joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019718
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14001979f
mov rsi, rbx
cmp word [rax], bp
je 0x14001975e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140019748
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140019744
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140016c50
mov rdi, rax
test rax, rax
je 0x14001978c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140020340
mov rbp, rdi
xor ecx, ecx
call fcn.140015d30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001b860
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001b876
mov al, 1
jmp 0x14001b8e2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001b887
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001b8e0
mov ecx, dword [rcx + 0x18]
nop
call fcn.140019a60
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001b8e0
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov r9d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001b8e0
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001b8e0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001b8e2
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001fb20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001fb48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001fb48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180012a40
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x180012a75
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x180012a50
and r10, 0xf
je 0x180012aa5
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x180012a80
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x180012a99
mov rax, r8
repz ret

Function at 0x180012ab0
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x180012aed
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x180012ac0
pxor xmm1, xmm1
and r10, 0xf
je 0x180012b23
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x180012afb
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x180012b17
mov rax, r8
repz ret
Function at 0x18005a8bc
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x38
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov r15d, r8d
mov r14, rcx
xor ebx, ebx
mov dword [rbp - 0x18], ebx
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], bl
mov dword [rbp - 0x18], 1
mov edi, ebx
test r8d, r8d
je 0x18005aa70
mov ecx, ebx
lea esi, [rbx + 3]
dec r15d
mov al, byte [rdx]
mov byte [rbp + rcx + 0x58], al
inc edi
inc rcx
inc rdx
mov qword [rbp + 0x50], rdx
mov r8b, byte [rbp + 0x5a]
mov r12b, byte [rbp + 0x59]
mov r13b, byte [rbp + 0x58]
cmp rcx, rsi
jne 0x18005a9ab
mov al, r13b
shr al, 2
mov byte [rbp + 0x60], al
mov cl, r13b
and cl, sil
shl cl, 4
mov al, r12b
shr al, 4
add cl, al
mov byte [rbp + 0x61], cl
mov cl, r12b
and cl, 0xf
shl cl, 2
mov al, r8b
shr al, 6
add cl, al
mov byte [rbp + 0x62], cl
mov al, r8b
and al, 0x3f
mov byte [rbp + 0x63], al
mov rdi, rbx
lea rcx, [0x1802c0ba0]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x1802c0ba0]
movzx eax, byte [rbp + rdi + 0x60]
mov dl, byte [rax + rcx]
mov rcx, r14
call fcn.18005acd0
inc rdi
cmp rdi, 4
jl 0x18005a96e
mov edi, ebx
mov rcx, rbx
mov rdx, qword [rbp + 0x50]
mov r8b, byte [rbp + 0x5a]
test r15d, r15d
jne 0x18005a90c
test edi, edi
je 0x18005aa70
cmp edi, esi
jge 0x18005a9e4
mov eax, esi
sub eax, edi
movsxd r8, eax
movsxd rax, edi
lea rcx, [rbp + 0x58]
add rcx, rax
xor edx, edx
call fcn.1801c27d0
mov r8b, byte [rbp + 0x5a]
mov r12b, byte [rbp + 0x59]
mov r13b, byte [rbp + 0x58]
mov al, r13b
shr al, 2
mov byte [rbp + 0x60], al
and r13b, sil
shl r13b, 4
mov al, r12b
shr al, 4
add r13b, al
mov byte [rbp + 0x61], r13b
and r12b, 0xf
shl r12b, 2
mov al, r8b
shr al, 6
add r12b, al
mov byte [rbp + 0x62], r12b
and r8b, 0x3f
mov byte [rbp + 0x63], r8b
lea eax, [rdi + 1]
movsxd r15, eax
test eax, eax
jle 0x18005aa57
lea rcx, [0x1802c0ba0]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rcx, qword [0x1802c0ba0]
movzx eax, byte [rbp + rbx + 0x60]
mov dl, byte [rax + rcx]
mov rcx, r14
call fcn.18005acd0
inc rbx
cmp rbx, r15
jl 0x18005aa28
cmp edi, esi
jge 0x18005aa70
sub esi, edi
movsxd rbx, esi
mov dl, 0x3d
mov rcx, r14
call fcn.18005acd0
sub rbx, 1
jne 0x18005aa60
mov rax, r14
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18005b64c
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x358]
sub rsp, 0x450
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rbx, rcx
movdqa xmm0, xmmword [0x180283730]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x18005b693
mov rcx, qword [rcx]
lea rdx, [0x180281238]
call fcn.1801c91e8
mov rdi, rax
test rax, rax
je 0x18005b76c
mov esi, 1
jmp 0x18005b6d3
mov byte [rsp + rax + 0x60], 0
lea rcx, [rsp + 0x60]
call fcn.1801c86a0
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.18005dedc
mov r9, rdi
mov r8d, 0x3e7
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.1801c9490
test rax, rax
jne 0x18005b6b2
mov rcx, rdi
call fcn.1801c95dc
lea rdi, str.user_pref__security.enterprise_roots.enabled___true__
mov rcx, rdi
call fcn.1801c86a0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov rdx, qword [rsp + 0x40]
call fcn.18005d944
cmp rax, 0xffffffffffffffff
jne 0x18005b76c
cmp qword [rbx + 0x18], 8
jb 0x18005b738
mov rbx, qword [rbx]
lea rdx, [0x180281240]
mov rcx, rbx
call fcn.1801c91e8
mov rbx, rax
test rax, rax
je 0x18005b76c
mov r9, rax
mov r8d, gethostname
mov rdx, rsi
mov rcx, rdi
call fcn.1801c9890
mov rcx, rbx
call fcn.1801c95dc
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x18005b7a5
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005b7a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b7be
call fcn.18009e42c
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.1801c897c
int3
Function at 0x18005b7c4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov r12, rdx
cmp qword [rcx + 0x18], 8
jb 0x18005b7f3
mov rcx, qword [rcx]
lea rdx, [0x180281238]
call fcn.1801c91e8
mov r15, rax
test rax, rax
je 0x18005b94e
xor ebx, ebx
mov qword [rbp - 0x18], rbx
xor esi, esi
mov qword [rbp - 0x10], rsi
xor edi, edi
mov qword [rbp - 8], rdi
mov r9, rax
lea r14d, [rbx + 1]
mov r8d, r14d
mov edx, r14d
lea rcx, [rbp + 0x30]
call fcn.1801c9490
test rax, rax
je 0x18005b87e
cmp rdi, rsi
je 0x18005b84b
mov al, byte [rbp + 0x30]
mov byte [rsi], al
add rsi, r14
mov qword [rbp - 0x10], rsi
jmp 0x18005b863
lea r8, [rbp + 0x30]
mov rdx, rsi
lea rcx, [rbp - 0x18]
call fcn.18005d810
mov rdi, qword [rbp - 8]
mov rsi, qword [rbp - 0x10]
mov r9, r15
mov r8, r14
mov rdx, r14
lea rcx, [rbp + 0x30]
call fcn.1801c9490
test rax, rax
jne 0x18005b838
mov rbx, qword [rbp - 0x18]
mov rcx, r15
call fcn.1801c95dc
sub rsi, rbx
mov r9, qword [r12 + 0x10]
cmp rsi, r9
ja 0x18005b8d3
xor r14b, r14b
test rbx, rbx
je 0x18005b8ce
sub rdi, rbx
mov rax, rbx
cmp rdi, 0x1000
jb 0x18005b8c3
add rdi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b96f
mov rdx, rdi
mov rcx, rbx
call fcn.18009e42c
mov al, r14b
jmp 0x18005b950
xor r10d, r10d
xor r8d, r8d
test r9, r9
je 0x18005b907
mov rax, r12
cmp qword [r12 + 0x18], 8
jb 0x18005b8ed
mov rax, qword [r12]
movzx edx, word [rax + r8*2]
lea rax, [rbx + r8]
movsx ecx, byte [rax + r10]
cmp ecx, edx
jne 0x18005b907
add r8, r14
cmp r8, r9
jb 0x18005b8de
cmp r8, r9
je 0x18005b896
add r10, r14
mov rax, rsi
sub rax, r9
cmp r10, rax
jbe 0x18005b8d6
test rbx, rbx
je 0x18005b94e
sub rdi, rbx
mov rax, rbx
cmp rdi, 0x1000
jb 0x18005b943
add rdi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b969
mov rdx, rdi
mov rcx, rbx
call fcn.18009e42c
xor al, al
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1801c897c
int3
call fcn.1801c897c
int3
Function at 0x18005fd28
Capabilities:
Read file on windows

Disassembly:
mov r9, qword [rcx + 8]
mov rax, rdx
test r9, r9
jne 0x18005fd37
xor eax, eax
ret
mov r8d, r8d
mov edx, 1
mov rcx, rax
jmp fcn.1801c9490

Function at 0x18005fd48
Capabilities:
Write file on windows

Disassembly:
mov r9, qword [rcx + 8]
mov rax, rdx
test r9, r9
jne 0x18005fd57
xor eax, eax
ret
mov r8d, r8d
mov edx, 1
mov rcx, rax
jmp fcn.1801c9890

Function at 0x18006d7f8
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x260
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rsi, rcx
mov rcx, qword [rcx + 8]
xor ebx, ebx
test rcx, rcx
jne 0x18006d82c
xor eax, eax
jmp 0x18006d965
mov rax, qword [rcx]
call qword [rax + 0x20]
mov ebp, eax
test eax, eax
je 0x18006d825
cmp byte [rsi + 0x14], bl
jne 0x18006d963
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov ecx, dword [rsi + 0x10]
cmp rax, rcx
jbe 0x18006d963
call fcn.180079c88
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], bx
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.18005d244
nop
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, [0x180281b30]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x18006d959
mov ecx, reloc.WS2_32.dll_recv
call fcn.18009e460
mov rdi, rax
mov qword [rsp + 0x280], rax
lea rax, vtable.ProtocolFilters::FileStream.0
mov qword [rdi], rax
mov qword [rdi + 8], rbx
lea rdx, str.wbTD
lea rcx, [rsp + 0x50]
call fcn.1801c91e8
mov qword [rdi + 8], rax
test rax, rax
jne 0x18006d8f6
mov r8, qword [rdi]
lea edx, [rax + 1]
mov rcx, rdi
call qword [r8]
jmp 0x18006d959
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
xor edx, edx
lea r8d, [rdx + 1]
call qword [rax + reloc.WS2_32.dll_recv]
mov r14, rax
mov rcx, qword [rsi + 8]
mov r8, qword [rcx]
mov rdx, rdi
call qword [r8 + 0x30]
mov rbx, rax
mov rcx, qword [rsi + 8]
mov rdx, qword [rcx]
call qword [rdx + 0x28]
cmp rbx, rax
je 0x18006d938
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
jmp 0x18006d959
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
call qword [rax + htons]
mov qword [rsi + 8], rdi
mov rax, qword [rdi]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
mov byte [rsi + 0x14], 1
lea rcx, [rsp + 0x20]
call fcn.18005e40c
mov eax, ebp
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18006eef0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
xor edx, edx
mov rdi, rcx
lea rcx, [rbp - 0x20]
lea r8d, [rdx + 0x20]
call fcn.1801c27d0
mov rax, qword [0x1802c0bf0]
mov rcx, qword [0x1802c7d08]
and dword [rbp + 0x10], 0
mov qword [rbp - 0x30], rax
mov rax, qword [0x1802c0be8]
mov qword [rbp - 0x28], rax
mov eax, dword [rdi + 0xc]
add rax, 0x10
mov qword [rbp + 0x18], rax
cmp rax, qword [rcx + 0x18]
jbe 0x18006ef50
mov eax, 0xfffffffc
jmp 0x18006f05e
or rbx, 0xffffffffffffffff
cmp qword [0x1802c0c00], rbx
je 0x18006f059
cmp qword [rcx + 0x10], 0
je 0x18006f059
lea rcx, [0x1802c7480]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x1802c7d08]
mov rdx, rdi
mov r8, qword [rbp + 0x18]
mov rcx, qword [rcx + 0x10]
call fcn.1801c2370
xor edx, edx
lea r8d, [rbx + 0x21]
lea rcx, [rbp - 0x20]
call fcn.1801c27d0
mov rax, qword [0x1802c0bf0]
lea r8d, [rbx + 9]
mov rcx, qword [0x1802c0c00]
lea rdx, [rbp + 0x18]
mov qword [rbp - 8], rax
xor r9d, r9d
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18006efe3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x18006efe3
mov ebx, 0xfffffffc
jmp 0x18006f048
xor r8d, r8d
lea rdx, [rbp - 0x30]
or r9d, 0xffffffff
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x18006f005
mov rcx, qword [0x1802c0c00]
jmp 0x18006f01f
mov rcx, qword [0x1802c0be8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x1802c0c00]
test eax, eax
jne 0x18006f027
call qword [sym.imp.KERNEL32.dll_CancelIo]
jmp 0x18006f048
xor r9d, r9d
lea r8, [rbp + 0x10]
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x18006f048
mov eax, dword [rbp + 0x10]
neg eax
sbb edx, edx
neg edx
lea ebx, [rdx - 1]
lea rcx, [0x1802c7480]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
jmp 0x18006f05e
mov eax, 0xfffffffd
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180070700
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1802c0bf0]
mov r15, r9
and dword [rbp + 0x48], 0
mov r12, rdx
test byte [r9 + 0x12], 1
mov r13d, ecx
mov qword [rbp - 0x38], rax
mov rax, qword [0x1802c0be8]
mov qword [rbp - 0x30], rax
movsxd r14, r8d
je 0x180070753
xor eax, eax
jmp 0x1800708a5
mov rcx, qword [0x1802c7d08]
lea esi, [r14 + 0x16]
movsxd rax, esi
add rax, 0x10
mov qword [rbp - 0x40], rax
cmp rax, qword [rcx + 0x18]
jbe 0x180070779
mov eax, 0xfffffffc
jmp 0x1800708a5
or rdi, 0xffffffffffffffff
cmp qword [0x1802c0c00], rdi
je 0x1800708a0
cmp qword [rcx + 0x10], 0
je 0x1800708a0
lea rcx, [0x1802c7480]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x1802c7d08]
lea r8d, [rdi + 0x17]
mov rdx, r15
mov rbx, qword [rax + 0x10]
and qword [rbx + 4], 0
lea rcx, [rbx + 0x10]
mov dword [rbx], r13d
mov dword [rbx + 0xc], esi
call fcn.1801c2370
mov r8, r14
lea rcx, [rbx + 0x26]
mov rdx, r12
call fcn.1801c2370
xor edx, edx
lea r8d, [rdi + 0x21]
lea rcx, [rbp - 0x28]
call fcn.1801c27d0
mov rax, qword [0x1802c0bf0]
lea r8d, [rdi + 9]
mov rcx, qword [0x1802c0c00]
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x10], rax
xor r9d, r9d
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18007082a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x18007082a
mov edi, 0xfffffffc
jmp 0x18007088f
xor r8d, r8d
lea rdx, [rbp - 0x38]
or r9d, 0xffffffff
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x18007084c
mov rcx, qword [0x1802c0c00]
jmp 0x180070866
mov rcx, qword [0x1802c0be8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x1802c0c00]
test eax, eax
jne 0x18007086e
call qword [sym.imp.KERNEL32.dll_CancelIo]
jmp 0x18007088f
xor r9d, r9d
lea r8, [rbp + 0x48]
lea rdx, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x18007088f
mov eax, dword [rbp + 0x48]
neg eax
sbb edx, edx
neg edx
lea edi, [rdx - 1]
lea rcx, [0x1802c7480]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
jmp 0x1800708a5
mov eax, 0xfffffffd
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180070dfc
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
lea rcx, [0x1802c7458]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [0x1802c0c00], 0xffffffffffffffff
je 0x180070e9a
cmp qword [0x1802c0c08], 0xffffffffffffffff
jne 0x180070e9a
xor ebx, ebx
test rdi, rdi
je 0x180070e9a
mov rcx, qword [0x1802c0be8]
mov qword [0x1802c7d00], rdi
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [0x1802c0be0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [0x1802c0bd8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x18006fc58]
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call fcn.1801d1e40
test rax, rax
jne 0x180070eb7
mov rcx, qword [0x1802c0be0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
or qword [0x1802c0c08], 0xffffffffffffffff
or ebx, 0xffffffff
lea rcx, [0x1802c7458]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov qword [0x1802c0c08], rax
jmp 0x180070e9d

Function at 0x180070f24
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x180070fcd
lea r8, [rsp + 0x50]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180070fc4
lea r8, [rsp + 0x58]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x180070fbe
mov rax, qword [rsp + 0x58]
lea r8, [rsp + 0x30]
and qword [rsp + 0x28], 0
mov r9d, reloc.WS2_32.dll_recv
and qword [rsp + 0x20], 0
xor edx, edx
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x40
pop rbx
ret
Function at 0x180072f9c
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov byte [rsp + 8], cl
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x30
mov bl, byte [0x1802c69b8]
lea rax, [rbp + 0x38]
not bl
mov qword [rsp + 0x20], rax
mov r9d, 3
lea rdx, str.SYSTEMCurrentControlSetServicesTcpip6Parameters
xor r8d, r8d
mov rcx, 0xffffffff80000002
and bl, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, 4
test eax, eax
jne 0x18007305f
mov rcx, qword [rbp + 0x38]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x30]
lea rax, [rbp + 0x20]
mov dword [rbp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DisabledComponents
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18007301f
cmp dword [rbp + 0x28], eax
je 0x18007301f
mov ecx, dword [rbp + 0x20]
jmp 0x180073021
xor ecx, ecx
mov eax, ecx
mov dword [rsp + 0x28], edi
or eax, 8
lea rdx, str.DisabledComponents
and ecx, 0xfffffff7
mov r9d, edi
test bl, bl
cmovne ecx, eax
lea rax, [rbp + 0x20]
mov dword [rbp + 0x20], ecx
xor r8d, r8d
mov rcx, qword [rbp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x28]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesTcpipParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1800730ba
and dword [rbp + 0x20], eax
lea rcx, [rbp + 0x20]
mov dword [rsp + 0x28], edi
lea rdx, str.DisableTaskOffload
mov qword [rsp + 0x20], rcx
mov r9d, edi
mov rcx, qword [rbp + 0x28]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add rsp, 0x30
pop rdi
pop rbx
pop rbp
ret
Function at 0x1800730c4
Capabilities:
Create service
Query service status
Start service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov byte [rax + 0x18], r8b
push rdi
push r14
push r15
sub rsp, 0x2a0
mov rsi, rdx
lea r8, [0x180281cb8]
mov r14, rcx
xor ebx, ebx
mov r9, rcx
mov dword [rax + 0x18], ebx
mov edx, 0x104
lea rcx, [rax - 0x228]
mov edi, ebx
call fcn.180073978
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbp, rax
test rax, rax
jne 0x18007312b
or eax, 0xffffffff
jmp 0x18007325b
mov qword [rsp + 0x60], rbx
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x58], rbx
lea r8, [rsp + 0x90]
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x48], rax
mov r15d, 1
lea rax, [0x180281cc0]
mov r9d, 0xf01ff
mov qword [rsp + 0x40], rax
mov rcx, rbp
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test byte [0x1802c69b8], 8
mov rsi, rax
je 0x1800731c0
test rax, rax
je 0x1800731a8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1800731bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x431
jne 0x18007323c
mov bl, r15b
jmp 0x18007323c
test rsi, rsi
jne 0x18007320a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x431
jne 0x18007323c
lea r8d, [rsi + 0x14]
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
je 0x180073234
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x18007320a
cmp dword [rsp + 0x74], 4
jne 0x18007320a
mov bl, r15b
jmp 0x180073221
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
movzx ebx, bl
cmovne ebx, r15d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x18007323c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call fcn.1800737b4
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, bl
sub eax, r15d
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret