joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002bb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x180002be3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x180002c27
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x180002c22
cmp rbx, r11
jae 0x180002c27
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x180002c10
cmp rbx, r11
jb 0x180002c2b
xor eax, eax
jmp 0x180002c37
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180003a00
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x18007f130]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2000
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, reloc.WS2_32.dll_inet_addr
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea rdx, str.Control_PanelDesktopWindowMetrics
mov r9d, 0xf003f
mov ebx, eax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea r8d, [rbx - 1]
lea rdx, [0x18006c480]
lea rcx, [rsp + 0x38]
call fcn.1800044d0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x38]
lea rdx, str.Shell_Icon_Size
mov r9d, 1
repne scasw ax, word [rdi]
lea rax, [rsp + 0x38]
xor r8d, r8d
not rcx
dec rcx
add ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_PostMessageW]
lea rdx, [0x18006c480]
lea rcx, [rsp + 0x38]
mov r8d, ebx
call fcn.1800044d0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x38]
lea rdx, str.Shell_Icon_Size
mov r9d, 1
repne scasw ax, word [rdi]
lea rax, [rsp + 0x38]
xor r8d, r8d
not rcx
dec rcx
add ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800340f0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x180003b50
Capabilities:
Delete file
Get common file path

Disassembly:
push rdi
sub rsp, 0x470
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x480], rbx
mov rax, qword [0x18007f130]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbx, rdx
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x250]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x1800682c0]
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea rcx, [rsp + 0x40]
lea rax, [rsp + 0x40]
test rax, 0xffffffffffff0000
jne 0x180003c1b
movzx edi, cx
xor edx, edx
mov ecx, edi
call fcn.1800029b0
test rax, rax
je 0x180003c16
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.180002430
nop
mov rax, rbx
jmp 0x180003c41
mov rax, rbx
jmp 0x180003c41
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180002290
nop
mov rax, rbx
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1800340f0
mov rbx, qword [rsp + 0x480]
add rsp, 0x470
pop rdi
ret
Function at 0x180003c70
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x18007f130]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rdx
mov qword [rsp + 0x38], rdx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
not rcx
lea rax, [rsp + rcx*2 + 0x3c]
cmp word [rax], 0x5c
je 0x180003d0b
add rax, 2
mov ecx, 0x5c
mov word [rax], cx
mov word [rax + 2], bp
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180002290
xor eax, eax
mov rcx, rsi
lea rdi, str.cache_
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.cache_
mov rcx, rbx
call fcn.180002500
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180003d6d
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r8d, [rax + rax*2]
lea rdx, str._x.exe
lea rcx, [rsp + 0x28]
call fcn.180004360
mov rdi, qword [rsp + 0x28]
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
mov rcx, rbx
call fcn.180002500
nop
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x180003dd4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, rbx
jmp 0x180003dd7
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1800340f0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180003e10
Capabilities:
Check if file exists
Delete file
Get common file path
Set file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x460
mov rax, qword [0x18007f130]
xor rax, rsp
mov qword [rsp + 0x450], rax
lea rbx, [rcx + 0x60]
mov rsi, rdx
mov dword [rsp + 0x20], 0
mov rcx, qword [rbx]
cmp dword [rcx - 0x10], 0
je 0x180003e55
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180003ee8
lea rdx, [rsp + 0x240]
mov ecx, 0x104
mov qword [rsp + 0x480], rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rsp + 0x30]
lea rdx, [0x18006c558]
lea rcx, [rsp + 0x240]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, [rsp + 0x30]
lea rdx, [0x18006c560]
mov ecx, 0x67
call fcn.1800310e0
lea rcx, [rsp + 0x30]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x30]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rbx
call fcn.180002290
mov rdi, qword [rsp + 0x480]
mov rcx, qword [rbx]
sub rcx, 0x18
call fcn.1800023a0
add rax, 0x18
mov qword [rsi], rax
mov rax, rsi
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1800340f0
mov rbx, qword [rsp + 0x488]
add rsp, 0x460
pop rsi
ret

Function at 0x180003f20
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
push rdi
sub rsp, 0x470
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x490], rbx
mov rax, qword [0x18007f130]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x250]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x18006c570]
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8d, 1
lea rdx, [rsp + 0x40]
mov rcx, qword [rdi + 0x28]
call fcn.18002b710
mov edx, 2
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea rcx, [rsp + 0x40]
lea rax, [rsp + 0x40]
test rax, 0xffffffffffff0000
jne 0x180004012
movzx edi, cx
xor edx, edx
mov ecx, edi
call fcn.1800029b0
test rax, rax
je 0x18000400d
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.180002430
nop
mov rax, rbx
jmp 0x180004038
mov rax, rbx
jmp 0x180004038
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180002290
nop
mov rax, rbx
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1800340f0
mov rbx, qword [rsp + 0x490]
add rsp, 0x470
pop rdi
ret
Function at 0x180012220
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x40
mov rdi, r9
mov rsi, r8
mov r12, rcx
lea rax, [rsp + 0x30]
mov rbp, rdx
xor ebx, ebx
lea r9, [0x180061ba0]
lea rcx, [0x1800649c0]
lea r8d, [rbx + 1]
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1800122fe
mov rcx, qword [rsp + 0x30]
mov rdx, r12
mov rax, qword [rcx]
call qword [rax + 0xa0]
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rcx, qword [rsp + 0x30]
mov rdx, rbp
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
lea rdx, [0x180064e30]
call qword [rax]
test eax, eax
js 0x1800122f3
mov rcx, qword [rsp + 0x38]
lea r8d, [rbx + 1]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x38]
mov ebx, 1
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop r12
ret
Function at 0x180014700
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rdi, rdx
mov esi, r8d
lea r9, [rax - 0x18]
lea rdx, [rax + 0x20]
lea r8d, [rbx + 2]
mov rcx, rdi
mov dword [rax - 0x18], ebx
mov word [rax + 0x20], bx
mov qword [rax - 0x28], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18001474e
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp dword [rsp + 0x30], 2
jne 0x18001473c
mov eax, 1
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x68]
lea r8d, [rax + 1]
mov rcx, rdi
mov qword [rsp + 0x20], rbx
mov word [rsp + 0x68], ax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18001473c
cmp dword [rsp + 0x30], 2
jne 0x18001473c
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x68]
mov r8d, 2
mov rcx, rdi
mov word [rsp + 0x68], si
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18001473c
cmp dword [rsp + 0x30], 2
mov rsi, qword [rsp + 0x58]
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180014860
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
sub rsp, 0x50
mov rax, r8
xor r13d, r13d
mov rsi, rdx
mov rbp, rcx
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x88], r13d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1800148d3
mov r8d, dword [rsi + 0x414]
mov rdx, rax
mov rcx, rbp
call fcn.180014700
test eax, eax
jne 0x1800148e7
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r13
pop r12
pop rsi
ret
mov qword [rsp + 0x70], rbx
mov ebx, r13d
mov qword [rsp + 0x78], rdi
cmp dword [rsi + 0x414], ebx
jbe 0x1800149cc
lea rdi, [rsi + 0x438]
nop word [rax + rax]
xor eax, eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
movzx eax, byte [rdi - 0x20]
mov byte [rsp + 0x43], r13b
mov byte [rsp + 0x40], al
movzx eax, byte [rdi - 0x1c]
mov byte [rsp + 0x41], al
mov rax, qword [rdi]
movzx ecx, word [rax + 0xc]
mov word [rsp + 0x44], cx
movzx eax, word [rax + 0xe]
mov edx, eax
mov word [rsp + 0x46], ax
imul edx, ecx
cmp edx, 8
jl 0x18001495d
mov byte [rsp + 0x42], r13b
jmp 0x18001496a
mov ecx, edx
mov eax, 1
shl al, cl
mov byte [rsp + 0x42], al
mov eax, dword [rdi - 8]
mov r8d, ebx
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x48], eax
call fcn.1800147d0
lea r9, [rsp + 0x88]
lea rdx, [rsp + 0x40]
mov r8d, 0x10
mov rcx, r12
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x4c], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180014a56
cmp dword [rsp + 0x88], 0x10
jne 0x180014a56
inc ebx
add rdi, 0x38
cmp ebx, dword [rsi + 0x414]
jb 0x180014910
mov edi, r13d
cmp dword [rsi + 0x414], r13d
jbe 0x180014a2c
lea rbx, [rsi + 0x438]
nop
mov rax, qword [rbx]
lea r9, [rsp + 0x88]
mov rcx, r12
mov ebp, dword [rax + 0x14]
mov dword [rax + 0x14], r13d
mov r8d, dword [rbx - 8]
mov rdx, qword [rbx - 0x10]
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180014a56
mov eax, dword [rbx - 8]
cmp dword [rsp + 0x88], eax
jne 0x180014a56
mov rax, qword [rbx]
inc edi
add rbx, 0x38
mov dword [rax + 0x14], ebp
cmp edi, dword [rsi + 0x414]
jb 0x1800149e0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r13
pop r12
pop rsi
ret
xor eax, eax
jmp 0x180014a3a
Function at 0x1800168f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x20
mov rbx, rcx
lea r8, [rsp + 0x38]
xor ebp, ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x38], rbp
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x180016977
mov rcx, qword [rsp + 0x38]
mov rdx, rbx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], rdi
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
or rcx, 0xffffffffffffffff
mov esi, eax
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdi, qword [rsp + 0x40]
mov eax, 0x5c
not rcx
cmp ax, word [rbx + rcx*2 - 4]
je 0x18001695a
mov word [rbx + rcx*2 - 2], ax
mov word [rbx + rcx*2], bp
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret

Function at 0x180016990
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
lea r8, [rsp + 0x38]
lea edx, [rbp + 5]
xor ecx, ecx
mov qword [rsp + 0x38], rbp
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x180016a18
mov rcx, qword [rsp + 0x38]
mov rdx, rbx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], rdi
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
or rcx, 0xffffffffffffffff
mov esi, eax
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdi, qword [rsp + 0x40]
mov eax, 0x5c
not rcx
cmp ax, word [rbx + rcx*2 - 4]
je 0x1800169fb
mov word [rbx + rcx*2 - 2], ax
mov word [rbx + rcx*2], bp
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
Function at 0x18001cb60
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x110
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x18007f130]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rbx, r8
xor eax, eax
mov qword [r11 - 0x78], rax
mov qword [r11 - 0x70], rax
mov qword [r11 - 0x68], rax
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov word [r11 - 0x48], ax
mov byte [r11 - 0x80], al
xor edi, edi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.18001f0c0
cmp byte [rsp + 0x98], dil
jne 0x18001cbfe
lea rcx, [rsp + 0x30]
call fcn.18001f1d0
mov edx, edi
cmp edx, 0x10
jae 0x18001cc1a
mov ecx, edx
movzx eax, byte [rsp + rcx + 0x88]
mov byte [rsp + rcx + 0xa0], al
inc edx
jmp 0x18001cc00
xor eax, eax
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], rax
cmp edi, 0x10
jge 0x18001cc73
movsxd rax, edi
movzx r8d, byte [rsp + rax + 0xa0]
lea eax, [rdi + rdi]
movsxd rcx, eax
lea rcx, [rsp + rcx + 0xd8]
lea rdx, [0x18006cfc8]
call fcn.18003572c
inc edi
jmp 0x18001cc44
lea rcx, [rsp + 0xd8]
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rbx], al
inc rcx
inc rbx
test al, al
jne 0x18001cc80
mov eax, 1
jmp 0x18001cc98
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1800340f0
mov rbx, qword [rsp + 0x138]
add rsp, 0x110
pop rdi
ret
Function at 0x18001d440
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
lea rax, [rsp + 0x30]
mov edi, r9d
mov r13, r8
mov rbx, rdx
mov r12d, ecx
test rax, rax
je 0x18001d481
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rcx, [0x18006cf40]
lea edx, [r9 + 1]
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
xor r9d, r9d
lea rdx, [rsp + 0x30]
or rcx, 0xffffffffffffffff
lea r8d, [r9 + 4]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
test rax, rax
je 0x18001d521
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
test rax, rax
je 0x18001d521
mov r8, r12
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x70], rbp
call fcn.180035fe0
mov qword [rbx], rsi
mov dword [rbx + 8], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbx + 0xc], eax
test r13, r13
je 0x18001d50c
test edi, edi
je 0x18001d50c
lea rdx, [r12 - 0x10]
lea rcx, [rbx + 0x10]
mov r9, rdi
mov r8, r13
call fcn.180034594
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rbp, qword [rsp + 0x70]
mov eax, 1
jmp 0x18001d523
xor eax, eax
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r13
pop r12
pop rdi
ret
Function at 0x180026150
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x48
xor eax, eax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x3c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x58]
mov edx, 0x38
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1800261f7
lea r8, [rsp + 0x34]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1800261ec
mov rcx, qword [rsp + 0x58]
xor eax, eax
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1800261ec
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x48
ret

Function at 0x180026260
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
sub rsp, 0x58
xor eax, eax
lea rcx, [r11 - 0x38]
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x10], rax
test rcx, rcx
je 0x1800262c0
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
test rax, rax
je 0x1800262b5
call rax
jmp 0x1800262bb
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x20]
cmp ax, 9
je 0x1800262d1
cmp ax, 6
mov eax, 0x20
jne 0x1800262d6
mov eax, 0x40
add rsp, 0x58
ret
Function at 0x1800264a0
Capabilities:
Acquire debug privileges
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x30
mov r12, r9
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x1800264c8
test r8, r8
je 0x1800264c8
test rcx, rcx
jne 0x1800264d8
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
lea rcx, str.SeDebugPrivilege
call fcn.180026150
call fcn.180026260
cmp eax, 0x20
jne 0x180026521
mov rax, qword [rsp + 0x78]
mov r9, r12
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.180028c70
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x18006d078]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800264c8
mov qword [rsp + 0x50], rbp
lea rdx, [rsp + 0x58]
xor ebp, ebp
mov rcx, rsi
mov dword [rsp + 0x58], ebp
call rax
test eax, eax
je 0x1800265e8
cmp rdi, 0x1000
jb 0x1800265e8
mov eax, 0x5a4d
cmp ax, word [rbx]
jne 0x1800265e8
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x1800265e8
mov ecx, 0x14c
cmp word [rax + rbx + 4], cx
mov eax, dword [rsp + 0x58]
sete bpl
cmp eax, ebp
jne 0x1800265e8
test eax, eax
jne 0x1800265c1
mov rax, qword [rsp + 0x78]
mov r9, r12
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.180028c70
jmp 0x1800265ea
mov rax, qword [rsp + 0x78]
mov r9, r12
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.1800294b0
jmp 0x1800265ea
xor eax, eax
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret