joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180023b00
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [r11 + 8], rdi
mov qword [r11 - 0x38], rax
mov ebx, 0x43
mov qword [r11 - 0x30], rax
xor ebp, ebp
mov qword [r11 - 0x28], rax
lea esi, [rax + 0x1a]
mov qword [r11 - 0x20], rax
nop
mov r9d, ebx
lea r8, str._C:_
mov edx, 7
lea rcx, [rsp + 0x40]
call fcn.18000f870
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x180023bc7
mov r9d, ebx
lea r8, str.._C:
lea edx, [rax + 4]
lea rcx, [rsp + 0x50]
call fcn.18000f870
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x50]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180023bc7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
sub rsi, 1
jne 0x180023b40
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
Function at 0x180024570
Capabilities:
Acquire debug privileges
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push r15
sub rsp, 0x298
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r15, r8
mov rbp, rdx
movzx ebx, cx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.180113150
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, 0x103
lea rcx, [rsp + 0x70]
test eax, eax
je 0x1800245d6
lea r8, str._fmifs.dll
call fcn.180125a58
jmp 0x1800245e2
lea r8, str.fmifs.dll
call fcn.1801259f0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
jne 0x180024619
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rsp + 0x70]
mov rdx, rbp
mov r9d, eax
lea rcx, str.FormatVolume:_LoadLib_error_FsName_s_Dll_s_err_x
call sym.SafeBase64.dll_DbgPrintW
xor eax, eax
jmp 0x180024782
lea rdx, str.FormatEx
mov qword [rsp + 0x290], r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x180024649
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x18002477a
mov qword [rsp + 0x2c0], rdi
xor edi, edi
mov qword [rsp + 0x2d8], r12
lea r12, [0x1800244a0]
mov word [rsp + 0x58], bx
mov ebx, edi
mov word [rsp + 0x5e], di
mov dword [rsp + 0x5a], 0x5c003a
mov qword [rsp + 0x30], r12
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x28], 0x1000
mov r9, r15
mov r8, rbp
mov dword [rsp + 0x20], 1
mov edx, 0xc
mov byte [0x18019664c], dil
call r14
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, byte [0x18019664c]
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov r9d, ebx
mov dword [rsp + 0x20], ecx
mov r8, rbp
lea rcx, str.FormatVolume:_DriveRoot_s_FsName_s_i_d_ret___x_err_x
call sym.SafeBase64.dll_DbgPrintW
movzx eax, byte [0x18019664c]
test al, al
je 0x180024752
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x40]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180024747
lea r8, [rsp + 0x4c]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x54], 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, 8
jl 0x180024676
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx ecx, byte [0x18019664c]
mov r12, qword [rsp + 0x2d8]
test cl, cl
sete dil
mov eax, edi
mov rdi, qword [rsp + 0x2c0]
mov r14, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x298
pop r15
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800247a0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x610]
sub rsp, 0x710
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rbp + 0x600], rax
mov r14, r8
mov rsi, rdx
movzx edi, cx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x20]
call fcn.180113150
xor edx, edx
lea rcx, [rbp + 0x1f0]
mov r8d, 0x410
call fcn.180113150
mov edx, 0x104
lea rcx, [rbp - 0x20]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, 0x103
lea rcx, [rbp - 0x20]
test eax, eax
je 0x180024821
lea r8, str._format.com
call fcn.180125a58
jmp 0x18002482d
lea r8, str.format.com
call fcn.1801259f0
movzx eax, di
lea r9, [rbp - 0x20]
mov qword [rsp + 0x30], r14
lea r8, str._s__c:__FS:_s__Q__X__V:__s___Y
mov qword [rsp + 0x28], rsi
lea rcx, [rbp + 0x1f0]
mov edx, 0x207
mov dword [rsp + 0x20], eax
call fcn.18000f870
xor eax, eax
lea rcx, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x68]
call fcn.180113150
or dword [rbp - 0x54], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x1f0]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 1
mov word [rbp - 0x50], bx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x18002492d
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1800248f9
cmp dword [rsp + 0x68], ebx
sete bl
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, dword [rsp + 0x68]
lea rcx, str.ExFormatVolume:_bRet_x_dwExitCode_x_error_x_n
mov r9d, eax
mov edx, ebx
call sym.SafeBase64.dll_DbgPrintW
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180024944
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
lea rcx, str.ExFormatVolume:_CreateProcess_bRet_x_error_x_n
mov r8d, eax
call sym.SafeBase64.dll_DbgPrintW
mov eax, ebx
mov rcx, qword [rbp + 0x600]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x710
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180024970
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x430
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x20]
call fcn.180113150
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
test rax, rax
je 0x180024a2c
nop word [rax + rax]
mov r8d, 0x200
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x1800249fb
mov rdx, rsi
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180024a51
test edi, edi
je 0x180024a12
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call sym.SafeBase64.dll_FindWindowByName
test rax, rax
jne 0x180024a2e
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
test rax, rax
jne 0x1800249d0
xor eax, eax
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x468]
add rsp, 0x430
pop rdi
pop rsi
pop rbp
ret
mov rax, rbx
jmp 0x180024a2e

Function at 0x180024a60
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x440
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rsi, r8
mov ebp, edx
mov r14, rcx
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x30]
mov edi, r9d
call fcn.180113150
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
test rax, rax
je 0x180024b30
nop word [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp ebp, dword [rsp + 0x20]
jne 0x180024b16
mov r8d, 0x200
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x180024aff
mov rdx, rsi
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180024b50
test edi, edi
je 0x180024b16
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call sym.SafeBase64.dll_FindWindowByName
test rax, rax
jne 0x180024b32
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
test rax, rax
jne 0x180024ac0
xor eax, eax
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x440
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, rbx
jmp 0x180024b32

Function at 0x180024c60
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
lea rdx, [rsp + 0x20]
lea rcx, [0x180024c00]
mov qword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x48
ret
Function at 0x180024e90
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetFocus]
mov rbx, rax
test rax, rax
jne 0x180024edb
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x180024ed9
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov rbx, rax
jmp 0x180024edb
xor ebx, ebx
lea rdx, [rsp + 0x28]
mov dword [rsp + 0x28], 0
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x28], eax
jne 0x180024f11
mov r8d, 0x104
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x180024f13
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x180024f30
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, edx
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetFocus]
mov rbx, rax
test rax, rax
jne 0x180024f82
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x180024f80
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov rbx, rax
jmp 0x180024f82
xor ebx, ebx
lea rdx, [rsp + 0x28]
mov dword [rsp + 0x28], 0
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp edi, dword [rsp + 0x28]
jne 0x180024fb2
mov r8d, 0x104
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x180024fb4
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180025dd0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov rcx, rbx
mov edi, eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, 1
mov ecx, edi
mov edx, eax
mov ebx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.USER32.dll_ShowWindow]
xor ebp, ebp
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], ebp
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebp
mov rcx, rsi
lea rdx, [rbp - 1]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov dword [rsp + 0x30], 3
lea rdx, [rbp - 2]
mov dword [rsp + 0x28], ebp
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebp
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor r8d, r8d
mov edx, ebx
mov ecx, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
jmp qword [sym.imp.USER32.dll_AttachThreadInput]

Function at 0x180028ff0
Capabilities:
Create process on windows
Delete file
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea rdx, [0x180157ba0]
lea rcx, [0x180157ba8]
call fcn.1801258f4
mov rbx, rax
test rax, rax
je 0x18002908d
mov r9, rax
lea rcx, [0x18018a030]
mov edx, 1
mov r8d, 0x1b1a
call fcn.18012600c
mov rcx, rbx
call fcn.180125984
xor edx, edx
lea rcx, [0x180157ba8]
call qword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
nop dword [rax + rax]
lea rdx, [0x180155518]
lea rcx, [0x180157bb8]
call fcn.1801258f4
mov rdi, rax
test rax, rax
jne 0x18002909f
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xa
jl 0x180029060
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, rdi
mov edx, 1
mov r8d, 0xffff
mov rcx, rsi
call fcn.180126310
mov rcx, rdi
mov rbx, rax
call fcn.180125984
lea rcx, str.getbios.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x180157be0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp rbx, 0xf000
jb 0x18002908d
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180029100
Capabilities:
Create process on windows
Delete file
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea rdx, [0x180157ba0]
lea rcx, [0x180157bf8]
call fcn.1801258f4
mov rbx, rax
test rax, rax
je 0x18002919d
mov r9, rax
lea rcx, [0x18018bb50]
mov edx, 1
mov r8d, 0x2600
call fcn.18012600c
mov rcx, rbx
call fcn.180125984
xor edx, edx
lea rcx, str.smbios.exe_smbios.dat
call qword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
nop dword [rax + rax]
lea rdx, [0x180155518]
lea rcx, [0x180157c20]
call fcn.1801258f4
mov rdi, rax
test rax, rax
jne 0x1800291af
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xa
jl 0x180029170
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, rdi
mov edx, 1
mov r8d, 0xffff
mov rcx, rsi
call fcn.180126310
mov r8d, eax
lea rdx, [rsi + 3]
mov rcx, rsi
mov rbx, rax
call fcn.180112cb0
mov rcx, rdi
call fcn.180125984
lea rcx, str.smbios.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.smbios.dat
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18002a000
Capabilities:
Hash data using sha1

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x70]
sub rsp, 0x170
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov rdi, qword [rbp + 0xc0]
mov rax, r8
mov rsi, rcx
mov r14d, edx
xor ecx, ecx
mov r8d, r9d
xor ebx, ebx
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x78], rcx
mov rdx, rax
mov qword [rbp - 0x70], rcx
mov qword [rbp - 0x68], rcx
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x48], rcx
cmp r9d, 0x40
ja 0x18002a076
lea rcx, [rbp - 0x80]
call fcn.180112cb0
jmp 0x18002a0be
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
mov dword [rsp + 0x30], 0xc3d2e1f0
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x78], ebx
call fcn.180047f40
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x20]
call fcn.180048050
movdqa xmm5, xmmword [str.6666666666666666]
lea rdx, [rbp - 0x80]
movdqa xmm6, xmmword [0x180164b90]
lea rcx, [rsp + 0x20]
movdqu xmm2, xmmword [rbp - 0x80]
movdqa xmm0, xmm5
movdqu xmm3, xmmword [rbp - 0x70]
pxor xmm0, xmm2
movdqu xmm4, xmmword [rbp - 0x60]
movdqa xmm1, xmm6
movdqu xmm7, xmmword [rbp - 0x50]
pxor xmm1, xmm2
movdqu xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmm5
movdqu xmmword [rbp - 0x10], xmm1
pxor xmm0, xmm3
movdqu xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmm6
pxor xmm1, xmm3
mov dword [rsp + 0x20], 0x67452301
movdqu xmmword [rbp], xmm1
movdqa xmm0, xmm5
movdqa xmm1, xmm6
mov dword [rsp + 0x24], 0xefcdab89
pxor xmm0, xmm4
mov dword [rsp + 0x28], 0x98badcfe
pxor xmm1, xmm4
movdqu xmmword [rbp - 0x60], xmm0
pxor xmm5, xmm7
movdqu xmmword [rbp + 0x10], xmm1
pxor xmm6, xmm7
movdqu xmmword [rbp - 0x50], xmm5
movdqu xmmword [rbp + 0x20], xmm6
mov dword [rsp + 0x2c], 0x10325476
mov dword [rsp + 0x30], 0xc3d2e1f0
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x78], ebx
call fcn.180046d00
inc dword [rsp + 0x34]
lea rcx, [rsp + 0x20]
mov r8, r14
mov dword [rsp + 0x78], ebx
mov rdx, rsi
call fcn.180047f40
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x20]
call fcn.180048050
lea rdx, [rbp - 0x10]
mov dword [rsp + 0x20], 0x67452301
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
mov dword [rsp + 0x30], 0xc3d2e1f0
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x78], ebx
call fcn.180046d00
inc dword [rsp + 0x34]
lea rax, [rbp - 0x30]
mov r9d, 0x14
mov dword [rsp + 0x78], ebx
cmp ebx, 0x40
jge 0x18002a219
movzx ecx, byte [rax]
inc rax
movsxd r8, ebx
mov byte [rsp + r8 + 0x38], cl
mov ebx, dword [rsp + 0x78]
inc ebx
mov dword [rsp + 0x78], ebx
sub r9, 1
jne 0x18002a1f6
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.180048050
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.18010faf0
movaps xmm6, xmmword [rsp + 0x160]
movaps xmm7, xmmword [rsp + 0x150]
add rsp, 0x170
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18002a5a0
Capabilities:
Check os version
Create service
Persist via windows service

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x1e0
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
movups xmm0, xmmword [str.FSFilter_Encryption]
xor eax, eax
mov rsi, rcx
movups xmm1, xmmword [0x180158998]
lea rcx, [rsp + 0x70]
mov rbp, r8
movaps xmmword [r11 - 0x78], xmm0
mov rbx, rdx
movsd xmm0, qword [0x1801589a8]
lea edi, [rax + 1]
movsd qword [r11 - 0x58], xmm0
movaps xmmword [r11 - 0x68], xmm1
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov dword [rsp + 0x70], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x74], 5
jne 0x18002a63a
cmp dword [rsp + 0x78], 0
jne 0x18002a63a
lea r8, str.Filter
lea edx, [rdi + 0x1e]
lea rcx, [rsp + 0x190]
call fcn.1801259f0
xor r14d, r14d
lea rax, [rsp + 0x190]
mov qword [rsp + 0x60], r14
mov r9d, 0xf01ff
mov qword [rsp + 0x58], r14
mov r8, rbx
mov qword [rsp + 0x50], r14
mov rdx, rbx
mov qword [rsp + 0x48], r14
mov rcx, rsi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x18002a6c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
je 0x18002a6a8
xor edx, edx
mov rcx, rbx
call sym.SafeBase64.dll_SetDriverStartType
mov edi, r14d
mov rcx, rbx
call sym.SafeBase64.dll_CheckDriverRemoved
test eax, eax
je 0x18002a6ce
xor edx, edx
mov rcx, rbx
call sym.SafeBase64.dll_SetDriverStartType
mov eax, 1
jmp 0x18002a6d0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x1e0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18002a6f0
Capabilities:
Create service

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0xc8
mov esi, 1
call fcn.180113150
mov rdx, rdi
mov rcx, rbx
call sym.SafeBase64.dll_CopyDriverFile
lea r8, str.System32Drivers_
lea edx, [rsi + 0x62]
lea rcx, [rsp + 0x70]
call fcn.1801259f0
mov r8, rdi
lea edx, [rsi + 0x62]
lea rcx, [rsp + 0x70]
call fcn.180125a58
lea r8, str..sys
lea edx, [rsi + 0x62]
lea rcx, [rsp + 0x70]
call fcn.180125a58
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x18002a831
lea rax, [rsp + 0x70]
mov qword [rsp + 0x180], rbp
xor ebp, ebp
mov r9d, 0xf01ff
mov qword [rsp + 0x60], rbp
mov r8, rdi
mov qword [rsp + 0x58], rbp
mov rdx, rdi
mov qword [rsp + 0x50], rbp
mov rcx, rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x18002a815
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
je 0x18002a7fa
lea edx, [rbp + 3]
mov rcx, rdi
call sym.SafeBase64.dll_SetDriverStartType
mov esi, ebp
mov rcx, rdi
call sym.SafeBase64.dll_CheckDriverRemoved
test eax, eax
je 0x18002a81e
mov edx, 3
mov rcx, rdi
call sym.SafeBase64.dll_SetDriverStartType
jmp 0x18002a81e
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x180]
mov eax, esi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x150
pop rdi
pop rsi
pop rbx
ret
Function at 0x18002a850
Capabilities:
Create service

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov ebp, r8d
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0xc8
lea rcx, [rsp + 0x70]
mov esi, 1
call fcn.180113150
mov rdx, rdi
mov rcx, rbx
call sym.SafeBase64.dll_CopyDriverFile
lea r8, str.System32Drivers_
lea edx, [rsi + 0x62]
lea rcx, [rsp + 0x70]
call fcn.1801259f0
mov r8, rdi
lea edx, [rsi + 0x62]
lea rcx, [rsp + 0x70]
call fcn.180125a58
lea r8, str..sys
lea edx, [rsi + 0x62]
lea rcx, [rsp + 0x70]
call fcn.180125a58
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x18002a996
lea rax, str.Filter
mov qword [rsp + 0x150], r14
xor r14d, r14d
mov r9d, 0xf01ff
mov qword [rsp + 0x60], r14
mov r8, rdi
mov qword [rsp + 0x58], r14
mov rdx, rdi
mov qword [rsp + 0x50], r14
mov rcx, rbx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x18002a97a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
je 0x18002a962
mov edx, ebp
mov rcx, rdi
call sym.SafeBase64.dll_SetDriverStartType
mov esi, r14d
mov rcx, rdi
call sym.SafeBase64.dll_CheckDriverRemoved
test eax, eax
je 0x18002a983
mov edx, ebp
mov rcx, rdi
call sym.SafeBase64.dll_SetDriverStartType
jmp 0x18002a983
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r14, qword [rsp + 0x150]
mov eax, esi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x158
pop rdi
pop rsi
pop rbp
pop rbx
ret