joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c770
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r15
sub rsp, 0xd0
mov r15d, r8d
mov rsi, rdx
mov edi, ecx
xor ebp, ebp
xor edx, edx
lea rcx, [rax - 0x74]
or r15d, 0x10
lea r8d, [rbp + 0x64]
call fcn.1400c5520
mov dword [rsp + 0x60], SQLExecDirectW
cmp qword [rsp + 0x120], rbp
je 0x14000c7c5
mov rbx, qword [rsp + 0x120]
jmp 0x14000c7df
mov edx, reloc.ODBC32.dll_SQLAllocHandle
lea ecx, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x14000c90f
mov rcx, rsi
call fcn.1400c9ff8
mov rsi, rax
test rax, rax
je 0x14000c90f
test edi, edi
je 0x14000c892
sub edi, 1
je 0x14000c859
cmp edi, 1
jne 0x14000c8f3
mov r9d, dword [rsp + 0x100]
lea rax, [rsp + 0x60]
mov r8, qword [rsp + 0x118]
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rax
and qword [rsp + 0x40], rbp
and qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], rsi
and qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
jmp 0x14000c8c5
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
xor r9d, r9d
and qword [rsp + 0x40], rbp
mov r8, rsi
and qword [rsp + 0x38], rbp
xor edx, edx
mov dword [rsp + 0x30], r15d
xor ecx, ecx
and dword [rsp + 0x28], ebp
and qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x14000c8c5
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
xor r9d, r9d
and qword [rsp + 0x38], rbp
xor r8d, r8d
and qword [rsp + 0x30], rbp
mov rdx, rsi
mov dword [rsp + 0x28], r15d
xor ecx, ecx
and dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, eax
test eax, eax
je 0x14000c8f3
cmp dword [rsp + 0x128], 0
jne 0x14000c8e0
cmp qword [rsp + 0x120], 0
jne 0x14000c907
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x120], 0
jne 0x14000c907
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call fcn.1400ca07c
lea r11, [rsp + 0xd0]
mov eax, ebp
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x14000cf38
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x38]
sub rsp, 0x120
mov rbx, rcx
mov dword [rsp + 0x24], 0x60000
xor r15d, r15d
mov dword [rsp + 0x28], 0x860100aa
xor edx, edx
lea rcx, [rsp + 0x2c]
mov r8d, 0xf4
lea edi, [r15 + 1]
mov dword [rsp + 0x20], edi
call fcn.1400c5520
xor dl, dl
xor cl, cl
movzx eax, cl
add cl, dil
xor dl, byte [rsp + rax + 0x2a]
cmp cl, 2
jb 0x14000cf8b
lea rcx, [0x140102410]
mov byte [rsp + 0x2c], dl
mov byte [rsp + 0x2d], 0xbb
call fcn.14000b314
mov r8d, edi
lea rcx, [rsp + 0x20]
mov edx, reloc.Cabinet.dll_FCIDestroy
call fcn.1400115ec
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000b314
mov esi, 0xa
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r14d, 0x100
lea rdx, [rsp + 0x20]
mov r8d, r14d
mov rcx, rbx
call qword [sym.imp.HID.DLL_HidD_SetFeature]
test al, al
je 0x14000d133
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, r14d
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.HID.DLL_HidD_GetFeature]
test al, al
je 0x14000d133
cmp byte [rsp + 0x20], 3
jne 0x14000d133
movzx ebx, word [rsp + 0x26]
lea edx, [r14 - 0xe]
lea eax, [rbx - 6]
cmp ax, dx
ja 0x14000d133
lea rcx, [0x140102418]
call fcn.14000b314
lea edx, [rbx + 8]
mov r8d, edi
lea rcx, [rsp + 0x20]
call fcn.1400115ec
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000b314
sub bl, 6
cmp byte [rsp + 0x28], 0xaa
jne 0x14000d133
movzx eax, byte [rsp + 0x2a]
sub eax, edi
movzx edx, bl
cmp eax, edx
jne 0x14000d133
xor r8b, r8b
lea r9d, [rdx + 2]
xor cl, cl
test r9d, r9d
je 0x14000d0a3
movzx eax, cl
add cl, dil
xor r8b, byte [rsp + rax + 0x2a]
movzx eax, cl
cmp eax, r9d
jb 0x14000d090
cmp r8b, byte [rsp + rdx + 0x2c]
jne 0x14000d133
mov byte [rsp + rdx + 0x2d], 0xbb
movzx ecx, byte [rsp + 0x2b]
test ecx, ecx
je 0x14000d0e2
sub ecx, edi
je 0x14000d133
sub ecx, edi
je 0x14000d133
sub ecx, edi
je 0x14000d133
sub ecx, edi
je 0x14000d133
sub ecx, edi
je 0x14000d133
sub ecx, 2
je 0x14000d133
sub ecx, 3
je 0x14000d133
cmp ecx, 0xf5
jne 0x14000d133
mov rsi, qword [rbp + 0x60]
mov r15d, edi
test rsi, rsi
je 0x14000d133
mov rdi, qword [rbp + 0x68]
test rdi, rdi
je 0x14000d133
and qword [rsi], 0
mov byte [rdi], 0
test bl, bl
je 0x14000d133
movzx r14d, bl
mov ecx, 0x40
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x14000d130
mov r8d, r14d
lea rdx, [rsp + 0x2c]
mov rcx, rax
call fcn.1400c5960
mov byte [rdi], bl
jmp 0x14000d133
xor r15d, r15d
lea r11, [rsp + 0x120]
mov eax, r15d
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000d440
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov r14, rdx
mov esi, ecx
mov rdi, r9
mov ebp, r8d
lea edx, [rbx + 0x10]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x14000d5b9
mov dword [rax], esi
test esi, esi
je 0x14000d5b4
cmp esi, 1
jne 0x14000d5a9
lea edx, [rbx + 0x20]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, rax
mov rax, qword [rdi]
mov qword [rax + 8], rcx
mov rax, qword [rdi]
cmp qword [rax + 8], rbx
je 0x14000d5a5
mov eax, ebp
mov rcx, r14
neg eax
sbb r8d, r8d
and qword [rsp + 0x28], rbx
and dword [rsp + 0x20], ebx
and r8d, 2
add r8d, 2
xor r9d, r9d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdx, rax
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov qword [rcx], rdx
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov rcx, qword [rcx]
test rcx, rcx
je 0x14000d5a5
neg ebp
sbb edx, edx
and qword [rsp + 0x20], rbx
and edx, 0xfffffffe
xor r9d, r9d
add edx, 4
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdx, rax
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov qword [rcx + 8], rdx
mov rax, qword [rdi]
mov r8, qword [rax + 8]
mov rdx, qword [r8 + 8]
test rdx, rdx
je 0x14000d5a5
cmp dword [rdx], 0x66676572
mov rcx, rax
jne 0x14000d587
cmp dword [rdx + 0x1c], ebx
jne 0x14000d587
add rdx, 0x1000
cmp dword [rdx], 0x6e696268
jne 0x14000d587
mov qword [r8 + 0x10], rdx
movsxd rax, dword [rdx + 4]
add rdx, 0x20
add rdx, rax
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov qword [rcx + 0x18], rdx
mov rcx, qword [rdi]
mov rax, qword [rcx + 8]
mov rdx, qword [rax + 0x18]
mov eax, 0x6b6e
cmp word [rdx + 4], ax
jne 0x14000d583
test byte [rdx + 6], 0xc
je 0x14000d583
mov ebx, esi
test ebx, ebx
jne 0x14000d5b9
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x14000d5b9
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000d5b9
mov ebx, 1
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14000db90
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov r9d, dword [rcx]
xor edi, edi
mov r10, r8
mov r11, rdx
mov r14, rcx
test r9d, r9d
je 0x14000dc3d
cmp r9d, 1
jne 0x14000dc77
call fcn.14000da4c
test rax, rax
mov rcx, rax
setne dil
test rax, rax
je 0x14000dc77
mov ebx, dword [rax + 8]
mov rdx, qword [rsp + 0x60]
btr ebx, 0x1f
test rdx, rdx
je 0x14000dbf4
mov eax, dword [rax + 0x10]
mov dword [rdx], eax
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x14000dc77
mov r9, qword [rsp + 0x68]
test r9, r9
je 0x14000dc39
xor edi, edi
cmp dword [rsi], ebx
setae dil
jb 0x14000dc39
cmp dword [rcx + 8], 0
lea rdx, [rcx + 0xc]
jl 0x14000dc2e
mov rax, qword [r14 + 8]
movsxd rdx, dword [rdx]
mov rax, qword [rax + 0x10]
add rax, 4
add rdx, rax
mov r8d, ebx
mov rcx, r9
call fcn.1400c5960
mov dword [rsi], ebx
jmp 0x14000dc77
mov rax, qword [rsp + 0x70]
xor r8d, r8d
mov r9, qword [rsp + 0x60]
mov rdx, r10
mov qword [rsp + 0x28], rax
mov rcx, r11
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete dil
test eax, eax
je 0x14000dc77
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop r14
ret

Function at 0x14000dc90
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r9d, dword [rcx]
xor ebx, ebx
mov r10, r8
mov r11, rdx
mov rdi, rcx
test r9d, r9d
je 0x14000dd1e
cmp r9d, 1
jne 0x14000dd55
call fcn.14000da4c
mov rdx, rax
test rax, rax
je 0x14000dd55
mov ecx, dword [rax + 8]
mov r8d, ecx
mov r9d, dword [rsp + 0x70]
btr r8d, 0x1f
cmp r8d, r9d
setae bl
jb 0x14000dd17
mov eax, dword [rsp + 0x60]
and ecx, 0x80000000
or ecx, r9d
mov dword [rdx + 0x10], eax
mov dword [rdx + 8], ecx
lea rcx, [rdx + 0xc]
jl 0x14000dd0b
mov rax, qword [rdi + 8]
movsxd rcx, dword [rcx]
mov rax, qword [rax + 0x10]
add rax, 4
add rcx, rax
mov rdx, qword [rsp + 0x68]
call fcn.1400c5960
jmp 0x14000dd55
mov ecx, Ordinal_54
jmp 0x14000dd4f
mov eax, dword [rsp + 0x70]
xor r8d, r8d
mov r9d, dword [rsp + 0x60]
mov rdx, r10
mov dword [rsp + 0x28], eax
mov rcx, r11
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
test eax, eax
je 0x14000dd55
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14000dd64
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r10d, dword [rcx]
xor r12d, r12d
mov r14, qword [rsp + 0x80]
mov rsi, r9
mov r11d, r8d
mov rbp, rdx
mov edi, r12d
test r10d, r10d
je 0x14000dea0
cmp r10d, 1
jne 0x14000ded8
cmp dword [rdx + 0x18], r12d
je 0x14000ded8
cmp r11d, dword [rdx + 0x18]
jae 0x14000ded8
cmp dword [rdx + 0x20], 0xffffffff
je 0x14000ded8
mov rax, qword [rcx + 8]
movsxd rcx, dword [rdx + 0x20]
mov r8, qword [rax + 0x10]
mov eax, 0x666c
add rcx, r8
cmp word [rcx + 4], ax
je 0x14000ddf5
mov eax, 0x686c
cmp word [rcx + 4], ax
jne 0x14000ded8
cmp word [rcx + 6], r12w
je 0x14000ded8
movzx eax, word [rcx + 6]
cmp r11d, eax
jae 0x14000ded8
movsxd rdx, dword [rcx + r11*8 + 8]
mov eax, 0x6b6e
add rdx, r8
cmp word [rdx + 4], ax
jne 0x14000ded8
test rsi, rsi
je 0x14000ded8
test r14, r14
je 0x14000ded8
test byte [rdx + 6], 0x20
movzx ebx, word [rdx + 0x4c]
je 0x14000de76
cmp dword [r14], ebx
seta dil
jbe 0x14000de92
lea rcx, [rdx + 0x50]
mov edx, ebx
call fcn.1400113d4
mov rbp, rax
test rax, rax
je 0x14000de92
lea r8, [rbx + rbx]
mov rdx, rax
mov rcx, rsi
call fcn.1400c5960
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000de92
shr ebx, 1
cmp dword [r14], ebx
seta dil
jbe 0x14000de92
movzx r8d, word [rbp + 0x4c]
add rdx, 0x50
mov rcx, rsi
call fcn.1400c5960
test edi, edi
je 0x14000de9b
mov word [rsi + rbx*2], r12w
mov dword [r14], ebx
jmp 0x14000ded8
mov qword [rsp + 0x38], r12
mov r9, r14
mov qword [rsp + 0x30], r12
mov r8, rsi
mov qword [rsp + 0x28], r12
mov edx, r11d
mov rcx, rbp
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
sete dil
test eax, eax
je 0x14000ded8
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x14000defc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov r11d, r8d
mov r10, rdx
mov r12, r9
mov edx, dword [rcx]
mov ebx, r13d
test edx, edx
je 0x14000e0ad
cmp edx, 1
jne 0x14000e101
lea r15, [rcx + 8]
test r10, r10
jne 0x14000df4a
mov rax, qword [r15]
mov r10, qword [rax + 0x18]
mov eax, 0x6b6e
cmp word [r10 + 4], ax
jne 0x14000e101
cmp dword [r10 + 0x28], r13d
je 0x14000e101
cmp r11d, dword [r10 + 0x28]
jae 0x14000e101
cmp dword [r10 + 0x2c], 0xffffffff
je 0x14000e101
mov rax, qword [r15]
movsxd rcx, dword [r10 + 0x2c]
add rcx, qword [rax + 0x10]
movsxd rdi, dword [rcx + r11*4 + 4]
add rdi, qword [rax + 0x10]
mov eax, 0x6b76
cmp word [rdi + 4], ax
jne 0x14000e101
test r12, r12
je 0x14000e101
mov r14, qword [rsp + 0x90]
test r14, r14
je 0x14000e101
movzx eax, word [rdi + 6]
test ax, ax
je 0x14000e0a8
test byte [rdi + 0x14], 1
mov esi, eax
mov edx, eax
je 0x14000dfe2
lea rcx, [rdi + 0x18]
inc esi
call fcn.1400113d4
mov rbp, rax
test rax, rax
je 0x14000e036
jmp 0x14000e00e
shr esi, 1
add rdx, 2
mov ecx, 0x40
inc esi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
je 0x14000e036
movzx r8d, word [rdi + 6]
lea rdx, [rdi + 0x18]
mov rcx, rax
call fcn.1400c5960
cmp dword [r14], esi
setae bl
jb 0x14000e02d
mov r8d, esi
mov rdx, rbp
add r8, r8
mov rcx, r12
call fcn.1400c5960
lea eax, [rsi - 1]
mov dword [r14], eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x14000e101
mov esi, dword [rdi + 8]
mov rdx, qword [rsp + 0xa0]
btr esi, 0x1f
test rdx, rdx
je 0x14000e057
mov eax, dword [rdi + 0x10]
mov dword [rdx], eax
mov r14, qword [rsp + 0xb0]
test r14, r14
je 0x14000e101
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x14000e0a3
cmp dword [r14], esi
mov ebx, r13d
setae bl
jb 0x14000e0a3
lea rdx, [rdi + 0xc]
cmp dword [rdi + 8], r13d
jl 0x14000e09b
mov rax, qword [r15]
movsxd rdx, dword [rdx]
mov rax, qword [rax + 0x10]
add rax, 4
add rdx, rax
mov r8d, esi
call fcn.1400c5960
mov dword [r14], esi
jmp 0x14000e101
mov dword [r14], r13d
jmp 0x14000e101
mov rax, qword [rsp + 0xb0]
mov r8, r12
mov r9, qword [rsp + 0x90]
mov edx, r11d
mov qword [rsp + 0x38], rax
mov rcx, r10
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
sete bl
test eax, eax
je 0x14000e101
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000e868
Capabilities:
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x150
movzx edi, r9b
mov r15, r8
mov bl, dl
mov word [rsp + 0x30], 0x103
mov r14, rcx
xorps xmm0, xmm0
xor edx, edx
lea rcx, [rsp + 0x50]
lea eax, [rdi + 5]
mov r8d, 0x100
mov byte [rsp + 0x32], al
xor esi, esi
xor eax, eax
mov dword [rsp + 0x43], eax
mov byte [rsp + 0x47], al
movups xmmword [rsp + 0x33], xmm0
call fcn.1400c5520
cmp dil, 0x12
jae 0x14000ea58
mov r8d, edi
mov byte [rsp + 0x33], bl
mov rdx, r15
lea rcx, [rsp + 0x34]
call fcn.1400c5960
xor dl, dl
lea r8d, [rdi + 3]
xor cl, cl
test r8d, r8d
je 0x14000e903
movzx eax, cl
inc cl
xor dl, byte [rsp + rax + 0x31]
movzx eax, cl
cmp eax, r8d
jb 0x14000e8f2
mov byte [rsp + rdi + 0x34], dl
mov rcx, r14
mov edx, reloc.WLDAP32.dll_Ordinal_12
mov byte [rsp + rdi + 0x35], 4
call qword [sym.imp.KERNEL32.dll_PurgeComm]
mov edi, 0x64
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
and qword [rsp + 0x20], rsi
lea r9, [rbp + 0x88]
lea r8d, [rdi - 0x4c]
mov rcx, r14
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000ea58
cmp dword [rbp + 0x88], 0x18
jne 0x14000ea58
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ClearCommError]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
and qword [rsp + 0x20], rsi
lea r9, [rbp + 0x88]
mov r8d, 0x100
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000ea58
cmp dword [rbp + 0x88], 6
jb 0x14000ea58
cmp byte [rsp + 0x50], 5
jne 0x14000ea58
cmp byte [rsp + 0x51], 1
jne 0x14000ea58
mov cl, byte [rsp + 0x52]
cmp cl, 5
jb 0x14000ea58
or bl, 0x80
cmp byte [rsp + 0x53], bl
jne 0x14000ea58
sub cl, 5
xor r8b, r8b
movzx r10d, cl
xor dl, dl
lea r9d, [r10 + 3]
test r9d, r9d
je 0x14000e9fc
movzx eax, dl
inc dl
xor r8b, byte [rsp + rax + 0x51]
movzx eax, dl
cmp eax, r9d
jb 0x14000e9ea
cmp byte [rsp + r10 + 0x54], r8b
jne 0x14000ea58
cmp byte [rsp + r10 + 0x55], 4
jne 0x14000ea58
mov esi, 1
test cl, cl
je 0x14000ea58
mov rbx, qword [rbp + 0x90]
test rbx, rbx
je 0x14000ea58
mov rax, qword [rbp + 0x98]
test rax, rax
je 0x14000ea58
movzx edi, cl
mov byte [rax], cl
mov edx, edi
lea ecx, [rsi + 0x3f]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x14000ea56
mov r8d, edi
lea rdx, [rsp + 0x54]
mov rcx, rax
call fcn.1400c5960
jmp 0x14000ea58
xor esi, esi
lea r11, [rsp + 0x150]
mov eax, esi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000feac
Capabilities:
Encrypt data using rc4 via systemfunction033

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
mov rbx, rdx
lea rsi, str.1.2.840.113556.1.4.90
mov r14, rcx
xor edi, edi
mov rdx, qword [rsi]
lea r8, [rbp - 0x71]
lea r8, [r8 + rdi*4]
xor r9d, r9d
mov rcx, r14
call fcn.140010254
test eax, eax
je 0x1400100f5
inc edi
add rsi, 8
cmp edi, 8
jb 0x14000fed7
test rbx, rbx
je 0x1400100ee
cmp qword [rbx + 0x20], 0
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
je 0x1400100e2
xor r12d, r12d
cmp dword [rbx + 0x18], r12d
jbe 0x1400100e2
mov rax, qword [rbx + 0x20]
lea r14, [r12 + r12*2]
xor edx, edx
lea rcx, [rbp - 0x71]
mov r8d, dword [rax + r14*8]
cmp dword [rcx], r8d
je 0x14000ff50
inc edx
add rcx, 4
cmp edx, 8
jb 0x14000ff3b
jmp 0x1400100d0
cmp qword [rax + r14*8 + 0x10], 0
je 0x1400100d0
xor r15d, r15d
cmp dword [rax + r14*8 + 8], r15d
jbe 0x1400100d0
mov rsi, qword [rax + r14*8 + 0x10]
mov edi, r15d
add rdi, rdi
mov r13, qword [rsi + rdi*8 + 8]
mov qword [rbp + 0x77], r13
test r13, r13
je 0x1400100be
cmp qword [0x140138260], 0
lea rax, [rbp + 0xf]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x10
mov dword [rsp + 0x3c], 0x10
je 0x1400100f5
cmp dword [0x140138258], 0
je 0x1400100f5
cmp dword [rsi + rdi*8], 0x14
jb 0x1400100f5
lea rcx, [rbp - 0x49]
call qword [sym.imp.cryptdll.dll_MD5Init]
mov r8d, dword [0x140138258]
lea rcx, [rbp - 0x49]
mov rdx, qword [0x140138260]
call qword [sym.imp.cryptdll.dll_MD5Update]
mov r8d, 0x10
lea rcx, [rbp - 0x49]
mov rdx, r13
call qword [sym.imp.cryptdll.dll_MD5Update]
lea rcx, [rbp - 0x49]
call qword [sym.imp.cryptdll.dll_MD5Final]
mov eax, dword [rsi + rdi*8]
lea rdx, [rsp + 0x38]
sub eax, 0x10
lea rcx, [rsp + 0x48]
mov dword [rbp - 0x7d], eax
mov dword [rsp + 0x48], eax
lea rax, [r13 + 0x10]
mov qword [rbp + 0x7f], rax
mov qword [rbp - 0x79], rax
call qword [sym.imp.ADVAPI32.dll_SystemFunction033]
test eax, eax
js 0x1400100f5
mov r13d, dword [rsi + rdi*8]
lea r9, [rbp + 0x6f]
mov rax, qword [rbp + 0x77]
sub r13d, 0x14
add rax, 0x14
mov dword [rsp + 0x20], 4
mov r8d, r13d
mov qword [rbp + 0x77], rax
mov rdx, rax
mov ecx, 0x8000
call fcn.140003560
test eax, eax
je 0x1400100f5
mov rax, qword [rbp + 0x7f]
mov eax, dword [rax]
cmp dword [rbp + 0x6f], eax
jne 0x1400100f5
mov rax, qword [rsi + rdi*8 + 8]
mov ecx, 0x40
mov edx, r13d
mov qword [rbp + 0x7f], rax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi + rdi*8 + 8], rax
test rax, rax
je 0x1400100f5
mov rdx, qword [rbp + 0x77]
mov rcx, rax
mov r8d, r13d
call fcn.1400c5960
mov rax, qword [rbp + 0x7f]
mov dword [rsi + rdi*8], r13d
test rax, rax
je 0x1400100be
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rbx + 0x20]
inc r15d
cmp r15d, dword [rax + r14*8 + 8]
jb 0x14000ff6a
inc r12d
cmp r12d, dword [rbx + 0x18]
jb 0x14000ff29
mov rax, qword [rsp + 0x30]
mov rbx, rax
test rax, rax
jne 0x14000ff09
mov eax, 1
jmp 0x1400100f7
xor eax, eax
mov rbx, qword [rsp + reloc.WLDAP32.dll_Ordinal_304]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140010cb0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbp, rdx
mov rsi, rcx
xor ebx, ebx
lea rdx, str.ServicesActive
xor ecx, ecx
lea r8d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140010d2f
lea r8d, [rbx + 4]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x140010d26
lea rax, [rsp + 0x50]
mov r8, rbp
lea r9d, [rbx + 0x24]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140010dc4
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rdx, str.ServicesActive
xor ebx, ebx
xor ecx, ecx
lea r8d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x140010e2a
mov r8d, 0x10000
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x140010e21
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret