joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400013c0
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rcx, qword [rsp + 0x60]
call fcn.140001294
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400013e7
xor al, al
jmp 0x1400014c0
mov byte [rsp + 0x20], 0
mov rcx, qword [rsp + 0x28]
call fcn.140001668
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140001408
jmp 0x1400014a6
mov rcx, qword [rsp + 0x28]
call fcn.1400014c8
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140001424
jmp 0x1400014a6
mov rcx, qword [rsp + 0x28]
call fcn.140001868
mov rcx, qword [rsp + 0x28]
call sub.ntoskrnl.exe_RtlImageNtHeader
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x28]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x48]
call qword [0x1400030b8]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jge 0x14000148a
mov byte [rsp + 0x20], 0
jmp 0x1400014a6
mov r8d, 0x1000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call fcn.1400023c0
xor eax, eax
test eax, eax
jne 0x1400013ec
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400014bc
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, byte [rsp + 0x20]
add rsp, 0x58
ret
Function at 0x1400014c8
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x80], 0
jne 0x1400014e3
xor al, al
jmp 0x140001663
mov rcx, qword [rsp + 0x80]
call sub.ntoskrnl.exe_RtlImageNtHeader
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140001504
xor al, al
jmp 0x140001663
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax + 0x88]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
jmp 0x14000154e
mov rax, qword [rsp + 0x28]
add rax, 0x14
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0xc], 0
je 0x14000165f
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.140001ba4
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x14000159b
mov byte [rsp + 0x20], 0
jmp 0x14000165f
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x10]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
jmp 0x1400015ee
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
add rax, 8
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x14000164f
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
add rax, 2
mov rdx, rax
mov rcx, qword [rsp + 0x48]
call fcn.140001108
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140001646
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
jmp 0x14000164d
mov byte [rsp + 0x20], 0
jmp 0x14000164f
jmp 0x1400015d2
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14000165a
jmp 0x14000165f
jmp 0x140001540
mov al, byte [rsp + 0x20]
add rsp, 0x78
ret
Function at 0x140001668
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rcx, qword [rsp + 0x80]
call sub.ntoskrnl.exe_RtlImageNtHeader
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140001692
xor al, al
jmp 0x140001862
mov eax, 8
imul rax, rax, 5
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 0x88]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax + 4], 0
je 0x140001860
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0
je 0x140001860
mov rax, qword [rsp + 0x28]
add rax, 8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 4]
sub rax, 8
xor edx, edx
mov ecx, 2
div rcx
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x20], 0
jmp 0x140001720
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x20], eax
jae 0x140001843
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
movzx eax, word [rcx + rax*2]
shr ax, 0xc
and ax, 0xf
movzx eax, ax
cmp eax, 0xa
jne 0x1400017bc
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 0x20]
mov edx, 0xfff
mov r8, qword [rsp + 0x30]
movzx ecx, word [r8 + rcx*2]
and cx, dx
movzx ecx, cx
add rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x30]
mov rax, qword [rax]
sub rax, rcx
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x60]
mov qword [rax], rcx
jmp 0x14000183e
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
movzx eax, word [rcx + rax*2]
shr ax, 0xc
and ax, 0xf
movzx eax, ax
cmp eax, 3
jne 0x14000183e
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 0x20]
mov edx, 0xfff
mov r8, qword [rsp + 0x30]
movzx ecx, word [r8 + rcx*2]
and cx, dx
movzx ecx, cx
add rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x38]
sub rax, qword [rcx + 0x30]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x44]
mov dword [rax], ecx
jmp 0x140001716
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 4]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
jmp 0x1400016c7
mov al, 1
add rsp, 0x78
ret
Function at 0x140001868
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x50], 0
jne 0x14000187d
xor eax, eax
jmp 0x1400018e6
mov rcx, qword [rsp + 0x50]
call sub.ntoskrnl.exe_RtlImageNtHeader
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140001898
xor eax, eax
jmp 0x1400018e6
mov eax, 8
imul rax, rax, 0xa
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + rax + 0x88]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x58]
mov rax, qword [rax]
add rax, 0xa
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x58]
mov qword [rcx], rax
add rsp, 0x48
ret
Function at 0x140001ec4
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xd0
lea rax, [rsp + 0x98]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x88]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rax, [rsp + 0x78]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x98], 0x30
mov qword [rsp + 0xa0], 0
mov dword [rsp + 0xb0], 0x40
lea rax, [rsp + 0x78]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x40
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x98]
mov edx, 0x80000000
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jge 0x140001fdb
mov eax, dword [rsp + 0x60]
jmp 0x14000208f
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov rax, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov r8, qword [rax]
mov edx, 0x1f01ff
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jge 0x140002030
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0x60]
jmp 0x14000208f
mov rax, qword [rsp + 0x68]
mov byte [rax + 0x4c], 1
mov rax, qword [rsp + 0x68]
mov byte [rax + 0x49], 0
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 0x28]
mov qword [rax], 0
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 0x28]
mov qword [rax + 0x10], 0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
add rsp, 0xd0
pop rdi
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
push rsi
mov rdx, qword [rdx + 0x20]
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
add r8, rdx
push rax
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140001700
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140001733
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
je 0x140001777
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x140001772
cmp rbx, r11
jae 0x140001777
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140001760
cmp rbx, r11
jb 0x14000177b
xor eax, eax
jmp 0x140001787
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400027c0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x240
mov rax, qword [0x1401216d8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov esi, edx
lea rcx, [rsp + 0x20]
mov edx, 0x104
mov r12, r9
mov rbp, r8
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp dword [0x1401232ec], 0
jne 0x14000281f
cmp dword [0x1401232f0], 0
jne 0x14000281f
cmp dword [0x1401232f4], 0
jne 0x14000281f
cmp dword [0x1401232f8], 0
je 0x140002831
lea rdx, str.System32
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.DIFxAPI.dll
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov rdi, rax
je 0x140002874
lea rdx, str.DriverPackageUninstallW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140002879
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
or eax, 0xffffffff
jmp 0x140002893
mov r9, r12
mov r8, rbp
mov edx, esi
mov rcx, rbx
call rax
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140090720
add rsp, 0x240
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400029c0
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1401216d8]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r8, rdx
movzx edx, cx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor ecx, ecx
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test rbx, rbx
mov ebp, eax
je 0x140002ac4
test rdi, rdi
je 0x140002ac4
test rsi, rsi
je 0x140002ac4
test eax, eax
je 0x140002ac4
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, str.DIFxAPI.dll
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor ebx, ebx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x140002abc
lea r9, [rsp + 0x40]
mov r8d, ebp
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x140002ac6
mov ebx, dword [rsp + 0x40]
mov eax, ebx
jmp 0x140002ac6
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140090720
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x270
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002fd0
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov esi, edx
mov rbx, rcx
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
xor ebp, ebp
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rdi, rax
je 0x140003133
mov r8d, 0xf01ff
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rbx, rax
je 0x14000312a
lea rax, [rsp + 0x80]
lea r9d, [rbp + 0x24]
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x140003067
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140003135
mov r9d, 0x4e20
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call fcn.140002b70
test esi, esi
je 0x140003121
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r11, [rsp + 0x80]
lea r8, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.dll_SafeArrayAllocData
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x14000304a
cmp dword [rsp + 0x34], 4
je 0x140003121
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x1388
jae 0x140003121
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0x80]
lea r8, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.dll_SafeArrayAllocData
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x14000305c
cmp dword [rsp + 0x34], 4
jne 0x1400030d6
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebp
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret

Function at 0x140003150
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rsi, rax
je 0x1400031d6
mov r8d, 0xf01ff
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rdi, rax
je 0x1400031cd
mov r9d, 0x2710
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call fcn.140002b70
test eax, eax
jne 0x1400031c4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov ecx, VarCyFromDisp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400055b0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1401216d8]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rdx
mov rdx, qword [rdx]
lea rax, [rsp + 0x48]
xor ebx, ebx
mov r9d, 0xf003f
xor r8d, r8d
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005643
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ecx, 1
cmp eax, 0x103
cmove ebx, ecx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rdi]
sub rdx, 0x18
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x140005663
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140090720
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret
Function at 0x140005c00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov r8d, 6
add ax, 1
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x140005d62
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140005d62
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x140005d62
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x140005ca6
nop
cmp rdi, r11
jae 0x140005d62
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x140005c90
cmp rdi, r11
jae 0x140005d62
movzx eax, word [rdi]
test ax, ax
je 0x140005d62
movzx ebx, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x140005cdc
mov edx, ebx
mov rcx, rsi
call fcn.140004650
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x140005cf9
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.140090a80
test eax, eax
je 0x140005d38
cmp eax, 0xc
je 0x140005d32
cmp eax, 0x16
je 0x140005d2c
cmp eax, 0x22
je 0x140005d2c
cmp eax, 0x50
je 0x140005d38
call fcn.140037194
int3
call fcn.140037194
int3
call fcn.14003714c
int3
test ebx, ebx
js 0x140005d57
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x140005d57
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x140005d64
mov ecx, 0x80070057
call fcn.140001610
int3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x140008fe0
Capabilities:
Delete registry key

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
cmp dword [rcx + 0x298], 0
je 0x1400090dc
call fcn.14004b378
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x140009020
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
lea rdx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionUninstall
test rdx, 0xffffffffffff0000
jne 0x140009068
movzx edi, dx
mov ecx, edi
call fcn.14004b1a0
test rax, rax
je 0x140009077
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140005c00
mov rbx, qword [rsp + 0x50]
jmp 0x140009077
lea rcx, [rsp + 0x50]
call fcn.140006080
mov rbx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbx
mov ecx, 0x80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
sete dil
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400090ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x1400090dc
lea rdx, str.0A46A65D_89AC_464C_8026_3CD44960BD04
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000aff0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x480
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x4a0], rbx
mov rax, qword [0x1401216d8]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x38], 0
call fcn.14004b378
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x14000b053
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbx], rax
lea rdx, [0x1400def30]
test rdx, 0xffffffffffff0000
jne 0x14000b08f
movzx edi, dx
mov ecx, edi
call fcn.14004b1a0
test rax, rax
je 0x14000b098
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.140005c00
jmp 0x14000b098
mov rcx, rbx
call fcn.140006080
nop
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], 2
xor r9d, r9d
lea r8d, [r9 + 1]
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
cmp rax, 0xffffffffffffffff
je 0x14000b148
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 0x208
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.InfPath
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000b148
mov edx, 0x104
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x260]
lea rdx, str._sinf_s
mov rcx, rbx
call fcn.140006a90
mov rax, rbx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140090720
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x480
pop rdi
pop rsi
pop rbp
ret