joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007d40
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rcx, qword [0x14002d0a0]
test rcx, rcx
je 0x140007d7b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140007da0
mov rcx, qword [0x14002d0a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x1400300e0], 0
jne 0x140007db8
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [0x14002d0a0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140007d6e
mov edx, 0x414
lea r12, [rsp + 0x20]
lea rsi, [0x14001d3ca]
mov qword [rsp + 0x20], 0
lea rdi, [0x140030100]
movq xmm0, rsi
mov rcx, r12
mov dword [rsp + 0x28], 3
movq xmm6, rdi
mov word [rsp + 0x40], dx
mov rbp, qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, 0x14
punpcklqdq xmm6, xmm0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rsi
movaps xmmword [rsp + 0x30], xmm6
call rbp
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140007e84
test al, 0x10
je 0x140007d84
mov ecx, 0x64
call r14
mov eax, 0x414
mov qword [rsp + 0x50], rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
movaps xmmword [rsp + 0x30], xmm6
call rbp
sub ebx, 1
je 0x140007d84
mov rcx, rdi
call r13
cmp eax, 0xffffffff
jne 0x140007e30
jmp 0x140007d84

Function at 0x14000e4f0
Capabilities:
Create directory

Disassembly:
push rdi
mov eax, 0x2020
push rsi
push rbx
call fcn.1400156b0
sub rsp, rax
mov eax, dword [0x140034100]
mov rsi, rcx
test eax, eax
je 0x14000e590
xor ebx, ebx
lea rdi, [0x140032100]
test eax, eax
jg 0x14000e52c
jmp 0x14000e540
add rbx, 1
cmp dword [0x140034100], ebx
jle 0x14000e540
mov rdx, qword [rdi + rbx*8]
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000e520
jmp 0x14000e577
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, 2
jne 0x14000e555
cmp word [rsi + 2], 0x3a
je 0x14000e577
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000e5e0
movsxd rbx, dword [0x140034100]
cmp ebx, 0x3ff
jle 0x14000e5f8
mov eax, 1
add rsp, 0x2020
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
lea rbx, str.HOME
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rdi
call fcn.140007540
test al, al
je 0x14000e61a
movsxd rbx, dword [0x140034100]
mov rcx, rdi
lea rdi, [0x140032100]
call sub.msvcrt.dll__wcsdup
mov qword [rdi + rbx*8], rax
mov eax, dword [0x140034100]
add eax, 1
mov dword [0x140034100], eax
jmp 0x14000e511
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000e564
xor eax, eax
jmp 0x14000e57c
mov rcx, rsi
call sub.msvcrt.dll__wcsdup
add dword [0x140034100], 1
mov rdx, rax
lea rax, [0x140032100]
mov qword [rax + rbx*8], rdx
jmp 0x14000e577
mov rcx, rbx
call fcn.140007c80
nop
nop word cs:[rax + rax]
nop
Function at 0x140014390
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.14001b2f0
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.14001b2f0
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x140015062
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140034228]
test eax, eax
je 0x1400150fa
lea rax, [0x140034200]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140034230]
mov qword [rbp - 8], rax
jmp 0x1400150de
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400150d2
cmp qword [rbp - 0x10], 0
je 0x1400150d2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140015098
lea rax, [0x140034200]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400150fb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140015200
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140015228
mov eax, 0
jmp 0x140015276
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140015251
mov eax, 0
jmp 0x140015276
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140015271
mov eax, 0
jmp 0x140015276
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x14001527c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400152fa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400152f1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400152f1
mov rax, qword [rbp - 8]
jmp 0x14001530f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1400152c4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc5d5ef0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc5d68f2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc5f9108]
test eax, eax
je 0x2fc5d698a
lea rax, [0x2fc5f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc5f9110]
mov qword [rbp - 8], rax
jmp 0x2fc5d696e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc5d6962
cmp qword [rbp - 0x10], 0
je 0x2fc5d6962
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc5d6928
lea rax, [0x2fc5f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc5d698b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc5d6a90
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc5d6ab8
mov eax, 0
jmp 0x2fc5d6b06
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc5d6ae1
mov eax, 0
jmp 0x2fc5d6b06
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc5d6b01
mov eax, 0
jmp 0x2fc5d6b06
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc5d6b0c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc5d6b8a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc5d6b81
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc5d6b81
mov rax, qword [rbp - 8]
jmp 0x2fc5d6b9f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc5d6b54
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400017f0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140068080]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rcx
mov ebx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_core_profile_l1_1_0.dll_QueryPerformanceCounter]
mov rcx, qword [rdi + 0x280]
movabs rax, 0x20c49ba5e353f7cf
imul rcx, rbx
imul rcx
mov rbx, rdx
sar rbx, 7
mov rax, rbx
shr rax, 0x3f
add rbx, rax
add rbx, qword [rsp + 0x20]
nop word [rax + rax]
lea rcx, [rsp + 0x28]
call qword [sym.imp.api_ms_win_core_profile_l1_1_0.dll_QueryPerformanceCounter]
cmp qword [rsp + 0x28], rbx
jle 0x140001850
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140013c00
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140002670
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor r8d, r8d
lea rcx, str.gdi32.dll
xor edx, edx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
mov qword [rbx + 0x38], rax
test rax, rax
je 0x14000275d
lea rdx, str.D3DKMTOpenAdapterFromGdiDisplayName
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rcx, qword [rbx + 0x38]
lea rdx, str.D3DKMTOpenAdapterFromDeviceName
mov qword [rbx + 8], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rcx, qword [rbx + 0x38]
lea rdx, str.D3DKMTEscape
mov qword [rbx + 0x10], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rcx, qword [rbx + 0x38]
lea rdx, str.D3DKMTCreateDevice
mov qword [rbx + 0x30], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rcx, qword [rbx + 0x38]
lea rdx, str.D3DKMTDestroyDevice
mov qword [rbx + 0x20], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rcx, qword [rbx + 0x38]
lea rdx, str.D3DKMTCloseAdapter
mov qword [rbx + 0x28], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
cmp qword [rbx + 8], 0
mov qword [rbx + 0x18], rax
je 0x14000275d
cmp qword [rbx + 0x10], 0
je 0x14000275d
cmp qword [rbx + 0x30], 0
je 0x14000275d
cmp qword [rbx + 0x20], 0
je 0x14000275d
cmp qword [rbx + 0x28], 0
je 0x14000275d
test rax, rax
je 0x14000275d
mov r8, rbx
lea rdx, [0x14004a580]
mov rcx, rbx
call fcn.140002770
test eax, eax
jne 0x14000275d
cmp dword [rbx], eax
je 0x14000275d
add rsp, 0x20
pop rbx
ret
mov eax, 0x80004005
add rsp, 0x20
pop rbx
ret
Function at 0x140003880
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov rax, qword [0x140068080]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov esi, 0x80004005
call fcn.140002510
mov qword [rsp + 0x40], rax
xor ebp, ebp
mov ebx, ebp
test rax, rax
je 0x140003986
mov ecx, 0xb0
call fcn.140013b2c
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140003930
xor edx, edx
mov r8d, 0xb0
mov rcx, rax
call fcn.140017b30
mov qword [rbx + 0xa8], rbp
mov dword [rbx], ebp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], rbp
mov qword [rbx + 0x28], rbp
mov qword [rbx + 0x30], rbp
mov qword [rbx + 0x38], rbp
mov dword [rbx + 0x44], ebp
lea rdi, [rbx + 0x48]
xor eax, eax
mov ecx, SafeArrayGetDim
rep stosq qword [rdi], rax
call fcn.140002510
mov qword [rbx + 8], rax
mov dword [rbx + 0x40], ebp
jmp 0x140003933
mov rbx, rbp
test rbx, rbx
je 0x140003986
mov rcx, rbx
call fcn.140003a00
mov esi, eax
test eax, eax
js 0x14000395e
mov rcx, rbx
call fcn.140002e00
mov esi, eax
test eax, eax
js 0x14000395e
mov rcx, rbx
call fcn.140003bc0
mov esi, eax
test esi, esi
js 0x140003986
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
mov r9, rbx
lea r8, [0x1400030c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rbx + 0xa8], rax
lea rcx, [rsp + 0x40]
call fcn.140002c30
test esi, esi
jns 0x1400039d0
test rbx, rbx
je 0x1400039d0
mov dword [rbx], 1
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400039ae
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rcx, rbx
call fcn.140002fe0
mov rcx, rbx
call fcn.140002d70
mov edx, 0xb0
mov rcx, rbx
call fcn.140013d34
mov rax, rbp
jmp 0x1400039d3
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140013c00
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140003fe0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x140068080]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rdx
mov edi, ecx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call fcn.140017b30
lea rsi, [rsp + 0x180]
call fcn.140004110
mov qword [rsp + 0x28], rsi
lea rdx, [rsp + 0x30]
xor esi, esi
mov r9, rbx
mov r8d, 0x104
mov qword [rsp + 0x20], rsi
mov rcx, qword [rax]
call fcn.14001bdd0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringA]
test dword [0x14006a904], 0x20000
je 0x140004090
mov rcx, qword [0x14006a910]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], esi
lea r9d, [rsi + 1]
mov r8d, edi
mov qword [rsp + 0x20], rax
lea rdx, [0x14004a0c0]
call fcn.140002380
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140013c00
add rsp, 0x150
pop rdi
pop rsi
pop rbx
ret
Function at 0x140007df0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx], 0x50564150
mov rdi, rdx
mov rbx, rcx
je 0x140007e16
lea rdx, str.Unexpected_packet_Sig
xor ecx, ecx
call fcn.140003fe0
mov eax, 0x100
cmp word [rbx + 4], ax
je 0x140007e2f
lea rdx, str.Unexpected_packet_Ver
xor ecx, ecx
call fcn.140003fe0
mov ecx, dword [rbx + 0x10]
lea rax, [rdi - 0x14]
cmp rcx, rax
je 0x140007e49
lea rdx, str.Unexpected_packet_DataLen
xor ecx, ecx
call fcn.140003fe0
mov r8d, dword [rbx + 0xc]
cmp r8d, 6
ja case.default.0x140007e69
lea rdx, [0x140000000]
mov ecx, dword [rdx + r8*4 + 0x7f14]
add rcx, rdx
jmp rcx
lea rdx, str.Invalid_packet_status:_CHS_STATUS_MAX_MESSAGE_LENGTH_EXCEEDED
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140003fe0
lea rdx, str.Invalid_packet_status:_CHS_STATUS_UNSPEC_ERROR
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140003fe0
lea rdx, str.Invalid_packet_status:_CHS_STATUS_CONN_FAILED
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140003fe0
lea rdx, str.Invalid_packet_status:_CHS_STATUS_COMM_FAILED
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140003fe0
lea rdx, str.Invalid_packet_status:_CHS_STATUS_NOT_CONNECTED
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140003fe0
lea rdx, str.Invalid_packet_status:_CHS_STATUS_HECI_NOT_READY
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140003fe0
lea rdx, str.Unsupported_packet_status___d
xor ecx, ecx
call fcn.140003fe0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140009a80
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rsi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140009aae
mov r8, rdx
mov rdx, qword [rdi]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14000b730
cmp byte [0x14006aa58], 0
mov qword [rsp + 0x30], rbx
jne 0x140009b01
lea rcx, str.Advapi32.dll
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test rax, rax
je 0x140009af1
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rbx, rax
mov qword [0x14006aa50], rax
mov byte [0x14006aa58], 1
jmp 0x140009b08
mov rbx, qword [0x14006aa50]
mov byte [0x14006aa58], 1
jmp 0x140009b08
mov rbx, qword [0x14006aa50]
test rbx, rbx
je 0x140009b38
mov rcx, rbx
call qword [fcn.140014fd0]
mov r8d, dword [rdi + 8]
xor r9d, r9d
mov rcx, qword [rdi]
mov rdx, rsi
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp rax
mov rcx, qword [rdi]
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x14000b7a7
lea rcx, str.Advapi32.dll
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test rax, rax
je 0x14000b7bb
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x14000b7bb
mov rcx, rax
call qword [fcn.140014fd0]
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rsi
mov rcx, rbp
call rdi
jmp 0x14000b7c0
cmp dword [rcx + 8], 0
je 0x14000b7bb
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegDeleteKeyW]
jmp 0x14000b7c0
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14000a5b0
Capabilities:
Create service

Disassembly:
push rdi
sub rsp, 0xa90
mov rax, qword [0x140068080]
xor rax, rsp
mov qword [rsp + 0xa80], rax
mov rdi, rcx
call fcn.14000a8e0
test eax, eax
je 0x14000a5e1
mov eax, 1
jmp 0x14000a6e8
mov r8d, 0x104
lea rdx, [rsp + 0x72]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0x14000a7de
cmp eax, 0x104
je 0x14000a7de
lea ecx, [rax + 1]
mov r8d, 0x22
mov word [rsp + 0x70], r8w
mov word [rsp + rcx*2 + 0x70], r8w
lea ecx, [rax + 2]
add rcx, rcx
cmp rcx, 0x20c
jae 0x14000a827
mov qword [rsp + 0xaa8], rbx
xor edx, edx
mov qword [rsp + 0xab0], rsi
mov r8d, 0xf003f
xor esi, esi
mov word [rsp + rcx + 0x70], si
xor ecx, ecx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x14000a701
mov r8d, 0x400
lea rdx, [rsp + 0x280]
mov ecx, 0xd80a
call fcn.140008b70
test eax, eax
jne 0x14000a6bf
lea r8, str.Could_not_open_Service_Manager
mov edx, 0x400
lea rcx, [rsp + 0x280]
call fcn.14001bf54
test eax, eax
je 0x14000a6bf
cmp eax, 0xc
je 0x14000a7fb
cmp eax, 0x16
je 0x14000a7f0
cmp eax, 0x22
je 0x14000a7f0
cmp eax, 0x50
jne 0x14000a7e5
lea r8, [rdi + 0x68]
xor r9d, r9d
lea rdx, [rsp + 0x280]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rbx, qword [rsp + 0xaa8]
mov rsi, qword [rsp + 0xab0]
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.140013c00
add rsp, 0xa90
pop rdi
ret
mov qword [rsp + 0x60], rsi
lea rax, str.RPCSS
mov qword [rsp + 0x58], rsi
add rdi, 0x68
mov qword [rsp + 0x50], rax
mov r9d, 0xf01ff
mov qword [rsp + 0x48], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rsi
mov r8, rdi
mov qword [rsp + 0x38], rax
mov rdx, rdi
mov dword [rsp + 0x30], 1
mov rcx, rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CreateServiceW]
test rax, rax
jne 0x14000a7c2
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov r8d, 0x400
lea rdx, [rsp + 0x280]
mov ecx, 0xd80b
call fcn.140008b70
test eax, eax
jne 0x14000a7b7
lea r8, str.Could_not_start_service
mov edx, 0x400
lea rcx, [rsp + 0x280]
call fcn.14001bf54
test eax, eax
je 0x14000a7b7
cmp eax, 0xc
je 0x14000a81c
cmp eax, 0x16
je 0x14000a811
cmp eax, 0x22
je 0x14000a811
cmp eax, 0x50
jne 0x14000a806
xor r9d, r9d
mov r8, rdi
jmp 0x14000a6c6
mov rcx, rax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov eax, 1
jmp 0x14000a6d8
xor eax, eax
jmp 0x14000a6e8
mov ecx, 0x80004005
call fcn.1400062d0
int3
mov ecx, 0x80070057
call fcn.1400062d0
int3
mov ecx, 0x8007000e
call fcn.1400062d0
int3
mov ecx, 0x80004005
call fcn.1400062d0
int3
mov ecx, 0x80070057
call fcn.1400062d0
int3
mov ecx, 0x8007000e
call fcn.1400062d0
int3
call fcn.1400144a4
int3