joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180026250
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1800881a0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x10], 0
jne 0x180026291
xor eax, eax
jmp 0x18002645c
mov dword [rsp + 0x24], 0
mov rcx, qword [rsp + 0x88]
call fcn.180024ee0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov edx, 1
lea rcx, [rsp + 0x50]
call fcn.180019030
lea rcx, [rsp + 0x50]
call fcn.18001bf00
nop
xor eax, eax
cmp eax, 1
je 0x180026446
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x28]
call fcn.180024f30
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1800263ae
mov r8, 0xffffffffffffffff
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.1800215b0
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x90]
call fcn.180023870
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
jmp 0x180026446
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.1800215b0
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x90]
call fcn.180023870
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
lea rax, [rax + rcx*2]
mov qword [rsp + 0x28], rax
mov eax, SafeArrayGetElement
mov word [rsp + 0x20], ax
movsx rax, word [rsp + 0x20]
lea rcx, [0x180087a10]
cmp dword [rcx + rax*4], 1
jne 0x180026441
movsx rax, word [rsp + 0x20]
lea rcx, [0x180087a10]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x20]
lea rdx, [0x180087a10]
mov dword [rdx + rcx*4], eax
jmp 0x1800262d5
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x3c], eax
lea rcx, [rsp + 0x50]
call fcn.180011730
mov eax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18004d370
add rsp, 0x78
ret
Function at 0x1800273c0
Capabilities:
Get file attributes

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp qword [rsp + 0x40], 0
je 0x1800273eb
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
movzx eax, word [rcx + rax]
test eax, eax
jne 0x18002741e
mov dword [rsp + 0x28], 1
mov eax, dword [rsp + 0x28]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x18002741a
xor r9d, r9d
lea r8, [0x180089ffc]
lea rdx, [0x18008a004]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
jmp 0x180027456
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 0x10
test eax, eax
je 0x180027449
cmp dword [rsp + 0x20], 0xffffffff
je 0x180027449
mov dword [rsp + 0x24], 1
jmp 0x180027451
mov dword [rsp + 0x24], 0
movzx eax, byte [rsp + 0x24]
add rsp, 0x38
ret
Function at 0x180027d50
Capabilities:
Get file size
Read file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x1800881a0]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x30], 0
xor edx, edx
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0xffffffff
je 0x180027dab
cmp dword [rsp + 0x3c], 0
ja 0x180027dd1
mov rcx, qword [rsp + 0xa0]
call fcn.18001bf00
nop
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xa0]
jmp 0x180028050
mov dword [rsp + 0x40], 0
mov edx, 1
lea rcx, [rsp + 0x70]
call fcn.180019030
lea rcx, [rsp + 0x70]
call fcn.180026470
nop
mov eax, dword [rsp + 0x3c]
inc eax
mov eax, eax
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.180023ee0
mov eax, 8
mov word [rsp + 0x38], ax
movsx rax, word [rsp + 0x38]
lea rcx, [0x180087a10]
cmp dword [rcx + rax*4], 1
jne 0x180027e46
movsx rax, word [rsp + 0x38]
lea rcx, [0x180087a10]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x38]
lea rdx, [0x180087a10]
mov dword [rdx + rcx*4], eax
lea rcx, [rsp + 0x70]
call fcn.1800324e0
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x180027e8c
mov rcx, qword [rsp + 0xa0]
call fcn.18001bf00
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x70]
call fcn.18001c2e0
mov rax, qword [rsp + 0xa0]
jmp 0x180028050
mov eax, dword [rsp + 0x3c]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jbe 0x180027f69
mov dword [rsp + 0x68], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, dword [rsp + 0x3c]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180027eda
cmp dword [rsp + 0x68], 0
jne 0x180027f50
cmp qword [0x1800d27b8], 0
je 0x180027ef0
call qword [0x1800d27b8]
mov dword [rsp + 0x44], eax
jmp 0x180027ef8
mov dword [rsp + 0x44], 0
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x180027f0f
mov dword [rsp + 0x40], 0x1f
jmp 0x180027f69
mov eax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
jmp 0x180027e95
cmp dword [rsp + 0x40], 0
je 0x180028012
mov rcx, qword [rsp + 0xa0]
call fcn.18001bf00
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x70]
call fcn.18001c2e0
mov rax, qword [rsp + 0xa0]
jmp 0x180028050
mov eax, dword [rsp + 0x3c]
mov r9d, dword [rsp + 0xb0]
mov r8d, eax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xa0]
call fcn.180026490
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x70]
call fcn.18001c2e0
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.18004d370
add rsp, 0x98
ret
Function at 0x18002c4d0
Capabilities:
Query or enumerate registry key

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2c8
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x1800881a0]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov eax, dword [rsp + 0x2e8]
or eax, 0x2001f
mov dword [rsp + 0x4c], eax
mov rcx, qword [rsp + 0x2d8]
call fcn.1800324c0
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x20], rcx
mov ecx, dword [rsp + 0x4c]
mov r9d, ecx
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x2d0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x18002c5d3
cmp dword [rsp + 0x44], 2
je 0x18002c5c9
cmp dword [rsp + 0x44], 3
je 0x18002c5c9
mov eax, 7
mov word [rsp + 0x40], ax
movsx rax, word [rsp + 0x40]
lea rcx, [0x180087a70]
cmp dword [rcx + rax*4], 1
jne 0x18002c5a3
movsx rax, word [rsp + 0x40]
lea rcx, [0x180087a70]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x40]
lea rdx, [0x180087a70]
mov dword [rdx + rcx*4], eax
mov rcx, qword [rsp + 0x2d8]
call fcn.1800324e0
mov r9, rax
mov r8d, dword [rsp + 0x44]
lea rdx, [0x18008b7e0]
mov ecx, 3
call fcn.180040a70
mov eax, 0xffffffff
jmp 0x18002c6a5
mov dword [rsp + 0x88], 0x104
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
lea r8, [rsp + 0xa0]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x18002c693
mov r8, 0xffffffffffffffff
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x68]
call fcn.18001be50
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x2e0]
call fcn.180023870
nop
lea rcx, [rsp + 0x68]
call fcn.180011730
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x88], 0x104
jmp 0x18002c5e6
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.18004d370
add rsp, 0x2c8
ret
Function at 0x180034a00
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x58], 0
je 0x180034a20
xor eax, eax
mov rcx, qword [rsp + 0x58]
mov word [rcx], ax
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x28], 0
je 0x180034bca
mov rax, qword [rsp + 0x50]
add rax, 0x28
mov rcx, rax
call fcn.1800324e0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180034bca
mov eax, reloc.OLEAUT32.dll_SafeArrayDestroy
mov word [rsp + 0x20], ax
movsx rax, word [rsp + 0x20]
lea rcx, [0x180087dc0]
cmp dword [rcx + rax*4], 1
jne 0x180034a91
movsx rax, word [rsp + 0x20]
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x20]
lea rdx, [0x180087dc0]
mov dword [rdx + rcx*4], eax
mov rax, qword [rsp + 0x50]
add rax, 0x28
mov rcx, rax
call fcn.1800324e0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x50]
add rcx, 0x28
call fcn.1800324e0
mov ecx, dword [rsp + 0x30]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rax, qword [rsp + 0x50]
add rax, 0x28
mov rcx, rax
call fcn.1800324e0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180034b1d
mov rax, qword [rsp + 0x50]
add rax, 0x28
mov rcx, rax
call fcn.1800324e0
mov r8d, 4
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x180034b1d
mov dword [rsp + 0x2c], 0
jmp 0x180034b25
mov dword [rsp + 0x2c], 1
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x38], eax
mov eax, 1
mov word [rsp + 0x24], ax
movsx rax, word [rsp + 0x24]
lea rcx, [0x180087dc0]
cmp dword [rcx + rax*4], 1
jne 0x180034b6c
movsx rax, word [rsp + 0x24]
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x24]
lea rdx, [0x180087dc0]
mov dword [rdx + rcx*4], eax
mov dword [rsp + 0x34], 1
mov eax, dword [rsp + 0x34]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x180034b9b
xor r9d, r9d
lea r8, [0x1800758d0]
lea rdx, [0x1800757a4]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp qword [rsp + 0x58], 0
je 0x180034bca
cmp dword [rsp + 0x38], 0
je 0x180034bb6
mov eax, 0xffffffff
mov word [rsp + 0x28], ax
jmp 0x180034bbd
xor eax, eax
mov word [rsp + 0x28], ax
mov rax, qword [rsp + 0x58]
movzx ecx, word [rsp + 0x28]
mov word [rax], cx
xor eax, eax
add rsp, 0x48
ret
Function at 0x1800386b0
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [rsp + 0x60]
mov dword [rax + 0x38], 8
cmp qword [rsp + 0x80], 0
je 0x1800386f7
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
jmp 0x180038703
lea rax, str.Mozilla_5.0__Windows_NT_6.2__WOW64__AppleWebKit_535.7__KHTML__like_Gecko__Chrome_16.0.912.75_Safari_535.7
mov qword [rsp + 0x28], rax
mov r8, 0xffffffffffffffff
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x38]
call fcn.18001be50
nop
mov rax, qword [rsp + 0x60]
add rax, 8
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.18001c490
nop
lea rcx, [rsp + 0x38]
call fcn.180011730
mov rax, qword [rsp + 0x60]
add rax, 0x20
mov rdx, qword [rsp + 0x68]
mov rcx, rax
call fcn.18002a870
mov rax, qword [rsp + 0x60]
add rax, 0x28
mov rdx, qword [rsp + 0x70]
mov rcx, rax
call fcn.18002a870
mov eax, 7
mov word [rsp + 0x20], ax
movsx rax, word [rsp + 0x20]
lea rcx, [0x180087dc0]
cmp dword [rcx + rax*4], 1
jne 0x1800387a6
movsx rax, word [rsp + 0x20]
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x20]
lea rdx, [0x180087dc0]
mov dword [rdx + rcx*4], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax]
xor edx, edx
mov ecx, SafeArrayGetElement
div rcx
mov rax, rdx
mov dword [rsp + 0x24], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
movsxd rdx, dword [rsp + 0x24]
lea r8, [0x180087dc0]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx*4], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0
lea rdx, [0x180087dc0]
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x78], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [rsp + 0x60]
add rcx, 0x80
mov rdx, rax
call fcn.1800329a0
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x80], 0
jne 0x180038860
mov eax, 0x80004005
jmp 0x180038875
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x60]
call qword [rax + 0xa8]
xor eax, eax
add rsp, 0x58
ret
Function at 0x18003b680
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x1800881a0]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, str.User_Agent:_Mozilla_5.0__Windows_NT_6.2__WOW64__AppleWebKit_535.7__KHTML__like_Gecko__Chrome_16.0.912.75_Safari_535.7_nPragma:_no_cache_nExpect:_100_continue_n
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], 0
mov edx, 1
lea rcx, [rsp + 0x58]
call fcn.180019030
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.180029a80
nop
lea rcx, [rsp + 0x58]
call fcn.1800012a0
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rcx
mov r8, rax
lea rdx, [0x180076468]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x48]
call qword [rax]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x18003b740
mov r8d, dword [rsp + 0x20]
lea rdx, str.E:0x_x_pJob__QueryIface
mov ecx, 4
call fcn.180040a70
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x58]
call fcn.18002a520
mov eax, dword [rsp + 0x30]
jmp 0x18003b826
lea rcx, [rsp + 0x58]
call fcn.1800324e0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [rax + 0x38]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x18003b810
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax]
xor edx, edx
mov ecx, SafeArrayGetElement
div rcx
mov rax, rdx
mov dword [rsp + 0x28], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
movsxd rdx, dword [rsp + 0x28]
lea r8, [0x180087dc0]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx*4], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0
lea rdx, [0x180087dc0]
mov dword [rdx + rcx], eax
mov r8d, dword [rsp + 0x20]
lea rdx, str.E:0x_x_pHttpOpts__SetCstmHdrs
mov ecx, 4
call fcn.180040a70
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x58]
call fcn.18002a520
mov eax, dword [rsp + 0x2c]
jmp 0x18003b826
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x58]
call fcn.18002a520
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18004d370
add rsp, 0x78
ret
Function at 0x18003bde0
Capabilities:
Modify service

Disassembly:
sub rsp, 0x88
mov dword [rsp + 0x64], 1
mov eax, dword [rsp + 0x64]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x18003be16
xor r9d, r9d
lea r8, [0x180075d70]
lea rdx, [0x180075d5c]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax]
xor edx, edx
mov ecx, SafeArrayGetElement
div rcx
mov rax, rdx
mov dword [rsp + 0x68], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
movsxd rdx, dword [rsp + 0x68]
lea r8, [0x180087dc0]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx*4], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0
lea rdx, [0x180087dc0]
mov dword [rdx + rcx], eax
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x18003bec1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.E:_d_OpenSCManager
mov ecx, 4
call fcn.180040a70
jmp 0x18003c042
mov r8d, 2
lea rdx, str.BITS
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
jne 0x18003bf05
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.E:_d_OpenService
mov ecx, 4
call fcn.180040a70
jmp 0x18003bfc8
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8d, 2
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x18003bfbd
mov eax, reloc.OLEAUT32.dll_SafeArrayDestroy
mov word [rsp + 0x60], ax
movsx rax, word [rsp + 0x60]
lea rcx, [0x180087dc0]
cmp dword [rcx + rax*4], 1
jne 0x18003bfa3
movsx rax, word [rsp + 0x60]
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x60]
lea rdx, [0x180087dc0]
mov dword [rdx + rcx*4], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x180076238]
mov ecx, 4
call fcn.180040a70
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax]
xor edx, edx
mov ecx, SafeArrayGetElement
div rcx
mov rax, rdx
mov dword [rsp + 0x6c], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
movsxd rdx, dword [rsp + 0x6c]
lea r8, [0x180087dc0]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx*4], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0
lea rdx, [0x180087dc0]
mov dword [rdx + rcx], eax
add rsp, 0x88
ret
Function at 0x18003c230
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x1800881a0]
xor rax, rsp
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x30], 0
xor eax, eax
cmp eax, 1
je 0x18003c407
mov eax, dword [rsp + 0xa8]
imul eax, eax, 0x3e8
sub eax, dword [rsp + 0x30]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x20], 0x1cff
mov r9d, dword [rsp + 0x44]
xor r8d, r8d
lea rdx, [rsp + 0xa0]
mov ecx, 1
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x18003c2bc
mov eax, 1
jmp 0x18003c409
cmp dword [rsp + 0x34], 1
je 0x18003c2f7
mov dword [rsp + 0x4c], 1
mov eax, dword [rsp + 0x4c]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x18003c2f2
xor r9d, r9d
lea r8, [0x180075538]
lea rdx, [0x180075264]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x18003c407
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x18003c402
mov dword [rsp + 0x38], 1
mov eax, dword [rsp + 0x38]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x18003c349
xor r9d, r9d
lea r8, [0x180075724]
lea rdx, [0x180075344]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rsp + 0x3c], 1
mov eax, dword [rsp + 0x3c]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x18003c378
xor r9d, r9d
lea r8, [0x18007579c]
lea rdx, [0x18007537c]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor edx, edx
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x18003c3a9
mov eax, 1
jmp 0x18003c409
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsp + 0x40]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa8]
imul eax, eax, 0x3e8
cmp dword [rsp + 0x30], eax
jbe 0x18003c3fd
mov dword [rsp + 0x48], 1
mov eax, dword [rsp + 0x48]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x18003c3f9
xor r9d, r9d
lea r8, [0x18007583c]
lea rdx, [0x1800754ac]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x18003c409
jmp 0x18003c2f7
jmp 0x18003c264
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18004d370
add rsp, 0x98
ret
Function at 0x180044540
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
xor r9d, r9d
mov r8, qword [rsp + 0xb8]
mov edx, 1
lea rcx, [rsp + 0x40]
call fcn.18004b7c0
mov dword [rsp + 0x2c], 1
mov eax, dword [rsp + 0x2c]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x18004459a
xor r9d, r9d
lea r8, [0x1800775e4]
lea rdx, [0x1800775ec]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rsp + 0x24], 0xffffffff
lea rcx, [rsp + 0x40]
call fcn.18004be10
test rax, rax
je 0x18004463d
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.180044e80
mov ecx, dword [rsp + 0x24]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x28], 8
jmp 0x1800445e1
mov eax, dword [rsp + 0x28]
dec eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x180044609
mov eax, dword [rsp + 0x24]
shr eax, 1
mov ecx, dword [rsp + 0x24]
and ecx, 1
xor edx, edx
sub edx, ecx
mov ecx, edx
and ecx, 0xedb88320
xor eax, ecx
mov dword [rsp + 0x24], eax
jmp 0x1800445d7
mov dword [rsp + 0x34], 1
mov eax, dword [rsp + 0x34]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x180044638
xor r9d, r9d
lea r8, [0x1800775f0]
lea rdx, [0x1800775f8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1800445a2
mov eax, dword [rsp + 0x24]
not eax
mov rcx, qword [rsp + 0xb0]
mov dword [rcx], eax
mov eax, 1
mov word [rsp + 0x20], ax
movsx rax, word [rsp + 0x20]
lea rcx, [0x180087f80]
cmp dword [rcx + rax*4], 1
jne 0x18004468c
movsx rax, word [rsp + 0x20]
lea rcx, [0x180087f80]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x20]
lea rdx, [0x180087f80]
mov dword [rdx + rcx*4], eax
xor eax, eax
jmp 0x1800446ff
add rsp, 0xa8
ret