joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140055fc0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1400cd450]
xorps xmm0, xmm0
add rcx, 1
js 0x140055f0b
cvtsi2ss xmm0, rcx
jmp 0x140055f20
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x1400cd440]
call fcn.140080d04
movss xmm1, dword [0x1400bc07c]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x140055f52
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140055f52
movabs rax, 0x8000000000000000
mov rcx, rax
mov rdx, qword [0x1400cd478]
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdx, rcx
jae 0x140055f8b
cmp rdx, 0x200
jae 0x140055f88
lea rdx, [rdx*8]
cmp rdx, rcx
jae 0x140055f8b
mov rdx, rcx
add rsp, 0x28
jmp 0x140055fc0
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14005616e
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1400cd448]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1400cd458]
lea rdx, [rdi + rdi]
call fcn.140055830
mov rax, qword [0x1400cd448]
lea r9, [rdi - 1]
mov qword [0x1400cd470], r9
mov qword [0x1400cd478], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140056163
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1400cd458]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1400560af
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140056124
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1400560ec
mov r10, qword [rdx]
cmp r10, rax
je 0x1400560e6
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140056124
cmp r9, rdx
je 0x140056100
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x140056138
cmp r9, rdx
jne 0x1400560f1
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x14005615e
mov r9, qword [0x1400cd470]
jmp 0x140056060
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140056124
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.14005706c
int3
Function at 0x140057124
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400571a8
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140086560]
cmp byte [rcx + rax], 0
je 0x1400571a8
dec r8
sub rdx, 1
jne 0x14005718e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14005a050
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005a09a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005a09a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005a09a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005a09a
cmp dword [rcx + 0x84], 0xe
jbe 0x14005a09a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005a09c
xor al, al
add rsp, 0x28
ret

Function at 0x140069614
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1400694a7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400694a7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400694a7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400694a7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400694a7
cmp dword [rcx + 0x84], 0xe
jbe 0x1400694a7
cmp dword [rcx + 0xf8], 0
je 0x1400694a7
mov ecx, ebx
call fcn.140069548
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140069338
cmp dword [rbp + 0x20], 0
je 0x1400694f4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400694fc
int3
xor r8d, r8d
xor edx, edx
jmp 0x140069440
Function at 0x140001000
Capabilities:
Access peb ldr_data

Disassembly:
push rbx
sub rsp, 0x200
mov rax, qword gs:[0x60]
mov r10, rcx
mov r11, qword [rax + 0x18]
add r11, 0x20
mov r9, qword [r11]
cmp r9, r11
je 0x1400011ae
movzx ebx, byte [rcx]
nop dword [rax]
mov r8, qword [r9 + 0x40]
lea rax, [rsp + 0x100]
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
lea edx, [rcx + 0x14]
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmmword [rax - 0x10], xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
mov qword [rax + 0x70], rcx
mov dword [rax + 0x78], ecx
mov word [rax + 0x7c], cx
mov byte [rax + 0x7e], cl
lea rax, [rsp]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmmword [rax - 0x10], xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
mov qword [rax + 0x70], rcx
mov dword [rax + 0x78], ecx
mov word [rax + 0x7c], cx
mov byte [rax + 0x7e], cl
movzx ecx, word [r8 + 0x28]
test cx, cx
je 0x140001114
lea eax, [rcx - 0x41]
cmp ax, 0x19
ja 0x140001100
add cx, 0x20
nop dword [rax]
mov byte [rsp + rdx + 0xec], cl
inc rdx
movzx ecx, word [r8 + rdx*2]
test cx, cx
jne 0x1400010f0
test bl, bl
je 0x14000113e
lea r8, [rsp]
movzx eax, bl
sub r8, r10
mov rdx, r10
lea ecx, [rax - 0x41]
cmp cl, 0x19
ja 0x140001130
add al, 0x20
nop
mov byte [r8 + rdx], al
inc rdx
movzx eax, byte [rdx]
test al, al
jne 0x140001125
xor edx, edx
xor eax, eax
cmp byte [rsp + 0x100], al
je 0x14000115c
nop dword [rax + rax]
inc rdx
cmp byte [rsp + rdx + 0x100], al
jne 0x140001150
cmp byte [rsp], al
je 0x14000116a
inc rax
cmp byte [rsp + rax], 0
jne 0x140001161
cmp rax, rdx
jne 0x1400011a2
xor ecx, ecx
test rdx, rdx
je 0x140001195
nop word [rax + rax]
movzx eax, byte [rsp + rcx]
cmp byte [rsp + rcx + 0x100], al
jne 0x1400011a2
inc rcx
cmp rcx, rdx
jb 0x140001180
mov rax, qword [r9 + 0x20]
add rsp, 0x200
pop rbx
ret
mov r9, qword [r9]
cmp r9, r11
jne 0x140001030
xor eax, eax
add rsp, 0x200
pop rbx
ret
Function at 0x1400011c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd rax, dword [rcx + 0x3c]
xor r9d, r9d
mov ebx, edx
mov r11, rcx
mov r8d, dword [rax + rcx + 0x88]
add r8, rcx
mov edi, dword [r8 + 0x1c]
mov esi, dword [r8 + 0x24]
add rdi, rcx
mov r10d, dword [r8 + 0x20]
add rsi, rcx
mov r8d, dword [r8 + 0x18]
add r10, rcx
test r8d, r8d
je 0x14000125b
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [r10]
mov eax, 0x458c
add rdx, r11
movzx ecx, byte [rdx]
test cl, cl
je 0x140001246
nop dword [rax]
nop word [rax + rax]
imul eax, eax, 0x7313
lea rdx, [rdx + 1]
movsx ecx, cl
add eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x140001230
xor eax, 0xab98
cmp ebx, eax
je 0x140001270
inc r9d
add r10, 4
cmp r9d, r8d
jb 0x140001210
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
movzx ecx, word [rsi + r9*2]
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov eax, dword [rdi + rcx*4]
mov rdi, qword [rsp + 0x18]
add rax, r11
ret
Function at 0x140001070
Capabilities:
Enumerate process modules
Execute command
Get memory capacity
Get system information on windows
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x12c0
call fcn.1400022f0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x12b0], rax
lea rcx, [rsp + 0x70]
xor bl, bl
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x90], 2
lea rcx, [rsp + 0x30]
movzx ebx, bl
mov edi, 1
cmovb ebx, edi
mov dword [rsp + 0x30], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rcx, qword [rsp + 0x38]
shr rcx, 0x14
test bl, bl
jne 0x14000122e
cmp ecx, 0x800
jb 0x14000122e
lea r8, [rsp + 0x28]
mov edx, 0x1000
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x140001124
mov eax, edi
mov rcx, qword [rsp + 0x12b0]
xor rcx, rsp
call fcn.1400014e0
mov rbx, qword [rsp + 0x12e0]
add rsp, 0x12c0
pop rdi
ret
mov eax, dword [rsp + 0x28]
shr eax, 2
test eax, eax
je 0x14000121a
mov qword [rsp + 0x12d0], rbp
lea rbx, [rsp + 0xa0]
mov ebp, eax
mov qword [rsp + 0x12d8], rsi
nop dword [rax]
mov edi, dword [rbx]
test edi, edi
je 0x1400011fc
movups xmm0, xmmword [str._unknown_]
mov eax, dword [0x140003320]
lea rcx, [rsp + 0x10b4]
xor edx, edx
mov dword [rsp + 0x10b0], eax
mov r8d, 0x1f4
movaps xmmword [rsp + 0x10a0], xmm0
call sub.VCRUNTIME140.dll_memset
mov r8d, edi
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x1400011dc
lea r9, [rsp + 0x2c]
mov r8d, 8
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1400011dc
mov rdx, qword [rsp + 0x20]
lea r8, [rsp + 0x10a0]
mov r9d, 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
mov r8d, edi
lea rdx, [rsp + 0x10a0]
lea rcx, str._s___PID:__u__n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x140001150
mov rsi, qword [rsp + 0x12d8]
mov rbp, qword [rsp + 0x12d0]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
jmp 0x140001103
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001260
mov rcx, rax
lea rdx, [0x140001420]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140001da0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001dea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001dea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001dea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001dea
cmp dword [rcx + 0x84], 0xe
jbe 0x140001dea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001dec
xor al, al
add rsp, 0x28
ret
Function at 0x10000104b
Capabilities:
Set registry value

Disassembly:
jmp 0x1000119a0
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
xor edi, edi
mov rbx, r8
mov rbp, rdx
cmp r8, rdi
mov r12, rcx
jne 0x1000119d4
mov ecx, 0x80004005
call fcn.10000110e
int3
mov rsi, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 1
lea rsi, [rsi + rax*2]
lea edi, [rdi + rax*2]
jne 0x1000119d7
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x1000010a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x1000169ec
push rbx
push rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x10002e230]
xor rax, rsp
mov qword [rsp + 0x450], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x40], 0
mov rax, rdx
xor edx, edx
mov rbx, r8
mov qword [rsp + 0x38], rcx
lea r8d, [rdx + 2]
mov rcx, rax
mov rsi, r9
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
mov rdi, rax
jne 0x100016a46
call fcn.1000013fc
mov ebx, eax
jmp 0x100016b54
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov rbx, rax
jne 0x100016a67
call fcn.1000013fc
jmp 0x100016b49
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rsi, rax
je 0x100016a5d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
add eax, 1
cmp eax, ebx
jae 0x100016ab0
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x40], rax
je 0x100016aa6
lea rcx, [rsp + 0x40]
call fcn.100001794
mov eax, 0x8007000e
jmp 0x100016b6c
test eax, eax
mov ecx, eax
je 0x100016aee
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x100016ae3
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x100016aee
lea rcx, [rsp + 0x40]
call fcn.100001316
mov r11, qword [rsp + 0x40]
jmp 0x100016af8
mov ecx, 0x80070057
call fcn.10000110e
int3
lea r11, [rsp + 0x48]
mov qword [rsp + 0x40], r11
test r11, r11
jne 0x100016b04
mov ebx, 0x8007000e
jmp 0x100016b4b
xor edx, edx
mov r9d, ebx
mov r8, rsi
lea ecx, [rdx + 3]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r11
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x100016a5d
mov r8d, dword [rsp + 0x4a0]
mov ecx, eax
mov rax, qword [rsp + 0x40]
and word [rax + rcx*2], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.1000010c3
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x40], rax
je 0x100016b6a
lea rcx, [rsp + 0x40]
call fcn.100001794
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1000218f0
add rsp, 0x460
pop rdi
pop rsi
pop rbx
ret
Function at 0x100001127
Capabilities:
Delete registry value

Disassembly:
jmp 0x10001a820
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
call fcn.10000119f
test eax, eax
jne 0x10001a842
mov eax, 0x80004005
jmp 0x10001a939
and qword [rsp + 0x68], 0
lea rax, [rsp + 0x68]
mov edi, 0x20006
lea rdx, [0x10000ad20]
mov r9d, edi
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10001a932
mov rbx, qword [rsp + 0x68]
and qword [rsp + 0x70], 0
lea rax, [rsp + 0x70]
lea rsi, [0x10000b6e0]
mov rcx, rbx
mov r9d, edi
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10001a917
mov rdi, qword [rsp + 0x70]
lea rdx, [0x10000ba98]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [0x10002e3b0]
and qword [rsp + 0x40], 0
and qword [rsp + 0x48], 0
xor r8d, r8d
lea r11, [0x10000ba60]
lea r9, [rsp + 0x30]
lea edx, [r8 + 0x65]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r11
call fcn.10000161d
test rdi, rdi
mov esi, eax
je 0x10001a905
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x10001a913
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10001a939
mov ecx, eax
call fcn.1000017cb
test rbx, rbx
mov edi, eax
je 0x10001a92e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x10001a939
mov ecx, eax
call fcn.1000017cb
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x100001145
Capabilities:
Create service

Disassembly:
jmp 0x100017fe4
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa90
mov rax, qword [0x10002e230]
xor rax, rsp
mov qword [rsp + 0xa80], rax
mov rdi, rcx
call fcn.1000015cd
test eax, eax
je 0x100018019
mov eax, 1
jmp 0x1000180fb
mov ebx, 0x104
lea rdx, [rsp + 0x72]
xor ecx, ecx
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1000180f9
cmp eax, ebx
je 0x1000180f9
lea ecx, [rax + 1]
mov word [rsp + 0x70], 0x22
add eax, 2
and word [rsp + rax*2 + 0x70], 0
mov word [rsp + rcx*2 + 0x70], 0x22
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rbx, rax
jne 0x10001811c
mov ebx, 0x400
lea rdx, [rsp + 0x280]
mov ecx, 0xd80a
mov r8d, ebx
call fcn.10000154b
test eax, eax
jne 0x1000180e2
lea r8, [0x10000b7f0]
lea rcx, [rsp + 0x280]
mov rdx, rbx
call sub.msvcrt.dll_wcscpy_s
test eax, eax
je 0x1000180e2
cmp eax, 0xc
je 0x1000180d7
cmp eax, 0x16
je 0x1000180cc
cmp eax, 0x22
je 0x1000180cc
cmp eax, 0x50
je 0x1000180e2
mov ecx, 0x80004005
call fcn.10000110e
int3
mov ecx, 0x80070057
call fcn.10000110e
int3
mov ecx, 0x8007000e
call fcn.10000110e
int3
lea r8, [rdi + 0x68]
lea rdx, [rsp + 0x280]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.1000218f0
mov rbx, qword [rsp + 0xaa8]
add rsp, 0xa90
pop rdi
ret
and qword [rsp + 0x60], 0
and qword [rsp + 0x58], 0
lea rax, [0x10000b7e0]
mov qword [rsp + 0x50], rax
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x70]
add rdi, 0x68
mov r9d, 0xf01ff
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov r8, rdi
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x1000181ff
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, 0x400
lea rdx, [rsp + 0x280]
mov r8d, ebx
mov ecx, 0xd80b
call fcn.10000154b
test eax, eax
jne 0x1000181f7
lea r8, [0x10000b7a0]
lea rcx, [rsp + 0x280]
mov rdx, rbx
call sub.msvcrt.dll_wcscpy_s
test eax, eax
je 0x1000181f7
cmp eax, 0xc
je 0x1000181ec
cmp eax, 0x16
je 0x1000181e1
cmp eax, 0x22
je 0x1000181e1
cmp eax, 0x50
je 0x1000181f7
mov ecx, 0x80004005
call fcn.10000110e
int3
mov ecx, 0x80070057
call fcn.10000110e
int3
mov ecx, 0x8007000e
call fcn.10000110e
int3
mov r8, rdi
jmp 0x1000180e6
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10001800f
Function at 0x100001172
Capabilities:
Set registry value

Disassembly:
jmp 0x10001c8f4
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x60
and dword [rsp + 0x50], 0
and qword [r11 - 0x10], 0
lea rax, [r11 - 0x18]
mov qword [r11 - 0x28], rax
lea rax, [r11 - 0x10]
mov rdi, r9
mov qword [r11 - 0x30], rax
and qword [r11 - 0x38], 0
mov rsi, r8
lea r9, [0x10000bb6c]
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov ebx, eax
jne 0x10001c975
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorLength]
mov rcx, qword [rsp + 0x58]
lea r9d, [rbx + 3]
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x10001c985
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x10000132f
Capabilities:
Access the windows event log

Disassembly:
jmp 0x100017d2c
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
sub rsp, 0x270
mov rax, qword [0x10002e230]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r9, rdx
mov edx, 0x100
mov rbx, rcx
lea rax, [r11 + 0x18]
lea rcx, [rsp + 0x60]
lea r8d, [rdx - 1]
mov qword [rsp + 0x20], rax
call sub.msvcrt.dll__vsnwprintf_s
and word [rsp + 0x25e], 0
cmp dword [rbx + 0x28c], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
jne 0x100017d9e
lea rcx, [rsp + 0x60]
call qword [sym.imp.msvcrt.dll__putws]
lea rdx, [rbx + 0x68]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
mov rbx, rax
je 0x100017df0
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
xor r8d, r8d
mov dx, 4
mov rcx, rbx
mov word [rsp + 0x28], 1
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1000218f0
add rsp, 0x270
pop rbx
ret

Function at 0x100001357
Capabilities:
Check os version

Disassembly:
jmp 0x10001d884
push rbx
sub rsp, 0x150
mov rax, qword [0x10002e230]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
xor ebx, ebx
mov dword [rsp + 0x20], 0x11c
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, ebx
je 0x10001d8ff
cmp dword [rsp + 0x24], 5
lea eax, [rbx + 1]
jne 0x10001d8fc
mov ecx, dword [rsp + 0x28]
cmp ecx, eax
jb 0x10001d8f8
jne 0x10001d8e9
cmp word [rsp + 0x134], 2
jmp 0x10001d8f6
cmp ecx, 2
jne 0x10001d8ff
cmp word [rsp + 0x134], ax
jae 0x10001d8ff
mov ebx, eax
jmp 0x10001d8ff
cmovb ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1000218f0
add rsp, 0x150
pop rbx
ret

Function at 0x100001429
Capabilities:
Check os version

Disassembly:
jmp 0x10001dfdc
push rbx
sub rsp, 0x150
mov rax, qword [0x10002e230]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, VarUI4FromDisp
xor ebx, ebx
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], VarUI4FromDisp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
jne 0x10001e02f
cmp dword [rsp + 0x28], ebx
lea eax, [rbx + 1]
cmove ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1000218f0
add rsp, 0x150
pop rbx
ret