joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400077e0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
lea rcx, [0x140022728]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp qword [0x1400228d0], 0
jne 0x14000790b
lea rcx, str.SETUPAPI.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1400228d0], rax
test rax, rax
jne 0x14000783e
lea rcx, [0x140022728]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0xfffffff5
jmp 0x140007921
lea rdx, str.SetupDiGetClassDevsA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400228d8], rax
lea rdx, str.SetupDiGetDeviceInterfaceDetailA
mov rcx, qword [0x1400228d0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400228f0], rax
lea rdx, str.SetupDiGetDeviceRegistryPropertyA
mov rcx, qword [0x1400228d0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400228f8], rax
lea rdx, str.SetupDiDestroyDeviceInfoList
mov rcx, qword [0x1400228d0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400228e0], rax
lea rdx, str.SetupDiEnumDeviceInterfaces
mov rcx, qword [0x1400228d0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400228e8], rax
cmp qword [0x1400228d8], 0
je 0x1400078ee
cmp qword [0x1400228e0], 0
je 0x1400078ee
test rax, rax
je 0x1400078ee
cmp qword [0x1400228f0], 0
je 0x1400078ee
cmp qword [0x1400228f8], 0
jne 0x14000790b
mov rcx, rbx
call fcn.140005c70
nop
lea rcx, [0x140022728]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0xfffffff4
jmp 0x140007921
lock inc dword [0x1400228c8]
lea rcx, [0x140022728]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140007930
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
lea rcx, [0x140022728]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp qword [0x140022900], 0
jne 0x140007af8
lea rcx, str.WINUSB.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140022900], rax
test rax, rax
jne 0x140007997
mov rcx, rbx
call fcn.140005c70
nop
lea rcx, [0x140022728]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0xffffffe1
jmp 0x140007b0e
lea rdx, str.WinUsb_Initialize
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140022908], rax
lea rdx, str.WinUsb_Free
mov rcx, qword [0x140022900]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140022910], rax
lea rdx, str.WinUsb_ReadPipe
mov rcx, qword [0x140022900]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140022918], rax
lea rdx, str.WinUsb_WritePipe
mov rcx, qword [0x140022900]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140022920], rax
lea rdx, str.WinUsb_AbortPipe
mov rcx, qword [0x140022900]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140022928], rax
lea rdx, str.WinUsb_ResetPipe
mov rcx, qword [0x140022900]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140022930], rax
lea rdx, str.WinUsb_QueryPipe
mov rcx, qword [0x140022900]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140022938], rax
lea rdx, str.WinUsb_GetDescriptor
mov rcx, qword [0x140022900]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140022940], rax
lea rdx, str.WinUsb_QueryInterfaceSettings
mov rcx, qword [0x140022900]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140022948], rax
cmp qword [0x140022908], 0
je 0x140007adb
cmp qword [0x140022910], 0
je 0x140007adb
cmp qword [0x140022918], 0
je 0x140007adb
cmp qword [0x140022920], 0
je 0x140007adb
cmp qword [0x140022928], 0
je 0x140007adb
cmp qword [0x140022930], 0
je 0x140007adb
cmp qword [0x140022938], 0
je 0x140007adb
cmp qword [0x140022940], 0
je 0x140007adb
test rax, rax
jne 0x140007af8
mov rcx, rbx
call fcn.140005c70
nop
lea rcx, [0x140022728]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0xffffffe0
jmp 0x140007b0e
lock inc dword [0x1400228cc]
lea rcx, [0x140022728]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140008370
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0xe0
lea rax, str.eCMD_Unknown
mov rsi, rdx
mov edx, dword [rdx]
mov qword [rsp + 0x30], rax
lea rax, str.eCMD_GetDriverVer
mov rbp, rcx
mov qword [rsp + 0x38], rax
lea rax, str.eCMD_GetDriverVerResp
lea rcx, str.Sending__s_with__d_bytes_to_pipe
mov qword [rsp + 0x40], rax
lea rax, str.eCMD_GetDevices
mov rbx, r9
mov qword [rsp + 0x48], rax
lea rax, str.eCMD_GetDevicesResp
mov edi, r8d
mov qword [rsp + 0x50], rax
lea rax, str.eCMD_Connect
mov qword [rsp + 0x58], rax
lea rax, str.eCMD_ConnectResp
mov qword [rsp + 0x60], rax
lea rax, str.eCMD_Disconnect
mov qword [r11 - 0x80], rax
lea rax, str.eCMD_DisconnectResp
mov qword [r11 - 0x78], rax
lea rax, str.eCMD_GetUsedDevice
mov qword [r11 - 0x70], rax
lea rax, str.eCMD_GetUsedDeviceResp
mov qword [r11 - 0x68], rax
lea rax, str.eCMD_Data
mov qword [r11 - 0x60], rax
lea rax, str.eCMD_UnknownCommand
mov qword [r11 - 0x58], rax
lea rax, str.eCMD_GetServerVersion
mov qword [r11 - 0x50], rax
lea rax, str.eCMD_GetServerVersionResp
mov qword [r11 - 0x48], rax
lea rax, str.eCMD_GetUserCount
mov qword [r11 - 0x40], rax
lea rax, str.eCMD_GetUserCountResp
mov qword [r11 - 0x38], rax
lea rax, str.eCMD_StartExclusiveMode
mov qword [r11 - 0x30], rax
lea rax, str.eCMD_StartExclusiveModeResp
mov qword [r11 - 0x28], rax
lea rax, str.eCMD_StoppExclusiveMode
mov qword [r11 - 0x20], rax
lea rax, str.eCMD_StoppExclusiveModeResp
mov qword [r11 - 0x18], rax
mov rdx, qword [rsp + rdx*8 + 0x30]
call fcn.140007f40
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140009460
Capabilities:
Accept command line arguments
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [0x1400228b4]
test eax, eax
jne 0x14000947f
call fcn.140005720
mov eax, dword [0x1400228b4]
inc eax
xor ebx, ebx
or edi, 0xffffffff
cmp qword [0x140022768], rbx
mov dword [0x1400228b4], eax
jne 0x14000949e
call fcn.140003000
test eax, eax
je 0x1400094d9
mov ecx, dword [0x140021494]
cmp ecx, 0xffffffff
je 0x1400094b5
call qword [0x140022770]
mov dword [0x140021494], edi
lea rcx, str.NLUSBSvr
call qword [0x140022768]
cmp eax, 0xffffffff
jne 0x1400094ce
call fcn.1400031a0
jmp 0x1400094d9
mov dword [0x140021494], eax
mov ebx, 1
mov dword [0x1400228b8], ebx
test ebx, ebx
je 0x14000953a
mov rax, qword [0x140022798]
test rax, rax
je 0x14000950c
mov ecx, dword [0x140021494]
lea r9, [0x1400228c4]
lea r8, [0x1400228c0]
lea rdx, [0x1400228bc]
call rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
or r8d, 0xffffffff
lea r9, str.NLUSBSrvInit_started__PID_08X__with_Commandline__s
or edx, r8d
or ecx, r8d
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
call fcn.140003230
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r8, [0x1400084d0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov qword [0x140022960], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14000959f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x140022958], 0
jne 0x1400095e6
mov edi, 0xfffffffe
cmp dword [0x1400228b8], 0
je 0x1400095b7
mov dword [0x1400228b8], 0
call fcn.1400031a0
mov ecx, dword [0x1400228b4]
test ecx, ecx
jle 0x1400095d9
cmp ecx, 1
jne 0x1400095d1
call fcn.140005a00
mov ecx, dword [0x1400228b4]
dec ecx
mov dword [0x1400228b4], ecx
mov eax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14000bd63
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140020028]
jne 0x14000a00a
rol rcx, 0x10
test cx, 0xffff
jne 0x14000a006
repz ret
ror rcx, 0x10
jmp 0x14000bcbc
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140021700]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1400217f8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000bd41
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140021700]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000bd63
mov rax, qword [rsp + 0x88]
mov qword [0x1400217f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140021798], rax
mov rax, qword [0x1400217f8]
mov qword [0x140021670], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140021780], rax
mov dword [0x140021660], 0xc0000409
mov dword [0x140021664], 1
mov rax, qword [0x140020028]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140020030]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400216f8], eax
mov ecx, 1
call fcn.140011510
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140019538]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400216f8], 0
jne 0x14000bdea
mov ecx, 1
call fcn.140011510
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14000fa4c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14000f8bc
Function at 0x1400133d0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140020028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14000ee34
xor ebx, ebx
cmp qword [0x1400226c8], rbx
mov rdi, rax
jne 0x1400134e3
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1400135ba
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400135ba
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1400226c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x14001b828]
mov rcx, rsi
mov qword [0x1400226d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1400226d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1400226e8], rax
test rax, rax
je 0x1400134da
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1400226e0], rax
jmp 0x1400134ea
mov rax, qword [0x1400226e0]
jmp 0x1400134f1
mov rax, qword [0x1400226e0]
mov r11, qword [0x1400226e8]
cmp rax, rdi
je 0x140013558
cmp r11, rdi
je 0x140013558
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1400226e8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140013558
test rax, rax
je 0x140013558
call rsi
test rax, rax
je 0x140013552
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140013552
test byte [rsp + 0x40], 1
jne 0x140013558
bts ebp, 0x15
jmp 0x140013598
mov rcx, qword [0x1400226d0]
cmp rcx, rdi
je 0x140013598
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140013598
call rax
mov rbx, rax
test rax, rax
je 0x140013598
mov rcx, qword [0x1400226d8]
cmp rcx, rdi
je 0x140013598
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140013598
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400226c8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400135ba
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1400135bc
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140009ff0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002b900
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14002b90d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14002b91d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14002b905
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14002b935
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14002b922
sub eax, 3
jb 0x14002b94f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14002b986
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14002b976
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14002b974
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14002b963
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14002b8c2
jmp 0x14002b90d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1b400
mov dl, 9
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14002b9d2
cmp rsi, rcx
jae 0x14002b9da
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14002b9b9
cmp al, 0x8f
ja 0x14002b9b9
cmp byte [rsi - 2], 0xf
je 0x14002b9bf
sub al, 0xe8
cmp al, 1
ja 0x14002b9a3
cmp rsi, rcx
jae 0x14002b9da
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14002b9a9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14002b9da
lodsb al, byte [rsi]
jmp 0x14002b9b9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x29000]
mov eax, dword [rdi]
or eax, eax
je 0x14002ba43
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2ca14]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14002b9e7
jns 0x14002ba1c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14002ba26
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14002ba3d
mov qword [rbx], rax
add rbx, 8
jmp 0x14002ba07
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14002ba9b
sub rsp, 0xffffffffffffff80
jmp 0x14001bce0
Function at 0xbe27c0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xbe27cd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xbe27dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xbe27c5
lea eax, [rcx + 1]
jmp 0xbe27eb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xbe27fe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xbe27e4
sub eax, 3
jb 0xbe281e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xbe286d
sar eax, 1
movsxd rbp, eax
jb 0xbe2854
jmp 0xbe282c
add ebx, ebx
jne 0xbe282a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xbe2854
inc ecx
add ebx, ebx
jne 0xbe283a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xbe2854
call r11
adc ecx, ecx
add ebx, ebx
jne 0xbe284d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xbe283c
add ecx, 2
jmp 0xbe2859
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00be2782
jmp 0xbe27cd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x255a00
mov dl, 0x28
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xbe28b9
cmp rsi, rcx
jae 0xbe28c1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xbe28a0
cmp al, 0x8f
ja 0xbe28a0
cmp byte [rsi - 2], 0xf
je 0xbe28a6
sub al, 0xe8
cmp al, 1
ja 0xbe288a
cmp rsi, rcx
jae 0xbe28c1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xbe2890
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xbe28c1
lodsb al, byte [rsi]
jmp 0xbe28a0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x7da000]
mov eax, dword [rdi]
or eax, eax
je 0xbe291e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x7e2000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xbe28ce
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xbe2918
mov qword [rbx], rax
add rbx, 8
jmp 0xbe28ee
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xbe2962
cmp al, 0xef
ja 0xbe294a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xbe292a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xbe2939
mov eax, dword [rdi]
add rdi, 4
jmp 0xbe2939
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xbe29b6
sub rsp, 0xffffffffffffff80
jmp 0x473c80
Function at 0x140412058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1404121df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140412089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14041206f
add dl, dl
jne 0x140412096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1404120f6
xor eax, eax
add dl, dl
jne 0x1404120a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1404121ad
add dl, dl
jne 0x1404120b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1404120c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1404120d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1404120dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1404120ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14041207e
mov eax, 1
add dl, dl
jne 0x140412106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140412113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1404120fb
sub eax, ebx
mov ebx, 1
jne 0x14041214c
mov ecx, 1
add dl, dl
jne 0x14041212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14041213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140412123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14041207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140412168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140412175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14041215d
cmp eax, 0x7d00
jae 0x14041219b
cmp eax, 0x500
jb 0x140412196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14041207e
cmp eax, 0x7f
ja 0x14041219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14041207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1404121d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14041207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180001d50
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1800680c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], rsp
mov rdi, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x180001db8
lea rdx, [0x180001d9e]
mov rcx, rsp
call fcn.18004b9a0
nop
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180023640
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov r8d, 0xf01ff
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x180001df6
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, [0x180001df2]
mov rcx, qword [rsp + 0x20]
call fcn.18004b9a0
nop
xor eax, eax
jmp 0x180001da0
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x180001e3f
cmp dword [rsp + 0x3c], 1
je 0x180001e3f
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, [0x180001e38]
mov rcx, qword [rsp + 0x20]
call fcn.18004b9a0
nop
xor eax, eax
jmp 0x180001da0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x180001da0

Function at 0x180001e60
Capabilities:
Delete service
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1800680c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], rsp
mov rdi, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x180001ec8
lea rdx, [0x180001eae]
mov rcx, rsp
call fcn.18004b9a0
nop
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180023640
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov r8d, 0xf01ff
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x180001f06
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, [0x180001f02]
mov rcx, qword [rsp + 0x20]
call fcn.18004b9a0
nop
xor eax, eax
jmp 0x180001eb0
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x180001f51
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, [0x180001f4a]
mov rcx, qword [rsp + 0x20]
call fcn.18004b9a0
nop
xor eax, eax
jmp 0x180001eb0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x180001eb0