joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000af20
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002ad18]
test rcx, rcx
je 0x14000af5b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000af4e
mov rcx, qword [0x14002ad18]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002ad18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x140039d70], 0
je 0x14000b04e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140025950]
mov qword [rsp + 0x80], rsi
lea rsi, [0x140033540]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b02f
test al, 0x10
je 0x14000b02f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000afd5
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x14000bf38
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000bf82
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000bf82
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000bf82
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000bf82
cmp dword [rcx + 0x84], 0xe
jbe 0x14000bf82
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000bf84
xor al, al
add rsp, 0x28
ret

Function at 0x14000d8b4
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14000d747
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000d747
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000d747
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000d747
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000d747
cmp dword [rcx + 0x84], 0xe
jbe 0x14000d747
cmp dword [rcx + 0xf8], 0
je 0x14000d747
mov ecx, ebx
call fcn.14000d7e8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14000d5d8
cmp dword [rbp + 0x20], 0
je 0x14000d794
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000d79c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000d6e0
Function at 0x14001c040
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001c068
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001c068
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140022500
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
mov rdi, rcx
mov qword [rsp + 0x48], r14
movsxd r14, dword [rcx + 0x28]
mov ecx, dword [rcx + 0x2c]
mov qword [rsp + 0x40], r15
movzx r15d, dx
movaps xmmword [rsp + 0x30], xmm6
movaps xmm6, xmm3
lea esi, [r14 + 1]
movaps xmmword [rsp + 0x20], xmm7
movaps xmm7, xmm2
cmp esi, ecx
jle 0x1400225a1
test ecx, ecx
je 0x14002254f
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x140022554
mov eax, 8
cmp eax, esi
mov ebx, esi
cmovg ebx, eax
cmp ebx, ecx
jle 0x1400225a1
movsxd rax, ebx
imul rcx, rax, 0x2c
mov qword [rsp + 0x60], rbp
call fcn.14000d720
mov rdx, qword [rdi + 0x30]
mov rbp, rax
test rdx, rdx
je 0x140022595
movsxd rcx, dword [rdi + 0x28]
imul r8, rcx, 0x2c
mov rcx, rax
call fcn.14007bf70
mov rcx, qword [rdi + 0x30]
call fcn.14000d9d0
mov qword [rdi + 0x30], rbp
mov rbp, qword [rsp + 0x60]
mov dword [rdi + 0x2c], ebx
movss xmm0, dword [rsp + 0x80]
movss xmm1, dword [rsp + 0x88]
mov dword [rdi + 0x28], esi
mov rsi, qword [rsp + 0x68]
imul rbx, r14, 0x2c
mov r14, qword [rsp + 0x48]
add rbx, qword [rdi + 0x30]
movss dword [rbx + 0x14], xmm0
movss xmm0, dword [rsp + 0x90]
movss dword [rbx + 0x18], xmm1
movss xmm1, dword [rsp + 0x98]
movss dword [rbx + 0x1c], xmm0
movss xmm0, dword [rsp + 0xa0]
movss dword [rbx + 0x20], xmm1
movss xmm1, dword [rsp + 0xa8]
movss dword [rbx + 0x24], xmm0
movss xmm0, dword [rsp + 0xb0]
movss dword [rbx + 0xc], xmm7
movaps xmm7, xmmword [rsp + 0x20]
movss dword [rbx + 0x10], xmm6
movaps xmm6, xmmword [rsp + 0x30]
mov word [rbx + 4], r15w
mov r15, qword [rsp + 0x40]
movss dword [rbx + 0x28], xmm1
mov rax, qword [rdi + 0x50]
addss xmm0, dword [rax + 0x20]
movss dword [rbx + 8], xmm0
mov rax, qword [rdi + 0x50]
cmp byte [rax + 0x1c], 0
je 0x140022668
mov ecx, 0x3f000000
call fcn.14002fc50
addss xmm0, dword [rbx + 8]
cvttss2si eax, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 8], xmm0
mov byte [rdi + 0x64], 1
xor r8d, r8d
mov rdi, qword [rsp + 0x70]
nop dword [rax]
nop dword [rax + rax]
movzx eax, r8b
movsxd rdx, r8d
add al, al
lea ecx, [rax + r8]
inc r8d
add cl, byte [rbx]
xor byte [rdx + rbx + 4], cl
cmp r8d, 0x28
jb 0x140022680
add rsp, 0x50
pop rbx
ret
Function at 0x1400987d0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140098857
mov rsi, rbx
cmp word [rax], bp
je 0x140098816
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140098800
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400987fc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14009102c
mov rdi, rax
test rax, rax
je 0x140098844
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14007bf70
mov rbp, rdi
xor ecx, ecx
call fcn.14009053c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14009b5fc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.14008fb04
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x14009b69d
cmp ebx, dword [rsp + 0x30]
je 0x14009b696
test esi, esi
je 0x14009b696
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x14009b671
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14009b67e
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x14009b65b
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14009b682
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x14009b69f
mov eax, 1
jmp 0x14009b69f
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14009fcc0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140095d7c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140095d7c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14009fe10
cmp rax, 0xffffffffffffffff
je 0x14009fe10
xor edi, edi
test rbp, rbp
jle 0x14009fdbb
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140090178
mov rbx, rax
test rax, rax
jne 0x14009fd48
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14009fdb1
mov edx, 0x8000
mov ecx, r14d
call fcn.14008dba8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400941a4
cmp eax, 0xffffffff
je 0x14009fd91
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14009fd58
mov edx, r15d
mov ecx, r14d
call fcn.14008dba8
jmp 0x14009fdb1
cmp byte [rsi + 0x38], dil
je 0x14009fda8
cmp dword [rsi + 0x34], 5
jne 0x14009fda8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14009fdb1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14009053c
jmp 0x14009fe24
jns 0x14009fe24
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140095d7c
cmp rax, 0xffffffffffffffff
jne 0x14009fddc
cmp byte [rsi + 0x30], dil
je 0x14009fe24
mov edi, dword [rsi + 0x2c]
jmp 0x14009fe24
mov ecx, r14d
call fcn.1400990a8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14009fe24
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14009fe24
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14009fe1d
mov eax, dword [rsi + 0x2c]
jmp 0x14009fe22
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140095d7c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x108dd84
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
xor esi, esi
lea rax, [rsp + 0x68]
lea rdx, [0x01081eb0]
and dword [rsp + 0x50], esi
lea r9d, [rsi + 0x11]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x108dde4
lea rdx, [0x01081f50]
lea r8, [0x01081f38]
mov r9d, eax
xor ecx, ecx
call fcn.01091f4c
mov eax, 0x80004005
jmp 0x108dfab
mov rcx, qword [rsp + 0x68]
and dword [rsp + 0x50], esi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x50]
lea rdx, [0x01081f90]
xor r8d, r8d
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x108de47
cmp dword [rsp + 0x50], 4
jne 0x108de47
mov r9d, dword [rsp + 0x58]
lea r8, [0x01081f38]
lea rdx, [0x01081fa0]
xor ecx, ecx
call fcn.01091f4c
mov esi, dword [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov rdi, rax
jne 0x108df3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x01082008]
jmp 0x108ddc9
mov rcx, qword [rsp + 0x68]
xor edx, edx
mov r9, rdi
lea r8d, [rdx + 4]
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
jne 0x108df7d
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x108df6b
cmp dword [0x010d8ffc], 0
je 0x108df3d
mov rcx, qword [rsp + 0x68]
and dword [rsp + 0x50], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x50]
lea rdx, [0x01081f90]
xor r8d, r8d
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x108df3d
cmp dword [rsp + 0x50], 4
jne 0x108df3d
mov r8d, dword [rsp + 0x58]
lea rdx, [0x01082100]
lea ecx, [rax + 0x1c]
call fcn.01091f4c
mov eax, dword [rsp + 0x58]
xor eax, esi
bt eax, 0x1d
jae 0x108df3d
mov esi, dword [rsp + 0x58]
lea rdx, [0x01082130]
mov ecx, 0x1c
call fcn.01091f4c
call fcn.0108dfb8
cmp dword [0x010e5304], 0
je 0x108de77
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x108df89
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x01082160]
jmp 0x108ddc9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x010820b0]
jmp 0x108ddc9
lea rdx, [0x01082050]
jmp 0x108ddc9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x108dfa9
lea rdx, [0x010821a0]
xor ecx, ecx
call fcn.01091f4c
jmp 0x108ddda
xor eax, eax
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x108fbf0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub rsp, 0x198
mov rax, qword [0x010d71a0]
xor rax, rsp
mov qword [rsp + 0x180], rax
cmp dword [0x010e5330], 0
jne 0x108fd8d
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x114
mov dword [0x010e5330], 1
call fcn.010a84b0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x108fc5c
lea rdx, [0x01082a70]
xor ecx, ecx
call fcn.01091f4c
jmp 0x108fd8d
cmp dword [rsp + 0x44], 5
jne 0x108fc95
cmp dword [rsp + 0x48], 0
mov ecx, 0xe
jne 0x108fc82
mov dword [0x010e5330], 2
lea rdx, [0x01082aa0]
jmp 0x108fcb2
mov dword [0x010e5330], 3
lea rdx, [0x01082ae8]
jmp 0x108fcb2
cmp dword [rsp + 0x44], 6
jb 0x108fcb7
mov dword [0x010e5330], 4
lea rdx, [0x01082b30]
mov ecx, 0xe
call fcn.01091f4c
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
lea rdx, [0x01082b90]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x108fd8d
xor eax, eax
lea r9, [rsp + 0x3c]
lea rdx, [0x01082bf0]
mov qword [rsp + 0x161], rax
mov qword [rsp + 0x169], rax
mov qword [rsp + 0x171], rax
mov dword [rsp + 0x179], eax
mov word [rsp + 0x17d], ax
mov byte [rsp + 0x17f], al
lea rax, [rsp + 0x38]
xor r8d, r8d
mov byte [rsp + 0x160], 0
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x160]
mov dword [rsp + 0x38], 0x20
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x3c], 1
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x108fd82
lea rcx, [rsp + 0x160]
call fcn.010a7878
lea rcx, [rsp + 0x164]
mov dword [0x010e5334], eax
call fcn.010a7878
mov dword [0x010e5338], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x010e5330]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.010a6e90
add rsp, 0x198
ret
Function at 0x10909d4
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
xor ebx, ebx
bt ecx, 0x1d
mov r12d, edx
mov esi, ecx
mov edi, edx
lea r13d, [rbx + 1]
lea r14d, [rbx + 0x1d]
jae 0x1090a2a
cmp edx, ebx
mov edi, r13d
mov ecx, r14d
je 0x1090a1e
lea rdx, [0x01083d40]
jmp 0x1090af0
lea rdx, [0x01083d68]
jmp 0x1090af0
bt ecx, 0x1c
jae 0x1090af5
cmp edx, ebx
mov edi, r13d
je 0x1090ae6
lea rdx, [0x010e4d80]
lea rcx, [0x010e4cb0]
call qword [sym.imp.USER32.dll_FindWindowW]
mov ecx, r14d
cmp rax, rbx
mov rbp, rax
je 0x1090add
lea rdx, [0x01082200]
call fcn.01091f4c
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebp, ebx
lea rdx, [0x010e4d80]
lea rcx, [0x010e4cb0]
call qword [sym.imp.USER32.dll_FindWindowW]
mov ecx, r14d
cmp rax, rbx
je 0x1090abc
lea rdx, [0x01083d94]
call fcn.01091f4c
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebp, r13d
cmp ebp, 0x64
jl 0x1090a7f
jmp 0x1090ac8
lea rdx, [0x01083d98]
call fcn.01091f4c
cmp ebp, 0x64
jne 0x1090af5
lea rdx, [0x01083dc0]
xor ecx, ecx
call fcn.01091f4c
jmp 0x1090af5
lea rdx, [0x01083e28]
jmp 0x1090af0
lea rdx, [0x01083e58]
mov ecx, r14d
call fcn.01091f4c
test sil, 2
je 0x1090b40
lea rdx, [0x0108b6c0]
mov rcx, 0xffffffff80000001
mov edi, r13d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, ebx
jne 0x1090b29
lea rdx, [0x0108b860]
mov ecx, 0x1c
call fcn.01091f4c
jmp 0x1090b40
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x0108b8b0]
xor ecx, ecx
mov r8d, eax
call fcn.01091f4c
test sil, 0x10
je 0x1090b53
mov ecx, pe_nt_image_headers64
mov edi, r13d
call fcn.010a1ce8
test sil, 0x20
je 0x1090b66
mov ecx, 0x30
mov edi, r13d
call fcn.010a1ce8
test sil, 0x40
je 0x1090b79
mov ecx, 0xc0
mov edi, r13d
call fcn.010a1ce8
mov eax, dword [0x010e52f4]
mov edx, dword [0x010e52fc]
test sil, 0x80
cmovne edi, r13d
bt esi, 8
cmovb edi, r13d
bt esi, 0xb
cmovb eax, r13d
bt esi, 0xc
mov dword [0x010e52f4], eax
mov eax, dword [0x010e52f8]
cmovb eax, r13d
bt esi, 0xd
cmovb edx, r13d
cmp r12d, ebx
mov dword [0x010e52f8], eax
mov dword [0x010e52fc], edx
je 0x1090bd9
lea rdx, [0x01083e80]
mov ecx, r14d
call fcn.01091f4c
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
cmp edi, ebx
mov rdi, qword [rsp + 0x58]
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x1090fdc
Capabilities:
Create service
Persist via windows service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x4e0
mov rax, qword [0x010d71a0]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
lea rcx, [rsp + 0x70]
lea rdx, [0x01084210]
mov r8d, 0x58
call fcn.010ac860
lea rdx, [rsp + 0xd0]
mov r8d, 0x200
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ecx, ecx
test eax, eax
jne 0x1091046
lea r8, [0x01084268]
lea rdx, [0x01084298]
call fcn.01091f4c
jmp 0x1091113
xor edx, edx
lea r8d, [rdx + 3]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rbx, rax
je 0x1091105
and qword [rsp + 0x60], 0
and qword [rsp + 0x58], 0
lea rax, [0x01084608]
mov qword [rsp + 0x50], rax
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x70]
lea r8, [0x01084268]
lea rdx, [0x010809d8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov r9d, 4
mov rcx, rbx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
mov rdi, rax
je 0x10910ec
lea r8, [0x01084268]
lea rdx, [0x010842c8]
mov ecx, 0x1d
call fcn.01091f4c
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10910fa
lea rdx, [0x010842e8]
xor ecx, ecx
call fcn.01091f4c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1091113
lea rdx, [0x01084318]
xor ecx, ecx
call fcn.01091f4c
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.010a6e90
mov rbx, qword [rsp + 0x4f0]
add rsp, 0x4e0
pop rdi
ret

Function at 0x109113c
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rdi, rax
je 0x1091263
lea rdx, [0x010809d8]
mov r8d, 0x10024
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rbx, rax
je 0x109124a
lea r8, [0x010e4c88]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
lea rsi, [0x01084268]
test eax, eax
je 0x109120e
lea rdx, [0x01084348]
mov r8, rsi
mov ecx, 0x1d
call fcn.01091f4c
jmp 0x10911c2
cmp eax, 3
jne 0x10911e7
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x010e4c88]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
mov eax, dword [0x010e4c8c]
jne 0x10911bd
cmp eax, 1
mov r8, rsi
jne 0x1091200
lea rdx, [0x01084368]
lea ecx, [rax + 0x1c]
call fcn.01091f4c
jmp 0x109120e
lea rdx, [0x01084388]
xor ecx, ecx
call fcn.01091f4c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov r8, rsi
test eax, eax
je 0x1091231
lea rdx, [0x010843b0]
mov ecx, 0x1d
call fcn.01091f4c
jmp 0x109123f
lea rdx, [0x010843d0]
xor ecx, ecx
call fcn.01091f4c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1091258
lea rdx, [0x01084408]
xor ecx, ecx
call fcn.01091f4c
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1091271
lea rdx, [0x01084318]
xor ecx, ecx
call fcn.01091f4c
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1091288
Capabilities:
Get session user name
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x70
mov rax, qword [0x010d71a0]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor edi, edi
lea rcx, [rsp + 0x48]
lea rdx, [0x01084440]
lea r8d, [rdi + 0x20]
call fcn.010ac860
mov ecx, 0xfffe
mov dword [rsp + 0x40], 0x7fff
call fcn.010a691c
test rax, rax
mov rbx, rax
je 0x109142b
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea ebp, [rdi + 1]
test eax, eax
je 0x1091306
lea r8d, [rdi + 0xf]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.010a79a4
test eax, eax
cmove edi, ebp
mov rcx, rbx
call fcn.010a67f8
test edi, edi
je 0x109142b
cmp dword [0x010e53a0], 0
je 0x109142b
lea rcx, [0x01081e50]
mov r9d, 0x12
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
cmp rax, 0xffffffffffffffff
jne 0x109135a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x010895e0]
xor ecx, ecx
mov r8d, eax
call fcn.01091f4c
jmp 0x10913a0
lea rcx, [0x01081e50]
mov r8, rax
mov edx, ebp
call fcn.0109dafc
test rax, rax
mov rbx, rax
je 0x10913a0
lea rdx, [0x01084548]
mov ecx, 0x1d
call fcn.01091f4c
mov edx, 0x171f00
mov rcx, rbx
call fcn.0109dd10
cmp rbx, 0xffffffffffffffff
je 0x10913a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
lea rdx, [0x010823e8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x10913fd
lea rax, [rsp + 0x30]
mov r9d, 4
lea rdx, [0x01084460]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [0x010e5318]
call fcn.0109bec8
cmp dword [0x010e53bc], 0
je 0x1091419
mov ecx, ebp
call fcn.0109c0c4
mov edx, 0xac44
mov r8d, 0x18
mov ecx, ebp
call fcn.0109cc20
mov eax, edi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.010a6e90
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret