joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800a9c50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x18014f980]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x1800a9ce5
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x1800a9d46
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.180083670
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800bd470
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x1800a9e01
sub ecx, 1
je 0x1800a9e74
sub ecx, 1
je 0x1800a9db0
cmp ecx, 1
je 0x1800a9d93
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x1800c3bb4]
call fcn.180083670
jmp 0x1800a9e74
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.1800a9980
test eax, eax
je 0x1800a9e74
jmp 0x1800a9d1a
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1800a9e74
sub rax, rsi
cmp rax, rbp
jae 0x1800a9e74
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.1800837f0
jmp 0x1800a9e74
cmp r8d, 4
jle 0x1800a9e74
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x1800a9e74
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.180083590
mov esi, eax
test eax, eax
je 0x1800a9e53
mov edx, 5
mov rcx, rbx
call fcn.1800aa940
mov eax, esi
jmp 0x1800a9d1a
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.180092ba0
mov rcx, r14
call fcn.180092e80
test eax, eax
je 0x1800a9d18
mov edx, 5
mov rcx, rbx
call fcn.1800aa940
mov eax, Ordinal_46
jmp 0x1800a9d1a
Function at 0x1800bcd50
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1800bcd92
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1800bcdd9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1800bce32
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1800bcdf0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1800bce73
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x18013dfb2]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x18013dfb3]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1800bce40
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x140003cb4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140003ad8
Function at 0x141994058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1419941df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141994089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14199406f
add dl, dl
jne 0x141994096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1419940f6
xor eax, eax
add dl, dl
jne 0x1419940a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1419941ad
add dl, dl
jne 0x1419940b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1419940c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1419940d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1419940dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1419940ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14199407e
mov eax, 1
add dl, dl
jne 0x141994106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141994113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1419940fb
sub eax, ebx
mov ebx, 1
jne 0x14199414c
mov ecx, 1
add dl, dl
jne 0x14199412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14199413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141994123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14199407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141994168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141994175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14199415d
cmp eax, 0x7d00
jae 0x14199419b
cmp eax, 0x500
jb 0x141994196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14199407e
cmp eax, 0x7f
ja 0x14199419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14199407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1419941d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14199407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400030e0
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x20
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x140003104
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
je 0x140003192
mov rdi, r15
mov qword [rsp + 0x40], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140003160
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x140003160
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.140029600
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000317d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140003185
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x140003121
mov rbp, qword [rsp + 0x40]
sub r15, rdi
jmp 0x140003270
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x1400031a9
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400031ab
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400031dd
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.140029600
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000326d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140003218
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x14000324e
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.140013d20
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x14000326d
cmp rsi, rax
ja 0x140003221
test rsi, rsi
je 0x14000326d
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.140013d20
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x48]
mov rax, r15
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
Function at 0x140004c90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x60
xor r14d, r14d
mov rbx, rcx
cmp qword [0x140043578], r14
mov edi, r14d
je 0x140004e8f
cmp qword [0x140043500], r14
je 0x140004e8f
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140004e81
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140004cf4
lea r8, str.KfGetSyscallNumber___ERROR:_Unable_to_find__s___n
mov edx, 0x63
jmp 0x140004e72
cmp byte [rax + 3], 0xb8
jne 0x140004e66
mov r11, qword [0x140043578]
mov r9d, dword [rax + 4]
mov eax, dword [r11 + 0x3c]
add rax, r11
movzx ecx, word [rax + 0x14]
movzx edx, word [rax + 6]
add rcx, 0x20
cmp r14w, dx
jae 0x140004e5a
movsd xmm0, qword [0x1400365b0]
movups xmm1, xmmword [0x1400365a0]
mov qword [rsp + 0x80], rbp
mov rbp, qword [0x140043500]
mov qword [rsp + 0x58], rsi
lea rsi, [rcx + rax]
mov qword [rsp + 0x50], r12
movzx r12d, byte [0x1400365be]
mov qword [rsp + 0x48], r13
movzx r13d, word [0x1400365bc]
mov qword [rsp + 0x40], r15
mov r15d, edx
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rdx
nop
mov eax, dword [rsi + 0x1c]
and eax, 0x22000000
cmp eax, 0x20000000
jne 0x140004e20
mov ebx, dword [rsi]
mov r10d, r14d
sub ebx, 0x100
je 0x140004e20
mov r14d, dword [rsi + 4]
xor esi, esi
mov r15d, dword [0x1400365b8]
movsd qword [rsp + 0x30], xmm0
lea r8d, [r14 + r10]
mov dword [rsp + 0x38], r15d
mov rax, rsi
mov dword [rsp + 0x35], r9d
movups xmmword [rsp + 0x20], xmm1
mov word [rsp + 0x3c], r13w
mov byte [rsp + 0x3e], r12b
nop dword [rax + rax]
movzx edx, byte [rsp + rax + 0x20]
cmp dl, 0xff
je 0x140004df6
mov ecx, r8d
add rcx, rax
cmp dl, byte [rcx + r11]
jne 0x140004e05
inc rax
cmp rax, 0x1e
jl 0x140004de0
mov edi, r8d
add rdi, rbp
inc r10d
cmp r10d, ebx
jb 0x140004db1
mov rsi, qword [rsp + 0x88]
xor r14d, r14d
mov r15, qword [rsp + 0x90]
add rsi, 0x28
sub r15, 1
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], r15
jne 0x140004d80
mov r15, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x80]
mov rax, rdi
add rsp, 0x60
pop r14
pop rdi
pop rbx
ret
lea r8, str.KfGetSyscallNumber___ERROR:_Unexpected_code_for__s___n
mov edx, 0x70
mov r9, rbx
lea rcx, str.C:Users_adminDocumentsKforge2kforge_librarykforge_library.cpp
call fcn.140007260
lea r8, str.KfGetKernelZwProcAddress___ERROR:_KfGetSyscallNumber___fails_n
mov edx, 0x97
jmp 0x140004e9b
lea r8, str.KfGetKernelZwProcAddress___ERROR:_Not_initialized_n
mov edx, 0x90
lea rcx, str.C:Users_adminDocumentsKforge2kforge_librarykforge_library.cpp
call fcn.140007260
xor eax, eax
add rsp, 0x60
pop r14
pop rdi
pop rbx
ret
Function at 0x140006ed0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x50
xor ebx, ebx
mov r14, r8
mov qword [rsp + 0x30], rbx
mov r15, rdx
mov dword [rsp + 0x28], ebx
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov r8d, 7
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140007094
test r15, r15
je 0x140007084
test r14, r14
je 0x140007084
mov qword [rsp + 0x78], rdi
lea rdx, [rsp + 0x88]
mov rcx, rax
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x88], ebx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test eax, eax
je 0x140007057
cmp dword [rsp + 0x88], ebx
je 0x140006f70
lea r8, str.ReadFromFile___ERROR:_File_is_too_large_n
mov edx, 0x1c
jmp 0x140007063
mov rdx, rdi
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x140007021
xor r9d, r9d
mov dword [rsp + 0x40], ebx
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbx
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140006fdf
mov qword [r15], rsi
mov rcx, rbp
mov rsi, qword [rsp + 0x70]
mov ebx, 1
mov dword [r14], edi
mov rdi, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400070b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.ReadFile___ERROR__d_n
mov edx, 0x31
mov r9d, eax
lea rcx, str.C:Users_adminDocumentsKforge2commoncommon.cpp
call fcn.140007260
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, qword [rsp + 0x78]
mov rcx, rbp
mov rsi, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400070b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.M_ALLOC___ERROR__d_n
mov edx, 0x38
mov r9d, eax
lea rcx, str.C:Users_adminDocumentsKforge2commoncommon.cpp
call fcn.140007260
mov rdi, qword [rsp + 0x78]
mov rcx, rbp
mov rsi, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400070b5
lea r8, str.ReadFromFile__:_File_is_empty_n
mov edx, 0x3d
lea rcx, str.C:Users_adminDocumentsKforge2commoncommon.cpp
call fcn.140007260
mov rdi, qword [rsp + 0x78]
mov rcx, rbp
mov rsi, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400070b5
mov rcx, rbp
mov ebx, 1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400070b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.CreateFile___ERROR__d_n
mov edx, 0x5d
mov r9d, eax
lea rcx, str.C:Users_adminDocumentsKforge2commoncommon.cpp
call fcn.140007260
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rbp
ret
Function at 0x140007260
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov r14, r8
lea rbx, [rsp + 0xa8]
mov r12d, edx
mov rdi, rcx
call fcn.1400016d0
xor r13d, r13d
mov qword [rsp + 0x28], rbx
mov r9, r14
mov qword [rsp + 0x20], r13
xor r8d, r8d
xor edx, edx
mov rcx, qword [rax]
mov r15, rax
or rcx, 2
call fcn.1400125f8
test eax, eax
mov rbx, 0xffffffffffffffff
mov ecx, 0x40
cmovs eax, ebx
add eax, 0x104
movsxd rsi, eax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
je 0x1400073d6
mov rdx, rsi
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
jne 0x140007300
mov rcx, rbp
jmp 0x1400073d0
mov rcx, qword [r15]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
or rcx, 1
mov r9, r14
mov qword [rsp + 0x20], r13
mov r8, rbx
mov rdx, rbp
call fcn.1400125f8
inc rbx
cmp byte [rdi + rbx], r13b
jne 0x140007327
test rbx, rbx
je 0x140007357
mov rax, rdi
movzx ecx, byte [rax]
cmp cl, 0x5c
je 0x14000734a
cmp cl, 0x2f
je 0x14000734a
inc rax
jmp 0x140007351
lea rdi, [rax + 1]
mov rax, rdi
sub rbx, 1
jne 0x140007338
mov r9d, r12d
mov qword [rsp + 0x20], rbp
mov r8, rdi
lea rdx, str._s__d__:__s
mov rcx, rsi
call fcn.140007200
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, rsi
lea rcx, [0x140036d1c]
call fcn.1400016e0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400073c4
mov rcx, rsi
mov dword [rsp + 0x30], r13d
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r13
mov r8d, eax
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140007af0
Capabilities:
Delete file
Get common file path

Disassembly:
sub rsp, 0x148
mov rax, qword [0x14003c040]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rcx, qword [0x140043598]
test rcx, rcx
je 0x140007b61
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x104
mov qword [0x140043598], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, str.driverswinio.sys
mov edx, 0x104
lea rcx, [rsp + 0x20]
call fcn.140014600
call fcn.140007d70
call fcn.140007eb0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140008700
add rsp, 0x148
ret
Function at 0x140007b80
Capabilities:
Create service
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov edi, r8d
mov r14, rdx
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x140007d36
mov qword [rsp + 0x80], rbp
mov rcx, rax
test edi, edi
je 0x140007cb8
mov qword [rsp + 0x60], rbx
lea rbp, str.winio
mov qword [rsp + 0x58], rbx
mov r9d, 0x10030
mov qword [rsp + 0x50], rbx
mov r8, rbp
mov qword [rsp + 0x48], rbx
mov rdx, rbp
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov qword [rsp + 0x28], r14
lea r8, str.OpenService___TEST__p__s__s_n
mov r9, rax
mov qword [rsp + 0x20], rbp
mov edx, 0x16
lea rcx, str.C:Users_adminDocumentsKforge2common_service.cpp
mov rdi, rax
call fcn.140007260
test rdi, rdi
jne 0x140007cd3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x140007c95
mov r8d, 0x10030
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
jne 0x140007cd3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.OpenService___ERROR__d_n
mov edx, 0x1e
mov r9d, eax
lea rcx, str.C:Users_adminDocumentsKforge2common_service.cpp
call fcn.140007260
jmp 0x140007d23
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.CreateService___ERROR__d_n
mov edx, 0x23
mov r9d, eax
lea rcx, str.C:Users_adminDocumentsKforge2common_service.cpp
call fcn.140007260
jmp 0x140007d23
mov r8d, 0x10030
lea rdx, str.winio
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
je 0x140007d23
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x140007cf2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x140007cf9
mov ebx, 1
jmp 0x140007d1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.StartService___ERROR__d_n
mov edx, 0x3d
mov r9d, eax
lea rcx, str.C:Users_adminDocumentsKforge2common_service.cpp
call fcn.140007260
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x80]
jmp 0x140007d57
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.OpenSCManager___ERROR__d_n
mov edx, 0x48
mov r9d, eax
lea rcx, str.C:Users_adminDocumentsKforge2common_service.cpp
call fcn.140007260
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140007d70
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14003c040]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x140007e6d
mov r8d, 0xf01ff
mov qword [rsp + 0x60], rsi
lea rdx, str.winio
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
je 0x140007e3c
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140007e02
mov rcx, rsi
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x60]
jmp 0x140007e8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.ControlService___ERROR__d_n
mov edx, 0x62
mov r9d, eax
lea rcx, str.C:Users_adminDocumentsKforge2common_service.cpp
call fcn.140007260
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x60]
jmp 0x140007e8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.OpenService___ERROR__d_n
mov edx, 0x69
mov r9d, eax
lea rcx, str.C:Users_adminDocumentsKforge2common_service.cpp
call fcn.140007260
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x60]
jmp 0x140007e8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.OpenSCManager___ERROR__d_n
mov edx, 0x70
mov r9d, eax
lea rcx, str.C:Users_adminDocumentsKforge2common_service.cpp
call fcn.140007260
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140008700
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140007eb0
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x140007fb2
mov r8d, 0xf01ff
mov qword [rsp + 0x30], rdi
lea rdx, str.winio
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
je 0x140007f76
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x140007f31
mov rcx, rdi
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x30]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.DeleteService___ERROR__d_n
mov edx, 0x88
mov r9d, eax
lea rcx, str.C:Users_adminDocumentsKforge2common_service.cpp
call fcn.140007260
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x30]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.OpenService___ERROR__d_n
mov edx, 0x8f
mov r9d, eax
lea rcx, str.C:Users_adminDocumentsKforge2common_service.cpp
call fcn.140007260
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x30]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.OpenSCManager___ERROR__d_n
mov edx, 0x96
mov r9d, eax
lea rcx, str.C:Users_adminDocumentsKforge2common_service.cpp
call fcn.140007260
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret

Function at 0x140008c04
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140008c4e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140008c4e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140008c4e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140008c4e
cmp dword [rcx + 0x84], 0xe
jbe 0x140008c4e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140008c50
xor al, al
add rsp, 0x28
ret