joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005f304
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14005305c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14005305c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14005f454
cmp rax, 0xffffffffffffffff
je 0x14005f454
xor edi, edi
test rbp, rbp
jle 0x14005f3ff
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14004dc8c
mov rbx, rax
test rax, rax
jne 0x14005f38c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14005f3f5
mov edx, 0x8000
mov ecx, r14d
call fcn.14004bb0c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140051408
cmp eax, 0xffffffff
je 0x14005f3d5
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14005f39c
mov edx, r15d
mov ecx, r14d
call fcn.14004bb0c
jmp 0x14005f3f5
cmp byte [rsi + 0x38], dil
je 0x14005f3ec
cmp dword [rsi + 0x34], 5
jne 0x14005f3ec
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14005f3f5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14004dd04
jmp 0x14005f468
jns 0x14005f468
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14005305c
cmp rax, 0xffffffffffffffff
jne 0x14005f420
cmp byte [rsi + 0x30], dil
je 0x14005f468
mov edi, dword [rsi + 0x2c]
jmp 0x14005f468
mov ecx, r14d
call fcn.1400588fc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14005f468
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14005f468
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14005f461
mov eax, dword [rsi + 0x2c]
jmp 0x14005f466
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14005305c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140060210
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140060238
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140060238
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140066040
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rax, r8
xor ecx, ecx
mov rdi, rdx
mov r8, r9
mov rdx, rax
mov qword [rbx], rcx
mov qword [rbx + 8], rcx
mov rcx, rbx
mov dword [rbx + 0x50], 0x6a09e667
mov dword [rbx + 0x54], 0xbb67ae85
mov dword [rbx + 0x58], 0x3c6ef372
mov dword [rbx + 0x5c], 0xa54ff53a
mov dword [rbx + 0x60], 0x510e527f
mov dword [rbx + 0x64], 0x9b05688c
mov dword [rbx + 0x68], 0x1f83d9ab
mov dword [rbx + 0x6c], 0x5be0cd19
call fcn.140064298
mov rdx, rdi
mov rcx, rbx
call fcn.14006402c
mov rbx, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x140068d50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
xor ebx, ebx
mov rsi, rcx
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov r14d, dword [rdi + 0x1c]
mov r15d, dword [rdi + 0x20]
add r14, rcx
mov r12d, dword [rdi + 0x24]
add r15, rcx
add r12, rcx
cmp dword [rdi + 0x18], ebx
jbe 0x140068dc5
movzx eax, word [r12 + rbx*2]
lea rdx, str.Main
mov ecx, dword [r15 + rbx*4]
add rcx, rsi
mov ebp, dword [r14 + rax*4]
add rbp, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x140068de6
inc ebx
cmp ebx, dword [rdi + 0x18]
jb 0x140068d9a
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
mov rax, rbp
jmp 0x140068dc7

Function at 0x140069ff4
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
jmp 0x14006a030
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
call fcn.140037068
test rax, rax
jne 0x14006a047
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14006a01c
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
jmp 0x14006a037
Function at 0x75b803dc4
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
xor ebx, ebx
lea r8d, [rbx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x75b803e22
call fcn.75b89abc4
mov ebx, eax
mov rcx, qword [0x75b91c090]
lea rdx, [0x75b91c090]
cmp rcx, rdx
je 0x75b803e73
test byte [rcx + 0x1c], 1
je 0x75b803e73
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0xf]
mov r9d, eax
lea r8, [0x75b8e4180]
call fcn.75b803a60
jmp 0x75b803e73
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x75b803e6a
call fcn.75b89abc4
mov ebx, eax
mov rcx, qword [0x75b91c090]
lea rdx, [0x75b91c090]
cmp rcx, rdx
je 0x75b803e6a
test byte [rcx + 0x1c], 1
je 0x75b803e6a
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8e4180]
mov edx, 0x10
mov r9d, eax
call fcn.75b803a60
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x75b805310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
and qword [rax + 0x18], 0
mov rsi, rdx
and dword [rax + 8], 0
test rcx, rcx
je 0x75b805483
test rdx, rdx
je 0x75b805483
cmp dword [rcx], 1
je 0x75b80537b
mov rcx, qword [0x75b91c090]
lea rdi, [0x75b91c090]
cmp rcx, rdi
je 0x75b805371
test byte [rcx + 0x1c], 1
je 0x75b805371
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8e42b0]
mov edx, 0xf
call fcn.75b803a40
mov eax, 0x80070006
jmp 0x75b8054b6
mov rdx, qword [rcx + 8]
lea r8, [rsp + 0x50]
xor ecx, ecx
call fcn.75b8061d0
mov ebx, eax
test eax, eax
jns 0x75b8053bc
mov rcx, qword [0x75b91c090]
lea rdi, [0x75b91c090]
cmp rcx, rdi
je 0x75b80547f
test byte [rcx + 0x1c], 1
je 0x75b80547f
mov eax, dword [rsp + 0x30]
mov dword [rsp], eax
mov eax, dword [rsp + 0x30]
dec eax
mov dword [rsp + 0x30], eax
cmp dword [rsp], 0
je 0x75b8054b0
xor byte [rbx + 0x7400243c], al
sub cl, byte [rax - 0x75]
and al, 0x20
add byte [rdx + rbp + 0x48], dh
mov eax, dword [rsp + 0x20]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov cl, byte [rcx]
mov byte [rax], cl
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
jmp 0x75b80546f
mov rax, qword [rsp + 8]
add rsp, 0x18
add esp, 0x18
ret

Function at 0x75b8054ba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push rsi
Function at 0x75b805c00
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [r15]
lea rbp, [r15 + 8]
mov dword [rsp + 0x20], ecx
movzx r14d, byte [rsp + 0x22]
movzx eax, byte [rsp + 0x21]
shl eax, 0x10
shl r14d, 8
add r14d, eax
movzx eax, cl
shl eax, 0x18
add r14d, eax
shr ecx, 0x18
mov eax, dword [r12 + 0xfc]
add r14d, ecx
cmp dword [rbp], eax
jne 0x75b805bdf
test rbx, rbx
jne 0x75b805be4
mov esi, dword [rbp + 8]
lea ecx, [rbx + 0x40]
mov rax, qword [rsp + 0x98]
add esi, 0x10
mov edx, esi
mov r13, rbp
call qword [rax + 0x10]
mov r8d, r14d
mov rdx, rbp
mov rcx, rax
mov rbx, rax
call fcn.75b805452
add edi, r14d
jmp 0x75b805c08
test rbx, rbx
je 0x75b805c08
mov ecx, edi
lea r12d, [r14 + rdi]
add rcx, rbx
mov rdx, rbp
cmp r12d, esi
ja 0x75b805c3f
mov r8d, r14d
call fcn.75b805452
mov edi, r12d
mov r12, qword [rsp + 0xa0]
mov eax, dword [rsp + 0x80]
lea rcx, [r15 + 1]
mov edx, dword [rsp + 0x88]
lea r8, [rsp + 0x28]
sub eax, r15d
add edx, 0xfffffff8
add edx, eax
mov r9d, 8
call fcn.75b80557a
mov r15, rax
test rax, rax
je 0x75b805c49
jmp 0x75b805b6f
sub esi, edi
mov r8d, esi
call fcn.75b805452
test rbx, rbx
je 0x75b805c8d
mov r8d, dword [r13 + 4]
lea rcx, [rbx + 0x10]
mov eax, dword [r13 + 8]
jmp 0x75b805c5e
dec eax
test al, 3
jne 0x75b805c5c
test eax, eax
je 0x75b805c7b
lea edx, [rax - 1]
shr edx, 2
inc edx
xor dword [rcx], r8d
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x75b805c6e
mov rax, qword [rsp + 0x90]
test edi, edi
mov qword [rax], rbx
setne al
jmp 0x75b805c8f
xor al, al
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x75b808f83
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov edi, ecx
mov rbx, qword [rax + 0x18]
add rbx, 0x10
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x75b808fa0
test edi, edi
je 0x75b808fb9
call fcn.75b808fcb
cmp edi, eax
jne 0x75b808fa0
mov rax, qword [rbx + 0x30]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x75b810c1c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov ebp, r8d
mov ecx, 0x20
mov rbx, rdx
call sym.mpclient.dll_MpAllocMemory
mov rdi, rax
test rax, rax
jne 0x75b810c89
mov ebx, 0x8007000e
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b810e56
test byte [rcx + 0x1c], 1
je 0x75b810e56
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x26]
lea r8, [0x75b8e4408]
call fcn.75b803a40
jmp 0x75b810e56
and qword [rax + 8], 0
lea rcx, [rax + 8]
and qword [rax + 0x10], 0
mov rdx, rbx
and qword [rax + 0x18], 0
mov qword [rax], rsi
call fcn.75b81b168
mov ebx, eax
test eax, eax
jns 0x75b810cd8
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b810de1
test byte [rcx + 0x1c], 1
je 0x75b810de1
mov edx, 0x27
jmp 0x75b810dce
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x75b810d25
call fcn.75b89abc4
mov ebx, eax
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b810de1
test byte [rcx + 0x1c], 1
je 0x75b810de1
mov edx, 0x28
jmp 0x75b810dce
lea rcx, [rdi + 0x18]
mov r8, rdi
lea rdx, [0x75b810c10]
call fcn.75b81a870
mov ebx, eax
test eax, eax
jns 0x75b810d66
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b810de1
test byte [rcx + 0x1c], 1
je 0x75b810de1
mov edx, 0x29
jmp 0x75b810dce
test ebp, ebp
je 0x75b810e17
mov rax, qword [rsi + 0x48]
lea r8, [fcn.75b811710]
add rax, 8
mov r9, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
and dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsi + 0x48]
mov qword [rcx], rax
mov rax, qword [rsi + 0x48]
cmp qword [rax], 0
jne 0x75b810e56
call fcn.75b89abc4
mov ebx, eax
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b810de1
test byte [rcx + 0x1c], 1
je 0x75b810de1
mov edx, 0x2a
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8e4408]
mov r9d, ebx
call fcn.75b803a60
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x75b810def
call fcn.75b81b11c
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x75b810dfe
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x75b810e0d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call sym.mpclient.dll_MpFreeMemory
jmp 0x75b810e56
mov rcx, rdi
call fcn.75b811710
mov ebx, eax
test eax, eax
jns 0x75b810e56
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b810e56
test byte [rcx + 0x1c], 1
je 0x75b810e56
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8e4408]
mov edx, 0x2b
mov r9d, ebx
call fcn.75b803a60
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x75b8185c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x30
xor edi, edi
mov dword [rbp + 0x20], edi
mov dword [rbp + 0x28], edi
lea r8, [rbp + 0x28]
xor edx, edx
lea rcx, str.MpService_OOBE_Simulate
call fcn.75b857af0
nop
mov ecx, dword [rbp + 0x28]
test eax, eax
cmovs ecx, edi
test ecx, ecx
je 0x75b818621
mov dword [rbp + 0x28], edi
lea r8, [rbp + 0x28]
xor edx, edx
lea rcx, str.MpService_OOBE_Simulate_Finished
call fcn.75b857af0
nop
mov ecx, dword [rbp + 0x28]
test eax, eax
cmovs ecx, edi
test ecx, ecx
jmp 0x75b8187b7
mov rax, qword [0x75b9255a8]
test rax, rax
jne 0x75b818688
lea rdx, str.OOBEComplete
lea rcx, [0x75b9255a8]
call fcn.75b89c2cc
mov ebx, eax
test eax, eax
jns 0x75b818681
lea rdx, [0x75b91c090]
mov rcx, qword [0x75b91c090]
cmp rcx, rdx
je 0x75b81867a
mov esi, 1
test byte [rcx + 0x1c], sil
je 0x75b81867a
lea edx, [rsi + 0x33]
mov r9d, ebx
lea r8, [0x75b8e4890]
mov rcx, qword [rcx + 0x10]
call fcn.75b803b0c
mov eax, ebx
jmp 0x75b8187bd
mov rax, qword [0x75b9255a8]
movabs r10, 0xedcd27be32d06870
lea rcx, [rbp + 0x20]
call qword [0x75b8e0a70]
test eax, eax
jne 0x75b8186ca
call fcn.75b89abc4
mov ebx, eax
lea rdx, [0x75b91c090]
mov rcx, qword [0x75b91c090]
cmp rcx, rdx
je 0x75b81867a
mov esi, 1
test byte [rcx + 0x1c], sil
je 0x75b81867a
lea edx, [rsi + 0x34]
jmp 0x75b818667
cmp dword [rbp + 0x20], edi
jne 0x75b8187b7
mov edx, 0x3801
call fcn.75b89e578
test eax, eax
js 0x75b8187b4
mov esi, 1
cmp byte [0x75b925442], sil
je 0x75b8187b4
mov qword [rbp + 0x28], rdi
mov dword [rbp + 0x20], edi
mov r9d, 0x20019
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionOOBEStats
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x28]
call fcn.75b8a275c
mov ecx, eax
mov rbx, qword [rbp + 0x28]
test eax, eax
jne 0x75b81875e
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.EndTimeStamp
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, dword [rbp + 0x20]
test ecx, ecx
cmove eax, esi
mov dword [rbp + 0x20], eax
mov r14d, edi
cmp ecx, 0x80070002
cmovne r14d, ecx
test rbx, rbx
je 0x75b818779
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14d, r14d
jns 0x75b8187b4
lea rdx, [0x75b91c090]
mov rcx, qword [0x75b91c090]
cmp rcx, rdx
je 0x75b8187af
test byte [rcx + 0x1c], sil
je 0x75b8187af
mov edx, 0x36
mov r9d, r14d
lea r8, [0x75b8e4890]
mov rcx, qword [rcx + 0x10]
call fcn.75b803b0c
mov eax, r14d
jmp 0x75b8187bd
cmp dword [rbp + 0x20], edi
sete dil
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret
Function at 0x75b8346b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r9
mov r13, rcx
mov r9, r8
lea rcx, [rax - 0x38]
mov r8, rdx
xor r15d, r15d
lea rdx, [0x75b8e5090]
mov qword [rax - 0x38], r15
call fcn.75b89f104
mov rdi, qword [rsp + 0x20]
mov esi, eax
test eax, eax
js 0x75b8348eb
or r14, 0xffffffffffffffff
mov rbp, r14
inc rbp
cmp word [r12 + rbp*2], r15w
jne 0x75b83470d
inc r14
cmp word [rdi + r14*2], r15w
jne 0x75b834717
xor ebx, ebx
lea rax, [r14 + rbp]
lea r15, [rax*2 + 0x7c]
mov qword [rsp + 0x20], rbx
cmp r15, 0x78
jae 0x75b834744
mov esi, 0x80070057
jmp 0x75b8348d9
mov rdx, r15
lea rcx, [rsp + 0x20]
call fcn.75b89e43c
mov rbx, qword [rsp + 0x20]
mov esi, eax
test eax, eax
js 0x75b8348d9
mov r8, r15
xor edx, edx
mov rcx, rbx
call fcn.75b8c0190
mov eax, dword [rsp + 0x80]
neg dword [rsp + 0x88]
mov dword [rbx + 0x48], eax
lea eax, [rbp*2 + 0x7a]
mov dword [rbx + 0x74], 0x78
mov dword [rbx + 0x70], eax
sbb eax, eax
mov dword [rbx], r15d
and eax, 0x3d4
mov dword [rbx + 0x2c], 0x20000
add eax, 0x14
mov dword [rbx + 0x28], 1
xor r15d, r15d
mov dword [rbx + 0x40], 2
mov dword [rbx + 0x3c], eax
mov rax, qword [rsp + 0x90]
mov dword [rbx + 0x30], 0x10000
test rax, rax
je 0x75b8347f2
mov ecx, dword [rax]
test ecx, ecx
je 0x75b8347d4
mov dword [rbx + 0x30], ecx
mov ecx, dword [rax + 4]
test ecx, ecx
je 0x75b8347de
mov dword [rbx + 0x3c], ecx
mov ecx, dword [rax + 8]
test ecx, ecx
je 0x75b8347e8
mov dword [rbx + 0x40], ecx
mov ecx, dword [rax + 0xc]
test ecx, ecx
je 0x75b8347f2
mov dword [rbx + 0x44], ecx
mov ecx, dword [rbx + 0x74]
lea rdx, [rbp + 1]
add rcx, rbx
lea rax, [rdx - 1]
mov r8d, 0x7ffffffe
cmp rax, r8
ja 0x75b8348cb
mov r9d, r8d
sub r9, rdx
sub r12, rcx
lea rax, [r9 + rdx]
test rax, rax
je 0x75b834838
movzx eax, word [r12 + rcx]
test ax, ax
je 0x75b834838
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x75b834818
test rdx, rdx
lea rax, [rcx - 2]
mov r10d, 0x8007007a
cmovne rax, rcx
mov word [rax], r15w
mov rax, rdx
neg rax
sbb esi, esi
not esi
and esi, r10d
test rdx, rdx
je 0x75b8348d9
mov ecx, dword [rbx + 0x70]
lea rdx, [r14 + 1]
add rcx, rbx
lea rax, [rdx - 1]
cmp rax, r8
ja 0x75b8348cb
sub r8, rdx
mov r9, rdi
sub r9, rcx
lea rax, [r8 + rdx]
test rax, rax
je 0x75b83489b
movzx eax, word [r9 + rcx]
test ax, ax
je 0x75b83489b
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x75b83487b
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r15w
mov rax, rdx
neg rax
sbb esi, esi
not esi
and esi, r10d
test rdx, rdx
je 0x75b8348d9
mov rax, rbx
mov esi, r15d
mov qword [r13], rax
mov rbx, r15
jmp 0x75b8348d9
mov esi, 0x80070057
test rdx, rdx
je 0x75b8348d9
mov word [rcx], r15w
test rbx, rbx
je 0x75b8348eb
mov edx, 0x78
mov rcx, rbx
call fcn.75b8bdec8
test rdi, rdi
je 0x75b8348f8
mov rcx, rdi
call fcn.75b8bde90
mov rbx, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x75b839b78
Capabilities:
Delete file

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rax, vtable.MpClient::CMpPersistedCacheImpl.0
mov qword [rcx], rax
cmp qword [rcx + 0x20], 0
je 0x75b839cd0
cmp byte [rcx + 0x75], 0
jne 0x75b839c43
mov r8, qword [rcx + 0x50]
test r8, r8
je 0x75b839cd0
cmp qword [rcx + 0x38], 0
je 0x75b839cd0
and dword [rsp + 0x40], 0
mov qword [r11 + 0x10], 4
lea rax, [r11 + 8]
mov qword [r11 - 0x18], rax
lea r9, [r11 + 0x10]
mov rdx, qword [rcx + 0x48]
mov ecx, 1
call fcn.75b8aa0d0
mov ecx, dword [rsp + 0x40]
mov rax, qword [rbx + 0x38]
mov qword [rax + 0xc0], rcx
mov rcx, qword [rbx + 0x38]
add rcx, qword [rcx + 0xa0]
mov r8, qword [rbx + 0x48]
mov rdx, qword [rbx + 0x50]
call fcn.75b8cb300
lea rdx, [0x75b91c090]
mov rcx, qword [0x75b91c090]
cmp rcx, rdx
je 0x75b839cd0
test byte [rcx + 0x1c], 4
je 0x75b839cd0
mov edx, 0xb
lea r8, [0x75b8e5b18]
mov rcx, qword [rcx + 0x10]
call fcn.75b803a40
jmp 0x75b839cd0
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x75b839c57
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
and qword [rbx + 0x30], 0
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x75b839c6b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbx + 0x28], 0
mov rcx, qword [rbx + 0x20]
cmp rcx, 0xffffffffffffffff
je 0x75b839c80
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rbx + 0x20], 0xffffffffffffffff
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x75b839cd0
lea rdx, [0x75b91c090]
mov rax, qword [0x75b91c090]
cmp rax, rdx
je 0x75b839cd0
test byte [rax + 0x1c], 1
je 0x75b839cd0
call fcn.75b89abc4
mov edx, 0xc
mov dword [rsp + 0x20], eax
mov r9, qword [rbx + 0x18]
lea r8, [0x75b8e5b18]
mov rcx, qword [0x75b91c090]
mov rcx, qword [rcx + 0x10]
call fcn.75b81c350
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x75b839cde
call fcn.75b8bde90
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x75b839ced
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x75b839cfc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x20]
cmp rcx, 0xffffffffffffffff
je 0x75b839d0c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x75b839d1a
call fcn.75b8bde90
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x75b839d3a
mov rax, qword [rcx]
movabs r10, 0xcc411749525d9370
mov rax, qword [rax + 8]
call qword [0x75b8e0a70]
lea rax, vtable.CommonUtil::CRefObject.0
mov qword [rbx], rax
add rsp, 0x30
pop rbx
ret

Function at 0x75b844cc0
Capabilities:
Delete file

Disassembly:
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax + 0x10]
jmp 0x75b89de80
push rbx
sub rsp, 0x20
and dword [rsp + 0x38], 0
mov rbx, rcx
mov rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.75b89d358
lea edx, [rax + 0x7ff8fffe]
cmp edx, 1
jbe 0x75b89dec8
test eax, eax
js 0x75b89decd
test byte [rsp + 0x38], 0x10
mov rcx, rbx
jne 0x75b89debe
add rsp, 0x20
pop rbx
jmp fcn.75b89dc04
add rsp, 0x20
pop rbx
jmp fcn.75b89dcb8
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x75b8468e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
mov qword [rsp], rdx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x75b84693b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x75b84692e
mov eax, dword [rcx + 0x3c]
mov dword [rsp + 0x20], eax
cmp eax, 0x10000000
jae 0x75b84692e
mov eax, eax
add rax, rcx
mov qword [rsp], rax
cmp rax, rcx
jae 0x75b846920
mov qword [rsp], rdx
jmp 0x75b84692e
cmp dword [rax], 0x4550
cmovne rax, rdx
mov qword [rsp], rax
jmp 0x75b846935
mov rax, qword [rsp]
jmp 0x75b84693d
xor eax, eax
add rsp, 0x18
ret
Function at 0x75b850498
Capabilities:
Modify service
Start service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
xor ebx, ebx
lea r8d, [rbx + 0x12]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x75b8504f9
call fcn.75b89abc4
mov ebx, eax
mov rcx, qword [0x75b91c090]
lea rdx, [0x75b91c090]
cmp rcx, rdx
je 0x75b8505af
test byte [rcx + 0x1c], 1
je 0x75b8505af
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x27]
mov r9d, eax
lea r8, [0x75b8e7820]
call fcn.75b803a60
jmp 0x75b8505af
mov qword [rsp + 0x50], rbx
or edx, 0xffffffff
mov qword [rsp + 0x48], rbx
mov r9d, edx
mov qword [rsp + 0x40], rbx
mov r8d, 2
mov qword [rsp + 0x38], rbx
mov rcx, rdi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x75b85055c
call fcn.75b89abc4
mov ebx, eax
mov rcx, qword [0x75b91c090]
lea rdx, [0x75b91c090]
cmp rcx, rdx
je 0x75b8505a6
test byte [rcx + 0x1c], 1
je 0x75b8505a6
mov edx, 0x28
jmp 0x75b850593
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x75b8505a6
call fcn.75b89abc4
mov ebx, eax
mov rcx, qword [0x75b91c090]
lea rdx, [0x75b91c090]
cmp rcx, rdx
je 0x75b8505a6
test byte [rcx + 0x1c], 1
je 0x75b8505a6
mov edx, 0x29
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8e7820]
mov r9d, eax
call fcn.75b803a60
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret