joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ed1b0
Capabilities:
Get uefi variable

Disassembly:
sub rsp, 0x868
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x850], rax
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x800
call fcn.180113150
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetFirmwareType
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800ed213
lea rcx, [rsp + 0x30]
call rax
test eax, eax
je 0x1800ed213
cmp dword [rsp + 0x30], 2
je 0x1800ed2fa
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1800ed280
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, str.SeSystemEnvironmentPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
xor eax, eax
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x800
lea r8, [rsp + 0x50]
lea rdx, str.8BE4DF61_93CA_11D2_AA0D_00E098032B8C
lea rcx, str.BootOrder
call qword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
test eax, eax
jne 0x1800ed2fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e6
je 0x1800ed2fa
mov r9d, 0x800
lea r8, [rsp + 0x50]
lea rdx, str.00000000_0000_0000_0000_000000000000
lea rcx, [0x180154cbc]
call qword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
test eax, eax
jne 0x1800ed2fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e6
je 0x1800ed2fa
xor eax, eax
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x868
ret
mov eax, 1
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x868
ret
Function at 0x1800eda10
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor ebx, ebx
lea rcx, str.Shell32.dll
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.SHCreateItemFromParsingName
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
je 0x1800edbb0
lea rcx, str.Propsys.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1800edbb0
lea rdx, str.PSGetPropertyKeyFromName
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
test rax, rax
jne 0x1800edab2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1800edbb0
mov edx, 6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov r12d, 1
lea rcx, [rsp + 0x60]
test eax, eax
mov r8d, 0x208
cmovs r12d, ebx
xor edx, edx
call fcn.180113150
lea rdx, [rsp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov r14d, eax
shr r14d, 2
test r14d, r14d
je 0x1800edb9c
nop dword [rax]
lea ecx, [rbx*4]
lea rdi, [rsp + 0x60]
lea rdi, [rdi + rcx*2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x1800edb91
lea r9, [rsp + 0x20]
xor edx, edx
lea r8, [0x180163fd8]
mov rcx, rdi
call r15
test eax, eax
js 0x1800edb91
lea rdx, [rsp + 0x40]
lea rcx, str.System.Volume.BitLockerProtection
call rbp
test eax, eax
js 0x1800edb86
mov rcx, qword [rsp + 0x20]
lea r8, [rsp + 0x28]
xor eax, eax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov rax, qword [rcx]
call qword [rax + 0x68]
test eax, eax
js 0x1800edb86
mov rcx, qword [rsp + 0x30]
lea eax, [rcx - 1]
test eax, 0xfffffff9
jne 0x1800edb86
cmp ecx, 7
jne 0x1800edbe4
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + 0x10]
inc ebx
cmp ebx, r14d
jb 0x1800edb00
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r12d, r12d
je 0x1800edbb0
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r12d, r12d
je 0x1800edc03
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1800edbb2
Function at 0x1800ee720
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, dword [0x180164218]
mov rdi, rcx
mov dword [rsp + 0x20], eax
movzx eax, word [0x18016421c]
mov word [rsp + 0x24], ax
xor eax, eax
mov qword [rsp + 0x26], rax
xor ebx, ebx
mov word [rsp + 0x2e], ax
nop word [rax + rax]
lea eax, [rbx + 0x43]
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov word [rsp + 0x20], ax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x1800ee7a3
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1801153c8
test eax, eax
je 0x1800ee7cd
inc ebx
cmp ebx, 0x1a
jl 0x1800ee770
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
mov eax, 1
jmp 0x1800ee7ac

Function at 0x1800ee8d0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov qword [rsp + 0x30], rsi
mov ebx, 0x19
mov ebp, eax
mov qword [rsp + 0x38], rdi
nop word [rax + rax]
bt ebp, ebx
jb 0x1800ee920
lea edi, [rbx + 0x41]
movzx esi, di
or esi, 0x20
add esi, 0xffffff9f
cmp esi, 0x19
ja 0x1800ee920
call sym.SafeBase64.dll_GetUsedLogicalDrives
bt eax, esi
jae 0x1800ee942
sub ebx, 1
jns 0x1800ee900
xor eax, eax
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov word [r14], di
mov eax, 1
jmp 0x1800ee927

Function at 0x1800ee950
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x440
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x430], rax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor ebx, ebx
mov dword [rsp + 0x24], 0x3a0041
mov word [rsp + 0x28], bx
mov esi, eax
nop dword [rax + rax]
movzx ecx, bl
mov edi, 1
shl edi, cl
test esi, edi
jne 0x1800ee9d4
lea eax, [rbx + 0x41]
mov dword [rsp + 0x20], 0x200
lea r8, [rsp + 0x20]
mov word [rsp + 0x24], ax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x24]
call qword [sym.imp.MPR.dll_WNetGetConnectionW]
test eax, eax
je 0x1800ee9ce
cmp eax, 0x4b1
jne 0x1800ee9d4
or dword [0x180196f4c], edi
inc bx
cmp bx, 0x19
jbe 0x1800ee990
mov eax, dword [0x180196f4c]
or eax, esi
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1800eea70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
push r14
push r15
sub rsp, 0xa68
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0xa50], rax
mov r15, rdx
mov r14, rcx
xor edx, edx
lea rcx, [rsp + 0x250]
mov r8d, 0x800
call fcn.180113150
lea rcx, [0x180159808]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtQuerySystemInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edi, edi
test rax, rax
jne 0x1800eeadd
lea rcx, str.GetVolumeESP:_NtQuerySystemInformationPtr_Null
call sym.SafeBase64.dll_DbgPrintW
jmp 0x1800eeb0d
lea r9, [rsp + 0x38]
mov r8d, 0x800
lea rdx, [rsp + 0x250]
mov ecx, 0x62
call rax
test eax, eax
je 0x1800eeb9d
mov edx, eax
lea rcx, str.GetVolumeESP:_NtQuerySystemInformationPtr__res___x
call sym.SafeBase64.dll_DbgPrintW
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0x208
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SystemSetup
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800eeb85
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.SystemPartition
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, 1
test eax, eax
cmovne ebx, edi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1800eebb4
lea rdx, [rsp + 0x40]
lea rcx, str.GetVolumeESP:_GetSystemPartition__DeviceName___s
call sym.SafeBase64.dll_DbgPrintW
xor eax, eax
jmp 0x1800eecb6
mov r8, qword [rsp + 0x258]
lea rcx, [rsp + 0x40]
mov edx, 0x103
call fcn.1801259f0
mov eax, 0x74
mov qword [rsp + 0xaa0], rbp
mov word [r14], ax
mov qword [rsp + 0xa60], rsi
call sym.SafeBase64.dll_GetUsedLogicalDrives
bt eax, 0x13
jae 0x1800eec54
mov ebx, edi
nop
mov esi, 0x5a
sub si, bx
movzx ebp, si
or ebp, 0x20
add ebp, 0xffffff9f
cmp ebp, 0x19
ja 0x1800eec00
call sym.SafeBase64.dll_GetUsedLogicalDrives
bt eax, ebp
jae 0x1800eec50
inc ebx
cmp ebx, 0x1a
jl 0x1800eebe0
nop word [rax + rax]
lea ebx, [rdi + 0x30]
movzx esi, bx
or esi, 0x20
add esi, 0xffffff9f
cmp esi, 0x19
ja 0x1800eec2b
call sym.SafeBase64.dll_GetUsedLogicalDrives
bt eax, esi
jae 0x1800eec89
inc edi
cmp edi, 0xa
jl 0x1800eec10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x40]
lea rcx, str.GetUEFIDriver:_GetNonUsedDriverLetter_DevceiName_s_err_x
call sym.SafeBase64.dll_DbgPrintW
xor eax, eax
jmp 0x1800eeca6
mov word [r14], si
lea r8, [rsp + 0x40]
mov rdx, r14
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
test eax, eax
jne 0x1800eec8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x40]
lea rcx, str.GetUEFIDriver:_CreateDosName_DevceiName_s_err_x
call sym.SafeBase64.dll_DbgPrintW
xor eax, eax
jmp 0x1800eeca6
mov word [r14], bx
jmp 0x1800eec54
lea r8, [rsp + 0x40]
mov edx, 0x103
mov rcx, r15
call fcn.1801259f0
mov eax, 1
mov rbp, qword [rsp + 0xaa0]
mov rsi, qword [rsp + 0xa60]
mov rcx, qword [rsp + 0xa50]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0xa68
pop r15
pop r14
pop rdi
pop rbx
ret
Function at 0x1800ef5e0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x68], rax
call fcn.1800f6888
xor ecx, ecx
call fcn.18011ab34
mov rcx, rax
call fcn.18011aa84
xor r14d, r14d
lea rdi, [0x180196628]
mov ebx, r14d
nop dword [rax]
call fcn.18011aa58
imul ecx, eax, 0xff
mov eax, 0x20005
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0xe
mov byte [rdi], cl
test cl, cl
jne 0x1800ef646
lea eax, [rbx + 1]
mov byte [rdi], al
inc ebx
inc rdi
cmp ebx, 0x20
jb 0x1800ef620
call sym.SafeBase64.dll_Is64BitOS
mov ebp, 1
test eax, eax
je 0x1800ef73b
mov qword [rsp + 0x98], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x400
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x1800ef733
xor eax, eax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx edx, word [rsp + 0x38]
lea rcx, str.IsX86Process:_wProcessorArchitecture_x_n
call sym.SafeBase64.dll_DbgPrintW
cmp r14w, word [rsp + 0x38]
jne 0x1800ef6d4
mov ebx, ebp
jmp 0x1800ef719
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], r14d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, dword [rsp + 0x30]
lea rcx, str.IsX86Process:_bRet_x_Wow64Process_x_hProcess_x_Pid_d_Err_x_n
mov r9, rsi
mov dword [rsp + 0x28], ebx
mov edx, edi
mov dword [rsp + 0x20], eax
call sym.SafeBase64.dll_DbgPrintW
mov ebx, dword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x18019689c]
test ebx, ebx
cmovne ecx, ebp
mov dword [0x18019689c], ecx
mov rsi, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, dword [0x18019689c]
lea rcx, str.InitWow64:_isWow64_x_heap___x_n
mov r8, rax
mov qword [0x1801968a0], rax
call sym.SafeBase64.dll_DbgPrintW
mov eax, ebp
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r14
pop rdi
pop rbp
ret
Function at 0x1800efa70
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xd98]
sub rsp, 0xe98
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rbp + 0xd80], rax
xor edi, edi
mov r14d, r9d
mov r15d, r8d
mov rsi, rdx
test rcx, rcx
je 0x1800efcd7
mov r8, rcx
mov edx, 0x1ff
lea rcx, [rbp + 0x180]
call fcn.1801259f0
lea rcx, [rbp + 0x180]
mov rax, 0xffffffffffffffff
nop
cmp word [rcx + rax*2 + 2], di
lea rax, [rax + 1]
jne 0x1800efad0
cmp word [rbp + rax*2 + 0x17e], 0x5c
jne 0x1800efb02
lea rax, [rax*2 - 2]
cmp rax, 0x400
jae 0x1800efcf8
mov word [rbp + rax + 0x180], di
test r14d, r14d
je 0x1800efbf0
lea r8, [rbp + 0x180]
mov edx, 0x3ff
lea rcx, [rbp + 0x580]
call fcn.1801259f0
lea r8, [0x180155a80]
mov edx, 0x3ff
lea rcx, [rbp + 0x580]
call fcn.180125a58
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x580]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800efcd7
nop word [rax + rax]
lea rdx, [0x180155a8c]
lea rcx, [rsp + 0x5c]
call fcn.1801153c8
test eax, eax
je 0x1800efbd1
lea rdx, [0x180155a90]
lea rcx, [rsp + 0x5c]
call fcn.1801153c8
test eax, eax
je 0x1800efbd1
test byte [rsp + 0x30], 0x10
je 0x1800efbd1
lea rax, [rsp + 0x5c]
mov edx, 0x3ff
lea r9, [rbp + 0x180]
mov qword [rsp + 0x20], rax
lea r8, [0x180154c70]
lea rcx, [rbp + 0x580]
call fcn.18000f870
mov r9d, r14d
lea rcx, [rbp + 0x580]
mov r8d, r15d
mov rdx, rsi
call sym.SafeBase64.dll_WipeFolder
mov edi, eax
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1800efb60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r8, [rbp + 0x180]
mov edx, 0x3ff
lea rcx, [rbp + 0x580]
call fcn.1801259f0
test rsi, rsi
je 0x1800efc3f
cmp word [rsi], 0
je 0x1800efc3f
lea r8, [0x180155ad4]
mov edx, 0x3ff
lea rcx, [rbp + 0x580]
call fcn.180125a58
mov r8, rsi
lea rcx, [rbp + 0x580]
mov edx, 0x3ff
call fcn.180125a58
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x580]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800efcd7
nop word [rax + rax]
test byte [rsp + 0x30], 0x10
jne 0x1800efcb8
lea rax, [rsp + 0x5c]
mov edx, 0x3ff
lea r9, [rbp + 0x180]
mov qword [rsp + 0x20], rax
lea r8, [0x180154c70]
lea rcx, [rbp + 0x580]
call fcn.18000f870
mov edx, r15d
lea rcx, [rbp + 0x580]
call sym.SafeBase64.dll_WipeFile
mov edi, eax
test eax, eax
jne 0x1800efcb8
lea rdx, [rbp + 0x580]
lea rcx, [0x180164638]
call sym.SafeBase64.dll_DbgPrintW
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1800efc60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
jmp 0x1800efcd9
xor eax, eax
mov rcx, qword [rbp + 0xd80]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0xe98
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18010fc24
int3
Function at 0x1800f1310
Capabilities:
Set tcp connection state

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edi, edi
movzx r14d, cx
mov ebp, 1
cmp di, cx
jne 0x1800f133c
mov eax, ebp
jmp 0x1800f13ad
xor eax, eax
mov qword [rsp + 0x80], rsi
mov r8d, ebp
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0x18
call qword [sym.imp.IPHLPAPI.DLL_GetTcpTable]
cmp eax, 0x7a
jne 0x1800f13a3
mov ecx, dword [rsp + 0x20]
call fcn.180115540
mov rsi, rax
test rax, rax
je 0x1800f13a3
mov r8d, ebp
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetTcpTable]
test eax, eax
je 0x1800f13c3
mov rcx, rsi
call fcn.180115548
xor eax, eax
mov rsi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret
cmp dword [rsi], edi
jle 0x1800f1432
mov qword [rsp + 0x78], rbx
lea rbx, [rsi + 4]
mov qword [rsp + 0x88], r15
mov r15d, 2
nop
cmp dword [rbx], 5
jne 0x1800f141b
movzx ecx, r14w
call qword [sym.imp.WS2_32.dll_htons]
movzx eax, ax
cmp dword [rbx + 8], eax
jne 0x1800f141b
movsxd rax, edi
mov dword [rbx], 0xc
lea rcx, [rax*4 + 1]
add rcx, rax
lea rcx, [rsi + rcx*4]
call qword [sym.imp.IPHLPAPI.DLL_SetTcpEntry]
test eax, eax
cmove ebp, r15d
inc edi
add rbx, 0x14
cmp edi, dword [rsi]
jl 0x1800f13e0
mov r15, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x78]
mov rcx, rsi
call fcn.180115548
mov eax, ebp
jmp 0x1800f13a5

Function at 0x1800f1450
Capabilities:
Set tcp connection state

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edi, edi
movzx r14d, cx
mov ebp, 1
cmp di, cx
jne 0x1800f147c
mov eax, ebp
jmp 0x1800f14ed
xor eax, eax
mov qword [rsp + 0x80], rsi
mov r8d, ebp
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0x18
call qword [sym.imp.IPHLPAPI.DLL_GetTcpTable]
cmp eax, 0x7a
jne 0x1800f14e3
mov ecx, dword [rsp + 0x20]
call fcn.180115540
mov rsi, rax
test rax, rax
je 0x1800f14e3
mov r8d, ebp
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetTcpTable]
test eax, eax
je 0x1800f1503
mov rcx, rsi
call fcn.180115548
xor eax, eax
mov rsi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret
cmp dword [rsi], edi
jle 0x1800f1572
mov qword [rsp + 0x78], rbx
lea rbx, [rsi + 4]
mov qword [rsp + 0x88], r15
mov r15d, 2
nop
cmp dword [rbx], 5
jne 0x1800f155b
movzx ecx, r14w
call qword [sym.imp.WS2_32.dll_htons]
movzx eax, ax
cmp dword [rbx + 0x10], eax
jne 0x1800f155b
movsxd rax, edi
mov dword [rbx], 0xc
lea rcx, [rax*4 + 1]
add rcx, rax
lea rcx, [rsi + rcx*4]
call qword [sym.imp.IPHLPAPI.DLL_SetTcpEntry]
test eax, eax
cmove ebp, r15d
inc edi
add rbx, 0x14
cmp edi, dword [rsi]
jl 0x1800f1520
mov r15, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x78]
mov rcx, rsi
call fcn.180115548
mov eax, ebp
jmp 0x1800f14e5
Function at 0x1800f1590
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx edi, cx
mov ebx, 1
call fcn.1800f0ac0
test eax, eax
jne 0x1800f1688
mov qword [rsp + 0x68], rbp
lea rax, [rsp + 0x30]
xor ebp, ebp
mov qword [rsp + 0x70], rsi
mov r9d, ebx
mov dword [rsp + 0x38], ebp
xor r8d, r8d
mov dword [rsp + 0x40], 4
lea rdx, str.SYSTEMCurrentControlSetControlTerminal_Server_
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800f1651
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.fDenyTSConnections
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
mov esi, ebx
test eax, eax
cmovne esi, ebp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1800f1649
mov ebx, ebp
cmp dword [rsp + 0x38], ebx
sete bl
test ebx, ebx
jne 0x1800f1651
mov eax, esi
jmp 0x1800f167e
xor ecx, ecx
call sym.SafeBase64.dll_SetRemoteDesktopState
movzx ecx, di
call sym.SafeBase64.dll_CloseConnect
mov ebx, eax
cmp eax, 2
jne 0x1800f1672
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call sym.SafeBase64.dll_SetRemoteDesktopState
mov eax, ebx
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1800f1d90
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r15, rcx
lea rcx, str.rootwmi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r14, rax
mov qword [rsp + 0x58], rax
lea rcx, str.MSSmBios_RawSMBiosTables
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
mov qword [rsp + 0x50], rax
mov r12d, 1
mov dword [rsp + 0x78], r12d
xor edi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [0x180142b28]
mov r8d, r12d
xor edx, edx
lea rcx, [0x180142bf8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1800f1f0d
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
call qword [rax + 0x18]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
jne 0x1800f1f0d
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
call qword [rax + 0x90]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
js 0x1800f1f0d
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x20], rdx
mov r9, r15
mov r8d, r12d
mov edx, 0xfa0
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp dword [rsp + 0x78], r12d
cmove edi, r12d
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret