joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800f5120
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
movsxd r12, edx
mov rdi, rcx
mov qword [rax - 0x18], r14
mov ecx, r12d
mov esi, r9d
mov r14, r8
call fcn.1800b0d20
test eax, eax
jne 0x1800f52ce
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x58], r13
mov rbx, r12
mov qword [rsp + 0x48], r15
lea r15, [0x18022d530]
mov dword [rdi + 0x110], r12d
imul rbx, rbx, 0x78
test esi, esi
mov r13d, dword [rbx + r15 + 0xc]
jne 0x1800f518a
mov eax, 0x7d1
jmp 0x1800f52bf
mov ecx, dword [rbx + r15 + 0x10]
mov qword [rsp + 0x78], rbp
call fcn.180079290
test rax, rax
mov rbp, rax
je 0x1800f51bf
mov ecx, dword [rbx + r15 + 0x10]
call fcn.180079290
test rax, rax
mov qword [rdi + 0x228], rax
jne 0x1800f51c9
mov rcx, rbp
call fcn.180078fc0
mov eax, reloc.WSOCK32.dll_ioctlsocket
jmp 0x1800f52ba
mov ecx, dword [rbx + r15 + 0x10]
cmp esi, ecx
jbe 0x1800f521b
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x30]
mov r9, rax
mov qword [rsp + 0x20], rcx
mov r8d, esi
mov rdx, r14
mov ecx, r12d
call fcn.1800f2970
test eax, eax
mov esi, eax
jne 0x1800f52a4
mov eax, dword [rbx + r15 + 0x10]
cmp r13d, eax
jae 0x1800f5249
sub eax, r13d
mov rcx, r13
add rcx, qword [rdi + 0x228]
mov edx, eax
call fcn.1800af3a0
jmp 0x1800f5249
mov r8, rsi
mov rdx, r14
mov rcx, rax
call fcn.1800ae650
mov r11d, dword [rbx + r15 + 0x10]
cmp esi, r11d
jae 0x1800f5249
mov rax, qword [rdi + 0x228]
sub r11d, esi
lea rcx, [rsi + rax]
mov edx, r11d
call fcn.1800af3a0
xor r8d, r8d
cmp dword [rbx + r15 + 0x10], r8d
jbe 0x1800f5280
mov r9, rbp
nop
nop
nop
mov rax, qword [rdi + 0x228]
inc r9
movzx edx, byte [r8 + rax]
inc r8d
xor dl, 0x36
mov byte [r9 - 1], dl
cmp r8d, dword [rbx + r15 + 0x10]
jb 0x1800f5260
mov rcx, rdi
call qword [rbx + r15 + 0x58]
test eax, eax
mov esi, eax
jne 0x1800f52a4
mov r8d, dword [rbx + r15 + 0x10]
mov rdx, rbp
mov rcx, rdi
call qword [rbx + r15 + 0x60]
test eax, eax
mov esi, eax
je 0x1800f52b0
mov rcx, qword [rdi + 0x228]
call fcn.180078fc0
mov rcx, rbp
call fcn.180078fc0
mov eax, esi
mov rbp, qword [rsp + 0x78]
mov r13, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x70]
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
add rsp, 0x68
ret
Function at 0x1800f83f0
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x28], rbp
lea r10, [rdx + 2]
mov qword [rsp + 0x38], rdi
mov rdi, rdx
mov qword [rsp + 0x10], r12
mov qword [rsp + 8], r13
movabs r13, 0xaaaaaaaaaaaaaaab
mov rbp, r9
mov r12, r8
mov rax, r13
mov r11, rcx
mul r10
shr rdx, 1
shl rdx, 2
inc rdx
cmp qword [r9], rdx
jae 0x1800f8444
mov qword [r9], rdx
mov eax, 0x7d4
jmp 0x1800f856e
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov rbx, qword [0x180155250]
mov rax, r13
mov qword [rsp + 0x30], rsi
mov rsi, r9
mul rdi
shr rdx, 1
lea rcx, [rdx + rdx*2]
test rcx, rcx
je 0x1800f84f3
dec rcx
mov rax, r13
mul rcx
mov r10, rdx
shr r10, 1
inc r10
lea rsi, [r10 + r10*2]
nop
nop
nop
movzx eax, byte [r11]
add r8, 4
add r11, 3
shr rax, 2
movzx eax, byte [rax + rbx]
mov byte [r8 - 4], al
movzx ecx, byte [r11 - 2]
mov al, byte [r11 - 3]
shl eax, 4
shr ecx, 4
lea edx, [rax + rcx]
and edx, 0x3f
movzx eax, byte [rdx + rbx]
mov byte [r8 - 3], al
mov al, byte [r11 - 2]
movzx ecx, byte [r11 - 1]
shr ecx, 6
lea ecx, [rcx + rax*4]
and ecx, 0x3f
movzx eax, byte [rcx + rbx]
mov byte [r8 - 2], al
mov al, byte [r11 - 1]
and eax, 0x3f
dec r10
movzx eax, byte [rax + rbx]
mov byte [r8 - 1], al
jne 0x1800f8490
cmp rsi, rdi
jae 0x1800f8554
movzx edx, byte [r11]
inc rsi
cmp rsi, rdi
jae 0x1800f8509
movzx r9d, byte [r11 + 1]
mov eax, edx
add edx, edx
shr al, 2
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r8], al
mov eax, r9d
shr eax, 4
lea ecx, [rax + rdx*8]
and ecx, 0x3f
cmp rsi, rdi
movzx eax, byte [rcx + rbx]
mov byte [r8 + 1], al
jae 0x1800f8542
and r9d, 0xf
shl r9d, 2
movsx ecx, byte [r9 + rbx]
jmp 0x1800f8547
mov ecx, 0x3d
mov byte [r8 + 2], cl
mov byte [r8 + 3], 0x3d
add r8, 4
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x20]
mov byte [r8], 0
sub r8d, r12d
mov eax, r8d
mov qword [rbp], rax
xor eax, eax
mov r13, qword [rsp + 8]
mov r12, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x28]
add rsp, 0x18
ret

Function at 0x1800ff9a8
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1800ff9c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1800ff9c2
xor eax, eax
test eax, eax
je 0x1800ff9d2
mov ecx, eax
call fcn.180008f00
or eax, 0xffffffff
jmp 0x1800ff9d4
xor eax, eax
add rsp, 0x28
ret

Function at 0x180101fe4
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180101ffa
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180101ffc
xor eax, eax
test eax, eax
je 0x18010200c
mov ecx, eax
call fcn.180008f00
or eax, 0xffffffff
jmp 0x18010200e
xor eax, eax
add rsp, 0x28
ret
Function at 0x1802985a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1802985cd
xor al, al
jmp 0x18029872f
mov rax, qword [0x1802b86b0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1802b86b8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1802b86c0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1802b86c8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1802b86d0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1802b86d8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1802b86e0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1802b86e8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1802b86f0]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x180298721
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x180298679
mov r11d, 2
jmp 0x18029869d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x180298693
mov r11d, 1
jmp 0x18029869d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x180298745
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1802986e2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1802986fa
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x18029870a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x180298718
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x180298660
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x18029872a
Function at 0x140005d6c
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x198]
sub rsp, 0x290
mov rax, qword [0x14002d670]
xor rax, rsp
mov qword [rbp + 0x180], rax
xor esi, esi
mov dword [rsp + 0x78], 0xff
lea rax, [rsp + 0x68]
mov dword [rsp + 0x60], esi
mov r9d, 0x20019
mov dword [rsp + 0x70], esi
xor r8d, r8d
mov dword [rsp + 0x74], esi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion_rempl_shell
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov edi, 0x80070000
test eax, eax
je 0x140005dfb
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
test ebx, ebx
je 0x140005dfb
mov ecx, ebx
call fcn.1400091d8
jmp 0x140005ec0
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rsi
xor r9d, r9d
mov qword [rsp + 0x50], rsi
xor r8d, r8d
mov qword [rsp + 0x48], rsi
xor edx, edx
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140005e48
mov ebx, esi
jmp 0x140005e56
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
test ebx, ebx
jne 0x140005def
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x140005ec0
mov edi, esi
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x74]
mov qword [rsp + 0x38], rsi
lea r9, [rsp + 0x78]
mov qword [rsp + 0x30], rsi
lea r8, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov edx, edi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
test eax, eax
jne 0x140005eb8
lea rdx, str..IterationCount
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
test rax, rax
je 0x140005eb8
mov rcx, qword [rsp + 0x68]
lea rdx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
inc edi
cmp edi, dword [rsp + 0x60]
jb 0x140005e60
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140005ed0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, ebx
call fcn.1400091f4
mov eax, ebx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140018830
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140008378
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
and qword [rbp + 0x20], 0
lea r8, [rbp + 0x20]
xor ebx, ebx
lea rcx, str.D:PAI_A_OICI_FA___WD_
xor esi, esi
xor r9d, r9d
mov qword [rbp + 0x28], rsi
lea edi, [rbx + 1]
mov edx, edi
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
jne 0x1400083d8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jne 0x1400083c5
mov edi, 0x80004005
jmp 0x1400084a8
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x1400084a8
xor eax, eax
lea r8, str.GlobalMicrosoft.Windows.Remediation.TelemetryPlugin
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x10], rax
xor edx, edx
mov rax, qword [rbp + 0x20]
and dword [rbp - 0x10], ebx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x20], 0x18
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov rbx, rax
test rax, rax
je 0x1400083b1
mov edx, 0x2710
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test eax, eax
je 0x140008456
cmp eax, 0x102
je 0x14000844f
cmp eax, 0xffffffff
jne 0x1400083bb
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jne 0x14000843b
xor edi, edi
jmp 0x1400084af
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
je 0x1400084af
jmp 0x1400084a8
mov edi, 0x800705b4
jmp 0x1400084a8
lea r9, [rbp + 0x28]
call fcn.140009fe0
mov rsi, qword [rbp + 0x28]
test eax, eax
cmovs rsi, rdi
call fcn.14000a184
mov edi, eax
test eax, eax
jns 0x140008478
mov ecx, eax
jmp 0x1400084aa
xor ecx, ecx
call fcn.1400091f4
lea r9, [rsi + 1]
mov dword [rsp + 0x20], 8
call fcn.14000a99c
mov edi, eax
test eax, eax
jns 0x14000849d
mov ecx, eax
call fcn.1400091d8
mov ecx, edi
call fcn.1400091f4
test edi, edi
jns 0x1400084af
mov ecx, edi
call fcn.1400091d8
test rbx, rbx
je 0x1400084bd
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
test edi, edi
jns 0x1400084cf
lea rdx, str.Failed_to_get_a_proper_GlobalEventCounter_for_telemetry__using_0
mov ecx, edi
call fcn.140008768
test rbx, rbx
je 0x1400084dd
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x1400084ec
call qword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalFree]
mov rax, rsi
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140008ce4
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
xor edi, edi
mov qword [rax - 0x40], rbx
mov r15, r9
mov r12, r8
mov r13, rdx
mov rbp, rcx
test rcx, rcx
jne 0x140008d2a
mov ecx, 0x80070057
mov edi, ecx
call fcn.1400091d8
jmp 0x140008e0c
test r13, r13
je 0x140008d19
test r12, r12
je 0x140008d19
test r15, r15
je 0x140008d19
mov r14, qword [rsp + 0x90]
test r14, r14
je 0x140008d19
lea rdx, [rsp + 0x70]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test eax, eax
jne 0x140008d77
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
je 0x140008d77
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
je 0x140008d77
mov ecx, edi
jmp 0x140008d20
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.140009918
mov rbx, qword [rsp + 0x28]
test rbx, rbx
jne 0x140008d95
mov edi, 0x8007000e
jmp 0x140008d73
mov r9, rbx
mov r8d, esi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x140008dcb
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jne 0x140008dbb
mov edi, 0x80004005
jmp 0x140008d73
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x140008d73
lea r9, [rsp + 0x20]
mov rcx, rbx
lea r8, [rsp + 0x30]
lea rdx, [0x14001d6d0]
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
test eax, eax
je 0x140008daa
mov rdx, qword [rsp + 0x30]
movzx ecx, word [rdx + 0xa]
mov dword [r13], ecx
movzx ecx, word [rdx + 8]
mov dword [r12], ecx
movzx ecx, word [rdx + 0xe]
mov dword [r15], ecx
movzx ecx, word [rdx + 0xc]
mov dword [r14], ecx
mov ecx, edi
call fcn.1400091f4
mov rcx, rbx
call fcn.140018ef0
lea r11, [rsp + 0x40]
mov eax, edi
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000ca14
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rbx, r9
mov r10, r8
mov r9, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r10]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x14000ca4c
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rdi, qword [rsi + 8]
add r8, r8
mov rax, qword [rsi + 0x18]
cmp rdi, qword [rax + r8*8]
je 0x14000cad7
mov rdi, qword [rax + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r8*8]
je 0x14000cad7
mov ecx, dword [r10]
mov rdi, qword [rdi + 8]
cmp ecx, dword [rdi + 0x10]
je 0x14000caa5
cmp rdi, qword [rax + r8*8]
jne 0x14000ca94
jmp 0x14000cad7
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
mov rcx, rbx
call fcn.140018814
mov rax, qword [rsp + 0x68]
mov qword [rax], rdi
mov byte [rax + 8], 0
jmp 0x14000cc05
mov qword [rsp + 0x28], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x14000cb11
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x14000cb2e
mov qword [rdx + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14000cb5d
cmp rax, rdi
jne 0x14000cb39
mov qword [rdx + r8*8], rbx
jmp 0x14000cb5d
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14000cb5d
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x1400241d0]
test rax, rax
jns 0x14000cb7e
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14000cb8f
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x14000cbfa
cmp rdx, 0x200
jae 0x14000cba7
shl rdx, 3
jmp 0x14000cbb9
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x14000cbb9
add rdx, rdx
mov rcx, rsi
call fcn.14000a90c
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x14000cbf5
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.14000ca14
cmp rdi, qword [rsp + 0x20]
jne 0x14000cbd3
mov r9, qword [rsp + 0x68]
mov qword [r9], rbx
mov byte [r9 + 8], 1
mov rax, r9
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14000cc8c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rdi, rdx
movabs rcx, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 4
jb 0x14000cca9
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14000cd01
cmp qword [rcx + rdx*8], r8
jne 0x14000ccf6
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x14000ccfa
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14000cd0e
cmp qword [rcx + rdx*8], r8
jne 0x14000cd0e
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r9 + 0x10]
call fcn.140018814
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000ce90
Capabilities:
Delete service
Stop service

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
sub rsp, 0x50
mov rax, qword [0x14002d670]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
xor edx, edx
mov qword [r11 - 0x38], rax
xor ecx, ecx
mov qword [r11 - 0x30], rax
mov ebp, 0xe10
mov qword [r11 - 0x28], rax
lea r8d, [rax + 1]
mov dword [rsp + 0x38], eax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14000cf01
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
lea rdx, str.Failed_OpenSCManager
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140008768
jmp 0x14000d01e
mov r8d, 0x10024
lea rdx, str.Windows_Remediation_Service
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14000cf44
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea rdx, str.Failed_OpenService
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140008768
jmp 0x14000d007
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
test eax, eax
je 0x14000cfda
lea rdx, str.Stopping_service
xor ecx, ecx
call fcn.140008980
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000cf8f
mov eax, dword [rsp + 0x24]
cmp eax, 3
jne 0x14000cfa5
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
sub ebp, 1
je 0x14000cfa1
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
test eax, eax
jne 0x14000cf76
mov eax, dword [rsp + 0x24]
cmp eax, 1
jne 0x14000cfba
lea rdx, str.Service_stopped
xor ecx, ecx
call fcn.140008980
jmp 0x14000cfda
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
lea rdx, str.Stop_service_failed
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140008768
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_DeleteService]
test eax, eax
jne 0x14000cff9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea rdx, str.Failed_to_delete_service
jmp 0x14000cf2c
lea rdx, str.Service_removed
xor ecx, ecx
call fcn.140008980
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
test rbx, rbx
je 0x14000d01e
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140018830
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
Function at 0x14000f94c
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get file version info

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x168]
sub rsp, 0x268
mov rax, qword [0x14002d670]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x1d0]
mov r13, rcx
mov qword [rsp + 0x30], rdx
lea rcx, [rsp + 0x40]
mov r14d, 0x104
mov qword [rsp + 0x38], rax
xor esi, esi
mov edx, r14d
and qword [rsp + 0x20], rsi
mov r12, r9
mov r15, r8
xor edi, edi
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x102
ja 0x14000faf4
lea r8, str.kernel32.dll
mov edx, r14d
lea rcx, [rsp + 0x40]
call fcn.140002c60
mov ebx, eax
test eax, eax
js 0x14000fb0c
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000fa20
mov edx, r14d
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x102
ja 0x14000fa65
lea r8, str._ntdll.dll
mov edx, r14d
lea rcx, [rsp + 0x40]
call fcn.140002c60
mov ebx, eax
test eax, eax
js 0x14000fb0c
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov r14d, eax
test eax, eax
je 0x14000fa65
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov rsi, rax
test rax, rax
je 0x14000fa65
mov r8d, r14d
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x14000fa6f
mov ebx, 0x8007000e
jmp 0x14000fb0c
mov ebx, 0x8000ffff
jmp 0x14000fb0c
mov r9, rdi
lea rcx, [rsp + 0x40]
mov r8d, r14d
xor edx, edx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x14000faf4
lea r9, [rsp + 0x28]
mov rcx, rdi
lea r8, [rsp + 0x20]
lea rdx, [0x14001d6d0]
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
test eax, eax
je 0x14000faf4
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x30]
movzx eax, word [rcx + 0xa]
mov dword [r13], eax
movzx eax, word [rcx + 8]
mov dword [rdx], eax
movzx r8d, word [rcx + 0xe]
mov rax, qword [rsp + 0x38]
mov dword [rax], r8d
cmp r8d, 0x23f0
jae 0x14000fae7
mov eax, 0xcccccccd
mul r8d
shr edx, 3
lea eax, [rdx + rdx*4]
add eax, eax
sub r8d, eax
jmp 0x14000faea
xor r8d, r8d
mov dword [r15], r8d
and dword [r12], 0
jmp 0x14000faf9
mov ebx, 0x8000ffff
test rdi, rdi
je 0x14000fb0c
mov r8, rdi
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, ebx
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140018830
add rsp, 0x268
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret