joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001d380
Capabilities:
Enumerate process modules

Disassembly:
push rdi
mov eax, 0x1280
call fcn.140020cb0
sub rsp, rax
mov rax, qword [0x14002c0b8]
xor rax, rsp
mov qword [rsp + 0x1270], rax
mov qword [rsp + 0x1030], 0
mov dword [rsp + 0x1024], 0
mov dword [rsp + 0x1028], 0
mov dword [rsp + 0x1020], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x1020]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea r8, [rsp + 0x1028]
mov edx, 0x1000
lea rcx, [rsp + 0x20]
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x14001d404
jmp 0x14001d58c
mov eax, dword [rsp + 0x1028]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rsp + 0x1024], eax
cmp dword [rsp + 0x1024], 0
jne 0x14001d42b
jmp 0x14001d58c
mov dword [rsp + 0x1038], 0
jmp 0x14001d449
mov eax, dword [rsp + 0x1038]
add eax, 1
mov dword [rsp + 0x1038], eax
mov eax, dword [rsp + 0x1024]
cmp dword [rsp + 0x1038], eax
jae 0x14001d582
xor eax, eax
mov word [rsp + 0x1050], ax
lea rdi, [rsp + 0x1052]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x1038]
mov r8d, dword [rsp + rax*4 + 0x20]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1030], rax
cmp qword [rsp + 0x1030], 0
je 0x14001d564
mov qword [rsp + 0x1260], 0
mov dword [rsp + 0x1268], 0
lea r9, [rsp + 0x1268]
mov r8d, 8
lea rdx, [rsp + 0x1260]
mov rcx, qword [rsp + 0x1030]
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x14001d509
mov r9d, 0x104
lea r8, [rsp + 0x1050]
mov rdx, qword [rsp + 0x1260]
mov rcx, qword [rsp + 0x1030]
call sub.PSAPI.DLL_GetModuleBaseNameW
lea rax, [rsp + 0x1050]
test rax, rax
je 0x14001d564
mov dword [rsp + 0x126c], 0
mov eax, dword [rsp + 0x1038]
lea rdx, [rsp + 0x126c]
mov ecx, dword [rsp + rax*4 + 0x20]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x1050]
call fcn.1400077ac
test eax, eax
jne 0x14001d564
mov eax, dword [rsp + 0x1020]
cmp dword [rsp + 0x126c], eax
jne 0x14001d564
jmp 0x14001d582
cmp qword [rsp + 0x1030], 0
je 0x14001d57d
mov rcx, qword [rsp + 0x1030]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001d438
xor eax, eax
test eax, eax
jne 0x14001d3e4
mov rax, qword [rsp + 0x1030]
mov rcx, qword [rsp + 0x1270]
xor rcx, rsp
call fcn.140006d50
add rsp, 0x1280
pop rdi
ret
Function at 0x14001d5c0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xce0
mov rax, qword [0x14002c0b8]
xor rax, rsp
mov qword [rsp + 0xcd8], rax
cmp qword [rsp + 0xcf0], 0
jne 0x14001d5f1
xor eax, eax
jmp 0x14001d887
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x280], 0x418
xor eax, eax
mov word [rsp + 0xab0], ax
lea rdi, [rsp + 0xab2]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0x54], 0x104
xor eax, eax
mov word [rsp + 0x70], ax
lea rdi, [rsp + 0x72]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0xcc4], 0x104
call fcn.14001d380
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x14001d670
jmp 0x14001d85d
lea r8, [rsp + 0x48]
mov edx, 8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14001d68e
jmp 0x14001d85d
lea rax, [rsp + 0x280]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x280]
lea r8, [rsp + 0x290]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14001d6c4
jmp 0x14001d85d
lea rax, [rsp + 0xcc0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xcc4]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
lea r8, [rsp + 0xab0]
mov rdx, qword [rsp + 0x290]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
jne 0x14001d70e
jmp 0x14001d85d
xor eax, eax
mov word [rsp + 0x6b0], ax
lea rdi, [rsp + 0x6b2]
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
mov r8d, 0x200
xor edx, edx
lea rcx, [rsp + 0x6b0]
call fcn.1400055b0
mov dword [rsp + 0x58], 0x200
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x6b0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea rcx, [rsp + 0xab0]
call fcn.140006f00
mov rdi, rax
lea rcx, [rsp + 0x70]
call fcn.140006f00
lea eax, [rdi + rax + 2]
mov dword [rsp + 0xcc8], eax
mov ecx, dword [rsp + 0xcc8]
mov eax, 2
mul rcx
mov rcx, rax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
call fcn.140006af8
mov qword [rsp + 0xcd0], rax
mov rcx, qword [rsp + 0xcf0]
mov rax, qword [rsp + 0xcd0]
mov qword [rcx], rax
mov r8d, dword [rsp + 0xcc8]
xor edx, edx
mov rcx, qword [rsp + 0xcf0]
mov rcx, qword [rcx]
call fcn.1400055b0
lea rdx, [0x140025bc4]
mov rcx, qword [rsp + 0xcf0]
mov rcx, qword [rcx]
call fcn.140007abc
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x6b0]
call fcn.1400077ac
test eax, eax
je 0x14001d833
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0xcf0]
mov rcx, qword [rcx]
call fcn.140007abc
lea rdx, [0x140025bfc]
mov rcx, qword [rsp + 0xcf0]
mov rcx, qword [rcx]
call fcn.140007a90
lea rdx, [rsp + 0xab0]
mov rcx, qword [rsp + 0xcf0]
mov rcx, qword [rcx]
call fcn.140007a90
mov dword [rsp + 0x50], 1
xor eax, eax
test eax, eax
jne 0x14001d60b
cmp qword [rsp + 0x40], 0
je 0x14001d870
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x48], 0
je 0x14001d883
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0xcd8]
xor rcx, rsp
call fcn.140006d50
add rsp, 0xce0
pop rdi
ret
Function at 0x14001d8b0
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x320
mov rax, qword [0x14002c0b8]
xor rax, rsp
mov qword [rsp + 0x310], rax
cmp qword [rsp + 0x330], 0
jne 0x14001d8e1
xor eax, eax
jmp 0x14001da83
xor eax, eax
mov word [rsp + 0x60], ax
lea rdi, [rsp + 0x62]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, 0x800
call fcn.140006af8
mov qword [rsp + 0x300], rax
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x270], rax
cmp qword [rsp + 0x270], 0
je 0x14001da7e
mov r8d, 0x400
xor edx, edx
mov rcx, qword [rsp + 0x270]
call fcn.1400055b0
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x270]
call fcn.140007abc
lea rdx, str.wbemmofcomp.exe__
mov rcx, qword [rsp + 0x270]
call fcn.140007a90
mov rdx, qword [rsp + 0x330]
mov rcx, qword [rsp + 0x270]
call fcn.140007a90
lea rdx, [0x14002566c]
mov rcx, qword [rsp + 0x270]
call fcn.140007a90
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x290]
call fcn.140007030
mov dword [rsp + 0x290], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x278]
call fcn.140007030
lea rax, [rsp + 0x278]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x290]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x270]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14001da55
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x270]
mov qword [rsp + 0x308], rax
mov rcx, qword [rsp + 0x308]
call fcn.140007214
mov qword [rsp + 0x270], 0
mov eax, 1
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.140006d50
add rsp, 0x320
pop rdi
ret
Function at 0x14001dab0
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x320
mov rax, qword [0x14002c0b8]
xor rax, rsp
mov qword [rsp + 0x310], rax
cmp qword [rsp + 0x330], 0
je 0x14001daea
cmp qword [rsp + 0x338], 0
jne 0x14001daf1
xor eax, eax
jmp 0x14001dca8
xor eax, eax
mov word [rsp + 0x60], ax
lea rdi, [rsp + 0x62]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, 0x800
call fcn.140006af8
mov qword [rsp + 0x300], rax
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x270], rax
cmp qword [rsp + 0x270], 0
je 0x14001dca3
mov r8d, 0x400
xor edx, edx
mov rcx, qword [rsp + 0x270]
call fcn.1400055b0
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x270]
call fcn.140007abc
lea rdx, [0x140026078]
mov rcx, qword [rsp + 0x270]
call fcn.140007a90
mov rdx, qword [rsp + 0x330]
mov rcx, qword [rsp + 0x270]
call fcn.140007a90
mov rdx, qword [rsp + 0x338]
mov rcx, qword [rsp + 0x270]
call fcn.140007a90
lea rdx, [0x140025644]
mov rcx, qword [rsp + 0x270]
call fcn.140007a90
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x290]
call fcn.140007030
mov dword [rsp + 0x290], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x278]
call fcn.140007030
lea rax, [rsp + 0x278]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x290]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x270]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14001dc7a
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x270]
mov qword [rsp + 0x308], rax
mov rcx, qword [rsp + 0x308]
call fcn.140007214
mov qword [rsp + 0x270], 0
mov eax, 1
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.140006d50
add rsp, 0x320
pop rdi
ret
Function at 0x14001dcd0
Capabilities:
Delete file
Get common file path
Print debug messages
Write file on windows

Disassembly:
push rsi
push rdi
mov eax, 0x2648
call fcn.140020cb0
sub rsp, rax
mov rax, qword [0x14002c0b8]
xor rax, rsp
mov qword [rsp + 0x2630], rax
mov dword [rsp + 0x2278], 0
mov dword [rsp + 0x2054], 0x1000
lea rdi, [rsp + 0x2280]
lea rsi, str.pragma_namespace___._rootFaronics___r_npragma_deleteinstance____MethodProviderRegistration.provider._rootFaronics:Win32_ProviderEx.Name_Faronics_AEWmiProvider_2___FAIL__r_npragma_deleteinstance____InstanceProviderRegistration.provider._rootFaronics:Win32_ProviderEx.Name_Faronics_AEWmiProvider_2___FAIL__r_npragma_deleteinstance__Win32_ProviderEx.NameFaronics_AEWmiProvider_2__FAIL__r_npragma_deleteclass__AntiExecutable_v2__FAIL__r_n
mov ecx, 0x3a4
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x2050], 0x1000
lea rdx, [rsp + 0x50]
mov ecx, dword [rsp + 0x2050]
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rsp + 0x2060]
xor r8d, r8d
lea rdx, [0x140025ff8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rsp + 0x2060]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2270], rax
cmp qword [rsp + 0x2270], 0xffffffffffffffff
jne 0x14001ddb6
lea rcx, [0x140026000]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [rsp + 0x2278]
jmp 0x14001dea7
mov eax, 0xfeff
mov word [rsp + 0x44], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x2270]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x14001dde7
mov eax, dword [rsp + 0x2278]
jmp 0x14001dea7
mov rcx, qword [rsp + 0x2270]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14001de05
mov eax, dword [rsp + 0x2278]
jmp 0x14001dea7
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, 2
lea rdx, [rsp + 0x44]
mov rcx, qword [rsp + 0x2270]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001de69
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, 0x3a4
lea rdx, [rsp + 0x2280]
mov rcx, qword [rsp + 0x2270]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001de69
mov dword [rsp + 0x2278], 1
mov rcx, qword [rsp + 0x2270]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x2060]
call fcn.14001d8b0
mov dword [rsp + 0x2278], eax
lea rcx, [rsp + 0x2060]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rsp + 0x2278], eax
mov eax, dword [rsp + 0x2278]
mov rcx, qword [rsp + 0x2630]
xor rcx, rsp
call fcn.140006d50
add rsp, 0x2648
pop rdi
pop rsi
ret
Function at 0x14001df10
Capabilities:
Delete file
Set file attributes

Disassembly:
push rdi
sub rsp, 0x690
mov rax, qword [0x14002c0b8]
xor rax, rsp
mov qword [rsp + 0x688], rax
xor eax, eax
mov word [rsp + 0x30], ax
lea rdi, [rsp + 0x32]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x250], ax
lea rdi, [rsp + 0x252]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x470], ax
lea rdi, [rsp + 0x472]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea rdx, [rsp + 0x30]
lea rcx, str.AeFilter.sys
call fcn.14001c770
lea rdx, [rsp + 0x250]
lea rcx, str.AeKbd.sys
call fcn.14001c770
lea rdx, [rsp + 0x470]
lea rcx, str.AeMouse.sys
call fcn.14001c770
mov edx, 0x80
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 0x80
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 0x80
lea rcx, [rsp + 0x470]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [rsp + 0x240], 0
mov dword [rsp + 0x460], 0
mov dword [rsp + 0x680], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rsp + 0x240], eax
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rsp + 0x460], eax
lea rcx, [rsp + 0x470]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rsp + 0x680], eax
cmp dword [rsp + 0x240], 0
je 0x14001e06d
cmp dword [rsp + 0x460], 0
je 0x14001e06d
cmp dword [rsp + 0x680], 0
je 0x14001e06d
mov dword [rsp + 0x684], 1
jmp 0x14001e078
mov dword [rsp + 0x684], 0
mov al, byte [rsp + 0x684]
mov rcx, qword [rsp + 0x688]
xor rcx, rsp
call fcn.140006d50
add rsp, 0x690
pop rdi
ret
Function at 0x14001e0a0
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xcd0
mov rax, qword [0x14002c0b8]
xor rax, rsp
mov qword [rsp + 0xcc8], rax
cmp qword [rsp + 0xce0], 0
jne 0x14001e0d1
xor al, al
jmp 0x14001e31b
xor eax, eax
mov word [rsp + 0xab0], ax
lea rdi, [rsp + 0xab2]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x460], ax
lea rdi, [rsp + 0x462]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x240], ax
lea rdi, [rsp + 0x242]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x30], ax
lea rdi, [rsp + 0x32]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x670], ax
lea rdi, [rsp + 0x672]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x890], ax
lea rdi, [rsp + 0x892]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea r8, [rsp + 0xab0]
lea rdx, [0x1400272b8]
mov rcx, qword [rsp + 0xce0]
call fcn.14001c840
lea r8, [rsp + 0x460]
lea rdx, [0x1400272d8]
mov rcx, qword [rsp + 0xce0]
call fcn.14001c840
lea r8, [rsp + 0x240]
lea rdx, [0x1400272f0]
mov rcx, qword [rsp + 0xce0]
call fcn.14001c840
lea rdx, [rsp + 0x30]
lea rcx, [0x140027308]
call fcn.14001c770
lea rdx, [rsp + 0x670]
lea rcx, [0x140027328]
call fcn.14001c770
lea rdx, [rsp + 0x890]
lea rcx, [0x140027340]
call fcn.14001c770
mov dword [rsp + 0x450], 0
mov dword [rsp + 0x880], 0
mov dword [rsp + 0xaa0], 0
mov edx, 0x80
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 0x80
lea rcx, [rsp + 0x670]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 0x80
lea rcx, [rsp + 0x890]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x670]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x890]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xab0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [rsp + 0x450], eax
mov r8d, 1
lea rdx, [rsp + 0x670]
lea rcx, [rsp + 0x460]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [rsp + 0x880], eax
mov r8d, 1
lea rdx, [rsp + 0x890]
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [rsp + 0xaa0], eax
cmp dword [rsp + 0x450], 0
je 0x14001e309
cmp dword [rsp + 0x880], 0
je 0x14001e309
cmp dword [rsp + 0xaa0], 0
je 0x14001e309
mov dword [rsp + 0xcc0], 1
jmp 0x14001e314
mov dword [rsp + 0xcc0], 0
mov al, byte [rsp + 0xcc0]
mov rcx, qword [rsp + 0xcc8]
xor rcx, rsp
call fcn.140006d50
add rsp, 0xcd0
pop rdi
ret
Function at 0x14001e340
Capabilities:
Delete registry key
Delete service

Disassembly:
sub rsp, 0x58
call fcn.14001c8a0
movzx eax, al
test eax, eax
jne 0x14001e357
xor eax, eax
jmp 0x14001e455
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
mov byte [rsp + 0x28], 0
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001e38d
jmp 0x14001e3e4
mov r8d, 0xf01ff
lea rdx, [0x140027230]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14001e3b4
jmp 0x14001e3e4
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x14001e3cd
mov dword [rsp + 0x3c], 1
jmp 0x14001e3d5
mov dword [rsp + 0x3c], 0
movzx eax, byte [rsp + 0x3c]
mov byte [rsp + 0x28], al
xor eax, eax
test eax, eax
jne 0x14001e36e
movzx eax, byte [rsp + 0x28]
test eax, eax
je 0x14001e3f7
mov dword [rsp + 0x40], 0
jmp 0x14001e401
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x38], eax
cmp qword [rsp + 0x30], 0
je 0x14001e41c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp qword [rsp + 0x20], 0
je 0x14001e42f
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, 1
call fcn.14001cdd0
test eax, eax
je 0x14001e451
lea rdx, str.SOFTWAREAntiExecutable
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [rsp + 0x38]
add rsp, 0x58
ret

Function at 0x14001e7c0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x48
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call fcn.14001e460
test eax, eax
jne 0x14001e7e7
xor eax, eax
jmp 0x14001e81f
cmp qword [rsp + 0x20], 0
je 0x14001e7fe
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.140006d38
mov qword [rsp + 0x20], 0
mov eax, dword [rsp + 0x28]
add rsp, 0x48
ret
Function at 0x14001ead0
Capabilities:
Delete file
Get common file path

Disassembly:
push rdi
sub rsp, 0x8e0
mov qword [rsp + 0x8d0], 0xfffffffffffffffe
mov rax, qword [0x14002c0b8]
xor rax, rsp
mov qword [rsp + 0x8d8], rax
xor eax, eax
mov word [rsp + 0x40], ax
lea rdi, [rsp + 0x42]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2e
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x14001eb34
xor eax, eax
jmp 0x14001ec8d
mov dword [rsp + 0x8a0], 0xc
lea rax, str.AE.log
mov qword [rsp + 0x840], rax
lea rax, str.AE.log.bak
mov qword [rsp + 0x848], rax
lea rax, str.TEM.LOG
mov qword [rsp + 0x850], rax
lea rax, str.TEM.LOG1.bak
mov qword [rsp + 0x858], rax
lea rax, str.TEM.LOG2.bak
mov qword [rsp + 0x860], rax
lea rax, str.TEM.LOG3.bak
mov qword [rsp + 0x868], rax
lea rax, str.TEM.LOG4.bak
mov qword [rsp + 0x870], rax
lea rax, str.TEM.LOG5.bak
mov qword [rsp + 0x878], rax
lea rax, str.TEM.LOG6.bak
mov qword [rsp + 0x880], rax
lea rax, str.TEM.LOG7.bak
mov qword [rsp + 0x888], rax
lea rax, str.TEM.LOG8.bak
mov qword [rsp + 0x890], rax
lea rax, str.TEM.LOG9.bak
mov qword [rsp + 0x898], rax
mov dword [rsp + 0x8a4], 0
jmp 0x14001ec11
mov eax, dword [rsp + 0x8a4]
add eax, 1
mov dword [rsp + 0x8a4], eax
cmp dword [rsp + 0x8a4], 0xc
jge 0x14001ec88
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x8a8]
call fcn.140003730
nop
lea rdx, [0x140025ff4]
lea rcx, [rsp + 0x8a8]
call fcn.1400037b0
movsxd rdx, dword [rsp + 0x8a4]
mov rdx, qword [rsp + rdx*8 + 0x840]
lea rcx, [rsp + 0x8a8]
call fcn.1400037b0
lea rcx, [rsp + 0x8a8]
call fcn.1400037e0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rsp + 0x8a8]
call fcn.140003790
jmp 0x14001ec00
mov eax, 1
mov rcx, qword [rsp + 0x8d8]
xor rcx, rsp
call fcn.140006d50
add rsp, 0x8e0
pop rdi
ret
Function at 0x14001fa80
Capabilities:
Create service
Persist via windows service

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x340
mov qword [rsp + 0x300], 0xfffffffffffffffe
mov rax, qword [0x14002c0b8]
xor rax, rsp
mov qword [rsp + 0x330], rax
cmp qword [rsp + 0x350], 0
jne 0x14001fabd
xor eax, eax
jmp 0x14001fd0d
call fcn.14001c8a0
movzx eax, al
test eax, eax
je 0x14001fad0
xor eax, eax
jmp 0x14001fd0d
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x70], 0
mov byte [rsp + 0x78], 0
xor eax, eax
mov word [rsp + 0xa0], ax
lea rdi, [rsp + 0xa2]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov rdx, qword [rsp + 0x350]
lea rcx, [rsp + 0xa0]
call fcn.140004d50
lea rdx, str.aeengine.exe
lea rcx, [rsp + 0xa0]
call fcn.140007a90
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
jne 0x14001fb50
jmp 0x14001fc93
mov r8w, 0x800
mov edx, 0x69
lea rcx, [rsp + 0x2b0]
call fcn.140020b90
mov qword [rsp + 0x308], rax
mov rax, qword [rsp + 0x308]
mov qword [rsp + 0x310], rax
mov r8w, 0x800
mov edx, 0x68
lea rcx, [rsp + 0x2d8]
call fcn.140020b90
mov qword [rsp + 0x318], rax
mov rax, qword [rsp + 0x318]
mov qword [rsp + 0x320], rax
mov rcx, qword [rsp + 0x310]
call fcn.1400037e0
mov rdi, rax
mov rcx, qword [rsp + 0x320]
call fcn.1400037e0
mov r8, rax
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
lea rax, str.winmgmt
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
mov r9d, 0xf01ff
lea rdx, [0x140026ed0]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x2d8]
call fcn.140003790
nop
lea rcx, [rsp + 0x2b0]
call fcn.140003790
cmp qword [rsp + 0x80], 0
je 0x14001fc72
mov dword [rsp + 0x328], 1
jmp 0x14001fc7d
mov dword [rsp + 0x328], 0
movzx eax, byte [rsp + 0x328]
mov byte [rsp + 0x78], al
xor eax, eax
test eax, eax
jne 0x14001faea
movzx eax, byte [rsp + 0x78]
test eax, eax
je 0x14001fca9
mov dword [rsp + 0x32c], 0
jmp 0x14001fcb6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x32c], eax
mov eax, dword [rsp + 0x32c]
mov dword [rsp + 0x88], eax
movzx eax, byte [rsp + 0x78]
test eax, eax
je 0x14001fcda
lea rcx, [rsp + 0x80]
call fcn.14001ca60
cmp qword [rsp + 0x70], 0
je 0x14001fced
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp qword [rsp + 0x80], 0
je 0x14001fd06
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.140006d50
add rsp, 0x340
pop rdi
ret