joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a0a0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rbp + 0x37], rax
movzx ebx, r8b
mov rsi, rdx
mov rdi, rcx
movzx r9d, r8b
mov r8, rdx
lea rdx, [rbp + 0x17]
call fcn.14000bcc0
nop
movzx r9d, bl
mov r8, rsi
lea rdx, [rbp - 0x29]
call fcn.14000bfe0
nop
xor bl, 1
movzx r9d, bl
mov r8, rsi
lea rdx, [rbp - 9]
call fcn.14000bfe0
nop
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae rcx, qword [rbp - 0x29]
call fcn.140045e64
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rcx, qword [rbp - 9]
call fcn.140045e64
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae rdx, qword [rbp - 0x29]
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rcx, qword [rbp + 0x17]
call fcn.140045e8c
mov ebx, eax
mov rdx, rsi
call fcn.14000c300
test ebx, ebx
je 0x14000a167
lea rcx, str.rename_file_failed_n
call fcn.1400031b0
xor bl, bl
jmp 0x14000a19b
mov edx, 0xffffffff
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov r8, rsi
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.14000de50
mov rcx, qword [rax]
mov dword [rcx + 0x40], 2
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov bl, 1
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x14000a1db
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a1d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a29d
call fcn.140038b74
xor edi, edi
mov qword [rbp + 7], rdi
mov qword [rbp + 0xf], 7
mov word [rbp - 9], di
mov rdx, qword [rbp - 0x11]
cmp rdx, 8
jb 0x14000a229
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a224
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a2a3
call fcn.140038b74
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], 7
mov word [rbp - 0x29], di
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x14000a275
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a270
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a297
call fcn.140038b74
movzx eax, bl
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140038b50
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
call fcn.140045708
nop
call fcn.140045708
nop
call fcn.140045708
int3
Function at 0x14001c770
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x1b8], 0xffffffffffffffff
mov rbx, rcx
je 0x14001c8ba
mov qword [rsp + 0x40], rbp
xor ebp, ebp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
mov edx, 0xffffffff
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [rbx + 0x1b8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_accept]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14001c883
lea rdx, [0x14006a078]
mov ecx, 0x18
call fcn.1400390e4
mov rdi, rax
test rax, rax
jne 0x14001c81a
lea edx, [rax + 0x18]
lea rcx, str.JHI_memory_allocation_of_size__d_failed_.
call fcn.140003170
lea rcx, str.CS_ClientThreadParams_memory_allocation_failed
call fcn.1400031b0
mov rcx, qword [rbx + 0x10]
lea edx, [rdi + 1]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.DLL_ReleaseSemaphore]
jmp 0x14001c873
mov qword [rax], rsi
lea r8, [0x14001c8c0]
mov rax, qword [rbx + 0x18]
mov r9, rdi
mov qword [rdi + 8], rax
xor edx, edx
mov rax, qword [rbx + 0x10]
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov qword [rdi + 0x10], rax
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.DLL_CreateThread]
test rax, rax
jne 0x14001c86a
lea rcx, str.failed_creating_thread_for_client_request_n
call fcn.1400031b0
mov edx, 0x18
mov rcx, rdi
call fcn.140038b74
jmp 0x14001c873
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp qword [rbx + 0x1b8], 0xffffffffffffffff
jne 0x14001c7a0
jmp 0x14001c8ab
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.accept_failed_with_error:__d_n
call fcn.1400031b0
mov rcx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, qword [rcx]
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.DLL_ReleaseSemaphore]
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
Function at 0x14001e360
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rcx
cmp byte [rcx + 0x10], 0
je 0x14001e396
mov eax, 1
jmp 0x14001e53f
call fcn.14000cc30
mov ebx, dword [rax + 0x5c]
xor ebp, ebp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], bp
mov byte [rsp + 0x30], bpl
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
call fcn.14001dbf0
test al, al
jne 0x14001e3d5
mov ebx, 0x1014
jmp 0x14001e4f7
movzx esi, byte [rsp + 0x30]
cmp ebx, 2
jne 0x14001e3f4
movzx r8d, sil
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.14001e8b0
test eax, eax
je 0x14001e46e
lea rcx, str.Installing_the_Spooler...
call fcn.1400031b0
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdx, qword [rsp + 0x38]
movzx r9d, sil
xor r8d, r8d
lea rcx, str.BA8D164350B649CC861D2C01BED14BE8
call fcn.140021830
mov ebx, eax
test eax, eax
je 0x14001e43f
cmp eax, 0x108
je 0x14001e43f
lea rcx, str.failed_downloading_Spooler_Applet_to_DAL_FW_n
call fcn.140003170
jmp 0x14001e44b
lea rcx, str.Spooler_is_installed.
call fcn.1400031b0
test ebx, ebx
jne 0x14001e4f9
movzx r8d, sil
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.14001e8b0
mov ebx, eax
test eax, eax
jne 0x14001e4f7
call fcn.14000cc30
mov rbx, rax
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rsi, qword [rbx + 0x50]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
lea rcx, str.Creating_the_event_listener_thread...
call fcn.1400031b0
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
lea r8, [0x14001d750]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [rdi + 8], rax
test rax, rax
jne 0x14001e4e9
lea rcx, str.Failed_creating_event_handle_thread_n
call fcn.1400031b0
mov ebx, 0x601
mov rax, qword [rsi]
mov rdx, rdi
mov rcx, rsi
mov rax, qword [rax + 0x40]
call qword [0x140069610]
jmp 0x14001e4f7
lea rcx, str.Event_listener_thread_created_successfully
call fcn.1400031b0
mov ebx, ebp
test ebx, ebx
sete al
mov byte [rdi + 0x10], al
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x14001e53d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e538
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e562
call fcn.140038b74
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140038b50
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140045708
int3
Function at 0x14001ee20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp byte [rcx + 8], 0
mov rdi, rdx
mov rsi, rcx
je 0x14001ef82
mov eax, dword [rsp + 0x30]
lea r9, [rsp + 0x34]
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x30]
and eax, 0xffff02ff
mov qword [rsp + 0x20], 0
or eax, 0x2ff
mov r8d, 4
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x14001ef62
lea rcx, str.Sent_FWU_GET_VERSION_to_HECI._n
call fcn.1400031b0
xor bpl, bpl
mov dword [rsp + 0x30], 0
test rdi, rdi
je 0x14001ef82
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x14001ef82
call fcn.1400089c0
mov rbx, rax
test rax, rax
je 0x14001ef82
movsxd r8, dword [rsi + 0x18]
xor edx, edx
mov rcx, rax
call fcn.14003d8e0
mov r8d, dword [rsi + 0x18]
lea r9, [rsp + 0x30]
mov rcx, qword [rsi + 0x10]
mov rdx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x14001ef3d
mov edx, dword [rsp + 0x30]
lea rcx, str.Number_bytes_read_from_HECI:__d_n
call fcn.1400031b0
cmp byte [rbx + 3], bpl
je 0x14001ef19
lea rcx, str.Got_error_status_from_HCI_GET_FW_VERSION._n
call fcn.1400031b0
jmp 0x14001ef51
movzx eax, word [rbx + 6]
mov bpl, 1
mov word [rdi], ax
movzx eax, word [rbx + 4]
mov word [rdi + 2], ax
movzx eax, word [rbx + 0xa]
mov word [rdi + 4], ax
movzx eax, word [rbx + 8]
mov word [rdi + 6], ax
jmp 0x14001ef51
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.HeciRead_Error._LastError___d_n
call fcn.1400031b0
mov rcx, rbx
call fcn.1400089f0
test bpl, bpl
je 0x14001ef82
mov al, 1
jmp 0x14001ef84
lea rcx, str.Error:_sending_FWU_GET_VERSION_request_to_HECI_failed._n
call fcn.1400031b0
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.error:__d
call fcn.1400031b0
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140038b50
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400223e0
Capabilities:
Check mutex on windows
Initialize winsock library

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
lea rcx, [0x14007ed50]
call fcn.140003170
call fcn.14000cc30
mov rbx, rax
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov dword [rbx + 8], 2
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
lea rdx, [0x14006a078]
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400390e4
mov rdi, rax
test rax, rax
je 0x140022457
lea rax, vtable.intel_dal::CommandDispatcher.0
mov qword [rdi], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov qword [rdi + 8], rax
jmp 0x140022468
xor edi, edi
lea edx, [rdi + 0x10]
lea rcx, str.JHI_memory_allocation_of_size__d_failed_.
call fcn.140003170
mov ecx, 0x1c0
call fcn.140038e18
mov rsi, rax
mov qword [rsp + 0x60], rax
xor edx, edx
mov r8d, 0x1c0
mov rcx, rax
call fcn.14003d8e0
lea rax, vtable.intel_dal::ICommandsServer.0
mov qword [rsi], rax
mov ecx, 8
call fcn.140038e18
mov rbx, rax
mov qword [rsp + 0x68], rax
xor eax, eax
mov qword [rbx], rax
xor r9d, r9d
mov edx, 0xa
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.DLL_CreateSemaphoreW]
mov qword [rbx], rax
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rdi
mov byte [rsi + 8], 0xa
lea rax, vtable.intel_dal::CommandsServerSocketsWin32.0
mov qword [rsi], rax
mov qword [rsi + 0x1b8], 0xffffffffffffffff
mov ecx, 0x202
lea rdx, [rsi + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14002256f
cmp byte [rsi + 0x20], 2
jne 0x1400225a0
cmp byte [rsi + 0x21], 2
jne 0x1400225a0
mov qword [0x140091a30], rsi
lea rcx, str.opening_command_server_n
call fcn.1400031b0
mov rcx, qword [0x140091a30]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [0x140069610]
test al, al
jne 0x140022551
lea rcx, str.Error:_command_server_has_failed_to_open_a_connection_n
call fcn.140003170
xor al, al
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
lea rcx, str.____jhi_start
call fcn.140003170
mov al, 1
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov edx, eax
lea rcx, str.WSAStartup_failed_with_error:__d_n
call fcn.140003170
lea rdx, str.WSAStartup_failed
lea rcx, [rsp + 0x20]
call fcn.140001ff0
lea rdx, [0x14008bf00]
lea rcx, [rsp + 0x20]
call fcn.14003da70
int3
lea rcx, str.Could_not_find_a_usable_version_of_Winsock.dll_n
call fcn.140003170
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rdx, str.Could_not_find_a_usable_version_of_Winsock.dll
lea rcx, [rsp + 0x38]
call fcn.140001ff0
lea rdx, [0x14008bf00]
lea rcx, [rsp + 0x38]
call fcn.14003da70
int3
Function at 0x1400227b0
Capabilities:
Create mailslot

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp qword [rcx + 0x28], 0
mov r14d, r8d
mov rdi, rdx
mov rbp, rcx
je 0x1400227e5
mov eax, 7
jmp 0x1400228e2
mov qword [rsp + 0xb0], rbx
test rdi, rdi
je 0x140022921
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x140022800
cmp rbx, 0x20
ja 0x140022921
lea r8, str..mailslot_
mov qword [rsp + 0xb8], rsi
mov edx, 0x2e
lea rcx, [rsp + 0x40]
call fcn.14004475c
mov r8, rdi
lea rcx, [rsp + 0x40]
mov edx, 0x2e
call fcn.14004c68c
test r14d, r14d
jne 0x14002288d
xor r9d, r9d
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x1a8
call qword [sym.imp.KERNEL32.DLL_CreateMailslotA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400228cd
xor eax, eax
lea r8d, [r14 + 4]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov rcx, rsi
mov qword [rsp + 0x20], rax
lea edx, [rax + 6]
call qword [sym.imp.ADVAPI32.DLL_SetSecurityInfo]
jmp 0x1400228c7
cmp r14d, 1
jne 0x14002291a
xor eax, eax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov r8d, r14d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rsi, rax
cmp rsi, 0xffffffffffffffff
jne 0x1400228fb
mov eax, 1
mov rsi, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140038b50
add rsp, 0x80
pop r14
pop rdi
pop rbp
ret
mov r9, rbx
mov r8, rdi
mov edx, 0x22
mov rcx, rbp
call fcn.14004c5b8
xor eax, eax
mov dword [rbp + 0x30], r14d
mov qword [rbp + 0x28], rsi
jmp 0x1400228d2
mov eax, 0xa
jmp 0x1400228d2
mov eax, 8
jmp 0x1400228da
Function at 0x140022930
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x270
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rdx
mov byte [rsp + 0x48], 0
mov edx, 0x2e
mov qword [rsp + 0x70], 0
lea r8, str..mailslot_
mov dword [rsp + 0x78], 1
lea rcx, [rsp + 0x80]
call fcn.14004475c
lea r8, str.AMLTJOM_MailBox
mov edx, 0x2e
lea rcx, [rsp + 0x80]
call fcn.14004c68c
mov r14d, 3
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x80]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
mov edx, 0x40000000
lea r8d, [r14 - 2]
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140022bd6
lea r9d, [r14 + 0xd]
lea r8, str.AMLTJOM_MailBox
lea edx, [r14 + 0x1f]
lea rcx, [rsp + 0x48]
call fcn.14004c5b8
mov dword [rsp + 0x78], 1
mov qword [rsp + 0x70], rbx
test rbx, rbx
jne 0x140022a10
lea r14d, [rbx + 5]
jmp 0x140022ba4
test rdi, rdi
je 0x140022b68
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x290], rbp
mov r9, rbx
mov qword [rsp + 0x2a0], rsi
inc r9
cmp byte [rdi + r9], 0
jne 0x140022a33
inc r9
mov rdx, rbx
inc rdx
cmp byte [rdi + rdx], 0
jne 0x140022a43
inc rdx
lea rcx, [rsp + 0xb0]
mov r8, rdi
call fcn.14004c5b8
mov rax, rbx
inc rax
cmp byte [rdi + rax], 0
jne 0x140022a62
lea rsi, [rsp + 0xb0]
mov r9, rbx
add rsi, rax
mov byte [rsi], 0x2c
inc rsi
nop
inc r9
cmp byte [r9 + rdi + 0x12], 0
jne 0x140022a80
inc r9
mov rdx, rbx
inc rdx
cmp byte [rdx + rdi + 0x12], 0
jne 0x140022a91
inc rdx
lea r8, [rdi + 0x12]
mov rcx, rsi
call fcn.14004c5b8
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rax + rdi + 0x12], 0
jne 0x140022ab0
add rsi, rax
mov r9, rbx
mov byte [rsi], 0x2c
inc rsi
nop word [rax + rax]
inc r9
cmp byte [r9 + rdi + 0x34], 0
jne 0x140022ad0
inc r9
mov rdx, rbx
inc rdx
cmp byte [rdx + rdi + 0x34], 0
jne 0x140022ae1
inc rdx
lea r8, [rdi + 0x34]
mov rcx, rsi
call fcn.14004c5b8
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rax + rdi + 0x34], 0
jne 0x140022b00
mov rbp, qword [rsp + 0x290]
add rsi, rax
mov r9, rbx
mov byte [rsi], 0x2c
nop dword [rax + rax]
inc r9
cmp byte [rdi + r9 + 0x56], 0
jne 0x140022b20
inc r9
mov rdx, rbx
inc rdx
cmp byte [rdi + rdx + 0x56], 0
jne 0x140022b31
inc rdx
lea r8, [rdi + 0x56]
lea rcx, [rsi + 1]
call fcn.14004c5b8
nop dword [rax + rax]
cmp byte [rdi + rbx + 0x57], 0
lea rbx, [rbx + 1]
jne 0x140022b50
mov byte [rsi + rbx + 1], 0
mov rsi, qword [rsp + 0x2a0]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0xb0]
mov qword [rsp + 0x20], 0
lea r8d, [rax + 1]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x140022bb7
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x140022bb2
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, r14d
jmp 0x140022bdb
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140022bd2
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
jne 0x140022bd2
mov eax, 2
jmp 0x140022bdb
xor eax, eax
jmp 0x140022bdb
mov eax, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140038b50
add rsp, 0x270
pop r14
pop rdi
pop rbx
ret
Function at 0x140022c00
Capabilities:
Read file on windows
Read from mailslot

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x200
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
cmp dword [rcx + 0x30], 0
mov rsi, rdx
mov rdi, rcx
je 0x140022c32
mov eax, 0xa
jmp 0x140022c6d
mov rcx, qword [rcx + 0x28]
mov qword [rsp + 0x220], rbx
xor ebx, ebx
test rcx, rcx
je 0x140022c5a
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_GetMailslotInfo]
cmp dword [rsp + 0x30], ebx
ja 0x140022c8e
mov eax, 9
mov rbx, qword [rsp + 0x220]
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.140038b50
mov rsi, qword [rsp + 0x228]
add rsp, 0x200
pop rdi
ret
mov rcx, qword [rdi + 0x28]
lea r9, [rsp + 0x34]
mov r8d, 0x1a8
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x140022cb8
mov eax, 4
jmp 0x140022c65
mov eax, dword [rsp + 0x34]
cmp rax, 0x1aa
jae 0x140022ce3
lea rdx, [rsp + 0x40]
mov byte [rsp + rax + 0x40], bl
mov rcx, rsi
call fcn.140022cf0
test eax, eax
mov ecx, listen
cmove ebx, ecx
mov eax, ebx
jmp 0x140022c65
call fcn.140039214
int3
Function at 0x140028560
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.DLL_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x1400285a7
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
je 0x140028639
mov edx, eax
lea rcx, str.OpenSCManager_failed___d__n
call fcn.14001f150
lea eax, [rbx + 1]
jmp 0x140028687
mov r8d, 0x10000
lea rdx, str.jhi_service
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x14002860f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
je 0x140028639
cmp eax, 0x424
jne 0x1400285f4
lea rcx, str.Error:_the_service_does_not_exist._n
call fcn.14001f150
lea eax, [rdi + 4]
jmp 0x140028687
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.Uninstall_Service_failed:___d__n
call fcn.14001f150
mov eax, 1
jmp 0x140028687
mov rcx, rdi
call qword [sym.imp.ADVAPI32.DLL_DeleteService]
test eax, eax
jne 0x140028667
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x14002864c
lea rcx, str.ACCESS_DENIED:_administrative_privileges_required._n
call fcn.14001f150
mov eax, 2
jmp 0x140028687
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.Uninstall_Service_failed:___d__n
call fcn.14001f150
mov eax, 1
jmp 0x140028687
lea rcx, str.JHI_Service_removed_successfully_n
call fcn.14001f150
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14002a2d0
Capabilities:
Initialize winsock library

Disassembly:
push rdi
sub rsp, 0x1d0
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rdi, rdx
test rdx, rdx
jne 0x14002a2fb
lea eax, [rdx - 2]
jmp 0x14002a40a
mov qword [rsp + 0x1e0], rbx
sub ecx, 1
je 0x14002a37b
cmp ecx, 1
je 0x14002a317
mov eax, 0xfffffffe
jmp 0x14002a402
lea rax, [0x14002a7a0]
xor ebx, ebx
mov qword [rdx], rax
lea rax, [0x14002a880]
mov qword [rdx + 8], rax
lea rax, [0x14002ab80]
mov qword [rdx + 0x10], rax
lea rax, [0x14002acf0]
mov qword [rdx + 0x18], rax
lea ecx, [rbx + 0x28]
lea rax, [0x14002ae90]
mov dword [rdx + 0x28], ebx
mov qword [rdx + 0x20], rax
call fcn.14004c5b0
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
mov qword [0x140091a48], rbx
xor eax, eax
mov dword [rdi + 0x28], 1
jmp 0x14002a402
lea rax, [0x14002a430]
xor ebx, ebx
mov qword [rdx], rax
lea rcx, [rsp + 0x20]
lea rax, [0x14002a470]
mov dword [rdx + 0x28], ebx
mov qword [rdx + 8], rax
mov r8d, 0x198
lea rax, [0x14002a5f0]
mov qword [rdx + 0x10], rax
lea rax, [0x14002a670]
mov qword [rdx + 0x18], rax
lea rax, [0x14002a720]
mov qword [rdx + 0x20], rax
xor edx, edx
call fcn.14003d8e0
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14002a3e5
mov dword [rdi + 0x28], 1
jmp 0x14002a400
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x20], rbx
mov dword [rdi + 0x28], ebx
mov ebx, 0xffffffff
mov eax, ebx
mov rbx, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140038b50
add rsp, 0x1d0
pop rdi
ret
Function at 0x14002b2f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push rsi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, qword [rsp + 0xa0]
xor eax, eax
mov dword [rsp + 0x30], eax
mov ebp, r9d
mov rsi, r8
mov r12, rdx
mov r15d, ecx
cmp rdx, 0xffffffffffffffff
je 0x14002b491
test r8, r8
je 0x14002b491
test r9d, r9d
je 0x14002b491
test r14, r14
je 0x14002b491
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r13
call qword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov r13d, 8
mov r8d, 0x20
mov rcx, rax
mov edx, r13d
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x14002b3b2
lea eax, [rdi + 1]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x80]
mov r13, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140038b50
add rsp, 0x50
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret
mov ebx, 1
xor r9d, r9d
mov edx, ebx
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateEventW]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x14002b466
test r15d, r15d
jne 0x14002b3fd
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
mov r8d, ebp
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x14002b41f
mov qword [r14], rdi
xor eax, eax
jmp 0x14002b386
cmp r15d, ebx
jne 0x14002b41f
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
mov r8d, ebp
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x14002b3f6
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
je 0x14002b3f6
sub eax, 6
je 0x14002b461
sub eax, 0x19
je 0x14002b45a
sub eax, 0x5b
je 0x14002b453
sub eax, 0x415
je 0x14002b44c
cmp eax, ebx
jne 0x14002b466
movzx ebx, r13w
jmp 0x14002b466
mov ebx, 3
jmp 0x14002b466
mov ebx, listen
jmp 0x14002b466
mov ebx, 5
jmp 0x14002b466
mov ebx, 4
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x14002b475
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
call qword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_HeapFree]
movzx eax, bx
jmp 0x14002b386
mov eax, 4
jmp 0x14002b398