joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002f48
Capabilities:
Switch active desktop

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp - 4], 1
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x182
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rax, str.m_pcszNewDesktopName
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_CreateDesktopA]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x140002f9e
mov eax, 0
jmp 0x140002fbc
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SwitchDesktop]
call rax
test eax, eax
je 0x140002fb9
mov dword [rbp - 4], 0
mov eax, dword [rbp - 4]
add rsp, 0x40
pop rbp
ret

Function at 0x140003087
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
sub rsp, 0x458
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], rcx
mov qword [rbp + 0x3f8], rdx
mov qword [rbp + 0x400], r8
mov qword [rbp + 0x408], r9
mov qword [rbp + 0x3c8], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
lea rdx, [rbp - 0x30]
mov eax, 0
mov ecx, 0x7e
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x44], 0x104
mov rax, qword [rbp + 0x3f8]
lea rdx, [rbp + 0x3c8]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20019
mov r8d, 0
mov rdx, rax
mov rcx, qword [rbp + 0x3f0]
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
jne 0x1400031a9
mov rax, qword [rbp + 0x3c8]
mov rdx, qword [rbp + 0x400]
lea rcx, [rbp - 0x44]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
test eax, eax
jne 0x140003196
mov rdx, qword [rbp + 0x408]
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_StrStrIA]
call rax
test rax, rax
je 0x140003196
mov rax, qword [rbp + 0x3c8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 1
jmp 0x1400031ae
mov rax, qword [rbp + 0x3c8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 0
add rsp, 0x458
pop rdi
pop rbp
ret

Function at 0x14000349f
Capabilities:
Check if process is running under wine

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400034cc
mov eax, 0
jmp 0x1400034f4
mov rax, qword [rbp - 8]
lea rdx, str.wine_get_unix_file_name
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
test rax, rax
jne 0x1400034ef
mov eax, 0
jmp 0x1400034f4
mov eax, 1
add rsp, 0x30
pop rbp
ret
Function at 0x1400034fa
Capabilities:
Check if process is running under wine

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp - 4], 0
lea rax, str.SOFTWAREWine
mov qword [rbp - 0x18], rax
mov word [rbp - 0xa], 1
mov dword [rbp - 8], 0
jmp 0x14000356f
mov eax, dword [rbp - 8]
cdqe
mov rax, qword [rbp + rax*8 - 0x18]
mov rdx, rax
mov rcx, 0xffffffff80000001
call sym.Is_RegKeyExists
test eax, eax
je 0x140003547
mov dword [rbp - 4], 1
mov eax, dword [rbp - 8]
cdqe
mov rax, qword [rbp + rax*8 - 0x18]
mov rdx, rax
mov rcx, 0xffffffff80000002
call sym.Is_RegKeyExists
test eax, eax
je 0x14000356b
mov dword [rbp - 4], 1
add dword [rbp - 8], 1
movzx eax, word [rbp - 0xa]
cmp dword [rbp - 8], eax
jl 0x140003523
mov eax, dword [rbp - 4]
add rsp, 0x40
pop rbp
ret
Function at 0x1400047f1
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xdc], 0
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
cmp qword [rbp + 0xd0], 0xffffffffffffffff
je 0x14000484b
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32First
test eax, eax
jne 0x140004872
jmp 0x140004855
mov eax, 0
jmp 0x140004a04
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140004a04
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.vboxservice.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x14000489b
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.vboxtray.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x1400048c4
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VGAuthService.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x1400048ed
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.Vmacthlp.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004916
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VMtoolsd.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x14000493f
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VMwaretrat.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004968
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VMwareUser.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004991
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VMwareService.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x1400049ba
mov dword [rbp + 0xdc], 1
lea rax, [rbp - 0x60]
add rax, 0x2c
lea rdx, str.VMwareTray.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x1400049e3
mov dword [rbp + 0xdc], 1
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x140004872
mov eax, dword [rbp + 0xdc]
add rsp, 0x160
pop rbp
ret
Function at 0x140004cc5
Capabilities:
Enumerate process modules

Disassembly:
push rbp
mov eax, 0x1040
call fcn.14000ce90
sub rsp, rax
lea rbp, [rsp + 0x80]
lea rdx, [rbp - 0x54]
lea rax, [rbp - 0x50]
mov r8, rdx
mov edx, 0x1000
mov rcx, rax
call sym.K32EnumProcesses
test eax, eax
jne 0x140004cfe
mov eax, 1
jmp 0x140004d62
mov eax, dword [rbp - 0x54]
shr eax, 2
mov dword [rbp + 0xfb4], eax
mov dword [rbp + 0xfb8], 0
jmp 0x140004d4b
mov eax, dword [rbp + 0xfb8]
mov eax, dword [rbp + rax*4 - 0x50]
test eax, eax
je 0x140004d44
mov eax, dword [rbp + 0xfb8]
mov eax, dword [rbp + rax*4 - 0x50]
mov ecx, eax
call sym.checkProcessName
mov dword [rbp + 0xfbc], eax
cmp dword [rbp + 0xfbc], 0
jne 0x140004d5b
add dword [rbp + 0xfb8], 1
mov eax, dword [rbp + 0xfb8]
cmp eax, dword [rbp + 0xfb4]
jb 0x140004d16
jmp 0x140004d5c
nop
mov eax, dword [rbp + 0xfbc]
add rsp, 0x1040
pop rbp
ret

Function at 0x1400051a1
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, [0x140028dac]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
lea rdx, [0x140028db6]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov rdx, qword [0x14002ba90]
mov qword [rdx], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtCreateFile
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x140033060], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtCreateEvent
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x140033068], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtQueryDirectoryFile
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x140033070], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtWaitForSingleObject
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x140033078], rax
mov rax, qword [rbp - 8]
lea rdx, str.RtlUnicodeStringToAnsiString
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x140033080], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtClose
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x140033088], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtOpenFile
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x140033090], rax
mov rax, qword [rbp - 8]
lea rdx, str.NtQueryAttributesFile
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x140033098], rax
nop
add rsp, 0x30
pop rbp
ret
Function at 0x140006224
Capabilities:
Hide thread from debugger

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp - 4], 0x11
lea rax, [0x140029a50]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
lea rdx, str.NtSetInformationThread
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp - 0x18], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rax
mov rcx, rax
mov eax, dword [rbp - 4]
mov r10, qword [rbp - 0x18]
mov r9d, 0
mov r8d, 0
mov edx, eax
call r10
lea rax, [sym.UnhandledExcepFilter]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov qword [rbp - 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 0
mov ecx, 0xc000008e
mov rax, qword [sym.imp.KERNEL32.dll_RaiseException]
call rax
mov rax, qword [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov eax, dword [0x140027b60]
add rsp, 0x40
pop rbp
ret

Function at 0x140006463
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x100], ecx
mov dword [rbp + 0xdc], 0
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
lea rdx, [rbp - 0x60]
mov eax, 0
mov ecx, 0x26
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32First
test eax, eax
je 0x1400064f7
mov eax, dword [rbp - 0x58]
cmp dword [rbp + 0x100], eax
jne 0x1400064e0
mov eax, dword [rbp - 0x40]
mov dword [rbp + 0xdc], eax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x1400064cc
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0xdc]
add rsp, 0x168
pop rdi
pop rbp
ret
Function at 0x14000656a
Capabilities:
Accept command line arguments
Check mutex on windows
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xf0
lea rax, str.SelfDebugMutex
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov r8, rax
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateMutexA]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 0xb7
jne 0x1400065bd
call sym.child_process
mov eax, 0
jmp 0x1400066a1
mov dword [rbp - 0x34], 0
lea rax, [rbp - 0x30]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp - 0xa0]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp - 0xa0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCommandLineA]
call rax
mov rdx, rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0xa0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov rax, qword [rbp - 0x30]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 0x30]
lea rdx, [rbp - 0x34]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call rax
mov eax, dword [rbp - 0x34]
test eax, eax
je 0x14000669c
mov eax, 1
jmp 0x1400066a1
mov eax, 0
add rsp, 0xf0
pop rbp
ret

Function at 0x1400069ae
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov qword [rbp + 0xd8], 0
lea rax, [rbp - 0x60]
mov r8d, 0x130
mov edx, 0
mov rcx, rax
call sym.memset
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd8], rax
cmp qword [rbp + 0xd8], 0xffffffffffffffff
jne 0x140006a11
mov eax, 0
jmp 0x140006ae9
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32First
test eax, eax
jne 0x140006a4c
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140006ae9
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
call rax
test eax, eax
jne 0x140006aba
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp - 0x58]
jmp 0x140006ae9
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
call rax
test eax, eax
jne 0x140006aba
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp - 0x58]
jmp 0x140006ae9
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x140006a83
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x160
pop rbp
ret
Function at 0x140006c75
Capabilities:
Check for sandbox username or hostname
Get hostname

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xdc], 0
lea rax, str.vbox
mov qword [rbp + 0xb0], rax
lea rax, [0x140029ca4]
mov qword [rbp + 0xb8], rax
lea rax, str.virtual
mov qword [rbp + 0xc0], rax
lea rax, str.sandbox
mov qword [rbp + 0xc8], rax
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0
mov qword [rbp], 0
mov qword [rbp + 8], 0
mov qword [rbp + 0x10], 0
mov qword [rbp + 0x18], 0
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xa8], 0
mov dword [rbp - 0x54], 0x100
lea rdx, [rbp - 0x54]
lea rax, [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetComputerNameA]
call rax
test eax, eax
je 0x140006e32
jmp 0x140006e29
mov eax, dword [rbp + 0xdc]
cdqe
mov rdx, qword [rbp + rax*8 + 0xb0]
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.strstr
test rax, rax
je 0x140006e22
mov eax, 1
jmp 0x140006e37
add dword [rbp + 0xdc], 1
cmp dword [rbp + 0xdc], 3
jle 0x140006dfa
mov eax, 0
add rsp, 0x160
pop rbp
ret
Function at 0x140006e67
Capabilities:
Get local ipv4 addresses

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x1c], 0
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.GetAdaptersAddresses
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0x6f
jne 0x140006f81
mov eax, dword [rbp - 0x1c]
mov eax, eax
mov rdx, rax
mov ecx, 0x40
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x18], rax
cmp qword [rbp - 8], 0
je 0x140006f81
mov rdx, qword [rbp - 8]
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x20], rax
mov r9, rdx
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.GetAdaptersAddresses
mov dword [rbp - 0x22], 0
mov word [rbp - 0x1e], 0
jmp 0x140006f6a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x58]
cmp eax, 6
jne 0x140006f5e
mov rax, qword [rbp - 8]
add rax, 0x50
mov edx, dword [rax]
mov dword [rbp - 0x22], edx
movzx eax, word [rax + 4]
mov word [rbp - 0x1e], ax
lea rax, [rbp - 0x22]
mov r8d, 3
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call sym.memcmp
test eax, eax
jne 0x140006f5e
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
call rax
mov eax, 1
jmp 0x140006f86
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140006f0c
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
call rax
mov eax, 0
add rsp, 0x60
pop rbp
ret

Function at 0x140006f8c
Capabilities:
Get mac address on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov dword [rbp - 4], 0
mov dword [rbp - 0x18], 0x2c0
mov ecx, 0x2c0
call sym.malloc
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x140006fc5
mov eax, 0xffffffff
jmp 0x140007098
lea rdx, [rbp - 0x18]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.GetAdaptersInfo
cmp eax, 0x6f
jne 0x140007008
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.free
mov eax, dword [rbp - 0x18]
mov eax, eax
mov rcx, rax
call sym.malloc
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x140007008
mov eax, 1
jmp 0x140007098
lea rdx, [rbp - 0x18]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.GetAdaptersInfo
test eax, eax
jne 0x140007095
mov dword [rbp - 0x14], 0
jmp 0x140007042
mov eax, dword [rbp - 0x14]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
movzx edx, byte [rax]
mov eax, dword [rbp - 0x14]
cdqe
mov byte [rbp + rax - 0x1c], dl
add dword [rbp - 0x14], 1
cmp dword [rbp - 0x14], 3
jle 0x140007025
jmp 0x14000708e
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x194]
cmp eax, 6
jne 0x140007083
mov rax, qword [rbp - 0x10]
lea rdx, [rax + 0x198]
lea rax, [rbp - 0x1c]
mov r8d, 3
mov rcx, rax
call sym.memcmp
test eax, eax
jne 0x140007083
mov dword [rbp - 4], 1
jmp 0x140007095
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000704a
mov eax, dword [rbp - 4]
add rsp, 0x40
pop rbp
ret
Function at 0x14000723c
Capabilities:
Get disk size

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, [rbp - 8]
mov r9d, 0
mov r8, rax
mov edx, 0
lea rax, [0x140029cd3]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
call rax
test eax, eax
je 0x140007287
mov rax, qword [rbp - 8]
movabs rdx, 0xf3fffffff
cmp rax, rdx
ja 0x140007287
mov eax, 1
jmp 0x14000728c
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x140007292
Capabilities:
Check for debugger via api

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 4], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
lea rax, [rbp - 4]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
call rax
test eax, eax
je 0x1400072cf
mov eax, dword [rbp - 4]
test eax, eax
je 0x1400072cf
mov eax, 1
jmp 0x1400072d4
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x1400072da
Capabilities:
Get memory capacity

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov dword [rbp - 0x40], 0x40
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call rax
mov rax, qword [rbp - 0x38]
mov edx, 0x80000000
cmp rax, rdx
setb al
movzx eax, al
add rsp, 0x60
pop rbp
ret

Function at 0x140007384
Capabilities:
Get disk size

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
lea rax, str..PhysicalDrive0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0xffffffffffffffff
jne 0x1400073eb
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140007467
mov rax, qword [rbp - 8]
mov qword [rsp + 0x38], 0
lea rdx, [rbp - 0x1c]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 8
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0x7405c
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeviceIoControl]
call rax
mov dword [rbp - 0xc], eax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp - 0xc], 0
je 0x140007462
mov rax, qword [rbp - 0x18]
movabs rdx, 0xf3fffffff
cmp rax, rdx
jg 0x140007462
mov eax, 1
jmp 0x140007467
mov eax, 0
add rsp, 0x60
pop rbp
ret
Function at 0x140007610
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp - 0x20], 0
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.ole32.dll_CoInitializeEx]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jns 0x14000764e
mov eax, 0
jmp 0x140007797
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0xffffffff
mov ecx, 0
mov rax, qword [sym.imp.ole32.dll_CoInitializeSecurity]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jns 0x1400076b3
mov rax, qword [sym.imp.ole32.dll_CoUninitialize]
call rax
mov eax, 0
jmp 0x140007797
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9, qword [0x14002b8c0]
mov r8d, 1
mov edx, 0
mov rax, qword [0x14002b8b0]
mov rcx, rax
mov rax, qword [sym.imp.ole32.dll_CoCreateInstance]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jns 0x1400076fd
mov rax, qword [sym.imp.ole32.dll_CoUninitialize]
call rax
mov eax, 0
jmp 0x140007797
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.OLEAUT32.dll_SysAllocString]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov r10, qword [rax + 0x18]
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp + 0x18]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
not eax
shr eax, 0x1f
movzx eax, al
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.OLEAUT32.dll_SysFreeString]
call rax
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp - 0x20]
mov rcx, rax
call rdx
mov eax, dword [rbp - 0x14]
add rsp, 0x70
pop rbp
ret

Function at 0x140007a1c
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x140007a4e
mov eax, 0
jmp 0x140007a81
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_number_cores]
lea r8, str.SELECT__FROM_Win32_Processor
lea rdx, [0x140029d64]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x140007b51
Capabilities:
Reference wmi statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rdx, rax
lea rax, str.rootcimv2
mov rcx, rax
call sym.wmi_initialize
cmp eax, 1
je 0x140007b83
mov eax, 0
jmp 0x140007bb6
mov rax, qword [rbp - 0x10]
lea r9, [sym.check_wmi_disk_size]
lea r8, str.SELECT__FROM_Win32_LogicalDisk
lea rdx, [0x140029d64]
mov rcx, rax
call sym.wmi_check_query
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.wmi_cleanup
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret