joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140096a5c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov ebp, dword [rcx + 0x38]
mov rdi, rcx
mov r9d, dword [rcx + 0x94]
xor r13d, r13d
mov esi, dword [rdi + 0x50]
or r14d, 0xffffffff
mov edx, dword [rdi + 0x8c]
sub esi, edx
sub esi, r9d
jne 0x140096aac
test edx, edx
jne 0x140096ab8
test r9d, r9d
jne 0x140096ab8
mov esi, ebp
jmp 0x140096b37
cmp esi, r14d
jne 0x140096ab8
mov esi, 0xfffffffe
jmp 0x140096b37
mov ecx, dword [rdi + 0x38]
add ecx, 0xfffffefa
add ecx, ebp
cmp edx, ecx
jb 0x140096b37
mov rcx, qword [rdi + 0x48]
mov r8, rbp
lea rdx, [rcx + rbp]
call sub.msvcrt.dll_memcpy
mov r8d, dword [rdi + 0x6c]
mov rax, qword [rdi + 0x60]
sub dword [rdi + 0x90], ebp
sub dword [rdi + 0x8c], ebp
sub dword [rdi + 0x7c], ebp
lea rdx, [rax + r8*2]
lea rdx, [rdx - 2]
movzx ecx, word [rdx]
movzx eax, cx
sub ax, bp
cmp ecx, ebp
cmovb ax, r13w
mov word [rdx], ax
add r8d, r14d
jne 0x140096af2
mov rax, qword [rdi + 0x58]
mov r8d, ebp
lea rdx, [rax + rbp*2]
lea rdx, [rdx - 2]
movzx ecx, word [rdx]
movzx eax, cx
sub ax, bp
cmp ecx, ebp
cmovb ax, r13w
mov word [rdx], ax
add r8d, r14d
jne 0x140096b19
add esi, ebp
mov r14, qword [rdi]
mov ecx, dword [r14 + 8]
test ecx, ecx
je 0x140096bfc
mov edx, dword [rdi + 0x94]
mov r12d, dword [rdi + 0x8c]
add r12, rdx
add r12, qword [rdi + 0x48]
cmp ecx, esi
cmovbe esi, ecx
test esi, esi
jne 0x140096b68
mov esi, r13d
jmp 0x140096bab
mov rax, qword [r14 + 0x28]
sub ecx, esi
mov r15, qword [r14]
mov dword [r14 + 8], ecx
cmp dword [rax + 0x2c], r13d
jne 0x140096b8e
mov ecx, dword [r14 + 0x4c]
mov r8d, esi
mov rdx, r15
call fcn.140097a20
mov dword [r14 + 0x4c], eax
mov r8d, esi
mov rdx, r15
mov rcx, r12
mov ebx, esi
call sub.msvcrt.dll_memcpy
add qword [r14], rbx
add dword [r14 + 0xc], esi
mov edx, dword [rdi + 0x94]
lea r9d, [rdx + rsi]
mov dword [rdi + 0x94], r9d
cmp r9d, 3
jb 0x140096be6
mov eax, dword [rdi + 0x8c]
mov rdx, qword [rdi + 0x48]
mov ecx, dword [rdi + 0x78]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x68], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x74]
mov dword [rdi + 0x68], r8d
cmp r9d, 0x106
jae 0x140096bfc
mov rax, qword [rdi]
cmp dword [rax + 8], r13d
jne 0x140096a88
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140097a20
Capabilities:
Compute adler32 checksum

Disassembly:
movzx r9d, cx
mov r10, rdx
shr ecx, 0x10
test rdx, rdx
jne 0x140097b68
lea eax, [rdx + 1]
ret
cmp r8d, 0x15b0
jae 0x140097a52
mov edx, r8d
sub r8d, r8d
cmp edx, 0x10
jl 0x140097b2c
jmp 0x140097a5e
mov edx, 0x15b0
add r8d, 0xffffea50
mov r11d, edx
shr r11, 4
mov eax, r11d
neg eax
shl eax, 4
add edx, eax
movzx eax, byte [r10]
add r9d, eax
movzx eax, byte [r10 + 1]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 7]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 8]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 9]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xa]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xb]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xc]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xd]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xe]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xf]
add ecx, r9d
add r10, 0x10
add r9d, eax
add ecx, r9d
sub r11, 1
jne 0x140097a6f
test edx, edx
je 0x140097b42
movzx eax, byte [r10]
inc r10
add r9d, eax
add ecx, r9d
sub edx, 1
jne 0x140097b30
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
test r8d, r8d
jne 0x140097a38
shl ecx, 0x10
or ecx, r9d
mov eax, ecx
ret
Function at 0x140005d80
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140005dba
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140005dbf
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140005e08
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400083f0]
cmp byte [rcx + rax], 0
je 0x140005e08
dec r8
sub rdx, 1
jne 0x140005dee
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140006c24
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006c6e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006c6e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006c6e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006c6e
cmp dword [rcx + 0x84], 0xe
jbe 0x140006c6e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140006c70
xor al, al
add rsp, 0x28
ret
Function at 0x140001a20
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
or ebx, 0xffffffff
lock xadd dword [0x140004018], ebx
dec ebx
jne 0x140001a76
lea ecx, [rbx + 4]
call fcn.140001468
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], ebx
lea r8, [0x1400019f0]
mov r9, rax
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x493e0
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140001a71
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001a76
call fcn.1400015e0
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x140002a0c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140002a58
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140002a50
cmp dword [rcx + 0x3c], edx
jl 0x140002a50
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140002a50
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140002a58
mov rax, rdx
add rsp, 0x18
ret

Function at 0x37fc7f170
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x37ffbcd70]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x37fc7f190
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x37fc7f198
ret
cmp word [r8 + 0x18], 0x20b
jne 0x37fc7f190
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x37fc7f1ed
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x37fc7f1e4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x37fc7f190
add rax, 0x28
cmp rax, r9
jne 0x37fc7f1d0
xor eax, eax
ret

Function at 0x37fc7f1f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x37ffbcd70]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x37fc7f20f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x37fc7f218
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x37fc7f20f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x37fc7f2b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x37ffbcd70]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x37fc7f2cf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x37fc7f2d8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140001330
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x140015028]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbp, rdx
or r9d, 0xffffffff
lea rdx, str.Start_WriteService
or r8d, r9d
mov rsi, rcx
xor ebx, ebx
mov dword [rsp + 0x20], 1
call fcn.1400015b0
mov rcx, rsi
call fcn.140001450
test rax, rax
mov rdi, rax
jne 0x14000139d
lea ecx, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rsi
call fcn.140001450
test rax, rax
mov rdi, rax
je 0x140001406
lea rcx, [rsp + 0x48]
mov rdx, rbp
mov r8d, 0x44
mov dword [rsp + 0x40], 0xae0ae0ae
mov dword [rsp + 0x44], 1
call fcn.14000d730
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x88
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400013f2
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
lea rdx, str.WriteService_successful
jne 0x14000140d
lea rdx, str.WriteService_failed
or r9d, 0xffffffff
mov rcx, rsi
mov dword [rsp + 0x20], 0
or r8d, r9d
call fcn.1400015b0
mov eax, ebx
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400046f0
mov rbx, qword [rsp + 0x110]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001450
Capabilities:
Start service

Disassembly:
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x40
mov rdi, rcx
xor r12d, r12d
lea rcx, str..pipeAERTAPOProperties
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x14000159e
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Cant_open_pipe:
or r9d, 0xffffffff
mov rcx, rdi
mov r8d, eax
mov dword [rsp + 0x20], r12d
call fcn.1400015b0
cmp dword [rdi + 0x60], r12d
je 0x1400014dd
mov ebx, 1
mov rax, r12
mov dword [rdi + 0x60], ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
mov ebx, 1
xor edx, edx
xor ecx, ecx
mov r8d, ebx
mov qword [rsp + 0x60], rsi
mov esi, r12d
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
mov rdi, rax
je 0x140001591
lea r8d, [rbx + 0xf]
lea rdx, str.AERTFilters
mov rcx, rax
mov qword [rsp + 0x58], rbp
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
test rax, rax
mov rbp, rax
je 0x140001540
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov rcx, rbp
test eax, eax
cmovne esi, ebx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
mov rbp, qword [rsp + 0x58]
je 0x140001591
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], r12
lea rcx, str..pipeAERTAPOProperties
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
cmove rax, r12
jmp 0x140001594
mov rax, r12
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x140002210
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x140015028]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
xor esi, esi
lea rdi, [rcx + 0x68]
mov ebp, 1
mov rbx, rcx
mov dword [rcx + 0x6c], ebp
mov qword [rcx + 0x60], rsi
mov dword [rcx + 0x70], esi
mov qword [rcx + 0x98], rsi
mov dword [rcx + 0x74], ebp
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareAndrea_ElectronicsAEEQAPO
mov rcx, 0xffffffff80000002
mov dword [rdi], esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1400022bc
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rdx, str.Logging
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x34], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1400022b1
mov dword [rdi], esi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rdi], esi
je 0x14000232f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14000232f
lea rdx, [rsp + 0xb0]
mov r8d, 0x100
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14000232f
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
movsxd rcx, eax
jle 0x140002314
nop
cmp byte [rsp + rcx + 0xb0], 0x5c
je 0x140002314
sub rcx, rbp
sub eax, ebp
test rcx, rcx
jg 0x140002300
add eax, ebp
mov edx, 0x14
movsxd rcx, eax
lea r8, [rsp + rcx + 0xb0]
lea rcx, [rbx + 0x78]
call fcn.140004710
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x60]
call fcn.140006ff0
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareRealtekAEAPO
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov edi, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400023f6
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.RenProperties
xor r8d, r8d
mov dword [rsp + 0x30], 0x60
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400023ba
cmp dword [rsp + 0x30], 0x60
jne 0x1400023ba
cmp dword [rsp + 0x50], 0xaee0aee0
cmove edi, ebp
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x1400023f6
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov r8d, 0x60
call fcn.14000d730
or r9d, 0xffffffff
lea rdx, str.LoadEQInfo_successful
mov rcx, rbx
or r8d, r9d
mov dword [rsp + 0x20], esi
call fcn.140002690
cmp dword [rbx + 4], esi
jne 0x140002403
mov rcx, rbx
call fcn.1400028f0
mov rax, rbx
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400046f0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140002430
Capabilities:
Start service
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0xf0
mov rax, qword [0x140015028]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov r13, rdx
or r9d, 0xffffffff
lea rdx, str.Start_WriteService
xor r14d, r14d
mov r15d, 1
or r8d, r9d
mov rdi, rcx
mov esi, r14d
mov dword [rsp + 0x20], r15d
call fcn.140002690
mov qword [rsp + 0x30], r14
lea rcx, str..pipeAERTAPOProperties
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140002614
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], r14
lea rcx, str..pipeAERTAPOProperties
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140002614
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Cant_open_pipe:
mov rcx, rdi
mov r8d, eax
or r9d, ebx
mov dword [rsp + 0x20], r14d
call fcn.140002690
cmp dword [rdi + 0x70], r14d
je 0x14000255e
mov dword [rdi + 0x70], r15d
lea rdx, str.WriteService_failed
or r9d, 0xffffffff
mov rcx, rdi
mov dword [rsp + 0x20], r14d
or r8d, r9d
call fcn.140002690
mov eax, esi
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400046f0
add rsp, 0xf0
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r8d, r15d
xor edx, edx
xor ecx, ecx
mov ebp, r14d
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
mov rbx, rax
je 0x14000251f
lea rdx, str.AERTFilters
mov r8d, 0x10
mov rcx, rax
mov qword [rsp + 0x140], r12
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
test rax, rax
mov r12, rax
je 0x1400025b9
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov rcx, r12
test eax, eax
cmovne ebp, r15d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebp, ebp
mov r12, qword [rsp + 0x140]
je 0x14000251f
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], r14
lea rcx, str..pipeAERTAPOProperties
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x14000251f
test rbx, rbx
je 0x14000251f
lea rcx, [rsp + 0x58]
mov rdx, r13
mov r8d, 0x60
mov dword [rsp + 0x50], 0xae0ae0ae
mov dword [rsp + 0x54], 2
call fcn.14000d730
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov r8d, 0x88
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000266e
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov esi, r15d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x14000251f
lea rdx, str.WriteService_successful
jmp 0x140002526
Function at 0x140002690
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0x190
mov rax, qword [0x140015028]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp dword [rcx + 0x68], 0
mov ebp, r8d
mov rsi, rdx
mov rdi, rcx
je 0x1400028c6
mov qword [r11 - 0x20], rbx
mov qword [r11 - 0x28], r12
xor r12d, r12d
mov qword [rsp + 0x30], r12
lea rcx, str.C:Program_FilesAndrea_ElectronicsAEAPORen.log
lea r8d, [r12 + 1]
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x14000274a
lea ecx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 1]
lea rcx, str.C:Program_FilesAndrea_ElectronicsAEAPORen.log
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x1400028b6
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rax, [rsp + 0x80]
lea r9, str.ddMMMyy
lea r8, [rsp + 0x58]
xor edx, edx
mov ecx, 0x400
mov dword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDateFormatA]
lea rax, [rsp + 0x68]
lea r9, str.HH:mm:ss
lea r8, [rsp + 0x58]
xor edx, edx
mov ecx, 0x400
mov dword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetTimeFormatA]
cmp ebp, 0xffffffff
jne 0x1400027f7
movzx eax, word [rsp + 0x66]
mov qword [rsp + 0x38], rsi
lea r9, [rdi + 0x78]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x68]
lea r8, str._s__s__s._i:__s_r_n
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
lea rcx, [rsp + 0xa0]
mov edx, 0xc8
mov qword [rsp + 0x20], rax
call fcn.1400046b0
jmp 0x14000283d
movzx eax, word [rsp + 0x66]
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x68]
lea r9, [rdi + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
lea r8, str._s__s__s._i:__s___i__r_n
lea rcx, [rsp + 0xa0]
mov edx, 0xc8
mov qword [rsp + 0x20], rax
call fcn.1400046b0
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [rsp + 0x1d0], r12d
je 0x14000287b
lea r9, [rsp + 0x50]
lea rdx, [0x140012124]
mov r8d, 2
mov rcx, rbx
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0xa0]
repne scasb al, byte [rdi]
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0xa0]
not rcx
mov qword [rsp + 0x20], r12
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x188]
mov r12, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400046f0
add rsp, 0x190
pop rdi
pop rsi
pop rbp
ret
Function at 0x140003050
Capabilities:
Access the windows event log

Disassembly:
push rdi
sub rsp, 0xe0
mov rax, qword [0x140015028]
xor rax, rsp
mov qword [rsp + 0xd0], rax
cmp dword [0x14001758c], 0
mov rdi, rcx
jne 0x140003121
mov qword [rsp + 0xf8], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.AERTFilters
xor ecx, ecx
mov dword [0x140017588], eax
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov edx, dword [0x140017588]
lea r9, str.AERTFilters
mov dword [rsp + 0x20], edx
lea r8, str._s_error:__d
lea rcx, [rsp + 0x60]
mov edx, 0x70
mov rbx, rax
call fcn.1400046b0
test rbx, rbx
lea r11, [rsp + 0x60]
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], rdi
je 0x140003119
xor ecx, ecx
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], 2
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rbx
mov dx, 1
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rbx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400046f0
add rsp, 0xe0
pop rdi
ret
Function at 0x140004370
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x170
mov rax, qword [0x140015028]
xor rax, rsp
mov qword [rsp + 0x160], rax
test r9d, r9d
mov r12d, 2
mov eax, 4
cmovne eax, r12d
mov ebp, r8d
mov rdi, rcx
mov esi, edx
mov qword [rsp + 0x30], 0
lea r8d, [r12 - 1]
lea rcx, str.C:AEService.log
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x140004518
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rax, [rsp + 0x70]
lea r9, str.ddMMMyy
lea r8, [rsp + 0x48]
xor edx, edx
mov ecx, 0x400
mov dword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDateFormatA]
lea rax, [rsp + 0x58]
lea r9, str.HH:mm:ss
lea r8, [rsp + 0x48]
xor edx, edx
mov ecx, 0x400
mov dword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetTimeFormatA]
cmp esi, 0xffffffff
movzx eax, word [rsp + 0x56]
lea r9, [rsp + 0x70]
mov edx, 0xc8
lea rcx, [rsp + 0x90]
jne 0x140004484
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x58]
lea r8, str._s__s._i:__s__r_n
mov qword [rsp + 0x20], rax
call fcn.1400046b0
jmp 0x1400044a7
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x58]
lea r8, str._s__s._i:__s___i__r_n
mov qword [rsp + 0x20], rax
call fcn.1400046b0
mov r9d, r12d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test ebp, ebp
je 0x1400044dd
lea r9, [rsp + 0x40]
lea rdx, [0x140012124]
mov r8d, r12d
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x90]
repne scasb al, byte [rdi]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x90]
not rcx
mov qword [rsp + 0x20], rax
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400046f0
add rsp, 0x170
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret