joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002a2f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x138
mov rax, qword [0x140064018]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rsi, r9
mov r15, rdx
mov r12, rcx
test rcx, rcx
je 0x14002a4b0
test rdx, rdx
je 0x14002a4b0
mov rax, rdx
lea rbp, [rdx + 0x10]
and eax, 0xf
mov edi, sendto
sub rdi, rax
mov edx, 1
add rbp, rdi
mov rcx, rbp
call fcn.14003853c
mov qword [rsi], rax
mov rbx, rax
test rax, rax
je 0x14002a4b0
xor ecx, ecx
mov qword [rsp + 0x130], r14
call fcn.140038c74
mov rcx, rax
call fcn.140038bc4
mov r14d, sendto
nop dword [rax + rax]
call fcn.140038b98
and eax, 0x800000ff
jge 0x14002a395
dec eax
or eax, 0xffffff00
inc eax
mov byte [rbx], al
inc rbx
sub r14, 1
jne 0x14002a380
mov rcx, qword [rsi]
mov r8, r15
add rcx, 0x10
mov rdx, r12
call fcn.1400372c0
mov r14, qword [rsp + 0x130]
mov rdx, rbp
sub rdx, rdi
mov rbx, rdx
cmp rdx, rbp
jae 0x14002a412
cmp rdi, 0x10
jb 0x14002a412
mov rax, qword [rsi]
lea rcx, [rax - 1]
add rcx, rbp
lea r9, [rax + rdx]
cmp r9, rsi
ja 0x14002a3e6
cmp rcx, rsi
jae 0x14002a412
mov rax, rdi
mov r8, rbp
and eax, 0xf
sub r8, rax
add rbx, 0x10
cmp rbx, r8
jb 0x14002a3f2
sub r8, rdx
mov rcx, r9
add r8, 0xf
movzx edx, dil
and r8, 0xfffffffffffffff0
call fcn.1400376d0
cmp rbx, rbp
jae 0x14002a42f
nop word [rax + rax]
mov rax, qword [rsi]
mov byte [rbx + rax], dil
inc rbx
cmp rbx, rbp
jb 0x14002a420
lea rdx, [0x140064b48]
lea rcx, [rsp + 0x20]
call fcn.140034420
mov rcx, qword [rsi]
lea eax, [rbp - 0x10]
mov edi, eax
lea r8, [rsp + 0x110]
lea rbx, [rcx + 0x10]
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0x110], xmm0
test eax, eax
je 0x14002a4ab
dec rdi
shr rdi, 4
inc rdi
nop dword [rax]
mov rcx, rbx
sub r8, rbx
mov edx, sendto
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14002a480
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140034ba0
mov r8, rbx
add rbx, 0x10
sub rdi, 1
jne 0x14002a470
mov rax, rbp
jmp 0x14002a4b2
xor eax, eax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140036180
add rsp, 0x138
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002a4e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x140064018]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r15, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
test rcx, rcx
je 0x14002a687
test rdx, rdx
je 0x14002a687
cmp qword [r9], 0
jne 0x14002a687
test r14b, 0xf
jne 0x14002a687
cmp rdx, 0x20
jb 0x14002a687
lea rsi, [rdx - 0x10]
mov edx, 1
mov rcx, rsi
call fcn.14003853c
mov qword [r15], rax
test rax, rax
je 0x14002a687
lea rdx, [rbx + 0x10]
mov r8, rsi
mov rcx, rax
call fcn.1400372c0
lea rax, [0x140064b48]
test rdi, rdi
lea rcx, [rsp + 0x20]
cmove rdi, rax
mov rdx, rdi
call fcn.140034420
movups xmm0, xmmword [rbx]
mov rbx, qword [r15]
lea eax, [r14 - 0x10]
mov ebp, eax
movaps xmmword [rsp + 0x110], xmm0
test eax, eax
je 0x14002a604
lea rdi, [rsp + 0x110]
sub rdi, rbx
dec rbp
shr rbp, 4
inc rbp
nop word [rax + rax]
movups xmm0, xmmword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140034ea0
mov ecx, sendto
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x14002a5e0
sub rdi, 0x10
movaps xmmword [rsp + 0x110], xmm0
sub rbp, 1
jne 0x14002a5c0
mov rbx, qword [r15]
movsx rbp, byte [rbx + r14 - 0x11]
lea rax, [rbp - 1]
cmp rax, 0xf
ja 0x14002a687
sub r14, rbp
mov rax, rsi
sub r14, 0x10
sub rax, r14
mov rdi, r14
cmp r14, rsi
jae 0x14002a66b
cmp rax, 0x10
jb 0x14002a66b
lea rdx, [rsi - 1]
add rdx, rbx
lea rcx, [r14 + rbx]
cmp rcx, r15
ja 0x14002a644
cmp rdx, r15
jae 0x14002a66b
and eax, 0xf
mov r8, rsi
sub r8, rax
nop dword [rax]
add rdi, 0x10
cmp rdi, r8
jb 0x14002a650
sub r8, r14
xor edx, edx
add r8, 0xf
and r8, 0xfffffffffffffff0
call fcn.1400376d0
cmp rdi, rsi
jae 0x14002a67f
mov rcx, qword [r15]
mov byte [rdi + rcx], 0
inc rdi
cmp rdi, rsi
jb 0x14002a670
sub rsi, rbp
mov rax, rsi
jmp 0x14002a689
xor eax, eax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140036180
mov rbx, qword [rsp + 0x170]
add rsp, 0x130
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002a6b0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x140064018]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
test rcx, rcx
jne 0x14002a6fb
mov r8d, 0xd8
lea rdx, [0x14005e210]
lea rcx, [0x14005e300]
call fcn.1400393f4
test rdi, rdi
jne 0x14002a719
mov r8d, 0xd9
lea rdx, [0x14005e210]
lea rcx, [0x14005e320]
call fcn.1400393f4
cmp qword [rsi], 0
je 0x14002a738
mov r8d, 0xda
lea rdx, [0x14005e210]
lea rcx, [0x14005e348]
call fcn.1400393f4
test rbp, rbp
je 0x14002a83c
test rdi, rdi
je 0x14002a83c
cmp qword [rsi], 0
jne 0x14002a83c
mov edx, 1
lea ecx, [rdx + 0x1f]
call fcn.14003853c
mov qword [rsi], rax
mov rdx, rax
test rax, rax
je 0x14002a83c
xor eax, eax
mov qword [rsp + 0xb0], rbx
xor ebx, ebx
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 0x6a09e667
mov dword [rsp + 0x74], 0xbb67ae85
mov dword [rsp + 0x78], 0x3c6ef372
mov dword [rsp + 0x7c], 0xa54ff53a
mov dword [rsp + 0x80], 0x510e527f
mov dword [rsp + 0x84], 0x9b05688c
mov dword [rsp + 0x88], 0x1f83d9ab
mov dword [rsp + 0x8c], 0x5be0cd19
test rdi, rdi
je 0x14002a823
xor edx, edx
nop dword [rax + rax]
mov ecx, eax
movzx eax, byte [rdx + rbp]
mov byte [rsp + rcx + 0x20], al
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
cmp eax, 0x40
jne 0x14002a817
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x20]
call fcn.140033ce0
add qword [rsp + 0x68], 0x200
xor eax, eax
mov dword [rsp + 0x60], eax
inc ebx
mov edx, ebx
cmp rdx, rdi
jb 0x14002a7e0
mov rdx, qword [rsi]
lea rcx, [rsp + 0x20]
call fcn.140034240
mov rbx, qword [rsp + 0xb0]
mov eax, 0x20
jmp 0x14002a83e
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140036180
lea r11, [rsp + 0xa0]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14002bba0
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x170
mov rax, qword [0x140064018]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov edx, 8
mov rsi, rcx
lea ecx, [rdx - 6]
call fcn.14003853c
mov qword [rsi], rax
test rax, rax
je 0x14002bd20
mov qword [rsp + 0x188], rbx
xor r9d, r9d
mov qword [rsp + 0x190], rbp
xor r8d, r8d
mov qword [rsp + 0x168], rdi
xor ecx, ecx
mov qword [rsp + 0x160], r14
xor r14d, r14d
mov qword [rax], r14
mov ebp, r14d
mov rax, qword [rsi]
lea edx, [r14 + 0x17]
mov qword [rax + 8], r14
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rdi, [r14 - 1]
test eax, eax
jne 0x14002bc70
lea rax, [rsp + 0x40]
mov rbx, rdi
cmp byte [rax + rbx + 1], bpl
lea rbx, [rbx + 1]
jne 0x14002bc33
mov edx, 8
lea rcx, [rbx + 1]
call fcn.14003853c
mov rcx, qword [rsi]
mov qword [rcx], rax
mov rax, qword [rsi]
mov rcx, qword [rax]
test rcx, rcx
je 0x14002bc70
lea r8, [rsp + 0x40]
lea rdx, [rbx + 1]
call fcn.140038690
mov ebp, 1
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], r14
call fcn.140002a10
cmp qword [rsp + 0x38], r14
je 0x14002bd00
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], r14
lea rcx, [0x14005e418]
call fcn.14002a0e0
mov rbx, qword [rsp + 0x30]
mov rax, rdi
inc rax
cmp byte [rbx + rax], r14b
jne 0x14002bca4
mov rcx, qword [rsp + 0x38]
inc rdi
cmp byte [rcx + rdi], r14b
jne 0x14002bcb2
inc rax
mov edx, 8
add rdi, rax
mov rcx, rdi
call fcn.14003853c
mov r9, qword [rsi]
mov qword [r9 + rbp*8], rax
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
test rcx, rcx
je 0x14002bd00
mov r8, qword [rsp + 0x38]
mov rdx, rdi
call fcn.1400386f0
mov rcx, qword [rsi]
mov r8, rbx
mov rdx, rdi
mov rcx, qword [rcx + rbp*8]
call fcn.1400386f0
mov rdi, qword [rsp + 0x168]
mov rbp, qword [rsp + 0x190]
mov rbx, qword [rsp + 0x188]
mov r14, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140036180
add rsp, 0x170
pop rsi
ret
Function at 0x140032990
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140064018]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov dword [rsp + 0x20], 0x30
mov rbx, rcx
mov qword [rsp + 0x34], rax
xor ecx, ecx
mov dword [rsp + 0x30], eax
xor edx, edx
mov dword [rsp + 0x24], 2
mov r8d, 0xf003f
mov qword [rsp + 0x28], 7
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
jne 0x1400329ed
lea eax, [rdi - 1]
jmp 0x140032a46
mov r8d, 0xf003f
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140032a32
test rbx, rbx
je 0x140032a32
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x140032a46
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140036180
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140032a60
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140064018]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov dword [rsp + 0x20], 0x30
mov esi, edx
mov qword [rsp + 0x34], rax
mov rbx, rcx
mov dword [rsp + 0x30], eax
xor edx, edx
mov dword [rsp + 0x24], 2
xor ecx, ecx
mov qword [rsp + 0x28], 7
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x140032b20
mov r8d, 0xf003f
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
je 0x140032b20
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140032b0a
cmp dword [rsp + 0x24], esi
jne 0x140032b0a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x140032b25
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x140032b25
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140036180
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140032b50
Capabilities:
Query service configuration

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x140064018]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r14d, edx
mov rbx, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
jne 0x140032b8e
lea eax, [rdi - 1]
jmp 0x140032c6b
mov r8d, 1
mov qword [rsp + 0x60], rsi
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x140032bbe
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [rsi - 1]
jmp 0x140032c66
lea r9, [rsp + 0x20]
mov qword [rsp + 0x58], rbp
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x140032be7
cmp eax, 0x7a
jne 0x140032c10
mov ebx, dword [rsp + 0x20]
xor ecx, ecx
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r9, [rsp + 0x20]
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x140032c29
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 0xffffffff
jmp 0x140032c61
test rbp, rbp
je 0x140032c4d
cmp dword [rbp + 4], r14d
jne 0x140032c4d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x140032c61
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140036180
add rsp, 0x30
pop r14
pop rdi
pop rbx
ret
Function at 0x140032c90
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x140064018]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rax, 0xffffffffffffffff
mov rbx, rcx
mov rcx, rax
mov rdi, rdx
inc rcx
cmp byte [rdx + rcx], 0
jne 0x140032cc1
nop word [rax + rax]
cmp byte [rbx + rax + 1], 0
lea rax, [rax + 1]
jne 0x140032cd0
lea rbp, [rax + 7]
mov edx, 1
add rbp, rcx
mov rcx, rbp
call fcn.14003853c
mov rsi, rax
test rax, rax
je 0x140032d49
lea r8, [0x14005ea14]
mov rdx, rbp
mov rcx, rax
call fcn.140038690
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call fcn.1400386f0
lea r8, [0x14005e9f0]
mov rdx, rbp
mov rcx, rsi
call fcn.1400386f0
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.1400386f0
lea r8, [0x14005e9dc]
mov rdx, rbp
mov rcx, rsi
call fcn.1400386f0
xorps xmm0, xmm0
xor ecx, ecx
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0xd0], rax
xor r8d, r8d
mov qword [rsp + 0x60], rax
mov rdx, rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x20], ecx
movups xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0x70], 0x68
movups xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0xac], 1
movups xmmword [rsp + 0x80], xmm0
mov word [rsp + 0xb0], cx
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140032e09
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140036180
mov rbx, qword [rsp + 0x120]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140033360
Capabilities:
Query service configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x140064018]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r15d, edx
mov rsi, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r8d, 1
mov rdx, rsi
mov rcx, rax
mov r14, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
lea r9, [rsp + 0x20]
xor r8d, r8d
mov rcx, rax
xor edx, edx
mov rbp, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x1400333d4
cmp eax, 0x7a
jne 0x140033448
mov ebx, dword [rsp + 0x20]
xor ecx, ecx
mov edx, ebx
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r9, [rsp + 0x20]
mov r8d, ebx
mov rdx, rax
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x140033443
cmp r15d, 1
jne 0x140033421
lea rdx, [0x14005ec40]
mov rcx, rsi
call fcn.140032c90
lea ecx, [r15 + 9]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14005ec48]
mov rcx, rsi
call fcn.140032c90
test rdi, rdi
je 0x140033443
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x140033443
call fcn.14003897c
mov rdi, qword [rsp + 0x58]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140036180
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rsi
ret
Function at 0x140033480
Capabilities:
Get file version info
Query service configuration

Disassembly:
push rbx
push rbp
push rdi
push r13
sub rsp, 0xa8
mov rax, qword [0x140064018]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x40], rdx
mov rbx, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r8d, 1
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0x48], rax
mov rbp, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
lea r9, [rsp + 0x58]
xor r8d, r8d
mov rcx, rax
xor edx, edx
mov r13, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x1400334f8
cmp eax, 0x7a
jne 0x140033521
mov ebx, dword [rsp + 0x58]
xor ecx, ecx
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r9, [rsp + 0x58]
mov r8d, ebx
mov rdx, rax
mov rcx, r13
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x14003353d
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 0xffffffff
jmp 0x14003365d
xor ebx, ebx
mov qword [rsp + 0x98], r14
mov qword [rsp + 0x90], r15
mov ebp, ebx
mov r14d, ebx
mov r15d, ebx
test rdi, rdi
je 0x1400335ff
mov qword [rsp + 0xe0], rsi
mov rsi, qword [rdi + 0x10]
test rsi, rsi
je 0x1400335f7
lea rdx, [rsp + 0x5c]
mov qword [rsp + 0xa0], r12
mov rcx, rsi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov r12d, eax
test eax, eax
je 0x1400335ef
mov ecx, r12d
lea edx, [rbx + 1]
call fcn.14003853c
mov rdi, rax
test rax, rax
je 0x1400335e7
mov r9, rax
mov r8d, r12d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
lea r9, [rsp + 0x60]
mov rcx, rdi
lea r8, [rsp + 0x50]
lea rdx, [0x14005e050]
call qword [sym.imp.VERSION.dll_VerQueryValueA]
mov rcx, qword [rsp + 0x50]
movzx r14d, word [rcx + 0x12]
movzx r15d, word [rcx + 0x10]
movzx ebp, word [rcx + 0x16]
movzx ebx, word [rcx + 0x14]
mov rcx, rdi
call fcn.140038520
mov r12, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xe0]
mov dword [rsp + 0x30], ebx
lea r8, [0x14005ec50]
mov dword [rsp + 0x28], ebp
lea rcx, [rsp + 0x68]
mov r9d, r14d
mov dword [rsp + 0x20], r15d
mov edx, SafeArrayCopy
call fcn.1400300f0
lea rcx, [rsp + 0x68]
call fcn.140038618
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r15, qword [rsp + 0x90]
xor eax, eax
mov r14, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140036180
add rsp, 0xa8
pop r13
pop rdi
pop rbp
pop rbx
ret
Function at 0x140033680
Capabilities:
Query service configuration
Write file on windows

Disassembly:
push rbx
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x48
mov rax, qword [0x140064018]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r15, rdx
mov r12, r8
lea rdx, [0x14005ec40]
mov rdi, rcx
call fcn.140032c90
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 4
mov rcx, rdi
call fcn.140032a60
test eax, eax
jne 0x1400336dd
lea edx, [rax + 3]
mov rcx, rdi
call fcn.140032a60
test eax, eax
je 0x1400336e4
mov ecx, 0x2710
jmp 0x1400336b7
xor edx, edx
mov qword [rsp + 0x40], rsi
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r8d, 1
mov rdx, rdi
mov rcx, rax
mov r14, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rcx, rax
xor edx, edx
mov rbp, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x140033735
cmp eax, 0x7a
jne 0x14003375e
mov ebx, dword [rsp + 0x30]
xor ecx, ecx
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r9, [rsp + 0x30]
mov r8d, ebx
mov rdx, rax
mov rcx, rbp
mov rsi, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x14003377a
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 0xffffffff
jmp 0x14003381f
xor ebx, ebx
test rsi, rsi
je 0x140033792
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x140033792
call fcn.140038618
mov rbx, rax
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x1400337f0
mov rcx, rbx
call fcn.14003897c
lea r8, [0x14005ec5c]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14003f724
test eax, eax
jne 0x1400337f0
mov r9, qword [rsp + 0x28]
test r9, r9
je 0x1400337f0
mov r8, r12
lea edx, [rax + 1]
mov rcx, r15
call fcn.14003f4c0
test rax, rax
je 0x1400337f0
mov rcx, qword [rsp + 0x28]
call fcn.14003ada4
lea rdx, [rsp + 0x20]
lea rcx, [0x14005eb90]
call fcn.14002a0e0
mov rdx, qword [rsp + 0x20]
mov rcx, rbx
call fcn.140030560
lea rdx, [0x14005ea0c]
mov rcx, rdi
call fcn.140032c90
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140036180
add rsp, 0x48
pop r15
pop r14
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x140034ea0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
sub rsi, rcx
mov r9d, 4
nop dword [rax]
mov r8d, 4
nop word [rax + rax]
movzx eax, byte [rsi + rcx + 0xe0]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x140034ee0
sub r9, 1
jne 0x140034ed0
mov bpl, SafeArrayDestroy
lea rdi, [rsi + 0xd0]
lea r14, [0x14005ee60]
nop word [rax + rax]
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x140034f80
inc r8
sub r9, 1
jne 0x140034f70
mov rax, rbx
lea r8d, [rdx + 4]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x140034fc0
sub r8, 1
jne 0x140034fb0
mov rcx, rbx
call fcn.1400348e0
sub rdi, 0x10
add bpl, 0xff
jne 0x140034f10
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x140035060
inc r8
sub r9, 1
jne 0x140035050
lea edx, [r9 + 4]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rbx + rsi]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140035090
sub rdx, 1
jne 0x140035082
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140042510
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140042530
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400448d4
or eax, 0xffffffff
jmp 0x140042532
xor eax, eax
add rsp, 0x28
ret

Function at 0x140043aec
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140043918