joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000f0d0
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x278
mov rax, qword [0x1800ca088]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov ebx, dword [rsp + 0x2d0]
mov r15, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
lea ebp, [rbx + 0x2e4]
cmp ebx, ebp
jae 0x18000f301
mov ecx, 0x79
mov qword [r11 + 0x20], r12
mov qword [r11 - 0x38], r13
lea r10, [sym.BD2C9DBE_A741_4A5E_9408_4674B2734826.dll_json_getBoolean]
movabs r13, 0x4f004d00450044
xor r12d, r12d
lea edx, [rcx - 0x2c]
lea eax, [rcx - 5]
lea r8d, [rcx - 0xa]
lea r9d, [rcx - 0x12]
cmp ebx, 0x18b
ja 0x18000f238
je 0x18000f226
mov eax, ebx
sub eax, 0x9b
je 0x18000f1a3
sub eax, 0x12
je 0x18000f193
sub eax, 0x4a
je 0x18000f189
cmp eax, 0x4a
mov eax, 0x74
jne 0x18000f2e6
mov word [rsp + 0x2a], cx
mov dword [rsp + 0x2c], 0x610043
jmp 0x18000f2e6
mov word [rsp + 0x28], dx
jmp 0x18000f2e1
mov qword [rsp + 0x40], r13
mov word [rsp + 0x48], r12w
jmp 0x18000f2e1
mov ecx, dword [rdi]
sub ecx, 1
je 0x18000f1bc
cmp ecx, 1
je 0x18000f1cd
mov ebx, 0x9b
lea ecx, [rbx - 0x22]
jmp 0x18000f2e1
mov eax, 0x17
cmp eax, 0x17
je 0x18000f20a
inc eax
cmp eax, 0x18
jb 0x18000f1c1
mov eax, 0x93
cmp eax, 0x93
je 0x18000f1f0
add eax, 4
cmp eax, 0x97
jb 0x18000f1d2
mov ebx, 0x9b
lea ecx, [rbx - 0x22]
jmp 0x18000f2e1
mov ecx, dword [r14]
mov ebx, 0x9b
mov rax, qword [rdi + 8]
mov dword [rax + 0x2808], ecx
lea ecx, [rbx - 0x22]
jmp 0x18000f2e1
mov rax, qword [rdi + 8]
mov ecx, dword [r14]
mov dword [rax + 0xc008], ecx
mov ebx, 0x9b
mov ecx, 0x79
jmp 0x18000f2e1
mov word [rsp + 0x30], ax
mov dword [rsp + 0x32], 0x6c0061
jmp 0x18000f2e6
mov eax, ebx
sub eax, 0x1d5
je 0x18000f2d9
sub eax, 0x4a
je 0x18000f2b4
sub eax, 0x4a
je 0x18000f293
cmp eax, 0x4a
jne 0x18000f2e1
lea rcx, [rdi + 0x98]
cmp rcx, rsi
je 0x18000f21c
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x18000f271
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
call fcn.180073f70
mov ecx, 0x79
lea r10, [sym.BD2C9DBE_A741_4A5E_9408_4674B2734826.dll_json_getBoolean]
lea edx, [rcx - 0x2c]
lea r8d, [rcx - 0xa]
lea r9d, [rcx - 0x12]
jmp 0x18000f2e1
lea r9, [rsp + 0x50]
mov qword [rdi + 0x90], r10
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x18000f27a
mov eax, dword [r15]
lea rcx, [rsp + 0x20]
mov r9d, 0x8b
mov dword [rsp + 0x20], eax
mov r8, rdi
mov word [rsp + 0x3a], r12w
mov rdx, r14
call fcn.180032c10
jmp 0x18000f27a
mov dword [rsp + 0x36], 0x67006f
mov eax, 0x74
add ebx, 0x4a
cmp ebx, ebp
jb 0x18000f144
mov r13, qword [rsp + 0x270]
mov r12, qword [rsp + 0x2c8]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1800803f0
add rsp, 0x278
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18001e930
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x10], edx
push rsi
push rdi
push r14
sub rsp, 0x30
mov rsi, qword [rsp + 0x70]
xor r14d, r14d
movzx ebp, word [rsp + 0x58]
mov edi, 0x36
mov ebx, dword [rsp + 0x58]
mov eax, edi
sub eax, 0x36
je 0x18001e9ce
sub eax, 0x5f
je 0x18001e992
sub eax, 0x36
je 0x18001e97d
cmp eax, 0x5f
je 0x18001ea0b
jmp 0x18001e9fc
mov rax, qword [r14]
xor r9d, r9d
mov r8, rax
mov edx, eax
mov rcx, rsi
call qword [rsi + 0x30]
mov ebx, eax
jmp 0x18001e9fc
movzx ecx, bp
call qword [sym.imp.USER32.dll_VkKeyScanW]
mov eax, dword [rsp + 0x58]
cmp eax, 1
jne 0x18001e9b9
mov r9d, 0xac
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
call fcn.180070280
jmp 0x18001e9fc
cmp eax, 2
jne 0x18001e9fc
xor r8d, r8d
lea ecx, [rax + 0x3f]
mov rdx, rsi
call fcn.18001a0b0
jmp 0x18001e9fc
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rsi
mov ebp, 0x37
mov dword [rsp + 0x68], 0xfa
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
lea r8d, [rbp + 0x28]
call fcn.180036bf0
add edi, 0x5f
cmp edi, 0x211
jb 0x18001e961
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x180040ad0
Capabilities:
Get memory capacity

