joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14020b338
Capabilities:
Get geographical location

Disassembly:
jmp 0x1403c7880
mov byte [rsp + 0x18], r8b
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x30]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa0]
lea rcx, [0x14095f220]
call fcn.1402116e3
movzx eax, al
test eax, eax
je 0x1403c79a6
mov r9d, 4
lea r8, [0x14096af80]
mov edx, 0xe
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1403c792b
mov eax, 2
imul rax, rax, 0
lea rcx, [0x14096af80]
mov edx, 0x2e
mov word [rcx + rax], dx
mov qword [rsp + 0x78], 2
cmp qword [rsp + 0x78], 8
jae 0x1403c7913
jmp 0x1403c7919
call fcn.140211459
nop
lea rax, [0x14096af80]
xor ecx, ecx
mov rdx, qword [rsp + 0x78]
mov word [rax + rdx], cx
mov r9d, 4
lea r8, [0x14096af88]
mov edx, 0xf
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1403c7999
mov eax, 2
imul rax, rax, 0
lea rcx, [0x14096af88]
mov edx, 0x2c
mov word [rcx + rax], dx
mov qword [rsp + 0x80], 2
cmp qword [rsp + 0x80], 8
jae 0x1403c797e
jmp 0x1403c7984
call fcn.140211459
nop
lea rax, [0x14096af88]
xor ecx, ecx
mov rdx, qword [rsp + 0x80]
mov word [rax + rdx], cx
lea rcx, [0x14095f220]
call sym.SystemInformer.exe_PhfEndInitOnce
nop
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], 0
movzx eax, byte [rsp + 0xb0]
test eax, eax
je 0x1403c79d2
mov dword [rsp + 0x88], 3
jmp 0x1403c79dd
mov dword [rsp + 0x88], 0
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x50], eax
lea rax, [0x14096af80]
mov qword [rsp + 0x58], rax
lea rax, [0x14096af88]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8, qword [rsp + 0xa0]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x74]
shl rax, 1
mov rdx, rax
xor ecx, ecx
call sym.SystemInformer.exe_PhCreateStringEx
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
mov r8, qword [rsp + 0xa0]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
test eax, eax
jne 0x1403c7a8f
mov rcx, qword [rsp + 0x30]
call sym.SystemInformer.exe_PhDereferenceObject
xor eax, eax
jmp 0x1403c7a9e
mov rcx, qword [rsp + 0x30]
call fcn.140212d1d
mov rax, qword [rsp + 0x30]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x14078c540]
call fcn.1402124fd
mov rax, rdi
add rsp, 0x90
pop rdi
ret

Function at 0x14020b3b5
Capabilities:
Delete service

Disassembly:
jmp 0x140429890
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x1404298b3
mov dword [rsp + 0x20], 0
jmp 0x1404298bc
call fcn.1402107d9
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
Function at 0x14020b4fa
Capabilities:
Get system information on windows

Disassembly:
jmp 0x1403fe790
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov dword [rsp + 0x30], 0x200
mov eax, dword [rsp + 0x30]
mov ecx, eax
call sym.SystemInformer.exe_PhAllocate
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov ecx, 0x90
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xc0000004
jne 0x1403fe80f
mov rcx, qword [rsp + 0x28]
call sym.SystemInformer.exe_PhFree
mov eax, dword [rsp + 0x30]
shl eax, 1
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x10000000
jbe 0x1403fe7fd
mov eax, 0xc000009a
jmp 0x1403fe837
mov eax, dword [rsp + 0x30]
mov ecx, eax
call sym.SystemInformer.exe_PhAllocate
mov qword [rsp + 0x28], rax
jmp 0x1403fe7b2
cmp dword [rsp + 0x20], 0
jge 0x1403fe826
mov rcx, qword [rsp + 0x28]
call sym.SystemInformer.exe_PhFree
mov eax, dword [rsp + 0x20]
jmp 0x1403fe837
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
mov eax, dword [rsp + 0x20]
add rsp, 0x40
pop rdi
ret

Function at 0x14020b5a4
Capabilities:
Stop service

Disassembly:
jmp 0x140429920
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
lea rdi, [rsp + 0x20]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x90]
mov rax, qword [0x140961e80]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x14042997b
mov dword [rsp + 0x20], 0
jmp 0x140429984
call fcn.1402107d9
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov edi, eax
mov rcx, rsp
lea rdx, [0x1407b7eb0]
call fcn.1402124fd
mov eax, edi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14020ee98
add rsp, 0x80
pop rdi
ret
Function at 0x14020b60d
Capabilities:
Get file attributes

Disassembly:
jmp 0x1403ff1c0
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xc0
lea rdi, [rsp + 0x60]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xd0]
mov byte [rsp + 0x94], 1
mov dword [rsp + 0xa0], 0x400
mov eax, dword [rsp + 0xa0]
mov ecx, eax
call sym.SystemInformer.exe_PhAllocate
mov qword [rsp + 0x98], rax
xor eax, eax
cmp eax, 1
je 0x1403ff3f6
xor eax, eax
cmp eax, 1
je 0x1403ff31f
movzx eax, byte [rsp + 0x94]
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0xe0]
mov byte [rsp + 0x40], al
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0x103
jne 0x1403ff2cf
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jl 0x1403ff2cf
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0x80000005
je 0x1403ff2e3
cmp dword [rsp + 0x60], 0xc0000004
jne 0x1403ff318
mov rcx, qword [rsp + 0x98]
call sym.SystemInformer.exe_PhFree
mov eax, dword [rsp + 0xa0]
shl eax, 1
mov dword [rsp + 0xa0], eax
mov eax, dword [rsp + 0xa0]
mov ecx, eax
call sym.SystemInformer.exe_PhAllocate
mov qword [rsp + 0x98], rax
jmp 0x1403ff31a
jmp 0x1403ff31f
jmp 0x1403ff228
cmp dword [rsp + 0x60], 0x80000006
jne 0x1403ff336
mov dword [rsp + 0x60], 0
jmp 0x1403ff3f6
cmp dword [rsp + 0x60], 0
jge 0x1403ff342
jmp 0x1403ff3f6
mov dword [rsp + 0xa4], 0
mov byte [rsp + 0xa8], 1
xor eax, eax
cmp eax, 1
je 0x1403ff3db
mov eax, dword [rsp + 0xa4]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0], rax
mov r8, qword [rsp + 0xf8]
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xd0]
call qword [rsp + 0xf0]
movzx eax, al
test eax, eax
jne 0x1403ff3a9
mov byte [rsp + 0xa8], 0
jmp 0x1403ff3db
mov rax, qword [rsp + 0xb0]
cmp dword [rax], 0
je 0x1403ff3d4
mov rax, qword [rsp + 0xb0]
mov eax, dword [rax]
mov ecx, dword [rsp + 0xa4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa4], eax
jmp 0x1403ff3d6
jmp 0x1403ff3db
jmp 0x1403ff355
movzx eax, byte [rsp + 0xa8]
test eax, eax
jne 0x1403ff3e9
jmp 0x1403ff3f6
mov byte [rsp + 0x94], 0
jmp 0x1403ff21d
mov rcx, qword [rsp + 0x98]
call sym.SystemInformer.exe_PhFree
mov eax, dword [rsp + 0x60]
mov edi, eax
mov rcx, rsp
lea rdx, [0x1407a3730]
call fcn.1402124fd
mov eax, edi
add rsp, 0xc0
pop rdi
ret
Function at 0x14020b6cb
Capabilities:
Get uefi variable

Disassembly:
jmp 0x1404098f0
push rdi
sub rsp, 0xc0
lea rdi, [rsp + 0x30]
mov ecx, 0x24
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov qword [rsp + 0x30], 1
mov dword [rsp + 0x44], 8
mov dword [rsp + 0x64], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x88]
lea rdx, [0x14079e6e0]
lea rcx, [0x14095fca8]
call qword [sym.imp.ntdll.dll_NtQuerySystemEnvironmentValueEx]
mov dword [rsp + 0xb4], eax
cmp dword [rsp + 0xb4], 0xc0000100
je 0x140409991
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x88]
and rcx, rax
mov rax, rcx
test rax, rax
jne 0x14040999c
mov dword [rsp + 0xb4], 0xc00000bb
cmp dword [rsp + 0xb4], 0
jl 0x140409a53
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
lea r8, [rsp + 0xa8]
lea rdx, [0x14079e6e0]
lea rcx, [0x14095fcb8]
call qword [sym.imp.ntdll.dll_NtQuerySystemEnvironmentValueEx]
mov dword [rsp + 0xb4], eax
cmp dword [rsp + 0xb4], 0
jge 0x1404099f3
cmp dword [rsp + 0xb4], 0xc0000100
jne 0x140409a53
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xa8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xa8], rax
cmp dword [rsp + 0xb4], 0xc0000100
jne 0x140409a23
mov dword [rsp + 0x64], 1
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x44]
lea r8, [rsp + 0xa8]
lea rdx, [0x14079e6e0]
lea rcx, [0x14095fcb8]
call qword [sym.imp.ntdll.dll_NtSetSystemEnvironmentValueEx]
mov dword [rsp + 0xb4], eax
mov eax, dword [rsp + 0xb4]
mov edi, eax
mov rcx, rsp
lea rdx, [0x1407a95d0]
call fcn.1402124fd
mov eax, edi
add rsp, 0xc0
pop rdi
ret

Function at 0x14020b739
Capabilities:
Get system information on windows

Disassembly:
jmp 0x140312ee0
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
xor r9d, r9d
mov r8d, Ordinal_345
lea rdx, [0x14096f260]
mov ecx, 2
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jge 0x140312f23
mov r8d, Ordinal_345
xor edx, edx
lea rcx, [0x14096f260]
call fcn.1402118af
nop
mov rax, qword [0x14096f1c0]
mov rcx, qword [0x14096f268]
sub rcx, rax
mov rax, rcx
mov qword [0x14096f1c8], rax
mov rax, qword [0x14096f268]
mov qword [0x14096f1c0], rax
mov rax, qword [0x14096f1b0]
mov rcx, qword [0x14096f270]
sub rcx, rax
mov rax, rcx
mov qword [0x14096f1b8], rax
mov rax, qword [0x14096f270]
mov qword [0x14096f1b0], rax
mov rax, qword [0x14096f1a0]
mov rcx, qword [0x14096f278]
sub rcx, rax
mov rax, rcx
mov qword [0x14096f1a8], rax
mov rax, qword [0x14096f278]
mov qword [0x14096f1a0], rax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x14020b8dd
Capabilities:
Initialize winhttp library
Reference cloudflare dns server

Disassembly:
jmp 0x1404d1da0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x100
lea rdi, [rsp + 0x30]
mov ecx, 0x34
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x110]
lea rcx, [0x1409614f8]
call fcn.1402116e3
movzx eax, al
test eax, eax
je 0x1404d1fa9
cmp dword [0x14095f7f0], 0x3f
jb 0x1404d1df3
mov dword [rsp + 0xe4], 4
jmp 0x1404d1dfe
mov dword [rsp + 0xe4], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0xe4]
xor ecx, ecx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [0x14096c958], rax
cmp qword [0x14096c958], 0
je 0x1404d1f9c
cmp dword [0x14095f7f0], 0x3f
jae 0x1404d1e64
mov dword [rsp + 0x34], 0xa00
mov r9d, 4
lea r8, [rsp + 0x34]
mov edx, 0x54
mov rcx, qword [0x14096c958]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
nop
jmp 0x1404d1f18
mov dword [rsp + 0x54], 0x2800
mov r9d, 4
lea r8, [rsp + 0x54]
mov edx, 0x54
mov rcx, qword [0x14096c958]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov dword [rsp + 0x74], 3
mov r9d, 4
lea r8, [rsp + 0x74]
mov edx, 0x76
mov rcx, qword [0x14096c958]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [0x14095f7f0], 0x64
jb 0x1404d1ee3
mov dword [rsp + 0x94], 1
mov r9d, 4
lea r8, [rsp + 0x94]
mov edx, 0x85
mov rcx, qword [0x14096c958]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
nop
cmp dword [0x14095f7f0], 0x72
jb 0x1404d1f18
mov dword [rsp + 0xb4], 1
mov r9d, 4
lea r8, [rsp + 0xb4]
mov edx, 0xc3
mov rcx, qword [0x14096c958]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
nop
mov dword [rsp + 0xd4], 1
mov r9d, 4
lea r8, [rsp + 0xd4]
mov edx, 0x49
mov rcx, qword [0x14096c958]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [0x14095f7f0], 0x64
jb 0x1404d1f9c
cmp qword [rsp + 0x110], 0
je 0x1404d1f69
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xe8], rax
jmp 0x1404d1f78
lea rax, str.1.1.1.1
mov qword [rsp + 0xe8], rax
xor r9d, r9d
mov r8w, 0x1bb
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [0x14096c958]
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [0x14096c960], rax
lea rcx, [0x1409614f8]
call sym.SystemInformer.exe_PhfEndInitOnce
nop
cmp dword [0x14095f7f0], 0x64
jae 0x1404d2002
cmp qword [rsp + 0x110], 0
je 0x1404d1fcf
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xf0], rax
jmp 0x1404d1fde
lea rax, str.1.1.1.1
mov qword [rsp + 0xf0], rax
xor r9d, r9d
mov r8w, 0x1bb
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [0x14096c958]
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [0x14096c960], rax
mov rax, qword [0x14096c960]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1407deaa0]
call fcn.1402124fd
mov rax, rdi
add rsp, 0x100
pop rdi
ret
Function at 0x14020b9c8
Capabilities:
Get system information on windows

Disassembly:
jmp 0x1403fd840
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x20]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 5
je 0x1403fd886
cmp dword [rsp + 0x44], 0x39
je 0x1403fd890
cmp dword [rsp + 0x44], 0x94
je 0x1403fd89a
jmp 0x1403fd8a4
mov dword [rsp + 0x24], 0
jmp 0x1403fd8ae
mov dword [rsp + 0x24], 1
jmp 0x1403fd8ae
mov dword [rsp + 0x24], 2
jmp 0x1403fd8ae
mov eax, 0xc0000003
jmp 0x1403fd98d
mov eax, dword [rsp + 0x24]
lea rcx, [0x14095fb60]
mov eax, dword [rcx + rax*4]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
mov ecx, eax
call sym.SystemInformer.exe_PhAllocateSafe
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1403fd8e2
mov eax, 0xc0000017
jmp 0x1403fd98d
xor eax, eax
cmp eax, 1
je 0x1403fd949
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xc0000023
je 0x1403fd91a
cmp dword [rsp + 0x20], 0xc0000004
jne 0x1403fd945
mov rcx, qword [rsp + 0x28]
call sym.SystemInformer.exe_PhFree
mov eax, dword [rsp + 0x34]
mov ecx, eax
call sym.SystemInformer.exe_PhAllocateSafe
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1403fd943
mov eax, 0xc0000017
jmp 0x1403fd98d
jmp 0x1403fd947
jmp 0x1403fd949
jmp 0x1403fd8e2
cmp dword [rsp + 0x20], 0
jge 0x1403fd960
mov rcx, qword [rsp + 0x28]
call sym.SystemInformer.exe_PhFree
mov eax, dword [rsp + 0x20]
jmp 0x1403fd98d
cmp dword [rsp + 0x34], 0x100000
ja 0x1403fd97c
mov eax, dword [rsp + 0x24]
lea rcx, [0x14095fb60]
mov edx, dword [rsp + 0x34]
mov dword [rcx + rax*4], edx
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
mov eax, dword [rsp + 0x20]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1407a2e20]
call fcn.1402124fd
mov rax, rdi
add rsp, 0x50
pop rdi
ret
Function at 0x14020bb67
Capabilities:
Receive http response

Disassembly:
jmp 0x1404d1730
mov word [rsp + 0x18], r8w
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xf0
lea rdi, [rsp + 0x40]
mov ecx, 0x2c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x98], 0
call fcn.1404d2120
movzx eax, al
test eax, eax
jne 0x1404d17a4
xor eax, eax
jmp 0x1404d190d
lea rax, [0x14096c98c]
mov cx, 1
lock xadd word [rax], cx
inc cx
movzx eax, cx
mov word [rsp + 0xe4], ax
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
movzx r8d, word [rsp + 0xe4]
movzx edx, word [rsp + 0x110]
mov rcx, qword [rsp + 0x108]
call fcn.1404d2220
movzx eax, al
test eax, eax
jne 0x1404d17fe
jmp 0x1404d18cb
mov rcx, qword [rsp + 0x100]
call fcn.14020b8dd
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1404d181d
jmp 0x1404d18cb
mov rcx, qword [rsp + 0x40]
call fcn.14020ff28
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x1404d1839
jmp 0x1404d18cb
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0xb4]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xb4]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x58]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x1404d1873
jmp 0x1404d18cb
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x1404d1886
jmp 0x1404d18cb
lea r8, [rsp + 0xd4]
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
call sym.SystemInformer.exe_PhHttpSocketReadDataToBuffer
movzx eax, al
test eax, eax
jne 0x1404d18a6
jmp 0x1404d18cb
lea r9, [rsp + 0x98]
mov r8d, dword [rsp + 0xd4]
mov rdx, qword [rsp + 0x78]
movzx ecx, word [rsp + 0xe4]
call fcn.1404d23c0
movzx eax, al
cmp qword [rsp + 0x48], 0
je 0x1404d18df
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
nop
cmp qword [rsp + 0x78], 0
je 0x1404d18f2
mov rcx, qword [rsp + 0x78]
call sym.SystemInformer.exe_PhFree
nop
cmp qword [rsp + 0x58], 0
je 0x1404d1905
mov rcx, qword [rsp + 0x58]
call sym.SystemInformer.exe_PhFree
nop
mov rax, qword [rsp + 0x98]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1407de590]
call fcn.1402124fd
mov rax, rdi
add rsp, 0xf0
pop rdi
ret

