joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180143cf0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, rdx
mov r15, rcx
xor r12d, r12d
mov dword [rbp - 0x50], r12d
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
mov qword [rbp - 0x38], r12
mov dword [rbp - 0x50], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
xor edx, edx
lea ecx, [rdx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180143dd9
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x2c], xmm0
mov qword [rbp - 0x1c], r12
mov dword [rbp - 0x30], 0x1c
lea rdx, [rbp - 0x30]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
mov rbx, qword [rbp - 0x40]
test eax, eax
je 0x180143dce
nop dword [rax]
cmp dword [rbp - 0x30], 0x10
jb 0x180143db7
cmp dword [rbp - 0x24], esi
jne 0x180143db7
cmp rbx, r12
je 0x180143d9f
mov eax, dword [rbp - 0x28]
mov dword [rbx], eax
add rbx, 4
mov qword [rbp - 0x40], rbx
jmp 0x180143db7
lea r8, [rbp - 0x28]
mov rdx, rbx
lea rcx, [rbp - 0x48]
call fcn.18013ede0
mov r12, qword [rbp - 0x38]
mov rbx, qword [rbp - 0x40]
mov dword [rbp - 0x30], 0x1c
lea rdx, [rbp - 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x180143d80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180143ddd
mov rbx, qword [rbp - 0x40]
mov rdi, qword [r14 + 8]
mov r10, qword [r14]
mov r11, qword [rbp - 0x48]
cmp r10, rdi
je 0x180143e8e
mov rax, r11
cmp r11, rbx
je 0x180143e0d
mov ecx, dword [r10]
nop dword [rax]
cmp ecx, dword [rax]
je 0x180143e81
add rax, 4
cmp rax, rbx
jne 0x180143e00
mov r8, qword [r15]
mov rax, qword [r8]
cmp rax, qword [r8 + 8]
je 0x180143e81
nop dword [rax]
lea rdx, [rax + 0x10]
mov ecx, dword [r10]
cmp dword [rax], ecx
jne 0x180143e74
mov r9, qword [r8 + 8]
cmp rdx, r9
je 0x180143e64
lea rax, [rdx - 0xc]
nop dword [rax + rax]
mov rcx, qword [rax + 0x14]
mov qword [rax + 4], rcx
movzx ecx, byte [rax + 0x10]
mov byte [rax], cl
mov ecx, dword [rdx]
mov dword [rax - 4], ecx
add rdx, 0x10
lea rax, [rax + 0x10]
cmp rdx, r9
jne 0x180143e40
mov r9, qword [r8 + 8]
lea rax, [r9 - 0x10]
mov qword [r8 + 8], rax
mov r8, qword [r15]
mov rax, qword [r8]
jmp 0x180143e77
mov rax, rdx
add rax, 0x10
cmp rax, qword [r8 + 8]
jne 0x180143e20
add r10, 4
cmp r10, rdi
jne 0x180143df1
test r11, r11
je 0x180143ecc
sub r12, r11
sar r12, 2
lea rdx, [r12*4]
mov rax, r11
cmp rdx, 0x1000
jb 0x180143ec3
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180143ef1
mov rcx, r11
call fcn.1801e60f0
nop
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1801e67e0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.18010f960
nop
int3
Function at 0x180149230
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov qword [rbp - 0x50], rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x20]
call fcn.1800b0960
nop
movdqa xmm0, xmmword [0x180056d80]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
xor r8d, r8d
mov edx, 0x8000
lea rcx, [rbp - 0x40]
call fcn.1800998d0
lea rdi, [0x1800567d8]
mov qword [rbp - 0x48], rdi
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rdx, qword [rbp - 0x40]
mov r8d, dword [rbp - 0x30]
lea rcx, [0x18006c310]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x180149311
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.1800f8680
nop
mov qword [rbp - 0x48], rdi
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x180149375
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180149309
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801493b6
call fcn.1801e60f0
nop
jmp 0x180149375
mov edx, eax
xor r8d, r8d
lea rcx, [rbp - 0x40]
call fcn.18009b5c0
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x48]
call fcn.1800f2960
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.1800f8680
nop
mov qword [rbp - 0x48], rdi
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x180149375
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18014936f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801493b0
call fcn.1801e60f0
nop
movdqa xmm0, xmmword [0x180056d80]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
lea rcx, [rbp - 0x20]
call fcn.180092860
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1801e67e0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.18010f960
nop
call fcn.18010f960
int3

Function at 0x18014bdd0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp dword [0x18029b2d0], 0xffffffff
jne 0x18014be54
mov qword [rsp + 0x20], 0
call fcn.180150960
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1800fd190
nop
cmp dword [0x18029b2d0], 0xffffffff
je 0x18014be17
mov bl, 1
jmp 0x18014be24
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
jne 0x18014be44
xor bl, bl
lea rcx, [rsp + 0x20]
call fcn.1800fd1e0
movzx eax, bl
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x30
pop rbx
ret
mov dword [0x18029b2d0], eax
lea rcx, [rsp + 0x20]
call fcn.1800fd1e0
mov al, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x30
pop rbx
ret
Function at 0x1801570b0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x50
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x40], rax
imul ecx, edx, 0x3e8
mov eax, 0x51eb851f
movzx esi, r8b
xor bpl, bpl
mov r8d, 0x80000001
mul ecx
xor ecx, ecx
mov ebx, edx
xor edx, edx
shr ebx, 5
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r14, rax
test rax, rax
je 0x180157199
mov r8d, 0x80000000
mov qword [rsp + 0x60], rdi
lea rdx, [0x18006c7d0]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
je 0x18015718b
nop dword [rax]
xor eax, eax
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
mov qword [rsp + 0x30], rax
mov rcx, rdi
mov dword [rsp + 0x38], eax
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x180157182
mov eax, dword [rsp + 0x24]
cmp eax, 2
je 0x18015716e
cmp eax, 4
je 0x18015717f
test sil, sil
jne 0x180157182
test ebx, ebx
je 0x180157182
dec ebx
mov ecx, 0x64
call sub.KERNEL32.dll_Sleep
cmp dword [rsp + 0x24], 4
jne 0x180157130
mov bpl, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x60]
movzx eax, bpl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e67e0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x1801571c0
Capabilities:
Check if process is running under wine
Get file version info

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp byte [rcx + 8], 1
mov rbx, rcx
jne 0x1801571f5
movzx eax, byte [rcx + 9]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x70
pop rbx
ret
mov eax, dword [0x18006c77c]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x48]
movzx eax, word [0x18006c780]
mov word [rsp + 0x4c], ax
xor eax, eax
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rsi
xor sil, sil
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x60], r14
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebp, eax
mov r14d, 1
test eax, eax
je 0x1801572db
mov ecx, eax
mov qword [rsp + 0x68], rdi
add ecx, 0x32
mov rax, 0xffffffffffffffff
cmovb rcx, rax
call fcn.1801139d0
mov rdi, rax
test rax, rax
je 0x1801572d6
mov edx, dword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov r9, rax
mov r8d, ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1801572ce
lea r9, [rsp + 0x44]
mov rcx, rdi
lea r8, [rsp + 0x30]
lea rdx, [0x18006c788]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1801572ce
cmp dword [rsp + 0x44], 0
je 0x1801572ce
mov rcx, qword [rsp + 0x30]
lea r8d, [r14 + 3]
lea rdx, [0x18006c7b0]
call fcn.180113e60
test eax, eax
movzx esi, sil
cmove esi, r14d
mov rcx, rdi
call fcn.18010fae0
mov rdi, qword [rsp + 0x68]
lea rax, [rsp + 0x38]
mov r9d, r14d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x18006c7b8]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r14, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x88]
test eax, eax
jne 0x180157327
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov byte [rbx + 8], 1
mov byte [rbx + 9], 1
jmp 0x18015733f
mov byte [rbx + 8], 1
cmp sil, 1
jne 0x18015733b
mov byte [rbx + 9], sil
movzx eax, sil
jmp 0x18015733f
movzx eax, byte [rbx + 9]
mov rsi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x70
pop rbx
ret
Function at 0x18015bca0
Capabilities:
Encode data using xor

Disassembly:
xor r10b, r10b
xor r9d, r9d
mov r11, rcx
test r8d, r8d
je 0x18015bd74
cmp r8d, 0x20
jb 0x18015bd45
mov r10d, r8d
xorps xmm3, xmm3
and r10d, 0xffffffe0
xorps xmm2, xmm2
nop dword [rax]
movdqu xmm0, xmmword [r9 + rdx]
lea eax, [r9 + 0x10]
movdqu xmm1, xmmword [r9 + rcx]
add r9d, 0x20
pxor xmm1, xmm0
por xmm3, xmm1
movdqu xmm1, xmmword [rax + rcx]
movdqu xmm0, xmmword [rax + rdx]
pxor xmm1, xmm0
por xmm2, xmm1
cmp r9d, r10d
jb 0x18015bcd0
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd r10d, xmm2
cmp r9d, r8d
jae 0x18015bd74
sub r11, rdx
mov eax, r9d
add rax, rdx
sub r8d, r9d
mov edx, r8d
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [r11 + rax]
xor cl, byte [rax]
lea rax, [rax + 1]
or r10b, cl
sub rdx, 1
jne 0x18015bd60
movzx eax, r10b
ret

Function at 0x18015be50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r11d, r11d
mov r10, rcx
test r8d, r8d
je 0x18015bf31
cmp r8d, 0x40
jb 0x18015bf0f
lea eax, [r8 - 1]
lea rcx, [rax + rdx]
add rax, r10
cmp rdx, rax
ja 0x18015be86
cmp rcx, r10
jae 0x18015bf0f
mov r9d, r8d
mov qword [rsp], rbx
and r9d, 0xffffffc0
mov ebx, 0x20
nop word [rax + rax]
movdqu xmm0, xmmword [r11 + rdx]
lea eax, [rbx - 0x10]
movdqu xmm1, xmmword [r11 + r10]
pxor xmm1, xmm0
movdqu xmmword [r11 + rdx], xmm1
add r11d, 0x40
movdqu xmm0, xmmword [rax + rdx]
movdqu xmm1, xmmword [rax + r10]
pxor xmm1, xmm0
movdqu xmmword [rax + rdx], xmm1
mov eax, ebx
movdqu xmm0, xmmword [rax + rdx]
movdqu xmm1, xmmword [rax + r10]
pxor xmm1, xmm0
movdqu xmmword [rax + rdx], xmm1
lea eax, [rbx + 0x10]
add ebx, 0x40
movdqu xmm0, xmmword [rax + rdx]
movdqu xmm1, xmmword [rax + r10]
pxor xmm1, xmm0
movdqu xmmword [rax + rdx], xmm1
cmp r11d, r9d
jb 0x18015bea0
mov rbx, qword [rsp]
cmp r11d, r8d
jae 0x18015bf31
sub r10, rdx
mov eax, r11d
add rax, rdx
sub r8d, r11d
mov edx, r8d
nop
movzx ecx, byte [r10 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x18015bf20
add rsp, 8
ret
Function at 0x180167ac0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
xor sil, sil
mov r11, rdx
mov rbx, rcx
mov rbp, r8
mov dil, 1
test r8, r8
je 0x180167b29
nop dword [rax + rax]
movzx r9d, dil
lea r11, [r11 + 1]
inc dil
movzx r10d, byte [r9 + rbx]
add sil, r10b
movzx eax, sil
movzx ecx, byte [rax + rbx]
mov byte [r9 + rbx], cl
mov byte [rax + rbx], r10b
add r10b, byte [r9 + rbx]
movzx ecx, r10b
movzx edx, byte [rcx + rbx]
xor byte [r11 - 1], dl
sub r8, 1
jne 0x180167af0
mov rbx, qword [rsp + 8]
mov rax, rbp
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x180167bf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
movsxd r8, dword [rcx]
mov r14, rdx
mov rdi, qword [rcx + 0x10]
mov rsi, r8
movzx eax, word [rdi + r8*4 + 0x10]
movzx ecx, word [rdi + r8*4 + 0x18]
movzx ebx, word [rdi + r8*4 + 0x14]
shl rbx, 0x10
or rbx, rax
mov eax, dword [rdx]
xor rbx, rax
movzx eax, word [rdi + r8*4 + 0x1c]
shl rax, 0x10
or rax, rcx
mov ecx, dword [rdx + 4]
xor rax, rcx
lea ecx, [r8 - 1]
xor rax, rbx
movsxd rbp, ecx
test ecx, ecx
js 0x180167ce7
nop word [rax + rax]
movzx r8d, word [rdi + rbp*4]
mov edx, eax
mov r9d, r8d
shr edx, 0x10
movzx ecx, dx
shr r9, 8
shr cx, 8
movzx r11d, cx
movzx ecx, dl
xor r9, r11
xor r9, rcx
movzx ecx, ax
shr cx, 8
xor cl, al
xor cl, r8b
inc cl
add cl, r9b
rol cl, 2
movzx r10d, cl
lea ecx, [r9 + r10]
rol cl, 2
movzx edx, cl
lea ecx, [rdx + 1]
add cl, r11b
rol cl, 2
movzx r8d, cl
shl r8, 8
or r8, rdx
shl r8, 8
or r8, r10
add r10b, al
shl r8, 8
rol r10b, 2
movzx ecx, r10b
or r8, rcx
xor r8, rbx
mov rbx, rax
sub rbp, 1
mov rax, r8
jns 0x180167c60
movzx ecx, word [rdi + rsi*4 + 8]
movzx edx, word [rdi + rsi*4 + 0xc]
mov rbp, qword [rsp + 0x18]
shl rdx, 0x10
or rdx, rcx
movzx ecx, word [rdi + rsi*4]
xor rdx, rax
xor rbx, rdx
movzx edx, word [rdi + rsi*4 + 4]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
shl edx, 0x10
or edx, ecx
mov dword [r14 + 4], ebx
mov rbx, qword [rsp + 0x10]
xor edx, eax
mov dword [r14], edx
pop r14
ret
Function at 0x180167d30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
mov eax, dword [rcx]
xor r8d, r8d
mov ebx, dword [rdx]
mov r11, rcx
mov ebp, dword [rdx + 4]
mov esi, r8d
cdq
sub eax, edx
sar eax, 1
add eax, 4
test eax, eax
jle 0x180167e28
mov qword [rsp + 0x10], rdi
mov edi, r8d
nop dword [rax]
nop word [rax + rax]
xor r8d, ebp
lea rdi, [rdi + 8]
mov eax, ebx
movzx ecx, bx
shr eax, 0x10
inc esi
movzx r9d, ax
movzx edx, al
shr cx, 8
xor cl, bl
shr r9, 8
xor rdx, r9
movzx eax, dl
xor al, r8b
inc al
add cl, al
movzx eax, r8w
shr ax, 8
rol cl, 2
movzx r10d, cl
xor al, r10b
shr r8d, 0x10
add al, dl
rol al, 2
movzx ecx, al
movzx eax, r8w
shr ax, 8
xor al, cl
inc al
add al, r9b
rol al, 2
movzx edx, al
shl edx, 8
or edx, ecx
shl edx, 8
or edx, r10d
xor r10b, r8b
add r10b, bl
shl edx, 8
rol r10b, 2
mov r8, rbx
movzx eax, r10b
mov rbx, rbp
or edx, eax
mov rax, qword [r11 + 0x10]
movzx ecx, dx
mov ebp, edx
mov dword [rdi + rax - 8], ecx
mov ecx, edx
mov rax, qword [r11 + 0x10]
shr ecx, 0x10
mov dword [rdi + rax - 4], ecx
mov eax, dword [r11]
cdq
sub eax, edx
sar eax, 1
add eax, 4
cmp esi, eax
jl 0x180167d70
mov rdi, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
pop rsi
ret
Function at 0x180167ea0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x28
mov r12, r9
mov r13, r9
shr r13, 3
mov r14, r8
and r12d, 7
mov rsi, rcx
mov qword [rsp + 0x78], r12
je 0x180167ee3
sub r13, 1
jne 0x180167ee3
mov rbx, qword [rdx]
mov rdi, r8
jmp 0x180168062
test r13, r13
je 0x180168055
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x20], r15
nop word [rax + rax]
movsxd rdx, dword [rsi]
mov r15, qword [rsi + 0x10]
mov rbp, rdx
mov rbx, qword [r14]
movzx eax, word [r15 + rdx*4 + 0x10]
movzx ecx, word [r15 + rdx*4 + 0x18]
movzx esi, word [r15 + rdx*4 + 0x14]
shl rsi, 0x10
or rsi, rax
mov eax, ebx
xor rsi, rax
movzx eax, word [r15 + rdx*4 + 0x1c]
shl rax, 0x10
or rax, rcx
mov rcx, rbx
shr rcx, 0x20
xor rax, rcx
lea ecx, [rdx - 1]
xor rax, rsi
movsxd r12, ecx
test ecx, ecx
js 0x180167ff1
nop dword [rax]
nop word [rax + rax]
movzx r8d, word [r15 + r12*4]
mov edx, eax
mov r10d, r8d
shr edx, 0x10
movzx ecx, dx
shr r10, 8
shr cx, 8
movzx r11d, cx
movzx ecx, dl
xor r10, rcx
movzx edi, al
movzx ecx, r8b
xor r10, r11
movzx edx, ax
shr rdx, 8
xor rcx, rdx
xor rcx, rdi
inc rcx
add rcx, r10
rol cl, 2
movzx r9d, cl
add rdi, r9
rol dil, 2
lea rcx, [r9 + r10]
rol cl, 2
movzx edx, cl
lea rcx, [rdx + 1]
add rcx, r11
rol cl, 2
movzx r8d, cl
shl r8, 8
or r8, rdx
movzx ecx, dil
shl r8, 8
or r8, r9
shl r8, 8
or r8, rcx
xor r8, rsi
mov rsi, rax
sub r12, 1
mov rax, r8
jns 0x180167f60
movzx ecx, word [r15 + rbp*4 + 8]
movzx edx, word [r15 + rbp*4 + 0xc]
shl rdx, 0x10
or rdx, rcx
movzx ecx, word [r15 + rbp*4]
xor rdx, rax
xor rsi, rdx
movzx edx, word [r15 + rbp*4 + 4]
mov dword [r14 + 4], esi
mov rsi, qword [rsp + 0x60]
shl edx, 0x10
or edx, ecx
xor edx, eax
mov dword [r14], edx
mov rdx, qword [rsp + 0x68]
mov rax, qword [rdx]
xor qword [r14], rax
add r14, 8
mov qword [rdx], rbx
sub r13, 1
jne 0x180167f00
mov r12, qword [rsp + 0x78]
mov r15, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x70]
jmp 0x18016805a
mov rbx, qword [rsp + 0x78]
mov rdi, r14
test r12, r12
je 0x1801680ab
mov rax, qword [r14]
mov rcx, rsi
mov qword [rdx], rax
mov rdx, r14
call fcn.180167bf0
lea rdx, [r14 + 8]
test r12, r12
je 0x18016809d
nop dword [rax]
movzx ecx, byte [rdx]
lea rdi, [rdi + 1]
movzx eax, cl
lea rdx, [rdx + 1]
xor al, byte [rdi - 1]
mov byte [rdx - 1], al
mov byte [rdi - 1], cl
sub r12, 1
jne 0x180168080
mov rdx, r14
mov rcx, rsi
call fcn.180167bf0
xor qword [r14], rbx
add rsp, 0x28
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x180187820
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1802b1734], eax
mov eax, dword [rbx + 0x14]
mov dword [0x1802b1730], eax
cmp dword [rbx + 4], edi
jne 0x1801878f6
mov ebp, 0x2710
lea r14, [0x1802b172c]
nop dword [rax]
mov eax, 0xcccccccd
mul dword [rbx + 0x18]
shr edx, 3
cmp edx, 0x3e8
jae 0x18018788a
mov edx, 0x3e8
jmp 0x18018788f
cmp edx, ebp
cmova edx, ebp
mov ecx, edx
mov dword [0x1802b1738], edx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x24
mov qword [rsp + 0x20], r14
mov r8, rbx
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1801878f6
mov eax, dword [0x1802b1730]
cmp dword [rbx + 0x14], eax
jbe 0x1801878dc
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1802b1734], eax
mov eax, dword [rbx + 0x14]
mov dword [0x1802b1730], eax
jmp 0x1801878ed
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1802b1734]
cmp eax, dword [rbx + 0x18]
ja 0x180187913
cmp dword [rbx + 4], edi
je 0x180187870
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
xor al, al
jmp 0x1801878f8
Function at 0x180187920
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x60
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
mov rbx, rcx
xor eax, eax
xor ecx, ecx
xor edx, edx
mov dword [rsp + 0x50], eax
mov r8d, 0x20000
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x180187a95
mov r8d, reloc.WS2_32.dll_sendto
mov qword [rsp + 0x80], rdi
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
jne 0x18018799d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x180187a8d
mov qword [rsp + 0x78], rbp
lea r8, [rsp + 0x30]
lea rbp, [0x1802b172c]
mov r9d, 0x24
xor edx, edx
mov qword [rsp + 0x20], rbp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x180187a74
mov eax, dword [rsp + 0x34]
cmp eax, 4
je 0x180187a5e
dec eax
test eax, 0xfffffffd
jne 0x180187a74
mov ebx, 3
lea rdx, [rsp + 0x30]
mov r8d, ebx
mov rcx, rdi
call fcn.180187820
test al, al
je 0x180187a74
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x180187a5e
lea r8d, [rbx - 1]
mov rcx, rdi
lea rdx, [rsp + 0x30]
call fcn.180187820
test al, al
jne 0x180187a43
test ebx, ebx
jle 0x180187a43
mov r8d, 2
lea rdx, [rsp + 0x30]
mov rcx, rdi
dec ebx
call fcn.180187820
test al, al
je 0x180187a26
mov r9d, 0x24
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
jmp 0x180187a88
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
mov rbp, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1801e67e0
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rsi
ret
Function at 0x1801882c0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov rdi, r8
mov rsi, rcx
mov r10, rcx
cmp r8, 0xffffffffffffffff
jae 0x180188415
cmp r8, 4
jb 0x180188415
mov qword [rsp + 0x18], rbp
lea rbp, [0x18006db30]
mov qword [rsp + 0x10], rbx
movsx rcx, byte [rdx]
test cl, cl
je 0x18018840b
cmp ecx, 0x80
jae 0x18018840b
movzx r11d, byte [rcx + rbp]
cmp r11b, 0xff
je 0x18018840b
movsx rcx, byte [rdx + 1]
cmp ecx, 0x80
jae 0x18018840b
movsx ebx, byte [rcx + rbp]
mov r8d, ebx
cmp ebx, 0xffffffff
je 0x18018840b
movsx rcx, byte [rdx + 2]
cmp cl, 0x3d
je 0x18018835c
cmp ecx, 0x80
jae 0x18018840b
cmp byte [rcx + rbp], 0xff
je 0x18018840b
movsx r9, byte [rdx + 3]
sub rdi, 4
add rdx, 4
cmp r9b, 0x3d
je 0x180188387
cmp r9d, 0x80
jae 0x18018840b
cmp byte [r9 + rbp], 0xff
je 0x18018840b
sar r8d, 4
and r8b, 3
shl r11b, 2
or r8b, r11b
mov byte [r10], r8b
inc r10
cmp cl, 0x3d
je 0x180188401
mov r8, rcx
cmp ecx, 0x80
jae 0x1801883b2
movsx eax, byte [rcx + rbp]
jmp 0x1801883b7
mov eax, 0xffffffff
sar eax, 2
and al, 0xf
shl bl, 4
or al, bl
mov byte [r10], al
inc r10
cmp r9b, 0x3d
je 0x180188401
cmp ecx, 0x80
jae 0x1801883dc
movzx r8d, byte [r8 + rbp]
jmp 0x1801883df
mov r8b, 0xff
cmp r9d, 0x80
jae 0x1801883ef
movzx ecx, byte [r9 + rbp]
jmp 0x1801883f1
mov cl, 0xff
and cl, 0x3f
shl r8b, 6
or cl, r8b
mov byte [r10], cl
inc r10
cmp rdi, 4
jae 0x1801882f4
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
sub r10d, esi
mov rsi, qword [rsp + 0x20]
mov eax, r10d
pop rdi
ret