joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800398a0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180001bf4
movzx eax, al
test eax, eax
je 0x1800398e9
mov rcx, qword [rsp + 0x78]
call fcn.180001bf4
movzx eax, al
test eax, eax
je 0x1800398e9
mov rcx, qword [rsp + 0x80]
call fcn.180001bf4
movzx eax, al
test eax, eax
jne 0x180039914
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x18d
lea rdx, [0x1801a87f0]
mov ecx, 2
call fcn.1800d5be0
cmp eax, 1
jne 0x180039914
int3
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov ecx, 0x70
call fcn.1800d66b0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.180001bf4
movzx eax, al
test eax, eax
jne 0x18003995c
mov dword [rsp + 0x30], 0
jmp 0x180039a29
mov r8d, 0x70
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.1800d63d0
mov rax, qword [rsp + 0x40]
mov dword [rax], 0x70
mov rax, qword [rsp + 0x40]
mov dword [rax + 4], 0x440
mov rax, qword [rsp + 0x40]
lea rcx, str.open
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x30], 0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x38], rcx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [rsp + 0x30], eax
mov edx, 0xffffffff
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [rsp + 0x30], 0
jne 0x180039a02
mov dword [rsp + 0x30], 0
jmp 0x180039a29
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x38]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0x20
jge 0x180039a1f
mov dword [rsp + 0x30], 0
jmp 0x180039a29
xor eax, eax
test eax, eax
jne 0x18003993e
mov rcx, qword [rsp + 0x40]
call fcn.180001bf4
movzx eax, al
test eax, eax
je 0x180039a4e
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.1800d65f0
mov eax, dword [rsp + 0x30]
add rsp, 0x68
ret
Function at 0x18003aff0
Capabilities:
Copy file
Delete file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov dword [rsp + 0x6c], 0
mov dword [rsp + 0x68], 0
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0xb0]
call fcn.1800d6570
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
add eax, 2
mov eax, eax
mov qword [rsp + 0x88], rax
mov eax, 2
mov rcx, qword [rsp + 0x88]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1800d4c50
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.180034970
nop
mov eax, dword [rsp + 0x68]
inc eax
mov eax, eax
mov qword [rsp + 0x90], rax
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.180034a70
mov r8, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x90]
mov rdx, rcx
mov rcx, rax
call fcn.1800d9840
mov eax, dword [rsp + 0x68]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.180034a70
xor ecx, ecx
mov word [rax], cx
mov eax, dword [rsp + 0x68]
inc eax
mov eax, eax
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.180034a70
xor ecx, ecx
mov word [rax], cx
mov r8d, 0x38
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1800d63d0
mov eax, 0x614
mov word [rsp + 0x50], ax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x60], 0
lea rcx, [rsp + 0x20]
call fcn.18003d090
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x38], 3
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 0
jne 0x18003b16c
mov dword [rsp + 0x98], 1
jmp 0x18003b177
mov dword [rsp + 0x98], 0
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x78], eax
lea rcx, [rsp + 0x20]
call fcn.180034a00
mov eax, dword [rsp + 0x78]
add rsp, 0xa0
pop rdi
ret
Function at 0x18003b1a0
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov dword [rsp + 0x6c], 0
mov dword [rsp + 0x68], 0
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0xb0]
call fcn.1800d6570
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
add eax, 2
mov eax, eax
mov qword [rsp + 0x88], rax
mov eax, 2
mov rcx, qword [rsp + 0x88]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1800d4c50
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.180034970
nop
mov eax, dword [rsp + 0x68]
inc eax
mov eax, eax
mov qword [rsp + 0x90], rax
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.180034a70
mov r8, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x90]
mov rdx, rcx
mov rcx, rax
call fcn.1800d9840
mov eax, dword [rsp + 0x68]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.180034a70
xor ecx, ecx
mov word [rax], cx
mov eax, dword [rsp + 0x68]
inc eax
mov eax, eax
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.180034a70
xor ecx, ecx
mov word [rax], cx
mov r8d, 0x38
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1800d63d0
mov eax, 0x614
mov word [rsp + 0x50], ax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x60], 0
lea rcx, [rsp + 0x20]
call fcn.18003d090
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], 2
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 0
jne 0x18003b325
mov dword [rsp + 0x98], 1
jmp 0x18003b330
mov dword [rsp + 0x98], 0
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x78], eax
lea rcx, [rsp + 0x20]
call fcn.180034a00
mov eax, dword [rsp + 0x78]
add rsp, 0xa0
pop rdi
ret
Function at 0x18003b360
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov dword [rsp + 0x6c], 0
mov dword [rsp + 0x68], 0
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0xb0]
call fcn.1800d6570
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
add eax, 2
mov eax, eax
mov qword [rsp + 0x88], rax
mov eax, 2
mov rcx, qword [rsp + 0x88]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1800d4c50
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.180034970
nop
mov eax, dword [rsp + 0x68]
inc eax
mov eax, eax
mov qword [rsp + 0x90], rax
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.180034a70
mov r8, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x90]
mov rdx, rcx
mov rcx, rax
call fcn.1800d9840
mov eax, dword [rsp + 0x68]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.180034a70
xor ecx, ecx
mov word [rax], cx
mov eax, dword [rsp + 0x68]
inc eax
mov eax, eax
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.180034a70
xor ecx, ecx
mov word [rax], cx
mov r8d, 0x38
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1800d63d0
mov eax, 0x614
mov word [rsp + 0x50], ax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x60], 0
lea rcx, [rsp + 0x20]
call fcn.18003d090
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], 4
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 0
jne 0x18003b4e5
mov dword [rsp + 0x98], 1
jmp 0x18003b4f0
mov dword [rsp + 0x98], 0
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x78], eax
lea rcx, [rsp + 0x20]
call fcn.180034a00
mov eax, dword [rsp + 0x78]
add rsp, 0xa0
pop rdi
ret
Function at 0x180040280
Capabilities:
Get memory capacity

