joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400115d2
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp 0x14001c870
push rbp
push rdi
sub rsp, 0x4f8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xd2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14002d018]
xor rax, rbp
mov qword [rbp + 0x4b0], rax
lea rcx, [0x1400340f7]
call fcn.1400118ac
mov edx, 0x110
lea rcx, [rbp + 0x10]
call fcn.1400115e1
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
lea rdx, str.shellcode_hex.txt
lea rcx, [rbp + 0x10]
call fcn.1400117f8
nop
mov qword [rbp + 0x138], 0
lea rcx, [rbp + 0x158]
call fcn.140011898
nop
lea rcx, [rbp + 0x10]
call fcn.14001103c
movzx eax, al
test eax, eax
je 0x14001c9b6
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x1a0]
call fcn.1400115cd
mov edx, 1
lea rcx, [rbp + 0x1a0]
call fcn.140011721
nop
lea rcx, [rbp + 0x10]
call fcn.140011055
lea rcx, [rbp + 0x1b0]
mov rdx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
lea rdx, [rbp + 0x478]
lea rcx, [rbp + 0x1a0]
call fcn.140011811
mov qword [rbp + 0x4a8], rax
mov rdx, qword [rbp + 0x4a8]
lea rcx, [rbp + 0x158]
call fcn.140011253
lea rcx, [rbp + 0x478]
call fcn.14001119a
lea rcx, [rbp + 0x158]
call fcn.14001176c
xor edx, edx
mov ecx, 2
div rcx
mov qword [rbp + 0x138], rax
lea rcx, [rbp + 0x10]
call fcn.1400114a6
nop
lea rcx, [rbp + 0x1a0]
call fcn.14001118b
jmp 0x14001c9c2
lea rcx, [0x140027ff8]
call fcn.1400119a1
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x2b8], rax
mov r8d, dword [rbp + 0x138]
mov rdx, qword [rbp + 0x2b8]
lea rcx, [rbp + 0x158]
call fcn.1400114ba
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, qword [rbp + 0x138]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x2d8], rax
mov r8, qword [rbp + 0x138]
mov rdx, qword [rbp + 0x2b8]
mov rcx, qword [rbp + 0x2d8]
call fcn.1400113f2
call qword [rbp + 0x2d8]
nop
lea rcx, [rbp + 0x158]
call fcn.14001119a
nop
lea rcx, [rbp + 0x10]
call fcn.140011163
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x140027140]
call fcn.14001171c
mov eax, edi
mov rcx, qword [rbp + 0x4b0]
xor rcx, rbp
call fcn.1400113ed
lea rsp, [rbp + 0x4c8]
pop rdi
pop rbp
ret
Function at 0x1400115fa
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001fe10
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001fe30
xor al, al
jmp 0x14001feb1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001fe43
xor al, al
jmp 0x14001feb1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001fe6d
xor al, al
jmp 0x14001feb1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001fe81
xor al, al
jmp 0x14001feb1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001fe93
xor al, al
jmp 0x14001feb1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001feaf
xor al, al
jmp 0x14001feb1
mov al, 1
add rsp, 0x38
ret
Function at 0x14001188e
Capabilities:
Write file on windows

Disassembly:
jmp 0x140017150
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x14002d018]
xor rax, rbp
mov qword [rbp + 0x1a0], rax
lea rcx, [0x1400340f3]
call fcn.1400118ac
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x1400171b6
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400171bd
mov al, 1
jmp 0x140017317
call fcn.14001125d
mov rcx, qword [rbp + 0x1d0]
mov rcx, qword [rcx]
mov qword [rbp + 0x198], rcx
mov edx, eax
mov rcx, qword [rbp + 0x1d0]
mov rax, qword [rbp + 0x198]
call qword [rax + 0x18]
mov dword [rbp + 0x164], eax
call fcn.14001125d
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.14001173f
movzx eax, al
test eax, eax
je 0x140017218
xor al, al
jmp 0x140017317
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x1d0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0
je 0x14001727d
cmp dword [rbp + 0x194], 1
je 0x140017288
cmp dword [rbp + 0x194], 3
je 0x140017306
jmp 0x140017315
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x1400172d8
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x1400172d8
xor al, al
jmp 0x140017317
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400172f3
mov dword [rbp + 0x194], 1
jmp 0x1400172fd
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x140017317
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140017317
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140027850]
call fcn.14001171c
mov rax, rdi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rbp
call fcn.1400113ed
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x1400010dc
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_WerSetFlags]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
call fcn.1400019cc
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140001e04
mov ebx, dword [rsp + 0x20]
mov rdi, rax
dec ebx
je 0x14000351e
cmp ebx, 1
je 0x140003505
and dword [rsp + 0x20], 0
lea r8, [rsp + 0x20]
lea rdx, [rdi + 8]
mov ecx, ebx
call fcn.140001164
test al, al
je 0x14000352e
mov eax, dword [rsp + 0x20]
jmp 0x140001156
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax + 8]
lea rdx, str._private
call qword [sym.imp.MSVCR110_CLR0400.dll__wcsicmp]
test eax, eax
jne 0x140001133
test ebx, ebx
setg cl
call fcn.140006094
nop
jmp 0x140001133
lea rdx, [rdi + 8]
mov ecx, ebx
call fcn.140004d74
nop
jmp 0x140001156
Function at 0x140002270
Capabilities:
Hash data using djb2
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xa0], rax
or rbp, 0xffffffffffffffff
mov rbx, rcx
xor esi, esi
mov r8, rbp
inc r8
cmp word [rcx + r8*2], si
jne 0x1400022a5
mov eax, edx
neg eax
mov eax, 0x3f
sbb ecx, ecx
and ecx, 8
sub eax, ecx
cdqe
cmp r8, rax
ja 0x14000231e
mov edi, 0x40
test edx, edx
je 0x1400036b6
cmp dword [0x14001a170], esi
jne 0x140003667
lea r8, str.COMPlus_
lea rcx, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.MSVCR110_CLR0400.dll_wcscpy_s]
jmp 0x1400022f6
lea rcx, [rsp + 0x20]
mov r8, rbx
mov rdx, rdi
call qword [sym.imp.MSVCR110_CLR0400.dll_wcscat_s]
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
movsxd rdi, eax
test eax, eax
jne 0x14000234b
xor eax, eax
jmp 0x140002322
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140001680
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov eax, 2
mul rdi
cmovo rax, rbp
xor ecx, ecx
mov rdx, rax
call qword [0x14001a0c8]
mov rbx, rax
test rax, rax
je 0x14000237b
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rax, rbx
jmp 0x140002322
movzx ecx, word [rbx]
mov r8, rbx
mov edx, 0x1505
jmp 0x14000368c
lea eax, [rcx - 0x61]
cmp eax, 0x19
ja 0x14000367f
and ecx, 0xffffffdf
imul edx, edx, 0x21
xor edx, ecx
add r8, 2
movzx ecx, word [r8]
test ecx, ecx
jne 0x140003674
movzx ecx, dl
mov edx, ecx
mov eax, ecx
lea rcx, [0x14001a178]
shr rax, 5
and edx, 0x1f
mov eax, dword [rcx + rax*4]
bt eax, edx
jb 0x1400022df
jmp 0x14000231e
mov word [rsp + 0x20], si
jmp 0x1400022f6
Function at 0x140002420
Capabilities:
Terminate process

Disassembly:
movzx r9d, si
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400010dc
mov dword [0x14001a078], eax
cmp dword [0x14001a020], 0
jne 0x140003baa
mov ecx, eax
call qword [sym.imp.MSVCR110_CLR0400.dll_exit]
nop
jmp 0x140003baa
sub rsp, 0x28
call fcn.140001c48
add rsp, 0x28
jmp 0x140002430
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
and dword [rsp + 0x20], 0
call sub.MSVCR110_CLR0400.dll___crtGetShowWindowMode
movzx esi, ax
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 8]
xor ebx, ebx
xor eax, eax
lock cmpxchg qword [0x14001a238], rdx
jne 0x140003b44
mov eax, dword [0x14001a240]
cmp eax, 1
je 0x140003b58
mov eax, dword [0x14001a240]
test eax, eax
jne 0x140003b6f
mov dword [0x14001a240], 1
lea rdx, [0x1400105d0]
lea rcx, [0x1400105b0]
call sub.MSVCR110_CLR0400.dll__initterm_e
test eax, eax
jne 0x140003b65
mov eax, dword [0x14001a240]
cmp eax, 1
jne 0x1400024d6
lea rdx, [0x1400105a8]
lea rcx, [0x140010550]
call fcn.14016f000
mov dword [0x14001a240], 2
test ebx, ebx
jne 0x1400024e3
xor eax, eax
xchg qword [0x14001a238], rax
cmp qword [0x14001a258], 0
jne 0x140003b7e
mov rax, qword [sym.imp.MSVCR110_CLR0400.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
cmp byte [rbx], 0x20
jbe 0x14000252d
cmp byte [rbx], 0x22
je 0x140003bc1
movzx ecx, byte [rbx]
call qword [sym.imp.MSVCR110_CLR0400.dll__ismbblead]
test eax, eax
jne 0x140003bd3
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x140002504
cmp byte [rbx], 0
je 0x140002536
test edi, edi
jne 0x140002509
mov al, byte [rbx]
dec al
cmp al, 0x1f
ja 0x1400010a6
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x140002536
cmp rax, rdx
jne 0x140003b53
mov ebx, 1
jmp 0x14000246c
jmp 0x14000245b
lea ecx, [rax + 0x1e]
call sub.MSVCR110_CLR0400.dll__amsg_exit
jmp 0x1400024ae
mov eax, 0xff
jmp 0x140003c0d
mov dword [0x14001a3b4], 1
jmp 0x1400024ae
lea rcx, [0x14001a258]
call fcn.14000da50
test eax, eax
je 0x1400024f1
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14001a258]
call rax
nop
jmp 0x1400024f1
cmp dword [0x14001a3b4], 0
jne 0x140003bbf
call qword [sym.imp.MSVCR110_CLR0400.dll__cexit]
mov eax, dword [0x14001a078]
jmp 0x140003c0d
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
jmp 0x140002512
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x140002523
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140002ad0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov dword [rax + 0x20], r9d
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov esi, dword [rbp + 0x50]
and qword [rbp - 0x28], 0
and dword [rbp + 0x48], 0
mov rbx, r8
mov r14, rdx
mov r12, rcx
mov dword [rbp - 0x30], 4
test sil, 1
je 0x140002b29
mov edx, dword [rbp + 0x58]
call fcn.140002270
mov rdi, rax
test rax, rax
jne 0x1400036c0
test sil, 0xe
je 0x140002c1b
mov rcx, r12
call fcn.140002c44
test eax, eax
je 0x140002c1b
mov r13d, 0x20019
test sil, 2
je 0x140002b96
mov rcx, qword [0x14001a0d0]
xor edi, edi
mov qword [rbp - 0x20], rcx
cmp rcx, 0xffffffffffffffff
jne 0x14000371d
lea rax, [rbp - 0x20]
lea rdx, str.SoftwareMicrosoft.NETFramework
mov r9d, r13d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, 1
test eax, eax
je 0x140003719
test sil, 4
je 0x140002c1b
mov rcx, qword [0x14001a0d8]
xor edi, edi
mov qword [rbp - 0x18], rcx
cmp rcx, 0xffffffffffffffff
jne 0x140002bdf
lea rax, [rbp - 0x18]
lea rdx, str.SoftwareMicrosoft.NETFramework
mov r9d, r13d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, 1
test eax, eax
jne 0x140002c1b
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x30]
lea r9, [rbp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x28]
mov rdx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rsi, eax
test edi, edi
je 0x140002c12
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rsi, rsi
je 0x14000376c
mov qword [rbx], r14
mov eax, 0x80004005
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.MSVCR110_CLR0400.dll__errno]
lea rdx, [rbp - 0x10]
mov r8d, 0x10
and dword [rax], 0
mov rcx, rdi
call qword [sym.imp.MSVCR110_CLR0400.dll_wcstoul]
mov r13d, eax
call qword [sym.imp.MSVCR110_CLR0400.dll__errno]
cmp dword [rax], 0x22
je 0x1400036f8
cmp qword [rbp - 0x10], rdi
je 0x1400036f8
mov r15d, 1
jmp 0x1400036fb
xor r15d, r15d
mov rdx, rdi
xor ecx, ecx
call qword [0x14001a008]
test r15d, r15d
je 0x140002b29
mov qword [rbx], r13
xor eax, eax
jmp 0x140002c23
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x30]
lea r9, [rbp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x28]
mov rdx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd r15, eax
test edi, edi
je 0x140003750
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15, r15
jne 0x140002b96
cmp dword [rbp + 0x48], 4
jne 0x140002b96
mov rax, qword [rbp - 0x28]
mov qword [rbx], rax
jmp 0x140003712
cmp dword [rbp + 0x48], 4
jne 0x140002c1b
jmp 0x140003763
Function at 0x140002c44
Capabilities:
Hash data using djb2

Disassembly:
xor r8d, r8d
mov r9, rcx
cmp dword [0x14001a174], r8d
jne 0x1400039f4
mov r8d, 1
mov eax, r8d
ret
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r8w
jne 0x1400039f8
cmp rax, 0x50
ja 0x140002c57
movzx ecx, word [rcx]
mov edx, 0x1505
jmp 0x140003a2e
lea eax, [rcx - 0x61]
cmp eax, 0x19
ja 0x140003a21
and ecx, 0xffffffdf
imul edx, edx, 0x21
xor edx, ecx
add r9, 2
movzx ecx, word [r9]
test ecx, ecx
jne 0x140003a16
movzx ecx, dl
mov edx, ecx
mov eax, ecx
lea rcx, [0x14001a198]
shr rax, 5
and edx, 0x1f
mov eax, dword [rcx + rax*4]
bt eax, edx
jb 0x140002c57
jmp 0x140002c5d

Function at 0x140003d60
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
mov eax, 0x2048
call fcn.140002e90
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2030], rax
lea rax, [rsp + 0x2058]
mov r9, rcx
lea rcx, [rsp + 0x30]
or r8, 0xffffffffffffffff
mov edx, 0x1000
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCR110_CLR0400.dll__vsnwprintf_s]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140003dcd
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x140003df9
call qword [sym.imp.MSVCR110_CLR0400.dll___iob_func]
lea r8, [rsp + 0x30]
lea rdx, [0x140010ca0]
lea rcx, [rax + 0x30]
call qword [sym.imp.MSVCR110_CLR0400.dll_fwprintf]
call qword [sym.imp.MSVCR110_CLR0400.dll___iob_func]
lea rcx, [rax + 0x30]
call qword [sym.imp.MSVCR110_CLR0400.dll_fflush]
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.140001680
add rsp, 0x2048
ret

Function at 0x140004fac
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbp
push rbx
lea rbp, [rax - 0x178]
sub rsp, 0x268
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x150], rax
xor ebx, ebx
cmp byte [0x14001b17c], bl
jne 0x14000500e
lea rcx, str.NGenServiceDebugLog
call fcn.140002a30
mov dword [0x14001b178], eax
mov byte [0x14001b17c], 1
jmp 0x140005014
mov eax, dword [0x14001b178]
test eax, eax
je 0x14000508c
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x34], 0x200
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 2
mov rax, qword [rsp + 0x40]
mov word [rax], bx
lea r8, [rbp + 0x188]
mov rdx, qword [rbp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.14000a290
lea rcx, [rsp + 0x30]
call fcn.140009680
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
test byte [rsp + 0x38], 8
je 0x14000508c
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x14000508c
xor ecx, ecx
call qword [0x14001a008]
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140001680
add rsp, 0x268
pop rbx
pop rbp
ret
Function at 0x140005be4
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x48
call fcn.1400050a8
and qword [rsp + 0x30], 0
and qword [rsp + 0x38], 0
mov qword [rsp + 0x20], rax
lea rax, [0x140005b34]
lea rcx, str.Calling_StartServiceCtrlDispatcher_n
mov qword [rsp + 0x28], rax
call fcn.140004fac
mov rax, qword [0x14001a960]
test rax, rax
jne 0x140005c71
cmp byte [0x14001a94f], al
jne 0x140005c6d
lea rcx, str.advapi32.dll
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
je 0x140005c5a
lea rdx, str.StartServiceCtrlDispatcherW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001a960], rax
jmp 0x140005c61
mov rax, qword [0x14001a960]
mov byte [0x14001a94f], 1
test rax, rax
jne 0x140005c71
xor eax, eax
jmp 0x140005c78
lea rcx, [rsp + 0x20]
call rax
test eax, eax
jne 0x140005c92
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.StartServiceCtrlDispatcher_failed_with_error__d.__Will_try_slow_path_n
mov edx, eax
call fcn.140004fac
jmp 0x140005caf
lea rcx, str.StartServiceCtrlDispatcher_done__exiting_n
call fcn.140004fac
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x48
ret

Function at 0x140005cb4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x178]
sub rsp, 0x270
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x44], 0x200
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 2
mov rax, qword [rsp + 0x50]
mov word [rax], di
lea rcx, [rsp + 0x40]
call fcn.140004484
lea rdx, str._ndpsetup.bat
lea rcx, [rsp + 0x40]
call fcn.140004140
lea rcx, [rsp + 0x40]
call fcn.140009680
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140005d75
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x30]
lea r8, str.Install
lea rdx, str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v4Client
call fcn.14000b8c0
lea ebx, [rdi + 1]
test eax, eax
je 0x140005d78
cmp dword [rsp + 0x30], ebx
jne 0x140005d78
mov bl, dil
test byte [rsp + 0x48], 8
je 0x140005d91
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x140005d91
xor ecx, ecx
call qword [0x14001a008]
mov al, bl
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140001680
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14000b8c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rdi
mov rbx, r9
mov rdi, r8
and qword [rbp - 0x18], 0
lea rax, [rbp - 0x18]
mov qword [r11 - 0x38], rax
mov r9d, 0x20019
call fcn.140006ff0
test eax, eax
jne 0x14000b951
mov dword [rbp + 0x30], 4
mov dword [rbp + 0x10], 4
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000b951
cmp dword [rbp + 0x30], 4
jne 0x14000b951
cmp dword [rbp + 0x10], 4
jne 0x14000b951
mov eax, dword [rbp - 0x20]
mov dword [rbx], eax
mov ebx, 1
jmp 0x14000b953
xor ebx, ebx
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14000b962
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x2244058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x22441df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x2244089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x224406f
add dl, dl
jne 0x2244096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x22440f6
xor eax, eax
add dl, dl
jne 0x22440a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x22441ad
add dl, dl
jne 0x22440b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x22440c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x22440d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x22440dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x22440ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x224407e
mov eax, 1
add dl, dl
jne 0x2244106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2244113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x22440fb
sub eax, ebx
mov ebx, 1
jne 0x224414c
mov ecx, 1
add dl, dl
jne 0x224412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x224413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x2244123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x224407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x2244168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x2244175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x224415d
cmp eax, 0x7d00
jae 0x224419b
cmp eax, 0x500
jb 0x2244196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x224407e
cmp eax, 0x7f
ja 0x224419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x224407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x22441d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x224407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14001a95c
Capabilities:
Hide graphical window

Disassembly:
mov r11, rsp
sub rsp, 0x68
and qword [r11 - 0x10], 0
mov rax, qword [0x1400e44b8]
lea rdx, str.488878_v3
mov qword [r11 - 0x18], rax
and qword [r11 - 0x20], 0
and qword [r11 - 0x28], 0
mov eax, 0x80000000
mov dword [rsp + 0x38], 0x64
mov dword [rsp + 0x30], 0x12c
mov dword [rsp + 0x28], eax
mov r9d, 0xcf0000
mov r8, rdx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
and qword [rsp + 0x58], 0
mov rcx, qword [0x1400e44b8]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x40], rax
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [0x1400ab2e0]
mov r9d, 0x50b008c4
xor r8d, r8d
xor ecx, ecx
mov qword [0x1400e4510], rax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, qword [0x1400e4510]
xor edx, edx
mov qword [0x1400e4508], rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400e4510]
xor edx, edx
add rsp, 0x68
jmp qword [sym.imp.USER32.dll_ShowWindow]