joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400159fc
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
movzx esi, dl
mov rbx, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
mov qword [rbp + 0x30], rax
test rax, rax
je 0x140015b09
mov r8d, 2
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
mov qword [rbp + 0x38], rax
test rax, rax
je 0x140015b3e
xor esi, 1
lea r8d, [rsi*2 + 2]
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
or edx, 0xffffffff
mov r9d, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x140015b73
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x140015ba8
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x140015ad3
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov edx, eax
lea rcx, str.Unable_to_close_service_handle:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_close_service_handle
lea rcx, [rbp - 0x20]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp - 0x20]
call fcn.14006dab0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_open_service_control_manager_with_all_access:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_open_service_control_manager
lea rcx, [rbp - 0x20]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp - 0x20]
call fcn.14006dab0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_open_service_for_config_change:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_open_service_for_config_change
lea rcx, [rbp - 0x20]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp - 0x20]
call fcn.14006dab0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_change_service_start_type:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_change_service_start_type
lea rcx, [rbp - 0x20]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp - 0x20]
call fcn.14006dab0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_close_service_handle:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_close_service_handle
lea rcx, [rbp - 0x20]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp - 0x20]
call fcn.14006dab0
int3
Function at 0x140015cfc
Capabilities:
Create service
Persist via windows service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rsi, r8
mov r14, rdx
mov rdi, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
mov qword [rbp + 0x27], rax
test rax, rax
je 0x140015e2b
mov r8d, 0xf01ff
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbp + 0x7f], rax
test rax, rax
jne 0x140015e60
and qword [rsp + 0x60], rax
and qword [rsp + 0x58], rax
and qword [rsp + 0x50], rax
and qword [rsp + 0x48], rax
and qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x110
mov r9d, 0xf01ff
mov r8, r14
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdx, rax
lea rcx, [rbp + 0x7f]
call fcn.140015990
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x140015e81
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x140015eb6
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x140015df5
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov edx, eax
lea rcx, str.Unable_to_close_service_handle:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_close_service_handle
lea rcx, [rbp + 0x2f]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp + 0x2f]
call fcn.14006dab0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_open_service_control_manager_with_all_access:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_open_service_control_manager
lea rcx, [rbp + 0x2f]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp + 0x2f]
call fcn.14006dab0
nop
lea rdx, str.Service_is_already_installed
lea rcx, [rbp + 0x2f]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp + 0x2f]
call fcn.14006dab0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_install_service:_error__u
call fcn.14000366c
lea rdx, str.Failed_to_install_service
lea rcx, [rbp + 0x2f]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp + 0x2f]
call fcn.14006dab0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_close_service_handle:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_close_service_handle
lea rcx, [rbp + 0x2f]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp + 0x2f]
call fcn.14006dab0
int3
Function at 0x140016134
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14012a418]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
mov qword [rbp - 0x38], rax
test rax, rax
je 0x140016234
mov r8d, 4
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
mov qword [rbp - 0x30], rax
test rax, rax
je 0x140016269
lea rdx, [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14001629e
cmp dword [rbp - 0x24], 4
sete sil
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x1400162d3
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x1400161fe
mov al, sil
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14006b990
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov edx, eax
lea rcx, str.Unable_to_close_service_handle:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_close_service_handle
lea rcx, [rbp - 0x50]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp - 0x50]
call fcn.14006dab0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_open_service_control_manager_with_all_access:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_open_service_control_manager
lea rcx, [rbp - 0x50]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp - 0x50]
call fcn.14006dab0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_open_service_for_status_query:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_open_service_for_status_query
lea rcx, [rbp - 0x50]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp - 0x50]
call fcn.14006dab0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_query_service_status:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_query_service_status
lea rcx, [rbp - 0x50]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp - 0x50]
call fcn.14006dab0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_close_service_handle:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_close_service_handle
lea rcx, [rbp - 0x50]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp - 0x50]
call fcn.14006dab0
int3
Function at 0x140016308
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
mov qword [rbp + 0x20], rax
test rax, rax
je 0x1400163f2
mov r8d, 0x14
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbp + 0x18], rax
test rax, rax
je 0x140016427
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x14001645c
mov edx, 2
lea r8d, [rdx + 2]
lea rcx, [rbp + 0x18]
call fcn.140016904
mov dil, al
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x14001639c
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x140016491
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x1400163bc
mov al, dil
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov edx, eax
lea rcx, str.Unable_to_close_service_handle:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_close_service_handle
lea rcx, [rbp - 0x20]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp - 0x20]
call fcn.14006dab0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_open_service_control_manager:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_open_service_control_manager
lea rcx, [rbp - 0x20]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp - 0x20]
call fcn.14006dab0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_open_service_for_starting:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_open_service_for_starting
lea rcx, [rbp - 0x20]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp - 0x20]
call fcn.14006dab0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_start_service:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_start_service
lea rcx, [rbp - 0x20]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp - 0x20]
call fcn.14006dab0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_close_service_handle:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_close_service_handle
lea rcx, [rbp - 0x20]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp - 0x20]
call fcn.14006dab0
int3
Function at 0x1400164c8
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14012a418]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rcx
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
mov qword [rbp - 0x30], rax
test rax, rax
je 0x1400165d2
mov r8d, 0x24
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbp - 0x38], rax
test rax, rax
je 0x140016607
lea r8, [rbp - 0x28]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x14001663c
mov edx, 3
lea r8d, [rdx - 2]
lea rcx, [rbp - 0x38]
call fcn.140016904
mov dil, al
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14001656e
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x140016671
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x14001659c
mov al, dil
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14006b990
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov edx, eax
lea rcx, str.Unable_to_close_service_handle:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_close_service_handle
lea rcx, [rbp - 0x50]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp - 0x50]
call fcn.14006dab0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_open_service_control_manager:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_open_service_control_manager
lea rcx, [rbp - 0x50]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp - 0x50]
call fcn.14006dab0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_open_service_for_stopping:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_open_service_for_stopping
lea rcx, [rbp - 0x50]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp - 0x50]
call fcn.14006dab0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_stop_service:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_stop_service
lea rcx, [rbp - 0x50]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp - 0x50]
call fcn.14006dab0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_close_service_handle:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_close_service_handle
lea rcx, [rbp - 0x50]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp - 0x50]
call fcn.14006dab0
int3
Function at 0x140016904
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14012a418]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14d, edx
mov r15, rcx
mov rcx, qword [rcx]
lea rdx, [rbp - 0x28]
mov ebx, r8d
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400169fa
cmp dword [rbp - 0x24], ebx
jne 0x140016955
mov al, 1
jmp 0x1400169d5
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, dword [rbp - 0x24]
mov rsi, rax
mov edi, dword [rbp - 0x14]
cmp ecx, r14d
jne 0x1400169d0
mov r13d, 0x7530
mov ecx, dword [rbp - 0x10]
cmp ecx, 0x3e8
jge 0x140016981
mov ecx, 0x3e8
jmp 0x140016988
cmp ecx, r13d
cmovg ecx, r13d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [r15]
lea rdx, [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400169cd
cmp dword [rbp - 0x14], edi
jbe 0x1400169b2
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov edi, dword [rbp - 0x14]
mov rsi, rax
jmp 0x1400169c3
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, dword [rbp - 0x10]
sub rax, rsi
cmp rax, rcx
ja 0x1400169cd
mov ecx, dword [rbp - 0x24]
cmp ecx, r14d
je 0x14001696f
jmp 0x1400169d0
mov ecx, dword [rbp - 0x24]
cmp ecx, ebx
sete al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14006b990
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_query_service_status:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_query_service_status
lea rcx, [rbp - 0x40]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rbp - 0x40]
call fcn.14006dab0
int3
Function at 0x1400180a8
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1180]
mov eax, 0x1280
call fcn.14006be50
sub rsp, rax
mov rax, qword [0x14012a418]
xor rax, rsp
mov qword [rbp + 0x1170], rax
mov r15, rdx
mov rbx, rcx
mov qword [rsp + 0x40], rcx
and dword [rsp + 0x20], 0
and qword [rcx], 0
and qword [rcx + 8], 0
and qword [rcx + 0x10], 0
mov dword [rsp + 0x20], 1
lea r8, [rsp + 0x24]
mov edx, 0x1000
lea rcx, [rsp + 0x60]
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x14001820e
mov eax, dword [rsp + 0x24]
shr eax, 2
test eax, eax
je 0x1400181e5
lea rsi, [rsp + 0x60]
mov r14d, eax
mov r8d, dword [rsi]
xor edx, edx
mov ecx, 0x411
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1400181d7
lea r9, [rsp + 0x28]
mov r8d, 8
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x1400181d7
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xf60]
call fcn.14006ec00
mov r9d, 0x104
lea r8, [rbp + 0xf60]
mov rdx, qword [rsp + 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_K32GetModuleBaseNameW
test eax, eax
je 0x1400181d7
mov rdx, r15
lea rcx, [rbp + 0xf60]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1400181d7
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x1400181ca
mov qword [rdx], rdi
add qword [rbx + 8], 8
jmp 0x1400181d7
lea r8, [rsp + 0x38]
mov rcx, rbx
call fcn.140017f14
add rsi, 4
sub r14, 1
jne 0x140018133
mov rax, rbx
mov rcx, qword [rbp + 0x1170]
xor rcx, rsp
call fcn.14006b990
mov rbx, qword [rsp + 0x12c0]
add rsp, 0x1280
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Unable_to_enumerate_process_list:_error__u
call fcn.14000366c
lea rdx, str.Unable_to_enumerate_process_list
lea rcx, [rsp + 0x48]
call fcn.14000552c
lea rdx, [0x140127a68]
lea rcx, [rsp + 0x48]
call fcn.14006dab0
int3
Function at 0x140022038
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
xor esi, esi
mov rcx, qword [rcx]
call fcn.14007e128
lea rbx, [rax*2 + 2]
mov rcx, rbx
call fcn.140021858
mov rdx, qword [rdi]
mov r8, rbx
mov rcx, rax
mov r14, rax
call fcn.14006d270
movzx eax, word [r14]
mov rbx, r14
test ax, ax
je 0x1400220cf
lea edi, [rsi + 0x5c]
cmp ax, di
je 0x140022095
cmp ax, 0x2f
jne 0x1400220c3
cmp rbx, r14
je 0x1400220c3
cmp word [rbx - 2], 0x3a
je 0x1400220c3
xor edx, edx
mov word [rbx], si
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400220c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140022115
mov word [rbx], di
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x14002208a
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400220f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov esi, 1
cmp eax, 0xb7
cmovne ecx, esi
mov esi, ecx
mov rcx, r14
call fcn.140021850
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov esi, 1
jmp 0x1400220f5

Function at 0x1400226f8
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov rbx, rcx
mov rcx, qword [rcx]
lea rdx, [0x1400fbc60]
call fcn.14007e75c
mov rsi, rax
test rax, rax
je 0x1400227bb
mov rcx, rbx
call fcn.140022418
mov rbx, rax
test rax, rax
jne 0x14002275e
mov rcx, rsi
call fcn.14007ea38
lea ecx, [rbx + 1]
call fcn.140021858
mov byte [rax], bl
test r14, r14
je 0x1400227bd
and qword [r14], rbx
jmp 0x1400227bd
cmp rax, 0x8000000
ja 0x1400227b3
lea rcx, [rax + 1]
call fcn.140021858
mov rbp, rax
test rax, rax
je 0x1400227b3
xor edi, edi
lea rcx, [rdi + rbp]
mov r9, rsi
mov r8, rbx
mov edx, 1
call fcn.1400a8ac4
test rax, rax
je 0x14002279a
add rdi, rax
sub rbx, rax
jne 0x140022779
mov rcx, rsi
mov byte [rdi + rbp], 0
call fcn.14007ea38
test r14, r14
je 0x1400227ae
mov qword [r14], rdi
mov rax, rbp
jmp 0x1400227bd
mov rcx, rsi
call fcn.14007ea38
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400227d8
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140022470
mov rcx, qword [rbx]
xor ebx, ebx
test al, al
jne 0x14002280b
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140022807
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
setne bl
jmp 0x140022816
xor eax, eax
jmp 0x140022818
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x140022890
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x280
mov rax, qword [0x14012a418]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
xor ebp, ebp
cmp qword [rdi], 0xffffffffffffffff
jne 0x14002292c
mov rcx, qword [rdi + 8]
mov rcx, qword [rcx]
call fcn.14007e128
mov r14, rax
lea rcx, [rax*2 + 6]
call fcn.140021858
mov rsi, rax
test rax, rax
je 0x140022992
mov rdx, qword [rdi + 8]
lea rbx, [r14 + r14]
mov r8, rbx
mov rcx, rax
mov rdx, qword [rdx]
call fcn.14006d270
lea rdx, [rsp + 0x20]
mov dword [rbx + rsi], 0x2a005c
mov rcx, rsi
mov word [rsi + r14*2 + 4], bp
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, rsi
mov qword [rdi], rax
call fcn.140021850
cmp qword [rdi], 0xffffffffffffffff
jmp 0x14002293c
mov rcx, qword [rdi]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140022992
lea rdx, [0x1400fbc58]
lea rcx, [rsp + 0x4c]
call fcn.1400b02b0
test eax, eax
je 0x1400228bc
lea rdx, [0x1400f9034]
lea rcx, [rsp + 0x4c]
call fcn.1400b02b0
test eax, eax
je 0x1400228bc
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14002297e
call fcn.140022af8
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x4c]
call fcn.140022588
mov qword [rdi + 0x10], rax
jmp 0x140022994
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14006b990
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140022b1c
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.140022470
test al, al
je 0x140022b5f
mov rcx, rbx
call fcn.140022518
mov rdi, rax
mov rcx, rax
jmp 0x140022b4d
mov rcx, rax
call fcn.140022b1c
mov rcx, rdi
call fcn.140022890
test rax, rax
jne 0x140022b42
mov rcx, rdi
call fcn.14002285c
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400227d8
Function at 0x140026130
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
test rcx, rcx
je 0x1400262e1
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14012a418]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov eax, 0x5a4d
mov rbx, rdx
mov rdi, rcx
cmp word [rcx], ax
jne 0x1400262bd
movsxd rsi, dword [rcx + 0x3c]
add rsi, rcx
cmp dword [rsi], 0x4550
jne 0x1400262bd
mov eax, dword [rsi + 0x50]
lea r8, str._08x_X
mov r9d, dword [rsi + 8]
lea rcx, [rsp + 0x50]
mov edx, 0x32
mov dword [rsp + 0x20], eax
call fcn.14002148c
lea rcx, [rsp + 0x50]
call fcn.140020e34
mov r8, rax
lea rdx, str.code_id
mov rcx, rbx
call fcn.140021230
mov r8, qword [rsi + 0xb8]
mov r9d, r8d
test r8d, r8d
je 0x1400262bd
shr r8, 0x20
movabs rax, 0x2492492492492493
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rcx, rax, 0x1c
cmp r8, rcx
jne 0x1400262bd
test r8, r8
je 0x1400262bd
lea rcx, [rdi + 0x14]
mov rdx, 0xffffffffffffffec
add rcx, r9
sub rdx, rdi
sub rdx, r9
cmp dword [rcx - 8], 2
jne 0x140026232
mov esi, dword [rcx]
add rsi, rdi
cmp dword [rsi], 0x53445352
je 0x140026241
add rcx, 0x1c
lea rax, [rdx + rcx]
cmp rax, r8
jae 0x1400262bd
jmp 0x14002621f
lea rcx, [rsi + 0x18]
call fcn.140020e34
mov r8, rax
lea rdx, str.debug_file
mov rcx, rbx
call fcn.140021230
lea rdx, [rsi + 4]
lea rcx, [rsp + 0x30]
call fcn.140025210
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x40], xmm0
call fcn.140025294
mov byte [rsp + 0x74], 0x2d
lea r8, [0x1400fc27c]
mov r9d, dword [rsi + 0x14]
lea rcx, [rsp + 0x75]
mov edx, 0xa
call fcn.14002148c
lea rcx, [rsp + 0x50]
call fcn.140020e34
mov r8, rax
lea rdx, str.debug_id
mov rcx, rbx
call fcn.140021230
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14006b990
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret