joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00415f40]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00415f50]
mov dword [rax], 1
mov rax, qword [0x00415f60]
mov dword [rax], 1
mov rax, qword [0x00415f30]
mov dword [rax], 1
mov rax, qword [0x00415e10]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x00415f20]
mov dword [0x00419008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x00415ed0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x00415da0]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x404290
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp - 8], 0
cmp qword [rbp + 0x18], 0
je 0x4042c0
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sym.nimCStrLen
mov rdx, rax
jmp 0x4042c5
mov edx, 0
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0
mov rcx, qword [rbp + 0x10]
call sym.fflush
mov dword [rbp - 0xc], eax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x40e107
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp - 8], 0
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0
mov rcx, qword [rbp + 0x10]
call sym.fflush
mov dword [rbp - 0xc], eax
nop
add rsp, 0x30
pop rbp
ret
Function at 0x40fc1c
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
lea rax, str.echoBinSafe
mov qword [rbp - 0x58], rax
lea rax, str.D:_nim_2.0.0_x64_nim_2.0.0lib_system.nim
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov word [rbp - 0x40], 0
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.nimFrame_5
call sym.nimErrorFlag_4
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x50], 0xac5
lea rax, [0x00419a60]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x50], 0xd
lea rax, str.D:_nim_2.0.0_x64_nim_2.0.0lib_systemiterators.nim
mov qword [rbp - 0x48], rax
mov qword [rbp - 8], 0
mov qword [rbp - 0x50], 0xe
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x18]
jge 0x40fdaa
mov qword [rbp - 0x50], 0xac6
lea rax, str.D:_nim_2.0.0_x64_nim_2.0.0lib_system.nim
mov qword [rbp - 0x48], rax
cmp qword [rbp - 8], 0
js 0x40fce0
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x18]
jl 0x40fcf9
mov rax, qword [rbp + 0x18]
lea rdx, [rax - 1]
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.raiseIndexError2
jmp 0x40fe38
mov rax, qword [rbp - 8]
shl rax, 4
mov rdx, rax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
mov rax, qword [rbp - 0x18]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rdx
lea rax, [rbp - 0x80]
mov r8d, 0
mov rdx, rax
call sym.writeWindows__system_u9025
mov rax, qword [rbp - 0x10]
movzx eax, byte [rax]
movzx eax, al
test eax, eax
jne 0x40fe37
mov qword [rbp - 0x50], 0x10
lea rax, str.D:_nim_2.0.0_x64_nim_2.0.0lib_systemiterators.nim
mov qword [rbp - 0x48], rax
mov edx, 0
mov rax, qword [rbp - 8]
add rax, 1
jno 0x40fd7e
mov edx, 1
mov rcx, rax
lea rax, [rbp - 0x68]
mov qword [rax], rcx
mov rax, rdx
and eax, 1
test al, al
je 0x40fd9d
call sym.raiseOverflow
nop
jmp 0x40fe38
mov rax, qword [rbp - 0x68]
mov qword [rbp - 8], rax
jmp 0x40fcae
nop
mov qword [rbp - 0x50], 0xae1
lea rax, str.D:_nim_2.0.0_x64_nim_2.0.0lib_system.nim
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x20], 0
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 1
mov edx, 1
lea rcx, [0x00415049]
call sym.fwrite
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x50], 0xae2
mov dword [rbp - 0x24], 0
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
call sym.fflush
mov dword [rbp - 0x24], eax
mov qword [rbp - 0x50], 0xae6
lea rax, [0x00419a60]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x40fe38
nop
call sym.popFrame_5
nop
add rsp, 0xa0
pop rbp
ret
Function at 0x411380
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00419644]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x411508
mov rax, qword [0x00419648]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x4113cc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x411455
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x4113b0
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x41153d
mov rax, qword [0x00419648]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00419648]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x411520
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x41144e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x4114b0
add dword [0x00419644], 1
cmp edi, 8
jae 0x411483
test dil, 4
jne 0x4114f4
test edi, edi
je 0x411478
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x41150f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x411478
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x41149c
jmp 0x411478
add rsi, qword [0x00419648]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x41144e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x411478
xor esi, esi
jmp 0x4113d7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x411478
mov rax, qword [0x00419648]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x411c90
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00419920]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00419900]
test rbx, rbx
je 0x411ce4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x411cdb
test rsi, rsi
je 0x411cdb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x411cc0
lea rcx, [0x00419920]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x411f20
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x411f30
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x411f40
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x411f81
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x411f78
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x411f83
add rax, 0x28
cmp rax, r9
jne 0x411f64
xor eax, eax
ret

Function at 0x412020
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00415e10]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x41208d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x41208d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x41208d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x412084
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x41208f
add rax, 0x28
cmp rax, r9
jne 0x412070
xor eax, eax
add rsp, 0x28
ret

Function at 0x412190
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00415e10]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x4121b0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x4121a8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x41220d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x412204
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x412214
add rax, 0x28
cmp rax, r9
jne 0x4121f0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x412230
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x00415e10]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x41229e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x41229e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x41229e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x41229e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x412295
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x4122a5
add rcx, 0x28
cmp rcx, rax
jne 0x412280
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x4122b8
jmp 0x41229e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x4122c6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x41229e
test r9d, r9d
jg 0x4122b0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x412400
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [global___mutex], 0xffffffff
mov r8d, 0xffff
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [0x00419988], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x412450
lea rdx, [dbg.emutls_destroy]
mov ecx, eax
mov dword [0x00419978], eax
call sym.__mingwthr_key_dtor
test eax, eax
jne 0x41245a
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41244b
call sym.abort
nop
Function at 0x412460
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x00415d90]
mov r11d, dword [rbx]
mov rdi, rcx
test r11d, r11d
jne 0x412494
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x4124f0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rsi, qword [rcx + 0x10]
test rsi, rsi
je 0x412500
mov ebx, dword [0x00419978]
mov r12, qword [sym.imp.KERNEL32.dll_GetLastError]
call r12
mov ebp, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebp
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x412571
mov rbp, qword [rbx]
cmp rbp, rsi
jb 0x4125b1
lea rbx, [rbx + rsi*8]
mov rax, qword [rbx]
test rax, rax
jne 0x412487
mov rcx, rdi
call dbg.emutls_alloc
mov qword [rbx], rax
jmp 0x412487
call dbg.emutls_alloc
mov qword [rdi + 0x10], rax
jmp 0x412487
mov r10d, dword [rbx]
test r10d, r10d
je 0x412612
mov r9d, dword [global_once]
test r9d, r9d
je 0x412640
lock add dword [0x00419980], 1
jne 0x412670
mov rsi, qword [rdi + 0x10]
test rsi, rsi
je 0x41261f
mov eax, dword [rbx]
test eax, eax
je 0x41249d
mov eax, 0xffffffff
lock xadd dword [0x00419980], eax
sub eax, 1
js 0x41249d
xor r8d, r8d
mov edx, 1
mov rcx, qword [0x00419988]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x41249d
lea rcx, [rsi + 0x21]
mov edx, 8
call sym.calloc
lea rbp, [rsi + 0x20]
test rax, rax
mov rbx, rax
je 0x412697
mov qword [rax], rbp
mov rdx, rbx
mov ecx, dword [0x00419978]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x4124d7
call r12
jmp 0x4124d7
lea r13, [rbp + rbp]
mov rcx, rbx
lea rax, [rsi + 0x20]
cmp rsi, r13
cmova r13, rax
lea rdx, [r13*8 + 8]
call sym.realloc
test rax, rax
mov rbx, rax
je 0x412697
mov qword [rax], r13
lea rcx, [rax + rbp*8 + 8]
sub r13, rbp
xor edx, edx
lea r8, [r13*8]
call sym.memset
jmp 0x412592
call dbg.emutls_init
mov dword [global_once], 1
mov edx, dword [rbx]
test edx, edx
jne 0x41251c
mov rsi, qword [rdi + 0x10]
test rsi, rsi
jne 0x41249d
mov rax, qword [0x00419970]
lea rsi, [rax + 1]
mov qword [0x00419970], rsi
mov qword [rdi + 0x10], rsi
jmp 0x412537
lock add dword [0x004137b4], 1
je 0x4125f9
mov r8d, dword [global_once]
lea rsi, [0x004137b0]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
test r8d, r8d
jne 0x412608
xor ecx, ecx
call rbp
mov ecx, dword [rsi]
test ecx, ecx
je 0x412664
jmp 0x412608
mov edx, 0xffffffff
mov rcx, qword [0x00419988]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41252a
lock sub dword [0x00419980], 1
jmp 0x41252a
call sym.abort
nop
nop dword [rax]
Function at 0x412960
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x100005df8
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov ebx, ecx
mov esi, 1
xor ecx, ecx
mov edx, esi
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov r11d, dword [0x10001ff20]
cmp ebx, 2
cmovge r11d, esi
lea rdx, [0x10001fd10]
mov r8d, 0x104
xor ecx, ecx
mov dword [0x10001ff20], r11d
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ebx, ebx
mov edi, ebx
mov ebp, ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x98]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [rsp + 0x98], esi
mov dword [rsp + 0x80], esi
mov r15, rax
jle 0x100005ecf
lea r14, [rax + 8]
mov r13, qword [r14]
cmp word [r13], 0x2f
je 0x100005e8e
cmp word [r13], 0x2d
jne 0x100005eca
mov r12d, ebx
mov rsi, rbx
lea rax, [0x100003a64]
mov edx, r12d
lea rcx, [r13 + 2]
imul rdx, rdx, 0x184
add rdx, rax
call fcn.10000ebc8
cmp eax, ebx
je 0x100005f4a
inc r12d
inc rsi
cmp r12d, 7
jb 0x100005e94
mov esi, 1
mov ebp, 0x80040903
cmp r15, rbx
je 0x100005edd
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp ebp, ebx
mov eax, 0x80000000
cmovl edi, eax
cmp edi, ebx
jne 0x100005f86
lea rcx, [0x100004500]
lea rax, [0x100006004]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
cmp eax, ebx
jne 0x100005fe3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x427
jne 0x100005f38
call fcn.100006070
movzx eax, di
or eax, 0x80070000
cmp edi, ebx
cmovle eax, edi
jmp 0x100005fe1
imul rsi, rsi, 0x184
lea rax, [0x100003a60]
add r14, 8
or edi, dword [rsi + rax]
mov eax, dword [rsp + 0x80]
mov esi, 1
add eax, esi
cmp eax, dword [rsp + 0x98]
mov dword [rsp + 0x80], eax
jge 0x100005ecf
jmp 0x100005e7b
bt edi, 0x1f
jae 0x100005f93
call fcn.100006070
jmp 0x100005fe1
test sil, dil
je 0x100005f9f
call fcn.100006188
jmp 0x100005fe1
test dil, 2
je 0x100005fac
call fcn.1000065e0
jmp 0x100005fe1
test edi, 0x70000000
je 0x100005fbb
call fcn.1000067a8
jmp 0x100005fe1
test dil, 4
je 0x100005fcf
lea rcx, [0x100004500]
call fcn.10000c084
jmp 0x100005fe1
test dil, 8
je 0x100005fe3
lea rcx, [0x100004500]
call fcn.10000bce4
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1000065e0
Capabilities:
Delete registry key
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
sub rsp, 0x280
mov rax, qword [0x10001d180]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
lea r12, [0x100004500]
mov rsi, rax
test rax, rax
jne 0x100006650
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100005ad8]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov edx, ebx
call fcn.10000ec98
jmp 0x1000066fb
mov r8d, 0x2c
mov rdx, r12
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x10000668e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100005b10]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov edx, ebx
call fcn.10000ec98
jmp 0x1000066e4
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x38]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1000066da
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000058f0]
mov rdx, r12
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.10000ec98
jmp 0x1000066e4
xor ebx, ebx
cmp dword [rsp + 0x3c], 1
setne bl
test rdi, rdi
je 0x1000066f2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x100006707
mov rcx, r12
call fcn.10000c084
mov rcx, r12
call fcn.10000ba50
mov ebx, eax
cmp eax, 0x80070424
je 0x10000671c
test eax, eax
jne 0x100006776
lea r9, [0x100004530]
lea r8, [0x1000050d0]
lea rcx, [rsp + 0x60]
mov edx, 0x104
mov qword [rsp + 0x20], r12
call fcn.100006b70
mov ebx, eax
test eax, eax
jne 0x100006776
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
je 0x100006776
movzx ebx, ax
lea rcx, [0x100005350]
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov edx, ebx
call fcn.10000ec98
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.10000e9b0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r12
ret
Function at 0x1000067a8
Capabilities:
Register raw input devices

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x10001d180]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r8d, dword [0x10001ff20]
lea r9, str.VEN_14F1REARLINEOUTWAVE
lea rdx, [0x100004500]
lea rcx, [rsp + 0xd0]
mov dword [rsp + 0x20], 2
call fcn.10000b204
mov ebx, 0x22
lea rcx, [rsp + 0x210]
lea rdx, [0x100004640]
mov r8, rbx
call fcn.100014160
lea rcx, [rsp + 0x238]
lea rdx, [0x100004640]
mov r8, rbx
call fcn.100014160
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edi, edi
mov edx, 0x7f00
mov rbx, rax
lea rax, [0x1000069d4]
xor ecx, ecx
mov dword [rsp + 0x70], 0x50
mov dword [rsp + 0x74], 3
mov dword [rsp + 0x80], edi
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x84], edi
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rdi
call qword [sym.imp.USER32.dll_LoadCursorW]
lea esi, [rdi + 6]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x210]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xb0], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov eax, 0x80000000
mov dword [rsp + 0x38], edi
lea r8, [rsp + 0x238]
mov dword [rsp + 0x30], eax
lea rdx, [rsp + 0x210]
mov r9d, 0xcf0000
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
lea r8, [rsp + 0xd0]
lea edx, [rdi - 0x15]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
lea edi, [rsi - 5]
lea r8d, [rsi + 0xa]
lea rcx, [rsp + 0x60]
mov edx, edi
mov word [rsp + 0x60], di
mov word [rsp + 0x62], si
mov dword [rsp + 0x64], pe_nt_image_headers64
mov qword [rsp + 0x68], rbx
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea rcx, [0x100006b34]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea r11, [rsp + 0xd0]
lea r8, [rsp + 0xc0]
lea rcx, [rsp + 0xd0]
mov r9, rbx
mov edx, edi
mov qword [0x10001ff28], r11
call fcn.10000971c
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
lea rcx, [rsp + 0xd0]
call fcn.10000b368
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.10000e9b0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x100009180
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13, rcx
mov r12d, edx
lea rcx, [0x10001ec20]
xor edx, edx
xor ebx, ebx
call fcn.10000e24c
lea r14d, [rbx + 1]
mov ebp, r14d
jmp 0x100009266
test rbx, rbx
jne 0x100009272
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, r14w
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rbx, rax
test rax, rax
je 0x100009255
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100009202
xor ebx, ebx
jmp 0x100009250
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x1000091fe
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x10000923f
cmp rdi, r11
jae 0x1000091fe
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x10000922d
cmp rdi, r11
jae 0x1000091fe
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x100009274
lea rcx, [0x10001ec20]
mov edx, ebp
call fcn.10000e24c
add ebp, r14d
mov rsi, rax
test rax, rax
jne 0x1000091bf
xor esi, esi
test rsi, rsi
jne 0x10000927d
xor eax, eax
jmp 0x10000928b
mov r8d, r12d
mov rdx, rsi
mov rcx, r13
call fcn.1000093dc
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret