joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800614d0
Capabilities:
Start service

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x28], 0
mov r8d, 0xf01ff
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x180061521
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService____NULL.__startDriver___failed__Error_code___d._n
call fcn.18003e440
xor eax, eax
jmp 0x18006159a
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x180061576
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x420
jne 0x18006155e
lea rcx, str.StartService____ERROR_SERVICE_ALREADY_RUNNING._success__n
call fcn.180038160
mov eax, 1
jmp 0x18006159a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.StartService_failed__Error_code___d._n
call fcn.18003e440
xor eax, eax
jmp 0x18006159a
cmp qword [rsp + 0x20], 0
je 0x180061589
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, str.StartService_success__n
call fcn.180038160
mov eax, 1
add rsp, 0x38
ret

Function at 0x1800615b0
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x180284030]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], 0
mov r8d, 0xf01ff
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x180061613
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService____NULL.__stopDriver___failed__Error_code___d._n
call fcn.18003e440
xor eax, eax
jmp 0x180061698
lea r8, [rsp + 0x30]
mov edx, 1
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x180061642
lea rcx, str.SERVICE_CONTROL_STOP_success__n
call fcn.180038160
mov dword [rsp + 0x50], 1
jmp 0x180061681
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
jne 0x180061665
lea rcx, str.SERVICE_CONTROL_STOP_ERROR_SERVICE_NOT_ACTIVE._success__n
call fcn.180038160
mov dword [rsp + 0x50], 1
jmp 0x180061681
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ControlService_SERVICE_CONTROL_STOP__failed__Error_code___d._n
call fcn.18003e440
mov dword [rsp + 0x50], 0
cmp qword [rsp + 0x20], 0
je 0x180061694
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800d65d0
add rsp, 0x68
ret
Function at 0x18006f380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x180284030]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x30], reloc.msi.dll_MsiGetActiveDatabase
mov byte [rsp + 0x31], reloc.msi.dll_MsiGetPropertyW
mov byte [rsp + 0x32], 0x56
mov byte [rsp + 0x33], MsiGetPropertyW
mov byte [rsp + 0x34], reloc.msi.dll_MsiGetActiveDatabase
mov byte [rsp + 0x35], reloc.msi.dll_MsiGetPropertyW
mov byte [rsp + 0x36], 0x53
mov byte [rsp + 0x37], reloc.msi.dll_MsiGetActiveDatabase
mov byte [rsp + 0x38], 0x78
mov byte [rsp + 0x39], 0x78
mov byte [rsp + 0x3a], 0x78
mov byte [rsp + 0x3b], 0x78
mov byte [rsp + 0x3c], 0x78
mov byte [rsp + 0x3d], 0x78
mov byte [rsp + 0x3e], 0x78
mov byte [rsp + 0x3f], 0x78
mov byte [rsp + 0x40], 0xff
mov byte [rsp + 0x41], 0xff
mov byte [rsp + 0x42], 0xff
mov byte [rsp + 0x43], 0xff
mov byte [rsp + 0x44], 0xff
mov byte [rsp + 0x45], 0xff
mov byte [rsp + 0x46], 0xff
mov byte [rsp + 0x47], 0xff
mov byte [rsp + 0x48], 0xff
mov byte [rsp + 0x49], 0xff
mov byte [rsp + 0x4a], 0xff
mov byte [rsp + 0x4b], 0xff
mov byte [rsp + 0x4c], 0xff
mov byte [rsp + 0x4d], 0xff
mov byte [rsp + 0x4e], 0xff
mov byte [rsp + 0x4f], 0xff
mov byte [rsp + 0x50], 0xff
mov byte [rsp + 0x51], 0xff
mov byte [rsp + 0x52], 0xff
mov byte [rsp + 0x53], 0
mov byte [rsp + 0x54], 0x1f
mov byte [rsp + 0x55], MsiGetActiveDatabase
mov rax, qword [rsp + 0x88]
add rax, 3
mov qword [rsp + 0x20], rax
mov r8d, 8
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call fcn.1800d91e0
test eax, eax