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov rax, qword [0x180284030]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0x50], MsiGetProductInfoW
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x1800402fb
movsxd rax, dword [rsp + 0xd8]
lea r8, str.Failed_to_query_memory_status.
mov rdx, rax
mov rcx, qword [rsp + 0xd0]
call fcn.1800d9310
test eax, eax
jne 0x1800402e6
mov byte [rsp + 0x90], 1
jmp 0x1800402ee
mov byte [rsp + 0x90], 0
movzx eax, byte [rsp + 0x90]
jmp 0x1800403b6
xor edx, edx
mov rax, qword [rsp + 0x70]
mov ecx, 0x100000
div rcx
mov qword [rsp + 0x98], rax
xor edx, edx
mov rax, qword [rsp + 0x68]
mov ecx, 0x100000
div rcx
mov qword [rsp + 0xa0], rax
xor edx, edx
mov rax, qword [rsp + 0x60]
mov ecx, 0x100000
div rcx
mov qword [rsp + 0xa8], rax
xor edx, edx
mov rax, qword [rsp + 0x58]
mov ecx, 0x100000
div rcx
movsxd rcx, dword [rsp + 0xd8]
mov rdx, qword [rsp + 0x98]
mov qword [rsp + 0x30], rdx
mov rdx, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0xa8]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, str.Memory_status:_nTotal_physical_memory:__4I64d_MB_tAvailable_physical_memory:__4I64d_MB_nTotal___page____files:__4I64d_MB_tAvailable____page___files:__4I64d_MB
mov rdx, rcx
mov rcx, qword [rsp + 0xd0]
call fcn.1800d88e0
test eax, eax
jle 0x1800403a6
mov byte [rsp + 0xb0], 1
jmp 0x1800403ae
mov byte [rsp + 0xb0], 0
movzx eax, byte [rsp + 0xb0]
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1800d65d0
add rsp, 0xc8
ret
Function at 0x180041010
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xb0]
add rax, 8
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb0]
add rax, 0x14
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0xb0]
add rax, 0x14
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xb0]
add rax, 0x30
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0xb0]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000200
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1800411c6
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov qword [rsp + 0x90], rax
mov r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rsp + 0x88]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 1
jne 0x18004114a
mov edx, 0xffffffff
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x18004114a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._nFiled_to_terminate_a_child_process__Error_code:_0x_x._n
call fcn.180038160
mov edx, 0xffffffff
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, SafeArrayCopy
xor edx, edx
mov rcx, qword [rsp + 0x70]
call fcn.1800d63d0
mov r8d, 0x68
xor edx, edx
mov rcx, qword [rsp + 0x80]
call fcn.1800d63d0
mov rax, qword [rsp + 0x78]
mov dword [rax], 0
mov eax, 1
jmp 0x1800411d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x78]
mov dword [rcx], eax
xor eax, eax
add rsp, 0xa8
ret

Function at 0x180041300
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x20], SafeArrayCopy
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x50]
add rax, 8
xor r9d, r9d
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x180041349
xor al, al
jmp 0x180041376
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x18], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x18]
call fcn.180001bf4
add rsp, 0x48
ret
Function at 0x180041390
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
call fcn.180001bf4
movzx eax, al
test eax, eax
je 0x1800413ed
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.180001bf4
movzx eax, al
test eax, eax
je 0x1800413ed
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x18]
call fcn.180001bf4
movzx eax, al
test eax, eax
je 0x1800413ed
mov rcx, qword [rsp + 0x78]
call fcn.180001bf4
movzx eax, al
test eax, eax
jne 0x1800413f4
xor al, al
jmp 0x1800414d6
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x70]
mov dword [rax + 0x40], 0x68
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
mov qword [rax + 0xa0], rcx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
mov qword [rax + 0x98], rcx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx]
mov qword [rax + 0x90], rcx
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x7c]
bts eax, 8
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 0x7c], eax
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], SafeArrayCopy
mov rax, qword [rsp + 0x70]
add rax, 0x10
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1800411f0]
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1800dea80
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1800414cc
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1800414cc
mov byte [rsp + 0x50], 1
jmp 0x1800414d1
mov byte [rsp + 0x50], 0
movzx eax, byte [rsp + 0x50]
add rsp, 0x68
ret

Function at 0x1800414f0
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x48]
call fcn.180001bf4
movzx eax, al
test eax, eax
jne 0x18004153f
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x74
lea rdx, str.redirectCmd.cpp
mov ecx, 2
call fcn.1800d5be0
cmp eax, 1
jne 0x18004153f
int3
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
mov r8d, 0x3ff
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x180041577
xor al, al
jmp 0x1800415ca
mov rax, qword [rsp + 0x50]
cmp dword [rax], 0
jbe 0x1800415c0
mov r8d, 0x400
xor edx, edx
mov rcx, qword [rsp + 0x48]
call fcn.1800d63d0
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
mov r8d, dword [rax]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1800415ca
mov rcx, qword [rsp + 0x40]
call fcn.180041670
add rsp, 0x38
ret
Function at 0x180048370
Capabilities:
Get disk information via ioctl

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rcx, qword [rsp + 0x80]
call fcn.180001bf4
movzx eax, al
test eax, eax
je 0x1800483b4
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x80]
call qword [rax + 0x48]
movzx eax, al
test eax, eax
jne 0x1800483ec
xor eax, eax
test eax, eax
jne 0x1800483e5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, [0x1801aa648]
mov ecx, 2
call fcn.1800d5be0
cmp eax, 1
jne 0x1800483e5
int3
xor al, al
jmp 0x180048554
mov dword [rsp + 0x50], 0x270
mov eax, dword [rsp + 0x50]
mov ecx, eax
call fcn.1800d4c50
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x4c], 0
mov byte [rsp + 0x48], 0
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
lea rcx, [rsp + 0x4c]
mov qword [rsp + 0x30], rcx
mov ecx, dword [rsp + 0x50]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70050
mov rcx, qword [rsp + 0x80]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov byte [rsp + 0x48], al
movzx eax, byte [rsp + 0x48]
test eax, eax
je 0x180048488
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov rax, qword [rsp + 0x90]
mov ecx, dword [rsp + 0x50]
mov dword [rax], ecx
jmp 0x180048542
call fcn.1800357c0
cmp eax, 0x7a
jne 0x1800484c6
lea rcx, [rsp + 0x40]
call fcn.180042e60
mov eax, dword [rsp + 0x50]
add rax, 0x240
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
mov ecx, eax
call fcn.1800d4c50
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
jmp 0x180048542
call fcn.1800357c0
cmp eax, 0x571
jne 0x180048519
mov rcx, qword [rsp + 0x80]
call fcn.180048d70
movzx eax, al
test eax, eax
jne 0x180048517
xor eax, eax
test eax, eax
jne 0x180048517
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x34
lea rdx, [0x1801aa660]
mov ecx, 2
call fcn.1800d5be0
cmp eax, 1
jne 0x180048517
int3
jmp 0x180048542
lea rcx, [rsp + 0x40]
call fcn.180042e60
mov rax, qword [rsp + 0x88]
mov qword [rax], 0
mov rax, qword [rsp + 0x90]
mov dword [rax], 0
jmp 0x18004854f
movzx eax, byte [rsp + 0x48]
test eax, eax
je 0x18004841b
movzx eax, byte [rsp + 0x48]
add rsp, 0x78
ret
Function at 0x180048a30
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
mov rax, qword [0x180284030]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0xc0]
call fcn.180001bf4
movzx eax, al
test eax, eax
je 0x180048a80
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc0]
call qword [rax + 0x48]
movzx eax, al
test eax, eax
jne 0x180048ab1
xor eax, eax
test eax, eax
jne 0x180048ab1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0xc5
lea rdx, [0x1801aa6d8]
mov ecx, 2
call fcn.1800d5be0
cmp eax, 1
jne 0x180048ab1
int3
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x68], 8
mov dword [rsp + 0x6c], 0
mov dword [rsp + 0x50], 0
lea rax, [rsp + 0x54]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov dword [rsp + 0x60], 0
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], SafeArrayGetDim
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, SafeArrayGetDim
lea r8, [rsp + 0x68]
mov edx, 0x2d1400
mov rcx, qword [rsp + 0xc0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov byte [rsp + 0x41], al
movzx eax, byte [rsp + 0x41]
test eax, eax
je 0x180048b4e
mov eax, dword [rsp + 0x60]
cmp rax, 0xc
jne 0x180048b4e
movzx eax, byte [rsp + 0x58]
test eax, eax
je 0x180048b4e
mov byte [rsp + 0x40], 1
movzx eax, byte [rsp + 0x40]
test eax, eax
je 0x180048c27
mov dword [rsp + 0x90], 7
mov dword [rsp + 0x94], 0
mov dword [rsp + 0x78], 0
lea rax, [rsp + 0x7c]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov dword [rsp + 0xa0], 0
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], SafeArrayGetDim
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x20], rcx
mov r9d, SafeArrayGetDim
lea r8, [rsp + 0x90]
mov edx, 0x2d1400
mov rcx, qword [rsp + 0xc0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov byte [rsp + 0x88], al
movzx eax, byte [rsp + 0x88]
test eax, eax
je 0x180048c27
mov eax, dword [rsp + 0xa0]
cmp rax, 0xc
jne 0x180048c27
movzx eax, byte [rsp + 0x80]
test eax, eax
jne 0x180048c13
mov byte [rsp + 0xa4], 1
jmp 0x180048c1b
mov byte [rsp + 0xa4], 0
movzx eax, byte [rsp + 0xa4]
mov byte [rsp + 0x40], al
movzx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1800d65d0
add rsp, 0xb0
pop rdi
ret
Function at 0x180048d70
Capabilities:
Delete drive layout via ioctl

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x60]
call qword [rax + 0x48]
movzx eax, al
test eax, eax
jne 0x180048d97
xor al, al
jmp 0x180048e48
mov rcx, qword [rsp + 0x60]
call fcn.180047700
movzx eax, al
test eax, eax
jne 0x180048daf
xor al, al
jmp 0x180048e48
mov dword [rsp + 0x44], 0
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7c100
mov rcx, qword [rsp + 0x60]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov byte [rsp + 0x40], al
movzx eax, byte [rsp + 0x40]
test eax, eax
je 0x180048e3e
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70140
mov rcx, qword [rsp + 0x60]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
movzx eax, al
test eax, eax
je 0x180048e3e
mov byte [rsp + 0x48], 1
jmp 0x180048e43
mov byte [rsp + 0x48], 0
movzx eax, byte [rsp + 0x48]
add rsp, 0x58
ret
Function at 0x180061300
Capabilities:
Create service

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov dword [rsp + 0x78], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
mov r9d, 0xf01ff
mov r8, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
jne 0x1800613ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0x431
jne 0x1800613c6
mov eax, 1
jmp 0x180061407
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x98]
lea rcx, str.CreateService___failed__DriverName___ws__BinaryPathName___ws__Error_code___d._n
call fcn.18003e440
xor eax, eax
jmp 0x180061407
cmp qword [rsp + 0x70], 0
je 0x180061402
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
add rsp, 0x88
ret

Function at 0x180061420
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x28], 0
mov r8d, 0xf01ff
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x180061471
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService____NULL.__removeDriver___failed__Error_code___d._n
call fcn.18003e440
xor eax, eax
jmp 0x1800614bd
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x18006148a
mov dword [rsp + 0x28], 1
jmp 0x1800614a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.DeleteService_failed__Error_code___d
call fcn.18003e440
mov dword [rsp + 0x28], 0
cmp qword [rsp + 0x20], 0
je 0x1800614b9
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [rsp + 0x28]
add rsp, 0x38
ret