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
movaps xmmword [rax - 0x48], xmm6
mov rax, qword [0x1800ca088]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r15, r9
mov r14, r8
mov ebp, 0x10
mov r12d, 0xa2
lea r13, [0x180000000]
movzx ebx, byte [rsp + 0x30]
movaps xmm6, xmmword [rsp + 0x50]
xor edx, edx
cmp ebp, 0x10
ja case.0x180040b42.2
mov eax, ebp
mov ecx, dword [r13 + rax*4 + 0x40d38]
add rcx, r13
jmp rcx
mov ecx, 0x7c
nop dword [rax]
mov eax, ecx
sub eax, 0x7c
je 0x180040b62
cmp eax, 1
je 0x180040d02
jmp 0x180040b6a
cmp qword [r14 + 8], 0
setne bl
inc ecx
cmp ecx, 0x7e
jb 0x180040b50
mov eax, dword [r14]
imul eax, dword [r15]
mov dword [rdx], eax
jmp case.0x180040b42.2
mov rcx, qword [rsp + 0x88]
mov rax, rcx
sub rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rcx
movaps xmm6, xmmword [rsp + 0x60]
jmp case.0x180040b42.2
mov edi, 0xc6
nop dword [rax + rax]
cmp edi, 0xc6
je 0x180040bc6
cmp edi, 0x40f8
je 0x180040d02
jmp 0x180040be7
mov dword [rsp + 0x38], 1
mov r9d, 1
mov r8, r14
mov rdx, r15
lea rcx, [rsp + 0x38]
call fcn.1800114b0
movzx ebx, al
add edi, 0x4032
cmp edi, 0x8064
jbe 0x180040bb0
mov eax, dword [r14 + 4]
imul eax, dword [r15]
mov dword [4], eax
jmp case.0x180040b42.2
mov dword [rsp + 0x80], 0x40
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne case.0x180040b42.2
mov eax, 0x6f
nop
cmp eax, 0x6f
je 0x180040c40
cmp eax, 0x79
je 0x180040d02
jmp 0x180040c42
xor bl, bl
add eax, 0xa
cmp eax, 0x83
jb 0x180040c30
jmp case.0x180040b42.2
mov dword [rsp + 0x38], edx
mov rsi, qword [r14]
mov rdi, rsi
mov rax, qword [rsi + 8]
cmp byte [rax + 0x19], 0
jne 0x180040c87
nop word [rax + rax]
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x180040c70
cmp rdi, rsi
je 0x180040c87
cmp dword [rdi + 0x20], 0
jbe 0x180040ce2
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rdx
mov ecx, 0x38
call fcn.1800809f4
lea r9, [rax + 0x20]
mov ecx, dword [rsp + 0x38]
mov dword [r9], ecx
xorps xmm0, xmm0
movups xmmword [r9 + 8], xmm0
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov word [rax + 0x18], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
mov r8, rdi
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.180079d30
mov rdi, qword [rsp + 0x40]
movups xmmword [rdi + 0x28], xmm6
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumPropsW]
inc r12d
inc ebp
cmp r12d, 0xaa
jb 0x180040b2a
movzx eax, bl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800803f0
mov rbx, qword [rsp + 0x120]
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180046530
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea esi, [rcx + 0xc3]
mov rdi, rdx
mov ebx, ecx
cmp ecx, esi
jae 0x1800465b2
nop
mov eax, ebx
sub eax, 0x3f
je 0x1800465a8
sub eax, 0x54
je 0x180046572
cmp eax, 0x41
jne 0x1800465ab
mov eax, 5
cmp eax, 5
je 0x1800465c7
inc eax
cmp eax, 6
jb 0x180046566
cmp byte [rdi + 0x19], 0
je 0x180046593
mov eax, 0x9e
nop dword [rax]
cmp eax, 0x9e
je 0x1800465db
add eax, 0x25a6
cmp eax, 0x25a6
jbe 0x180046580
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
setne al
mov byte [rdi + 0x19], al
jmp 0x1800465ab
mov byte [rdi], 0
add ebx, 0x41
cmp ebx, esi
jb 0x180046550
movzx eax, byte [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rdi + 0x19]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
mov al, 1
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180074700
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x180074734
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x180074720
ret
Function at 0x140d53058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140d531df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140d53089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d5306f
add dl, dl
jne 0x140d53096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d530f6
xor eax, eax
add dl, dl
jne 0x140d530a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d531ad
add dl, dl
jne 0x140d530b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d530c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d530d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d530dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140d530ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140d5307e
mov eax, 1
add dl, dl
jne 0x140d53106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d53113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d530fb
sub eax, ebx
mov ebx, 1
jne 0x140d5314c
mov ecx, 1
add dl, dl
jne 0x140d5312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d5313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d53123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d5307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140d53168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d53175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d5315d
cmp eax, 0x7d00
jae 0x140d5319b
cmp eax, 0x500
jb 0x140d53196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d5307e
cmp eax, 0x7f
ja 0x140d5319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d5307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140d531d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140d5307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180002ea0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rsi
push r14
push r15
sub rsp, 0x40
xor esi, esi
mov r15, rdx
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], esi
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x180002f6d
xor edx, edx
mov qword [rsp + 0x78], rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test eax, eax
je 0x180002f5f
mov qword [rsp + 0x60], rbx
lea ecx, [rdi + 1]
mov qword [rsp + 0x68], rbp
call fcn.1800355a8
mov dword [rsp + 0x70], esi
mov ebx, esi
mov rbp, rax
mov byte [rdi + rax], bl
test edi, edi
je 0x180002f4a
nop word [rax + rax]
mov r8d, edi
mov edx, ebx
sub r8d, ebx
mov qword [rsp + 0x20], rsi
add rdx, rbp
lea r9, [rsp + 0x70]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180002f7a
add ebx, dword [rsp + 0x70]
cmp ebx, edi
jb 0x180002f20
test r15, r15
je 0x180002f52
mov dword [r15], edi
mov rsi, rbp
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x78]
mov rax, rsi
add rsp, 0x40
pop r15
pop r14
pop rsi
ret
cmp ebx, edi
jae 0x180002f4a
test rbp, rbp
je 0x180002f55
mov rcx, rbp
call fcn.180035594
jmp 0x180002f55

Function at 0x180002f90
Capabilities:
Delete file
Get common file path

Disassembly:
push rbx
sub rsp, 0x360
mov rax, qword [0x18006c048]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x240]
mov r8d, 0x105
call fcn.18002ff40
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x105
call fcn.18002ff40
xor edx, edx
lea rcx, [rsp + 0x130]
mov r8d, 0x105
call fcn.18002ff40
lea rdx, [rsp + 0x240]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r9, [rsp + 0x20]
xor r8d, r8d
lea rdx, str.gtest_redir
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov edx, 2
lea rcx, [rsp + 0x20]
call fcn.1800407c0
cmp eax, 0xffffffff
jne 0x180003076
lea r9, [rsp + 0x130]
xor r8d, r8d
lea rdx, str.gtest_redir
lea rcx, str.C:inetpub_tempIIS_Temporary_Compressed_Files_
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea rdx, [rsp + 0x130]
mov rcx, rbx
call fcn.1800030c0
xor edx, edx
lea rcx, [rsp + 0x130]
call fcn.180002ea0
lea rcx, [rsp + 0x130]
jmp 0x180003094
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800030c0
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.180002ea0
lea rcx, [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rax, rbx
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.18002e380
add rsp, 0x360
pop rbx
ret
Function at 0x18002315c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x18000d3aa
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x18000d38d
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x18000d378

Function at 0x18002d384
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x18006e150]
mov ebx, r9d
mov rdi, r8
mov esi, edx
test rax, rax
je 0x18002d3af
call qword [0x180054328]
jmp 0x18002d3c4
call fcn.18002d350
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x18003588c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x180035763
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180035763
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x180035763
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x180035763
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x180035763
cmp dword [rcx + 0x84], 0xe
jbe 0x180035763
cmp dword [rcx + 0xf8], 0
je 0x180035763
mov ecx, ebx
call fcn.180035804
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1800355f4
cmp dword [rbp + 0x20], 0
je 0x1800357b0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1800357b8
int3
xor r8d, r8d
xor edx, edx
jmp 0x1800356fc
Function at 0x14002a870
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14002a87d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14002a88d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14002a875
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14002a8a5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14002a892
sub eax, 3
jb 0x14002a8bf
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14002a8f6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14002a8e6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14002a8e4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14002a8d3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14002a832
jmp 0x14002a87d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x5800
mov dl, 7
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14002a942
cmp rsi, rcx
jae 0x14002a94a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14002a929
cmp al, 0x8f
ja 0x14002a929
cmp byte [rsi - 2], 0xf
je 0x14002a92f
sub al, 0xe8
cmp al, 1
ja 0x14002a913
cmp rsi, rcx
jae 0x14002a94a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14002a919
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14002a94a
lodsb al, byte [rsi]
jmp 0x14002a929
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x28000]
mov eax, dword [rdi]
or eax, eax
je 0x14002a9a7
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x42a98]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14002a957
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14002a9a1
mov qword [rbx], rax
add rbx, 8
jmp 0x14002a977
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14002a9e1
cmp al, 0xef
ja 0x14002a9d3
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14002a9b3
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14002a9c2
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x20f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14002aa35
sub rsp, 0xffffffffffffff80
jmp 0x1400017c4
Function at 0x140007010
Capabilities:
Access the windows event log

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1401b4808]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r10, qword [rcx + 8]
mov qword [rsp + 0x50], r8
test r10, r10
je 0x140007091
test r8, r8
je 0x140007091
mov r11d, 1
test edx, edx
je 0x14000704b
cmp edx, r11d
jne 0x14000704b
movzx eax, r11w
jmp 0x140007050
mov eax, 4
cmp edx, r11d
mov ecx, 0xc0020011
mov r9d, 0x40020010
mov r8d, r11d
cmove r9d, ecx
xor edx, edx
mov qword [rsp + 0x40], rdx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov rcx, r10
mov dword [rsp + 0x30], edx
mov word [rsp + 0x28], r11w
mov qword [rsp + 0x20], rdx
movzx edx, ax
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400d1740
add rsp, 0x68
ret

Function at 0x140007110
Capabilities:
Access the windows event log

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1401b4808]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r10, qword [rcx + 8]
mov qword [rsp + 0x50], r8
test r10, r10
je 0x140007191
test r8, r8
je 0x140007191
mov r11d, 1
test edx, edx
je 0x14000714b
cmp edx, r11d
jne 0x14000714b
movzx eax, r11w
jmp 0x140007150
mov eax, 4
cmp edx, r11d
mov ecx, 0xc0020011
mov r9d, 0x40020010
mov r8d, r11d
cmove r9d, ecx
xor edx, edx
mov qword [rsp + 0x40], rdx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov rcx, r10
mov dword [rsp + 0x30], edx
mov word [rsp + 0x28], r11w
mov qword [rsp + 0x20], rdx
movzx edx, ax
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400d1740
add rsp, 0x68
ret

Function at 0x140007a50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401b4808]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [rcx + 0x270]
mov rsi, rcx
mov rax, qword [rdi]
mov rbx, qword [rax + 0x20]
mov rcx, rbx
call qword [fcn.140007230]
lea r8, str.Service_start
xor edx, edx
mov rcx, rdi
call rbx
mov rcx, qword [rsi + 0x260]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
lea rax, [rsp + 0x30]
mov r9, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x140007a40]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400d1740
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140007cd0
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rsi, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor ebx, ebx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140007d83
lea rdx, [rsi + 0x278]
mov qword [rsp + 0x70], rbp
cmp qword [rdx + 0x18], 8
jb 0x140007d16
mov rdx, qword [rdx]
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov rbp, rax
test rax, rax
je 0x140007d71
mov qword [rsp + 0x50], rbx
or r9d, 0xffffffff
mov qword [rsp + 0x48], rbx
mov r8d, 4
mov qword [rsp + 0x40], rbx
or edx, r9d
mov qword [rsp + 0x38], rbx
mov rcx, rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfigW]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x70]
test ebx, ebx
jne 0x140007da8
mov rdi, qword [rsi + 0x270]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140007230]
lea r8, str.Error_while_disabling_service.
xor edx, edx
mov rcx, rdi
call rbx
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x1400173f0
Capabilities:
Query service status
Stop service

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rcx
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x254
mov eax, dword [rcx + rdx]
mov r8d, 0x250
test al, 1
jne 0x140017437
or eax, 1
mov dword [rcx + rdx], eax
mov ecx, r8d
add rcx, rdx
call fcn.14000e570
nop
cmp byte [r8 + rdx + 1], 0
je 0x14001747d
lea rdx, str.unsigned_long___cdecl_MinifilterStopCommand::Execute_int_wchar_t____
lea rdi, [0x1401c2020]
mov rcx, rdi
call fcn.14000f0f0
mov rax, qword [0x1401c2020]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call fcn.14000edc0
movzx edx, al
mov rcx, rdi
call fcn.14000ec70
mov rcx, rdi
call fcn.14000eb70
mov rcx, qword [rbx + 8]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140027df0
Function at 0x1400194e0
Capabilities:
Start service

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rcx
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x254
mov eax, dword [rcx + rdx]
mov r8d, 0x250
test al, 1
jne 0x140019527
or eax, 1
mov dword [rcx + rdx], eax
mov ecx, r8d
add rcx, rdx
call fcn.14000e570
nop
cmp byte [r8 + rdx + 1], 0
je 0x14001956d
lea rdx, str.Starting_service
lea rdi, [0x1401c2020]
mov rcx, rdi
call fcn.14000f0f0
mov rax, qword [0x1401c2020]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call fcn.14000edc0
movzx edx, al
mov rcx, rdi
call fcn.14000ec70
mov rcx, rdi
call fcn.14000eb70
mov rcx, qword [rbx + 8]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp 0x140027c70