joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000bf90
Capabilities:
Query service status

Disassembly:
jmp 0x14000bf90
mov rax, rsp
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400623f0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
lea rax, str.CheckPreviousServiceStatus
mov qword [rsp + 0x38], rax
lea rbp, str.__CheckPreviousServiceStatus_
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 3
lea r9, [0x14004b650]
mov r8d, 0x55
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0x40]
call fcn.1400010c8
mov r8, qword [rsp + 0x38]
lea rdx, str.ENTER__s
lea rcx, [rsp + 0x40]
call fcn.1400016e5
nop
xor eax, eax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xa8], eax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14000c091
mov ebx, 0x80004003
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
lea r9, [0x14004b650]
lea r8d, [rax + 0x5e]
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0x68]
call fcn.1400010c8
mov rcx, rax
mov r8d, ebx
lea rdx, str.Error_Code:_0x_x
call fcn.1400016e5
jmp 0x14000c160
mov r8d, 0xf01ff
lea rdx, str.TOSRMService
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x14000c0ed
mov ebx, 0x80004003
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
lea r9, [0x14004b650]
lea r8d, [rax + 0x61]
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0x68]
call fcn.1400010c8
mov rcx, rax
mov r8d, ebx
lea rdx, str.Error_Code:_0x_x
call fcn.1400016e5
jmp 0x14000c156
lea rdx, [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
setne al
test al, al
jne 0x14000c14b
mov ebx, 0x80004005
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 0
lea r9, [0x14004b650]
mov r8d, 0x63
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0x68]
call fcn.1400010c8
mov rcx, rax
mov r8d, ebx
lea rdx, str.Error_Code:_0x_x
call fcn.1400016e5
jmp 0x14000c14d
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov r8, qword [rsp + 0x38]
lea rdx, str.LEAVE__s
lea rcx, [rsp + 0x40]
call fcn.1400016e5
mov eax, ebx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140011b90
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000d5a0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
jmp 0x14000d5a0
mov rax, rsp
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400623f0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
lea rax, str.UninstallService
mov qword [rsp + 0x38], rax
lea rbp, str.__UninstallService_
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 3
lea r9, [0x14004b650]
mov r8d, 0xab
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0x40]
call fcn.1400010c8
mov r8, qword [rsp + 0x38]
lea rdx, str.ENTER__s
lea rcx, [rsp + 0x40]
call fcn.1400016e5
nop
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14000d685
mov edi, 0x80004003
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
lea r9, [0x14004b650]
mov r8d, 0xb2
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0x68]
call fcn.1400010c8
mov rcx, rax
mov r8d, edi
lea rdx, str.Error_Code:_0x_x
call fcn.1400016e5
jmp 0x14000d72e
mov r8d, 0xf01ff
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14000d6df
mov edi, 0x80004003
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
lea r9, [0x14004b650]
mov r8d, 0xb5
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0x68]
call fcn.1400010c8
mov rcx, rax
mov r8d, edi
lea rdx, str.Error_Code:_0x_x
call fcn.1400016e5
jmp 0x14000d724
lea rdx, [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [rsp + 0x94], 1
je 0x14000d710
lea r8, [rsp + 0x90]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
xor edi, edi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov r8, qword [rsp + 0x38]
lea rdx, str.LEAVE__s
lea rcx, [rsp + 0x40]
call fcn.1400016e5
mov eax, edi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140011b90
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140010374
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14001038c
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14001038e
xor eax, eax
test eax, eax
je 0x14001039e
mov ecx, eax
call fcn.140014520
or eax, 0xffffffff
jmp 0x1400103a0
xor eax, eax
add rsp, 0x28
ret
Function at 0x417960
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417b06
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004372c0
xorps xmm15, xmm15
mov r14, qword [0x005a43c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4179cb
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4179e7
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.00451820
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
test rbx, rbx
jbe 0x417a0b
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417a1f
cmp rbx, 0x1000
jae 0x4179d5
jmp 0x417a89
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417a31
xor edx, edx
jmp 0x417a80
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004372c0
xorps xmm15, xmm15
mov r14, qword [0x005a43c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x417a15
jmp 0x417a00
call fcn.00467be0
xorps xmm15, xmm15
mov r14, qword [0x005a43c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043ba80
lea rax, [0x004c96c0]
mov ebx, 0x18
call fcn.0043c380
mov rax, qword [rsp + 0x38]
call fcn.0043c080
lea rax, [0x004c9780]
mov ebx, 0x19
call fcn.0043c380
mov rax, qword [rsp + 0x30]
nop
call fcn.0043c080
call fcn.0043bce0
call fcn.0043bb00
lea rax, [0x004cb9c1]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.0043a240
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00417960
Function at 0x417b40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417d6a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00437360
xorps xmm15, xmm15
mov r14, qword [0x005a43c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x417bb9
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x417be0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rcx
call fcn.00451820
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
test rbx, rbx
jbe 0x417c05
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x417c19
cmp rbx, 0x1000
jae 0x417bc3
nop dword [rax]
jmp 0x417c94
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x417c2d
xor esi, esi
jmp 0x417c8a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00437360
xorps xmm15, xmm15
mov r14, qword [0x005a43c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x417c0f
jmp 0x417bf4
call fcn.00467be0
xorps xmm15, xmm15
mov r14, qword [0x005a43c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417d0c
call fcn.0043ba80
lea rax, [0x004c9b4f]
mov ebx, 0x19
call fcn.0043c380
mov rax, qword [rsp + 0x68]
call fcn.0043c080
lea rax, [0x004c9780]
mov ebx, 0x19
call fcn.0043c380
mov eax, dword [rsp + 0x34]
call fcn.0043c080
call fcn.0043bce0
call fcn.0043bb00
lea rax, [0x004c675c]
mov ebx, 0xd
call fcn.0043a240
cmp eax, 0x5af
je 0x417cb7
call fcn.0043ba80
lea rax, [0x004c9b4f]
mov ebx, 0x19
call fcn.0043c380
mov rax, qword [rsp + 0x38]
call fcn.0043c080
lea rax, [0x004c9780]
mov ebx, 0x19
nop
call fcn.0043c380
mov eax, dword [rsp + 0x34]
call fcn.0043c080
call fcn.0043bce0
call fcn.0043bb00
lea rax, [0x004cb2d5]
mov ebx, 0x1f
call fcn.0043a240
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00417b40
Function at 0x422fc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4230be
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x423000
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x4230af
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.00423b20
nop dword [rax]
test rax, rax
je 0x4230af
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00423100]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.00463ee0
xorps xmm15, xmm15
mov r14, qword [0x005a43c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x42309d
xor eax, eax
jmp 0x4230a7
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x422ff2
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00464020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00422fc0

Function at 0x45c260
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45c319
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x0045c360]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00463ee0
xorps xmm15, xmm15
mov r14, qword [0x005a43c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00464020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0045c260
Function at 0x4660c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x402f8f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409a20
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x402f60
cmp byte [0x005a41ef], 0
je 0x4660d5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x463120
jmp 0x402f60

Function at 0x4660e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x409e8f
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
call fcn.00409f80
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x005a44a0]
movabs rdx, 0xa0761d6478bd642f
xor rbx, rdx
mov rax, rcx
call fcn.00409f60
mov rbx, rax
movabs rax, 0x1d8e4e27c47d124b
nop dword [rax]
call fcn.00409f60
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x409e20
cmp byte [0x005a41ef], 0
je 0x466115
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005a47e0]
aesenc xmm0, xmmword [0x005a47f0]
aesenc xmm0, xmmword [0x005a4800]
movq rax, xmm0
ret
jmp 0x409e20

Function at 0x466120
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x409f2f
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
call fcn.00409fc0
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x005a44a0]
movabs rdx, 0xa0761d6478bd642f
xor rbx, rdx
mov rax, rcx
call fcn.00409f60
mov rbx, rax
movabs rax, 0x1d8e4e27c47d1247
nop dword [rax]
call fcn.00409f60
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x409ec0
cmp byte [0x005a41ef], 0
je 0x466156
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005a47e0]
aesenc xmm0, xmmword [0x005a47f0]
aesenc xmm0, xmmword [0x005a4800]
movq rax, xmm0
ret
jmp 0x409ec0

Function at 0x467b60
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x005a4760]
mov qword [rsp + 8], rdx
lea r8d, [0x005a4204]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00466000
add rsp, 0x30
ret
Function at 0x4680a0
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4680d0
mov rcx, 0x28
jmp 0x4680db
shl rcx, 3
add rcx, 0x1480
mov qword [0x005a43c0], rcx
ret
Function at 0x492f80
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x493176
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x40], xmm15
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xc0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0
call fcn.00402ee0
xorps xmm15, xmm15
mov r14, qword [0x005a43c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
jne 0x493012
jmp 0x49305d
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
lea rdx, [0x004d4378]
mov qword [rsp + 0x40], rdx
lea rsi, [0x004d3d70]
mov qword [rsp + 0x48], rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x38], rcx
inc rcx
mov qword [rsp + 0x30], rcx
lea rax, [0x004b2480]
mov rbx, rcx
nop dword [rax]
call fcn.0044c920
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0xa0], rsi
mov rdx, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xb8]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdx
mov rsi, qword [rsp + 0x98]
mov qword [rsp + 0x28], rsi
cmp rsi, rdx
jg 0x4930ea
jmp 0x4930f1
mov qword [rsp + 0x28], rdx
jmp 0x4930f3
jmp 0x4930f3
mov rdx, qword [rsp + 0x90]
nop dword [rax + rax]
cmp qword [rsp + 0x50], rdx
jne 0x493109
jmp 0x493127
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x50]
call fcn.00467020
jmp 0x493129
jmp 0x493129
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
mov r9, qword [rsp + 0x88]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], r9
movups xmmword [rsp + 0x40], xmm15
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00492f80
Function at 0x493340
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x49359a
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x40], xmm15
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xc0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0
call fcn.00402ee0
xorps xmm15, xmm15
mov r14, qword [0x005a43c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
jne 0x4933d2
jmp 0x49341d
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
lea rdx, [0x004d4378]
mov qword [rsp + 0x40], rdx
lea rsi, [0x004d3d70]
mov qword [rsp + 0x48], rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rdx, qword [rsp + 0xc0]
mov qword [rsp + 0x38], rdx
lea rcx, [rdx + rdx]
lea rcx, [rcx + 1]
lea rax, [0x004b23c0]
xor ebx, ebx
nop dword [rax + rax]
call fcn.0044c920
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 0
lea rdx, [rdx + rdx]
lea rdx, [rdx + 1]
mov qword [rsp + 0x88], rdx
mov rdx, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xc0]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], 0
jmp 0x493490
mov rdx, qword [rsp + 0x30]
cmp qword [rsp + 0x58], rdx
jg 0x4934a5
nop dword [rax]
jmp 0x49352e
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x50]
add rdx, qword [rsp + 0x30]
movzx edx, byte [rdx]
mov dword [rsp + 0x24], edx
cmp edx, 0x80
jl 0x4934ca
jmp 0x4934d1
inc qword [rsp + 0x30]
jmp 0x4934f0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
call fcn.0045f6c0
mov dword [rsp + 0x24], eax
mov qword [rsp + 0x30], rbx
jmp 0x4934f0
mov edi, dword [rsp + 0x24]
mov dword [rsp + 0x20], edi
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
call fcn.00491280
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rcx
jmp 0x493529
jmp 0x493490
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
xor edi, edi
call fcn.00491280
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
movups xmmword [rsp + 0x40], xmm15
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00493340
Function at 0x140001487
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140026a90]
mov dword [rax], 1
mov rax, qword [0x140026aa0]
mov dword [rax], 1
mov rax, qword [0x140026ab0]
mov dword [rax], 1
mov rax, qword [0x140026a20]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014d8
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140001504
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000152a
cmp eax, 0x20b
je 0x140001551
jmp 0x140001580
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000153d
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001585
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000156c
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001585
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140014bb0
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rcx, qword [0x14002f0a8]
test rcx, rcx
je 0x140014bfa
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140014bed
mov rcx, qword [0x14002f0a8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002f0a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x1400318c0], 1
jne 0x140014cbf
xorps xmm6, xmm6
movaps xmmword [rsp + 0x20], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x40], xmm6
mov dword [rsp + 0x28], 3
lea rsi, [0x14002f0c0]
mov qword [rsp + 0x30], rsi
lea rbx, [0x1400261f2]
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x40], 0x414
mov qword [rsp + 0x50], rbx
lea r14, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebp, 0x14
mov r15, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
mov rdi, qword [sym.imp.SHELL32.dll_SHFileOperationW]
nop dword [rax]
mov rcx, rsi
call r15
cmp eax, 0xffffffff
je 0x140014cbf
and eax, 0x10
je 0x140014cbf
mov ecx, 0x64
call r12
movaps xmmword [rsp + 0x20], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x40], xmm6
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x40], 0x414
mov qword [rsp + 0x50], rbx
mov rcx, r14
call rdi
add ebp, 0xffffffff
jne 0x140014c70
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret