joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400314b0
Capabilities:
Reference wmi statements

Disassembly:
push rbp
push rbx
push rdi
push r12
mov rbp, rsp
sub rsp, 0x68
xor r12d, r12d
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x38]
mov qword [rbp + 0x38], r12
mov qword [rbp - 0x38], r12
mov edi, r12d
mov qword [rbp + 0x30], r12
mov ebx, r12d
call fcn.140032810
test eax, eax
je 0x140031698
mov qword [rsp + 0x60], rsi
lea rcx, [0x1400c60a8]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_LogicalDisk
mov r14, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea r15d, [r12 + 1]
mov rsi, rax
test r14, r14
je 0x140031576
test rax, rax
je 0x14003156d
mov rcx, qword [rbp + 0x38]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea r9d, [r12 + 0x30]
mov r8, rsi
mov qword [rsp + 0x20], r12
mov rdx, r14
mov r10, qword [rcx]
call qword [r10 + 0xa0]
test eax, eax
jns 0x14003156d
mov rcx, qword [rbp + 0x38]
mov r15d, r12d
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov r14, qword [rsp + 0x58]
test rsi, rsi
je 0x140031589
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test r15d, r15d
mov r15, qword [rsp + 0x50]
je 0x140031686
mov rcx, qword [rbp + 0x30]
mov qword [rbp + 0x40], r12
mov dword [rbp + 0x28], r12d
test rcx, rcx
je 0x140031666
nop dword [rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x28]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x40]
or edx, 0xffffffff
mov r8d, 1
call qword [rax + 0x20]
cmp dword [rbp + 0x28], r12d
je 0x140031662
mov rcx, qword [rbp + 0x40]
lea r9, [rbp - 0x30]
mov qword [rsp + 0x28], r12
lea rdx, str.Size
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x140031645
cmp word [rbp - 0x30], 1
je 0x140031645
call fcn.1400796e4
mov dword [rax], r12d
call fcn.140082e10
mov rcx, qword [rbp - 0x28]
xor edx, edx
mov r9, rax
lea r8d, [rdx + 0xa]
call fcn.140083780
mov rsi, rax
call fcn.1400796e4
cmp dword [rax], r12d
jne 0x14003163b
mov rbx, rsi
mov edi, 1
shr rbx, 0x1e
lea rcx, [rbp - 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test edi, edi
jne 0x140031662
mov rcx, qword [rbp + 0x30]
test rcx, rcx
jne 0x1400315b0
jmp 0x140031666
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rax, rbx
mov rsi, qword [rsp + 0x60]
add rsp, 0x68
pop r12
pop rdi
pop rbx
pop rbp
ret
mov rax, rbx
add rsp, 0x68
pop r12
pop rdi
pop rbx
pop rbp
ret
Function at 0x1400316b0
Capabilities:
Reference wmi statements

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x68
xor ebx, ebx
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x28]
mov qword [rbp + 0x28], rbx
mov qword [rbp - 0x38], rbx
mov qword [rbp + 0x30], rbx
call fcn.140032810
test eax, eax
je 0x1400318a4
mov qword [rsp + 0x60], rsi
lea rcx, [0x1400c60a8]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_ComputerSystem
mov rsi, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea r14d, [rbx + 1]
mov rdi, rax
test rsi, rsi
je 0x14003176a
test rax, rax
je 0x140031761
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea r9d, [rbx + 0x30]
mov r8, rdi
mov qword [rsp + 0x20], rbx
mov rdx, rsi
mov r10, qword [rcx]
call qword [r10 + 0xa0]
test eax, eax
jns 0x140031761
mov rcx, qword [rbp + 0x28]
mov r14d, ebx
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rsi, qword [rsp + 0x60]
test rdi, rdi
je 0x14003177d
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rdi, qword [rsp + 0x58]
test r14d, r14d
mov r14, qword [rsp + 0x50]
je 0x1400318a4
mov rcx, qword [rbp + 0x30]
mov qword [rbp + 0x20], rbx
mov dword [rbp + 0x18], ebx
test rcx, rcx
je 0x140031880
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x18]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x20]
or edx, 0xffffffff
mov r8d, 1
call qword [rax + 0x20]
cmp dword [rbp + 0x18], ebx
je 0x140031880
mov rcx, qword [rbp + 0x20]
lea r9, [rbp - 0x30]
mov qword [rsp + 0x28], rbx
lea rdx, str.Model
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x14003184e
cmp word [rbp - 0x30], 8
jne 0x140031844
mov rcx, qword [rbp - 0x28]
lea rdx, str.VirtualBox
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140031867
mov rcx, qword [rbp - 0x28]
lea rdx, str.HVM_domU
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140031867
mov rcx, qword [rbp - 0x28]
lea rdx, str.VMWare
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140031867
lea rcx, [rbp - 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x20]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x30]
test rcx, rcx
jne 0x1400317b0
jmp 0x140031880
lea rcx, [rbp - 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x20]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov ebx, 1
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
ret
Function at 0x1400318b0
Capabilities:
Reference wmi statements

Disassembly:
mov rax, rsp
push rbx
push rdi
sub rsp, 0x58
xor ebx, ebx
lea rdx, [rax + 0x20]
lea rcx, [rax + 0x10]
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbx
mov edi, ebx
mov qword [rax + 0x18], rbx
call fcn.140032810
test eax, eax
je 0x140031a1c
mov qword [rsp + 0x50], rbp
lea rcx, [0x1400c60a8]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_Fan
mov rbp, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea r14d, [rbx + 1]
mov rsi, rax
test rbp, rbp
je 0x140031975
test rax, rax
je 0x14003196c
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea r9d, [rbx + 0x30]
mov r8, rsi
mov qword [rsp + 0x20], rbx
mov rdx, rbp
mov r10, qword [rcx]
call qword [r10 + 0xa0]
test eax, eax
jns 0x14003196c
mov rcx, qword [rsp + 0x78]
mov r14d, ebx
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, rbp
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rbp, qword [rsp + 0x50]
test rsi, rsi
je 0x140031988
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rsi, qword [rsp + 0x48]
test r14d, r14d
mov r14, qword [rsp + 0x40]
je 0x140031a1c
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x70], ebx
test rcx, rcx
je 0x1400319ef
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x30]
or edx, 0xffffffff
mov r8d, 1
call qword [rax + 0x20]
cmp dword [rsp + 0x70], ebx
je 0x1400319ef
mov rcx, qword [rsp + 0x30]
inc edi
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x80]
test rcx, rcx
jne 0x1400319b1
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
test edi, edi
sete bl
mov eax, ebx
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x140031a30
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x1400f2120]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor edi, edi
lea rax, str.SystemCurrentControlSetEnumIDE
mov qword [rbp - 0x21], rax
lea rbx, [rbp - 0x21]
lea rax, str.SystemCurrentControlSetEnumSCSI
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x19], rax
mov r15d, edi
lea rax, str.qemu
mov qword [rbp - 0x31], rbx
mov qword [rbp - 0x11], rax
mov r13d, edi
lea rax, str.virtio
mov qword [rbp - 9], rax
lea rax, str.vmware
mov qword [rbp - 1], rax
lea rax, str.vbox
mov qword [rbp + 7], rax
lea rax, [0x1400c5d28]
mov qword [rbp + 0xf], rax
lea rax, [0x1400c5d20]
mov qword [rbp + 0x17], rax
lea rax, str.Virtual
mov qword [rbp + 0x1f], rax
nop dword [rax]
mov rdx, qword [rbx]
lea rax, [rbp - 0x41]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp - 0x49], edi
mov rcx, 0xffffffff80000002
mov dword [rbp - 0x39], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140031c2f
mov rcx, qword [rbp - 0x41]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x58], rdi
xor r9d, r9d
mov qword [rsp + 0x50], rdi
xor r8d, r8d
mov qword [rsp + 0x48], rdi
xor edx, edx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x140031b65
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140031c2f
mov eax, dword [rbp - 0x39]
lea r12d, [rax*2 + 2]
mov ecx, r12d
call fcn.14007970c
mov r14, rax
test rax, rax
jne 0x140031b8f
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140031c2f
cmp dword [rbp - 0x49], 0
mov esi, edi
jbe 0x140031c16
nop word [rax + rax]
mov rcx, qword [rbp - 0x41]
lea r9, [rbp - 0x29]
mov qword [rsp + 0x38], rdi
mov r8, r14
mov qword [rsp + 0x30], rdi
mov edx, esi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov dword [rbp - 0x29], r12d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140031c03
mov ebx, edi
lea rdi, [rbp - 0x11]
nop word [rax + rax]
mov rdx, qword [rdi]
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140031c0c
inc ebx
add rdi, 8
cmp ebx, 7
jb 0x140031be0
test r15d, r15d
jne 0x140031c12
xor edi, edi
inc esi
cmp esi, dword [rbp - 0x49]
jb 0x140031ba0
jmp 0x140031c12
mov r15d, 1
mov rbx, qword [rbp - 0x31]
mov rcx, r14
call fcn.140079704
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15d, r15d
jne 0x140031c44
xor edi, edi
add rbx, 8
inc r13d
mov qword [rbp - 0x31], rbx
cmp r13d, 2
jb 0x140031ae0
mov eax, r15d
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140057d50
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140031c80
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x1400f2120]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x20], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
xor edi, edi
mov qword [r11 - 0x40], rdi
lea r8, [r11 - 0x58]
lea rcx, [r11 - 0x50]
call fcn.140031da0
nop
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
sub rcx, rbx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rdi
mov word [rsp + 0x48], di
cmp word [rbx], di
jne 0x140031cf8
mov r8d, edi
jmp 0x140031d0b
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140031d00
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140008660
xor bl, bl
cmp qword [rsp + 0x58], 0
je 0x140031d41
mov r9d, 7
lea rcx, [rsp + 0x48]
call fcn.140008560
movzx ebx, bl
mov ecx, 1
cmp rax, 0xffffffffffffffff
cmovne ebx, ecx
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x140031d5e
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.140008d60
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rdi
mov word [rsp + 0x48], di
lea rcx, [rsp + 0x28]
call fcn.14000c670
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140057d50
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140032130
Capabilities:
Enumerate services

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
push r13
push r14
push r15
sub rsp, 0x68
mov r13, rcx
mov r14, r9
mov ecx, 0xe000
mov r15, r8
call fcn.14007970c
xor edx, edx
mov rbx, rax
test r14, r14
je 0x14003215f
mov dword [r14], edx
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
test rbx, rbx
je 0x140032286
mov qword [rsp + 0x48], rdx
xor eax, eax
mov r9d, 3
mov dword [rsp + 0x98], edx
mov rdi, rbx
mov dword [rsp + 0xa8], edx
mov ecx, 0xe000
rep stosb byte [rdi], al
lea rax, [rsp + 0xa8]
mov rcx, r13
mov qword [rsp + 0x40], rax
lea r8d, [r9 + 8]
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x98]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xe000
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
je 0x1400321ee
mov qword [r15], rbx
mov eax, 1
jmp 0x140032288
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140032270
mov ebp, dword [rsp + 0x98]
mov rcx, rbx
add ebp, 0xe000
mov edx, ebp
mov r12d, ebp
call fcn.1400792c0
mov rsi, rax
test rax, rax
je 0x14003227e
mov rbx, rax
mov rdi, rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x48], rax
mov ecx, r12d
mov qword [rsp + 0x40], rax
rep stosb byte [rdi], al
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x98]
mov qword [rsp + 0x30], rax
lea r9d, [rdx + 3]
mov dword [rsp + 0x28], ebp
lea r8d, [rdx + 0xb]
mov rcx, r13
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
je 0x14003227e
mov qword [r15], rbx
mov eax, 1
jmp 0x140032288
mov edx, eax
lea rcx, str.ERROR:__u_n
call fcn.140031ed0
mov rcx, rbx
call fcn.140079704
xor eax, eax
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x90]
add rsp, 0x68
pop r15
pop r14
pop r13
pop rbx
ret

Function at 0x1400323e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x1400f2120]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rsi, r8
mov qword [rsp + 0x30], 0
mov rbx, rdx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x800
mov rdi, r9
call fcn.1400773b0
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0x104
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400324ac
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400324a1
mov rdx, rdi
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x1400324a1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1400324ae
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140057d50
add rsp, 0x850
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400324d0
Capabilities:
Get mac address on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov dword [rsp + 0x38], 0x2c0
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x2c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x14003251d
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x140032572
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x14003250b
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1400325ba
movzx eax, byte [rdi]
movzx ecx, byte [rdi + 4]
mov byte [rsp + 0x40], al
movzx eax, byte [rdi + 2]
mov byte [rsp + 0x41], al
mov rax, rbx
movzx edx, word [rsp + 0x40]
cmp dword [rax + 0x194], 6
jne 0x1400325ab
cmp dx, word [rax + 0x198]
jne 0x1400325ab
cmp cl, byte [rax + 0x19a]
je 0x1400325b5
mov rax, qword [rax]
test rax, rax
jne 0x140032591
jmp 0x1400325ba
mov esi, 1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140032730
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1400f2120]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
lea rdi, [rsp + 0x20]
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
lea ecx, [rax + 2]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400327ed
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400327e4
mov rdx, rbx
lea rcx, [rsp + 0x4c]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov rcx, rdi
test eax, eax
jne 0x1400327af
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x1400327ef
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1400327e4
nop
mov rdx, rbx
lea rcx, [rsp + 0x4c]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov rcx, rdi
test eax, eax
je 0x1400327a3
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400327c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140057d50
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x140032810
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rdi, rdx
mov rsi, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x40], rbp
xor r8d, r8d
mov dword [rsp + 0x38], ebp
or edx, 0xffffffff
mov qword [rsp + 0x30], rbp
xor ecx, ecx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
lea r9, [0x1400c5fe8]
mov qword [rsp + 0x20], rdi
xor edx, edx
lea r8d, [rbp + 1]
lea rcx, [0x1400a7250]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x140032897
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea rcx, str.ROOTCIMV2
mov qword [rsp + 0x60], rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
test rax, rax
je 0x1400328f5
mov rcx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x40], rsi
xor r8d, r8d
mov qword [rsp + 0x38], rbp
mov rdx, rax
mov qword [rsp + 0x30], rbp
mov r10, qword [rcx]
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rbp
call qword [r10 + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, rbx
test eax, eax
jns 0x1400328ef
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x14003292e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsi]
xor r9d, r9d
mov dword [rsp + 0x38], ebp
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 3
lea edx, [r9 + 0xa]
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x140032941
mov rcx, qword [rsi]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x140032946
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140033140
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx]
mov rbx, rcx
test eax, eax
jne 0x14003318a
mov qword [rsp + 0x30], rdi
call fcn.140039e64
mov rdi, rax
call fcn.140039e48
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
mov rdi, qword [rsp + 0x30]
imul rdx, rcx, 0x3b9aca00
add rdx, rax
xor qword [rbx + 8], rdx
jmp 0x1400331a1
cmp eax, 1
jne 0x1400331a1
imul rax, qword [rcx + 8], 0x19660d
add rax, 0x3c6ef35f
mov qword [rcx + 8], rax
mov rdx, qword [rbx + 8]
mov r8d, 0x20
mov r9d, 0xf5000000
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r9
xor rcx, rdx
movzx eax, cl
and al, 1
neg al
sbb rdx, rdx
shr rcx, 1
and rdx, r9
xor rdx, rcx
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r9
xor rcx, rdx
movzx eax, cl
and al, 1
neg al
sbb rdx, rdx
shr rcx, 1
and rdx, r9
xor rdx, rcx
add r8d, 0xfffffffc
jne 0x1400331b1
mov qword [rbx + 8], rdx
cmp dword [rbx], r8d
jne 0x140033228
mov ecx, edx
call fcn.140079740
call fcn.140079714
movsxd rcx, eax
mov qword [rbx + 8], rcx
mov rax, rcx
add rsp, 0x20
pop rbx
ret
mov rax, rdx
add rsp, 0x20
pop rbx
ret
Function at 0x1400589c0
Capabilities:
Initialize winsock library

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x230
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400f2120]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov dword [rcx], 0x6f00
lea rbx, [rcx + 8]
mov qword [rbx + 0x18], SafeArrayLock
xor esi, esi
mov qword [rbx + 0x10], rsi
cmp qword [rbx + 0x18], 0x10
jb 0x140058a1a
mov rax, qword [rbx]
jmp 0x140058a1d
mov rax, rbx
mov byte [rax], sil
mov r8d, 7
lea rdx, str.Success
mov rcx, rbx
call fcn.140006800
nop
mov byte [rdi + 0x28], 0
mov qword [rdi + 0x30], rsi
mov qword [rdi + 0x38], rsi
xor edx, edx
mov r8d, 0x198
lea rcx, [rsp + 0x80]
call fcn.1400773b0
mov ecx, 0x202
lea rdx, [rsp + 0x80]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x20], eax
test eax, eax
je 0x140058b7d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.140058840
nop
mov r8, rax
lea rdx, str._Connector::NewConnect__Init_Winsock_Dll_failed_:_wsaerror
lea rcx, [rsp + 0x38]
call fcn.14000cee0
nop
mov dword [rdi], 0x6f01
cmp rbx, rax
je 0x140058ab9
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call fcn.140006930
nop
mov rax, qword [rsp + 0x50]
cmp rax, 0x10
jb 0x140058b11
inc rax
mov rcx, qword [rsp + 0x38]
cmp rax, 0x1000
jb 0x140058b0c
test cl, 0x1f
je 0x140058adf
call fcn.140078f8c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140058aee
call fcn.140078f8c
int3
sub rcx, rax
cmp rcx, 8
jae 0x140058afd
call fcn.140078f8c
int3
cmp rcx, 0x27
jbe 0x140058b09
call fcn.140078f8c
int3
mov rcx, rax
call fcn.14002a780
mov qword [rsp + 0x50], SafeArrayLock
mov qword [rsp + 0x48], rsi
mov byte [rsp + 0x38], 0
mov rax, qword [rsp + 0x70]
cmp rax, 0x10
jb 0x140058b7d
inc rax
mov rcx, qword [rsp + 0x58]
cmp rax, 0x1000
jb 0x140058b77
test cl, 0x1f
je 0x140058b4a
call fcn.140078f8c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140058b59
call fcn.140078f8c
int3
sub rcx, rax
cmp rcx, 8
jae 0x140058b68
call fcn.140078f8c
int3
cmp rcx, 0x27
jbe 0x140058b74
call fcn.140078f8c
int3
mov rcx, rax
call fcn.14002a780
nop
mov rax, rdi
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.140057d50
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret