joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010900
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x140199bd4], 0
mov rbx, rcx
jg 0x1400109c6
xor ecx, ecx
call fcn.140009000
cmp byte [rbx + 0x194], 0
jle 0x14001092f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
mov r8d, 0x7530
lea edx, [r9 + 0x68]
call qword [sym.imp.USER32.dll_SetTimer]
mov byte [rbx + 0x194], 1
mov rcx, qword [0x14019ab58]
test rcx, rcx
je 0x14001096d
mov rax, qword [rcx]
lea rdx, str.THREAD__wait_OnExit
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [0x14019ab58]
cmp dword [rbx + 0x198], 0
jle 0x14001097f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor r9d, r9d
or rdx, 0xffffffffffffffff
lea r8d, [r9 + 5]
call fcn.14001e770
mov qword [0x14019ab58], 0
mov rcx, qword [rbx + 0x40]
mov edx, 0x68
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
lea edx, [r9 + 0x68]
lea r8d, [r9 + 0x64]
call qword [sym.imp.USER32.dll_SetTimer]
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
add rsp, 0x20
pop rbx
ret

Function at 0x140012e90
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x230], rax
movsxd rax, dword [0x1401a0c8c]
xor edi, edi
mov rbp, rcx
cmp eax, 1
mov rbx, rdi
jle 0x140012ee4
cmp byte [0x14019ab52], bl
jne 0x140012ee4
mov rcx, rax
mov rax, qword [0x1401a0c98]
mov rbx, qword [rax + rcx*8 - 8]
test rbx, rbx
mov esi, 1
cmovne rsi, rbx
test rbx, rbx
jne 0x140012f12
lea rdx, [rsp + 0x20]
lea rcx, [0x14013f8a8]
mov r8d, 0x104
lea rbx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r9, qword [rbp + 0x1158]
test rbx, rbx
je 0x140012f30
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea edi, [rcx - 1]
lea rcx, [r9 + 0x170]
mov r8d, edi
mov rdx, rbx
call fcn.140002570
mov rcx, qword [rbp + 0x1158]
add rcx, 0x170
mov rax, qword [rcx]
cmp word [rax], 0
je 0x140012f73
cmp word [rax + 2], 0x3a
jne 0x140012f73
cmp word [rax + 4], 0
jne 0x140012f73
lea rdx, [0x14013e968]
call fcn.140004a90
mov rcx, qword [rbp + 0x1150]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
call fcn.14000d8c0
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14010bcc0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140018894
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, qword [rbx + 0x20]
mov edx, 9
mov rbp, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edi, edi
lea rdx, [rsp + 0x60]
lea r8d, [rdi + 0x64]
mov rcx, rbp
mov rsi, rax
mov word [rsp + 0x60], di
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rbx + 0x20]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x54], edi
call qword [sym.imp.USER32.dll_ClientToScreen]
lea r8d, [rdi + 0x10]
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.14010c6c0
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r8d, dword [rsp + 0x40]
mov r9d, dword [rsp + 0x44]
mov edi, dword [rsp + 0x48]
mov ebx, dword [rsp + 0x4c]
mov dword [rsp + 0x30], 4
sub edi, r8d
sub r8d, dword [rsp + 0x50]
sub ebx, r9d
sub r9d, dword [rsp + 0x54]
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x44], r9d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov r8d, dword [rsp + 0x44]
mov edx, dword [rsp + 0x40]
mov r9d, edi
mov rcx, rsi
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_MoveWindow]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14010bcc0
mov rbx, qword [rsp + 0x170]
add rsp, 0x140
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001cf54
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [0x14019bce0]
mov rbx, rcx
mov byte [rcx], 0x11
mov edx, 0x10000
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x14001ced8]
xor ecx, ecx
mov dword [rsp + 0x20], edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14001cf97
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001cf9a
mov byte [rbx], 0
add rsp, 0x30
pop rbx
ret
Function at 0x14001d030
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor eax, eax
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x21], rax
mov qword [rsp + 0x29], rax
mov dword [rsp + 0x31], eax
mov word [rsp + 0x35], ax
mov byte [rsp + 0x37], al
cmp word [0x1401b5004], ax
jne 0x14001d0a0
lea r9d, [rax + 0x18]
lea r8, [rsp + 0x20]
lea edx, [rax + 0xb]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea rcx, [rsp + 0x20]
call fcn.140064150
movzx ecx, word [0x1401b5004]
cmp eax, 1
cmovg cx, ax
mov word [0x1401b5004], cx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14010bcc0
add rsp, 0x48
ret

Function at 0x14001d1a8
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
lea rcx, [rax + 0x10]
xor ebx, ebx
mov dword [rax + 0x10], 8
mov dword [rax + 0x14], ebx
call qword [sym.imp.USER32.dll_GetLastInputInfo]
mov edx, dword [0x14019bd04]
mov eax, dword [rsp + 0x3c]
sub eax, edx
cmp eax, ebx
cmovg edx, dword [rsp + 0x3c]
mov dword [0x14019bd04], edx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14019bd04], eax
mov al, byte [0x1401958af]
cmp al, bl
jle 0x14001d241
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x3c], ebx
call qword [sym.imp.USER32.dll_GetLastInputInfo]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, dword [rsp + 0x3c]
mov ecx, eax
sub ecx, r8d
cmp ecx, edi
jb 0x14001d22a
mov edx, dword [0x14019bd04]
sub eax, edx
cmp eax, edi
jae 0x14001d24c
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11b, byte [0x1401958af]
cmp r11b, bl
jg 0x14001d1fb
mov r8d, dword [rsp + 0x3c]
mov edx, dword [0x14019bd04]
mov ecx, r8d
sub ecx, edx
cmp ecx, ebx
mov cl, byte [0x1401958af]
cmovg edx, r8d
cmp cl, bl
setg bl
mov dword [0x14019bd04], edx
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14001d2f8
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x20]
lea rcx, str.DEBUGMDG
mov r8d, 0x63
mov byte [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
movzx r11d, byte [0x14019bd00]
cmp byte [rsp + 0x20], 0x31
mov eax, 1
cmove r11d, eax
mov byte [0x14019bd00], r11b
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14010bcc0
add rsp, 0xa8
ret
Function at 0x14001d5c4
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0xe0
xor ebp, ebp
xor eax, eax
mov bl, r8b
mov rsi, rcx
mov dil, dl
mov dword [rsp + 0x70], 0x68
lea r8d, [rbp + 0x58]
lea rcx, [r11 - 0x68]
xor edx, edx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [r11 - 0x70], rbp
call fcn.14010c6c0
cmp bl, bpl
je 0x14001d627
or dword [rsp + 0xac], 1
mov word [rsp + 0xb0], bp
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rdx, rsi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebp
je 0x14001d68f
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dil, bpl
je 0x14001d684
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14001d6a8
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x430
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
lea rcx, str.SHOWEWFMSG
mov r8d, 0x3ff
mov byte [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp byte [rsp + 0x20], 0x31
jne 0x14001d6ff
lea r8, [0x1401463dc]
xor r9d, r9d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.14010bcc0
add rsp, 0x430
pop rbx
ret

Function at 0x14001d718
Capabilities:
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
mov qword [rax - 0x10], rcx
mov rsi, rdx
xor r9d, r9d
xor edx, edx
or rcx, 0xffffffffffffffff
mov r8d, 0x8000004
mov dword [rax - 0x18], 0x64
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdi, rax
test rax, rax
je 0x14001d7a7
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x14001d7a7
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x64]
call fcn.14001d364
mov dword [rbx], 0xffffffff
mov qword [rbx + 0x10], rsi
lea rcx, [rbx + 8]
mov qword [0x140195610], rcx
mov qword [0x14019bd18], rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14001d7e8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov al, byte [0x1401958af]
mov ebx, 0x14
cmp al, 2
je 0x14001d805
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x14019bd18]
mov ecx, 0x1e
test rax, rax
cmovne ebx, ecx
jmp 0x14001d830
mov rax, qword [0x14019bd08]
test rax, rax
je 0x14001d835
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
jns 0x14001d819
mov rcx, qword [0x14019bd08]
test rcx, rcx
je 0x14001d854
xor edx, edx
mov qword [0x14019bd08], 0
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [0x1401958af], 0xff
add rsp, 0x20
pop rbx
ret

Function at 0x14001d864
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
xor ecx, ecx
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r9d, r9d
xor edx, edx
mov r8d, 0x8000004
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 0x64
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov bl, 1
mov rdi, rax
test rax, rax
je 0x14001d8c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14001d8db
xor bl, bl
jmp 0x14001d8db
mov r8, rbp
xor edx, edx
mov ecx, 0x8000004
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov rdi, rax
test rax, rax
je 0x14001d92c
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rdi
mov qword [0x14019bd28], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11, qword [0x14019bd28]
test r11, r11
je 0x14001d92c
test bl, bl
je 0x14001d929
xor edx, edx
mov rcx, r11
lea r8d, [rdx + 0x64]
call fcn.14010c6c0
mov r11, qword [0x14019bd28]
mov qword [r11], rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14001db98
Capabilities:
Query environment variable

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov esi, r9d
mov rbx, r8
mov rbp, rdx
mov r12, rcx
xor r13d, r13d
cmp rdx, r13
je 0x14001dcfd
cmp word [rdx], r13w
je 0x14001dcfd
lea eax, [r13 + 0x26]
cmp ax, word [rdx]
je 0x14001dc5f
lea rdi, [0x14019cf50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp rbx, r13
je 0x14001dbff
mov rdx, qword [rbx]
jmp 0x14001dc02
mov rdx, r13
cmp rdx, r13
je 0x14001dc0c
cmp esi, r13d
jg 0x14001dc14
lea rdx, [rsp + 0x58]
mov esi, r13d
mov word [rdx], r13w
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
movsxd rbx, eax
cmp ebx, r13d
jg 0x14001dc4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jne 0x14001dc4e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, 0xfffffffffffffffe
jmp 0x14001dd01
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rbx
jmp 0x14001dd01
lea rdi, [0x14019cf50]
mov qword [rsp + 0x58], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [r12 + 8]
call fcn.14002b14c
mov rbp, rax
cmp rax, r13
je 0x14001dce0
mov r12d, 0x3fffffff
cmp rbx, r13
je 0x14001dcd8
mov rcx, qword [rbx]
cmp rcx, r13
je 0x14001dcd1
cmp esi, r13d
jle 0x14001dcd1
mov eax, dword [rax + 0x18]
and eax, r12d
add eax, 3
cdq
sub eax, edx
sar eax, 1
add eax, eax
cmp esi, eax
cmovg esi, eax
cmp esi, r13d
jle 0x14001dcd8
movsxd r8, esi
mov rdx, qword [rbp + 8]
call fcn.14010cd30
jmp 0x14001dcd8
mov rax, qword [rax + 8]
mov qword [rbx], rax
mov ebx, dword [rbp + 0x18]
and rbx, r12
jmp 0x14001dcef
cmp rbx, r13
je 0x14001dce8
mov qword [rbx], r13
mov rbx, 0xfffffffffffffffe
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rbx
jmp 0x14001dd01
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x14001dd1c
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rbx, rdx
mov rsi, rcx
mov qword [rax - 0x20], rcx
and dword [rax - 0x48], 0
mov edx, 0x169
lea rcx, [rax - 0x40]
call fcn.140063580
mov rbp, qword [rsp + 0x38]
add rbp, 0xc8
mov r8d, 0x104
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
and dword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov r12d, eax
test eax, eax
je 0x14001de27
and dword [rsp + 0x30], 0
and qword [rsp + 0x48], 0
mov rdx, r12
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rbx, rax
mov r9, rax
mov r8d, r12d
mov edx, dword [rsp + 0x40]
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoW
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x48]
lea rdx, [0x14013fc88]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
mov r11, qword [rsp + 0x48]
movzx eax, word [r11 + 0x14]
movzx ecx, word [r11 + 0x16]
movzx r9d, word [r11 + 0x10]
movzx r8d, word [r11 + 0x12]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str._u._u._u._u
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x38]
mov qword [rsi], rcx
and qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 1
lea rcx, [rsp + 0x38]
call fcn.14005b520
mov rax, rsi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x14001ed90
Capabilities:
Terminate process

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rcx
movzx ebx, word [rcx]
add rcx, 8
mov qword [rsp + 0x70], rcx
mov ebp, 0x20
lea r12d, [rbp - 0x17]
cmp r12w, word [rcx]
ja 0x14001edca
cmp word [rcx], 0xd
jbe 0x14001edd8
cmp bp, word [rcx]
je 0x14001edd8
add rcx, 2
mov qword [rsp + 0x70], rcx
call fcn.14001d2f8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14019bd04], eax
xor edi, edi
mov qword [rsp + 0x80], rdi
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x88]
call fcn.140071240
nop
lea rcx, [rsp + 0x78]
call fcn.140063500
nop
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, qword [rsp + 0x88]
lea rcx, [0x14019c170]
call fcn.14006bc40
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x80]
call fcn.140071480
mov r11, qword [rsp + 0x80]
mov qword [rsp + 0x70], r11
lea rcx, [rsp + 0x78]
call fcn.14005b520
nop
lea rcx, [rsp + 0x88]
call fcn.14005b520
mov rcx, qword [rsp + 0x70]
call fcn.14001d278
mov qword [rsp + 0x70], rax
lea r8d, [rdi + 0xf]
mov rdx, rax
lea rcx, str._InstallService
call fcn.14001d2a0
cmp eax, edi
je 0x14001eeb9
lea r8d, [rdi + 0x1e]
lea rdx, [0x140146808]
mov rcx, qword [rsp + 0x70]
call fcn.14010cd30
mov rcx, qword [rsp + 0x70]
add rcx, 0x1e
call fcn.14001d278
mov qword [rsp + 0x70], rax
jmp 0x14001eeda
mov r8d, 8
lea rdx, [rsp + 0x70]
lea rcx, [0x1401467f8]
call fcn.140065780
cmp al, dil
je 0x14001ef3e
mov rax, qword [rsp + 0x70]
mov esi, 0x22
cmp si, bx
jne 0x14001ef2d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x70]
lea rdx, [rax + rcx*2 - 2]
cmp rdx, rax
jbe 0x14001ef2d
cmp r12w, word [rdx]
ja 0x14001ef0b
cmp word [rdx], 0xd
jbe 0x14001ef10
cmp bp, word [rdx]
jne 0x14001ef1b
sub rdx, 2
cmp rdx, rax
jbe 0x14001ef2d
jmp 0x14001eeff
cmp rdx, rax
jbe 0x14001ef2d
cmp si, word [rdx]
jne 0x14001ef2d
mov word [rdx], di
mov rax, qword [rsp + 0x70]
mov rcx, rax
call fcn.1400296d4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r8d, 0xe
lea rdx, [rsp + 0x70]
lea rcx, [0x1401467e8]
call fcn.140065780
cmp al, dil
je 0x14001ef6d
mov rcx, qword [rsp + 0x70]
call fcn.14001ff80
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [rsp + 0x80]
call fcn.14005b520
xor eax, eax
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001ef88
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
mov bpl, dl
xor edx, edx
mov sil, r9b
mov rdi, r8
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbx]
mov qword [0x14019bd08], 0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbx], 0
test rdi, rdi
je 0x14001efed
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001efed
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rdi], 0
test sil, sil
je 0x14001f003
lea rcx, str.shutdown__a
mov r8b, 1
xor edx, edx
call fcn.14001d5c4
mov rcx, qword [0x14019bd78]
call fcn.14001d4f4
test bpl, bpl
je 0x14001f031
mov ebx, 2
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_AbortSystemShutdownW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
jns 0x14001f019
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001ff80
Capabilities:
Delete service
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x860
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x850], rax
movzx eax, word [rcx]
mov ebp, 0x20
mov rdi, rcx
mov rdx, rcx
xor esi, esi
lea r12d, [rbp - 0x17]
jmp 0x14001ffd5
cmp r12w, ax
ja 0x14001ffc9
cmp ax, 0xd
jbe 0x14001ffda
cmp bp, ax
je 0x14001ffda
add rdi, 2
mov ax, word [rdi]
cmp ax, si
jne 0x14001ffbd
mov rax, rdi
sub rax, rcx
mov ecx, 0x400
sar rax, 1
cmp eax, ecx
cmovg eax, ecx
lea rcx, [rsp + 0x40]
cdqe
lea rbx, [rax + rax]
mov r8, rbx
call fcn.14010cd30
mov word [rsp + rbx + 0x40], si
cmp r12w, word [rdi]
ja 0x140020011
cmp word [rdi], 0xd
jbe 0x140020016
cmp bp, word [rdi]
jne 0x14002001c
add rdi, 2
jmp 0x140020005
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
cmp rax, rsi
je 0x1400200b3
lea rdx, [rsp + 0x40]
mov r8d, 0x10020
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
cmp rax, rsi
je 0x1400200b3
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
cmp eax, esi
je 0x140020073
lea rcx, [0x140146a80]
call fcn.14001d6a8
mov ebp, 0xc8
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
lea rcx, [0x140146a70]
cmp eax, esi
jne 0x14002009b
lea rcx, [0x140146a60]
call fcn.14001d6a8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400200d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140146a50]
cmp eax, 0x424
je 0x1400200ce
lea rcx, [0x140146a40]
call fcn.14001d6a8
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.14010bcc0
lea r11, [rsp + 0x860]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140029f44
Capabilities:
Check os version
Read file via mapping

Disassembly:
push rbx
sub rsp, 0x70
lea rcx, [0x14019be00]
mov dword [0x14019be00], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [0x14019be04], 5
je 0x140029f71
xor eax, eax
jmp 0x14002a068
mov eax, dword [0x14019be08]
test eax, eax
je 0x140029f87
cmp eax, 1
jne 0x140029f6a
mov ebx, 0x39000
jmp 0x140029f8c
mov ebx, 0x30000
lea rdx, str.DevicePhysicalMemory
lea rcx, [rsp + 0x30]
call qword [0x14019bf18]
and qword [rsp + 0x48], 0
and dword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
and qword [rsp + 0x68], 0
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rcx, [0x14019bf58]
mov edx, 6
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 0x30
call qword [0x14019bdc0]
cmp eax, 0xc0000022
jne 0x14002a02c
lea r8, [rsp + 0x40]
lea rcx, [0x14019bf58]
mov edx, 0x60000
call qword [0x14019bdc0]
mov rcx, qword [0x14019bf58]
call fcn.140029df4
mov rcx, qword [0x14019bf58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0x40]
lea rcx, [0x14019bf58]
mov edx, 6
call qword [0x14019bdc0]
test eax, eax
js 0x140029f6a
mov rcx, qword [0x14019bf58]
xor r8d, r8d
mov r9d, ebx
lea edx, [r8 + 6]
mov qword [rsp + 0x20], 0x1000
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x14019bf50], rax
neg rax
sbb rax, rax
and rax, qword [0x14019bf58]
add rsp, 0x70
pop rbx
ret

Function at 0x14002a070
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov eax, edx
mov rdi, rdx
mov esi, edx
shr rax, 0x16
mov r9d, dword [rcx + rax*4]
mov eax, r9d
and eax, 1
test al, al
jne 0x14002a09c
xor eax, eax
jmp 0x14002a108
mov eax, r9d
and eax, 0x80
test al, al
je 0x14002a0b8
mov ebx, r9d
xor ebx, edx
and ebx, 0x3fffff
xor ebx, r9d
jmp 0x14002a106
mov rcx, qword [0x14019bf58]
xor r8d, r8d
and r9d, 0xfffff000
lea edx, [r8 + 4]
mov qword [rsp + 0x20], 0x1000
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
shr rsi, 0xc
mov ecx, eax
and esi, 0x3ff
mov eax, dword [rcx + rsi*4]
and eax, 1
test al, al
je 0x14002a098
mov ebx, dword [rcx + rsi*4]
xor ebx, edi
and ebx, 0xfff
xor ebx, dword [rcx + rsi*4]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14002a118
Capabilities:
Read file via mapping

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, rcx
mov rcx, qword [0x14019bf50]
call fcn.14002a070
mov rcx, qword [0x14019bf58]
xor r8d, r8d
mov r9d, eax
lea edx, [r8 + 6]
mov rbx, rax
and r9d, 0xfffff000
mov qword [rsp + 0x20], 0x1000
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rax
test rax, rax
je 0x14002a175
mov eax, ebx
shr rax, 2
and eax, 0x3ff
mov ebx, dword [rcx + rax*4]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, ebx
add rsp, 0x30
pop rbx
ret