0x1280]
xor rcx, rsp
call fcn.18000ee20
add rsp, 0x12a0
pop r14
pop r13
pop rsi
pop rbp
pop rbx
ret
test rdx, rdx
je 0x18001a3ee
mov rcx, r14
mov r8d, 0x5c8
call sub.msvcrt.dll_memcpy
xor ebx, ebx
jmp 0x18001a3f3
Function at 0x18001ab50
Capabilities:
Get disk information via ioctl

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x18002d000]
xor rax, rsp
mov qword [rsp + 0x280], rax
movzx eax, word [rcx]
mov esi, r8d
mov ebx, edx
cmp ax, 0x5c
je 0x18001aba4
lea r8, str.._c:
lea rcx, [rsp + 0x70]
movzx r9d, ax
mov edx, 0x104
call qword [sym.imp.msvcrt.dll__snwprintf]
jmp 0x18001abb8
mov rdx, rcx
lea rcx, [rsp + 0x70]
mov r8d, 0x104
call qword [sym.imp.msvcrt.dll_wcsncpy]
xor ebp, ebp
lea rcx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rbp
lea r8d, [rbp + 3]
mov edx, 0xc0000000
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18001abf3
lea eax, [rbp + 0xd]
jmp 0x18001ad02
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov edx, 0x70000
mov rcx, rdi
mov dword [rsp + 0x28], 0x18
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x18001ac34
lea ebx, [rax + 1]
jmp 0x18001acd5
cmp dword [rsp + 0x60], 0xb
je 0x18001ac45
mov ebx, 0x28
jmp 0x18001acd5
test dword [rsp + 0x6c], 0x1ff
je 0x18001ac56
mov ebx, 0x22
jmp 0x18001acd5
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x2d1080
mov rcx, rdi
mov dword [rsp + 0x28], 0xc
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x18001ac94
lea ebx, [rax + 1]
jmp 0x18001acd5
test ebx, ebx
jne 0x18001ace7
mov ecx, dword [rsp + 0x4c]
call fcn.180018ca0
test eax, eax
jne 0x18001acd0
mov ecx, dword [rsp + 0x4c]
lea edx, [rbx + 1]
mov r8d, esi
call sym.dcapi.dll_dc_set_mbr
mov ebx, eax
cmp eax, 0x14
jne 0x18001acd5
mov ecx, dword [rsp + 0x4c]
mov r8d, esi
xor edx, edx
call sym.dcapi.dll_dc_set_mbr
mov ebx, eax
cmp eax, 0x14
jne 0x18001acd5
mov ebx, 0x29
test rdi, rdi
je 0x18001ace3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x18001ad02
mov r8d, dword [rsp + 0x4c]
lea r9, [rsp + 0x58]
lea rdx, [rsp + 0x70]
mov rcx, rdi
mov dword [rsp + 0x20], esi
call fcn.18001a590
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.18000ee20
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18001af30
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
lea r8, [rsp + 0x50]
lea rdx, str.SYSTEMCurrentControlSetServicesdcryptInstances
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], eax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov ebx, eax
test eax, eax
jne 0x18001b049
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rdi
lea rdi, str.dcrypt
lea r9d, [rax + 1]
lea rdx, str.DefaultInstance
xor r8d, r8d
mov dword [rsp + 0x28], 0xe
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x18001b044
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x48]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov ebx, eax
test eax, eax
jne 0x18001b044
mov rcx, qword [rsp + 0x48]
lea rax, str.87150
lea r9d, [rbx + 1]
lea rdx, str.Altitude
xor r8d, r8d
mov dword [rsp + 0x28], 0xc
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x18001b044
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r9d, [rbx + 4]
lea rdx, str.Flags
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x18001b044
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ebx, eax
test eax, eax
jne 0x18001b044
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ebx, eax
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x18001b059
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18001b069
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x18001b080
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov edi, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x18001b0d6
lea rdx, [0x180027490]
mov r8d, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x18001b0d6
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x18001b0de
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test rdi, rdi
je 0x18001b0ec
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rsi, rsi
je 0x18001b0fa
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret