joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140029f70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400e0180]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor ebp, ebp
mov rdx, qword [rcx + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rdx
cmp rax, 1
jb 0x14002a1c7
cmp qword [rcx + 0x18], 7
jbe 0x140029fc0
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 1
lea rax, [0x1400cf908]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
mov r9, rcx
lea rcx, [rsp + 0x40]
call fcn.140028d70
nop
lea r9, [0x1400f1718]
cmp qword [0x1400f1730], 7
cmova r9, qword [0x1400f1718]
mov rdi, qword [0x1400f1728]
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x14002a052
lea rax, [rsi + rdi]
mov qword [rsp + 0x50], rax
lea rbx, [rsp + 0x40]
cmp rcx, 7
cmova rbx, qword [rsp + 0x40]
lea rcx, [rbx + rsi*2]
lea r8, [rdi + rdi]
mov rdx, r9
call fcn.1400b3cf0
lea rax, [rsi + rdi]
mov word [rbx + rax*2], bp
lea rax, [rsp + 0x40]
jmp 0x14002a067
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.14002d150
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], 7
mov word [rax], bp
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14002a0da
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a0d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a1cd
call fcn.14005ff0c
lea rcx, [rsp + 0x68]
cmp qword [rsp + 0x80], 7
cmova rcx, qword [rsp + 0x68]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14002a157
lea rdx, [0x1400f16f8]
cmp qword [0x1400f1710], 0xf
cmova rdx, qword [0x1400f16f8]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x60]
mov r8d, dword [0x1400f1708]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rdx, qword [rsp + 0x80]
cmp rdx, 7
jbe 0x14002a198
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a193
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a1c1
call fcn.14005ff0c
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14005feb0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140091ac4
int3
call fcn.140020b30
int3
call fcn.140091ac4
int3
Function at 0x14002a770
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1400e0180]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov dword [rsp + 0x20], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.1400b4390
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsW]
dec eax
cmp eax, 0x103
ja 0x14002a8c1
lea rbx, [rsp + 0x50]
cmp word [rsp + 0x50], si
je 0x14002a8c1
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
mov r8d, 2
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1400276c0
nop
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x14002a852
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rsp + 0x28], si
add qword [rdi + 8], 0x20
jmp 0x14002a864
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14002c6c0
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x14002a89d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a898
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a8e9
call fcn.14005ff0c
mov rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rbx + rax*2], 0
jne 0x14002a8a4
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], 0
jne 0x14002a800
mov rax, rdi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14005feb0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.140091ac4
int3
Function at 0x14002f410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 8], rcx
xor r9d, r9d
mov byte [rbp - 0x60], r9b
mov byte [rbp - 0x5f], 0x3e
mov byte [rbp - 0x5e], 0x2c
mov byte [rbp - 0x5d], 0x27
mov byte [rbp - 0x5c], 0x2c
mov byte [rbp - 0x5b], 0x1b
mov byte [rbp - 0x5a], 0x2c
mov byte [rbp - 0x59], 0x53
mov byte [rbp - 0x58], 0x2c
mov byte [rbp - 0x57], 0x29
mov byte [rbp - 0x56], 0x2c
mov byte [rbp - 0x55], 0x31
mov byte [rbp - 0x54], 0x2c
mov byte [rbp - 0x53], 0xd
mov byte [rbp - 0x52], 0x2c
mov byte [rbp - 0x51], 0xe
mov byte [rbp - 0x50], 0x2c
mov byte [rbp - 0x4f], 0x63
mov byte [rbp - 0x4e], 0x2c
mov byte [rbp - 0x4d], 0x31
mov byte [rbp - 0x4c], 0x2c
mov byte [rbp - 0x4b], 0x63
mov byte [rbp - 0x4a], 0x2c
mov byte [rbp - 0x49], 0x1b
mov byte [rbp - 0x48], 0x2c
mov byte [rbp - 0x47], 0x37
mov byte [rbp - 0x46], 0x2c
mov byte [rbp - 0x45], 0xe
mov byte [rbp - 0x44], 0x2c
mov byte [rbp - 0x43], 0x2b
mov byte [rbp - 0x42], 0x2c
mov byte [rbp - 0x41], 0x1b
mov byte [rbp - 0x40], 0x2c
mov byte [rbp - 0x3f], 0x63
mov byte [rbp - 0x3e], 0x2c
mov byte [rbp - 0x3d], 1
mov byte [rbp - 0x3c], 0x2c
mov byte [rbp - 0x3b], 0x23
mov byte [rbp - 0x3a], 0x2c
mov byte [rbp - 0x39], 0x47
mov byte [rbp - 0x38], 0x2c
mov byte [rbp - 0x37], 0xf
mov byte [rbp - 0x36], 0x2c
mov byte [rbp - 0x35], 0x47
mov byte [rbp - 0x34], 0x2c
mov byte [rbp - 0x33], 0x2c
mov byte [rbp - 0x32], 0x2c
movzx eax, byte [rbp - 0x5f]
movzx eax, byte [rbp - 0x60]
test al, al
jne 0x14002f547
movzx ecx, byte [rbp + r9 - 0x5f]
sub ecx, 0x2c
lea r8d, [rcx + rcx*8]
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
add r8d, 0x7f
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rbp + r9 - 0x5f], r8b
inc r9
cmp r9, 0x2e
jb 0x14002f4f2
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
lea rax, [rbp - 0x5f]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14002f561
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x28]
call fcn.1400276c0
nop
lea rdx, [rbp - 0x28]
mov rcx, rbx
call fcn.1400383c0
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 7
jbe 0x14002f5c3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002f5be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002f5d7
call fcn.14005ff0c
mov rax, rbx
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rbp
ret
call fcn.140091ac4
int3
Function at 0x14003b030
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x1400e0180]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbp, r9
mov r15, r8
mov rsi, rdx
mov rdi, rcx
xor r12d, r12d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x78], xmm0
mov qword [rsp + 0x88], rax
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x78]
call fcn.14003b2a0
nop
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
sub rax, rbx
cmp rax, rbp
jne 0x14003b0b1
mov r8, rbp
mov rdx, rbx
mov rcx, r15
call fcn.1400b4730
test eax, eax
je 0x14003b21a
mov rcx, rdi
call fcn.14003add0
mov r14, rax
test rax, rax
je 0x14003b21a
mov r8, rdi
mov r10, qword [rdi + 0x18]
cmp r10, 7
jbe 0x14003b0d5
mov r8, qword [rdi]
mov rdx, qword [rdi + 0x10]
mov r9, 0xffffffffffffffff
test rdx, rdx
je 0x14003b104
mov rcx, rdx
mov rax, r8
nop dword [rax + rax]
cmp word [rax], 0x5c
je 0x14003b275
add rax, 2
sub rcx, 1
jne 0x14003b0f0
mov rax, r9
inc rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
cmp rdx, rax
jb 0x14003b28f
sub rdx, rax
cmp rdx, r9
cmovb r9, rdx
cmp r10, 7
jbe 0x14003b137
mov rdi, qword [rdi]
lea rdx, [rdi + rax*2]
mov r8, r9
lea rcx, [rsp + 0x58]
call fcn.1400276c0
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 7
cmova rdx, qword [rsp + 0x58]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14003b1c4
cmp qword [rsi + 0x18], 7
jbe 0x14003b197
mov rsi, qword [rsi]
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r15
mov r9d, dword [rsp + 0x100]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x14003b206
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b201
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003b295
call fcn.14005ff0c
movdqa xmm0, xmmword [0x1400d00f0]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r12w
test rbx, rbx
je 0x14003b253
mov rdx, qword [rsp + 0x88]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14003b24b
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003b289
mov rcx, rbx
call fcn.14005ff0c
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14005feb0
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
test rax, rax
je 0x14003b104
sub rax, r8
sar rax, 1
jmp 0x14003b107
call fcn.140091ac4
nop
call fcn.1400273d0
int3
call fcn.140091ac4
int3
Function at 0x14003f3b0
Capabilities:
Check for time delay via gettickcount
Enumerate services
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x1400e0180]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x30], rsp
mov rbx, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r15, rax
test rax, rax
je 0x14003f5d6
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov esi, eax
lea rax, [rsp + 0x84]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x14003f5d6
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xea
jne 0x14003f5d6
mov ecx, dword [rsp + 0x80]
call fcn.1400971e0
mov r14, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14003f5d6
lea rax, [rsp + 0x84]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x80]
mov r8, r14
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x14003f4ae
lea rdx, [0x14003f5d6]
mov rcx, rsp
call fcn.1400b39d8
xor edi, edi
mov dword [rsp + 0x38], edi
cmp edi, dword [rsp + 0x84]
jae 0x14003f5ce
lea rcx, [rdi + rdi*2]
add rcx, rcx
movups xmm0, xmmword [r14 + rcx*8 + 0x10]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [r14 + rcx*8 + 0x20]
movups xmmword [rsp + 0x70], xmm1
mov r8d, 0x24
mov rdx, qword [r14 + rcx*8]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14003f510
lea rdx, [0x14003f5d6]
mov rcx, qword [rsp + 0x30]
call fcn.1400b39d8
nop
lea r8, [rsp + 0x88]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14003f540
lea rdx, [0x14003f5d6]
mov rcx, qword [rsp + 0x30]
call fcn.1400b39d8
nop dword [rax + rax]
cmp dword [rsp + 0x8c], 1
je 0x14003f5be
mov ecx, dword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.DLL_Sleep]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x88]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x14003f592
lea rdx, [0x14003f5d6]
mov rcx, qword [rsp + 0x30]
call fcn.1400b39d8
cmp dword [rsp + 0x8c], 1
je 0x14003f5be
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, esi
cmp eax, 0x7530
jbe 0x14003f5bc
lea rdx, [0x14003f5d6]
mov rcx, qword [rsp + 0x30]
call fcn.1400b39d8
jmp 0x14003f540
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
inc edi
jmp 0x14003f4b0
mov rcx, r14
call fcn.140096ad0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14005feb0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14003f600
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x80
mov rax, qword [0x1400e0180]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], rsp
mov rbx, rcx
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov edi, eax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14003f841
cmp qword [rbx + 0x18], 7
jbe 0x14003f662
mov rbx, qword [rbx]
mov r8d, 0x2c
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14003f838
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x14003f6ba
lea rdx, [0x14003f841]
mov rcx, qword [rsp + 0x30]
call fcn.1400b39d8
mov eax, dword [rsp + 0x54]
cmp eax, 1
jne 0x14003f6d4
lea rdx, [0x14003f841]
mov rcx, qword [rsp + 0x30]
call fcn.1400b39d8
mov r14d, 0x2710
nop word [rax + rax]
cmp eax, 3
jne 0x14003f789
mov eax, 0xcccccccd
mul dword [rsp + 0x68]
shr edx, 3
cmp edx, 0x3e8
jae 0x14003f704
mov edx, 0x3e8
jmp 0x14003f70b
cmp edx, r14d
cmova edx, r14d
mov ecx, edx
call qword [sym.imp.KERNEL32.DLL_Sleep]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x14003f748
lea rdx, [0x14003f841]
mov rcx, qword [rsp + 0x30]
call fcn.1400b39d8
cmp dword [rsp + 0x54], 1
jne 0x14003f760
lea rdx, [0x14003f841]
mov rcx, qword [rsp + 0x30]
call fcn.1400b39d8
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, edi
cmp eax, 0x7530
jbe 0x14003f780
lea rdx, [0x14003f841]
mov rcx, qword [rsp + 0x30]
call fcn.1400b39d8
mov eax, dword [rsp + 0x54]
jmp 0x14003f6e0
mov rcx, rbx
call fcn.14003f3b0
lea r8, [rsp + 0x50]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14003f7c0
lea rdx, [0x14003f841]
mov rcx, qword [rsp + 0x30]
call fcn.1400b39d8
nop dword [rax]
cmp dword [rsp + 0x54], 1
je 0x14003f82f
mov ecx, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.DLL_Sleep]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x14003f806
lea rdx, [0x14003f841]
mov rcx, qword [rsp + 0x30]
call fcn.1400b39d8
cmp dword [rsp + 0x54], 1
je 0x14003f82f
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, edi
cmp eax, 0x7530
jbe 0x14003f82d
lea rdx, [0x14003f841]
mov rcx, qword [rsp + 0x30]
call fcn.1400b39d8
jmp 0x14003f7c0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14005feb0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140058b80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x140058d24
cmp r9, 4
jb 0x140058bca
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x140058bb0
xor r11d, r11d
test r9, r9
je 0x140058d24
cmp r9, 8
jb 0x140058cfe
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x140058bfc
cmp rdx, r8
jae 0x140058cfe
