joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140033600
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
bt r8d, 0x10
jae 0x14003380f
mov r11, rsp
push r12
push r14
sub rsp, 0xe8
mov rax, qword [0x140081358]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r12, rdx
mov r14, rcx
test rcx, rcx
je 0x1400337f4
mov eax, dword [rcx]
mov qword [r11 + 0x18], rbx
cdq
mov qword [r11 - 0x18], rbp
and edx, 7
mov ebp, dword [rsp + 0x120]
add eax, edx
sar eax, 3
mov qword [r11 - 0x20], rsi
test r9, r9
mov qword [r11 - 0x28], rdi
lea rdi, [0x140067430]
mov qword [r11 - 0x30], r13
cmovne rdi, r9
mov qword [r11 - 0x38], r15
movsxd r15, dword [rcx + 4]
movsxd r13, eax
cmp ebp, 0x18
jne 0x14003369b
mov rcx, rdi
call fcn.140033f80
mov rdi, rax
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140033690
jmp 0x1400336da
cmp ebp, 0x19
jne 0x1400336bf
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1400336b0
add rbx, rbx
jmp 0x1400336da
mov rcx, rdi
call fcn.140034070
mov rdi, rax
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400336d1
mov rdx, rdi
cmp rbx, r15
jle 0x14003372d
mov r8d, ebx
mov rcx, r14
call qword [r12 + 0x18]
mov rcx, r14
call qword [r12 + 0x20]
lea rdx, [r14 + 8]
mov r8, r13
lea rcx, [rsp + 0x20]
call fcn.1400236b0
mov eax, r15d
lea rcx, [rsp + 0x20]
sub eax, r13d
add rcx, r13
movsxd r8, eax
xor edx, edx
call fcn.140021c80
mov edx, 1
mov rcx, r14
call qword [r12 + 0x10]
jmp 0x140033751
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.1400236b0
mov eax, r15d
lea rcx, [rsp + 0x20]
sub eax, ebx
add rcx, rbx
movsxd r8, eax
xor edx, edx
call fcn.140021c80
lea rcx, [r14 + 0x48]
mov r8, r15
lea rdx, [rsp + 0x20]
call fcn.1400236b0
mov r13, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0x110]
test r15d, r15d
jle 0x1400337a8
xor r9d, r9d
lea rcx, [rsp + 0x20]
mov rax, r14
sub rax, rcx
nop word [rax + rax]
lea rdx, [rsp + 0x20]
add rdx, r9
inc r9
xor byte [rdx], 0x36
xor byte [rax + rdx + 0x48], 0x5c
cmp r9, r15
jl 0x140033790
mov r8d, r15d
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [r12 + 0x18]
mov r15, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xd8]
cmp ebp, 0x18
jne 0x1400337d7
mov rcx, rdi
call fcn.140033f70
jmp 0x1400337e4
cmp ebp, 0x19
je 0x1400337e4
mov rcx, rdi
call fcn.140034060
mov rbp, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400342a0
add rsp, 0xe8
pop r14
pop r12
ret
Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add edi, edi
add byte [rax], al
add bh, bh
add eax, 0x1dff0d04
invalid
Function at 0x1800c036c
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x1803e3008]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rsi, qword [rdx + 0x10]
mov r14, rcx
mov r15, qword [rdx]
lea rcx, [rsp + 0x20]
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x44]
xorps xmm0, xmm0
mov dword [rsp + 0x40], 1
lea rax, [rsi + 3]
movdqa xmmword [rsp + 0x30], xmm0
shr rax, 2
mov qword [rsp + 0x28], 0x200
lea r8, [rax + rax*2]
call sym.python310.dll__PyBytesWriter_Prepare
mov rbx, rax
test rax, rax
je 0x1800c0506
xor edi, edi
xor cl, cl
xor r10d, r10d
xor r9d, r9d
mov rbp, rax
test rsi, rsi
je 0x1800c045b
cmp byte [r9 + r15], 0x3d
je 0x1800c04c2
movzx eax, byte [r9 + r15]
lea rdx, [0x1802620f0]
mov r8b, byte [rax + rdx]
cmp r8b, 0x40
jae 0x1800c044f
xor r10d, r10d
mov edx, edi
test edi, edi
je 0x1800c0447
sub edx, 1
je 0x1800c048f
sub edx, 1
jne 0x1800c04ac
shl cl, 4
lea edi, [rdx + 3]
mov al, r8b
shr al, 2
or al, cl
mov cl, r8b
mov byte [rbx], al
inc rbx
and cl, dil
jmp 0x1800c044f
mov edi, 1
mov cl, r8b
inc r9
cmp r9, rsi
jb 0x1800c03f4
test edi, edi
jne 0x1800c04d8
mov rdx, rbx
lea rcx, [rsp + 0x20]
call sym.python310.dll__PyBytesWriter_Finish
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180181080
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x260
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
shl cl, 2
mov al, r8b
shr al, 4
mov edi, 2
or al, cl
mov cl, r8b
mov byte [rbx], al
inc rbx
and cl, 0xf
jmp 0x1800c044f
cmp edx, 1
jne 0x1800c044f
shl cl, 6
xor edi, edi
or cl, r8b
mov byte [rbx], cl
inc rbx
xor cl, cl
jmp 0x1800c044f
cmp edi, 2
jl 0x1800c044f
inc r10d
lea eax, [r10 + rdi]
cmp eax, 4
jge 0x1800c045b
jmp 0x1800c044f
mov rcx, r14
call sym.python310.dll_PyModule_GetState
mov rcx, rax
test rax, rax
je 0x1800c04fc
cmp edi, 1
je 0x1800c050d
mov rcx, qword [rax]
lea rdx, str.Incorrect_padding
call sym.python310.dll_PyErr_SetString
lea rcx, [rsp + 0x20]
call sym.python310.dll__PyBytesWriter_Dealloc
xor eax, eax
jmp 0x1800c0468
mov rcx, qword [rcx]
sub rbx, rbp
movabs rax, 0x5555555555555556
imul rbx
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea r8, [rdx*4 + 1]
lea rdx, str.Invalid_base64_encoded_string:
call sym.python310.dll_PyErr_Format
jmp 0x1800c04fc
Function at 0x140004080
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
xor esi, esi

Function at 0x1400047b0
Capabilities:
Create service
Persist via windows service

Disassembly:
sub rsp, 0x488
mov rax, qword [0x1400230b0]
xor rax, rsp
mov qword [rsp + 0x470], rax
lea rdx, [rsp + 0x70]
mov r8d, 0x200
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000487d
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov qword [rsp + 0x480], rbx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rbx, rax
je 0x140004875
xor eax, eax
lea r8, str.Epson_Scanner_Service
lea rdx, str.EpsonScanSvc
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov r9d, 0xf01ff
mov rcx, rbx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
je 0x14000486c
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x480]
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14000a6e0
add rsp, 0x488
ret

Function at 0x1400048a0
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push rbp
sub rsp, 0x70
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rbp, rax
je 0x140004a0d
lea rdx, str.EpsonScanSvc
mov r8d, 0xf01ff
mov rcx, rax
mov qword [rsp + 0x90], rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rsi, rax
je 0x1400049fc
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x90]
add rsp, 0x70
pop rbp
ret

Function at 0x140004a20
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push rdi
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rdi, rax
je 0x140004ae8
lea rdx, str.EpsonScanSvc
mov r8d, 0xf01ff
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rbx, rax
je 0x140004ada
lea r8, [0x140025738]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140004ac8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140025738]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140004ac8
nop
Function at 0x140004af0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x520
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x1400230b0]
xor rax, rsp
mov qword [rsp + 0x510], rax
mov rbx, rcx
mov word [rsp + 0xf0], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xf2]
call fcn.14000c470
mov r8d, 0x104
lea rdx, [rsp + 0xf0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140004cab
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov r9, rbx
lea r8, str._REGISTER:
lea rdx, str._s__s_
lea rcx, [rsp + 0x50]
call fcn.140005c20
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x140004bbb
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0xf0]
lea r8, str.__s___s
mov edx, 0x208
lea rcx, [rsp + 0x300]
call fcn.140004000
jmp 0x140004bdc
lea r9, [rsp + 0xf0]
lea r8, str.__s_
mov edx, 0x208
lea rcx, [rsp + 0x300]
call fcn.140004000
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rsp + 0x88]
call fcn.14000c470
xor r11d, r11d
mov qword [rsp + 0x58], r11
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x80], 0x68
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], r11d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x300]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
je 0x140004c4f
invalid
Function at 0x1400057c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov r8d, 6
add ax, 1
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x140005931
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140005931
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x140005931
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x140005866
nop
cmp rdi, r11
jae 0x140005931
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x140005850
cmp rdi, r11
jae 0x140005931
movzx eax, word [rdi]
test ax, ax
je 0x140005931
movzx ebx, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x14000589c
mov edx, ebx
mov rcx, rsi
call fcn.140005ac0
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x1400058b9
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.14000b780
test eax, eax
je 0x140005907
cmp eax, 0xc
je 0x1400058fc
cmp eax, 0x16
je 0x1400058f1
cmp eax, 0x22
je 0x1400058f1
cmp eax, 0x50
je 0x140005907
mov ecx, 0x80004005
call fcn.140005e00
int3
mov ecx, 0x80070057
call fcn.140005e00
int3
mov ecx, 0x8007000e
call fcn.140005e00
int3
test ebx, ebx
js 0x140005926
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x140005926
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x140005933
mov ecx, 0x80070057
call fcn.140005e00
int3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x140005cd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12d, ecx
lea rcx, [0x1400246a0]
xor r13d, r13d
xor edx, edx
mov rbx, r13
call fcn.14000a290
lea ebp, [r13 + 1]
test rax, rax
mov rsi, rax
je 0x140005dd6
nop
test rbx, rbx
jne 0x140005dd6
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, 1
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
mov rdi, rax
jne 0x140005d43
mov rbx, r13
jmp 0x140005db9
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140005d59
mov rbx, r13
jmp 0x140005db4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
jne 0x140005d6f
mov rbx, r13
jmp 0x140005db4
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rbx
and ecx, 0xf
jbe 0x140005da2
nop
nop
cmp rbx, r11
jae 0x140005da7
add ecx, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140005d90
cmp rbx, r11
jb 0x140005dac
mov rbx, r13
jmp 0x140005db4
cmp word [rbx], r13w
cmove rbx, r13
test rbx, rbx
jne 0x140005df1
lea rcx, [0x1400246a0]
mov edx, ebp
call fcn.14000a290
add ebp, 1
test rax, rax
mov rsi, rax
jne 0x140005d10
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov rax, rsi
jmp 0x140005dd8
Function at 0x140006a90
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x250
mov rax, qword [0x1400230b0]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor dil, dil
xor ebp, ebp
xor esi, esi
xor r12d, r12d
mov r13, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [rbx + 0x10]
test rax, rax
jne 0x140006ad4
xor ecx, ecx
jmp 0x140006adf
mov rcx, qword [rbx + 0x18]
sub rcx, rax
sar rcx, 4
mov eax, ebp
cmp rax, rcx
jae 0x140006bd8
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140006b03
mov rax, qword [rbx + 0x18]
sub rax, rcx
sar rax, 4
cmp rsi, rax
jb 0x140006b08
call fcn.14000bcd0
mov rax, qword [rbx + 0x10]
or r9d, 0xffffffff
mov ecx, 0x400
mov r8, qword [r12 + rax]
lea edx, [r9 + 2]
mov dword [rsp + 0x28], 0xffffffff
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x140006bc8
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x208
call fcn.14000c470
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140006b64
mov rax, qword [rbx + 0x18]
sub rax, rcx
sar rax, 4
cmp rsi, rax
jb 0x140006b69
call fcn.14000bcd0
mov rax, qword [rbx + 0x10]
lea r9, [rsp + 0x30]
lea r8, [0x14001e6dc]
mov rcx, qword [r12 + rax + 8]
lea rdx, str.ScannerID
mov qword [rsp + 0x28], rcx
lea rcx, str.Version
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x140006bc8
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x30]
not rcx
lea r8d, [rcx - 1]
mov rcx, r13
call fcn.140005950
mov dil, 1
add ebp, 1
add rsi, 1
add r12, 0x10
jmp 0x140006ac7
mov al, dil
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000a6e0
add rsp, 0x250
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140009370
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x490
mov rax, qword [0x1400230b0]
xor rax, rsp
mov qword [rsp + 0x480], rax
xor eax, eax
mov rdi, rcx
mov rsi, rdx
lea rcx, [rsp + 0x62]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x3a], rax
mov qword [rsp + 0x42], rax
mov word [rsp + 0x38], bx
mov qword [rsp + 0x4a], rax
mov dword [rsp + 0x52], eax
mov word [rsp + 0x56], ax
mov word [rsp + 0x60], ax
call fcn.14000c470
lea rcx, [rsp + 0x272]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x270], bx
call fcn.14000c470
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x14000952d
movzx eax, word [rdi]
mov rcx, rbx
test ax, ax
je 0x140009493
nop
add ebx, 1
cmp ax, 0x2c
je 0x140009429
mov ax, word [rdi + rcx*2 + 2]
add rcx, 1
test ax, ax
jne 0x140009410
jmp 0x140009493
lea rcx, [rsp + 0x38]
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
movsxd r11, ebx
lea rax, [rsp + 0x270]
lea r8, [r11 + r11]
mov edx, 0x104
lea rcx, [rsp + 0x270]
sub r8, rax
add r8, rdi
nop
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140009485
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140009485
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140009460
jmp 0x14000948a
test rdx, rdx
jne 0x14000948e
sub rcx, 2
mov word [rcx], 0
lea rdx, str.WIN_DIR
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000957a
lea rdx, [0x14001e870]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000957a
lea rdx, str.PROGx86_DIR
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009554
lea rdx, [0x14001e8a0]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009554
lea rdx, str.PROG_DIR
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400095c0
xor r9d, r9d
lea rax, [rsp + 0x60]
xor r8d, r8d
lea edx, [r9 + 0x26]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x14000959a
xor al, al
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14000a6e0
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea r9, str.ProgramFiles_x86_
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call fcn.14000beb0
cmp qword [rsp + 0x30], 0
ja 0x14000959a
jmp 0x14000952d
xor r9d, r9d
lea rax, [rsp + 0x60]
xor r8d, r8d
lea edx, [r9 + 0x24]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14000952d
lea rax, [rsp + 0x270]
lea r9, [rsp + 0x60]
lea r8, str._s_s
mov edx, 0x208
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140004000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
setne al
jmp 0x14000952f
Function at 0x1400095e0
Capabilities:
Enumerate process modules

Disassembly:
push rsi
sub rsp, 0x3f0
mov rax, qword [0x1400230b0]
xor rax, rsp
mov qword [rsp + 0x3e0], rax
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x40]
mov edx, 0x190
mov sil, 1
call fcn.14001b466
test eax, eax
je 0x14000976d
mov ecx, dword [rsp + 0x20]
mov qword [rsp + 0x400], rbx
mov qword [rsp + 0x408], rbp
mov eax, ecx
and eax, 0xfffffffc
cmp eax, 0x190
jae 0x14000963f
shr ecx, 2
jmp 0x140009644
mov ecx, 0x64
xor ebx, ebx
test ecx, ecx
movsxd rbp, ecx
jle 0x140009768
mov qword [rsp + 0x410], rdi
nop
nop
mov rax, qword [str._unknown_]
lea rcx, [rsp + 0x1d0]
xor edx, edx
mov qword [rcx], rax
mov rax, qword [0x14001e8f0]
mov r8d, 0x1f4
mov qword [rcx + 8], rax
mov eax, dword [0x14001e8f8]
mov dword [rcx + 0x10], eax
lea rcx, [rsp + 0x1e4]
call fcn.14000c470
mov r8d, dword [rsp + rbx*4 + 0x40]
xor edx, edx
mov ecx, 0x100410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rdi, rax
je 0x140009727
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
mov rcx, rax
call fcn.14001b46c
test eax, eax
je 0x14000971e
mov rdx, qword [rsp + 0x28]
lea r8, [rsp + 0x1d0]
mov r9d, 0x104
mov rcx, rdi
call fcn.14001b472
test eax, eax
je 0x14000971e
lea rdx, str.EsDevApp.exe
lea rcx, [rsp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000971e
mov edx, 0x2710
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000971e
xor sil, sil
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 1
cmp rbx, rbp
jl 0x140009660
mov rdi, qword [rsp + 0x410]
mov al, sil
mov rbx, qword [rsp + 0x400]
mov rbp, qword [rsp + 0x408]
mov rcx, qword [rsp + 0x3e0]
xor rcx, rsp
call fcn.14000a6e0
add rsp, 0x3f0
pop rsi
ret
mov al, sil
jmp 0x14000973f
mov al, sil
jmp 0x14000974f
Function at 0x140009e20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x258
mov rax, qword [0x1400230b0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbp, r8
lea r8, [0x14001e6dc]
mov ebx, 0x104
mov r11, rdx
mov r10, rcx
xor edi, edi
sub r8, r9
mov rsi, r9
mov rdx, rbx
mov rcx, r9
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140009e86
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140009e86
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140009e61
jmp 0x140009e8b
test rdx, rdx
jne 0x140009e8f
sub rcx, 2
lea rax, [rsp + 0x38]
mov word [rcx], di
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r11
mov rcx, r10
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140009f46
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x30], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140009f3b
lea rdx, [rsp + 0x40]
mov rcx, rsi
sub rdx, rsi
nop
nop
lea rax, [rbx + 0x7ffffefa]
test rax, rax
je 0x140009f24
movzx eax, word [rdx + rcx]
test ax, ax
je 0x140009f24
mov word [rcx], ax
add rcx, 2
sub rbx, 1
jne 0x140009f00
jmp 0x140009f29
test rbx, rbx
jne 0x140009f2d
sub rcx, 2
mov word [rcx], di
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000a6e0
add rsp, 0x258
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14000a310
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1400230b0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.14000c470
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x140003000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.14000c470
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x14000a3a3
cmp dword [rsp + 0x24], 5
jb 0x14000a3bd
jmp 0x14000a3b9
cmp dword [rsp + 0x30], esi
jne 0x14000a3bd
cmp dword [rsp + 0x24], 4
ja 0x14000a3b9
jne 0x14000a3bd
cmp dword [rsp + 0x28], 0
jbe 0x14000a3bd
mov byte [rbx + 0x18], sil
lea rax, [0x14001c668]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.14000a150
movzx ecx, byte [0x140025788]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x140025788], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14000a6e0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret