joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400244a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x140024659
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x140024536
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.140023e10
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.140023400
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x140024527
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.1400198c0
mov dword [rbx + 0x80], 0
jmp 0x140024645
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
mov r8d, 4
call fcn.1400222e0
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14003fee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140059040]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [rcx]
mov ebx, edx
test al, al
je 0x14003ff18
cmp al, 0x25
jne 0x14003ff0d
cmp byte [rcx + 1], al
jne 0x14003ff18
inc rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14003ff01
cmp byte [rcx], 0x25
jne 0x14003ffe9
cmp byte [rcx + 1], 0x25
je 0x14003ffe9
xorps xmm3, xmm3
mov r8, rcx
cvtss2sd xmm3, xmm2
mov edx, 0x40
lea rcx, [rsp + 0x30]
movq r9, xmm3
call fcn.140007f80
cmp byte [rsp + 0x30], 0x20
lea rcx, [rsp + 0x30]
jne 0x14003ff5d
inc rcx
cmp byte [rcx], 0x20
je 0x14003ff55
lea eax, [rbx - 4]
cmp eax, 1
jbe 0x14003ffd7
movzx edx, byte [rcx]
movzx r8d, dl
cmp dl, 0x2d
jne 0x14003ff76
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
xorps xmm1, xmm1
cmovne rax, rcx
cmp r8b, 0x2b
lea rcx, [rax + 1]
cmovne rcx, rax
movzx eax, byte [rcx]
cmp al, 0x30
jl 0x14003ffc6
movss xmm2, dword [0x1400511d8]
nop dword [rax]
cmp al, 0x39
ja 0x14003ffc6
movsx eax, byte [rcx]
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x14003ffa0
cmp dl, 0x2d
jne 0x14003ffe4
xorps xmm1, xmmword [0x140051950]
movaps xmm0, xmm1
jmp 0x14003ffec
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14003ffec
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400414a0
add rsp, 0x80
pop rbx
ret

Function at 0x140040010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140059040]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [rcx]
mov ebx, edx
test al, al
je 0x140040048
cmp al, 0x25
jne 0x14004003d
cmp byte [rcx + 1], al
jne 0x140040048
inc rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140040031
cmp byte [rcx], 0x25
jne 0x14004010b
cmp byte [rcx + 1], 0x25
je 0x14004010b
mov r8, rcx
movaps xmm3, xmm2
lea rcx, [rsp + 0x30]
movq r9, xmm2
mov edx, 0x40
call fcn.140007f80
cmp byte [rsp + 0x30], 0x20
lea rcx, [rsp + 0x30]
jne 0x140040089
inc rcx
cmp byte [rcx], 0x20
je 0x140040081
lea eax, [rbx - 4]
cmp eax, 1
jbe 0x1400400fd
movzx edx, byte [rcx]
movzx r8d, dl
cmp dl, 0x2d
jne 0x1400400a2
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
xorps xmm1, xmm1
cmovne rax, rcx
cmp r8b, 0x2b
lea rcx, [rax + 1]
cmovne rcx, rax
movzx eax, byte [rcx]
cmp al, 0x30
jl 0x1400400ec
movsd xmm2, qword [0x140051190]
cmp al, 0x39
ja 0x1400400ec
movsx eax, byte [rcx]
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x1400400c8
cmp dl, 0x2d
jne 0x140040106
xorps xmm1, xmmword [0x140051940]
movaps xmm0, xmm1
jmp 0x14004010e
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14004010e
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400414a0
add rsp, 0x80
pop rbx
ret
Function at 0x140042208
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140042252
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140042252
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140042252
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140042252
cmp dword [rcx + 0x84], 0xe
jbe 0x140042252
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140042254
xor al, al
add rsp, 0x28
ret
Function at 0xe086c0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xe086cd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xe086dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xe086c5
lea eax, [rcx + 1]
jmp 0xe086eb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xe086fe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xe086e4
sub eax, 3
jb 0xe0871e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xe0876d
sar eax, 1
movsxd rbp, eax
jb 0xe08754
jmp 0xe0872c
add ebx, ebx
jne 0xe0872a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xe08754
inc ecx
add ebx, ebx
jne 0xe0873a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xe08754
call r11
adc ecx, ecx
add ebx, ebx
jne 0xe0874d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xe0873c
add ecx, 2
jmp 0xe08759
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00e08682
jmp 0xe086cd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xbba00
mov dl, 0x17
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xe087b9
cmp rsi, rcx
jae 0xe087c1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xe087a0
cmp al, 0x8f
ja 0xe087a0
cmp byte [rsi - 2], 0xf
je 0xe087a6
sub al, 0xe8
cmp al, 1
ja 0xe0878a
cmp rsi, rcx
jae 0xe087c1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xe08790
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xe087c1
lodsb al, byte [rsi]
jmp 0xe087a0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xa04000]
mov eax, dword [rdi]
or eax, eax
je 0xe0881e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xa08000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xe087ce
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xe08818
mov qword [rbx], rax
add rbx, 8
jmp 0xe087ee
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xe08862
cmp al, 0xef
ja 0xe0884a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xe0882a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xe08839
mov eax, dword [rdi]
add rdi, 4
jmp 0xe08839
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xe088b6
sub rsp, 0xffffffffffffff80
jmp 0x470560
Function at 0x140001030
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rdi, rcx
mov rbp, rdx
mov ecx, 0x80
call fcn.1400033d4
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
xor r15d, r15d
mov rbx, rax
movups xmmword [rax], xmm0
lea rsi, [rax + 0x10]
movups xmmword [rax + 0x10], xmm0
lea r14, [rax + 8]
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov qword [r14], r15
mov qword [rsi], r15
mov dword [rax], r15d
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400010ae
mov qword [rsi], r15
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14001e410]
movdqa xmm0, xmmword [0x140027020]
xor edx, edx
movups xmmword [rbx + 0x18], xmm0
xor ecx, ecx
movups xmmword [rbx + 0x28], xmm0
movups xmmword [rbx + 0x38], xmm0
movups xmmword [rbx + 0x48], xmm0
movups xmmword [rbx + 0x58], xmm0
movups xmmword [rbx + 0x68], xmm0
movd dword [rbx + 0x78], xmm0
mov qword [rdi], rbx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x140001219
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov dword [rsp + 0x38], r15d
xor r8d, r8d
mov qword [rsp + 0x30], r15
xor ecx, ecx
mov dword [rsp + 0x28], 3
lea edx, [r9 - 1]
mov dword [rbx], 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x140001219
xor edx, edx
mov qword [rsp + 0x20], r14
lea r9, [0x14001e600]
lea rcx, [0x14001e610]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140001219
lfence
mov rcx, qword [r14]
lea rdx, str.rootcimv2
mov qword [rsp + 0x40], rsi
xor r9d, r9d
mov qword [rsp + 0x38], r15
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov rax, qword [rcx]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov rax, qword [rax + 0x18]
call qword [0x14001e410]
test eax, eax
js 0x140001219
lfence
mov rcx, qword [rsi]
xor r9d, r9d
mov dword [rsp + 0x38], r15d
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
lea edx, [r9 + 0xa]
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x140001219
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x140001219
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x20], rax
test rax, rax
je 0x140001219
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x28], rax
test rax, rax
je 0x140001219
mov qword [rdi + 8], rbp
mov eax, 1
jmp 0x14000121b
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140001530
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14002a028]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rcx + 0x10], 0
mov rbx, rcx
jne 0x1400015d4
lea rax, [rsp + 0x30]
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x1400015f0]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x10], rax
mov rcx, rax
test rax, rax
jne 0x140001598
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400033b0
add rsp, 0x50
pop rbx
ret
mov rax, qword [rbx + 0x18]
lea rdx, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x40], rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x38], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x1400015d4
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], 0
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400033b0
add rsp, 0x50
pop rbx
ret
Function at 0x1400024e0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14002a028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edi, edx
mov rbx, rcx
mov rdx, qword [rcx + 8]
test rdx, rdx
je 0x14000252a
xor r8d, r8d
lea rcx, [0x140002af0]
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
test rax, rax
je 0x14000252a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
mov rcx, qword [rbx + 0x10]
xor esi, esi
test rcx, rcx
je 0x14000253f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rsi
mov rcx, qword [rbx]
test rcx, rcx
je 0x140002583
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x110
mov dword [rsp + 0x24], 1
mov dword [rsp + 0x28], 5
mov dword [rsp + 0x2c], edi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x38], esi
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x140002583
mov rcx, rbx
call int.140002450
mov rbx, qword [rbx + 0x20]
test rbx, rbx
je 0x14000269d
cmp qword [rbx + 0x10], rsi
je 0x1400025d0
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x10]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400025c2
mov rcx, qword [rbx + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rsi
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400025e3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x28], rsi
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400025f6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x18], rsi
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140002609
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x20], rsi
mov rdi, qword [rbx]
mov qword [rbx + 8], rsi
test rdi, rdi
je 0x14000268d
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14000262f
mov qword [rdi + 0x10], rsi
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14001e410]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140002649
mov qword [rdi + 8], rsi
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14001e410]
cmp dword [rdi], 1
jne 0x140002654
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14000266a
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14001e410]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140002680
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14001e410]
mov edx, 0x80
mov rcx, rdi
call fcn.140003410
mov edx, 0x30
mov qword [rbx], rsi
mov rcx, rbx
call fcn.140003410
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400033b0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400026c0
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
sub edx, 0x8000
je 0x140002735
sub edx, 1
je 0x1400026db
sub edx, 1
je 0x140002735
cmp edx, 2
jne 0x14000273e
mov qword [rsp + 0x20], rbx
mov rbx, qword [rcx + 0x20]
cmp qword [rbx + 0x10], 0
je 0x140002729
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x10]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140002717
mov rcx, qword [rbx + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], 0
mov rbx, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x20]
call fcn.140001530
xor eax, eax
add rsp, 0x28
ret

Function at 0x140002940
Capabilities:
Query service status

Disassembly:
sub rsp, 0x78
mov rax, qword [0x14002a028]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rcx, rdx
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140002983
lea rcx, str.Failed_to_get_service_status._n
call fcn.140001c70
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400033b0
add rsp, 0x78
ret
mov eax, dword [rsp + 0x44]
mov qword [rsp + 0x70], rbx
xor ebx, ebx
sub eax, 1
je 0x1400029fd
sub eax, 1
je 0x1400029de
sub eax, 1
je 0x1400029cd
sub eax, 1
je 0x1400029bc
cmp eax, 1
jne 0x140002a4d
mov dword [rsp + 0x24], 5
lea rcx, str.Service_is_resuming..._n
jmp 0x140002a0c
mov dword [rsp + 0x24], 4
lea rcx, str.Service_RUNNING._n
jmp 0x140002a0c
mov dword [rsp + 0x24], 3
lea rcx, str.Service_is_stopping..._n
jmp 0x140002a0c
lea rcx, str.Service_is_starting..._n
call fcn.140001c70
mov dword [rsp + 0x20], 0x110
mov qword [rsp + 0x24], 2
jmp 0x140002a21
mov dword [rsp + 0x24], 1
lea rcx, str.Service_STOPPED._n
mov dword [rsp + 0x20], 0x110
call fcn.140001c70
mov dword [rsp + 0x28], 5
mov rcx, qword [0x14002aa70]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x2c], rbx
mov qword [rsp + 0x34], rbx
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x140002a4d
lea rcx, [0x14002aa70]
call int.140002450
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400033b0
add rsp, 0x78
ret
Function at 0x140002b30
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
mov ebx, edx
lea rcx, str.Failed._Error__d
call fcn.140001c70
xor eax, eax
mov r9d, 0x400
mov qword [rsp + 0x30], rax
mov r8d, ebx
mov dword [rsp + 0x28], eax
xor edx, edx
lea rax, [rsp + 0x40]
mov ecx, 0x1300
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x140002b98
mov rdx, qword [rsp + 0x40]
lea rcx, [0x140026d78]
call fcn.1400030e0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140002ba4
lea rcx, str.unknown_error_n
call fcn.140001c70
lea r8, [0x140026d90]
lea rdx, str.balloon.log
lea rcx, [rsp + 0x48]
call fcn.14000de30
test eax, eax
jne 0x140002be6
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140002be6
mov r9d, ebx
lea rdx, str._s_failed__error_code___d_n
mov r8, rdi
call fcn.140003090
mov rcx, qword [rsp + 0x48]
call fcn.14000dfa8
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140002bf0
Capabilities:
Create service
Persist via windows service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x490
mov rax, qword [0x14002a028]
xor rax, rsp
mov qword [rsp + 0x480], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, 0x104
lea rdx, [rsp + 0x270]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rbx, [0x140026e60]
mov edx, 0xff
mov r9, rbx
lea rax, [rsp + 0x70]
sub r9, rax
lea rcx, [rsp + 0x70]
mov r8d, edx
nop dword [rax]
lea rax, [r8 + 0x7ffffeff]
test rax, rax
je 0x140002c73
movzx eax, word [r9 + rcx]
test ax, ax
je 0x140002c73
mov word [rcx], ax
add rcx, 2
sub r8, 1
jne 0x140002c50
test r8, r8
lea rax, [rcx - 2]
cmovne rax, rcx
xor edi, edi
mov word [rax], di
test r8, r8
je 0x140002e29
mov rcx, rdx
lea rax, [rsp + 0x70]
cmp word [rax], di
je 0x140002ca3
add rax, 2
sub rcx, 1
jne 0x140002c94
mov rax, rdx
sub rax, rcx
test rcx, rcx
cmove rax, rdi
je 0x140002e29
mov r9, rdx
lea rcx, [rsp + 0x70]
lea rcx, [rcx + rax*2]
mov r8d, 0x7ffffffe
sub r9, rax
je 0x140002d01
lea r11, [rsp + 0x270]
mov eax, r8d
sub r11, rcx
nop dword [rax + rax]
test rax, rax
je 0x140002d01
movzx r10d, word [r11 + rcx]
test r10w, r10w
je 0x140002d01
mov word [rcx], r10w
dec rax
add rcx, 2
sub r9, 1
jne 0x140002ce0
test r9, r9
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], di
je 0x140002e29
mov rcx, rdx
lea rax, [rsp + 0x70]
nop dword [rax]
cmp word [rax], di
je 0x140002d2f
add rax, 2
sub rcx, 1
jne 0x140002d20
mov rax, rdx
sub rax, rcx
test rcx, rcx
cmove rax, rdi
je 0x140002e29
lea rcx, [rsp + 0x70]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x140002d71
sub rbx, rcx
test r8, r8
je 0x140002d71
movzx eax, word [rbx + rcx]
test ax, ax
je 0x140002d71
mov word [rcx], ax
dec r8
add rcx, 2
sub rdx, 1
jne 0x140002d53
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], di
je 0x140002e29
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x140002e4c
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rdi
lea r8, str.Balloon_Service
mov qword [rsp + 0x50], rdi
lea rdx, str.BalloonService
mov qword [rsp + 0x48], rdi
mov r9d, 0xf01ff
mov qword [rsp + 0x40], rdi
mov rcx, rbx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
je 0x140002e61
lea rcx, str.Service_Installed_n
call fcn.140001c70
call fcn.140002e80
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x140002e2b
xor eax, eax
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1400033b0
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x490
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager
call fcn.140002b30
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateService
call fcn.140002b30
int3