joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140075954
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov r14, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, edx
call fcn.140075add
mov ebx, eax
mov rcx, qword [0x1401ba658]
test rcx, rcx
je 0x14007599c
mov rax, qword [rcx]
mov rdx, r14
mov r8d, ebx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140075a74
call fcn.140075b44
add ebx, dword [rax + 0x30]
mov r15, qword [0x1401bde28]
mov eax, ebx
shr eax, 4
inc eax
movzx edx, ax
mov r8d, 6
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xorps xmm6, xmm6
test rax, rax
je 0x140075a6a
mov rsi, rax
mov rcx, r15
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140075a6a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x140075a6a
mov rdi, rax
mov rcx, r15
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
setne cl
and ebx, 0xf
je 0x140075a38
test eax, eax
je 0x140075a38
mov ecx, eax
mov rax, rdi
add rax, rcx
dec ebx
movzx ecx, word [rdi]
lea rdi, [rdi + rcx*2]
add rdi, 2
cmp rdi, rax
setb cl
add ebx, 0xffffffff
jae 0x140075a38
cmp rdi, rax
jb 0x140075a1d
test cl, cl
je 0x140075a6a
movzx ebx, word [rdi]
test rbx, rbx
je 0x140075a6a
add rdi, 2
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
cmp bx, 0xb
jae 0x140075a95
lea r15, [rsp + 0x20]
mov byte [r15 + 0x17], bl
jmp 0x140075abb
xor eax, eax
mov qword [r14], rax
movups xmmword [r14 + 8], xmm6
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140147fd0
mov rax, r14
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea esi, [rbx + 8]
and esi, 0xfffffff8
lea rcx, [rsi + rsi]
call fcn.140147c20
mov r15, rax
mov qword [rsp + 0x20], rax
bts rsi, 0x3f
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rbx
lea r8, [rbx + rbx]
mov rcx, r15
mov rdx, rdi
call fcn.14014a9e0
mov word [r15 + rbx*2], 0
mov rax, qword [rsp + 0x20]
movups xmm6, xmmword [rsp + 0x28]
jmp 0x140075a6c
Function at 0x140078130
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x1401ba6f0]
test rax, rax
jne 0x140078174
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x1401ba6f0]
test rax, rax
je 0x140078161
cmp eax, 2
jne 0x1400781c2
mov ecx, 2
call fcn.1400481e0
test al, al
je 0x14007825a
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x83
mov r9d, 2
call fcn.140048290
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
jmp 0x14007824d
mov eax, 1
lock xadd qword [0x1401ba728], rax
test rax, rax
jle 0x1400781e2
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1401ba6a8], eax
mov qword [0x1401ba6a0], rsi
mov rcx, qword [0x1401b6af8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.1400481e0
test al, al
je 0x14007825a
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xaf
mov r9d, 2
call fcn.140048290
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
call fcn.140006489
mov rcx, rsi
call fcn.1400486f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140147fd0
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
Function at 0x1400792c4
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
cmp dword [0x1401bd850], 0
mov r8, qword [rcx]
je 0x1400792f6
mov rcx, qword [rsi + 0x28]
mov rdx, rdi
mov r9d, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14000ca7d
movsxd rax, ebx
mov rcx, rdi
mov rdx, r8
mov r8, rax
call fcn.14014a9e0
mov ecx, dword [rsi + 0x4c]
mov r8d, ebx
mov rdx, rdi
call fcn.140078f24
mov dword [rsi + 0x4c], eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x14007bbfb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
sub rsp, 0x20
xor ecx, ecx
lea r8, [0x1401ba740]
mov edx, 8
mov eax, ecx
mov esi, eax
shr esi, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, esi
dec edx
jne 0x14007bc10
mov dword [r8 + rcx*4], eax
inc rcx
cmp rcx, 0x100
jne 0x14007bc09
mov eax, 0x100
mov ecx, dword [r8 + rax*4 - 0x400]
movzx edx, cl
shr ecx, 8
xor ecx, dword [r8 + rdx*4]
mov dword [r8 + rax*4], ecx
inc rax
cmp rax, 0x800
jne 0x14007bc39
lea rax, [0x1400b8ce0]
mov qword [0x1401bc740], rax
mov qword [0x1401ba730], rax
lea rsi, [0x1400b8db0]
mov qword [0x1401bc748], rsi
call fcn.1400b8ef8
test eax, eax
jne 0x14007bc8d
mov qword [0x1401ba730], rsi
add rsp, 0x20
pop rsi
ret

Function at 0x14007beab
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x260
mov rsi, rdx
mov edx, ecx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x258], rax
lea rbx, [rsp + 0x50]
mov word [rbx], 0
mov qword [rsp + 0x20], rbx
xor edi, edi
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14007bf3a
mov qword [rsp + 0x28], rbx
cmp word [rsp + 0x50], 0
je 0x14007bf0c
xor eax, eax
cmp word [rsp + rax*2 + 0x52], 0
lea rax, [rax + 1]
jne 0x14007befe
jmp 0x14007bf0e
xor eax, eax
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x38]
mov rcx, rdi
call fcn.140043d50
mov rcx, rsi
mov rdx, rdi
call fcn.140043dd0
mov rcx, rdi
call fcn.140043da0
mov dil, 1
mov rcx, qword [rsp + 0x258]
xor rcx, rsp
call fcn.140147fd0
mov eax, edi
add rsp, 0x260
pop rbx
pop rdi
pop rsi
ret
Function at 0x14007c274
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x14007c29b
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x14007c396
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14007c2dc
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140147fd0
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.14007c3b2
mov ecx, 2
call fcn.1400481e0
test al, al
je 0x14007c394
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x244
mov r9d, 2
call fcn.140048f30
lea rcx, [rsp + 0x60]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.140006489
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.140052710
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14007c36d
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.140006489
xor eax, eax
cmp byte [rsp + 0x4f], al
jns 0x14007c38a
mov rcx, qword [rsp + 0x38]
call fcn.140147c5c
lea rcx, [rsp + 0x50]
call fcn.140049000
xor edi, edi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140147fd0
mov eax, edi
add rsp, 0x198
pop rdi
pop rsi
ret
Function at 0x14007c3b2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x14007c3d9
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14007c4bc
mov dil, 1
test al, 0x10
jne 0x14007c576
mov ecx, 2
call fcn.1400481e0
test al, al
je 0x14007c574
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x232
mov r9d, 2
call fcn.140048290
lea rcx, [rsp + 0x68]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140006489
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.140052710
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14007c47b
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call fcn.140006489
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.140006489
xor eax, eax
cmp byte [rsp + 0x5f], al
jns 0x14007c4ad
mov rcx, qword [rsp + 0x48]
call fcn.140147c5c
lea rcx, [rsp + 0x60]
call fcn.1400486f0
jmp 0x14007c574
mov ecx, 2
call fcn.1400481e0
test al, al
je 0x14007c574
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x22e
mov r9d, 2
call fcn.140048f30
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140006489
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x38]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.140052710
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14007c54d
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call fcn.140006489
xor eax, eax
cmp byte [rsp + 0x5f], al
jns 0x14007c56a
mov rcx, qword [rsp + 0x48]
call fcn.140147c5c
lea rcx, [rsp + 0x60]
call fcn.140049000
xor edi, edi
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140147fd0
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
Function at 0x14007e970
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x68]
cmp eax, edx
jne 0x14007e987
cmp byte [rcx + 0x27], 0
jns 0x14007e996
mov rcx, qword [rcx + 0x10]
jmp 0x14007e99a
xor ecx, ecx
cmp eax, 1
sete cl
lea eax, [rcx + rcx*2]
inc eax
jmp 0x14007e9b3
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov eax, 1
cmovne eax, ecx
add rsp, 0x28
ret

Function at 0x14007f7e0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x188
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov eax, dword [0x1401bc7f0]
mov ecx, dword [0x1401bc798]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007f840
lea rsi, [0x1401bc7e8]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140147fd0
mov rax, rsi
add rsp, 0x188
pop rdi
pop rsi
ret
lea rcx, [0x1401bc7f0]
call fcn.140147d80
cmp dword [0x1401bc7f0], 0xffffffff
jne 0x14007f81c
lea rcx, [rsp + 0x64]
mov r8d, 0x118
xor edx, edx
call fcn.14014adf0
mov dword [rsp + 0x60], 0x11c
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x2c], 0
mov ecx, dword [rsp + 0x64]
mov edx, dword [rsp + 0x68]
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.140147c20
mov rsi, rax
mov edi, dword [rsp + 0x2c]
mov eax, dword [0x1401bc828]
mov ecx, dword [0x1401bc798]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007f901
lea r8, [0x1401bc7f8]
lea rdx, [rsp + 0x60]
mov rcx, rsi
mov r9d, edi
call fcn.14007fab0
mov qword [0x1401bc7e8], rsi
lea rcx, [0x1401bc7f0]
call fcn.140147e18
jmp 0x14007f81c
lea rcx, [0x1401bc828]
call fcn.140147d80
cmp dword [0x1401bc828], 0xffffffff
jne 0x14007f8d2
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsp + 0x30]
movaps xmm1, xmmword [rsp + 0x40]
movaps xmm2, xmmword [rsp + 0x50]
movups xmmword [0x1401bc818], xmm2
movups xmmword [0x1401bc808], xmm1
movups xmmword [0x1401bc7f8], xmm0
lea rcx, [0x1401bc828]
call fcn.140147e18
jmp 0x14007f8d2
Function at 0x14007f990
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1401bc828]
mov ecx, dword [0x1401bc798]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007fa13
movzx eax, word [0x1401bc7f8]
cmp rax, 0xc
ja case.0x14007f9e2.1
xor esi, esi
lea rcx, [0x14007fa7c]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov esi, 2
jmp case.0x14007f9e2.0
mov esi, 4
jmp case.0x14007f9e2.0
mov esi, 1
jmp case.0x14007f9e2.0
mov esi, 3
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140147fd0
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x1401bc828]
call fcn.140147d80
cmp dword [0x1401bc828], 0xffffffff
jne 0x14007f9c5
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmm2, xmmword [rsp + 0x40]
movups xmmword [0x1401bc818], xmm2
movups xmmword [0x1401bc808], xmm1
movups xmmword [0x1401bc7f8], xmm0
lea rcx, [0x1401bc828]
call fcn.140147e18
jmp 0x14007f9c5
Function at 0x1400804a0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov r14, rdx
mov ebp, ecx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x98], rax
lea rdx, str.CreateLocalWmiConnection
lea r8, str..._.._base_win_wmi.cc
lea rdi, [rsp + 0x70]
mov rcx, rdi
mov r9d, 0x1d
call fcn.140047ce0
lea rcx, [rsp + 0x90]
mov rdx, rdi
call fcn.14009f670
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x20], rdi
lea rcx, [0x14018b6a8]
lea r9, [0x140183308]
xor edi, edi
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140080627
mov qword [rsp + 0x68], 0
mov rsi, qword [rsp + 0x70]
lea rax, [0x140183318]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xa
lea rbx, [rsp + 0x60]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400ba6e0
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsi]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor edi, edi
mov rcx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [rax + 0x18]
mov esi, eax
mov rcx, rbx
call fcn.1400ba730
test esi, esi
js 0x140080609
test bpl, bpl
je 0x1400805e7
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor edi, edi
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x140080609
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], 0
mov rcx, qword [r14]
mov qword [r14], rax
test rcx, rcx
je 0x140080624
mov rax, qword [rcx]
call qword [rax + 0x10]
mov dil, 1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140080627
mov qword [rsp + 0x68], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x140080627
mov dil, 1
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140080640
mov qword [rsp + 0x70], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rcx, [rsp + 0x90]
call fcn.14009f940
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140147fd0
mov eax, edi
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140084bd0
Capabilities:
Create process on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rdx, [0x140183708]
lea r8, str..._.._base_win_shortcut.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x169
call fcn.140047ce0
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.14008c5b0
cmp byte [rsi + 0x17], 0
jns 0x140084c26
mov rsi, qword [rsi]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, str.taskbarpin
xor ecx, ecx
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
setg bl
mov rcx, rdi
call fcn.14008c6e0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140147fd0
mov eax, ebx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret

Function at 0x140084c80
Capabilities:
Create process on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rdx, str.UnpinShortcutFromTaskbar
lea r8, str..._.._base_win_shortcut.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x172
call fcn.140047ce0
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.14008c5b0
cmp byte [rsi + 0x17], 0
jns 0x140084cd6
mov rsi, qword [rsi]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, str.taskbarunpin
xor ecx, ecx
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
setg bl
mov rcx, rdi
call fcn.14008c6e0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140147fd0
mov eax, ebx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret

Function at 0x140085616
Capabilities:
Delete service

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rcx, qword [rdx]
test rcx, rcx
je 0x140085645
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov dil, 1
test eax, eax
jne 0x140085647
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
sete dil
jmp 0x140085647
xor edi, edi
mov rcx, rsi
call fcn.140086054
mov eax, edi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140085e38
Capabilities:
Create service

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rsi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rcx, qword [rdx + 0x28]
xor eax, eax
cmp rcx, qword [rdx + 0x30]
mov edi, 0
cmovne rdi, rcx
cmp byte [rdx + 0x27], al
jns 0x140085e7e
mov r12, qword [rdx + 0x10]
jmp 0x140085e82
lea r12, [rdx + 0x10]
mov ebp, dword [rdx + 0xc]
mov r13d, dword [rdx + 4]
mov r15d, dword [rdx + 8]
lea r14, [rsi + 0x18]
cmp byte [rsi + 0x2f], al
jns 0x140085e99
mov r14, qword [r14]
lea rbx, [rsp + 0x70]
mov rcx, rsi
mov rdx, rbx
call fcn.14008547e
xor eax, eax
cmp byte [rbx + 0x17], al
jns 0x140085eb5
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsi + 0x48]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x50], rdi
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r13d
mov rdx, rbx
mov r8, r14
mov r9d, 0x10003
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
lea rcx, [rsp + 0x88]
xor edi, edi
mov qword [rcx], rdi
mov rdx, rax
call fcn.140085156
cmp byte [rsp + 0x87], dil
jns 0x140085f19
mov rcx, qword [rsp + 0x70]
call fcn.140147c5c
mov rdi, qword [rsp + 0x88]
test rdi, rdi
je 0x140085f72
add rsi, 0x50
xor ebx, ebx
mov qword [rsp + 0x88], rbx
call fcn.140047d00
mov rcx, rsi
mov rdx, rdi
call fcn.140085156
mov sil, 1
cmp qword [rsp + 0x88], rbx
je 0x140085f74
call fcn.140047d00
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x88], 0
jmp 0x140085f74
xor esi, esi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140147fd0
mov eax, esi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140085f9a
Capabilities:
Modify service

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [rdx + 0x28]
xor r11d, r11d
cmp rax, qword [rdx + 0x30]
cmove rax, r11
cmp byte [rdx + 0x27], 0
jns 0x140085fba
mov rsi, qword [rdx + 0x10]
jmp 0x140085fbe
lea rsi, [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
mov r10d, dword [rdx + 4]
mov r8d, dword [rdx + 8]
mov rcx, qword [rcx + 0x50]
mov qword [rsp + 0x50], r11
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rsi
mov edx, r10d
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
setne al
add rsp, 0x60
pop rsi
ret
Function at 0x140087618
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rdx
mov r14, rcx
mov rbx, qword [rcx + 0x10]
mov rax, qword [rcx + 0x18]
cmp rbx, rax
jne 0x140087750
mov r15, qword [r14]
mov rdi, qword [r14 + 8]
mov rcx, rdi
sub rcx, r15
jbe 0x1400876a9
sar rcx, 3
lea rax, [rcx + 1]
shr rax, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, rdi
sub r15, rax
sub rbx, rdi
mov r13, rbx
sar r13, 3
test rbx, rbx
je 0x140087694
mov rcx, r15
mov rdx, rdi
mov r8, rbx
call fcn.14014a9e0
mov rdi, qword [r14 + 8]
lea rbx, [r15 + r13*8]
mov qword [r14 + 0x10], rbx
lea rax, [rdi + r12*8]
mov qword [r14 + 8], rax
jmp 0x140087750
sub rax, r15
mov rcx, rax
sar rcx, 2
test rax, rax
mov r13d, 1
cmovne r13, rcx
mov rax, r13
shr rax, 0x3d
jne 0x14008776c
mov r12, r13
shr r12, 2
lea rcx, [r13*8]
call fcn.140147c20
lea r9, [rax + r12*8]
lea r8, [rax + r13*8]
sub rbx, rdi
je 0x140087728
mov r11, rsi
mov r10, r9
add r10, rbx
sar rbx, 3
shl rbx, 3
lea rcx, [rax + r12*8]
add rcx, 8
xor edx, edx
mov rsi, r9
mov rbp, qword [rdi + rdx]
mov qword [rsi], rbp
lea rsi, [rcx + rdx]
add rdx, 8
cmp rbx, rdx
jne 0x14008770c
mov r15, qword [r14]
mov rsi, r11
jmp 0x14008772b
mov r10, r9
mov qword [r14], rax
mov qword [r14 + 8], r9
mov qword [r14 + 0x10], r10
mov qword [r14 + 0x18], r8
test r15, r15
je 0x14008774d
mov rcx, r15
call fcn.140147c5c
mov rbx, qword [r14 + 0x10]
jmp 0x140087750
mov rbx, r10
mov rax, qword [rsi]
mov qword [rbx], rax
add qword [r14 + 0x10], 8
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14015acbc
int3
Function at 0x140087772
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rdx
mov r14, rcx
mov rcx, qword [rcx]
mov rbx, qword [r14 + 8]
cmp rbx, rcx
je 0x14008779c
mov r15, rbx
jmp 0x140087894
mov rdi, qword [r14 + 0x10]
mov rax, qword [r14 + 0x18]
cmp rdi, rax
jae 0x1400877f1
sub rax, rdi
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r12, [rax + rcx]
inc r12
sar r12, 1
lea r15, [rdi + r12*8]
mov r8, rdi
sub r8, rbx
je 0x1400877e0
sub r15, r8
mov rcx, r15
mov rdx, rbx
call fcn.14014a9e0
mov rdi, qword [r14 + 0x10]
mov qword [r14 + 8], r15
lea rax, [rdi + r12*8]
mov qword [r14 + 0x10], rax
jmp 0x140087894
sub rax, rcx
mov rcx, rax
sar rcx, 2
test rax, rax
mov r13d, 1
cmovne r13, rcx
mov rax, r13
shr rax, 0x3d
jne 0x1400878b7
lea r12, [r13 + 3]
shr r12, 2
lea rcx, [r13*8]
call fcn.140147c20
lea r15, [rax + r12*8]
lea r8, [rax + r13*8]
sub rdi, rbx
je 0x140087871
mov r10, rsi
mov r9, r15
add r9, rdi
sar rdi, 3
shl rdi, 3
lea rcx, [rax + r12*8]
add rcx, 8
xor edx, edx
mov rsi, r15
mov rbp, qword [rbx + rdx]
mov qword [rsi], rbp
lea rsi, [rcx + rdx]
add rdx, 8
cmp rdi, rdx
jne 0x140087855
mov rbx, qword [r14]
mov rsi, r10
jmp 0x140087874
mov r9, r15
mov qword [r14], rax
mov qword [r14 + 8], r15
mov qword [r14 + 0x10], r9
mov qword [r14 + 0x18], r8
test rbx, rbx
je 0x140087894
mov rcx, rbx
call fcn.140147c5c
mov r15, qword [r14 + 8]
mov rax, qword [rsi]
mov qword [r15 - 8], rax
mov rax, 0xfffffffffffffff8
add qword [r14 + 8], rax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14015acbc
int3