joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400fe6b4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400fe6e4
xor eax, eax
jmp 0x1400fe7a7
mov rbp, rbx
cmp word [rax], si
je 0x1400fe709
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400fe6f0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400fe6ec
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400fb3e8
movsxd r14, eax
test eax, eax
jne 0x1400fe747
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400fe6dd
mov rcx, r14
call fcn.1400f74b4
mov rdi, rax
test rax, rax
jne 0x1400fe760
xor ecx, ecx
call fcn.1400f6158
jmp 0x1400fe73c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400fb3e8
test eax, eax
jne 0x1400fe791
mov rcx, rdi
call fcn.1400f6158
jmp 0x1400fe79b
xor ecx, ecx
call fcn.1400f6158
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400fe7c4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400fe84b
mov rsi, rbx
cmp word [rax], bp
je 0x1400fe80a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400fe7f4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400fe7f0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400f74b4
mov rdi, rax
test rax, rax
je 0x1400fe838
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400ca480
mov rbp, rdi
xor ecx, ecx
call fcn.1400f6158
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140101b14
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140101b34
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400e5748
or eax, 0xffffffff
jmp 0x140101b36
xor eax, eax
add rsp, 0x28
ret

Function at 0x140104820
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400e09e8
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1401048aa
cmp byte [rbp - 0x21], r15b
je 0x1401048a5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1401048e0
call fcn.1400f6564
test eax, eax
jne 0x1401048cc
cmp byte [rbp - 0x21], r15b
je 0x1401048c4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1401048e0
cmp byte [rbp - 0x21], r15b
je 0x1401048dd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400e8208
test eax, eax
jne 0x140104980
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400e09e8
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14010491f
cmp byte [rbp - 0x21], r15b
je 0x140104954
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140104954
call fcn.1400f6564
test eax, eax
jne 0x140104940
cmp byte [rbp - 0x21], r15b
je 0x140104939
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140104954
cmp byte [rbp - 0x21], r15b
je 0x140104951
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400e8208
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140104980
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140104983
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140104991
mov rcx, rdi
call fcn.1400f6158
cmp byte [rbp + 0x3f], r15b
je 0x1401049a0
mov rcx, qword [rbp + 0x27]
call fcn.1400f6158
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000d4f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xe0], rbx
mov rax, qword [0x14016b140]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rdx
mov rbx, rcx
mov rdx, rcx
lea rcx, str.IsKyoceraSFX___s__n
call fcn.1400213c0
xor r12d, r12d
mov r14d, r12d
mov dword [rsp + 0x70], 0x69666a61
mov dword [rsp + 0x74], 0x76627265
mov word [rsp + 0x78], 0x6468
mov byte [rsp + 0x7a], r12b
mov ecx, r12d
movzx eax, byte [rsp + rcx + 0x70]
lea rcx, [rcx + 1]
test al, al
jne 0x14000d560
mov ecx, 8
call fcn.140027a60
mov qword [rsp + 0x70], rax
mov rcx, rax
call fcn.140024fc0
mov rbp, rax
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r15, rax
test rax, rax
je 0x14000d6ef
mov word [rsp + 0x30], r12w
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, 0x1e2
mov r8d, r9d
mov rdx, rax
mov rcx, rbp
call fcn.140024ff0
mov r13d, eax
inc eax
mov ebx, eax
mov ecx, eax
call fcn.140027a58
mov rsi, rax
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.1400c0ac0
test rsi, rsi
je 0x14000d6e6
mov word [rsp + 0x30], r12w
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rsi
mov r9d, 0x1e2
mov r8d, r9d
mov rdx, r15
mov rcx, rbp
call fcn.140024ff0
test eax, eax
je 0x14000d6de
lea rdx, str.24EE7F6D_C648_463f_9E71
mov rcx, rsi
call fcn.1400c0888
mov ebx, 1
test rax, rax
cmovne r14d, ebx
lea rdx, str.24EE7F6E_C648_463f_9E71
mov rcx, rsi
call fcn.1400c0888
test rax, rax
cmovne r14d, ebx
test rdi, rdi
je 0x14000d6de
mov dword [rdi], r12d
lea rdx, str.24EE7F6D_C648_463f_9E71_D
mov rcx, rsi
call fcn.1400c0888
test rax, rax
je 0x14000d66c
or dword [rdi], ebx
lea rdx, str.24EE7F6D_C648_463f_9E71_E
mov rcx, rsi
call fcn.1400c0888
test rax, rax
je 0x14000d683
or dword [rdi], 2
lea rdx, str.24EE7F6D_C648_463f_9E71_F
mov rcx, rsi
call fcn.1400c0888
test rax, rax
je 0x14000d69a
or dword [rdi], 4
lea rdx, str.24EE7F6E_C648_463f_9E71_D
mov rcx, rsi
call fcn.1400c0888
test rax, rax
je 0x14000d6b0
or dword [rdi], ebx
lea rdx, str.24EE7F6E_C648_463f_9E71_E
mov rcx, rsi
call fcn.1400c0888
test rax, rax
je 0x14000d6c7
or dword [rdi], 2
lea rdx, str.24EE7F6E_C648_463f_9E71_F
mov rcx, rsi
call fcn.1400c0888
test rax, rax
je 0x14000d6de
or dword [rdi], 4
mov rcx, rsi
call fcn.1400277b4
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbp, rbp
je 0x14000d709
mov rcx, rbp
call fcn.140024fd0
mov edx, 8
mov rcx, rbp
call fcn.1400277b4
mov eax, r14d
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140027790
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000d740
Capabilities:
Persist via run registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x14016b140]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r14, r8
mov rdi, rdx
mov rbp, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
mov ebx, r9d
xor esi, esi
call fcn.1400c0ac0
lea r9, str.SOFTWAREKyoceraKdsMntSvcHandler
mov qword [rsp + 0x20], rbp
lea r8, str._s_s
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140003710
cmp ebx, 1
je 0x14000d87b
cmp ebx, 4
je 0x14000d7fd
mov dword [rsp + 0x28], 0x20006
lea r9, str.ModuleName
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
mov rdx, 0xffffffff80000002
xor ecx, ecx
call fcn.140023200
lea r9, str.ModuleType
mov dword [rsp + 0x28], 0x20006
lea r8, [rsp + 0x30]
mov dword [rsp + 0x20], ebx
mov rdx, 0xffffffff80000002
xor ecx, ecx
call fcn.1400230d0
cmp ebx, 2
jne 0x14000d829
mov dword [rsp + 0x28], 0x20006
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov r9, rbp
mov qword [rsp + 0x20], rdi
mov rdx, 0xffffffff80000002
xor ecx, ecx
call fcn.140023200
jmp 0x14000d891
cmp ebx, 3
jne 0x14000d855
mov dword [rsp + 0x28], 0x20006
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov r9, rbp
mov qword [rsp + 0x20], rdi
mov rdx, 0xffffffff80000002
xor ecx, ecx
call fcn.140023200
jmp 0x14000d891
cmp ebx, 4
jne 0x14000d877
call fcn.14001f8b0
mov rcx, rax
lea r9d, [rbx - 3]
mov r8, r14
mov rdx, rdi
call fcn.14001fa20
test eax, eax
sete sil
mov eax, esi
jmp 0x14000d891
call fcn.14001f8b0
mov rcx, rax
xor r9d, r9d
mov r8, r14
mov rdx, rdi
call fcn.14001fa20
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140027790
add rsp, 0x250
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000d8b0
Capabilities:
Persist via run registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa80
mov rax, qword [0x14016b140]
xor rax, rsp
mov qword [rsp + 0xa70], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
xor ebx, ebx
call fcn.1400c0ac0
xor edx, edx
lea rcx, [rsp + 0x240]
mov r8d, 0x208
call fcn.1400c0ac0
lea r9, str.SOFTWAREKyoceraKdsMntSvcHandler
mov qword [rsp + 0x20], rdi
lea r8, str._s_s
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140003710
lea rax, [rsp + 0x240]
mov dword [rsp + 0x28], 0x20019
lea r9, str.ModuleName
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
mov rdx, 0xffffffff80000002
xor ecx, ecx
call fcn.140022700
lea r9, str.ModuleType
mov dword [rsp + 0x28], 0x20019
lea r8, [rsp + 0x30]
mov dword [rsp + 0x20], 0xffffffff
mov rdx, 0xffffffff80000002
xor ecx, ecx
call fcn.1400225c0
cmp eax, 2
jne 0x14000d984
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRun
jmp 0x14000d990
cmp eax, 3
jne 0x14000d9ab
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov r9, rdi
mov dword [rsp + 0x20], 0xf003f
mov rdx, 0xffffffff80000002
xor ecx, ecx
call fcn.140022d50
mov ebx, eax
mov r9d, 0xf003f
mov byte [rsp + 0x20], 0
lea r8, [rsp + 0x30]
mov rdx, 0xffffffff80000002
xor ecx, ecx
call fcn.140022aa0
call fcn.14001f8b0
mov rcx, rax
lea rdx, [rsp + 0x240]
call fcn.14001e940
test eax, eax
jne 0x14000d9f7
call fcn.14001f8b0
mov rcx, rax
lea rdx, [rsp + 0x240]
call fcn.14001e8c0
xor edx, edx
lea rcx, [rsp + 0x450]
mov r8d, 0x208
call fcn.1400c0ac0
call fcn.14001f8b0
mov rcx, rax
lea rdx, [rsp + 0x450]
call fcn.14001ea90
xor edx, edx
lea rcx, [rsp + 0x660]
mov r8d, 0x410
call fcn.1400c0ac0
lea r9, [rsp + 0x450]
mov qword [rsp + 0x20], rdi
lea r8, str._sKdsMntSvc_s.log
mov edx, 0x208
lea rcx, [rsp + 0x660]
call fcn.140003710
lea rdx, [rsp + 0x660]
lea rcx, str.wszLogFile_____s__n
call fcn.1400213c0
call fcn.14001f8b0
mov rcx, rax
lea rdx, [rsp + 0x660]
xor r8d, r8d
call fcn.14001f910
test al, al
je 0x14000daa1
call fcn.14001f8b0
mov rcx, rax
lea rdx, [rsp + 0x660]
call fcn.14001e940
mov eax, ebx
mov rcx, qword [rsp + 0xa70]
xor rcx, rsp
call fcn.140027790
mov rbx, qword [rsp + 0xa98]
add rsp, 0xa80
pop rdi
ret
Function at 0x1400124e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov dword [r8], 0
mov rsi, r8
mov r14, rdx
test rdx, rdx
jne 0x140012514
lea rcx, str.ShowBalloonTipRequest::Serialize_lppBuffer__NULL.
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.140021160
mov rdx, qword [rcx + 0x10]
mov qword [rsp + 0x38], rbp
lea rbp, [rcx + 8]
test rdx, rdx
je 0x14001259f
add rcx, 0x18
mov r9d, 1
xor r8d, r8d
call fcn.140014f50
test rax, rax
je 0x14001259f
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rdi
mov rdi, 0xffffffffffffffff
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], 0
jne 0x140012551
mov rcx, rax
inc ebx
call fcn.1400c6ea4
test ebx, ebx
jle 0x140012595
movsxd rdx, ebx
mov eax, 2
mul rdx
cmovo rax, rdi
mov rcx, rax
call fcn.140027a58
mov rdx, rax
mov rcx, rbp
mov rdi, rax
call fcn.140013c60
lea eax, [rbx + rbx]
mov qword [r14], rdi
mov dword [rsi], eax
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140012970
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov r14, r9
mov ebx, r8d
mov r15, rdx
mov rsi, rcx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [rsi + 0x10]
mov rbp, rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rax
cmp rcx, 0xffffffffffffffff
jne 0x1400129cd
lea rcx, str.INVALID_HANDLE_VALUE_n
call fcn.1400213c0
mov rcx, qword [rsi + 0x10]
mov r9, r14
mov qword [rsp + 0x20], rdi
mov r8d, ebx
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400129ec
mov edi, 1
jmp 0x140012a6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.WRITE___GetLastError__d_n
mov ebx, eax
call fcn.140020f50
cmp ebx, 0x26
je 0x1400129e5
cmp ebx, 0x3e5
jne 0x140012a6a
lea rcx, str.WRITE___ERROR_IO_PENDING_n
call fcn.140020f50
mov rcx, qword [rsp + 0x48]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, str.WRITE___COMPLETED_n
mov ebx, eax
call fcn.140020f50
test ebx, ebx
jne 0x140012a6a
mov rcx, qword [rsi + 0x10]
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov r8, r14
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
mov ecx, 1
cmovne edi, ecx
lea rcx, str.WRITE___Get_Result___d__n
mov edx, edi
call fcn.140020f50
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x70]
mov eax, edi
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
Function at 0x140012db0
Capabilities:
Print debug messages

Disassembly:
lea rcx, str.NamedPipeHandler::HandleRequest_HandleRequest_Not_Implemented_.
jmp fcn.1400213c0
Function at 0x140013120
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
xor edx, edx
lea rax, [rsp + 0x48]
movzx edi, r8b
mov qword [rsp + 0x28], rax
mov r8, rcx
mov dword [rsp + 0x20], edx
xor ecx, ecx
mov dword [rsp + 0x48], edx
xor r9d, r9d
call fcn.1400c8058
mov rbx, rax
test rax, rax
je 0x1400131fc
test dil, dil
je 0x1400131d0
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x58], eax
cmp eax, 0xffffffff
jne 0x140013197
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rsp + 0x48]
lea rcx, str._Failed_to_wait_for_threadID_0x_x_error__u_n
mov r8d, eax
call fcn.140021160
jmp 0x1400131d0
test eax, eax
jne 0x1400131d0
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1400131d0
mov r8d, dword [rsp + 0x58]
cmp r8d, 0x103
je 0x1400131d0
test r8d, r8d
je 0x1400131d0
mov edx, dword [rsp + 0x48]
lea rcx, str._ThreadID_0x_x_exit_code__u_n
call fcn.1400213c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140013210
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._Thread_close_error__u_n
call fcn.140021160
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._Thread_start_error__u_n
call fcn.140021160
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140013260
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 0x10], rdx
sub rsp, 0x38
xor eax, eax
lea rdx, str.CryptAPIContainer
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x20], eax
lea r9d, [rax + 1]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400132d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x1400132d9
mov r9d, 1
mov dword [rsp + 0x20], 8
xor r8d, r8d
lea rdx, str.CryptAPIContainer
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400132d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CryptAcquireContext_error___d_n
call fcn.1400213c0
mov rax, qword [rsp + 0x48]
add rsp, 0x38
ret
Function at 0x1400132f0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov rax, rdx
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x40]
mov rbx, r8
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov rcx, rax
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140013378
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x140013332
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x14001338c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CryptHashData_error___d_n
call fcn.140020f50
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor eax, eax
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CryptCreateHash_error___d_n
call fcn.140020f50
mov rax, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret

Function at 0x1400133a0
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, r8
mov r15, rdx
mov rbx, rcx
xor edi, edi
call fcn.140013260
lea r8, [rbx + 0x18]
mov rdx, rax
mov rsi, rax
call fcn.1400132f0
mov rbp, rax
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x50]
mov r8, rbp
mov r9d, 0x800000
mov qword [rsp + 0x20], rax
mov edx, 0x6801
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x140013418
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CryptDeriveKey_error___d_n
call fcn.140020f50
mov rbx, qword [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r15
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140013444
mov edi, 1
jmp 0x140013458
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CryptDecrypt_error___d_n
call fcn.1400213c0
test rbx, rbx
je 0x140013466
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
test rbp, rbp
je 0x140013474
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test rsi, rsi
je 0x140013484
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x58]
mov eax, edi
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140016bf0
Capabilities:
Create service
Persist via windows service

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x6a0
mov rax, qword [0x14016b140]
xor rax, rsp
mov qword [rsp + 0x690], rax
mov rbp, qword [rsp + 0x700]
lea rcx, str.KXSVC::InstallService_n
mov r14, qword [rsp + 0x708]
mov r12, r9
mov r15, r8
mov rbx, rdx
call fcn.1400213c0
xor edx, edx
mov r8d, 0xf003f
mov rcx, rbx
xor sil, sil
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x140016d97
test rbp, rbp
je 0x140016c74
mov r8, rbp
lea rcx, [rsp + 0x70]
mov edx, 0x104
call fcn.1400c3900
jmp 0x140016c90
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, 0x104
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r8, [0x140130540]
mov edx, 0x208
lea rcx, [rsp + 0x280]
call fcn.1400c3900
lea r8, [rsp + 0x70]
mov edx, 0x208
lea rcx, [rsp + 0x280]
call fcn.1400c7e90
lea r8, [0x140130540]
mov edx, 0x208
lea rcx, [rsp + 0x280]
call fcn.1400c7e90
test r14, r14
je 0x140016cf3
mov r8, r14
lea rcx, [rsp + 0x280]
mov edx, 0x208
call fcn.1400c7e90
lea rdx, [rsp + 0x280]
lea rcx, str.___s__n
call fcn.1400213c0
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x280]
mov qword [rsp + 0x58], rdi
mov r9d, 0xf01ff
mov qword [rsp + 0x50], rdi
mov r8, r12
mov qword [rsp + 0x48], rdi
mov rdx, r15
mov qword [rsp + 0x40], rdi
mov rcx, rbx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
je 0x140016d76
mov rcx, rax
mov sil, 1
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140016dad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.KXSVC::InstallService___CreateService_error___d_n
mov edi, eax
call fcn.140021160
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140016dad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.KXSVC::InstallService___OpenSCManager_error___d_n
mov edi, eax
call fcn.140021160
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, sil
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.140027790
add rsp, 0x6a0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret