joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140022a50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rsi, rdx
mov r14, rcx
mov qword [rcx + 0x18], 0xf
xor ebx, ebx
mov qword [rcx + 0x10], rbx
mov byte [rcx], bl
or r9, 0xffffffffffffffff
xor r8d, r8d
call fcn.140003670
nop
mov eax, dword [rsi + 0x20]
mov dword [r14 + 0x20], eax
mov eax, dword [rsi + 0x24]
mov dword [r14 + 0x24], eax
mov eax, dword [rsi + 0x28]
mov dword [r14 + 0x28], eax
mov eax, dword [rsi + 0x2c]
mov dword [r14 + 0x2c], eax
mov eax, dword [rsi + 0x30]
mov dword [r14 + 0x30], eax
mov eax, dword [rsi + 0x34]
mov dword [r14 + 0x34], eax
mov eax, dword [rsi + 0x38]
mov dword [r14 + 0x38], eax
mov eax, dword [rsi + 0x3c]
mov dword [r14 + 0x3c], eax
mov eax, dword [rsi + 0x40]
mov dword [r14 + 0x40], eax
movzx eax, word [rsi + 0x44]
mov word [r14 + 0x44], ax
movzx eax, byte [rsi + 0x46]
mov byte [r14 + 0x46], al
movzx eax, byte [rsi + 0x47]
mov byte [r14 + 0x47], al
lea rdx, [rsi + 0x48]
lea rcx, [r14 + 0x48]
call fcn.140022e40
nop
lea rcx, [r14 + 0x60]
mov qword [rcx + 0x18], 0xf
mov qword [rcx + 0x10], rbx
mov byte [rcx], bl
lea rdx, [rsi + 0x60]
or r9, 0xffffffffffffffff
xor r8d, r8d
call fcn.140003670
nop
movzx eax, word [rsi + 0x80]
mov word [r14 + 0x80], ax
movzx eax, word [rsi + 0x82]
mov word [r14 + 0x82], ax
movzx eax, word [rsi + 0x84]
mov word [r14 + 0x84], ax
movups xmm0, xmmword [rsi + 0x88]
movups xmmword [r14 + 0x88], xmm0
movups xmm1, xmmword [rsi + 0x98]
movups xmmword [r14 + 0x98], xmm1
movups xmm0, xmmword [rsi + 0xa8]
movups xmmword [r14 + 0xa8], xmm0
movups xmm1, xmmword [rsi + 0xb8]
movups xmmword [r14 + 0xb8], xmm1
movups xmm0, xmmword [rsi + 0xc8]
movups xmmword [r14 + 0xc8], xmm0
movups xmm1, xmmword [rsi + 0xd8]
movups xmmword [r14 + 0xd8], xmm1
mov eax, dword [rsi + 0xe8]
mov dword [r14 + 0xe8], eax
movzx eax, byte [rsi + 0xec]
mov byte [r14 + 0xec], al
movzx eax, byte [rsi + 0xed]
mov byte [r14 + 0xed], al
lea rdi, [r14 + 0xf0]
mov qword [rsp + 0x58], rdi
lea rdx, [rsi + 0xf0]
mov rcx, rdi
call fcn.1400047c0
nop
lea rdx, [rsi + 0x108]
lea rcx, [rdi + 0x18]
call fcn.1400047c0
mov eax, dword [rsi + 0x120]
mov dword [rdi + 0x30], eax
movzx eax, word [rsi + 0x128]
mov word [r14 + 0x128], ax
lea rdi, [r14 + 0x130]
mov qword [rsp + 0x58], rdi
lea rdx, [rsi + 0x130]
mov rcx, rdi
call fcn.140004830
nop
lea rdx, [rsi + 0x148]
lea rcx, [rdi + 0x18]
call fcn.140022d70
nop
mov rax, r14
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140023719
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rcx, rdx
je 0x140023840
push rsi
push r12
push r15
sub rsp, 0x40
mov rax, qword [0x1400a4a90]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rdi
lea rdi, [rcx + 6]
mov r15, r8
mov r12, rdx
mov rsi, rcx
cmp rdi, rdx
je 0x140023825
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x30], r14
lea rbp, [rdi - 6]
nop
mov eax, dword [rdi]
lea rcx, [rsp + 0x20]
mov rdx, rsi
mov dword [rsp + 0x20], eax
movzx eax, word [rdi + 4]
mov r14, rdi
mov word [rsp + 0x24], ax
call r15
test al, al
je 0x1400237b8
mov rax, rdi
cmp rsi, rdi
je 0x1400237a7
nop dword [rax]
mov ecx, dword [rax - 6]
sub rax, 6
mov dword [rax + 6], ecx
movzx ecx, word [rax + 4]
mov word [rax + 0xa], cx
cmp rax, rsi
jne 0x140023790
mov eax, dword [rsp + 0x20]
mov dword [rsi], eax
movzx eax, word [rsp + 0x24]
mov word [rsi + 4], ax
jmp 0x140023805
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov rbx, rbp
call r15
test al, al
je 0x1400237f4
nop word [rax + rax]
mov eax, dword [rbx]
lea rcx, [rsp + 0x20]
mov dword [r14], eax
movzx eax, word [rbx + 4]
mov word [r14 + 4], ax
mov r14, rbx
sub rbx, 6
mov rdx, rbx
call r15
test al, al
jne 0x1400237d0
mov eax, dword [rsp + 0x20]
mov dword [r14], eax
movzx eax, word [rsp + 0x24]
mov word [r14 + 4], ax
add rdi, 6
add rbp, 6
cmp rdi, r12
jne 0x140023760
mov r14, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140072910
add rsp, 0x40
pop r15
pop r12
pop rsi
ret

Function at 0x140023e70
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x288]
sub rsp, 0x360
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400a4a90]
xor rax, rsp
mov qword [rbp + 0x258], rax
mov rbx, rcx
lea rcx, [0x140093550]
jmp 0x1403246c2
Function at 0x14002e640
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov qword [rbp - 0x69], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400a4a90]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rcx
xor edx, edx
mov r8d, 0x90
lea rcx, [rbp - 0x59]
call fcn.140076990
lea rcx, [0x140091d6c]
call fcn.1400c9330
nop
mov rbx, rax
lea rcx, [0x140093800]
call fcn.1400c9330
nop
mov qword [rbp - 0x19], 0xf
xor r14d, r14d
mov qword [rbp - 0x21], r14
mov byte [rbp - 0x31], r14b
mov qword [rbp + 7], 0xf
mov qword [rbp - 1], r14
mov byte [rbp - 0x11], r14b
mov qword [rbp + 0x27], 0xf
mov qword [rbp + 0x1f], r14
mov byte [rbp + 0xf], r14b
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x59]
call fcn.1400024d0
nop
cmp dword [rbp + 0x2f], r14d
jne 0x14002e721
mov dword [rbp - 0x61], r14d
mov r9, qword [rbp - 0x59]
lea edx, [r14 + 1]
lea r8d, [r14 + 4]
lea rcx, [rbp - 0x61]
call fcn.140073380
sub qword [rbp - 0x39], rax
cmp dword [rbp + 0x2f], r14d
jne 0x14002e721
mov rcx, qword [rbp - 0x59]
call fcn.140073774
mov qword [rbp - 0x59], r14
mov dword [rbp + 0x2f], 0xffffffff
mov esi, dword [rdi + 0x19ec]
mov dword [rdi + 0x19ec], 0x64
mov edx, 0xf
lea ecx, [rdx - 0xa]
call fcn.1400069a0
test eax, eax
je 0x14002e78b
mov ebx, eax
mov qword [rbp - 0x71], 0xf
mov qword [rbp - 0x79], r14
mov byte [rsp + 0x30], 0
mov r8d, 3
lea rdx, [0x140093174]
lea rcx, [rsp + 0x30]
call fcn.140003d50
mov dword [rsp + 0x20], r14d
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400367b0
mov rcx, rdi
call fcn.140036fd0
dec rbx
jne 0x14002e744
mov dword [rdi + 0x19ec], esi
lea rcx, [rbp - 0x59]
call fcn.140002420
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140072910
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x1400b3c3c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], 0xffffffffb0ccbede
lea rsp, [rsp + 0x20]
call fcn.14024ab8b
push rsi
push r15
mov qword [rsp + 0x10], 0xffffffffa00b4885
lea rsp, [rsp + 0x10]
call fcn.1401fd475
push r10
pushfq
movabs r10, 0x1eb732f138630e1b
push r8
mov r10, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0xecdee38
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.1402a3935
Function at 0x1400bb560
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1400bb58c
xor al, al
jmp 0x1400bb6b0
movdqa xmm0, xmmword [0x1400dcaa0]
movdqa xmm1, xmmword [0x1400dcab0]
mov rax, qword [r9]
xor r11d, r11d
mov qword [rsp + 0x50], r12
mov rcx, r8
movdqa xmmword [rsp], xmm0
movdqa xmm0, xmmword [0x1400dcac0]
movdqa xmmword [rsp + 0x10], xmm1
lea r12, [r8 + rax]
mov edx, r11d
movdqa xmm1, xmmword [0x1400dcad0]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
test rbx, rbx
je 0x1400bb6a2
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1400bb609
mov r11d, 2
jmp 0x1400bb62d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1400bb623
mov r11d, 1
jmp 0x1400bb62d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, r12
ja 0x1400bb6c5
mov eax, r10d
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov eax, r10d
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1400bb66a
mov byte [rcx + 2], 0x3d
jmp 0x1400bb67a
shr r10, 6
and r10d, 0x3f
movzx eax, byte [rsp + r10]
mov byte [rcx + 2], al
add rcx, 3
add r8, 3
test r11, r11
je 0x1400bb68c
mov byte [rcx], 0x3d
jmp 0x1400bb693
movzx eax, byte [rsp + r9]
mov byte [rcx], al
inc rcx
inc r8
cmp rdx, rbx
jb 0x1400bb5f0
sub rcx, rsi
mov al, 1
mov qword [rbp], rcx
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor al, al
jmp 0x1400bb6ab
Function at 0x1400019b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xf8
mov qword [rsp + 0xd8], 0xfffffffffffffffe
mov rax, qword [0x14002e260]
xor rax, rsp
mov qword [rsp + 0xe8], rax
movzx eax, byte [0x14003fa21]
test eax, eax
je 0x140001a7e
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.140009950
mov r9, qword [0x1400256b8]
xor r8d, r8d
mov rdx, qword [rsp + 0x100]
lea rcx, [rsp + 0x28]
call fcn.140009160
nop
lea rcx, [0x1400256b0]
call fcn.140015fd0
mov qword [rsp + 0x78], rax
mov r8, qword [rsp + 0x78]
lea rdx, [0x1400256b0]
lea rcx, [rsp + 0x28]
call fcn.140008f00
cmp qword [rsp + 0x48], 0x10
jb 0x140001a53
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0xe0], rax
jmp 0x140001a60
lea rax, [rsp + 0x30]
mov qword [rsp + 0xe0], rax
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x28]
call fcn.140009950
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.140016780
add rsp, 0xf8
ret
Function at 0x140005c10
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x228
mov qword [rsp + 0x1f0], 0xfffffffffffffffe
mov qword [rsp + 0x30], 0
mov r8, qword [rsp + 0x238]
lea rdx, str.__del_reg__KEY:
lea rcx, [rsp + 0x40]
call fcn.14000d8f0
mov qword [rsp + 0x1f8], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x200], rax
mov rcx, qword [rsp + 0x200]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x40]
call fcn.140009950
mov rax, qword [rsp + 0x238]
cmp qword [rax + 0x20], 0x10
jb 0x140005ca9
mov rax, qword [rsp + 0x238]
mov rax, qword [rax + 8]
mov qword [rsp + 0x208], rax
jmp 0x140005cbd
mov rax, qword [rsp + 0x238]
add rax, 8
mov qword [rsp + 0x208], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x208]
mov rcx, qword [rsp + 0x230]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140005e3a
mov rax, qword [rsp + 0x238]
cmp qword [rax + 0x20], 0x10
jb 0x140005d13
mov rax, qword [rsp + 0x238]
mov rax, qword [rax + 8]
mov qword [rsp + 0x210], rax
jmp 0x140005d27
mov rax, qword [rsp + 0x238]
add rax, 8
mov qword [rsp + 0x210], rax
mov rdx, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x230]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x38], 0
jne 0x140005dc3
lea rax, [rsp + 0xe0]
mov qword [rsp + 0xe8], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.140009950
lea rcx, str.____done.
call fcn.140015fd0
mov qword [rsp + 0x110], rax
mov r8, qword [rsp + 0x110]
lea rdx, str.____done.
lea rcx, [rsp + 0x68]
call fcn.14000a980
nop
lea rcx, [rsp + 0x68]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x68]
call fcn.140009950
mov al, 1
jmp 0x140005eaf
lea rax, [rsp + 0x139]
mov qword [rsp + 0x140], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.140009950
lea rcx, str.____failed.
call fcn.140015fd0
mov qword [rsp + 0x168], rax
mov r8, qword [rsp + 0x168]
lea rdx, str.____failed.
lea rcx, [rsp + 0x90]
call fcn.14000a980
nop
lea rcx, [rsp + 0x90]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x90]
call fcn.140009950
xor al, al
jmp 0x140005eaf
lea rax, [rsp + 0x191]
mov qword [rsp + 0x198], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xb8]
call fcn.140009950
lea rcx, str.____not_exist
call fcn.140015fd0
mov qword [rsp + 0x1c0], rax
mov r8, qword [rsp + 0x1c0]
lea rdx, str.____not_exist
lea rcx, [rsp + 0xb8]
call fcn.14000a980
nop
lea rcx, [rsp + 0xb8]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xb8]
call fcn.140009950
xor al, al
add rsp, 0x228
ret
Function at 0x140005ec0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x278
mov qword [rsp + 0x258], 0xfffffffffffffffe
mov rax, qword [0x14002e260]
xor rax, rsp
mov qword [rsp + 0x268], rax
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x174], 0
mov rax, qword [rsp + 0x288]
cmp qword [rax + 0x20], 0x10
jb 0x140005f28
mov rax, qword [rsp + 0x288]
mov rax, qword [rax + 8]
mov qword [rsp + 0x260], rax
jmp 0x140005f3c
mov rax, qword [rsp + 0x288]
add rax, 8
mov qword [rsp + 0x260], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400060bf
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x174]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [rsp + 0x170], eax
cmp dword [rsp + 0x170], 0
jne 0x140006095
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x178]
call fcn.140009950
mov r9, qword [0x1400256b8]
xor r8d, r8d
mov rdx, qword [rsp + 0x288]
lea rcx, [rsp + 0x178]
call fcn.140009160
nop
lea rcx, [0x14002570c]
call fcn.140015fd0
mov qword [rsp + 0x1c8], rax
mov r8, qword [rsp + 0x1c8]
lea rdx, [0x14002570c]
lea rcx, [rsp + 0x178]
call fcn.140008f00
lea rcx, [rsp + 0x60]
call fcn.140015fd0
mov qword [rsp + 0x200], rax
mov r8, qword [rsp + 0x200]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x178]
call fcn.140008f00
lea rdx, [rsp + 0x178]
mov rcx, qword [rsp + 0x280]
call fcn.140005ec0
lea rdx, [rsp + 0x178]
mov rcx, qword [rsp + 0x280]
call fcn.140005c10
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x178]
call fcn.140009950
mov eax, dword [rsp + 0x174]
add eax, 1
mov dword [rsp + 0x174], eax
cmp dword [rsp + 0x170], 0
je 0x140005f6d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x268]
xor rcx, rsp
call fcn.140016780
add rsp, 0x278
ret
Function at 0x140006420
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x118
mov qword [rsp + 0xd0], 0xfffffffffffffffe
mov rax, qword [rsp + 0x120]
cmp qword [rax + 0x20], 0x10
jb 0x14000645d
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 8]
mov qword [rsp + 0xd8], rax
jmp 0x140006471
mov rax, qword [rsp + 0x120]
add rax, 8
mov qword [rsp + 0xd8], rax
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xffffffff
je 0x1400064d6
mov rax, qword [rsp + 0x120]
cmp qword [rax + 0x20], 0x10
jb 0x1400064af
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 8]
mov qword [rsp + 0xe0], rax
jmp 0x1400064c3
mov rax, qword [rsp + 0x120]
add rax, 8
mov qword [rsp + 0xe0], rax
mov edx, 0x80
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rax, qword [rsp + 0x120]
cmp qword [rax + 0x20], 0x10
jb 0x1400064fb
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 8]
mov qword [rsp + 0xe8], rax
jmp 0x14000650f
mov rax, qword [rsp + 0x120]
add rax, 8
mov qword [rsp + 0xe8], rax
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jne 0x140006578
mov r8, qword [rsp + 0x120]
lea rdx, str.__del_file:
lea rcx, [rsp + 0x30]
call fcn.14000d8f0
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0xf8], rax
mov rcx, qword [rsp + 0xf8]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.140009950
jmp 0x1400065eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 5
jne 0x1400065eb
mov rcx, qword [rsp + 0x120]
call fcn.140006f40
movzx eax, al
test eax, eax
je 0x1400065eb
mov r8, qword [rsp + 0x120]
lea rdx, str.__del_file_after_rebooting:
lea rcx, [rsp + 0x58]
call fcn.14000d8f0
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x108], rax
mov rcx, qword [rsp + 0x108]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x58]
call fcn.140009950
mov eax, 1
add rsp, 0x118
ret
Function at 0x140006f40
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x128
mov qword [rsp + 0xd0], 0xfffffffffffffffe
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0x130]
cmp qword [rax + 0x20], 0x10
jb 0x140006f85
mov rax, qword [rsp + 0x130]
mov rax, qword [rax + 8]
mov qword [rsp + 0xd8], rax
jmp 0x140006f99
mov rax, qword [rsp + 0x130]
add rax, 8
mov qword [rsp + 0xd8], rax
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 0x10
test eax, eax
je 0x140007077
mov rax, qword [rsp + 0x130]
cmp qword [rax + 0x20], 0x10
jb 0x140006fdf
mov rax, qword [rsp + 0x130]
mov rax, qword [rax + 8]
mov qword [rsp + 0xe0], rax
jmp 0x140006ff3
mov rax, qword [rsp + 0x130]
add rax, 8
mov qword [rsp + 0xe0], rax
mov r8d, 4
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x14000706b
mov r8, qword [rsp + 0x130]
lea rdx, str.__del_dir_on_reboot_:
lea rcx, [rsp + 0x30]
call fcn.14000d8f0
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0xf0], rax
mov rcx, qword [rsp + 0xf0]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.140009950
mov al, 1
jmp 0x140007198
xor al, al
jmp 0x140007198
mov rax, qword [rsp + 0x130]
cmp qword [rax + 0x20], 0x10
jb 0x14000709c
mov rax, qword [rsp + 0x130]
mov rax, qword [rax + 8]
mov qword [rsp + 0xf8], rax
jmp 0x1400070b0
mov rax, qword [rsp + 0x130]
add rax, 8
mov qword [rsp + 0xf8], rax
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x1400070d0
mov al, 1
jmp 0x140007198
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 2
jne 0x1400070e8
mov al, 1
jmp 0x140007198
mov rax, qword [rsp + 0x130]
cmp qword [rax + 0x20], 0x10
jb 0x14000710d
mov rax, qword [rsp + 0x130]
mov rax, qword [rax + 8]
mov qword [rsp + 0x100], rax
jmp 0x140007121
mov rax, qword [rsp + 0x130]
add rax, 8
mov qword [rsp + 0x100], rax
mov r8d, 4
xor edx, edx
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x140007196
mov r8, qword [rsp + 0x130]
lea rdx, str.__del_file_on_reboot_:
lea rcx, [rsp + 0x58]
call fcn.14000d8f0
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x110], rax
mov rcx, qword [rsp + 0x110]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x58]
call fcn.140009950
mov al, 1
jmp 0x140007198
xor al, al
add rsp, 0x128
ret
Function at 0x140007810
Capabilities:
Enumerate services

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x3028
call fcn.140021bb0
sub rsp, rax
lea rax, [rsp + 0x3010]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x2fd0
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, qword [rsp + 0x3038]
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesA]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x140007994
mov dword [rsp + 0x3014], 0
jmp 0x14000788e
mov eax, dword [rsp + 0x3014]
add eax, 1
mov dword [rsp + 0x3014], eax
mov eax, dword [rsp + 0x3010]
cmp dword [rsp + 0x3014], eax
jae 0x14000798b
mov edx, dword [rsp + 0x3014]
imul rdx, rdx, 0x30
mov r8d, 0xf01ff
mov rdx, qword [rsp + rdx + 0x40]
mov rcx, qword [rsp + 0x3030]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rsp + 0x3018], rax
cmp qword [rsp + 0x3038], 0
jne 0x1400078e0
xor eax, eax
jmp 0x140007996
mov r8d, dword [rsp + 0x3040]
mov rdx, qword [rsp + 0x3018]
mov rcx, qword [rsp + 0x3030]
call fcn.140007810
mov rcx, qword [rsp + 0x3018]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [rsp + 0x3014]
imul rax, rax, 0x30
cmp dword [rsp + rax + 0x54], 2
je 0x140007941
mov eax, dword [rsp + 0x3014]
imul rax, rax, 0x30
cmp dword [rsp + rax + 0x54], 4
je 0x140007941
mov eax, dword [rsp + 0x3014]
imul rax, rax, 0x30
cmp dword [rsp + rax + 0x54], 5
jne 0x140007986
mov r8d, dword [rsp + 0x3014]
imul r8, r8, 0x30
movzx eax, word [0x14003fa18]
imul rax, rax, 0x104
lea rcx, [0x14002f610]
add rcx, rax
mov r8, qword [rsp + r8 + 0x40]
mov edx, 0x104
call fcn.140016eec
movzx eax, word [0x14003fa18]
add ax, 1
mov word [0x14003fa18], ax
jmp 0x14000787d
mov eax, 1
jmp 0x140007996
xor eax, eax
add rsp, 0x3028
ret
Function at 0x1400079a0
Capabilities:
Query service status
Start service

Disassembly:
sub rsp, 0x68
mov r8d, 4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x1400079c8
xor eax, eax
jmp 0x140007b01
mov dword [rsp + 0x50], 0
jmp 0x1400079dd
mov eax, dword [rsp + 0x50]
add eax, 1
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0x100
jae 0x140007afc
mov eax, dword [rsp + 0x50]
imul rax, rax, 0x104
lea rdx, [0x14002f610]
add rdx, rax
mov r8d, 0xf01ff
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140007a30
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x140007b01
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140007a61
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x140007b01
cmp dword [rsp + 0x2c], 4
je 0x140007ae1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [rsp + 0x54], 0
jmp 0x140007a8d
mov eax, dword [rsp + 0x54]
add eax, 1
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0x1e
jae 0x140007ae1
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x140007ac5
cmp dword [rsp + 0x2c], 4
jne 0x140007ab8
jmp 0x140007ae1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140007adf
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x140007b01
jmp 0x140007a82
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400079d2
mov eax, 1
add rsp, 0x68
ret