joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001fd60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
mov eax, 0x4048
call fcn.1800a2220
sub rsp, rax
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rsp + 0x4030], rax
mov rdi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x4000
call fcn.1800a3140
test rbx, rbx
je 0x18001fe1c
mov qword [rsp + 0x4040], rsi
lea rsi, [rsp + 0x4070]
call fcn.180004c70
mov qword [rsp + 0x28], rsi
lea rdx, [rsp + 0x30]
mov r9, rdi
mov qword [rsp + 0x20], 0
mov r8d, 0x3fff
mov rcx, qword [rax]
or rcx, 2
call fcn.1800a7d18
mov rsi, qword [rsp + 0x4040]
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x18001fe00
mov r9, rbx
lea rcx, [rsp + 0x30]
mov edx, 1
call fcn.1800a8548
mov rcx, qword [rsp + 0x4030]
xor rcx, rsp
call fcn.1800a1bf0
add rsp, 0x4048
pop rdi
pop rbx
ret

Function at 0x18001fe40
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x2d0
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov esi, dword [rsp + 0x338]
lea eax, [r9 + 1]
mov rdi, qword [rsp + 0x330]
mov rbp, rcx
mov rcx, qword [rsp + 0x340]
mov r15, r8
mov qword [rsp + 0x48], rcx
mov r14, rdx
mov dword [rsp + 0x40], r9d
cmp esi, eax
jbe 0x18001fe9f
test r9d, r9d
jne 0x180020092
cmp esi, 0x1e
ja 0x180020092
test rcx, rcx
je 0x18001fecf
mov rbx, rcx
mov rcx, qword [rbx]
test rcx, rcx
je 0x18001fecf
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x180020092
add rbx, 8
jmp 0x18001feb0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 3
movsxd rcx, eax
add rcx, rcx
call fcn.1800a411c
mov qword [rsp + 0x50], rax
mov r12, rax
test rax, rax
je 0x180020092
mov r8, rdi
mov qword [rsp + 0x2c8], r13
lea rdx, [0x1800c4118]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x18001ff5d
mov rcx, r12
call fcn.1800a4108
xor eax, eax
mov r12, qword [rsp + 0x48]
nop dword [rax]
nop word [rax + rax]
xor eax, eax
jmp 0x18001ff3b

Function at 0x1800200a0
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file size

Disassembly:
push rbp
push rsi
push r12
push r13
push r14
sub rsp, 0x2d0
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov r14, r9
mov rbp, r8
mov rsi, rdx
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [rax*2 + 6]
call fcn.1800a411c
mov r13, rax
test rax, rax
jne 0x1800200f1
lea eax, [r13 - 1]
jmp 0x18002027c
mov r8, r12
mov qword [rsp + 0x2b8], r15
lea rdx, [0x1800c4118]
mov rcx, r13
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x50]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x180020130
mov rcx, r13
call fcn.1800a4108
jmp 0x180020272
mov qword [rsp + 0x2c8], rbx
mov qword [rsp + 0x2c0], rdi
Function at 0x180020970
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c0
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov r14, qword [rsp + 0x320]
xor ebx, ebx
mov rbp, qword [rsp + 0x328]
mov r12, rdx
mov dword [rsp + 0x38], r9d
mov r15, rcx
mov qword [rsp + 0x40], r8
test rdx, rdx
je 0x1800209db
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add edi, eax
lea edi, [rdi*2 + 4]
jmp 0x1800209e8
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [rax*2 + 6]
mov ecx, edi
call fcn.1800a411c
mov qword [rsp + 0x48], rax
mov r13, rax
test rax, rax
jne 0x180020a05
lea eax, [r13 - 1]
jmp 0x180020c1b
mov r8, r15
mov rcx, r13
test r12, r12
je 0x180020a22
mov r9, r12
lea rdx, [0x1800c4108]
lea rdx, [0x1800c4118]
call qword [sym.imp.USER32.dll_wsprintfW]

Function at 0x180020c40
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a8
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov r14, qword [rsp + 0x310]
mov r15, r9
mov ebp, r8d
mov rsi, rdx
mov r13, rcx
test rcx, rcx
je 0x180020ea1
xor edi, edi
test rdx, rdx
je 0x180020cae
test r8d, r8d
jne 0x180020cae
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [rax*2 + 6]

Function at 0x180020ed0
Capabilities:
Check if file exists
Create directory
Delete directory
Enumerate files on windows
Enumerate files recursively
Get file attributes
Move file

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c0
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov r15, qword [rsp + 0x320]
xor ebx, ebx
mov rbp, qword [rsp + 0x328]
mov r12, rdx
mov dword [rsp + 0x30], r9d
mov r14, rcx
mov qword [rsp + 0x40], r8
test rdx, rdx
je 0x180020f3b
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, r14
mov edi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add edi, eax
lea edi, [rdi*2 + 4]
jmp 0x180020f48
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [rax*2 + 6]
mov ecx, edi
call fcn.1800a411c
mov qword [rsp + 0x48], rax
mov r13, rax
test rax, rax
jne 0x180020f65
lea eax, [r13 - 1]
jmp 0x180021191
mov r8, r14
mov rcx, r13
test r12, r12
je 0x180020f82
mov r9, r12
lea rdx, [0x1800c4108]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x180020f8f
lea rdx, [0x1800c4118]
Function at 0x1800211c0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
mov eax, 0x1270
call fcn.1800a2220
sub rsp, rax
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rsp + 0x1260], rax
mov rbp, rdx
mov r14, rcx
xorps xmm0, xmm0
lea rcx, [r9 + 0x14]
lea rdx, [rsp + 0x48]
mov rsi, r9
movups xmmword [rsp + 0x50], xmm0
mov rdi, r8
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx ecx, word [rsp + 0x58]
movzx edx, word [rsp + 0x56]
movzx eax, word [rsp + 0x5a]
movzx r9d, word [rsp + 0x52]
movzx r8d, word [rsp + 0x50]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x20], edx
lea rdx, str._04d_02d_02d_02d_02d
call qword [sym.imp.USER32.dll_wsprintfW]
lea eax, [rbx + 0x44]
cmp dword [rsp + 0x12c8], ebx
jne 0x180021272
mov eax, dword [rsi + 0x20]
mov ebx, dword [rsi + 0x1c]
shl rbx, 0x20
add rbx, rax
mov eax, 0x46
mov r8d, dword [rsp + 0x12c0]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], rcx
lea r9, [rsi + 0x2c]
mov qword [rsp + 0x28], rbx
lea rcx, [rsp + 0x260]
lea rdx, str._d_t_s_t_c_t_I64u_t_s_n
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x260]
call fcn.1800343f0
mov rbx, rax
test rax, rax
je 0x180021341
cmp r14, 0xffffffffffffffff
je 0x180021339
test rbp, rbp
je 0x180021339
test rdi, rdi
je 0x180021339
mov esi, dword [rdi]
mov rcx, rax

Function at 0x180021360
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x15f8]
mov eax, 0x16f8
call fcn.1800a2220
sub rsp, rax
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rbp + 0x15d0], rax
mov r12, r8
mov r15, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x30]
mov rsi, r9
call fcn.1800a3140
xor edx, edx
lea rcx, [rbp + 0xdb0]
mov r8d, 0x820
call fcn.1800a3140
mov r8, r15
lea rdx, [0x1800c4118]
lea rcx, [rbp + 0xdb0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xdb0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1800215cc
mov qword [rsp + 0x16e8], r13
xor r13d, r13d
mov qword [rsp + 0x16f0], rbx
nop dword [rax + rax]
Function at 0x180021860
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push r12
push r13
push r14
push r15
sub rsp, 0x70
xor ebx, ebx
mov r13, r8
mov r15d, ebx
mov r14d, ebx
call fcn.180034490
mov r12, rax
test rax, rax
jne 0x18002189b
lea eax, [rbx - 0x16]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rbx
ret
mov rcx, r12
mov qword [rsp + 0x60], rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0x80000000
mov rcx, r12
lea r8d, [r9 + 1]
test al, 0x10
je 0x1800218cb
mov dword [rsp + 0x28], 0x2000000
jmp 0x1800218d3
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa0], rbp
mov rdi, rax
mov qword [rsp + 0x68], rsi
cmp rax, 0xffffffffffffffff
jne 0x180021906
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
neg ebx
jmp 0x180021a8e
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x48]
mov edx, 1
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov r8d, edx
mov rcx, rdi
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x44], 8
mov qword [rsp + 0x50], rbx
call qword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
je 0x180021963
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
neg ebx
jmp 0x180021a8e
mov rdx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0xb8]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0xb8], ebx
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x180021a7b
cmp dword [rsp + 0xb8], ebx
je 0x180021a7b
mov ecx, eax
add rcx, rcx
call fcn.1800a411c
mov ecx, dword [rsp + 0xb8]
mov rbp, rax
add rcx, rcx
call fcn.1800a411c
mov rsi, rax
test rbp, rbp
je 0x180021a4c
test rax, rax
je 0x180021a4c
mov rdx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0xb8]
lea rax, [rsp + 0x40]
mov r8, rsi
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
jne 0x180021a3b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
neg ebx
mov rcx, rdi
mov r15, rbp
mov r14, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180021a92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
neg ebx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbp, rbp
je 0x180021a6c
mov rcx, rbp
call fcn.1800a4108
test rsi, rsi
je 0x180021a8e
mov rcx, rsi
call fcn.1800a4108
jmp 0x180021a8e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
mov ebx, eax
Function at 0x1800258b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
push r13
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
mov qword [rsp + 0x48], r8
mov ecx, 0x100000
mov r13, r8
mov r15, rdx
xor edi, edi
call fcn.1800a411c
mov r14, rax
test rax, rax
jne 0x180025902
call fcn.1800a41dc
mov eax, dword [rax]
neg eax
jmp 0x180025a46
xorps xmm0, xmm0
mov qword [rsp + 0x118], rbp
mov rcx, rbx
movups xmmword [r13], xmm0
call fcn.180034490
mov rbx, rax
test rax, rax
jne 0x18002592e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
neg ebp
jmp 0x180025971
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
test eax, eax
jns 0x180025969
call qword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
mov ebp, eax
mov rcx, rbx
call fcn.1800a4108
test ebp, ebp
jns 0x180025984
mov rcx, r14
call fcn.1800a4108
mov eax, ebp
jmp 0x180025a3e
lea rcx, [rsp + 0x50]
mov qword [rsp + 0xc8], rsi
call fcn.1800260b0
xor esi, esi
test r15, r15
je 0x180025a16
mov qword [rsp + 0xc0], r12
mov r13d, 0x100000
movsxd r12, ebp
nop
mov ebx, r15d
mov qword [rsp + 0x20], 0
sub ebx, esi
lea r9, [rsp + 0x40]
cmp ebx, r13d
mov rdx, r14
mov rcx, r12
cmova ebx, r13d
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800259e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
neg edi
jmp 0x1800259ed
mov edi, dword [rsp + 0x40]
test edi, edi
jle 0x180025a09
mov r8, rbx
lea rcx, [rsp + 0x50]
mov rdx, r14
call fcn.180026940
add rsi, rbx
cmp rsi, r15
jb 0x1800259b0
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0xc0]
mov rcx, r14
call fcn.1800a4108
movsxd rcx, ebp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x50]
mov rcx, r13
call fcn.180025f60
mov rsi, qword [rsp + 0xc8]
mov eax, edi
mov rbp, qword [rsp + 0x118]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1800a1bf0
add rsp, 0xd0
pop r15
pop r14
pop r13
pop rdi
pop rbx
ret

Function at 0x180025b40
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
movsxd rcx, ecx
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180025b6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
add rsp, 0x38
ret
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret

Function at 0x180025d70
Capabilities:
Clear file content

Disassembly:
sub rsp, 0x28
movsxd rcx, ecx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x180025d8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x180025da0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rdi
push r14
sub rsp, 0x30
xor r14d, r14d
mov edi, r8d
mov rbp, rdx
mov ebx, r14d
test r8d, r8d
jle 0x180025e0e
mov qword [rsp + 0x50], rsi
movsxd rsi, ecx
nop word [rax + rax]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], r14
mov r8d, edi
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180025df5
add ebx, dword [rsp + 0x60]
cmp ebx, edi
jl 0x180025dd0
mov rsi, qword [rsp + 0x50]
test ebx, ebx
jle 0x180025e0e
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x58]
neg eax
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret

Function at 0x180025eb0
Capabilities:
Hash data using djb2

Disassembly:
push rdi
sub rsp, 0x20
mov r9, rcx
mov edi, 0x1505
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rcx + rdx], 0
jne 0x180025ec5
xor r8d, r8d
test rdx, rdx
je 0x180025f0f
movabs r10, 0xd400040400000000
movzx eax, byte [r8 + r9]
cmp al, 0x5c
jne 0x180025eed
mov al, 0x2f
jmp 0x180025efd
cmp al, 0x3f
ja 0x180025ef7
bt r10, rax
jb 0x180025efb
cmp al, 0x7c
jne 0x180025efd
mov al, 0x5f
imul rdi, rdi, 0x21
movzx ecx, al
inc r8
add rdi, rcx
cmp r8, rdx
jb 0x180025ee0
mov ecx, 1
call qword [sym.imp.WS2_32.dll_htonl]
cmp eax, 1
jne 0x180025f28
mov rax, rdi
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
mov qword [rsp + 0x30], rbx
shr rcx, 0x20
call qword [sym.imp.WS2_32.dll_htonl]
mov ecx, edi
mov ebx, eax
call qword [sym.imp.WS2_32.dll_htonl]
mov eax, eax
shl rax, 0x20
or rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180027e60
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
push rbp
push rsi
push r15
lea rbp, [r11 - 0xc38]
sub rsp, 0xd20
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rbp + 0xbe0], rax
mov rax, qword [rbp + 0xc68]
xor esi, esi
mov qword [r11 - 0x20], rbx
mov ebx, ecx
mov qword [r11 - 0x28], rdi
lea rcx, [rbp - 0x20]
mov rdi, qword [rbp + 0xc60]
mov qword [rbp - 0x80], rax
mov rax, qword [rbp + 0xc70]
mov qword [r11 - 0x38], r13
mov r13, rdx
mov qword [rbp - 0x78], rax
xor edx, edx
mov rax, qword [rbp + 0xc78]
mov qword [rsp + 0x70], r8
mov r8d, 0x400
mov qword [r11 - 0x40], r14
mov r14d, esi
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x5c], 0xff
mov dword [rsp + 0x58], 0xff
call fcn.1800a3140
xor edx, edx
lea rcx, [rbp + 0x3e0]
mov r8d, 0x400
call fcn.1800a3140
xor edx, edx
lea rcx, [rbp + 0x7e0]
mov r8d, 0x400
call fcn.1800a3140
mov r8d, ebx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x1800281c0
mov r8d, 0xff
mov qword [rsp + 0xd08], r12
lea rdx, [rbp + 0x7e0]
mov rcx, rax
call fcn.180027b30
lea rax, [rbp - 0x68]
mov rcx, r15
lea r9, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x58]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov eax, dword [rsp + 0x64]
xorps xmm0, xmm0
mov dword [rsp + 0x54], eax
movabs rcx, 0xfe624e212ac18000
mov eax, dword [rsp + 0x60]
mov ebx, esi
mov dword [rsp + 0x50], eax
movabs rax, 0xd6bf94d5e57a42bd
add rcx, qword [rsp + 0x50]
imul rcx
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
add rdx, rcx
mov dword [rsp + 0x50], esi
sar rdx, 0x17
lea rcx, str.kernel32.dll
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rdi], rdx
lea edi, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r12, rax
test rax, rax
jne 0x180027ff4
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18002809e
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rbp - 0x50]
mov r8d, 0x20
cmp eax, 0xe
ja case.default.0x18002801e
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x2826c]
add rcx, rdx
jmp rcx
mov ebx, 1
jmp case.default.0x18002801e
mov ebx, 4
jmp 0x180028072
mov ebx, 5
jmp 0x180028072
mov ebx, 3
jmp 0x180028072
mov ebx, 6
jmp 0x180028072
mov ebx, 2
jmp 0x180028072
mov ebx, 7
jmp case.default.0x18002801e
mov ebx, 5
jmp case.default.0x18002801e
mov ebx, 8
jmp 0x180028072
mov ebx, 9
jmp 0x180028072
mov ebx, 2
jmp case.default.0x18002801e
mov ebx, 7
mov edi, r8d
lea rdx, str.IsWow64Process
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18002809e
lea rdx, [rsp + 0x50]
mov rcx, r15
call rax
test eax, eax
mov eax, 0x20
cmovne edi, eax
test r13, r13
je 0x1800280a7
mov dword [r13], ebx
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x1800280b3
mov dword [rax], edi
test r12, r12
je 0x1800280c1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x48]
mov edx, 8
mov rcx, r15
Function at 0x180028340
Capabilities:
Acquire debug privileges
Create process on windows
Self delete

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov r12d, dword [rbp + 0x90]
xorps xmm0, xmm0
xor r13d, r13d
mov qword [rsp + 0x68], 0xffffffffffffffff
xor eax, eax
mov qword [rsp + 0x70], r13
mov rcx, rdx
mov qword [rbp - 0x70], rax
movups xmmword [rbp - 0x60], xmm0
mov r14d, r13d
mov esi, r13d
movups xmmword [rbp - 0x50], xmm0
mov r15d, r9d
mov ebx, r8d
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp - 0x80], xmm0
call fcn.180034490
mov rdi, rax
test rax, rax
jne 0x1800283cf
lea ebx, [rax - 0x16]
jmp 0x180028701
test ebx, ebx
js 0x18002846b
lea rcx, str.Wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test r15d, r15d
js 0x180028422
lea r8, [rsp + 0x78]
mov qword [rsp + 0x60], r13
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
mov ebx, r13d
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1800284e6
mov rax, qword [rsp + 0x78]
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x10], 1
mov dword [rbp + 0x1c], 2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1800284e6
mov rcx, qword [rsp + 0x60]
lea r8, [rbp + 0x10]
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1800284f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
neg ebx
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180028500
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
js 0x1800286eb
mov r8d, r15d
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x1800283e9
lea r8, [rsp + 0x68]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x180028422
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
neg ebx
call fcn.1800a4108
jmp 0x1800286f8
Function at 0x180028770
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
mov rbx, rdx
lea rcx, str.ROOTCIMV2
call qword [sym.imp.WS2_32.dll_bind]
lea rcx, [0x1800c42d0]
mov qword [rdi + 0x18], rax
call qword [sym.imp.WS2_32.dll_bind]
mov rcx, rbx
mov qword [rdi + 0x20], rax
call qword [sym.imp.WS2_32.dll_bind]
xor edx, edx
xor ecx, ecx
mov qword [rdi + 0x28], rax
call qword [sym.imp.ole32.dll_CoInitializeEx]
xor edx, edx
mov qword [rsp + 0x20], rdi
lea r9, [0x1800d3580]
lea rcx, [0x1800d3570]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18002888c
mov rcx, qword [rdi]
test rcx, rcx
je 0x18002888c
mov r10, qword [rcx]
test r10, r10
je 0x18002888c
mov rdx, qword [rdi + 0x18]
lea rbx, [rdi + 8]
mov qword [rsp + 0x40], rbx
xor r9d, r9d
mov qword [rsp + 0x60], rsi
xor r8d, r8d
xor esi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [r10 + 0x18]
test eax, eax
js 0x180028887
mov rcx, qword [rbx]
test rcx, rcx
je 0x180028887
mov dword [rsp + 0x38], esi
lea edx, [rsi + 0xa]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 3
xor r8d, r8d
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x180028887
mov rcx, qword [rbx]
lea rax, [rdi + 0x10]
mov r8, qword [rdi + 0x28]
xor r9d, r9d
mov rdx, qword [rdi + 0x20]
mov qword [rsp + 0x28], rax
mov r10, qword [rcx]
mov qword [rsp + 0x20], rsi
call qword [r10 + 0xa0]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x1800288a0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1800288b8
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800288c7
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800288d5
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1800288e4
call qword [sym.imp.WS2_32.dll_getsockname]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1800288f3
call qword [sym.imp.WS2_32.dll_getsockname]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x180028902
call qword [sym.imp.WS2_32.dll_getsockname]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
add rsp, 0x20
pop rbx
ret