joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001517c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.1400096dc
xor ebx, ebx
mov rdi, rax
cmp qword [0x14002ead8], rbx
jne 0x140015282
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140015357
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140015357
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14002ead8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14002eae0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14002eae8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14002eaf8], rax
test rax, rax
je 0x140015279
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14002eaf0], rax
jmp 0x140015289
mov rax, qword [0x14002eaf0]
jmp 0x140015290
mov rax, qword [0x14002eaf0]
mov r11, qword [0x14002eaf8]
cmp rax, rdi
je 0x1400152f8
cmp r11, rdi
je 0x1400152f8
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14002eaf8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1400152f8
test rax, rax
je 0x1400152f8
call rsi
test rax, rax
je 0x1400152f2
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400152f2
test byte [rsp + 0x38], 1
jne 0x1400152f8
bts ebp, 0x15
jmp 0x140015336
mov rcx, qword [0x14002eae0]
cmp rcx, rdi
je 0x140015336
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140015336
call rax
mov rbx, rax
test rax, rax
je 0x140015336
mov rcx, qword [0x14002eae8]
cmp rcx, rdi
je 0x140015336
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140015336
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14002ead8]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140015357
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140015359
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400199d0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x50], 0
jne 0x1400199ea
xor eax, eax
jmp 0x140019a63
mov rax, qword [rsp + 0x58]
mov dword [rax], 0
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xffffffff
jne 0x140019a11
xor eax, eax
jmp 0x140019a63
mov eax, dword [rsp + 0x28]
add rax, 2
mov dword [rsp + 0x28], eax
mov ecx, dword [rsp + 0x28]
call fcn.140006af8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140019a41
xor eax, eax
jmp 0x140019a63
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov rcx, qword [rsp + 0x20]
call fcn.140007030
mov r11, qword [rsp + 0x58]
mov eax, dword [rsp + 0x28]
mov dword [r11], eax
mov rax, qword [rsp + 0x20]
add rsp, 0x48
ret

Function at 0x140019ac0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x58], 0
je 0x140019aed
mov rax, qword [rsp + 0x60]
cmp dword [rax], 0
je 0x140019aed
cmp qword [rsp + 0x50], 0
jne 0x140019af4
xor al, al
jmp 0x140019b95
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x34], 0
mov eax, 0xfeff
mov word [rsp + 0x30], ax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x140019b27
xor al, al
jmp 0x140019b95
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140019b3a
xor al, al
jmp 0x140019b95
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, 2
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140019b91
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov rax, qword [rsp + 0x60]
mov r8d, dword [rax]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140019b91
mov byte [rsp + 0x38], 1
mov al, byte [rsp + 0x38]
add rsp, 0x48
ret
Function at 0x140019ba0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x78], 0
je 0x140019bc3
cmp qword [rsp + 0x70], 0
jne 0x140019bca
xor al, al
jmp 0x140019d05
mov rax, qword [rsp + 0x78]
mov qword [rax], 0
mov qword [rsp + 0x38], 0
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x140019c13
xor al, al
jmp 0x140019d05
lea rdx, [rsp + 0x34]
mov rcx, qword [rsp + 0x70]
call fcn.1400199d0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140019c5b
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140019c5b
mov byte [rsp + 0x40], 1
cmp dword [rsp + 0x30], 4
jbe 0x140019c9a
movzx eax, byte [rsp + 0x40]
test eax, eax
je 0x140019c9a
mov rcx, qword [rsp + 0x38]
add rcx, 2
mov rax, qword [rsp + 0x78]
mov qword [rax], rcx
cmp qword [rsp + 0x80], 0
je 0x140019c98
mov ecx, dword [rsp + 0x30]
sub ecx, 2
mov rax, qword [rsp + 0x80]
mov dword [rax], ecx
jmp 0x140019ce4
cmp qword [rsp + 0x38], 0
je 0x140019ce4
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.140007214
mov qword [rsp + 0x38], 0
mov rax, qword [rsp + 0x78]
mov qword [rax], 0
cmp qword [rsp + 0x80], 0
je 0x140019ce4
mov rax, qword [rsp + 0x80]
mov dword [rax], 0
mov rax, qword [rsp + 0x78]
cmp qword [rax], 0
je 0x140019cf9
mov dword [rsp + 0x50], 1
jmp 0x140019d01
mov dword [rsp + 0x50], 0
mov al, byte [rsp + 0x50]
add rsp, 0x68
ret

Function at 0x14001b4b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov word [rsp + 0x20], r9w
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x58], 0
je 0x14001b4d9
cmp qword [rsp + 0x60], 0
jne 0x14001b4e0
xor eax, eax
jmp 0x14001b591
movzx eax, word [rsp + 0x68]
cmp eax, 0xffff
jne 0x14001b4f8
movzx eax, word [0x14002ebe4]
mov word [rsp + 0x68], ax
movzx r9d, word [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14001b53a
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14001b546
xor eax, eax
jmp 0x14001b591
cmp qword [rsp + 0x70], 0
je 0x14001b55b
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x28]
mov qword [rcx], rax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14001b57c
xor eax, eax
jmp 0x14001b591
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x14001b8c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
cmp qword [rsp + 0x60], 0
jne 0x14001b8d8
xor eax, eax
jmp 0x14001b9f4
mov dword [rsp + 0x38], 0
mov ecx, 1
call fcn.14001b640
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x1400248c0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001b9e6
mov dword [rsp + 0x3c], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1400248f0]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x3c], 0
je 0x14001b9db
mov eax, dword [rsp + 0x3c]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, rax
add rcx, 1
mov eax, 2
mul rcx
mov rcx, rax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
call fcn.140006af8
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x14001b9db
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.AEConfigPath
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 3
call fcn.14001b640
mov eax, dword [rsp + 0x38]
add rsp, 0x58
ret
Function at 0x14001c0b0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
mov r9d, 1
lea r8, [0x140024970]
lea rdx, [0x1400249c8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14001c14e
mov dword [rsp + 0x20], 8
mov r9d, 1
lea r8, [0x1400249f0]
lea rdx, [0x140024a48]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14001c14e
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
lea r8, [0x140024a70]
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14001c14e
xor al, al
jmp 0x14001c23a
mov byte [rsp + 0x38], 0
lea r8, [rsp + 0x30]
mov edx, 2
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptGetUserKey]
test eax, eax
jne 0x14001c19b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x8009000d
jne 0x14001c199
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
jne 0x14001c197
jmp 0x14001c20e
jmp 0x14001c19b
jmp 0x14001c20e
cmp qword [rsp + 0x30], 0
je 0x14001c1b7
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
mov edx, 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptGetUserKey]
test eax, eax
jne 0x14001c1ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x8009000d
jne 0x14001c1fd
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
jne 0x14001c1fb
jmp 0x14001c20e
jmp 0x14001c1ff
jmp 0x14001c20e
mov byte [rsp + 0x38], 1
xor eax, eax
test eax, eax
jne 0x14001c153
cmp qword [rsp + 0x30], 0
je 0x14001c221
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp qword [rsp + 0x40], 0
je 0x14001c236
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, byte [rsp + 0x38]
add rsp, 0x58
ret
Function at 0x14001c2c0
Capabilities:
Contain obfuscated stackstrings
Encrypt data using des via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x14002c0b8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x14001c33b
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov dword [rsp + 0x34], eax
mov byte [rsp + 0x40], 0x2d
mov byte [rsp + 0x41], 0x34
mov byte [rsp + 0x42], 0x3f
mov byte [rsp + 0x43], 1
mov byte [rsp + 0x44], 0x7e
mov byte [rsp + 0x45], 0xc2
mov byte [rsp + 0x46], 0x78
mov byte [rsp + 0x47], 0x67
mov byte [rsp + 0x48], 0x60
mov byte [rsp + 0x49], 0x14
mov byte [rsp + 0x4a], 0xc
mov byte [rsp + 0x4b], 0xc8
mov byte [rsp + 0x4c], 0x54
mov byte [rsp + 0x4d], 0xb0
mov byte [rsp + 0x4e], 0xf8
mov byte [rsp + 0x4f], 0x1d
mov byte [rsp + 0x50], 0x4d
mov byte [rsp + 0x51], 0xfb
mov byte [rsp + 0x52], 0x33
mov byte [rsp + 0x53], 0x75
mov byte [rsp + 0x54], 0x9e
mov byte [rsp + 0x55], 0x25
mov byte [rsp + 0x56], 0xdc
mov byte [rsp + 0x57], 0x14
mov byte [rsp + 0x58], 0xc2
mov byte [rsp + 0x59], 0x36
mov byte [rsp + 0x5a], 0x33
mov byte [rsp + 0x5b], 0xfd
mov byte [rsp + 0x5c], 0x3b
mov byte [rsp + 0x5d], 0xbb
mov byte [rsp + 0x5e], 0x98
mov byte [rsp + 0x5f], 0x23
mov byte [rsp + 0x60], 0x26
mov byte [rsp + 0x61], 0xd5
mov byte [rsp + 0x62], 0xfd
mov byte [rsp + 0x63], 3
mov byte [rsp + 0x64], 0xdb
mov byte [rsp + 0x65], 0x2f
mov byte [rsp + 0x66], 0x88
mov byte [rsp + 0x67], 0xf6
mov dword [rsp + 0x30], 0x28
cmp dword [rsp + 0x34], 0
je 0x14001c434
xor r9d, r9d
mov r8d, dword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x88]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x14001c470
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x88]
mov r8, qword [r8]
mov edx, 0x6601
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140006d50
add rsp, 0x78
ret
Function at 0x14001c500
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0xb0
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.14001c2c0
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x14001c6c4
mov rcx, qword [rsp + 0xc0]
call fcn.140003710
add eax, 1
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
shl rax, 1
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x14001c6c4
mov eax, dword [rsp + 0x60]
cmp dword [rsp + 0x64], eax
jbe 0x14001c5da
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0xa0], eax
jmp 0x14001c5e5
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0xa0], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x78], eax
mov ecx, dword [rsp + 0x78]
call fcn.140006af8
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x70], rax
mov r8d, dword [rsp + 0x78]
xor edx, edx
mov rcx, qword [rsp + 0x70]
call fcn.140007030
mov ebx, dword [rsp + 0x64]
mov rcx, qword [rsp + 0xc0]
call fcn.1400066c0
mov edx, dword [rsp + 0x78]
mov r9, rbx
mov r8, rax
mov rcx, qword [rsp + 0x70]
call fcn.140006f1c
mov dword [rsp + 0x7c], eax
cmp dword [rsp + 0x7c], 0
jne 0x14001c6aa
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x14001c6aa
mov r8, qword [rsp + 0xc8]
mov edx, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
call fcn.14001c490
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x88]
call fcn.140007214
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x90], eax
mov rcx, qword [rsp + 0xc0]
call fcn.140003670
mov eax, dword [rsp + 0x90]
add rsp, 0xb0
pop rbx
ret
Function at 0x14001c770
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x250
mov rax, qword [0x14002c0b8]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp qword [rsp + 0x260], 0
je 0x14001c7aa
cmp qword [rsp + 0x268], 0
jne 0x14001c7ae
xor al, al
jmp 0x14001c818
xor eax, eax
mov word [rsp + 0x30], ax
lea rdi, [rsp + 0x32]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x14001c7db
xor al, al
jmp 0x14001c818
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x268]
call fcn.140007abc
lea rdx, str._system32drivers_
mov rcx, qword [rsp + 0x268]
call fcn.140007a90
mov rdx, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x268]
call fcn.140007a90
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140006d50
add rsp, 0x250
pop rdi
ret

Function at 0x14001c950
Capabilities:
Query service status

Disassembly:
sub rsp, 0x68
call fcn.14001c8a0
movzx eax, al
test eax, eax
jne 0x14001c967
xor eax, eax
jmp 0x14001ca50
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001c99b
jmp 0x14001ca1c
mov r8d, 0xf01ff
lea rdx, [0x140027218]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14001c9c2
jmp 0x14001ca1c
lea r8, [rsp + 0x38]
mov edx, 0xc9
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x14001ca12
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14001ca12
cmp dword [rsp + 0x3c], 3
jne 0x14001ca0e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001ca10
jmp 0x14001ca12
jmp 0x14001c9e6
xor eax, eax
test eax, eax
jne 0x14001c979
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
cmp qword [rsp + 0x28], 0
je 0x14001ca39
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp qword [rsp + 0x20], 0
je 0x14001ca4c
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [rsp + 0x30]
add rsp, 0x68
ret

Function at 0x14001ca60
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
jne 0x14001ca78
xor eax, eax
jmp 0x14001cad9
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x20]
mov edx, 2
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x14001cad4
xor eax, eax
jmp 0x14001cad9
mov eax, 1
add rsp, 0x58
ret
Function at 0x14001caf0
Capabilities:
Delete registry key
Manipulate safe mode programs

Disassembly:
sub rsp, 0x28
lea rdx, str.SYSTEMCurrentControlSetControlSafeBootMinimalAeFilter.sys
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, str.SYSTEMCurrentControlSetControlSafeBootMinimalAeKbd.sys
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, str.SYSTEMCurrentControlSetControlSafeBootMinimalAeMouse.sys
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, str.SYSTEMCurrentControlSetControlSafeBootMinimalAEEngine
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, str.SYSTEMCurrentControlSetControlSafeBootNetworkAeFilter.sys
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, str.SYSTEMCurrentControlSetControlSafeBootNetworkAeKbd.sys
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, str.SYSTEMCurrentControlSetControlSafeBootNetworkAeMouse.sys
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, str.SYSTEMCurrentControlSetControlSafeBootNetworkAEEngine
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, str.SoftwareFaronicsAntiExecutable
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
add rsp, 0x28
ret

Function at 0x14001cbc0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x50], 0
cmp qword [rsp + 0x88], 0
jne 0x14001cbf3
xor eax, eax
jmp 0x14001cc9f
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 6
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14001cc3d
xor eax, eax
jmp 0x14001cc9f
mov rcx, qword [rsp + 0x88]
call fcn.140006f00
lea rax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14001cc8f
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x14001cc9f
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x68
ret
Function at 0x14001ccb0
Capabilities:
Manipulate safe mode programs

Disassembly:
sub rsp, 0x28
lea r9, [0x140026560]
xor r8d, r8d
lea rdx, [0x140026570]
mov rcx, 0xffffffff80000002
call fcn.14001cbc0
lea r9, [0x1400265f0]
xor r8d, r8d
lea rdx, [0x140026600]
mov rcx, 0xffffffff80000002
call fcn.14001cbc0
lea r9, [0x140026678]
xor r8d, r8d
lea rdx, [0x140026690]
mov rcx, 0xffffffff80000002
call fcn.14001cbc0
lea r9, [0x140026710]
xor r8d, r8d
lea rdx, [0x140026720]
mov rcx, 0xffffffff80000002
call fcn.14001cbc0
lea r9, [0x140026798]
xor r8d, r8d
lea rdx, [0x1400267b0]
mov rcx, 0xffffffff80000002
call fcn.14001cbc0
lea r9, [0x140026830]
xor r8d, r8d
lea rdx, [0x140026840]
mov rcx, 0xffffffff80000002
call fcn.14001cbc0
lea r9, str.Driver
xor r8d, r8d
lea rdx, [0x1400268d0]
mov rcx, 0xffffffff80000002
call fcn.14001cbc0
lea r9, str.Service
xor r8d, r8d
lea rdx, [0x140026960]
mov rcx, 0xffffffff80000002
call fcn.14001cbc0
lea r9, [0x140025c44]
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetEnumRootLEGACY_AEENGINE
mov rcx, 0xffffffff80000002
call fcn.14001cbc0
mov eax, 1
add rsp, 0x28
ret