jne 0x18006f489
mov al, 1
jmp 0x18006f4c6
mov rax, qword [rsp + 0x88]
add rax, 0x1e0
mov qword [rsp + 0x20], rax
mov r8d, 0x1e
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call fcn.1800d91e0
test eax, eax
jne 0x18006f4bc
mov byte [rsp + 0x58], 1
jmp 0x18006f4c1
mov byte [rsp + 0x58], 0
movzx eax, byte [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800d65d0
add rsp, 0x78
ret
Function at 0x18007beb0
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rcx, qword [rsp + 0x50]
call fcn.180001a19
test rax, rax
ja 0x18007bef8
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x421
lea rdx, [0x1801afcb8]
mov ecx, 2
call fcn.1800d5be0
cmp eax, 1
jne 0x18007bef8
int3
mov rcx, qword [rsp + 0x58]
call fcn.180001a19
test rax, rax
ja 0x18007bf32
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x422
lea rdx, [0x1801afcd0]
mov ecx, 2
call fcn.1800d5be0
cmp eax, 1
jne 0x18007bf32
int3
mov rcx, qword [rsp + 0x58]
call fcn.18000122b
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
call fcn.18000122b
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
add rsp, 0x48
ret
Function at 0x180087f80
Capabilities:
Manipulate boot configuration

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x338
mov rax, qword [0x180284030]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov rcx, qword [rsp + 0x350]
call fcn.180001bf4
movzx eax, al
test eax, eax
jne 0x180087fdf
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, SafeArrayCopy
lea rdx, [0x1801b1888]
mov ecx, 2
call fcn.1800d5be0
cmp eax, 1
jne 0x180087fdf
int3
mov rcx, qword [rsp + 0x350]
call fcn.1800d6570
test rax, rax
ja 0x18008801c
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, reloc.OLEAUT32.dll_SafeArrayCopy
lea rdx, [0x1801b18a0]
mov ecx, 2
call fcn.1800d5be0
cmp eax, 1
jne 0x18008801c
int3
call fcn.180087ed0
mov dword [rsp + 0x104], eax
lea rax, [rsp + 0x40]
lea rcx, str.boot.ini
mov rdi, rax
mov rsi, rcx
mov ecx, 0x12
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x52]
mov rdi, rax
xor eax, eax
mov ecx, 0x2e
rep stosb byte [rdi], al
lea rax, [rsp + 0x80]
lea rcx, str.BootBCD
mov rdi, rax
mov rsi, rcx
mov ecx, 0x12
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x92]
mov rdi, rax
xor eax, eax
mov ecx, 0x2e
rep stosb byte [rdi], al
lea rax, [rsp + 0xc0]
lea rcx, str.EFIMicrosoftBootBCD
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2e
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xee]
mov rdi, rax
xor eax, eax
mov ecx, 0x12
rep stosb byte [rdi], al
mov byte [rsp + 0x108], 0
mov byte [rsp + 0x100], 0
mov dword [rsp + 0x10c], 0
jmp 0x1800880df
mov eax, dword [rsp + 0x10c]
inc eax
mov dword [rsp + 0x10c], eax
cmp dword [rsp + 0x10c], 3
jge 0x18008818e
xor eax, eax
mov word [rsp + 0x110], ax
lea rax, [rsp + 0x112]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
movsxd rax, dword [rsp + 0x10c]
imul rax, rax, 0x40
lea rax, [rsp + rax + 0x40]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x350]
lea r8, [0x1801b1918]
mov edx, 0x104
lea rcx, [rsp + 0x110]
call fcn.1800d6e60
lea rcx, [rsp + 0x110]
call fcn.180037850
test eax, eax
je 0x180088189
cmp dword [rsp + 0x10c], 0
jne 0x180088165
mov byte [rsp + 0x108], 1
cmp dword [rsp + 0x10c], 1
jne 0x180088177
mov byte [rsp + 0x100], 1
cmp dword [rsp + 0x10c], 2
jne 0x180088189
mov byte [rsp + 0x100], 1
jmp 0x1800880cf
movzx eax, byte [rsp + 0x100]
test eax, eax
je 0x1800881c3
lea rcx, str.BOOT_MGR_TYP::BCD_FILE._n
call fcn.180038160
cmp dword [rsp + 0x104], 2
je 0x1800881bc
lea rcx, str.os_typ___BCD_FILE._n
call fcn.180038160
mov eax, 2
jmp 0x180088237
movzx eax, byte [rsp + 0x108]
test eax, eax
je 0x180088204
movzx eax, byte [rsp + 0x100]
test eax, eax
jne 0x180088204
lea rcx, str.BOOT_MGR_TYP::BOOT_INI._n
call fcn.180038160
cmp dword [rsp + 0x104], 1
je 0x1800881fd
lea rcx, str.os_typ___BOOT_INI._n
call fcn.180038160
mov eax, 1
jmp 0x180088237
xor eax, eax
test eax, eax
jne 0x180088235
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x4a
lea rdx, str.bootMgr.cpp
mov ecx, 2
call fcn.1800d5be0
cmp eax, 1
jne 0x180088235
int3
xor eax, eax
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.1800d65d0
add rsp, 0x338
pop rdi
pop rsi
ret
Function at 0x18008cdc0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xa8
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov edx, 1
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax + 0x68]
call fcn.180076eb0
mov r8d, 0x3e8
xor edx, edx
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax + 0x68]
call fcn.180076ff0
xor edx, edx
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax + 0x68]
call fcn.180076ba0
mov rcx, qword [rsp + 0xc0]
call fcn.18008d270
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax + 0x48]
call fcn.180001bf4
movzx eax, al
test eax, eax
jne 0x18008ceb9
mov ecx, 8
call fcn.1800d66b0
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x18008ce8f
mov rax, qword [rsp + 0xc0]
add rax, 8
mov dword [rsp + 0x20], 0x80
mov r9d, 3
mov r8d, 0x40000000
mov rdx, rax
mov rcx, qword [rsp + 0x60]
call fcn.18003daf0
mov qword [rsp + 0x88], rax
jmp 0x18008ce9b
mov qword [rsp + 0x88], 0
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x48], rcx
mov rax, qword [rsp + 0xc0]
mov qword [rax + 0x50], 0
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax + 0x48]
call fcn.18003dc30
movzx eax, al
test eax, eax
jne 0x18008ceeb
mov eax, 0xffffeff2
jmp 0x18008d031
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax + 0x48]
call fcn.18003e300
mov rdx, rax
mov rcx, qword [rsp + 0xc0]
call fcn.18008d390
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0xc0]
mov rdi, rax
lea rsi, [rcx + 0x58]
mov ecx, SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0xc0]
call fcn.18008bb40
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0xc0]
add rax, 0x48
mov rcx, rax
call fcn.18008fa00
cmp dword [rsp + 0x50], 0
je 0x18008cf61
mov eax, dword [rsp + 0x50]
jmp 0x18008d031
mov edx, 0x3e8
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax + 0x68]
call fcn.180076ba0
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0xc0]
call fcn.18008d460
nop
lea rcx, [rsp + 0x30]
call fcn.180001fd7
test rax, rax
jbe 0x18008cfec
lea rcx, [rsp + 0x30]
call fcn.18000122b
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0xc0]
add rcx, 8
call fcn.18000122b
mov rcx, qword [rsp + 0x90]
mov rdx, rcx
mov rcx, rax
call fcn.18003b360
test eax, eax
jne 0x18008cfec
mov rax, qword [rsp + 0xc0]
add rax, 8
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180001d6b
lea rcx, [rsp + 0x30]
call fcn.18000122b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18008d01b
mov dword [rsp + 0x68], 0xffffefdf
lea rcx, [rsp + 0x30]
call fcn.18000165e
mov eax, dword [rsp + 0x68]
jmp 0x18008d031
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x6c], eax
lea rcx, [rsp + 0x30]
call fcn.18000165e
mov eax, dword [rsp + 0x6c]
add rsp, 0xa8
pop rdi
pop rsi
ret
Function at 0x180095a10
Capabilities:
Manipulate boot configuration

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov dword [rsp + 0x48], 0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x20]
call fcn.180001357
movzx eax, al
test eax, eax
jne 0x180095a8e
lea rdx, str._boot.ini
lea rcx, [rsp + 0x28]
call fcn.1800334a0
nop
lea r8, [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
call fcn.180033cc0
mov eax, dword [rsp + 0x48]
or eax, 1
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x28]
call fcn.18000165e
mov rax, qword [rsp + 0x70]
jmp 0x180095aa8
mov rcx, qword [rsp + 0x70]
call fcn.1800016a9
mov eax, dword [rsp + 0x48]
or eax, 1
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x1800c6d00
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0xb8
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov dword [rsp + 0x50], 0x20
lea rcx, [rsp + 0x50]
call fcn.180038c00
test eax, eax
jne 0x1800c6d5a
xor eax, eax
test eax, eax
jne 0x1800c6d5a
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0xa2
lea rdx, [0x180228608]
mov ecx, 2
call fcn.1800d5be0
cmp eax, 1
jne 0x1800c6d5a
int3
lea rcx, [rsp + 0x78]
call fcn.180045670
nop
lea rcx, [rsp + 0x78]
call fcn.180001357
movzx eax, al
test eax, eax
je 0x1800c6dc8
xor eax, eax
test eax, eax
jne 0x1800c6da7
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0xa7
lea rdx, [0x180228620]
mov ecx, 2
call fcn.1800d5be0
cmp eax, 1
jne 0x1800c6da7
int3
mov dword [rsp + 0x98], 0xffffbff0
lea rcx, [rsp + 0x78]
call fcn.18000165e
mov eax, dword [rsp + 0x98]
jmp 0x1800c6ee1
lea rcx, [rsp + 0x58]
call fcn.180045750
nop
lea rcx, [rsp + 0x58]
call fcn.180001a19
test rax, rax
jne 0x1800c6e29
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.18007b8d0
movzx eax, al
test eax, eax
jne 0x1800c6e29
xor eax, eax
test eax, eax
jne 0x1800c6e29
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0xb1
lea rdx, [0x180228638]
mov ecx, 2
call fcn.1800d5be0
cmp eax, 1
jne 0x1800c6e29
int3
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x30]
call fcn.180001820
nop
cmp dword [rsp + 0x50], 0x40
jne 0x1800c6e53
lea rdx, str.EFIBoot_bootx64.efi
lea rcx, [rsp + 0x30]
call fcn.180033970
jmp 0x1800c6e64
lea rdx, [0x180228680]
lea rcx, [rsp + 0x30]
call fcn.180033970
lea rcx, [rsp + 0x30]
call fcn.18000122b
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1800c6eaf
mov dword [rsp + 0x9c], 0xffff9df6
lea rcx, [rsp + 0x30]
call fcn.18000165e
nop
lea rcx, [rsp + 0x58]
call fcn.18000165e
nop
lea rcx, [rsp + 0x78]
call fcn.18000165e
mov eax, dword [rsp + 0x9c]
jmp 0x1800c6ee1
mov dword [rsp + 0xa0], 0
lea rcx, [rsp + 0x30]
call fcn.18000165e
nop
lea rcx, [rsp + 0x58]
call fcn.18000165e
nop
lea rcx, [rsp + 0x78]
call fcn.18000165e
mov eax, dword [rsp + 0xa0]
add rsp, 0xb8
ret
Function at 0x1800c6ef0
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2c0
mov rax, qword [0x180284030]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov dword [rsp + 0x244], 0
mov byte [rsp + 0x240], 0
mov qword [rsp + 0x20], 0
xor eax, eax
mov word [rsp + 0x30], ax
lea rax, [rsp + 0x32]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.180036520
test eax, eax
jne 0x1800c6f66
mov dword [rsp + 0x244], 0xffffefe0
jmp 0x1800c709e
xor eax, eax
mov word [rsp + 0x36], ax
lea rax, [rsp + 0x250]
mov qword [rsp + 0x270], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x270]
call fcn.1800334a0
mov qword [rsp + 0x2a0], rax
mov rdx, qword [rsp + 0x2d0]
mov rcx, qword [rsp + 0x2a0]
call fcn.1800c70f0
movzx eax, al
test eax, eax
je 0x1800c6fc0
mov byte [rsp + 0x240], 1
jmp 0x1800c709e
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
jne 0x1800c6fed
mov dword [rsp + 0x244], 0xffffefe0
jmp 0x1800c709e
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [rsp + 0x248], eax
cmp dword [rsp + 0x248], 3
je 0x1800c700b
jmp 0x1800c705d
lea rax, [rsp + 0x278]
mov qword [rsp + 0x298], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x298]
call fcn.1800334a0
mov qword [rsp + 0x2a8], rax
mov rdx, qword [rsp + 0x2d0]
mov rcx, qword [rsp + 0x2a8]
call fcn.1800c70f0
movzx eax, al
test eax, eax
jne 0x1800c7053
jmp 0x1800c705d
mov byte [rsp + 0x240], 1
jmp 0x1800c707b
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x1800c6fed
movzx eax, byte [rsp + 0x240]
test eax, eax
jne 0x1800c7094
mov dword [rsp + 0x244], 0xffff9ff5
jmp 0x1800c709e
xor eax, eax
test eax, eax
jne 0x1800c6f43
mov rcx, qword [rsp + 0x20]
call fcn.180001bf4
movzx eax, al
test eax, eax
je 0x1800c70c3
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov qword [rsp + 0x20], 0
mov eax, dword [rsp + 0x244]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1800d65d0
add rsp, 0x2c0
pop rdi
ret
Function at 0x1800c70f0
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x330
mov qword [rsp + 0x310], 0xfffffffffffffffe
mov rax, qword [0x180284030]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov rcx, qword [rsp + 0x340]
call fcn.180001357
movzx eax, al
test eax, eax
je 0x1800c7187
xor eax, eax
test eax, eax
jne 0x1800c7165
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x104
lea rdx, [0x1802286b0]
mov ecx, 2
call fcn.1800d5be0
cmp eax, 1
jne 0x1800c7165
int3
mov byte [rsp + 0x2d8], 0
mov rcx, qword [rsp + 0x340]
call fcn.18000165e
movzx eax, byte [rsp + 0x2d8]
jmp 0x1800c73b9
mov rdx, qword [rsp + 0x340]
lea rcx, [rsp + 0x30]
call fcn.180001820
nop
lea rdx, str.Recovery
lea rcx, [rsp + 0x30]
call fcn.180033970
mov dword [rsp + 0x60], 0
lea rax, [rsp + 0x64]
mov rdi, rax
xor eax, eax
mov ecx, 0x24c
rep stosb byte [rdi], al
lea rcx, [rsp + 0x30]
call fcn.18000122b
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x2b0], rax
cmp qword [rsp + 0x2b0], 0xffffffffffffffff
jne 0x1800c721c
mov byte [rsp + 0x2d9], 0
lea rcx, [rsp + 0x30]
call fcn.18000165e
nop
mov rcx, qword [rsp + 0x340]
call fcn.18000165e
movzx eax, byte [rsp + 0x2d9]
jmp 0x1800c73b9
movzx eax, word [rsp + 0x8c]
cmp eax, 0x2e
jne 0x1800c722e
jmp 0x1800c7368
mov eax, dword [rsp + 0x60]
and eax, 0x10
test eax, eax
jne 0x1800c723e
jmp 0x1800c7368
mov rdx, qword [rsp + 0x340]
lea rcx, [rsp + 0x2b8]
call fcn.180001820
nop
lea rdx, str.Recovery_
lea rcx, [rsp + 0x2b8]
call fcn.180033970
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x2b8]
call fcn.180033970
lea rdx, [0x1802286f8]
lea rcx, [rsp + 0x2b8]
call fcn.180033970
lea rcx, [rsp + 0x2b8]
call fcn.18000122b
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1800c72bd
lea rcx, [rsp + 0x2b8]
call fcn.18000165e
jmp 0x1800c7368
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x300], rax
lea rdx, [rsp + 0x2b8]
mov rcx, qword [rsp + 0x300]
call fcn.180001820
mov qword [rsp + 0x318], rax
mov rcx, qword [rsp + 0x318]
call fcn.1800c73e0
movzx eax, al
test eax, eax
jne 0x1800c730d
lea rcx, [rsp + 0x2b8]
call fcn.18000165e
jmp 0x1800c7368
lea rdx, [rsp + 0x2b8]
mov rcx, qword [rsp + 0x348]
call fcn.180001d6b
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov byte [rsp + 0x308], 1
lea rcx, [rsp + 0x2b8]
call fcn.18000165e
nop
lea rcx, [rsp + 0x30]
call fcn.18000165e
nop
mov rcx, qword [rsp + 0x340]
call fcn.18000165e
movzx eax, byte [rsp + 0x308]
jmp 0x1800c73b9
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1800c721c
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov byte [rsp + 0x309], 0
lea rcx, [rsp + 0x30]
call fcn.18000165e
nop
mov rcx, qword [rsp + 0x340]
call fcn.18000165e
movzx eax, byte [rsp + 0x309]
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.1800d65d0
add rsp, 0x330
pop rdi
ret
Function at 0x1800c73e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x480
mov qword [rsp + 0x468], 0xfffffffffffffffe
mov rax, qword [0x180284030]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor eax, eax
mov word [rsp + 0x40], ax
lea rax, [rsp + 0x42]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x250], ax
lea rax, [rsp + 0x252]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea rdx, [rsp + 0x250]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x1800c74ab
xor eax, eax
test eax, eax
jne 0x1800c7489
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x137
lea rdx, [0x180228710]
mov ecx, 2
call fcn.1800d5be0
cmp eax, 1
jne 0x1800c7489
int3
mov byte [rsp + 0x460], 0
mov rcx, qword [rsp + 0x490]
call fcn.18000165e
movzx eax, byte [rsp + 0x460]
jmp 0x1800c757d
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.Grab
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x1800c751c
xor eax, eax
test eax, eax
jne 0x1800c74fd
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x13c
lea rdx, [0x180228738]
mov ecx, 2
call fcn.1800d5be0
cmp eax, 1
jne 0x1800c74fd
int3
mov byte [rsp + 0x461], 0
mov rcx, qword [rsp + 0x490]
call fcn.18000165e
movzx eax, byte [rsp + 0x461]
jmp 0x1800c757d
mov rcx, qword [rsp + 0x490]
call fcn.18000122b
lea r8, [rsp + 0x40]
lea rdx, str.Windows_system32winload.exe
mov rcx, rax
call fcn.1800c6850
test eax, eax
je 0x1800c7560
mov byte [rsp + 0x462], 0
mov rcx, qword [rsp + 0x490]
call fcn.18000165e
movzx eax, byte [rsp + 0x462]
jmp 0x1800c757d
mov byte [rsp + 0x463], 1
mov rcx, qword [rsp + 0x490]
call fcn.18000165e
movzx eax, byte [rsp + 0x463]
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1800d65d0
add rsp, 0x480
pop rdi
ret
Function at 0x1800c75a0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x310
mov qword [rsp + 0x2c0], 0xfffffffffffffffe
mov rax, qword [0x180284030]
xor rax, rsp
mov qword [rsp + 0x308], rax
mov rax, qword [rsp + 0x320]
add rax, 0x98
mov rdx, qword [rsp + 0x328]
mov rcx, rax
call fcn.180001d6b
xor eax, eax
mov word [rsp + 0x30], ax
lea rax, [rsp + 0x32]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1800c7621
xor al, al
jmp 0x1800c7766
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
call fcn.1800334a0
mov qword [rsp + 0x2c8], rax
mov rax, qword [rsp + 0x2c8]
mov qword [rsp + 0x2d0], rax
mov rax, qword [rsp + 0x320]
add rax, 0x118
mov rdx, qword [rsp + 0x2d0]
mov rcx, rax
call fcn.180001d6b
nop
lea rcx, [rsp + 0x240]
call fcn.18000165e
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.180036520
test eax, eax
jne 0x1800c7691
xor al, al
jmp 0x1800c7766
lea rdx, [0x180228790]
lea rcx, [rsp + 0x260]
call fcn.1800334a0
mov qword [rsp + 0x2d8], rax
mov rax, qword [rsp + 0x2d8]
mov qword [rsp + 0x2e0], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x280]
call fcn.1800334a0
mov qword [rsp + 0x2e8], rax
mov rax, qword [rsp + 0x2e8]
mov qword [rsp + 0x2f0], rax
mov r8, qword [rsp + 0x2e0]
mov rdx, qword [rsp + 0x2f0]
lea rcx, [rsp + 0x2a0]
call fcn.180033cc0
mov qword [rsp + 0x2f8], rax
mov rax, qword [rsp + 0x2f8]
mov qword [rsp + 0x300], rax
mov rax, qword [rsp + 0x320]
add rax, 0x138
mov rdx, qword [rsp + 0x300]
mov rcx, rax
call fcn.180001d6b
nop
lea rcx, [rsp + 0x2a0]
call fcn.18000165e
nop
lea rcx, [rsp + 0x280]
call fcn.18000165e
nop
lea rcx, [rsp + 0x260]
call fcn.18000165e
mov al, 1
mov rcx, qword [rsp + 0x308]
xor rcx, rsp
call fcn.1800d65d0
add rsp, 0x310
pop rdi
ret