joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400233d0
Capabilities:
Read file on windows

Disassembly:
test rcx, rcx
je 0x14002363b
push rbx
push r12
sub rsp, 0x38
mov r12, rdx
mov rbx, rcx
test rdx, rdx
je 0x140023634
mov qword [rsp + 0x20], r15
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140023400
add rcx, 0xc
call fcn.14002fc3c
mov r15, rax
test rax, rax
je 0x14002362f
mov rdx, rax
mov qword [rsp + 0x30], r13
sub rdx, rbx
mov qword [rsp + 0x28], r14
nop
movzx ecx, byte [rbx]
mov byte [rdx + rbx], cl
lea rbx, [rbx + 1]
test cl, cl
jne 0x140023430
lea rdx, [0x140069c30]
mov rcx, r15
call fcn.140008580
xor r13d, r13d
lea rdx, [0x140055fc4]
mov rcx, r15
mov r14d, r13d
call fcn.1400331e4
mov rbx, rax
test rax, rax
je 0x14002361d
xor edx, edx
mov qword [rsp + 0x60], rdi
lea r8d, [r13 + 2]
mov rcx, rax
call fcn.1400309dc
mov rcx, rbx
call fcn.140030254
mov rcx, rbx
movsxd rdi, eax
call fcn.1400370a4
test edi, edi
jle 0x1400234cc
lea rcx, [rdi + 1]
call fcn.14002fc3c
mov r9, rbx
lea edx, [r13 + 1]
mov r8, rdi
mov rcx, rax
mov r14, rax
call fcn.140036fdc
cmp rax, rdi
je 0x1400234c8
mov rcx, r14
call fcn.14002fc28
mov r14d, r13d
jmp 0x1400234cc
mov byte [rdi + r14], r13b
mov rcx, rbx
call fcn.140030770
test r14, r14
je 0x140023618
lea rdx, [0x140069c40]
mov qword [rsp + 0x50], rbp
mov rcx, r14
call fcn.1400086e0
mov rbp, rax
test rax, rax
je 0x14002360b
mov qword [rsp + 0x58], rsi
lea rcx, [rbp + 0x12]
mov edx, 0x22
call fcn.14002e37c
mov rbx, rax
test rax, rax
je 0x1400235ea
inc rbx
mov edx, 0x22
mov rcx, rbx
call fcn.14002e37c
mov rdi, rax
test rax, rax
je 0x1400235ea
sub rdi, rbx
lea rcx, [rdi + 1]
call fcn.14002fc3c
mov rsi, rax
test rax, rax
je 0x1400235ea
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.140035f00
mov rcx, rsi
mov byte [rsi + rdi], r13b
call fcn.140022d80
mov rbx, rax
test rax, rax
je 0x1400235e2
mov rcx, rax
call fcn.140008040
mov rdi, rax
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], r13b
jne 0x140023584
xor edx, edx
mov rcx, rbx
call fcn.14002ec20
mov rcx, rbx
call fcn.14002fc28
test rdi, rdi
je 0x1400235e2
mov rcx, rdi
call fcn.14001e680
test al, al
je 0x1400235da
mov ecx, SafeArrayCopy
call fcn.14002fc3c
test rax, rax
je 0x1400235e2
mov rdx, rax
mov qword [rax], rdi
mov rcx, r12
mov dword [rax + 0x10], 1
mov qword [rax + 8], r13
call fcn.140004460
jmp 0x1400235e2
mov rcx, rdi
call fcn.14002fc28
mov rcx, rsi
call fcn.14002fc28
lea rcx, [rbp + 1]
lea rdx, [0x140069c40]
call fcn.1400086e0
mov rbp, rax
test rax, rax
jne 0x140023502
mov rsi, qword [rsp + 0x58]
mov rcx, r14
call fcn.14002fc28
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov rcx, r15
call fcn.14002fc28
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r15, qword [rsp + 0x20]
add rsp, 0x38
pop r12
pop rbx
ret
Function at 0x1400243e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400243fa
test al, 0x10
je 0x1400243fa
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x140024410
Capabilities:
Read file on windows

Disassembly:
push r12
push r14
push r15
sub rsp, 0x50
mov r12, rdx
xor r14d, r14d
lea rdx, [0x140055fc8]
call fcn.1400331e4
mov r15, rax
test rax, rax
jne 0x140024443
lea eax, [r14 + 1]
add rsp, 0x50
pop r15
pop r14
pop r12
ret
xor eax, eax
mov qword [rsp + 0x70], rbx
mov r9, r15
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov word [rsp + 0x30], ax
mov rbx, r14
lea edx, [rax + 0x12]
lea r8d, [rax + 1]
call fcn.140036fdc
test rax, rax
jne 0x14002447e
lea r14d, [rax + 2]
jmp 0x140024591
lea rdx, [0x140069d60]
lea rcx, [rsp + 0x20]
call fcn.1400085f0
test eax, eax
je 0x14002449e
mov r14d, 3
jmp 0x140024591
movzx eax, byte [rsp + 0x31]
mov qword [rsp + 0x78], rbp
movzx ebp, byte [rsp + 0x30]
shl ebp, 8
add ebp, eax
mov qword [rsp + 0x40], r13
mov ecx, ebp
mov r13d, ebp
call fcn.14002fc3c
mov rbx, rax
test rax, rax
jne 0x1400244d2
lea r14d, [rax + 4]
jmp 0x140024587
xor r8d, r8d
mov edx, ebp
mov rcx, r15
call fcn.1400309dc
mov r9, r15
mov r8d, 1
mov rdx, r13
mov rcx, rbx
call fcn.140036fdc
test rax, rax
je 0x140024587
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x48], rdi
nop dword [rax]
cmp byte [rbx], 0xa
jne 0x140024561
movzx esi, byte [rbx + 3]
mov edi, r14d
movzx eax, byte [rbx + 4]
shl esi, 8
add esi, eax
je 0x140024561
nop word [rax + rax]
lea eax, [rdi*2 + 8]
mov r8, r12
movzx edx, byte [rax + rbx]
lea eax, [rdi*2 + 9]
movzx ecx, byte [rax + rbx]
shl rdx, 8
lea rax, [rbx + rdx]
mov edx, ebp
add rcx, rax
call fcn.140024780
inc edi
cmp edi, esi
jb 0x140024530
mov r9, r15
mov r8d, 1
mov rdx, r13
mov rcx, rbx
call fcn.140036fdc
test rax, rax
jne 0x140024510
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov r13, qword [rsp + 0x40]
mov rcx, r15
call fcn.140030770
mov rcx, rbx
call fcn.14002fc28
mov rbx, qword [rsp + 0x70]
mov eax, r14d
add rsp, 0x50
pop r15
pop r14
pop r12
ret
Function at 0x140025980
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x138
mov rax, qword [0x14005a018]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rsi, r9
mov r15, rdx
mov r12, rcx
test rcx, rcx
je 0x140025b2f
test rdx, rdx
je 0x140025b2f
mov rax, rdx
lea rbp, [rdx + 0x10]
and eax, 0xf
mov ebx, recvfrom
sub rbx, rax
add rbp, rbx
mov rcx, rbp
call fcn.14002fc3c
mov qword [rsi], rax
mov rdi, rax
test rax, rax
je 0x140025b2f
xor ecx, ecx
mov qword [rsp + 0x130], r14
call fcn.14002fd20
mov rcx, rax
call fcn.14002fc70
mov r14d, setsockopt
call fcn.14002fc44
and eax, 0x800000ff
jge 0x140025a1b
dec eax
or eax, 0xffffff00
inc eax
mov byte [rdi], al
inc rdi
sub r14, 1
jne 0x140025a06
mov rcx, qword [rsi]
mov r8, r15
add rcx, 0x10
mov rdx, r12
call fcn.14002e590
mov r14, qword [rsp + 0x130]
mov r8, rbp
sub r8, rbx
mov rdx, r8
cmp r8, rbp
jae 0x140025a9a
cmp rbx, 0x10
jb 0x140025a9a
mov rax, qword [rsi]
lea rcx, [rax - 1]
add rcx, rbp
lea rdi, [rax + r8]
cmp rdi, rsi
ja 0x140025a6c
cmp rcx, rsi
jae 0x140025a9a
mov rax, rbx
mov rcx, rbp
and eax, 0xf
sub rcx, rax
nop dword [rax + rax]
add rdx, 0x10
cmp rdx, rcx
jb 0x140025a80
sub rcx, r8
movsx rax, bl
add rcx, 0xf
and rcx, 0xfffffffffffffff0
rep stosb byte [rdi], al
cmp rdx, rbp
jae 0x140025aae
nop
mov rax, qword [rsi]
mov byte [rdx + rax], bl
inc rdx
cmp rdx, rbp
jb 0x140025aa0
lea rdx, [0x14005ab38]
lea rcx, [rsp + 0x20]
call fcn.1400297e0
mov rcx, qword [rsi]
lea eax, [rbp - 0x10]
mov esi, eax
lea rdi, [rsp + 0x110]
lea rbx, [rcx + 0x10]
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0x110], xmm0
test eax, eax
je 0x140025b2a
dec rsi
shr rsi, 4
inc rsi
nop dword [rax]
mov rcx, rbx
sub rdi, rbx
mov edx, recvfrom
nop dword [rax + rax]
movzx eax, byte [rdi + rcx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140025b00
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140029fa0
mov rdi, rbx
add rbx, 0x10
sub rsi, 1
jne 0x140025af0
mov rax, rbp
jmp 0x140025b31
xor eax, eax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14002d5c0
add rsp, 0x138
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140026fa0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14005a018]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov dword [rsp + 0x20], 0x30
mov rdi, rcx
mov qword [rsp + 0x34], rax
xor ecx, ecx
mov dword [rsp + 0x30], eax
xor edx, edx
mov dword [rsp + 0x24], 2
mov r8d, 0xf003f
mov qword [rsp + 0x28], 7
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
jne 0x140026ffd
lea eax, [rbx - 1]
jmp 0x140027048
mov r8d, 0xf003f
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
jne 0x14002703a
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x140027048
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002d5c0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140027060
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14005a018]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov dword [rsp + 0x20], 0x30
mov rbx, rcx
mov qword [rsp + 0x34], rax
xor ecx, ecx
mov dword [rsp + 0x30], eax
xor edx, edx
mov dword [rsp + 0x24], 2
mov r8d, 0xf003f
mov qword [rsp + 0x28], 7
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x140027113
mov r8d, 0xf003f
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
je 0x140027113
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [rsp + 0x24], 4
mov rcx, rdi
jne 0x140027100
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x140027118
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x140027118
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002d5c0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140027130
Capabilities:
Query service configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x30
mov rax, qword [0x14005a018]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r14d, edx
mov rbx, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbp, rax
test rax, rax
je 0x1400271fc
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
je 0x1400271fc
lea r9, [rsp + 0x20]
mov qword [rsp + 0x58], rdi
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
mov ebx, dword [rsp + 0x20]
xor ecx, ecx
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r9, [rsp + 0x20]
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
cmp dword [rdi + 4], r14d
mov rcx, rbp
mov rdi, qword [rsp + 0x58]
jne 0x1400271e9
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x140027201
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x140027201
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14002d5c0
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret

Function at 0x140027220
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x14005a018]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rax, 0xffffffffffffffff
mov rsi, rcx
mov rcx, rax
mov rbp, rdx
inc rcx
cmp byte [rcx + rdx], 0
jne 0x140027251
nop word [rax + rax]
cmp byte [rsi + rax + 1], 0
lea rax, [rax + 1]
jne 0x140027260
lea rbx, [rax + 7]
mov edx, 1
add rbx, rcx
mov rcx, rbx
call fcn.14002f9e8
lea r8, [0x140051908]
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.14002fbc8
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.1400337a0
lea r8, [0x140051880]
mov rdx, rbx
mov rcx, rdi
call fcn.1400337a0
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.1400337a0
lea r8, [0x14005186c]
mov rdx, rbx
mov rcx, rdi
call fcn.1400337a0
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.14002ec20
xor eax, eax
mov dword [rsp + 0x70], 0x68
xor ecx, ecx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
xor r9d, r9d
mov qword [rsp + 0x60], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov dword [rsp + 0xac], 1
mov qword [rsp + 0x48], rax
mov rdx, rdi
lea rax, [rsp + 0x70]
mov word [rsp + 0xb0], cx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140027371
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14002d5c0
mov rbx, qword [rsp + 0x120]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400278a0
Capabilities:
Query service configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x14005a018]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov edi, edx
mov rsi, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r8d, 1
mov rdx, rsi
mov rcx, rax
mov r14, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
lea r9, [rsp + 0x20]
xor r8d, r8d
mov rcx, rax
xor edx, edx
mov rbp, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
mov ebx, dword [rsp + 0x20]
xor ecx, ecx
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r9, [rsp + 0x20]
mov r8d, ebx
mov rdx, rax
mov rcx, rbp
mov r15, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
cmp edi, 1
jne 0x140027949
lea rdx, [0x140051b20]
mov rcx, rsi
call fcn.140027220
lea ecx, [rdi + 9]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140051b28]
mov rcx, rsi
call fcn.140027220
mov rcx, qword [r15 + 0x10]
call fcn.140033648
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14002d5c0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14002a2a0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
sub rsi, rcx
mov r9d, 4
nop dword [rax]
mov r8d, 4
nop word [rax + rax]
movzx eax, byte [rsi + rcx + 0xe0]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x14002a2e0
sub r9, 1
jne 0x14002a2d0
mov bpl, SafeArrayDestroy
lea rdi, [rsi + 0xd0]
lea r14, [0x140051ec0]
nop word [rax + rax]
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x14002a380
inc r8
sub r9, 1
jne 0x14002a370
mov rax, rbx
lea r8d, [rdx + 4]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x14002a3c0
sub r8, 1
jne 0x14002a3b0
mov rcx, rbx
call fcn.140029ce0
sub rdi, 0x10
add bpl, 0xff
jne 0x14002a310
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x14002a460
inc r8
sub r9, 1
jne 0x14002a450
lea edx, [r9 + 4]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rbx + rsi]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x14002a490
sub rdx, 1
jne 0x14002a482
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14002a4c0
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x14002a55b
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov qword [rsp + 0x30], rbp
mov rbx, rdx
mov qword [rsp + 0x38], rdi
mov r14, rcx
lea rdi, [rcx + 0xf0]
mov esi, r8d
sub rdi, rdx
dec rsi
shr rsi, 4
inc rsi
movups xmm0, xmmword [rbx]
mov rdx, r14
mov rcx, rbx
call fcn.14002a2a0
mov ecx, recvfrom
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x14002a520
sub rdi, 0x10
movups xmmword [r14 + 0xf0], xmm0
sub rsi, 1
jne 0x14002a500
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14002aa00
Capabilities:
Create service
Persist via windows service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x14005a018]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov edi, ecx
mov rsi, rdx
lea rcx, [0x140051fd0]
call fcn.140033728
mov rbx, rax
test rax, rax
je 0x14002aa60
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14002aa44
xor edx, edx
mov rcx, rbx
call fcn.14002ec20
mov rcx, rbx
call fcn.14002fc28
lea rdx, [rsp + 0x70]
lea rcx, [0x140052040]
call fcn.140025790
cmp edi, 2
jl 0x14002aa92
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsi + 8]
call fcn.140034260
test eax, eax
jne 0x14002aa92
call fcn.14002bde0
jmp 0x14002abb5
lea rdx, [rsp + 0x70]
lea rcx, [0x140052070]
call fcn.140025790
cmp edi, 2
jl 0x14002ab6e
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsi + 8]
call fcn.140034260
test eax, eax
jne 0x14002ab6e
mov r8d, 0x104
lea rdx, [rsp + 0xa0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14002abb5
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
je 0x14002abb5
xor ecx, ecx
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x60], rcx
lea r8, [0x1400520a0]
mov qword [rsp + 0x58], rcx
lea rdx, [0x1400520a0]
mov qword [rsp + 0x50], rcx
mov r9d, 0xf01ff
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
mov rcx, rbx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], setsockopt
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
test rax, rax
je 0x14002ab63
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14002abb5
lea rdx, [rsp + 0x70]
lea rcx, [0x1400520a0]
call fcn.140025790
mov rax, qword [rsp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x78], rax
lea rax, [0x14002bd60]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], rcx
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x80], rax
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
xor eax, eax
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.14002d5c0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14002bf10
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14005a018]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x68], r14
call fcn.14002af80
call fcn.14002c260
lea rdx, [0x140051905]
mov ecx, 2
call fcn.140003920
lea rdx, [0x140051905]
mov ecx, SafeArrayDestroy
call fcn.140003920
mov rcx, qword [0x14005be40]
call fcn.140033728
mov rdx, rax
mov ecx, recvfrom
call fcn.140003920
lea rdx, [0x140051905]
mov ecx, recvfrom
call fcn.140003920
lea rdx, [0x140051905]
mov ecx, reloc.OLEAUT32.dll_SafeArrayDestroy
call fcn.140003920
lea rdx, [0x140051905]
mov ecx, recvfrom
call fcn.140003920
lea rax, [0x140051910]
xor r14d, r14d
lea r8, [rbp - 0x30]
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x18]
mov qword [rbp - 0x30], r14
call fcn.140026b90
cmp eax, 1
jne 0x14002c009
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x30], r14
call fcn.140027e00
mov rcx, qword [rbp - 0x30]
lea r8d, [r14 + 2]
lea rdx, [rbp - 0x20]
call fcn.1400281b0
mov rdx, qword [rbp - 0x20]
call fcn.1400273a0
mov rcx, qword [rbp - 0x20]
call fcn.14002fc28
mov rcx, qword [rbp - 0x30]
call fcn.14002fc28
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x30], r14
lea rcx, [0x140055f48]
call fcn.140025790
mov rdi, qword [rbp - 0x30]
lea r8, [rbp - 0x20]
mov rdx, rdi
mov qword [rbp - 0x28], r14
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x20], r14
call fcn.140028720
test eax, eax
jne 0x14002c04e
mov rcx, qword [rbp - 0x20]
call fcn.140029390
test eax, eax
je 0x14002c12f
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x60], rsi
lea rcx, [0x140055f80]
mov qword [rbp - 0x30], r14
call fcn.140025790
mov r8, qword [rbp - 0x30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rsi, rax
test rax, rax
je 0x14002c12a
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
jne 0x14002c121
lea r8, [rbp - 0x30]
mov qword [rbp - 0x20], r14
mov rdx, rdi
mov qword [rbp - 0x30], r14
lea rcx, [rbp - 0x20]
call fcn.140028720
test eax, eax
je 0x14002c0be
lea rcx, [rbp - 0x20]
call fcn.140028f10
jmp 0x14002c0cb
mov rcx, qword [rbp - 0x30]
call fcn.140029390
test eax, eax
je 0x14002c118
lea rcx, [rbp - 0x28]
call fcn.1400291d0
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14002c0ee
mov r8, qword [rbp - 0x28]
test r8, r8
je 0x14002c0ee
mov rdx, rdi
call fcn.140028be0
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x20], r14
lea rcx, [0x140051890]
call fcn.140025790
mov rcx, qword [rbp - 0x20]
lea rdx, [rbp - 0x18]
call fcn.1400279a0
mov rcx, qword [rbp - 0x20]
call fcn.14002fc28
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
test rdi, rdi
je 0x14002c15c
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], 0
jne 0x14002c140
xor edx, edx
mov rcx, rdi
call fcn.14002ec20
mov rcx, rdi
call fcn.14002fc28
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002d5c0
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x140036d24
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140036d44
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140039734
or eax, 0xffffffff
jmp 0x140036d46
xor eax, eax
add rsp, 0x28
ret

Function at 0x140038330
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14003815c