joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c3e0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42c686
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1270]
mov rcx, qword [rax + 0x1260]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42c67a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1260], 0
cmp byte [0x0058e351], 0
jne 0x42c442
xor edx, edx
xor ebx, ebx
nop
jmp 0x42c48b
xor edx, edx
jmp 0x42c46e
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1270]
mov rax, rcx
call fcn.0041c9a0
mov rcx, qword [rsp + 0x28]
lea rdx, [rcx + 1]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42c446
add rax, 0x1260
call fcn.0042c260
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42c612
mov rsi, qword [rax + rdx*8 + 0x1270]
nop dword [rax]
cmp rsi, 0x1000
jb 0x42c488
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00411540
test rax, rax
jne 0x42c4e2
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42c488
nop
mov rsi, rcx
shr rcx, 3
and esi, 7
mov rdx, rcx
mov rcx, rsi
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rbx + 0x50]
movzx esi, byte [rdx]
test r8b, sil
je 0x42c525
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop dword [rax]
jmp 0x42c488
nop
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42c66d
lea r10, [0x005607b0]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x21040]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x21040]
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42c5ab
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42c5e5
mov r8, qword [rsp + 0x48]
mov r9, qword [r8 + 0x1248]
add r9, qword [rbx + 0x68]
mov qword [r8 + 0x1248], r9
mov rax, r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42c488
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42c665
mov r9, qword [rsp + 0x48]
mov qword [r9 + r8*8 + 0x1270], rax
lea rbx, [r8 + 1]
mov rax, r9
mov rdx, qword [rsp + 0x28]
jmp 0x42c488
cmp rbx, 0x200
ja 0x42c657
lea rdx, [rax + 0x1270]
lea rsi, [rax + 0x1238]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.004225c0
mov rdx, qword [rsp + 0x48]
lea rax, [rdx + 0x1260]
call fcn.0042c260
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
nop
call fcn.0045c180
mov rax, r8
call fcn.0045c100
mov rax, r8
mov ecx, 0x40
call fcn.0045c120
mov edx, 0x200
nop
call fcn.0045c160
nop
mov qword [rsp + 8], rax
call fcn.0045e120
mov rax, qword [rsp + 8]
jmp fcn.0042c3e0
Function at 0x44bce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44be58
movzx edx, byte [rax]
nop
test edx, edx
jne 0x44bd1c
test r8b, r8b
jne 0x44bd1c
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x44bd2f
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44be18
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x44be06
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x44bdfc
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x44bd83
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x44bdc6
mov eax, 1
cmp rax, rbx
ja 0x44bdb5
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.0045c1c0
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x44bdf4
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x44bdbd
mov r8d, eax
mov eax, r10d
jmp 0x44bd88
mov rcx, rbx
call fcn.0045c100
xor eax, eax
mov rcx, rbx
call fcn.0045c100
mov eax, r8d
mov rcx, rbx
call fcn.0045c1c0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44be4e
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x44be11
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44bd35
mov eax, edx
mov rcx, rbx
call fcn.0045c100
xor eax, eax
mov rcx, rbx
nop dword [rax]
call fcn.0045c100
nop
int3
Function at 0x4534c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45357b
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x004535c0]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.004598e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00459a20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004534c0
Function at 0x45bb40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4023cf
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00408cc0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00459a20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4023a0
cmp byte [0x0058e350], 0
je 0x45bb55
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x458b20
jmp 0x4023a0

Function at 0x45bb60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0058e600]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0058e350], 0
je 0x45bb95
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0058e8c0]
aesenc xmm0, xmmword [0x0058e8d0]
aesenc xmm0, xmmword [0x0058e8e0]
movq rax, xmm0
ret
jmp 0x408ec0

Function at 0x45bba0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0058e600]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0058e350], 0
je 0x45bbd6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0058e8c0]
aesenc xmm0, xmmword [0x0058e8d0]
aesenc xmm0, xmmword [0x0058e8e0]
movq rax, xmm0
ret
jmp 0x408f20

Function at 0x45d500
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x0058e840]
mov qword [rsp + 8], rdx
lea r8d, [0x0058e368]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.0045ba80
add rsp, 0x30
ret
Function at 0x140001014
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x14000e250
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1b8]
mov rax, qword [0x140028018]
xor rax, rbp
mov qword [rbp + 0x158], rax
lea rcx, [0x14002e556]
call fcn.140001645
mov dword [rbp + 4], 0
mov dword [rbp + 0x24], 0
mov qword [rbp + 0x48], 0
mov dword [rbp + 0x64], 0
mov qword [rbp + 0x88], 0
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0x188]
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
je 0x14000e309
jmp 0x14000e3b5
lea rax, [rbp + 0x64]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
je 0x14000e33f
jmp 0x14000e3b5
mov eax, dword [rbp + 0x64]
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jne 0x14000e364
jmp 0x14000e3b5
lea rax, [rbp + 0x64]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
je 0x14000e39d
jmp 0x14000e3b5
mov rax, qword [rbp + 0x198]
mov rcx, qword [rbp + 0x88]
mov qword [rax], rcx
mov dword [rbp + 4], 1
cmp dword [rbp + 4], 0
jne 0x14000e3d2
cmp qword [rbp + 0x88], 0
je 0x14000e3d2
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rbp + 0x48], 0
je 0x14000e3e3
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [rbp + 0x24]
call fcn.140001131
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.140001546
mov eax, edi
mov rcx, qword [rbp + 0x158]
xor rcx, rbp
call fcn.14000132a
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x14000104b
Capabilities:
Check if file exists
Get common file path

Disassembly:
jmp 0x140005c10
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x158]
mov rax, qword [0x140028018]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x14002e1cb]
call fcn.140001645
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
mov edx, 0x20a
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140005c8d
jmp 0x140005d7d
mov edx, 0x104
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x140005caa
jmp 0x140005d7d
lea rax, str.WaaSMedicCapsule.dll
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x28]
lea r8, [0x14001d2b8]
mov edx, 0x104
mov rcx, qword [rbp + 0x28]
call fcn.140001226
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140005d56
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140005d56
mov edx, 0x104
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x140005d00
jmp 0x140005d7d
lea rax, str.WaaSMedicCapsule.dll
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x28]
lea r8, str._wsUUS_amd64_ws
mov edx, 0x104
mov rcx, qword [rbp + 0x28]
call fcn.140001226
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140005d56
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140005d56
lea rdx, str.WaaSMedicCapsule.dll
lea rcx, str.____Failed_to_determine_file_path_for_file:__ws_r_n
call fcn.140001037
jmp 0x140005d7d
mov r9, qword [rbp + 0x28]
lea r8, [0x14001aea8]
mov edx, 0x104
mov rax, qword [rbp + 0x120]
mov rcx, qword [rax + 0x18]
call fcn.140001226
mov dword [rbp + 4], 1
lea rcx, [rbp + 0x28]
call fcn.1400010a5
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001bf10]
call fcn.140001546
mov eax, edi
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.14000132a
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400010e1
Capabilities:
Get common file path

Disassembly:
jmp 0x140007100
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x140028018]
xor rax, rbp
mov qword [rbp + 0x120], rax
lea rcx, [0x14002e1cb]
call fcn.140001645
mov dword [rbp + 4], 0
mov dword [rbp + 0x24], 0
mov qword [rbp + 0x48], 0
mov edx, 0x20a
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x140007184
jmp 0x14000725b
mov edx, 0x104
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1400071a1
jmp 0x14000725b
lea rax, str.TaskSchdPS.dll
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x48]
lea r8, [0x14001d2b8]
mov edx, 0x104
mov rcx, qword [rbp + 0x48]
call fcn.140001226
mov rcx, qword [rbp + 0x150]
call fcn.1400012fd
test eax, eax
jne 0x1400071dd
jmp 0x14000725b
mov dword [rbp + 0x24], 1
mov rcx, qword [rbp + 0x150]
call fcn.140001523
lea r9, str._SystemRoot__system32WaaSMedicPS.dll
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call fcn.140001122
test eax, eax
jne 0x140007211
jmp 0x14000725b
mov rcx, qword [rbp + 0x150]
call fcn.1400010af
mov qword [rbp + 0x118], rax
mov rcx, qword [rbp + 0x150]
call fcn.14000137a
mov rcx, qword [rbp + 0x118]
mov r9, rcx
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call fcn.140001122
test eax, eax
jne 0x140007254
jmp 0x14000725b
mov dword [rbp + 4], 1
cmp dword [rbp + 0x24], 0
je 0x14000726d
mov rcx, qword [rbp + 0x150]
call fcn.1400012da
lea rcx, [rbp + 0x48]
call fcn.1400010a5
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001b200]
call fcn.140001546
mov eax, edi
mov rcx, qword [rbp + 0x120]
xor rcx, rbp
call fcn.14000132a
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x14000110e
Capabilities:
Read file on windows
Write file on windows

Disassembly:
jmp 0x1400024e0
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x178]
mov rax, qword [0x140028018]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x14002e0a5]
call fcn.140001645
mov dword [rbp + 4], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x150]
mov rdx, qword [rbp + 0x148]
mov rax, qword [rbp + 0x140]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140002573
jmp 0x1400025b9
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x44]
mov r8d, 0x1000
mov rdx, qword [rbp + 0x158]
mov rax, qword [rbp + 0x140]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400025a6
jmp 0x1400025b9
mov rax, qword [rbp + 0x160]
mov ecx, dword [rbp + 0x44]
mov dword [rax], ecx
mov dword [rbp + 4], 1
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.140001546
mov eax, edi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.14000132a
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret

Function at 0x140001122
Capabilities:
Set registry value

Disassembly:
jmp 0x14000f2c0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x198]
mov rax, qword [0x140028018]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x14002e556]
call fcn.140001645
mov dword [rbp + 4], 0
mov dword [rbp + 0x24], 0
mov qword [rbp + 0x48], 0
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.ucrtbased.dll_wcslen]
inc eax
mov eax, eax
shl rax, 1
mov dword [rbp + 0x64], eax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rdx, qword [rbp + 0x168]
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
je 0x14000f378
jmp 0x14000f3b9
mov eax, dword [rbp + 0x64]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x178]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0x170]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
je 0x14000f3b2
jmp 0x14000f3b9
mov dword [rbp + 4], 1
cmp qword [rbp + 0x48], 0
je 0x14000f3ca
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [rbp + 0x24]
call fcn.140001131
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001ff40]
call fcn.140001546
mov eax, edi
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.14000132a
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x1400011c2
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
jmp 0x1400051b0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x4a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xbe
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4c8]
mov rax, qword [0x140028018]
xor rax, rbp
mov qword [rbp + 0x468], rax
lea rcx, [0x14002e1cb]
call fcn.140001645
mov dword [rbp + 4], 0
mov qword [rbp + 0x298], 0
mov qword [rbp + 0x2d8], 0
mov rcx, qword [rbp + 0x498]
call fcn.1400014a1
lea rcx, [rbp + 0x298]
call fcn.14000122b
test eax, eax
jne 0x140005241
jmp 0x140005310
lea rax, str._____________________________________
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x298]
lea r8, [0x14001d2b8]
mov edx, 0x104
mov rcx, qword [rbp + 0x298]
call fcn.140001226
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x2d8], rax
cmp qword [rbp + 0x2d8], 0xffffffffffffffff
jne 0x1400052a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1400052a0
mov dword [rbp + 4], 1
jmp 0x140005310
mov edx, 0x20a
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x2b8], rax
cmp qword [rbp + 0x2b8], 0
je 0x1400052f4
lea r9, [rbp + 0x5c]
lea r8, [0x14001aea8]
mov edx, 0x104
mov rcx, qword [rbp + 0x2b8]
call fcn.140001226
lea rdx, [rbp + 0x2b8]
mov rcx, qword [rbp + 0x498]
call fcn.140001442
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x2d8]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400052a4
mov dword [rbp + 4], 1
cmp dword [rbp + 4], 0
jne 0x140005329
mov rdx, qword [rbp + 0x298]
lea rcx, str.____Failed_to_enumerate_temp_directory:__ws_r_n
call fcn.140001037
cmp qword [rbp + 0x2d8], 0
je 0x14000534a
cmp qword [rbp + 0x2d8], 0xffffffffffffffff
je 0x14000534a
mov rcx, qword [rbp + 0x2d8]
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rbp + 0x298]
call fcn.1400010a5
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001c570]
call fcn.140001546
mov eax, edi
mov rcx, qword [rbp + 0x468]
xor rcx, rbp
call fcn.14000132a
lea rsp, [rbp + 0x478]
pop rdi
pop rbp
ret
Function at 0x14000122b
Capabilities:
Get common file path

Disassembly:
jmp 0x14000eb80
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x148]
mov rax, qword [0x140028018]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x14002e556]
call fcn.140001645
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
mov edx, 0x20a
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x14000ebf7
jmp 0x14000ec3c
mov edx, 0x104
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x14000ec0e
jmp 0x14000ec3c
mov r9, qword [rbp + 0x28]
lea r8, str._wsTemp
mov edx, 0x104
mov rcx, qword [rbp + 0x28]
call fcn.140001226
mov rax, qword [rbp + 0x120]
mov rcx, qword [rbp + 0x28]
mov qword [rax], rcx
mov dword [rbp + 4], 1
cmp dword [rbp + 4], 0
jne 0x14000ec4b
lea rcx, [rbp + 0x28]
call fcn.1400010a5
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140020340]
call fcn.140001546
mov eax, edi
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.14000132a
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400012b2
Capabilities:
Stop service

Disassembly:
jmp 0x14000f6b0
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x140028018]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, [0x14002e556]
call fcn.140001645
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rbp + 0x88], rax
lea r8, [rbp + 0x28]
mov edx, 0x24
mov rcx, qword [rbp + 0x1a0]
call fcn.140001474
test eax, eax
jne 0x14000f73c
jmp 0x14000f856
lea r8, [rbp + 0x48]
mov edx, 1
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14000f75d
jmp 0x14000f856
lea rdx, [rbp + 0x48]
mov rcx, qword [rbp + 0x28]
call fcn.140001154
test eax, eax
jne 0x14000f778
jmp 0x14000f856
cmp dword [rbp + 0x1a8], 0
je 0x14000f84f
mov rdx, qword [rbp + 0x1a0]
lea rcx, str.___Stopping_service__ws..._r_n
call fcn.140001037
cmp dword [rbp + 0x4c], 1
je 0x14000f828
xor edx, edx
mov eax, dword [rbp + 0x60]
mov ecx, 0xa
div ecx
mov dword [rbp + 0xa4], eax
cmp dword [rbp + 0xa4], 0x3e8
jae 0x14000f7cc
mov dword [rbp + 0xa4], 0x3e8
jmp 0x14000f7e2
cmp dword [rbp + 0xa4], 0x2710
jbe 0x14000f7e2
mov dword [rbp + 0xa4], 0x2710
mov ecx, dword [rbp + 0xa4]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x48]
mov rcx, qword [rbp + 0x28]
call fcn.140001154
test eax, eax
jne 0x14000f801
jmp 0x14000f828
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [rbp + 0x88]
cmp rax, 0x1388
jbe 0x14000f823
mov ecx, 0x5b4
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14000f828
jmp 0x14000f798
cmp dword [rbp + 0x4c], 1
jne 0x14000f83a
mov dword [rbp + 0x174], 1
jmp 0x14000f844
mov dword [rbp + 0x174], 0
mov eax, dword [rbp + 0x174]
mov dword [rbp + 4], eax
jmp 0x14000f856
mov dword [rbp + 4], 1
cmp qword [rbp + 0x28], 0
je 0x14000f867
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [rbp + 4], 0
jne 0x14000f880
mov rdx, qword [rbp + 0x1a0]
lea rcx, str.____Failed_to_stop_service__ws._r_n
call fcn.140001037
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.140001546
mov eax, edi
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.14000132a
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret