joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003f90
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x180033990]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
mov rbx, rax
jne 0x180003fdb
mov rcx, qword [0x180033988]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
mov rbx, rax
jne 0x180003fdb
lea edx, [rax + 1]
lea r8, [0x180032d68]
lea rcx, [0x180032d50]
mov r9d, edx
call fcn.180029668
jmp 0x180004003
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x18003216c], eax
je 0x180003ffd
mov rdx, qword [0x180033998]
mov rcx, rbx
call fcn.180020874
jmp 0x180004003
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
pop rbx
ret

Function at 0x180004adc
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x60
and qword [r11 - 0x38], 0
xor eax, eax
mov rbp, rdx
mov r12d, r9d
mov edi, r8d
mov rsi, rcx
lea edx, [rax + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [rsp + 0x58], rax
je 0x180004bf0
mov rcx, qword [0x180033bb0]
and dword [rsp + 0x88], 0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
test r12d, r12d
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x88]
mov r8d, edi
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], rax
je 0x180004b6e
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x180004b74
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180004bbf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
mov ebx, eax
jne 0x180004bdd
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov r9d, 0x2710
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, rsi
cmp eax, 1
mov ebx, eax
jne 0x180004bd7
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x40]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [rsp + 0x88]
add rbp, rax
sub edi, dword [rsp + 0x88]
je 0x180004be1
jmp 0x180004b46
call qword [sym.imp.KERNEL32.dll_CancelIo]
test edi, edi
jne 0x180004be3
xor ebx, ebx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180004bf8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x180004eb8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, qword [0x180033ba0]
movzx r12d, word [0x180033bc8]
mov r13d, r9d
movsxd rcx, dword [r14 + 0x3c]
xor ebp, ebp
xor r12w, 0xd189
add rcx, r14
mov r15, r8
movzx eax, word [rcx + 6]
lea r9, [rax + rax*4]
movzx eax, word [rcx + 0x14]
add rcx, rax
lea rdi, [rcx + r9*8 + 0x40]
jmp 0x180004f1c
cmp ax, r12w
je 0x180004f2e
add rdi, 0x14
movzx eax, word [rdi]
test ax, ax
jne 0x180004f12
cmp ax, r12w
jne 0x18000500f
mov ebx, 1
test r13d, r13d
je 0x180004f3e
cmp dword [rdi + 8], r13d
jne 0x180004fa5
test byte [rdi + 3], 2
jne 0x180004fa5
mov r8d, dword [rdi + 0x10]
mov rcx, qword [0x1800339a8]
xor edx, edx
add r8d, ebx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rsi, rax
je 0x180004fa5
test byte [rdi + 3], bl
je 0x180004fb9
mov ecx, dword [rdi + 0xc]
mov ebx, dword [rdi + 0x10]
mov rdx, rax
add rcx, r14
call fcn.180008264
cmp eax, ebx
mov eax, 1
cmove ebp, eax
cmp ebx, 4
jb 0x180004f8c
mov eax, dword [rdi + 4]
xor dword [rsi], eax
test ebp, ebp
jne 0x180004ffa
mov rcx, qword [0x1800339a8]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea ebx, [rbp + 1]
movzx eax, byte [rdi + 2]
lea rdi, [rdi + rax*4 + 0x14]
cmp word [rdi], r12w
jne 0x18000500f
jmp 0x180004f33
mov edx, dword [rdi + 0xc]
mov r8d, dword [rdi + 0x10]
mov r9d, dword [rdi + 4]
add rdx, r14
shr r8d, 2
mov rcx, rax
je 0x180004fe8
mov eax, dword [rdx]
add rdx, 4
sub eax, r9d
mov dword [rcx], eax
add rcx, 4
add r9d, eax
add r8d, 0xffffffff
jne 0x180004fd0
mov eax, dword [rdi + 0x10]
and eax, 3
je 0x180004ff8
mov r8d, eax
call sub.ntdll.dll_memcpy
mov ebp, ebx
mov ecx, dword [rdi + 0x10]
mov rax, qword [rsp + 0x58]
mov byte [rcx + rsi], 0
mov ecx, dword [rdi + 0x10]
mov qword [rax], rsi
mov dword [r15], ecx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov eax, ebp
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180005030
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x1c0
xor esi, esi
test r9, r9
mov r12, r9
mov rbp, r8
mov r13, rdx
jne 0x180005063
lea edi, [rsi + 0x57]
jmp 0x1800051c7
lea rdx, [rsp + 0x20]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
mov edi, eax
jne 0x18000519c
mov rcx, qword [0x1800339a8]
mov edi, 0xa0
xor edx, edx
mov r8, rdi
lea esi, [rax + 1]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
jne 0x1800050a6
lea edi, [rsi + 7]
jmp 0x1800051b9
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
lea rcx, [rbx + 0x50]
mov r8d, 0x10
mov rdx, r13
call sub.ntdll.dll_memcpy
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
or qword [rbx + 0x60], 0xffffffffffffffff
xor r9d, r9d
xor r8d, r8d
mov edx, esi
xor ecx, ecx
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [rbx + 0x68], rax
je 0x1800051a9
test rbp, rbp
mov qword [rbx + 0x70], rbp
jne 0x18000511f
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
test rax, rax
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x70], rax
je 0x1800051a9
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrDupA]
mov r8d, 6
mov edx, esi
mov qword [rbx + 0x38], rax
lea rax, [fcn.180018a08]
lea ecx, [r8 - 4]
mov qword [rbx + 0x40], rax
lea rax, [0x180018f50]
mov qword [rbx + 0x48], rax
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
mov qword [rbx + 0x60], rax
je 0x1800051a9
lock add dword [0x180033b70], esi
lea r8, [rbx + 0x88]
lea rcx, [0x180004c7c]
mov rdx, rbx
call fcn.1800191d8
test rax, rax
mov qword [rbx + 0x80], rax
jne 0x180005191
lock add dword [0x180033b70], 0xffffffff
jmp 0x1800051a9
mov qword [0x1800339b8], rbx
xor edi, edi
jmp 0x1800051a4
mov rbx, qword [rsp + 0x1f8]
cmp edi, 0xffffffff
jne 0x1800051b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x1800051c7
test esi, esi
je 0x1800051c7
mov rcx, rbx
call fcn.180029b44
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea r11, [rsp + 0x1c0]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1800052e0
Capabilities:
Get explorer pid

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edx, dword [0x180033b9c]
lea rcx, [0x180033d38]
call fcn.180003c50
test eax, eax
jne 0x180005393
call fcn.1800199d4
lea rcx, [0x180033d38]
mov edi, eax
xor edi, 0x81bbe65d
mov edx, edi
call fcn.180003c50
test eax, eax
je 0x180005410
mov ebx, dword [0x180033d48]
test ebx, ebx
je 0x18000535d
mov rcx, qword [0x180033d38]
xor r9d, r9d
mov r8d, edi
mov edx, ebx
call fcn.180015e14
mov r8d, dword [0x180033b9c]
mov rcx, qword [0x180033d38]
xor r9d, r9d
mov edx, ebx
call fcn.180015164
mov ebx, dword [0x180033d4c]
test ebx, ebx
je 0x180005393
mov rcx, qword [0x180033d40]
xor r9d, r9d
mov r8d, edi
mov edx, ebx
call fcn.180015e14
mov r8d, dword [0x180033b9c]
mov rcx, qword [0x180033d40]
xor r9d, r9d
mov edx, ebx
call fcn.180015164
mov r8, qword [0x180033b48]
xor edx, edx
lea ebx, [rdx + 2]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_OpenEventA]
test rax, rax
mov rdi, rax
je 0x1800053d5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.USER32.dll_GetShellWindow]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x30]
test r8d, r8d
je 0x180005403
lea rcx, [0x180033d38]
xor edx, edx
call fcn.180014b24
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ebx, dword [rsp + 0x30]
jmp 0x180005403
Function at 0x1800054a4
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
lea rcx, [rsp + 0x78]
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rsp + 0x78]
xor edx, edx
movabs rcx, 0x19254d38000
div rcx
mov rcx, qword [0x180033bd0]
lea rdx, [0x180000000]
lea r9, [rcx + rdx + 0x364dd]
lea r8, [rcx + rdx + 0x37e28]
lea edx, [rsi + 0x16]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll__snwprintf]
lea r11, [rsp + 0x30]
lea r8d, [rsi + 4]
mov qword [rsp + 0x28], r11
lea rdx, [0x180033bd8]
xor r9d, r9d
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test rax, rax
mov rdi, rax
je 0x180005585
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180005571
and qword [rsp + 0x20], rsi
lea edx, [rsi + 6]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
mov rbx, rax
jne 0x18000559b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x180005576
mov ebx, 2
test ebx, ebx
je 0x180005591
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000558d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x1800055c1
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x70]
mov eax, dword [rbx]
test al, 1
je 0x1800055af
lea rcx, [rbx + 4]
xor edx, edx
call fcn.18000715c
mov rsi, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x180033b9c]
lea rdi, [0x180033e60]
xor ebx, ebx
mov dword [rsp + 0x70], ecx
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.180029ae4
test eax, eax
je 0x18000561a
add ebx, 1
add rdi, 8
cmp ebx, 3
jb 0x1800055d4
mov rcx, qword [0x180033e70]
cmp word [rcx], 0x61
jb 0x18000560c
cmp word [rcx], 0x7a
ja 0x18000560c
movzx eax, word [rcx]
sub eax, 0x20
jmp 0x18000560f
movzx eax, word [rcx]
mov word [rcx], ax
mov rcx, rsi
call fcn.180009ce8
mov rcx, qword [0x180033a98]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test byte [0x18003212c], 1
jne 0x180005667
lock add dword [0x180033b70], 1
lea rcx, [0x1800298ec]
xor r8d, r8d
xor edx, edx
call fcn.1800191d8
test rax, rax
jne 0x18000565e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lock add dword [0x180033b70], 0xffffffff
jmp 0x180005667
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180005df4
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r15
sub rsp, 0x90
xor edx, edx
mov r13d, ecx
mov rcx, qword [0x1800339a8]
mov r12, r8
lea r8d, [rdx + 0x38]
mov rbp, r9
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x180006007
mov rdx, qword [0x180033bd0]
lea r15, [0x180000000]
lea rcx, [rdx + r15 + 0x3691e]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [0x180033bd0]
mov edi, 0x7f
lea rdx, [rcx + r15 + 0x38078]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x10], rax
je 0x180005ff3
mov rax, qword [0x180033bd0]
mov rcx, rsi
lea rdx, [rax + r15 + 0x37b44]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x18], rax
je 0x180005ff3
mov rax, qword [0x180033bd0]
mov rcx, rsi
lea rdx, [rax + r15 + 0x37dfa]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x20], rax
je 0x180005ff3
mov rax, qword [0x180033bd0]
mov rcx, rsi
lea rdx, [rax + r15 + 0x37e92]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x28], rax
je 0x180005ff3
mov rax, qword [0x180033bd0]
mov rcx, rsi
lea rdx, [rax + r15 + 0x38088]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x30], rax
je 0x180005ff3
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
mov edi, 0x40
lea r8d, [rdi - 0x18]
lea rcx, [rsp + 0x60]
xor edx, edx
mov dword [rbx + 0xc], edi
mov dword [rbx + 8], r13d
call sub.ntdll.dll_memset
xor r11d, r11d
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x58]
and qword [rsp + 0x30], r11
and qword [rsp + 0x60], r11
and qword [rsp + 0x68], r11
and qword [rsp + 0x78], r11
and qword [rsp + 0x80], r11
lea rcx, [rsp + 0x50]
mov edx, 0xf001f
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x44], r11d
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x58], 0x30
mov dword [rsp + 0x70], edi
call qword [rbx + 0x10]
test eax, eax
js 0x180005fe2
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x48]
or rdx, 0xffffffffffffffff
mov rcx, rbx
mov qword [rbx], rax
call fcn.180024064
test eax, eax
mov edi, eax
jne 0x180005fd8
mov r8d, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call sub.ntdll.dll_memset
mov r11, qword [rsp + 0x48]
mov qword [r12], r11
jmp 0x180005fe9
mov rcx, qword [rsp + 0x50]
call qword [rbx + 0x30]
jmp 0x180005fe9
mov ecx, eax
call qword [rbx + 0x28]
mov edi, eax
test edi, edi
jne 0x180005ff3
mov qword [rbp], rbx
jmp 0x18000600c
mov rcx, qword [0x1800339a8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18000600c
mov edi, 8
lea r11, [rsp + 0x90]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop r12
ret
Function at 0x180006030
Capabilities:
Get hostname
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x40
lea rdx, [rax + 8]
xor ebx, ebx
xor ecx, ecx
mov dword [rax + 8], ebx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov r11d, dword [rsp + 0x50]
cmp r11d, ebx
je 0x180006154
lea rdx, [rsp + 0x50]
xor ecx, ecx
mov dword [rsp + 0x58], r11d
mov dword [rsp + 0x50], ebx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov r11d, dword [rsp + 0x50]
cmp r11d, ebx
je 0x180006154
mov eax, dword [rsp + 0x58]
mov rcx, qword [0x1800339a8]
xor edx, edx
lea eax, [rax + r11 + 2]
mov dword [rsp + 0x58], eax
shl eax, 2
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, rbx
mov rdi, rax
je 0x180006154
mov ecx, dword [rsp + 0x58]
lea rdx, [rsp + 0x50]
lea esi, [rcx + rcx]
mov dword [rsp + 0x50], ecx
add rsi, rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp eax, ebx
je 0x180006142
mov eax, dword [rsp + 0x50]
lea rdx, [rsp + 0x58]
add eax, 0xffffffff
mov word [rsi + rax*2], 0x40
mov eax, dword [rsp + 0x50]
sub dword [rsp + 0x58], eax
lea rcx, [rsi + rax*2]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp eax, ebx
je 0x180006142
mov r9d, dword [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
add r9d, dword [rsp + 0x50]
mov r8, rsi
xor edx, edx
lea eax, [r9 + r9 + 2]
mov ecx, 0xfde9
mov dword [rsp + 0x58], r9d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, ebx
mov dword [rsp + 0x50], eax
je 0x180006142
mov eax, eax
mov byte [rax + rdi], bl
mov rbx, rdi
jmp 0x180006154
mov rcx, qword [0x1800339a8]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180006628
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov ebp, edx
mov rbx, rcx
xor edi, edi
call fcn.180016b98
cmp eax, 0x102
je 0x1800066ba
and qword [rsp + 0x30], rdi
lea r8d, [rdi + 3]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x180006697
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000669d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
je 0x1800066b8
mov rcx, rbx
call fcn.180013878
mov r8d, ebp
mov rdx, rbx
xor ecx, ecx
call fcn.180013980
jmp 0x1800066ba
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180007288
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor r8d, r8d
xor edx, edx
mov rsi, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
mov edi, eax
je 0x1800072ee
mov rcx, qword [0x1800339a8]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x1800072ee
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x1800072ee
mov rcx, qword [0x1800339a8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180007304
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
mov rcx, qword [0x1800339a8]
mov rbp, rdx
xor edx, edx
mov r8d, 0x208
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
xor eax, eax
cmp rbx, rax
mov qword [rsp + 0x78], rax
jne 0x180007344
mov eax, 8
jmp 0x18000742c
mov esi, eax
xor edx, edx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
mov r8, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x1800073b9
test eax, eax
jne 0x1800073a5
lea rcx, [0x180037990]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [0x180037990]
mov rcx, rbx
lea r8d, [rax + 1]
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x1800073ae
add esi, 1
xor eax, eax
mov edx, esi
jmp 0x180007348
mov rdx, rbp
mov rcx, rdi
call fcn.1800240f8
xor esi, esi
xor edx, edx
jmp 0x1800073ff
lea rax, [rsp + 0x78]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800073ef
mov rcx, qword [rsp + 0x78]
mov rdx, rbp
call fcn.180007304
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 1
mov edx, esi
mov r9d, 0x104
mov r8, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x1800073bf
mov rcx, qword [0x1800339a8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800074b4
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
xor eax, eax
mov r12, rdx
mov r13, rcx
xor esi, esi
lea rdx, [0x180036bd0]
lea rcx, [r11 - 0x38]
and word [rsp + 0x30], si
mov qword [r11 - 0x36], rax
mov qword [r11 - 0x2e], rax
mov qword [r11 - 0x26], rax
mov dword [rsp + 0x4a], eax
mov word [rsp + 0x4e], ax
call qword [sym.imp.ntdll.dll_wcscpy]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov rcx, qword [0x1800339a8]
xor edx, edx
lea ebx, [rax + 2]
mov ebp, eax
add rbx, rbx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rdi, rax
je 0x1800075e7
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
mov rdx, rdi
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [rdi], si
mov rbx, rdi
je 0x1800075d5
mov rcx, qword [0x180033bb0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1800075d5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x1800075bc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r11d, eax
add r11, 4
cmp r11, 0x10
jae 0x1800075bc
lea rcx, [rsp + 0x38]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_wcscpy]
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
xor r9d, r9d
mov r8, r12
mov rdx, r13
call fcn.18001537c
add esi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
cmp word [rbx], 0
jne 0x180007555
mov rcx, qword [0x1800339a8]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r11, [rsp + 0x50]
mov eax, esi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x180007874
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
and dword [rsp + 0x68], 0
mov r14, rcx
mov rcx, qword [0x1800339a8]
mov r12, r8
mov r13, rdx
mov esi, 0x1000
xor edx, edx
mov r8, rsi
mov edi, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x180007949
lea r9, [rsp + 0x68]
mov r8d, esi
mov rdx, rbx
mov rcx, r14
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
mov ebp, eax
je 0x180007913
mov eax, dword [rsp + 0x68]
cmp esi, eax
ja 0x180007917
mov rcx, qword [0x1800339a8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x1800339a8]
add esi, 0x1000
mov r8d, esi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
jne 0x1800078c0
mov eax, dword [rsp + 0x68]
test rbx, rbx
je 0x180007949
test ebp, ebp
je 0x18000792f
shr eax, 3
mov qword [r13], rbx
xor edi, edi
mov dword [r12], eax
jmp 0x180007949
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1800339a8]
mov r8, rbx
xor edx, edx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov eax, edi
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x1800081e4
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
lea r8, [rsp + 0x30]
xor edx, edx
and dword [rsp + 0x30], ebx
lea ecx, [rbx + 3]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x180008258
mov rcx, qword [0x1800339a8]
lea r8d, [rax + 1]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x180008258
lea r8, [rsp + 0x30]
mov rdx, rax
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
test eax, eax
jne 0x180008250
mov rcx, qword [0x1800339a8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
jmp 0x180008258
mov eax, dword [rsp + 0x30]
mov byte [rax + rbx], 0
mov rax, rbx
add rsp, 0x20
pop rbx
ret