joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400318e0
Capabilities:
Set file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xe0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov edx, pe_nt_image_headers64
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test ebx, ebx
je 0x140031995
lea rcx, [rsp + 0x48]
call fcn.140031620
nop
mov ecx, 0x38
mov r9d, 0x78
cmp qword [rax], 0
cmovne r9d, ecx
add r9, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
mov edx, 0xc0000000
lea r8d, [rcx - 0x35]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 8], rax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140031977
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140031987
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp qword [rdi + 8], 0xffffffffffffffff
jne 0x1400319d4
mov eax, 0xe0010006
jmp 0x1400319d6
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x1400319d4
mov eax, 0xe0010005
jmp 0x1400319d6
xor eax, eax
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400319f0
Capabilities:
Set file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xe0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov edx, pe_nt_image_headers64
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test ebx, ebx
je 0x140031aa5
lea rcx, [rsp + 0x48]
call fcn.140031620
nop
mov ecx, 0x38
mov r9d, 0x78
cmp qword [rax], 0
cmovne r9d, ecx
add r9, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
mov edx, 0xc0000000
lea r8d, [rcx - 0x35]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rdi + 8], rax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140031a87
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140031a97
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp qword [rdi + 8], 0xffffffffffffffff
jne 0x140031ae4
mov eax, 0xe0010006
jmp 0x140031ae6
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rdi + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x140031ae4
mov eax, 0xe0010005
jmp 0x140031ae6
xor eax, eax
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140031b40
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 8]
xor eax, eax
mov rbx, r9
mov dword [rsp + 0x40], eax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140031b76
mov eax, dword [rsp + 0x40]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov eax, 0xe0010001
add rsp, 0x30
pop rbx
ret

Function at 0x140031b90
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 8]
xor eax, eax
mov rbx, r9
mov dword [rsp + 0x40], eax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140031bc6
mov eax, dword [rsp + 0x40]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov eax, 0xe0010001
add rsp, 0x30
pop rbx
ret
Function at 0x1400366f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
xor edx, edx
mov rcx, qword [rcx + 0x1f60]
mov r8d, dword [rdi + 0x1f70]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rcx, qword [rdi + 0x1f60]
lea r9, [rsp + 0x30]
mov r8d, 0xa10
lea rdx, [rdi + 0xc]
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
jns 0x140036743
mov eax, 0xe0010005
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rdi + 0x1f60]
lea r9, [rsp + 0x30]
mov r8d, 0x210
mov qword [rsp + 0x40], rbp
lea rdx, [rdi + 0xa1c]
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
jns 0x140036780
mov eax, 0xe0010005
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rdi + 0x1f60]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x38], rbx
mov r8d, 0x330
lea rbx, [rdi + 0xc2c]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
jns 0x1400367b5
mov eax, 0xe0010005
jmp 0x1400368a6
lea rdx, [rdi + 0xc]
mov eax, 0x7473754d
mov r8d, 0x142
nop dword [rax]
nop dword [rax + rax]
xor dword [rdx], eax
lea ecx, [rax + 1]
xor dword [rdx + 4], ecx
lea rdx, [rdx + 8]
add eax, 2
sub r8, 1
jne 0x1400367d0
lea rdx, [rdi + 0xa1c]
mov r8d, 0x42
nop dword [rax]
nop word [rax + rax]
xor dword [rdx], eax
lea ecx, [rax + 1]
xor dword [rdx + 4], ecx
lea rdx, [rdx + 8]
add eax, 2
sub r8, 1
jne 0x140036800
lea edx, [r8 + 0x66]
nop dword [rax]
xor dword [rbx], eax
lea ecx, [rax + 1]
xor dword [rbx + 4], ecx
lea rbx, [rbx + 8]
add eax, 2
sub rdx, 1
jne 0x140036820
cmp dword [rdi + 0xc], 0x7473754d
jne 0x140036850
mov edx, 0xa10
lea rcx, [rdi + 0xc]
call fcn.140019760
test eax, eax
je 0x140036857
mov eax, 0xe0010001
jmp 0x1400368a6
xor ebx, ebx
cmp dword [rdi + 0xc28], 0x78747241
je 0x140036897
mov edx, 0x210
mov dword [rdi + 0xc24], 1
lea rcx, [rdi + 0xa1c]
mov dword [rdi + 0xc28], 0x78747241
mov qword [rdi + 0xc1c], rbx
call fcn.140019760
mov dword [rdi + 0xc20], eax
mov rcx, rdi
call fcn.140036600
test eax, eax
cmovs ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140037980
Capabilities:
Set file attributes
Write file on windows

Disassembly:
mov rax, rsp
push r14
sub rsp, 0xf0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, r9
mov rbp, r8
mov rbx, rdx
mov r14, rcx
lea rax, vtable.XFileIO.0
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0xffffffffffffffff
mov edx, pe_nt_image_headers64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x60]
call fcn.140031620
nop
mov edx, 0x38
mov r9d, 0x78
cmp qword [rax], 0
cmovne r9d, edx
add r9, rax
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
mov edx, 0xc0000000
lea r8d, [rdi + 3]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140037a36
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140037a49
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp rbx, 0xffffffffffffffff
jne 0x140037a56
mov edi, 0xe0010006
jmp 0x140037a92
xor r9d, r9d
xor r8d, r8d
mov edx, dword [r14 + 0x1f70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140037a92
mov edi, 0xe0010001
cmp rbx, 0xffffffffffffffff
je 0x140037aa2
mov rcx, rbx
call qword [0x1400692d0]
nop
mov eax, edi
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140037c20
Capabilities:
Read file on windows
Set file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x14009e018]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov r14, r9
mov rsi, r8
mov r12, rdx
mov r15, rcx
mov r13, qword [rsp + 0x110]
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
call qword [rax + 0x38]
test eax, eax
js 0x140037e52
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x140037e3c
cmp dword [rsp + 0x8c], 0
jne 0x140037e3c
mov eax, dword [rsp + 0x90]
cmp rax, qword [rsp + 0x40]
jne 0x140037e3c
lea rax, vtable.XFileIO.0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xffffffffffffffff
mov edx, pe_nt_image_headers64
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rbp + 3]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x140037d28
mov qword [rsp + 0x20], r13
mov r9, r14
mov r8, rsi
mov rdx, r12
mov rcx, r15
call fcn.140037b70
mov ebp, eax
jmp 0x140037e28
mov rcx, qword [rsp + 0x40]
call fcn.140051c84
mov rdi, rax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x40]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140037dfb
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
cmp rax, rcx
jne 0x140037dfb
call fcn.140051c84
mov rbx, rax
mov qword [rsp + 0x48], rax
mov r9, qword [rsp + 0x40]
mov r8, rax
mov rdx, r12
mov rcx, r15
call fcn.140037e90
test eax, eax
jns 0x140037daf
mov qword [rsp + 0x20], r13
mov r9, r14
mov r8, rsi
mov rdx, r12
mov rcx, r15
call fcn.140037b70
jmp 0x140037dea
test r14, r14
je 0x140037dc2
mov r8, r13
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x40]
mov r8, r14
mov rdx, rbx
mov rcx, rdi
call fcn.1400547b0
test eax, eax
je 0x140037dec
mov r9, r14
mov r8, rbx
mov rdx, rsi
mov rcx, r15
call fcn.140037980
mov ebp, eax
test rbx, rbx
je 0x140037e15
mov rcx, rbx
call fcn.140051af0
jmp 0x140037e15
mov qword [rsp + 0x20], r13
mov r9, r14
mov r8, rsi
mov rdx, r12
mov rcx, r15
call fcn.140037b70
mov ebp, eax
jmp 0x140037e1a
mov rbx, qword [rsp + 0x58]
test rdi, rdi
je 0x140037e28
mov rcx, rdi
call fcn.140051af0
nop
cmp rbx, 0xffffffffffffffff
je 0x140037e38
mov rcx, rbx
call qword [0x1400692d0]
nop
mov eax, ebp
jmp 0x140037e52
mov qword [rsp + 0x20], r13
mov r9, r14
mov r8, rsi
mov rdx, r12
mov rcx, r15
call fcn.140037b70
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140051aa0
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14003ade0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov r10, qword [0x1400a34c0]
test r10, r10
je 0x14003ae23
or rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14003adf4
mov rdx, rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [r10 + 0x70]
lea r8d, [rax*2 + 2]
lea r9, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x38
ret
Function at 0x14003b260
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test rcx, rcx
je 0x14003b2c6
nop dword [rax]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14003b2b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x420
je 0x14003b2c6
cmp eax, 0x10
jne 0x14003b2b1
mov rdx, rbx
mov rcx, rdi
call fcn.14003ae30
jmp 0x14003b280
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14003b970
Capabilities:
Delete file
Set file attributes
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov rbx, r8
mov edi, r15d
mov rbp, rdx
mov r14, rcx
nop word [rax + rax]
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14003ba12
mov rcx, rbx
call fcn.14003b7a0
mov edx, pe_nt_image_headers64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jl 0x14003b9a0
mov ecx, 0xdeaddead
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14003ba39
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], r15
mov r8d, ebp
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [0x1400692d0]
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14003f7a0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x14009e018]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rdx
mov rdi, qword [0x1400a34c0]
mov qword [r11 - 0x20], 0xf
xor r8d, r8d
mov qword [r11 - 0x28], r8
mov byte [r11 - 0x38], r8b
mov ecx, 0xd046fd6d
call fcn.14003e730
mov r9, rax
mov edx, r8d
lea rcx, [rax + 0x16]
lea rax, [rsp + 0x28]
cmp rax, rcx
ja 0x14003f810
lea rax, [rsp + 0x3e]
cmp rax, r9
jae 0x14003f828
nop dword [rax + rax]
movdqu xmm0, xmmword [r9]
pxor xmm0, xmmword [0x140093500]
movdqu xmmword [rsp + 0x28], xmm0
mov edx, 0x10
lea rax, [rsp + 0x28]
sub r9, rax
lea rcx, [rsp + 0x28]
add rcx, rdx
movzx eax, byte [r9 + rcx]
xor al, 0x88
mov byte [rcx], al
inc rdx
cmp rdx, 0x17
jb 0x14003f830
mov byte [rsp + 0x3f], 0
cmp byte [rsp + 0x28], 0
je 0x14003f86a
lea rax, [rsp + 0x28]
or r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14003f860
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x40]
call fcn.140019930
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r8, qword [rsp + 0x40]
mov rdx, qword [rdi]
mov rcx, rbx
call fcn.14003ee40
mov ebx, eax
mov rcx, qword [rsp + 0x58]
cmp rcx, 0x10
jb 0x14003f8f3
inc rcx
mov rdx, qword [rsp + 0x40]
cmp rcx, 0x1000
jb 0x14003f8eb
test dl, 0x1f
je 0x14003f8be
call fcn.140058a08
int3
mov rax, qword [rdx - 8]
cmp rax, rdx
jb 0x14003f8cd
call fcn.140058a08
int3
sub rdx, rax
cmp rdx, 8
jae 0x14003f8dc
call fcn.140058a08
int3
cmp rdx, 0x27
jbe 0x14003f8e8
call fcn.140058a08
int3
mov rdx, rax
mov rcx, rdx
call fcn.140051c7c
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140051aa0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x14003fee0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push rdi
sub rsp, 0x280
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x298], rbx
mov rax, qword [0x14009e018]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0x2b]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
cmp qword [rbx + 0x18], 8
jb 0x14003ff4d
mov rax, qword [rbx]
jmp 0x14003ff50
mov rax, rbx
mov word [rax], di
mov dword [rsp + 0x30], 1
mov r8, qword [0x1400a34c0]
add r8, 0x10
cmp qword [r8 + 0x18], 8
jb 0x14003ff70
mov r8, qword [r8]
mov ecx, 0xebcbcf43
call fcn.140028900
mov rdx, rax
mov r9d, 0x5017
movzx eax, word [rax]
xor ax, r9w
mov word [rsp + 0x48], ax
movzx eax, word [rdx + 2]
xor ax, r9w
mov word [rsp + 0x4a], ax
movzx eax, word [rdx + 4]
xor ax, r9w
mov word [rsp + 0x4c], ax
movzx eax, word [rdx + 6]
xor ax, r9w
mov word [rsp + 0x4e], ax
movzx eax, word [rdx + 8]
xor ax, r9w
mov word [rsp + 0x50], ax
movzx eax, word [rdx + 0xa]
xor ax, r9w
mov word [rsp + 0x52], ax
movzx eax, word [rdx + 0xc]
xor ax, r9w
mov word [rsp + 0x54], ax
movzx ecx, word [rdx + 0xe]
xor cx, r9w
mov word [rsp + 0x56], cx
movzx ecx, word [rdx + 0x10]
xor cx, r9w
mov word [rsp + 0x58], cx
mov word [rsp + 0x5a], di
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x60]
lea rdx, str._ls_ls_ls.exe
mov rcx, rbx
call fcn.140041cd0
mov rax, rbx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140051aa0
mov rbx, qword [rsp + 0x298]
add rsp, 0x280
pop rdi
ret
Function at 0x1400404f0
Capabilities:
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x14009e018]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 8]
call fcn.14002b3d0
test rax, rax
je 0x1400405cf
mov edx, dword [rdx]
lea r8, [rsp + 0x50]
mov rcx, rax
call fcn.14002b9e0
test eax, eax
jns 0x1400405cf
mov ecx, 0xc4fa85bb
call fcn.14001a490
mov edx, 0x5017
xor r9d, r9d
movzx ecx, word [rax]
xor cx, dx
mov word [rsp + 0x38], cx
movzx ecx, word [rax + 2]
xor cx, dx
mov word [rsp + 0x3a], cx
movzx ecx, word [rax + 4]
xor cx, dx
mov word [rsp + 0x3c], cx
movzx eax, word [rax + 6]
mov rcx, qword [0x1400a34c0]
xor ax, dx
mov word [rsp + 0x3e], ax
mov word [rsp + 0x40], r9w
test rcx, rcx
je 0x140040615
lea rdx, [rsp + 0x38]
or rax, 0xffffffffffffffff
nop
cmp word [rdx + rax*2 + 2], r9w
lea rax, [rax + 1]
jne 0x1400405a0
mov rcx, qword [rcx + 0x70]
lea r8d, [rax*2 + 2]
mov qword [rsp + 0x20], r9
lea rdx, [rsp + 0x38]
lea r9, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140040615
cmp qword [rbx + 0x28], 8
lea rdx, [rbx + 0x10]
jb 0x1400405dd
mov rdx, qword [rdx]
lea rcx, [rsp + 0x50]
call fcn.140055d34
test eax, eax
jne 0x140040615
mov r8d, dword [rdi]
lea ecx, [rax + 1]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140040615
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [0x1400692d0]
mov eax, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140051aa0
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret

Function at 0x1400406f0
Capabilities:
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14009e018]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
xor ebx, ebx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140040741
cmp dword [rsp + 0x24], 1
je 0x1400407b7
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x96
jl 0x140040711
call fcn.14002bef0
mov rbx, rax
test rax, rax
je 0x1400407b7
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400403f0
mov rcx, rbx
call fcn.14002b3d0
test rax, rax
je 0x14004078a
lea r9, [rsp + 0x40]
mov rdx, rax
call fcn.14002b870
mov rcx, rbx
call fcn.14002b3d0
test rax, rax
je 0x14004079f
mov rcx, rax
call fcn.14002bc70
mov r8, qword [rsp + 0x68]
cmp r8, 8
jb 0x1400407b7
mov rdx, qword [rsp + 0x50]
inc r8
call fcn.140019be0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140051aa0
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
Function at 0x140040b30
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x4a0], rbx
mov rax, qword [0x14009e018]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov rbx, rdx
lea r8, [0x14009339c]
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.140058e08
cmp qword [rsp + 0x40], 0
jne 0x140040c12
mov ecx, 0xef45c7ae
call fcn.14001a490
mov edx, 0x5017
movzx ecx, word [rax]
xor cx, dx
mov word [rsp + 0x60], cx
movzx ecx, word [rax + 2]
xor cx, dx
mov word [rsp + 0x62], cx
movzx ecx, word [rax + 4]
xor cx, dx
mov word [rsp + 0x64], cx
movzx eax, word [rax + 6]
xor ax, dx
mov word [rsp + 0x66], ax
xor ebx, ebx
mov word [rsp + 0x68], bx
mov rcx, qword [0x1400a34c0]
test rcx, rcx
je 0x140040c0b
lea rdx, [rsp + 0x60]
or rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rdx + rax*2], bx
jne 0x140040be0
lea r8d, [rax*2 + 2]
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, qword [rcx + 0x70]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
jmp 0x140040da9
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.14003a9c0
nop
lea r8, [0x14009339c]
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140058e08
cmp qword [rsp + 0x38], 0
jne 0x140040ce0
mov ecx, 0x7ab7314e
call fcn.14001a490
mov edx, 0x5017
movzx ecx, word [rax]
xor cx, dx
mov word [rsp + 0x60], cx
movzx ecx, word [rax + 2]
xor cx, dx
mov word [rsp + 0x62], cx
movzx ecx, word [rax + 4]
xor cx, dx
mov word [rsp + 0x64], cx
movzx eax, word [rax + 6]
xor ax, dx
mov word [rsp + 0x66], ax
xor ebx, ebx
mov word [rsp + 0x68], bx
mov rcx, qword [0x1400a34c0]
test rcx, rcx
je 0x140040d96
lea rdx, [rsp + 0x60]
or rax, 0xffffffffffffffff
nop word [rax + rax]
lea rax, [rax + 1]
cmp word [rdx + rax*2], bx
jne 0x140040cb0
lea r8d, [rax*2 + 2]
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, qword [rcx + 0x70]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140040d96
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.14003a9c0
mov r9, qword [rsp + 0x38]
mov edx, 1
mov r8d, 0x200
lea rcx, [rsp + 0x70]
call fcn.14005967c
mov rbx, rax
test rax, rax
je 0x140040d7f
nop dword [rax + rax]
mov r9, qword [rsp + 0x40]
mov edx, 1
mov r8d, 0x200
lea rcx, [rbp + 0x170]
call fcn.14005967c
cmp rbx, rax
jne 0x140040d7b
mov r8, rax
lea rdx, [rbp + 0x170]
lea rcx, [rsp + 0x70]
call fcn.1400547b0
test eax, eax
jne 0x140040d7b
mov r9, qword [rsp + 0x38]
lea edx, [rax + 1]
mov r8d, 0x200
lea rcx, [rsp + 0x70]
call fcn.14005967c
mov rbx, rax
test rax, rax
jne 0x140040d20
jmp 0x140040d7f
xor ebx, ebx
jmp 0x140040d84
mov ebx, 1
cmp byte [rsp + 0x60], 0
jne 0x140040d96
lea rcx, [rsp + 0x60]
call fcn.140041680
nop
cmp byte [rsp + 0x48], 0
jne 0x140040da7
lea rcx, [rsp + 0x48]
call fcn.140041680
mov eax, ebx
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.140051aa0
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x480
pop rbp
ret