joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140027c00
Capabilities:
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1400b5200]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
movzx ebp, dl
mov rcx, qword [rcx]
test rcx, rcx
je 0x140027d70
lea rax, [rsp + 0x30]
xor edi, edi
mov r9d, 0x24
mov dword [rsp + 0x30], edi
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140027d5b
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x140027c89
lea r8, [rbx + 0x10]
mov ecx, eax
lea r9, str._already_stopped
lea rdx, str.Service
call fcn.140027070
mov al, 1
jmp 0x140027d72
mov esi, edi
cmp eax, 3
jne 0x140027cd3
mov ecx, dword [rbx + 0x34]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, dword [rbx + 0x30]
ja 0x140027d70
mov rcx, qword [rbx]
lea rax, [rsp + 0x30]
mov r9d, 0x24
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140027d70
cmp dword [rsp + 0x3c], 3
je 0x140027c90
test bpl, bpl
je 0x140027ce0
mov rcx, rbx
call fcn.140027f20
mov rcx, qword [rbx]
lea r8, [rsp + 0x38]
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140027d5b
cmp dword [rsp + 0x3c], 1
je 0x140027d3b
nop
mov ecx, dword [rbx + 0x34]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, dword [rbx + 0x30]
jae 0x140027d70
mov rcx, qword [rbx]
lea rax, [rsp + 0x30]
mov r9d, 0x24
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140027d5b
cmp dword [rsp + 0x3c], 1
jne 0x140027d00
lea r8, [rbx + 0x10]
mov ecx, 3
lea r9, str._stopped
lea rdx, str.Service
call fcn.140027070
mov al, 1
jmp 0x140027d72
lea r8, [rbx + 0x10]
mov ecx, 1
lea rdx, str.Cant_Query_information_about_service
call fcn.140027260
xor al, al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14005e480
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140027f20
Capabilities:
Enumerate services

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x1400b5200]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r15, rcx
lea rax, [rbp - 0x55]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x140028113
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140028113
mov eax, dword [rbp - 0x59]
test eax, eax
je 0x140028113
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp - 0x51], rax
test rax, rax
je 0x140028113
lea rcx, [rbp - 0x51]
mov qword [rbp - 0x49], rcx
lea rcx, [rbp - 0x55]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x59]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbp - 0x59]
mov r8, rax
mov edx, 1
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
je 0x1400280fb
xor r12d, r12d
mov r14d, r12d
cmp dword [rbp - 0x55], r12d
jbe 0x1400280fb
nop word [rax + rax]
mov eax, r14d
lea rcx, [rax + rax*2]
add rcx, rcx
mov rax, qword [rbp - 0x51]
mov rsi, qword [rax + rcx*8]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x140028030
mov rdi, qword [r15 + 8]
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], r12
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r12w
mov dword [rbp + 0x1f], 6
mov dword [rbp + 0x23], 0xbb8
mov r8d, 0x24
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rdi
mov r8, rbx
mov rdx, rsi
lea rcx, [rbp - 1]
call fcn.14000d0a0
nop
cmp qword [rbp - 0x11], 0
jne 0x140028097
jmp 0x1400280b2
xor edx, edx
lea rcx, [rbp - 0x11]
call fcn.140027c00
nop
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x1400280b2
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, qword [rbp + 0x17]
cmp rdx, 7
jbe 0x1400280ee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
cmp rdx, 0x1000
mov rax, rcx
jb 0x1400280e9
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002813b
call fcn.14005e4dc
inc r14d
cmp r14d, dword [rbp - 0x55]
jb 0x140028010
mov rbx, qword [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14005e480
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400645e4
nop
int3
Function at 0x140028150
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
movabs r9, 0x100000001b3
movzx ecx, byte [rdx + 6]
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, r9
xor rax, r8
imul rax, r9
xor rax, rcx
movzx ecx, byte [rdx + 7]
imul rax, r9
xor rax, rcx
imul rax, r9
ret
Function at 0x14002b3e0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1400]
mov eax, 0x1500
call fcn.14005f310
sub rsp, rax
mov rax, qword [0x1400b5200]
xor rax, rsp
mov qword [rbp + 0x13f0], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov ecx, 0x60
call fcn.14005e4a0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsi], rax
mov dword [rsp + 0x20], 1
mov dword [rbp - 0x7e], 0x3a
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov ebx, 0x41
test dil, 1
je 0x14002b5a9
mov word [rbp - 0x80], bx
xor edx, edx
mov r8d, 0x1452
lea rcx, [rbp - 0x70]
call fcn.140087b80
mov r8d, 0xa28
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x14002b5a9
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
lea rax, [rbp - 0x70]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14002b4c0
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.140004b90
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
lea rax, [rbp - 0x80]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14002b500
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.140004b90
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400281c0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14002b56b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b566
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b5e2
call fcn.14005e4dc
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14002b5a9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b5a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b5e2
call fcn.14005e4dc
inc bx
shr edi, 1
cmp bx, 0x5a
jbe 0x14002b465
mov rax, rsi
mov rcx, qword [rbp + 0x13f0]
xor rcx, rsp
call fcn.14005e480
lea r11, [rsp + 0x1500]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1400645e4
int3
Function at 0x14002b990
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14002bb6f
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140021bf0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14002bb34
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14002baac
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14002bb23
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x14002bae9
mov r10, qword [rdx]
cmp r10, rax
je 0x14002bae3
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14002bb23
cmp r9, rdx
je 0x14002baff
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x14002bb49
cmp r9, rdx
jne 0x14002baf0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x14002ba30
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14002bb23
lea rcx, str.invalid_hash_bucket_count
call fcn.14003ad50
int3
Function at 0x14002d870
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rax, qword [0x1400b5200]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor r15d, r15d
xor edx, edx
mov r8d, 0x412
lea rcx, [rsp + 0x50]
call fcn.140087b80
mov edx, 0x208
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
test eax, eax
jne 0x14002d8f0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 7
mov word [rdi], r15w
jmp 0x14002da1f
mov ebx, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
cmp rbx, 7
ja 0x14002d932
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 7
add rbx, rbx
mov r8, rbx
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.1400874e0
mov word [rsp + rbx + 0x30], r15w
jmp 0x14002d9b1
mov r14, rbx
or r14, 7
mov eax, 0xa
cmp r14, rax
cmovb r14, rax
lea rcx, [r14*2 + 2]
cmp rcx, 0x1000
jb 0x14002d982
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14002da54
mov rcx, rax
call fcn.14005e4a0
test rax, rax
je 0x14002da4e
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14002d98a
call fcn.14005e4a0
mov rsi, rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], r14
add rbx, rbx
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1400874e0
mov word [rbx + rsi], r15w
lea rcx, [rsp + 0x30]
call fcn.14001eb70
lea rcx, [rsp + 0x30]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x48]
cmp r8, 7
cmova rcx, rdx
mov r9, qword [rsp + 0x40]
dec r9
cmp word [rcx + r9*2], 0x5c
je 0x14002d9f7
lea rax, [rsp + 0x30]
cmp r8, 7
cmova rax, rdx
cmp word [rax + r9*2], 0x2f
jne 0x14002da0e
mov qword [rsp + 0x40], r9
lea rax, [rsp + 0x30]
cmp r8, 7
cmova rax, rdx
mov word [rax + r9*2], r15w
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rdi + 0x10], xmm1
mov rax, rdi
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.14005e480
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1400645e4
int3
call fcn.140001240
int3
Function at 0x14002da60
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1400b5200]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x118
call fcn.140087b80
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.ntdll.dll_RtlGetVersion]
test eax, eax
js 0x14002dd51
mov ecx, dword [rsp + 0x24]
mov eax, dword [rsp + 0x28]
cmp ecx, 6
jne 0x14002daba
cmp eax, 1
jb 0x14002dabc
jmp 0x14002dad8
jae 0x14002dad6
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005e480
add rsp, 0x158
ret
jne 0x14002db46
cmp eax, 1
jne 0x14002dafa
mov eax, 0x3d
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005e480
add rsp, 0x158
ret
cmp eax, 2
jne 0x14002db1c
mov eax, 0x3e
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005e480
add rsp, 0x158
ret
cmp eax, 3
mov ecx, 0xffffffff
mov edx, 0x3f
cmove ecx, edx
mov eax, ecx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005e480
add rsp, 0x158
ret
cmp ecx, 0xa
jne 0x14002dd51
test eax, eax
jne 0x14002dd51
mov eax, dword [rsp + 0x2c]
cmp eax, 0x57e4
jb 0x14002db7f
mov eax, 0x72
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005e480
add rsp, 0x158
ret
cmp eax, 0x55f0
jb 0x14002dba3
mov eax, 0x71
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005e480
add rsp, 0x158
ret
cmp eax, 0x4a64
jb 0x14002dbc7
mov eax, 0x70
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005e480
add rsp, 0x158
ret
cmp eax, 0x4a63
jb 0x14002dbeb
mov eax, 0x6f
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005e480
add rsp, 0x158
ret
cmp eax, 0x4a62
jb 0x14002dc0f
mov eax, 0x6e
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005e480
add rsp, 0x158
ret
cmp eax, 0x4a61
jb 0x14002dc33
mov eax, 0x6d
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005e480
add rsp, 0x158
ret
cmp eax, 0x47bb
jb 0x14002dc57
mov eax, 0x6c
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005e480
add rsp, 0x158
ret
cmp eax, 0x47ba
jb 0x14002dc7b
mov eax, 0x6b
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005e480
add rsp, 0x158
ret
cmp eax, 0x4563
jb 0x14002dc9f
mov eax, 0x6a
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005e480
add rsp, 0x158
ret
cmp eax, 0x42ee
jb 0x14002dcc3
mov eax, 0x69
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005e480
add rsp, 0x158
ret
cmp eax, 0x3fab
jb 0x14002dce7
mov eax, 0x68
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005e480
add rsp, 0x158
ret
cmp eax, 0x3ad7
jb 0x14002dd0b
mov eax, 0x67
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005e480
add rsp, 0x158
ret
cmp eax, 0x3839
jb 0x14002dd2f
mov eax, 0x66
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005e480
add rsp, 0x158
ret
cmp eax, 0x295a
sbb eax, eax
add eax, 0x65
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005e480
add rsp, 0x158
ret
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005e480
add rsp, 0x158
ret
Function at 0x14002de50
Capabilities:
Create process on windows
Delete registry key
Get common file path
Manipulate boot configuration

Disassembly:
sub rsp, 0x498
mov rax, qword [0x1400b5200]
xor rax, rsp
mov qword [rsp + 0x480], rax
lea rdx, str.SOFTWARERaccine
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, str.SOFTWARERaccine
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, str.SYSTEMCurrentControlSetServicesEventLogApplicationRaccine
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_vssadmin.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionswmic.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionswbadmin.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_bcdedit.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionspowershell.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionsdiskshadow.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_net.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskkill.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x14002dfa7
lea rdx, str._sysnative_vssadmin.exe
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str._delete_shadows__all__quiet
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
lea r9, [rsp + 0x270]
mov dword [rsp + 0x28], eax
lea r8, [rsp + 0x30]
lea rdx, str.open
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14005e480
add rsp, 0x498
ret
Function at 0x14002dfc0
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
jmp 0x14002f530
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [0x1400b5200]
xor rax, rsp
mov qword [rsp + 0x180], rax
lea rcx, [rsp + 0x30]
call fcn.14002f7a0
nop
mov r14, qword [rsp + 0x30]
mov rdi, r14
mov rbp, qword [rsp + 0x38]
cmp r14, rbp
je 0x14002f702
xor r13d, r13d
mov rsi, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14002f592
mov rsi, qword [rdi]
mov r12, qword [rdi + 0x10]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
cmove rbx, r13
mov qword [rsp + 0x48], rbx
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14002f6e2
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
test eax, eax
jne 0x14002f6e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
cmp dword [0x1400b5010], 1
jl 0x14002f6e0
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.140005990
nop
lea rdx, str.Cant_clear_log_channel
lea rcx, [rsp + 0x70]
call fcn.140004350
mov r8, r12
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.140008590
lea rdx, str._error:
lea rcx, [rsp + 0x70]
call fcn.1400046b0
mov edx, r15d
lea rcx, [rsp + 0x70]
call fcn.14001a380
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x60]
call fcn.14000cfe0
nop
mov rcx, rax
cmp qword [rax + 0x18], 7
jbe 0x14002f657
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x50], xmm0
mov rcx, qword [str._P_v_]
test rcx, rcx
je 0x14002f787
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax + 0x10]
nop
mov rdx, qword [rsp + 0x178]
cmp rdx, 7
jbe 0x14002f6d5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002f6cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002f793
call fcn.14005e4dc
nop
lea rcx, [rsp + 0x60]
call fcn.140005200
nop
jmp 0x14002f6ec
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14002f6f5
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
add rdi, 0x20
cmp rdi, rbp
jne 0x14002f585
test r14, r14
je 0x14002f756
mov rbx, r14
cmp r14, rbp
je 0x14002f721
nop
mov rcx, rbx
call fcn.140001a60
add rbx, 0x20
cmp rbx, rbp
jne 0x14002f710
mov rdx, qword [rsp + 0x40]
sub rdx, r14
and rdx, 0xffffffffffffffe0
mov rax, r14
cmp rdx, 0x1000
jb 0x14002f74e
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002f78d
mov rcx, r14
call fcn.14005e4dc
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14005e480
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14003ad30
nop
call fcn.1400645e4
nop
call fcn.1400645e4
int3
Function at 0x14002dfd0
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
lea rcx, str.PowrProf.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14002e014
lea rdx, str.PowerSetActiveScheme
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002e014
lea rdx, [0x1400952e0]
xor ecx, ecx
call rax
lea rcx, str.SeTakeOwnershipPrivilege
call fcn.14002e130
lea rcx, str.SeDebugPrivilege
call fcn.14002e130
lea rcx, str.SeImpersonatePrivilege
call fcn.14002e130
lea rcx, str.SeChangeNotifyPrivilege
call fcn.14002e130
lea rcx, str.SeCreateGlobalPrivilege
call fcn.14002e130
lea rcx, str.SeIncreaseBasePriorityPrivilege
call fcn.14002e130
lea rcx, str.SeIncreaseWorkingSetPrivilege
call fcn.14002e130
lea rcx, str.SeProfileSingleProcessPrivilege
call fcn.14002e130
lea rcx, str.SeRestorePrivilege
call fcn.14002e130
lea rcx, str.SeBackupPrivilege
call fcn.14002e130
mov ecx, 0x10
call fcn.14005e4a0
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14002e0e0
mov ecx, 1
call fcn.14005e4a0
mov qword [rsp + 0x50], rax
lea rsi, [rbx + 8]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14002dd70]
xor edx, edx
xor ecx, ecx
call fcn.14006b988
mov qword [rbx], rax
test rax, rax
je 0x14002e115
jmp 0x14002e0e2
xor ebx, ebx
mov rcx, qword [rdi + 8]
mov qword [rdi + 8], rbx
test rcx, rcx
je 0x14002e0ff
cmp dword [rcx + 8], 0
jne 0x14002e10f
mov edx, 0x10
call fcn.14005e4dc
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.14006ba70
nop
mov dword [rsi], 0
mov ecx, 6
call fcn.14003d4dc
int3

Function at 0x14002e1f0
Capabilities:
Identify system language via api

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400b5200]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov eax, 0x444
mov dword [rsp + 0x20], 0x43f0419
mov word [rsp + 0x28], ax
mov dword [rsp + 0x24], 0x4220423
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx r8d, ax
lea rdx, [rsp + 0x2a]
lea rcx, [rsp + 0x20]
call fcn.14003cc60
lea rcx, [rsp + 0x2a]
cmp rax, rcx
setne al
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14005e480
add rsp, 0x48
ret

Function at 0x14002e410
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14002e42c
mov eax, 2
add rsp, 0x28
ret
shr eax, 4
not eax
and eax, 1
add rsp, 0x28
ret