joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400013e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov byte [rsp + 8], cl
sub rsp, 0x18
mov byte [rsp + 1], 0
jmp 0x140001404
movzx eax, byte [rsp + 1]
inc al
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 4
jge 0x140001485
mov byte [rsp], 0
jmp 0x14000141d
movzx eax, byte [rsp]
inc al
mov byte [rsp], al
movzx eax, byte [rsp]
cmp eax, 4
jge 0x140001480
movzx eax, byte [rsp + 1]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax*4]
movzx ecx, byte [rsp]
movzx edx, byte [rsp + 0x20]
shl edx, 2
movzx r8d, byte [rsp + 1]
shl r8d, 2
lea edx, [r8 + rdx*4]
movzx r8d, byte [rsp]
add edx, r8d
movsxd rdx, edx
mov r8, qword [rsp + 0x30]
movzx edx, byte [r8 + rdx]
movzx eax, byte [rax + rcx]
xor eax, edx
movzx ecx, byte [rsp]
movzx edx, byte [rsp + 1]
mov r8, qword [rsp + 0x28]
lea rdx, [r8 + rdx*4]
mov byte [rdx + rcx], al
jmp 0x140001414
jmp 0x1400013f9
add rsp, 0x18
ret

Function at 0x140002600
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov byte [rsp + 1], 0
jmp 0x14000261b
movzx eax, byte [rsp + 1]
inc al
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 4
jge 0x140002679
mov byte [rsp], 0
jmp 0x140002634
movzx eax, byte [rsp]
inc al
mov byte [rsp], al
movzx eax, byte [rsp]
cmp eax, 4
jge 0x140002677
movzx eax, byte [rsp]
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + rax*4]
movzx ecx, byte [rsp + 1]
movzx eax, byte [rax + rcx]
lea rcx, [0x140050740]
movzx edx, byte [rsp]
mov r8, qword [rsp + 0x20]
lea rdx, [r8 + rdx*4]
movzx r8d, byte [rsp + 1]
movzx eax, byte [rcx + rax]
mov byte [rdx + r8], al
jmp 0x14000262b
jmp 0x140002610
add rsp, 0x18
ret
Function at 0x140003140
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov byte [rsp + 1], 0
jmp 0x14000315b
movzx eax, byte [rsp + 1]
inc al
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 4
jge 0x1400031b9
mov byte [rsp], 0
jmp 0x140003174
movzx eax, byte [rsp]
inc al
mov byte [rsp], al
movzx eax, byte [rsp]
cmp eax, 4
jge 0x1400031b7
movzx eax, byte [rsp]
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + rax*4]
movzx ecx, byte [rsp + 1]
movzx eax, byte [rax + rcx]
lea rcx, str.cw
movzx edx, byte [rsp]
mov r8, qword [rsp + 0x20]
lea rdx, [r8 + rdx*4]
movzx r8d, byte [rsp + 1]
movzx eax, byte [rcx + rax]
mov byte [rdx + r8], al
jmp 0x14000316b
jmp 0x140003150
add rsp, 0x18
ret

Function at 0x1400031c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov byte [rsp], 0
jmp 0x1400031dd
movzx eax, byte [rsp]
inc al
mov byte [rsp], al
movzx eax, byte [rsp]
cmp eax, 0x10
jge 0x140003210
movzx eax, byte [rsp]
movzx ecx, byte [rsp]
mov rdx, qword [rsp + 0x28]
movzx ecx, byte [rdx + rcx]
mov rdx, qword [rsp + 0x20]
movzx eax, byte [rdx + rax]
xor eax, ecx
movzx ecx, byte [rsp]
mov rdx, qword [rsp + 0x20]
mov byte [rdx + rcx], al
jmp 0x1400031d4
add rsp, 0x18
ret

Function at 0x140003460
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x6a09e667
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0xbb67ae85
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x3c6ef372
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0xa54ff53a
mov eax, 4
imul rax, rax, 4
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x510e527f
mov eax, 4
imul rax, rax, 5
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x9b05688c
mov eax, 4
imul rax, rax, 6
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x1f83d9ab
mov eax, 4
imul rax, rax, 7
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x5be0cd19
mov rax, qword [rsp + 8]
mov qword [rax + 0x20], 0
ret
Function at 0x14001c540
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
sub rsp, 0x2e8
mov rax, qword [0x140066018]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov qword [rsp + 0x68], 0xffffffffffffffff
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea rdx, [rsp + 0x130]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x14001c5f7
movzx r8d, byte [rsp + 0x34]
lea rdx, [0x140050b04]
lea rcx, [rsp + 0x88]
call fcn.1400163c0
mov rcx, rax
call fcn.1400204d0
mov qword [rsp + 0x60], rax
movzx r8d, byte [rsp + 0x35]
lea rdx, str.WSAStartup_failed
lea rcx, [rsp + 0xa8]
call fcn.140013d40
mov rcx, rax
call fcn.140020930
xor r9d, r9d
mov rcx, qword [rsp + 0x60]
mov r8, rcx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x14001c747
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x80], 0
mov eax, 1
mov word [rsp + 0x30], ax
mov dword [rsp + 0x58], 1
movzx r8d, byte [rsp + 0x36]
lea rdx, str.china.cheat.asia
lea rcx, [rsp + 0x90]
call fcn.140014260
mov rcx, rax
call fcn.140020890
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x50]
mov r8d, 8
movzx edx, word [rsp + 0x30]
mov rcx, rax
call sub.DNSAPI.dll_DnsQuery_A
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
je 0x14001c6e4
movzx eax, word [rsp + 0x30]
cmp eax, 1
jne 0x14001c6b0
movzx r8d, byte [rsp + 0x37]
lea rdx, str.Failed_to_query_the_host_record_and_the_error_is__d__n
lea rcx, [rsp + 0xf8]
call fcn.140009820
mov rcx, rax
call fcn.1400215b0
mov edx, dword [rsp + 0x3c]
mov rcx, rax
call fcn.140025aa0
jmp 0x14001c6de
movzx r8d, byte [rsp + 0x38]
lea rdx, str.Failed_to_query_the_PTR_record_and_the_error_is__d__n
lea rcx, [rsp + 0xc0]
call fcn.140009fd0
mov rcx, rax
call fcn.140021510
mov edx, dword [rsp + 0x3c]
mov rcx, rax
call fcn.140025aa0
xor eax, eax
jmp 0x14001c747
movzx eax, word [rsp + 0x30]
cmp eax, 1
jne 0x14001c70b
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0x20]
mov dword [rsp + 0x44], eax
mov edx, 1
mov rcx, qword [rsp + 0x48]
call sub.DNSAPI.dll_DnsFree
jmp 0x14001c70f
xor eax, eax
jmp 0x14001c747
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov ecx, 1
imul rcx, rcx, 0
lea rdx, [0x140067250]
add rdx, rcx
mov rcx, rdx
mov rdx, rax
call fcn.140032bf0
mov eax, 1
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.140025cc0
add rsp, 0x2e8
ret
Function at 0x14001f700
Capabilities:
Delete file
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x4c8
mov rax, qword [0x140066018]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov edx, 0x104
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
movzx r8d, byte [rsp + 0x20]
lea rdx, str.Prefetch_
lea rcx, [rsp + 0x30]
call fcn.1400155c0
mov rcx, rax
call fcn.1400207f0
mov rdx, rax
lea rcx, [rsp + 0x180]
call fcn.140032b50
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x290]
call fcn.140032bf0
lea rdx, [0x140050a8c]
lea rcx, [rsp + 0x290]
call fcn.140032b50
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
je 0x14001f814
mov rdx, qword [rsp + 0x4d0]
lea rcx, [rsp + 0x6c]
call fcn.1400240b0
test rax, rax
je 0x14001f7f5
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x3a0]
call fcn.140032bf0
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x3a0]
call fcn.140032b50
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14001f7a9
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.140025cc0
add rsp, 0x4c8
ret
Function at 0x14001fb30
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x4198
call fcn.1400262f0
sub rsp, rax
mov rax, qword [0x140066018]
xor rax, rsp
mov qword [rsp + 0x4180], rax
mov dword [rsp + 0x44], 0
mov byte [rsp + 0x40], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0x41a8]
mov rcx, qword [rsp + 0x41a0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14001fd23
mov dword [rsp + 0x70], 0
mov dword [rsp + 0x48], 0
xor eax, eax
cmp eax, 1
je 0x14001fd0f
mov dword [rsp + 0x4c], 0xff
mov eax, 1
imul rax, rax, 0
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0xff
jae 0x14001fbe6
jmp 0x14001fbeb
call fcn.140025e34
mov rax, qword [rsp + 0x68]
mov byte [rsp + rax + 0x80], 0
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x50], eax
mov r9d, dword [rsp + 0x4c]
lea r8, [rsp + 0x80]
mov edx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x44], 0
jne 0x14001fd08
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14001fd02
mov dword [rsp + 0x54], 0x3fff
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x180]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x10000006
mov r8, qword [rsp + 0x41b0]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14001fcf5
mov rdx, qword [rsp + 0x41b8]
lea rcx, [rsp + 0x180]
call fcn.1400240b0
test rax, rax
je 0x14001fcf5
lea rdx, [rsp + 0x180]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x14001fcf5
mov byte [rsp + 0x40], 0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001fd06
xor al, al
jmp 0x14001fd25
jmp 0x14001fd0a
jmp 0x14001fd0f
jmp 0x14001fbb8
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [rsp + 0x40]
jmp 0x14001fd25
xor al, al
mov rcx, qword [rsp + 0x4180]
xor rcx, rsp
call fcn.140025cc0
add rsp, 0x4198
ret
Function at 0x14001fd40
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x4088
call fcn.1400262f0
sub rsp, rax
mov rax, qword [0x140066018]
xor rax, rsp
mov qword [rsp + 0x4070], rax
mov dword [rsp + 0x44], 0
mov byte [rsp + 0x40], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0x4098]
mov rcx, qword [rsp + 0x4090]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14001ff19
mov dword [rsp + 0x48], 0
xor eax, eax
cmp eax, 1
je 0x14001ff05
mov dword [rsp + 0x4c], 0x3fff
mov dword [rsp + 0x4c], 0x3fff
mov eax, 1
imul rax, rax, 0
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0x3fff
jae 0x14001fdf6
jmp 0x14001fdfb
call fcn.140025e34
mov rax, qword [rsp + 0x60]
mov byte [rsp + rax + 0x70], 0
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x70]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x44], 0
jne 0x14001fe9e
mov rdx, qword [rsp + 0x40a0]
lea rcx, [rsp + 0x70]
call fcn.1400240b0
test rax, rax
je 0x14001fe9c
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x14001fe9a
mov byte [rsp + 0x40], 0
jmp 0x14001ff05
jmp 0x14001ff05
jmp 0x14001ff00
movzx eax, byte [rsp + 0x40a8]
test eax, eax
je 0x14001fefe
mov dword [rsp + 0x48], 0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0x4098]
mov rcx, qword [rsp + 0x4090]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x14001fef7
xor al, al
jmp 0x14001ff1b
jmp 0x14001fdc0
jmp 0x14001ff05
jmp 0x14001fdc0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [rsp + 0x40]
jmp 0x14001ff1b
xor al, al
mov rcx, qword [rsp + 0x4070]
xor rcx, rsp
call fcn.140025cc0
add rsp, 0x4088
ret
Function at 0x14001ff40
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x4198
call fcn.1400262f0
sub rsp, rax
mov rax, qword [0x140066018]
xor rax, rsp
mov qword [rsp + 0x4180], rax
mov dword [rsp + 0x44], 0
mov byte [rsp + 0x40], 1
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0x41a8]
mov rcx, qword [rsp + 0x41a0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x140020186
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x48], 0
xor eax, eax
cmp eax, 1
je 0x140020172
mov dword [rsp + 0x50], 0xff
mov eax, 1
imul rax, rax, 0
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0xff
jae 0x14001fff1
jmp 0x14001fff6
call fcn.140025e34
mov rax, qword [rsp + 0x70]
mov byte [rsp + rax + 0x80], 0
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x54], eax
mov r9d, dword [rsp + 0x50]
lea r8, [rsp + 0x80]
mov edx, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x44], 0
jne 0x14002016b
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x140020165
xor eax, eax
cmp eax, 1
je 0x140020158
mov dword [rsp + 0x58], 0x3fff
mov eax, 1
imul rax, rax, 0
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0x3fff
jae 0x1400200a3
jmp 0x1400200a8
call fcn.140025e34
mov rax, qword [rsp + 0x78]
mov byte [rsp + rax + 0x180], 0
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x5c], eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x180]
mov edx, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x44], 0
jne 0x140020151
mov rdx, qword [rsp + 0x41b0]
lea rcx, [rsp + 0x180]
call fcn.1400240b0
test rax, rax
je 0x14002014f
lea rdx, [rsp + 0x180]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x14002014f
mov byte [rsp + 0x40], 0
jmp 0x140020153
jmp 0x140020158
jmp 0x140020075
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140020169
xor al, al
jmp 0x140020188
jmp 0x14002016d
jmp 0x140020172
jmp 0x14001ffc3
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [rsp + 0x40]
jmp 0x140020188
xor al, al
mov rcx, qword [rsp + 0x4180]
xor rcx, rsp
call fcn.140025cc0
add rsp, 0x4198
ret
Function at 0x140022da0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x178
mov rax, qword [0x140066018]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor edx, edx
mov ecx, 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x130
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32First
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140022e2d
mov rdx, qword [rsp + 0x180]
lea rcx, [rsp + 0x5c]
call fcn.140032cc0
test eax, eax
jne 0x140022e18
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
jmp 0x140022e3a
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32Next
mov dword [rsp + 0x20], eax
jmp 0x140022dea
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140025cc0
add rsp, 0x178
ret
Function at 0x140023700
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [0x140066018]
xor rax, rsp
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0x12c
mov r8d, 0x2c
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140023767
xor eax, eax
jmp 0x1400237c4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x48]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x14002379c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x1400237c4
cmp dword [rsp + 0x4c], 1
jne 0x1400237b4
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x1400237c4
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140025cc0
add rsp, 0x88
ret
Function at 0x1400242c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x128
mov rax, qword [0x140066018]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rcx, qword [rsp + 0x138]
call fcn.14001f680
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0xffffffffffffffff
jne 0x140024370
movzx r8d, byte [rsp + 0x44]
lea rdx, str.Cant_CreateFile_n
lea rcx, [rsp + 0x88]
call fcn.1400132c0
mov rcx, rax
call fcn.140020930
mov rcx, rax
call fcn.140025aa0
mov byte [rsp + 0x40], 0
mov rcx, qword [rsp + 0x138]
call fcn.140019f70
movzx eax, byte [rsp + 0x40]
jmp 0x14002455a
mov rcx, qword [rsp + 0x138]
call fcn.14001f680
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x130]
call fcn.140023fc0
mov qword [rsp + 0x68], rax
movzx r8d, byte [rsp + 0x45]
lea rdx, str.Writing__d_bytes_to__s._n
lea rcx, [rsp + 0xd0]
call fcn.140010030
mov rcx, rax
call fcn.140020c50
mov rcx, qword [rsp + 0x60]
mov r8, rcx
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
mov rcx, rax
call fcn.140025aa0
mov dword [rsp + 0x4c], 0
mov rcx, qword [rsp + 0x130]
call fcn.140023fc0
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x130]
call fcn.140020370
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
mov rcx, qword [rsp + 0x70]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
jne 0x14002447a
movzx r8d, byte [rsp + 0x46]
lea rdx, [0x140050f80]
lea rcx, [rsp + 0xa0]
call fcn.140013560
mov rcx, rax
call fcn.140020930
mov rcx, rax
call fcn.140025aa0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x41], 0
mov rcx, qword [rsp + 0x138]
call fcn.140019f70
movzx eax, byte [rsp + 0x41]
jmp 0x14002455a
mov eax, dword [rsp + 0x4c]
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x130]
call fcn.140023fc0
mov rcx, qword [rsp + 0x78]
cmp rcx, rax
je 0x1400244ea
movzx r8d, byte [rsp + 0x47]
lea rdx, str.Cant_write_file_n
lea rcx, [rsp + 0xb8]
call fcn.140013800
mov rcx, rax
call fcn.140020930
mov rcx, rax
call fcn.140025aa0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x42], 0
mov rcx, qword [rsp + 0x138]
call fcn.140019f70
movzx eax, byte [rsp + 0x42]
jmp 0x14002455a
mov rcx, qword [rsp + 0x138]
call fcn.14001f680
mov qword [rsp + 0x80], rax
movzx r8d, byte [rsp + 0x48]
lea rdx, str.Wrote__d_bytes_to__s_successfully._n
lea rcx, [rsp + 0xf0]
call fcn.14000cdc0
mov rcx, rax
call fcn.1400210b0
mov rcx, qword [rsp + 0x80]
mov r8, rcx
mov edx, dword [rsp + 0x4c]
mov rcx, rax
call fcn.140025aa0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x43], 1
mov rcx, qword [rsp + 0x138]
call fcn.140019f70
movzx eax, byte [rsp + 0x43]
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.140025cc0
add rsp, 0x128
ret
Function at 0x1400269f8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140026a42
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140026a42
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140026a42
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140026a42
cmp dword [rcx + 0x84], 0xe
jbe 0x140026a42
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140026a44
xor al, al
add rsp, 0x28
ret

Function at 0x140028c24
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x140028c52
xor eax, eax
jmp 0x140028d38
cmp qword [rcx + 0x68], 0
je 0x140028c63
call fcn.140028d54
jmp 0x140028d38
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140028c7a
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140028c7c
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140028cae
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400294e0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x140028d32
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x140028ce5
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x140028d0e
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.140037c2c
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x140028d32
cmp rsi, rbx
ja 0x140028cec
test rsi, rsi
je 0x140028d32
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.140037c2c
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14003484c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140034648