joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141b96058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x141b961df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141b96089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b9606f
add dl, dl
jne 0x141b96096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b960f6
xor eax, eax
add dl, dl
jne 0x141b960a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b961ad
add dl, dl
jne 0x141b960b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b960c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b960d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b960dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141b960ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141b9607e
mov eax, 1
add dl, dl
jne 0x141b96106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b96113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b960fb
sub eax, ebx
mov ebx, 1
jne 0x141b9614c
mov ecx, 1
add dl, dl
jne 0x141b9612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141b9613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b96123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b9607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141b96168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141b96175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b9615d
cmp eax, 0x7d00
jae 0x141b9619b
cmp eax, 0x500
jb 0x141b96196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b9607e
cmp eax, 0x7f
ja 0x141b9619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b9607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141b961d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141b9607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x140002810
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000285a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000285a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000285a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000285a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000285a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000285c
xor al, al
add rsp, 0x28
ret
Function at 0x140002920
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140002948
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000296e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140002970
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400029c9
test ecx, ecx
jle 0x1400029a9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400029c9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400029c9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x1400029f0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140002a12
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140002a28
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140002a44
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002a46
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140002a82
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140002b1e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140002abd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140002afe
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140002b1e
cmp rbx, rax
ja 0x140002ad0
test rbx, rbx
je 0x140002b1e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140002f80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140013040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140002fad
xor eax, eax
jmp 0x140003119
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002fe7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140002fe7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140003119
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000310c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000302a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003055
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003111
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400030c4
sub eax, 1
je 0x1400030c4
cmp eax, 2
jne 0x14000310c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003111
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400030f2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000310c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140003111
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140004e80
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400036f0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140013040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400037c3
cmp byte [rcx + 0x71], 0
je 0x1400037c3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400037bf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003784
sub eax, 1
je 0x140003788
cmp eax, 2
jne 0x1400037bf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004e80
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400037b6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400037bf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000376c
xor al, al
jmp 0x14000376c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004e80
add rsp, 0x60
pop rbx
ret
Function at 0x140004c20
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140013040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rcx
lea r9, [rsp + 0x20]
xor edi, edi
mov ecx, 0xb
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
mov ebx, edi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140004cb5
test rbx, rbx
je 0x140004c7b
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140004c65
test eax, eax
jns 0x140004cd6
test rbx, rbx
je 0x140004cdb
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140004d9d
test rbx, rbx
jne 0x140004ce2
xor eax, eax
jmp 0x140004d9d
mov qword [rsp + 0x68], rbp
cmp dword [rbx], edi
jbe 0x140004d85
nop
mov eax, edi
imul rcx, rax, 0x128
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rcx, 0x30
add rdx, rcx
lea rcx, [rsp + 0x28]
add rdx, rbx
call fcn.140003500
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x140004d23
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140004dba
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140004d7b
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d76
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004e03
call fcn.140004ea0
inc edi
cmp edi, dword [rbx]
jb 0x140004cf0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140004e80
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140004e0f
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004e0a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004e0a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ea0
mov rax, rdi
jmp 0x140004d98
Function at 0x14000592c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005976
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005976
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005976
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005976
cmp dword [rcx + 0x84], 0xe
jbe 0x140005976
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005978
xor al, al
add rsp, 0x28
ret
Function at 0x1400010d2
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, eax
nop
cpuid
nop
mov eax, 1
nop
cpuid
nop
movabs r9, 0xb2d05e00
nop
cpuid
nop
rdtsc
nop
shl rdx, 0x20
nop
or rax, rdx
nop
mov rcx, rax
nop
fldpi
nop
frndint
nop
rdtsc
nop
shl rdx, 0x20
nop
or rax, rdx
nop
sub rax, rcx
nop
cmp rax, r9
nop
jb 0x1400010ff
nop
nop
push rbp
nop
mov rbp, rsp
nop
sub rsp, 8
nop
mov r10, 0xa
nop
mov rcx, 0xffffffff9f345678
nop
dec rcx
nop
xor r9, r9
nop
mov rax, rcx
nop
jne 0x140001138
nop
xor rax, rax
nop
mov rax, rbx
nop
add rax, rdx
nop
dec r10
nop
xor r11, r11
nop
jne 0x14000112f
nop
xor rax, rax
mov rax, 0xa
nop
dec rax
nop
add rsp, 8
pop rbp
ret

Function at 0x140003489
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub rsp, 0xa0
xor rcx, rcx
mov rdx, 0xaa97
mov r8, 0x1000
add byte [rcx - 0x39], cl
rol dword [rax], 0
add byte [rax - 1], cl
adc eax, 0x19e61
test rax, rax
je 0x1400035fb
mov rdi, rax
call 0x1400034c0
pop rsi
add rsi, 0x28430
mov rcx, 0xaa97
rep movsb byte [rdi], byte [rsi]
movsb byte [rdi], byte [rsi]
call rax
sub esp, 0x30
mov rbx, r8
test edx, edx
je 0x14000350b
cmp edx, 1
jne 0x14009d8a0
mov rcx, qword [0x140183000]
mov dword [r8], 5
mov rax, qword [rcx]
call qword [rax + 0x150]
test al, al
jne 0x14009d8d1
add rsp, 0x30
pop rbx
ret
mov rcx, qword [0x140183000]
mov dword [r8], 0xf
mov rax, qword [rcx]
call qword [rax + 0x150]
test al, al
je 0x140003505
lea rdx, [0x1401041a0]
jmp 0x14009d8db
add byte [rax], al
add byte [rax], al
add byte [rcx - 0x75], al
push rax
sub byte [rbp - 0x6d7bf02e], al
xor al, 1
add byte [rdi], cl
invalid
Function at 0x140005cc0
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x1a40
call fcn.14000b350
sub rsp, rax
mov rax, qword [0x14002a018]
xor rax, rsp
mov qword [rsp + 0x1a30], rax
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x800
call fcn.14000cb30
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, 0x400
lea rdx, [rsp + 0x30]
mov r8d, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x30]
call qword [0x14001d3b0]
xor edx, edx
lea rcx, [rsp + 0x830]
mov r8d, 0x900
call fcn.14000cb30
lea r8, [rsp + 0x30]
mov edx, 0x480
lea rcx, [rsp + 0x830]
call fcn.14000f084
lea r8, str.jdk_binjava.exe
mov edx, 0x480
lea rcx, [rsp + 0x830]
call fcn.14000f084
xor r14d, r14d
mov ecx, 0x1000
mov dword [rsp + 0x20], r14d
call fcn.14000ace0
lea r8, [rsp + 0x20]
mov edx, 0x1000
mov rcx, rax
mov rsi, rax
call fcn.14000ac62
test eax, eax
je 0x140005e01
mov edi, ebx
lea rbp, [r14 - 1]
nop word [rax + rax]
mov edx, dword [rsp + 0x20]
lea rcx, [rdi*4]
cmp rdx, rcx
jb 0x140005e05
mov rcx, rsi
call fcn.14000acd8
add ebx, ebx
mov eax, 4
mov edi, ebx
mul rdi
cmovo rax, rbp
mov rcx, rax
call fcn.14000ace0
lea edx, [rbx*4]
mov dword [rsp + 0x20], r14d
lea r8, [rsp + 0x20]
mov rcx, rax
mov rsi, rax
call fcn.14000ac62
test eax, eax
jne 0x140005db0
mov edx, dword [rsp + 0x20]
mov ebp, edx
shr rbp, 2
test rbp, rbp
je 0x140005ec5
mov rdi, r14
nop word [rax + rax]
mov ecx, dword [rsi + rdi*4]
test ecx, ecx
je 0x140005eb9
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], r14d
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp dword [rsp + 0x24], r14d
jne 0x140005eb9
mov r8d, dword [rsi + rdi*4]
xor edx, edx
mov ecx, 0x431
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140005eb9
xor edx, edx
lea rcx, [rsp + 0x1130]
mov r8d, 0x900
call fcn.14000cb30
mov r9d, 0x105
lea r8, [rsp + 0x1130]
xor edx, edx
mov rcx, rbx
call fcn.14000ac68
test eax, eax
je 0x140005eb0
lea rdx, [rsp + 0x830]
lea rcx, [rsp + 0x1130]
call fcn.14000f30c
test eax, eax
jne 0x140005eb0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc rdi
cmp rdi, rbp
jl 0x140005e20
mov rcx, rsi
call fcn.14000acd8
mov rcx, qword [rsp + 0x1a30]
xor rcx, rsp
call fcn.14000b3c0
lea r11, [rsp + 0x1a40]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140006080
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x140006135
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x140006101
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006120
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140006120
mov rdx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je 0x140006120
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x14002ad60], 0
jne 0x140006180
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006170
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14002ad58], rax
mov byte [0x14002ad60], 1
jmp 0x140006187
mov rax, qword [0x14002ad58]
mov byte [0x14002ad60], 1
jmp 0x140006187
mov rax, qword [0x14002ad58]
mov rcx, qword [rbx]
mov rdx, rsi
test rax, rax
je 0x14000610a
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp rax
Function at 0x140006290
Capabilities:
Create service

Disassembly:
push rdi
sub rsp, 0xa90
mov rax, qword [0x14002a018]
xor rax, rsp
mov qword [rsp + 0xa80], rax
mov rdi, rcx
call fcn.140006510
test eax, eax
je 0x1400062c1
mov eax, 1
jmp 0x1400063c8
mov r8d, 0x104
lea rdx, [rsp + 0x72]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400064be
cmp eax, 0x104
je 0x1400064be
lea ecx, [rax + 1]
mov r8d, 0x22
mov word [rsp + 0x70], r8w
mov word [rsp + rcx*2 + 0x70], r8w
lea ecx, [rax + 2]
add rcx, rcx
cmp rcx, 0x20c
jae 0x140006507
mov qword [rsp + 0xaa8], rbx
xor edx, edx
mov qword [rsp + 0xab0], rsi
mov r8d, 0xf003f
xor esi, esi
mov word [rsp + rcx + 0x70], si
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x1400063e1
mov r8d, 0x400
lea rdx, [rsp + 0x280]
mov ecx, 0xd80a
call fcn.140005260
test eax, eax
jne 0x14000639f
lea r8, str.Could_not_open_Service_Manager
mov edx, 0x400
lea rcx, [rsp + 0x280]
call fcn.14000f104
test eax, eax
je 0x14000639f
cmp eax, 0xc
je 0x1400064db
cmp eax, 0x16
je 0x1400064d0
cmp eax, 0x22
je 0x1400064d0
cmp eax, 0x50
jne 0x1400064c5
lea r8, [rdi + 0x68]
xor r9d, r9d
lea rdx, [rsp + 0x280]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rbx, qword [rsp + 0xaa8]
mov rsi, qword [rsp + 0xab0]
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.14000b3c0
add rsp, 0xa90
pop rdi
ret
mov qword [rsp + 0x60], rsi
lea rax, str.RPCSS
mov qword [rsp + 0x58], rsi
add rdi, 0x68
mov qword [rsp + 0x50], rax
mov r9d, 0xf01ff
mov qword [rsp + 0x48], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rsi
mov r8, rdi
mov qword [rsp + 0x38], rax
mov rdx, rdi
mov dword [rsp + 0x30], 1
mov rcx, rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x1400064a2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r8d, 0x400
lea rdx, [rsp + 0x280]
mov ecx, 0xd80b
call fcn.140005260
test eax, eax
jne 0x140006497
lea r8, str.Could_not_start_service
mov edx, 0x400
lea rcx, [rsp + 0x280]
call fcn.14000f104
test eax, eax
je 0x140006497
cmp eax, 0xc
je 0x1400064fc
cmp eax, 0x16
je 0x1400064f1
cmp eax, 0x22
je 0x1400064f1
cmp eax, 0x50
jne 0x1400064e6
xor r9d, r9d
mov r8, rdi
jmp 0x1400063a6
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x1400063b8
xor eax, eax
jmp 0x1400063c8
mov ecx, 0x80004005
call fcn.140005ba0
int3
mov ecx, 0x80070057
call fcn.140005ba0
int3
mov ecx, 0x8007000e
call fcn.140005ba0
int3
mov ecx, 0x80004005
call fcn.140005ba0
int3
mov ecx, 0x80070057
call fcn.140005ba0
int3
mov ecx, 0x8007000e
call fcn.140005ba0
int3
call fcn.14000b0a4
int3