joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400227d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x1a3b6faa
mov r12, rdx
call qword [sym.imp.WS2_32.dll_htonl]
mov edi, 4
lea rdx, [rsp + 0x50]
mov r8d, edi
xor r9d, r9d
mov rcx, rsi
mov dword [rsp + 0x50], eax
lea rbp, [rsp + 0x50]
mov ebx, edi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x140022842
nop
cmp eax, ebx
je 0x140022850
sub ebx, eax
cdqe
xor r9d, r9d
add rbp, rax
mov r8d, ebx
mov rcx, rsi
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x140022820
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x14002295e
mov ecx, dword [r12 + 8]
call qword [sym.imp.WS2_32.dll_htonl]
lea rdx, [rsp + 0x50]
xor r9d, r9d
mov r8d, edi
mov rcx, rsi
lea rbp, [rsp + 0x50]
mov dword [rsp + 0x50], eax
mov ebx, edi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1400228a2
nop
cmp eax, ebx
je 0x1400228b0
sub ebx, eax
cdqe
xor r9d, r9d
add rbp, rax
mov r8d, ebx
mov rcx, rsi
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x140022880
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x14002295e
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_htonl]
lea rdx, [rsp + 0x50]
xor r9d, r9d
mov r8d, edi
mov rcx, rsi
lea rbx, [rsp + 0x50]
mov dword [rsp + 0x50], eax
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x140022902
nop
nop
cmp eax, edi
je 0x14002290c
sub edi, eax
cdqe
xor r9d, r9d
add rbx, rax
mov r8d, edi
mov rcx, rsi
mov rdx, rbx
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1400228e0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x14002295e
mov rdi, qword [r12]
mov ebx, dword [r12 + 8]
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x140022952
nop
cmp eax, ebx
je 0x14002295c
sub ebx, eax
cdqe
xor r9d, r9d
add rdi, rax
mov r8d, ebx
mov rcx, rsi
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x140022930
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x14002295e
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x140022980
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov r12, rdx
mov edi, 4
lea rdx, [rsp + 0x50]
xor r9d, r9d
mov r8d, edi
mov rbp, rcx
mov dword [rsp + 0x50], 0
lea rsi, [rsp + 0x50]
mov ebx, edi
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x1400229e8
test eax, eax
je 0x140022a11
cmp eax, ebx
je 0x1400229f6
sub ebx, eax
cdqe
xor r9d, r9d
add rsi, rax
mov r8d, ebx
mov rcx, rbp
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x1400229c2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x140022afc
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, 0x1a3b6faa
je 0x140022a1b
mov eax, ntohl
jmp 0x140022afc
mov eax, 0x277e
jmp 0x140022afc
lea rdx, [rsp + 0x50]
xor r9d, r9d
mov r8d, edi
mov rcx, rbp
mov dword [rsp + 0x50], 0
lea rsi, [rsp + 0x50]
mov ebx, edi
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x140022a69
test eax, eax
je 0x140022a11
cmp eax, ebx
je 0x140022a77
sub ebx, eax
cdqe
xor r9d, r9d
add rsi, rax
mov r8d, ebx
mov rcx, rbp
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x140022a43
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x140022afc
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_ntohl]
lea rdx, [rsp + 0x50]
xor r9d, r9d
mov r8d, edi
mov rcx, rbp
mov dword [rsp + 0x50], 0
mov esi, eax
lea rbx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x140022ada
nop
nop
test eax, eax
je 0x140022a11
cmp eax, edi
je 0x140022ae4
sub edi, eax
cdqe
xor r9d, r9d
add rbx, rax
mov r8d, edi
mov rcx, rbp
mov rdx, rbx
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x140022ab0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x140022afc
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_ntohl]
mov r8d, esi
mov rdx, r12
mov rcx, rbp
call fcn.140022380
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x140022de0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov eax, r8d
mov rsi, rdx
mov ebx, r8d
shr eax, 4
mov rbp, rcx
mov r8d, 6
add ax, 1
mov rcx, rsi
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x140022f49
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140022f49
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x140022f49
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x140022e7a
cmp rdi, r11
jae 0x140022f49
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x140022e64
cmp rdi, r11
jae 0x140022f49
movzx eax, word [rdi]
test ax, ax
je 0x140022f49
mov qword [rsp + 0x60], r13
movzx ebx, ax
call qword [0x140126528]
xor r13d, r13d
lea r12, [rdi + 2]
mov r9d, ebx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rbp]
mov edx, 1
movsxd rsi, eax
sub edx, dword [rcx - 8]
mov ecx, dword [rcx - 0xc]
sub ecx, esi
or edx, ecx
jge 0x140022eea
mov edx, esi
mov rcx, rbp
call fcn.140022bf0
mov rbx, qword [rbp]
movzx edi, word [rdi]
call qword [0x140126528]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r9d, edi
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test esi, esi
mov r13, qword [rsp + 0x60]
js 0x140022f3e
mov rcx, qword [rbp]
cmp esi, dword [rcx - 0xc]
jg 0x140022f3e
mov dword [rcx - 0x10], esi
mov rcx, qword [rbp]
mov eax, 1
mov byte [rsi + rcx], 0
jmp 0x140022f4b
mov ecx, 0x80070057
call fcn.140022210
int3
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x140028600
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x140127190]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
xor ebp, ebp
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], ebp
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x14002866b
mov qword [rsi + 0x20], 7
mov qword [rsi + 0x18], rbp
lea rdx, [0x1400f04f8]
xor r8d, r8d
mov rcx, rsi
mov word [rsi + 8], bp
call fcn.1400a4380
jmp 0x140028798
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x268], rbx
mov qword [rsp + 0x270], rdi
xor eax, eax
mov qword [rsi + 0x20], 7
lea rbx, [rsi + 8]
lea rdi, [rsp + 0x30]
mov qword [rsi + 0x18], rbp
mov word [rbx], bp
mov rdx, qword [rsi + 0x20]
repne scasw ax, word [rdi]
cmp rdx, 8
not rcx
lea rdi, [rcx - 1]
jb 0x1400286b2
mov rax, qword [rbx]
jmp 0x1400286b5
mov rax, rbx
lea rcx, [rsp + 0x30]
cmp rcx, rax
jb 0x140028706
cmp rdx, 8
jb 0x1400286ca
mov rcx, qword [rbx]
jmp 0x1400286cd
mov rcx, rbx
mov rax, qword [rsi + 0x18]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x30]
cmp rcx, rax
jbe 0x140028706
cmp rdx, 8
jb 0x1400286e8
mov rbx, qword [rbx]
lea r8, [rsp + 0x30]
mov r9, rdi
mov rdx, rsi
sub r8, rbx
mov rcx, rsi
sar r8, 1
call fcn.1400a4180
jmp 0x140028788
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
jbe 0x14002871a
call fcn.14009c5b0
mov rax, qword [rsi + 0x20]
cmp rax, rdi
jae 0x140028746
mov r8, qword [rsi + 0x18]
mov rdx, rdi
mov rcx, rsi
call fcn.1400a3b30
test rdi, rdi
je 0x140028788
mov rdx, qword [rsi + 0x20]
cmp rdx, 8
jb 0x14002875d
mov rcx, qword [rbx]
jmp 0x140028760
test rdi, rdi
jne 0x140028732
cmp rax, 8
mov qword [rsi + 0x18], rbp
jb 0x140028758
mov rbx, qword [rbx]
mov word [rbx], bp
jmp 0x140028788
mov rcx, rbx
lea rbp, [rdi + rdi]
lea r8, [rsp + 0x30]
add rdx, rdx
mov r9, rbp
call fcn.1400c9e10
cmp qword [rsi + 0x20], 8
mov qword [rsi + 0x18], rdi
jb 0x140028782
mov rbx, qword [rbx]
mov word [rbx + rbp], 0
mov rdi, qword [rsp + 0x270]
mov rbx, qword [rsp + 0x268]
mov rax, rsi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400caf00
mov rbp, qword [rsp + 0x278]
add rsp, 0x250
pop rsi
ret
Function at 0x14002fea0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rdi + 0x30], rax
jne 0x14002feed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x58], rsi
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rdi + 0x38], rax
jne 0x14002ff3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rdi + 0x30]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov rcx, rdi
mov qword [rdi + 0x30], rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
lea rax, [rsp + 0x60]
lea r8, [0x14002fcf0]
xor esi, esi
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov r11, rax
mov qword [rdi + 0x28], rax
jne 0x14002ffad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rdi + 0x30]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x38]
mov qword [rdi + 0x30], rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
mov qword [rdi + 0x38], rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov rax, qword [rdi + 0x30]
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea ecx, [r8 + 2]
or r9d, 0xffffffff
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x14003002d
mov rcx, qword [rdi + 0x28]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x38]
mov qword [rdi + 0x30], rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x50]
mov rcx, rdi
mov qword [rdi + 0x38], rsi
mov qword [rdi + 0x28], rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
mov qword [rdi + 0x30], rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x14004b2a0
Capabilities:
Initialize winsock library

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x210
mov rax, qword [0x140127190]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov rdi, rdx
mov rbx, rcx
lea rdx, [rsp + 0x60]
mov cx, 0x202
mov ebp, r9d
mov rsi, r8
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dx, 0x191
xor ecx, ecx
call fcn.140091800
lea rcx, [0x1401291b8]
movzx r12d, al
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [0x140129168]
test r11b, 1
jne 0x14004b3af
mov r9d, ntohl
or r11d, 1
lea r8, str.waudit
lea rcx, [rsp + 0x38]
lea edx, [r9 + 2]
mov qword [rsp + 0x50], 7
mov dword [0x140129168], r11d
mov qword [rsp + 0x48], 0
mov word [rsp + 0x38], 0
call fcn.1400c9e10
cmp qword [rsp + 0x50], 8
mov qword [rsp + 0x48], 6
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x30]
lea rcx, [0x1401290c0]
cmovae rax, qword [rsp + 0x38]
mov word [rax + 0xc], 0
call fcn.140050c90
cmp qword [rsp + 0x50], 8
jb 0x14004b38a
mov rcx, qword [rsp + 0x38]
call fcn.1400c9d50
lea rcx, [0x1400ee4e0]
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], 0
mov word [rsp + 0x38], 0
call fcn.1400cbb50
lea rcx, [0x1401291b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x1401290c0]
mov r9, rsi
mov r8, rdi
mov rdx, rbx
mov dword [rsp + 0x20], ebp
call fcn.14004e180
test r12d, r12d
mov ebx, eax
je 0x14004b3e1
call fcn.1400918d0
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.1400caf00
add rsp, 0x210
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14004cf10
Capabilities:
Create service
Persist via windows service

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x140127190]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edx, edx
mov rbx, rcx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rdi, rax
je 0x14004cff0
lea rdx, [rsp + 0x70]
mov r8d, 0x105
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14004cfe7
cmp qword [rbx + 0x70], 8
jb 0x14004cf74
mov r8, qword [rbx + 0x58]
jmp 0x14004cf78
lea r8, [rbx + 0x58]
cmp qword [rbx + 0x70], 8
jb 0x14004cf85
mov rdx, qword [rbx + 0x58]
jmp 0x14004cf89
lea rdx, [rbx + 0x58]
xor ecx, ecx
lea rax, [rsp + 0x70]
mov r9d, 0xf01ff
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
mov rcx, rdi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
je 0x14004cfe1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14004cfe7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400caf00
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x290
pop rdi
ret
Function at 0x14004d020
Capabilities:
Delete service
Query service status

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
xor edx, edx
mov rbx, rcx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rdi, rax
je 0x14004d09f
cmp qword [rbx + 0x70], 8
jb 0x14004d050
mov rdx, qword [rbx + 0x58]
jmp 0x14004d054
lea rdx, [rbx + 0x58]
mov r8d, 0x10004
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rbx, rax
je 0x14004d096
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14004d08d
cmp dword [rsp + 0x24], 1
jne 0x14004d08d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140069570
Capabilities:
Enumerate process modules

Disassembly:
push rsi
push rdi
push r12
mov eax, 0x1090
call fcn.1400ebe00
sub rsp, rax
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [rsp + 0x10b8], rbx
mov qword [rsp + 0x10c0], rbp
mov rdi, rcx
mov rax, qword [rcx + 8]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
cmp rcx, qword [rdi + 8]
je 0x1400695d2
mov rbx, qword [rcx]
call fcn.1400c9d50
mov rcx, rbx
cmp rbx, qword [rdi + 8]
jne 0x1400695c1
lea r8, [rsp + 0x10b0]
mov edx, 0x1000
lea rcx, [rsp + 0x90]
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x1400695fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140069740
mov ebp, dword [rsp + 0x10b0]
shr ebp, 2
mov ebx, 0
je 0x14006973e
movabs r12, 0x3fffffffffffffff
nop
nop
mov rsi, qword [rdi + 8]
mov eax, ebx
lea r9, [rsp + rax*4 + 0x90]
mov r8, qword [rsi + 8]
mov rdx, rsi
mov rcx, rdi
call fcn.140068bb0
mov rdx, qword [rdi + 0x10]
mov rcx, r12
sub rcx, rdx
cmp rcx, 1
jb 0x14006966c
lea rcx, [rdx + 1]
mov qword [rdi + 0x10], rcx
mov qword [rsi + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
add ebx, 1
cmp ebx, ebp
jb 0x140069620
jmp 0x14006973e
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x38], 0
mov byte [rsp + 0x28], 0
xor r8d, r8d
lea edx, [r8 + 0x10]
lea rcx, [rsp + 0x20]
call fcn.140001350
lea rcx, [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
cmovae rcx, qword [rsp + 0x28]
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.list_T__too_long
call fcn.1400c9e10
mov qword [rsp + 0x38], reloc.WS2_32.dll_recv
lea rax, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rax, qword [rsp + 0x28]
mov byte [rax + 0x10], 0
lea rcx, [rsp + 0x48]
call fcn.1400ca220
nop
lea rax, [0x1400ef958]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x80], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x78], 0
mov byte [rsp + 0x68], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400015a0
nop
lea rax, [0x1400ef998]
mov qword [rsp + 0x48], rax
lea rdx, [0x140121da0]
lea rcx, [rsp + 0x48]
call fcn.1400ca580
nop
xor eax, eax
lea r11, [rsp + 0x1090]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x14006e7e0
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rdi, rcx
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
lea rax, [0x1400f56e8]
mov qword [rdi], rax
lea rax, [0x1400f56d0]
mov qword [rdi + 8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x68]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14006e843
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14006e8c7
lea r8, [rsp + 0x3c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x14006e86e
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14006e8c7
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14006e8bc
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14006e8c7
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rdi + 0x40]
call fcn.140068c50
mov qword [rdi + 0x48], rax
mov byte [rax + 0x121], 1
mov rax, qword [rdi + 0x48]
mov qword [rax + 8], rax
mov rax, qword [rdi + 0x48]
mov qword [rax], rax
mov rax, qword [rdi + 0x48]
mov qword [rax + 0x10], rax
mov qword [rdi + 0x50], 0
mov rax, rdi
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140091800
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov word [rsp + 0x10], dx
mov qword [rsp + 8], rcx
sub rsp, 0x248
movzx eax, word [rsp + 0x258]
test eax, eax
je 0x1400918a4
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [0x140125f48]
mov edx, 0x104
lea rcx, [rsp + 0x20]
call fcn.1400cf830
lea r8, [0x140125f60]
mov edx, 0x104
lea rcx, [rsp + 0x20]
call fcn.1400cf830
lea r8, str..sys
mov edx, 0x104
lea rcx, [rsp + 0x20]
call fcn.1400cf830
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400918a4
lea r8, [rsp + 0x20]
movzx edx, word [rsp + 0x258]
mov rcx, qword [rsp + 0x250]
call fcn.140093d00
mov dword [rsp + 0x230], eax
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call fcn.140091620
add rsp, 0x248
ret

Function at 0x140091c30
Capabilities:
Create service

Disassembly:
push rsi
push rdi
sub rsp, 0x6a8
mov byte [rsp + 0x694], 0
mov dword [rsp + 0x690], 0
lea rax, [rsp + 0x490]
lea rcx, [0x140125fb0]
mov rdi, rax
mov rsi, rcx
mov ecx, 6
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x496]
mov rdi, rax
xor eax, eax
mov ecx, 0x1fa
rep stosb byte [rdi], al
lea rax, [rsp + 0x280]
lea rcx, str.KHCap_Packet_Driver__KHCAP_
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1c
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x29c]
mov rdi, rax
xor eax, eax
mov ecx, 0x1e4
rep stosb byte [rdi], al
lea rax, [rsp + 0x70]
lea rcx, str.system32driversKHCAP.sys
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1b
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x8b]
mov rdi, rax
xor eax, eax
mov ecx, 0x1e5
rep stosb byte [rdi], al
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x270], rax
cmp qword [rsp + 0x270], 0
jne 0x140091d04
xor al, al
jmp 0x140091e04
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
mov r9d, 0xf01ff
lea r8, [rsp + 0x280]
lea rdx, [rsp + 0x490]
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov qword [rsp + 0x480], rax
cmp qword [rsp + 0x480], 0
jne 0x140091db9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x690], eax
cmp dword [rsp + 0x690], 0x431
jne 0x140091db7
mov dword [rsp + 0x690], 0
mov byte [rsp + 0x694], 1
jmp 0x140091dc1
mov byte [rsp + 0x694], 1
cmp qword [rsp + 0x480], 0
je 0x140091dda
mov rcx, qword [rsp + 0x480]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, byte [rsp + 0x694]
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [rsp + 0x690]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rsp + 0x694]
add rsp, 0x6a8
pop rdi
pop rsi
ret