Function at 0x14020bc70
Capabilities:
Set file attributes

Disassembly:
jmp 0x1403fb3b0
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
lea rdi, [rsp + 0x30]
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x90]
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 0x29
mov r9d, 4
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1407a1900]
call fcn.1402124fd
mov rax, rdi
add rsp, 0x80
pop rdi
ret
Function at 0x14020becd
Capabilities:
Get file attributes

Disassembly:
jmp 0x1403fb230
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
lea rdi, [rsp + 0x30]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xf0]
mov rax, qword [0x140961e80]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x20], 0x22
mov r9d, 0x38
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x1403fb2b6
lea rax, [rsp + 0x78]
mov rdi, qword [rsp + 0xf8]
mov rsi, rax
mov ecx, 0x38
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0x30]
mov edi, eax
mov rcx, rsp
lea rdx, [0x1407a17a0]
call fcn.1402124fd
mov eax, edi
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14020ee98
add rsp, 0xd8
pop rdi
pop rsi
ret
Function at 0x14020c29c
Capabilities:
Read file on windows

Disassembly:
jmp 0x1403ea390
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x50]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x88], 0
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 8]
and eax, 8
test eax, eax
je 0x1403ea3f7
mov rax, qword [rsp + 0xa0]
add rax, 0x10
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax]
call qword [sym.imp.ntdll.dll_NtReadFile]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0x103
jne 0x1403ea47f
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax]
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jl 0x1403ea47f
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jl 0x1403ea4bc
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax + 0x10]
add rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0xa0]
mov qword [rcx + 0x10], rax
cmp qword [rsp + 0xb8], 0
je 0x1403ea4bc
mov rax, qword [rsp + 0xb8]
mov ecx, dword [rsp + 0x70]
mov dword [rax], ecx
mov eax, dword [rsp + 0x50]
mov edi, eax
mov rcx, rsp
lea rdx, [0x14079a030]
call fcn.1402124fd
mov eax, edi
add rsp, 0x90
pop rdi
ret
Function at 0x14020c2b5
Capabilities:
Enumerate services

Disassembly:
jmp 0x140428bd0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xc0
lea rdi, [rsp + 0x50]
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xd0]
cmp dword [0x14095f7f0], 0x66
jb 0x140428c0e
mov dword [rsp + 0x60], 0x3ff
jmp 0x140428c29
cmp dword [0x14095f7f0], 0x64
jb 0x140428c21
mov dword [rsp + 0x60], 0x1ff
jmp 0x140428c29
mov dword [rsp + 0x60], 0x3b
call fcn.1402138b2
mov qword [rsp + 0x58], rax
mov eax, dword [0x140960370]
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x70]
mov ecx, eax
call sym.SystemInformer.exe_PhAllocate
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0xa4]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x84]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 3
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
je 0x140428cb1
mov dword [rsp + 0x50], 0
jmp 0x140428cba
call fcn.1402107d9
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0x105
jne 0x140428d62
mov rcx, qword [rsp + 0x68]
call sym.SystemInformer.exe_PhFree
mov eax, dword [rsp + 0x84]
mov ecx, dword [rsp + 0x70]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x70]
mov ecx, eax
call sym.SystemInformer.exe_PhAllocate
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0xa4]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x84]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 3
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
je 0x140428d59
mov dword [rsp + 0x50], 0
jmp 0x140428d62
call fcn.1402107d9
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x140428d79
mov rcx, qword [rsp + 0x68]
call sym.SystemInformer.exe_PhFree
mov eax, dword [rsp + 0x50]
jmp 0x140428db2
cmp dword [rsp + 0x70], 0x20000
ja 0x140428d8d
mov eax, dword [rsp + 0x70]
mov dword [0x140960370], eax
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x68]
mov qword [rax], rcx
mov rax, qword [rsp + 0xd8]
mov ecx, dword [rsp + 0xa4]
mov dword [rax], ecx
mov eax, dword [rsp + 0x50]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1407b7af0]
call fcn.1402124fd
mov rax, rdi
add rsp, 0xc0
pop rdi
ret

Function at 0x14020c3c3
Capabilities:
Receive http response

Disassembly:
jmp 0x1404d0630
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
xor edx, edx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x1404d0659
mov dword [rsp + 0x20], 1
jmp 0x1404d0661
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x30
pop rdi
ret