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x140058c11
cmp rdx, r10
jae 0x140058cfe
mov rdx, r10
mov qword [rsp + 0x10], rbx
sub rdx, r8
mov qword [rsp], rdi
cmp r9, 0x40
jb 0x140058cbb
mov rdi, r9
mov qword [rsp + 0x18], rsi
and edi, 0x3f
mov rsi, r9
sub rsi, rdi
mov rbx, rcx
lea rax, [r8 + 0x10]
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rsi
jb 0x140058c50
mov rsi, qword [rsp + 0x18]
cmp rdi, 8
jb 0x140058cf0
mov rbx, r9
and rbx, 0xfffffffffffffff8
mov rdi, rcx
lea rax, [r11 + r8]
sub rdi, r8
nop dword [rax]
movq xmm1, qword [rax + rdx]
add r11, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
pxor xmm1, xmm0
movq qword [rax + rdi - 8], xmm1
cmp r11, rbx
jb 0x140058cd0
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
jae 0x140058d24
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
nop dword [rax + rax]
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x140058d10
add rsp, 8
ret

Function at 0x140060de0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test rax, rax
je 0x140060e2a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140060e2a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140060e2a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140060e2a
cmp dword [rcx + 0x84], 0xe
jbe 0x140060e2a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140060e2c
xor al, al
add rsp, 0x28
ret

Function at 0x140084198
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
call fcn.14009c934
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1400841ea
and dword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
mov r9d, 2
lea edx, [r9 + 0x20]
call qword [sym.imp.KERNEL32.DLL_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
je 0x1400841ea
sub ecx, 1
je 0x1400841e3
cmp ecx, 1
je 0x1400841dc
xor eax, eax
jmp 0x1400841ef
mov eax, 3
jmp 0x1400841ef
mov eax, 1
jmp 0x1400841ef
mov eax, 2
add rsp, 0x28
ret
Function at 0x1400970d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x140097107
call fcn.140097328
mov dword [rax], 0x16
call fcn.140091aa4
xor eax, eax
jmp 0x140097199
mov rdx, r9
mov rcx, r8
call fcn.14009706c
mov rbx, rax
test rax, rax
je 0x140097196
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x28], rax
lea r8, [0x140096fa0]
mov eax, dword [rsp + 0x60]
mov rdx, rsi
mov r9, rbx
mov dword [rsp + 0x20], eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140097183
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.1400972b8
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14009716a
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140097179
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov rcx, rbx
call fcn.1400a49a0
jmp 0x140097196
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140097193
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140099990
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400999ff
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test rax, rax
je 0x1400999ff
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400999ff
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400999ff
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400999ff
cmp dword [rcx + 0x84], 0xe
jbe 0x1400999ff
cmp dword [rcx + 0xf8], 0
je 0x1400999ff
mov ecx, ebx
call fcn.140099aa4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140099898
nop
cmp dword [rbp + 0x20], 0
jne 0x140099a60
call fcn.1400a7f54
cmp eax, 1
jne 0x140099a50
xor dl, dl
jmp 0x140099a5a
call fcn.1400a8674
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x140099a6b
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140099a74
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140099990

Function at 0x140099b78
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140099990
Function at 0x1400a7800
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x1400fe050]
mov ebx, r9d
mov rdi, r8
mov esi, edx
mov rbp, rcx
cmp rax, 0xffffffffffffffff
je 0x1400a7865
test rax, rax
jne 0x1400a7853
lea r9, [0x1400c8370]
lea r8, [0x1400c8368]
lea rdx, [0x1400c8370]
lea ecx, [rax + 0xa]
call fcn.1400a72ec
test rax, rax
je 0x1400a7865
mov r9d, ebx
mov r8, rdi
mov edx, esi
mov rcx, rbp
call fcn.1400b3cb0
jmp 0x1400a787f
xor edx, edx
mov rcx, rbp
call fcn.1400a7ba8
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret