joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140071100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x1401729a0]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0x18]
mov r9d, 0xd3e
mov dword [rsp + 0x20], 0xd510d6d
mov dword [rsp + 0x24], 0xd4a0d58
mov dword [rsp + 0x28], 0xd5f0d49
mov dword [rsp + 0x2c], 0xd5b0d4c
mov dword [rsp + 0x30], 0xd6e0d62
mov dword [rsp + 0x34], 0xd500d5f
mov dword [rsp + 0x38], 0xd5f0d5a
mov dword [rsp + 0x3c], 0xd6d0d1e
mov dword [rsp + 0x40], 0xd5d0d5b
mov dword [rsp + 0x44], 0xd4c0d4b
mov dword [rsp + 0x48], 0xd4a0d57
mov qword [rsp + 0x4c], 0xd3e0d47
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.140016520
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400efba0
add rsp, 0x130
pop rbp
ret

Function at 0x140071720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x140172a68]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0x10]
mov r9d, 0x2820
mov dword [rsp + 0x20], 0x284f2873
mov dword [rsp + 0x24], 0x28542846
mov dword [rsp + 0x28], 0x28412857
mov dword [rsp + 0x2c], 0x28452852
mov dword [rsp + 0x30], 0x2861287c
mov dword [rsp + 0x34], 0x284e2848
mov dword [rsp + 0x38], 0x2841286c
mov qword [rsp + 0x3c], 0x28202842
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.140016520
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400efba0
add rsp, 0x130
pop rbp
ret
Function at 0x140071d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x140172b20]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0x12]
mov r9d, 0x4302
mov dword [rsp + 0x20], 0x436d4351
mov dword [rsp + 0x24], 0x43764364
mov dword [rsp + 0x28], 0x43634375
mov dword [rsp + 0x2c], 0x43674370
mov dword [rsp + 0x30], 0x4357435e
mov dword [rsp + 0x34], 0x4356436c
mov dword [rsp + 0x38], 0x4370436a
mov dword [rsp + 0x3c], 0x43634367
mov qword [rsp + 0x40], 0x43024376
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.140016520
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400efba0
add rsp, 0x130
pop rbp
ret

Function at 0x140073990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x792e
lea r8, [0x140172ca0]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xd]
mov dword [rsp + 0x20], 0x796a796f
mov dword [rsp + 0x24], 0x796f7978
mov dword [rsp + 0x28], 0x7967797e
mov dword [rsp + 0x2c], 0x791c791d
mov dword [rsp + 0x30], 0x794a7900
mov dword [rsp + 0x34], 0x79427942
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.140016520
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400efba0
add rsp, 0x130
pop rbp
ret
Function at 0x140075f10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x355d
lea r8, [0x140173010]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0x39]
mov dword [rsp + 0x20], 0x352d351c
mov dword [rsp + 0x24], 0x3519352d
mov dword [rsp + 0x28], 0x3529353c
mov dword [rsp + 0x2c], 0x3501353c
mov dword [rsp + 0x30], 0x3532350f
mov dword [rsp + 0x34], 0x3530353c
mov dword [rsp + 0x38], 0x35333534
mov dword [rsp + 0x3c], 0x3501353a
mov dword [rsp + 0x40], 0x35343510
mov dword [rsp + 0x44], 0x352f353e
mov dword [rsp + 0x48], 0x352e3532
mov dword [rsp + 0x4c], 0x353b3532
mov dword [rsp + 0x50], 0x35013529
mov dword [rsp + 0x54], 0x35333514
mov dword [rsp + 0x58], 0x35383529
mov dword [rsp + 0x5c], 0x3533352f
mov dword [rsp + 0x60], 0x35293538
mov dword [rsp + 0x64], 0x3518357d
mov dword [rsp + 0x68], 0x352d3525
mov dword [rsp + 0x6c], 0x35323531
mov dword [rsp + 0x70], 0x3538352f
mov dword [rsp + 0x74], 0x3501352f
mov dword [rsp + 0x78], 0x3528350c
mov dword [rsp + 0x7c], 0x353e3534
mov dword [rbp - 0x80], 0x357d3536
mov dword [rbp - 0x7c], 0x353c3511
mov dword [rbp - 0x78], 0x35333528
mov dword [rbp - 0x74], 0x3535353e
mov qword [rbp - 0x70], r9
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.140016520
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400efba0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140083640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x5e4c
lea r8, [0x140173188]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xd]
mov dword [rsp + 0x20], 0x5e295e27
mov dword [rsp + 0x24], 0x5e225e3e
mov dword [rsp + 0x28], 0x5e205e29
mov dword [rsp + 0x2c], 0x5e7e5e7f
mov dword [rsp + 0x30], 0x5e285e62
mov dword [rsp + 0x34], 0x5e205e20
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.140016520
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400efba0
add rsp, 0x130
pop rbp
ret

Function at 0x140083740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x792e
lea r8, [0x140173200]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xd]
mov dword [rsp + 0x20], 0x794b7945
mov dword [rsp + 0x24], 0x7940795c
mov dword [rsp + 0x28], 0x7942794b
mov dword [rsp + 0x2c], 0x791c791d
mov dword [rsp + 0x30], 0x794a7900
mov dword [rsp + 0x34], 0x79427942
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.140016520
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400efba0
add rsp, 0x130
pop rbp
ret
Function at 0x140085030
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rdi, rcx
lea rbx, [rcx - 0xc8]
mov rax, qword [rbx]
movsxd rdx, dword [rax + 4]
lea rax, vtable.utils::temp_file_class_std::basic_ofstream_char__struct_std::char_traits_char___.0
mov qword [rdx + rcx - 0xc8], rax
mov rax, qword [rbx]
movsxd rdx, dword [rax + 4]
lea r8d, [rdx - 0xc8]
mov dword [rdx + rcx - 0xcc], r8d
lea rcx, [rbx + 8]
call fcn.140044090
test rax, rax
jne 0x1400850ae
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov edx, dword [rcx + 0x10]
or edx, 2
cmp qword [rcx + 0x48], 0
jne 0x1400850a6
or edx, 4
xor r8d, r8d
call fcn.14002abc0
cmp qword [rdi - 0x10], 8
jb 0x1400850bb
mov rcx, qword [rdi - 0x28]
jmp 0x1400850bf
lea rcx, [rdi - 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
cmp qword [rdi - 0x10], 8
jb 0x1400850d6
mov rcx, qword [rdi - 0x28]
call fcn.1400ed78c
mov qword [rdi - 0x10], 7
xor eax, eax
mov qword [rdi - 0x18], rax
mov word [rdi - 0x28], ax
lea rcx, [rdi - 0x20]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.140084eb0

Function at 0x14008df10
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rdi, rcx
lea rbx, [rcx - 0xd0]
mov rax, qword [rbx]
movsxd rdx, dword [rax + 4]
lea rax, vtable.utils::temp_file_class_std::basic_ifstream_char__struct_std::char_traits_char___.0
mov qword [rdx + rcx - 0xd0], rax
mov rax, qword [rbx]
movsxd rdx, dword [rax + 4]
lea r8d, [rdx - 0xd0]
mov dword [rdx + rcx - 0xd4], r8d
lea rcx, [rbx + 0x10]
call fcn.140044090
test rax, rax
jne 0x14008df8e
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov edx, dword [rcx + 0x10]
or edx, 2
cmp qword [rcx + 0x48], 0
jne 0x14008df86
or edx, 4
xor r8d, r8d
call fcn.14002abc0
cmp qword [rdi - 0x10], 8
jb 0x14008df9b
mov rcx, qword [rdi - 0x28]
jmp 0x14008df9f
lea rcx, [rdi - 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
cmp qword [rdi - 0x10], 8
jb 0x14008dfb6
mov rcx, qword [rdi - 0x28]
call fcn.1400ed78c
mov qword [rdi - 0x10], 7
xor eax, eax
mov qword [rdi - 0x18], rax
mov word [rdi - 0x28], ax
lea rcx, [rdi - 0x20]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.140042fe0
Function at 0x14008ebe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0xc6e
lea r8, [0x1401688b0]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0x2b]
mov dword [rsp + 0x20], 0xc000c2b
mov dword [rsp + 0x24], 0xc0f0c06
mov dword [rsp + 0x28], 0xc0d0c00
mov dword [rsp + 0x2c], 0xc1d0c0b
mov dword [rsp + 0x30], 0xc0b0c4e
mov dword [rsp + 0x34], 0xc1e0c16
mov dword [rsp + 0x38], 0xc1c0c0b
mov dword [rsp + 0x3c], 0xc0b0c07
mov dword [rsp + 0x40], 0xc0d0c00
mov dword [rsp + 0x44], 0xc4e0c0b
mov dword [rsp + 0x48], 0xc060c19
mov dword [rsp + 0x4c], 0xc000c0b
mov dword [rsp + 0x50], 0xc0c0c4e
mov dword [rsp + 0x54], 0xc010c1c
mov dword [rsp + 0x58], 0xc1d0c19
mov dword [rsp + 0x5c], 0xc000c07
mov dword [rsp + 0x60], 0xc4e0c09
mov dword [rsp + 0x64], 0xc060c1a
mov dword [rsp + 0x68], 0xc4e0c0b
mov dword [rsp + 0x6c], 0xc0b0c19
mov dword [rsp + 0x70], 0xc400c0c
mov qword [rsp + 0x74], r9
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.140016520
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400efba0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14008fc70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x140168b10]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0x10]
mov r9d, 0x6a51
mov dword [rsp + 0x20], 0x6a386a3c
mov dword [rsp + 0x24], 0x6a236a32
mov dword [rsp + 0x28], 0x6a226a3e
mov dword [rsp + 0x2c], 0x6a376a3e
mov dword [rsp + 0x30], 0x6a346a25
mov dword [rsp + 0x34], 0x6a366a35
mov dword [rsp + 0x38], 0x6a326a34
mov qword [rsp + 0x3c], 0x6a516a21
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.140016520
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400efba0
add rsp, 0x130
pop rbp
ret

Function at 0x140090d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0xc06
lea r8, [0x140168af8]
lea rcx, [rsp + 0x20]
lea edx, [rax + 9]
mov dword [rsp + 0x20], 0xc7e0c63
mov dword [rsp + 0x24], 0xc6a0c76
mov dword [rsp + 0x28], 0xc740c69
mov dword [rsp + 0x2c], 0xc740c63
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.140016520
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400efba0
add rsp, 0x130
pop rbp
ret
Function at 0x140091c50
Capabilities:
Create service

Disassembly:
push rdi
sub rsp, 0xa90
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rsp + 0xa80], rax
mov rdi, rcx
call fcn.140091ed0
test eax, eax
je 0x140091c81
mov eax, 1
jmp 0x140091d88
lea rdx, [rsp + 0x72]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140091e7e
cmp eax, 0x104
je 0x140091e7e
lea ecx, [rax + 1]
mov r8d, 0x22
mov word [rsp + 0x70], r8w
mov word [rsp + rcx*2 + 0x70], r8w
lea ecx, [rax + 2]
add rcx, rcx
cmp rcx, 0x20c
jae 0x140091ec7
mov qword [rsp + 0xaa8], rbx
mov qword [rsp + 0xab0], rsi
xor esi, esi
mov word [rsp + rcx + 0x70], si
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140091da1
lea rdx, [rsp + 0x280]
mov r8d, 0x400
mov ecx, 0xd80a
call fcn.140091a00
test eax, eax
jne 0x140091d5f
lea r8, str.Could_not_open_Service_Manager
lea rcx, [rsp + 0x280]
mov edx, 0x400
call fcn.1400f05a8
test eax, eax
je 0x140091d5f
cmp eax, 0xc
je 0x140091e9b
cmp eax, 0x16
je 0x140091e90
cmp eax, 0x22
je 0x140091e90
cmp eax, 0x50
jne 0x140091e85
lea r8, [rdi + 0x48]
xor r9d, r9d
lea rdx, [rsp + 0x280]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rbx, qword [rsp + 0xaa8]
mov rsi, qword [rsp + 0xab0]
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.1400efba0
add rsp, 0xa90
pop rdi
ret
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
lea rax, str.RPCSS
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x70]
add rdi, 0x48
mov r9d, 0xf01ff
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov r8, rdi
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], select
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x140091e62
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, [rsp + 0x280]
mov r8d, 0x400
mov ecx, 0xd80b
call fcn.140091a00
test eax, eax
jne 0x140091e57
lea r8, str.Could_not_start_service
lea rcx, [rsp + 0x280]
mov edx, 0x400
call fcn.1400f05a8
test eax, eax
je 0x140091e57
cmp eax, 0xc
je 0x140091ebc
cmp eax, 0x16
je 0x140091eb1
cmp eax, 0x22
je 0x140091eb1
cmp eax, 0x50
jne 0x140091ea6
xor r9d, r9d
mov r8, rdi
jmp 0x140091d66
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x140091d78
xor eax, eax
jmp 0x140091d88
mov ecx, 0x80004005
call fcn.140091a90
int3
mov ecx, 0x80070057
call fcn.140091a90
int3
mov ecx, 0x8007000e
call fcn.140091a90
int3
mov ecx, 0x80004005
call fcn.140091a90
int3
mov ecx, 0x80070057
call fcn.140091a90
int3
mov ecx, 0x8007000e
call fcn.140091a90
int3
call fcn.1400f008c
int3
Function at 0x140091f50
Capabilities:
Access the windows event log

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rdi
sub rsp, 0x278
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r9, rdx
mov edx, 0x100
mov rbx, rcx
lea rax, [r11 + 0x18]
lea rcx, [rsp + 0x60]
lea r8d, [rdx - 1]
mov qword [rsp + 0x20], rax
call fcn.1400f06fc
xor edi, edi
lea rax, [rsp + 0x60]
mov word [rsp + 0x25e], di
mov qword [rsp + 0x50], rax
cmp dword [rbx + 0x26c], edi
jne 0x140091fc2
lea rcx, [rsp + 0x60]
call fcn.1400f0614
lea rdx, [rbx + 0x48]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x140092013
mov qword [rsp + 0x40], rdi
mov ecx, 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov word [rsp + 0x28], cx
lea edx, [rcx + 3]
xor r8d, r8d
xor r9d, r9d
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400efba0
add rsp, 0x278
pop rdi
pop rbx
ret
Function at 0x140092530
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x80
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rdi
movzx ebp, dl
mov rbx, rcx
call fcn.140093b50
test eax, eax
jne 0x140092569
mov eax, 0x80004005
jmp 0x1400926d2
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x58], r14
mov r9d, 0x20006
lea r8, str.AppID
mov rdx, 0xffffffff80000000
lea rcx, [rsp + 0x48]
call fcn.140069950
test eax, eax
je 0x1400925bc
mov ecx, eax
call fcn.1400919f0
mov ebx, eax
jmp 0x1400926b3
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x68], r14d
mov qword [rsp + 0x70], r14
lea rcx, [rsp + 0xa0]
call fcn.14008fa30
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8, rax
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.140091ab0
mov rdi, qword [rsp + 0x60]
test eax, eax
je 0x140092629
mov ecx, eax
call fcn.1400919f0
mov ebx, eax
jmp 0x14009269b
lea rdx, str.LocalService
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test bpl, bpl
je 0x140092698
lea rcx, [rbx + 0x48]
mov eax, r14d
test rcx, rcx
setne al
test eax, eax
je 0x140092687
or rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140092653
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.LocalService
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call fcn.140091c50
test eax, eax
mov ebx, 0x80004005
je 0x14009269b
mov ebx, r14d
test rdi, rdi
je 0x1400926ae
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x68], r14d
cmp qword [rsp + 0x48], 0
je 0x1400926cb
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x50], r14d
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret