joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403514b8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x14080e640]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14035150f
cmp word [rdx], r13w
jne 0x14035150f
or byte [rax + rdi*8 + 0x38], cl
jmp 0x140351514
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x140351639
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14035165a
lea r9, [rdx + 2]
cmp cx, r11w
je 0x14035154d
mov rdx, r9
mov word [rbx], cx
jmp 0x140351574
cmp r9, r8
jae 0x140351584
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14035152e
jmp 0x140351639
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14035162e
cmp dword [rsp + 0x80], esi
je 0x14035162e
lea r8, [0x14080e640]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x140351606
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x1403515d6
mov word [rbx], r13w
jmp 0x140351636
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x1403515e3
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x140351636
cmp word [rsp + 0x70], r13w
jne 0x140351613
cmp rbx, r14
je 0x1403515d0
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140352de8
cmp word [rsp + 0x70], r13w
je 0x140351639
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x14080e640]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x140351633
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x140351639
Function at 0x140359d70
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140359d86
mov al, 1
jmp 0x140359de6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140359d97
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140359de4
mov ecx, dword [rcx + 0x18]
nop
call fcn.140343718
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140359de4
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140359de4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140359de4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140359de6
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14035f0d4
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140352de8
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140352de8
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14035f224
cmp rax, 0xffffffffffffffff
je 0x14035f224
xor edi, edi
test rbp, rbp
jle 0x14035f1cf
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140358bcc
mov rbx, rax
test rax, rax
jne 0x14035f15c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14035f1c5
mov edx, 0x8000
mov ecx, r14d
call fcn.140349ab4
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140352870
cmp eax, 0xffffffff
je 0x14035f1a5
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14035f16c
mov edx, r15d
mov ecx, r14d
call fcn.140349ab4
jmp 0x14035f1c5
cmp byte [rsi + 0x38], dil
je 0x14035f1bc
cmp dword [rsi + 0x34], 5
jne 0x14035f1bc
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14035f1c5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140358c44
jmp 0x14035f238
jns 0x14035f238
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140352de8
cmp rax, 0xffffffffffffffff
jne 0x14035f1f0
cmp byte [rsi + 0x30], dil
je 0x14035f238
mov edi, dword [rsi + 0x2c]
jmp 0x14035f238
mov ecx, r14d
call fcn.140343718
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14035f238
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14035f238
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14035f231
mov eax, dword [rsi + 0x2c]
jmp 0x14035f236
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140352de8
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140360e50
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140360e80
xor eax, eax
jmp 0x140360f43
mov rbp, rbx
cmp word [rax], si
je 0x140360ea5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140360e8c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140360e88
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14035ecd8
movsxd r14, eax
test eax, eax
jne 0x140360ee3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140360e79
mov rcx, r14
call fcn.14035a00c
mov rdi, rax
test rax, rax
jne 0x140360efc
xor ecx, ecx
call fcn.140358c44
jmp 0x140360ed8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14035ecd8
test eax, eax
jne 0x140360f2d
mov rcx, rdi
call fcn.140358c44
jmp 0x140360f37
xor ecx, ecx
call fcn.140358c44
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140360f60
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140360fe7
mov rsi, rbx
cmp word [rax], bp
je 0x140360fa6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140360f90
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140360f8c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14035a00c
mov rdi, rax
test rax, rax
je 0x140360fd4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140336c00
mov rbp, rdi
xor ecx, ecx
call fcn.140358c44
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140363d2c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140358578
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x140363dcd
cmp ebx, dword [rsp + 0x30]
je 0x140363dc6
test esi, esi
je 0x140363dc6
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x140363da1
sub r8w, 0x61
cmp r8w, 0x19
ja 0x140363dae
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x140363d8b
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x140363db2
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x140363dcf
mov eax, 1
jmp 0x140363dcf
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14036613c
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1404e8f18]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x140366186
call fcn.14033cf28
mov dword [rax], 0xf
call fcn.14033cf48
mov dword [rax], 0xd
call fcn.14033cb84
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1403358f0
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x140366191
lea eax, [rbx + 1]
jmp 0x140366173
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x140366171
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x140366173
Function at 0x14036696c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1403438f0
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1403669f6
cmp byte [rbp - 0x21], r15b
je 0x1403669f1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140366a2c
call fcn.1403590a0
test eax, eax
jne 0x140366a18
cmp byte [rbp - 0x21], r15b
je 0x140366a10
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140366a2c
cmp byte [rbp - 0x21], r15b
je 0x140366a29
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1403474e4
test eax, eax
jne 0x140366acc
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1403438f0
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140366a6b
cmp byte [rbp - 0x21], r15b
je 0x140366aa0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140366aa0
call fcn.1403590a0
test eax, eax
jne 0x140366a8c
cmp byte [rbp - 0x21], r15b
je 0x140366a85
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140366aa0
cmp byte [rbp - 0x21], r15b
je 0x140366a9d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1403474e4
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140366acc
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140366acf
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140366add
mov rcx, rdi
call fcn.140358c44
cmp byte [rbp + 0x3f], r15b
je 0x140366aec
mov rcx, qword [rbp + 0x27]
call fcn.140358c44
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400031c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x1400eb0c0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rsi, rdx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000327b
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x4c]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140003230
cmp qword [rsi + 0x18], 0xf
mov rcx, rsi
mov rdi, qword [rsi + 0x10]
jbe 0x14000324a
mov rcx, qword [rsi]
cmp rbx, rdi
lea rdx, [rsp + 0x4c]
mov r8, rdi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140003269
cmp rdi, rbx
jb 0x140003269
jbe 0x1400032a6
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140003220
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400bcc60
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x14000327d

Function at 0x140003870
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1400eb0c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140003917
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140003917
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x44], rax
xor edx, edx
xor eax, eax
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x4c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140003900
lea rcx, str.AdjustTokenPrivilege_Errro_n
jmp 0x14000391e
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400bcc60
add rsp, 0x68
ret
lea rcx, str.SetPrivilege_Error_n
call fcn.140003810
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400bcc60
add rsp, 0x68
ret
Function at 0x140003cf0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400eb0c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edi, edx
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140003d4e
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], Ordinal_30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
jne 0x140003d52
lea rcx, [0x1400d08e0]
call fcn.140003810
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140003d81
cmp dword [rsp + 0x2c], edi
jne 0x140003d61
mov edx, dword [rsp + 0x28]
call fcn.140003940
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x140003d52
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400bcc60
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140003da0
Capabilities:
Enumerate services

Disassembly:
push r13
push r15
sub rsp, 0x78
mov rax, qword [0x1400eb0c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor r15d, r15d
xor edx, edx
xor ecx, ecx
lea r8d, [r15 + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r13, rax
test rax, rax
jne 0x140003de9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____OpenSCManager_fail__ld_
call fcn.140003810
jmp 0x140003f55
mov qword [rsp + 0x48], r15
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r15
xor edx, edx
mov qword [rsp + 0x38], rax
mov rcx, r13
lea rax, [rsp + 0x54]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
lea r9d, [rdx + 3]
mov qword [rsp + 0x98], rbp
lea r8d, [rdx + 0x30]
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x68], r12
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExA]
mov ebx, dword [rsp + 0x54]
mov ecx, ebx
call fcn.1400bccf8
mov qword [rsp + 0x48], r15
mov r12, rax
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor edx, edx
lea rax, [rsp + 0x54]
mov rcx, r13
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
lea r9d, [rdx + 3]
mov qword [rsp + 0x20], r12
lea r8d, [rdx + 0x30]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExA]
mov ebp, r15d
cmp dword [rsp + 0x50], r15d
jbe 0x140003f2f
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], r14
nop dword [rax]
nop word [rax + rax]
mov eax, ebp
mov rbx, 0xffffffffffffffff
imul r14, rax, 0x38
add r14, r12
mov rdi, qword [r14]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140003ec3
add rbx, rdi
mov rsi, rdi
cmp rdi, rbx
je 0x140003eee
movsx ecx, byte [rsi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
inc rsi
mov byte [rdi], al
lea rdi, [rdi + 1]
cmp rsi, rbx
jne 0x140003ed7
mov rcx, qword [r14]
lea rdx, str.eventlog
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140003f15
mov edx, dword [r14 + 0x2c]
lea rcx, str.___PID:_ld_n
call fcn.140003810
mov r15d, dword [r14 + 0x2c]
inc ebp
cmp ebp, dword [rsp + 0x50]
jb 0x140003eb0
mov r14, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xa0]
mov rcx, r12
call fcn.1400bccc4
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r12, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov eax, r15d
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400bcc60
add rsp, 0x78
pop r15
pop r13
ret
Function at 0x140008cc0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140008d1d
lea rbx, [0x1400d13b0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140008d04
cmp r10, 2
jb 0x140008d04
cmp byte [r9], r8b
jne 0x140008d04
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140008ce0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140008d5f
lea rbx, [0x1400d13b0]
cmp r8b, 0x23
jne 0x140008d43
cmp byte [r9], r8b
jne 0x140008d43
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140008d30
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140008ea0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140008eba
mov qword [r8], 0
lea rdx, [0x1400d0df4]
call fcn.140008d70
mov rbx, rax
test rax, rax
jne 0x140008eda
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140008fb1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140008fb1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140008fb1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140008fb1
cmp rdi, 0xffffffffffffffff
je 0x140008fb1
mov rax, qword [0x1400ec7c0]
test rax, rax
je 0x140008f4e
inc dword [rax + 0x3b0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140008fb1
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140008f9e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400ec7c0]
test rax, rax
je 0x140008f93
dec dword [rax + 0x3b0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140008fba
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140008fac
mov qword [r14], rdi
mov rax, rsi
jmp 0x140008fbc
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140016bb0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x1400ec7c0]
lea rdx, [0x1400d13b0]
mov r8d, ecx
mov rbx, qword [rax + 0x1d18]
add rbx, 0x108
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x140016c67
lea ecx, [r9 + 1]
test r8d, r8d
je 0x140016c53
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140016c58
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.1400292f0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140017b40
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400eb0c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400ec7c0]
mov edi, edx
cmp byte [rbx + 0x210d], 0
jne 0x140017ba0
cmp byte [rbx + 0x210e], 0
jne 0x140017ba0
mov r9d, dword [rbx + 0x31b0]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140008c40
test dil, 1
je 0x140017cc6
jmp 0x140017c2f
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
mov r9d, dword [rbx + 0x31b0]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400d7b90]
mulss xmm1, dword [0x1400d7b7c]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
mov qword [rbx + 0x1ddc], rax
mov dword [rbx + 0x1dc4], 1
movss dword [rbx + 0x1dd4], xmm0
mov byte [rbx + 0x1dfc], 1
movss dword [rbx + 0x1dd8], xmm1
movss xmm0, dword [rbx + 0x1748]
mulss xmm0, dword [0x1400d7ae4]
or dword [rbx + 0x1dc0], 0x41
movss dword [rbx + 0x1e20], xmm0
call fcn.140008c40
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140017c80
lea r11, [0x1400d13b0]
nop
cmp r9b, 0x23
jne 0x140017c63
cmp byte [r8], r9b
jne 0x140017c63
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140017c50
not ecx
call fcn.140010560
test rax, rax
je 0x140017cc6
cmp byte [rax + 0xcf], 0
je 0x140017cc6
mov byte [rax + 0xd6], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x31b0]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x31b0]
call fcn.140008c40
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400bcc60
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret