joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800315d0
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1800315f9
lea ecx, [rbx + 0x57]
mov dword [0x180121474], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor r9d, r9d
lea r8, [0x180031450]
lea edx, [r9 + 0x20]
call fcn.180030ed0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov rcx, rbx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ebx, eax
test eax, eax
jne 0x18003164a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180121474], eax
test eax, eax
je 0x18003164a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x180031660
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x180031689
lea ecx, [rbx + 0x57]
mov dword [0x180121474], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor r9d, r9d
lea r8, [0x180031510]
lea edx, [r9 + 0x20]
call fcn.180031040
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, rbx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebx, eax
test eax, eax
jne 0x1800316da
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180121474], eax
test eax, eax
je 0x1800316da
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x180032c00
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov rsi, r8
mov edi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.1800369b0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x18002da04
lea r8, [rsp + 0x20]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.18002d6d0
jmp 0x18002da0a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x180121474], eax
test eax, eax
je 0x18002da1e
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180036980
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret
jmp 0x18002d9a0
Function at 0x180032f50
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
call fcn.18002c2b0
test eax, eax
je 0x18002decd
mov r8, rsi
mov edx, edi
mov rcx, rbx
call fcn.18002dd40
jmp 0x18002df44
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.1800369b0
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x18002df23
lea rdx, [0x1800c1b30]
lea rcx, [rsp + 0x20]
mov r8d, 0x103
call fcn.18003e5d0
lea r8, [rsp + 0x20]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.18002d6d0
jmp 0x18002df29
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x180121474], eax
test eax, eax
je 0x18002df3d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180036980
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret
jmp 0x18002de90

Function at 0x1800331d0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
mov r12, r8
mov ebp, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.1800369b0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
test eax, eax
je 0x1800332e6
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x180033256
lea eax, [rcx - 1]
mov ecx, eax
movzx eax, byte [rsp + rax + 0x20]
cmp byte [rsp + rcx + 0x20], 0x5c
cmove eax, ebx
mov byte [rsp + rcx + 0x20], al
lea rcx, [rsp + 0x20]
call fcn.18002d490
test eax, eax
je 0x1800332d2
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x130], bl
call fcn.1800369b0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180032750
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800332d2
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180038a00
mov byte [rsp + rdi + 0x20], bl
lea r8, [rsp + 0x20]
mov r9, r12
mov edx, ebp
mov rcx, rsi
call fcn.18002d6d0
jmp 0x1800332ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [0x180121474], eax
test eax, eax
je 0x180033302
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180036980
add rsp, 0x250
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800331d0
Function at 0x1800340c0
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.1800369b0
lea rdx, [rsp + 0x20]
lea rcx, [0x1800cd3a8]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x1800341cc
lea rcx, [rsp + 0x20]
call fcn.18002d490
test eax, eax
je 0x1800341b3
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.1800369b0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180032750
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800341ab
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180038a00
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.18002d6d0
mov eax, 1
jmp 0x1800341ce
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180036980
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800340c0

Function at 0x180034330
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.1800369b0
lea rdx, [rsp + 0x20]
lea rcx, [0x1800cd3d8]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x18003443c
lea rcx, [rsp + 0x20]
call fcn.18002d490
test eax, eax
je 0x180034423
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.1800369b0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180032750
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x18003441b
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180038a00
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.18002d6d0
mov eax, 1
jmp 0x18003443e
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180036980
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x180034330
Function at 0x1800350e0
Capabilities:
Check if file exists
Move file

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x150
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov ebp, r8d
mov rbx, rdx
mov rsi, rcx
test rcx, rcx
je 0x1800352b1
test rdx, rdx
je 0x1800352b1
xor edx, edx
call fcn.18002f1d0
test eax, eax
jne 0x18003513f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180121474], eax
test eax, eax
je 0x18003513b
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800351ab
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x148], r12
mov rcx, rbx
mov qword [rsp + 0x140], r13
xor r12d, r12d
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea r13d, [r12 + 1]
cmp eax, 0xffffffff
je 0x18003517d
test al, 0x10
jne 0x18003517d
mov r12d, r13d
test r12b, al
cmovne edi, r13d
test r13b, bpl
je 0x1800351c6
test r12d, r12d
je 0x1800351c6
mov dword [0x180121474], 0x50
xor eax, eax
mov r12, qword [rsp + 0x148]
mov rdi, qword [rsp + 0x180]
mov r13, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180036980
add rsp, 0x150
pop rsi
pop rbp
pop rbx
ret
test bpl, 2
je 0x1800351dc
test edi, edi
je 0x1800351dc
mov dword [0x180121474], 5
jmp 0x180035191
cmp eax, 0xffffffff
je 0x1800351f4
mov rcx, rbx
test al, 0x10
je 0x1800351ef
call fcn.1800315d0
jmp 0x1800351f4
call fcn.18002f6f0
mov rdx, rbx
mov rcx, rsi
mov dword [0x180121474], 0
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov edi, eax
test eax, eax
jne 0x18003528d
test bpl, 4
jne 0x180035294
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x180035294
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], dil
call fcn.1800369b0
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rbx
call fcn.18002d1d0
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.18002fdc0
test eax, eax
jne 0x180035275
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.180030850
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180121474], eax
test eax, eax
je 0x18003528d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
jmp 0x180035193
test bpl, 8
je 0x180035275
mov rdx, rbx
mov rcx, rsi
call fcn.18002fc60
test eax, eax
je 0x180035275
mov eax, r13d
jmp 0x180035193
mov ecx, 0x57
mov dword [0x180121474], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800351ab
jmp 0x1800350e0
Function at 0x180035f40
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
mov r12, r8
mov ebp, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.1800369b0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
test eax, eax
je 0x1800332e6
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x180033256
lea eax, [rcx - 1]
mov ecx, eax
movzx eax, byte [rsp + rax + 0x20]
cmp byte [rsp + rcx + 0x20], 0x5c
cmove eax, ebx
mov byte [rsp + rcx + 0x20], al
lea rcx, [rsp + 0x20]
call fcn.18002d490
test eax, eax
je 0x1800332d2
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x130], bl
call fcn.1800369b0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180032750
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800332d2
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180038a00
mov byte [rsp + rdi + 0x20], bl
lea r8, [rsp + 0x20]
mov r9, r12
mov edx, ebp
mov rcx, rsi
call fcn.18002d6d0
jmp 0x1800332ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [0x180121474], eax
test eax, eax
je 0x180033302
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180036980
add rsp, 0x250
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800331d0

Function at 0x1800363c0
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.1800369b0
lea rdx, [rsp + 0x20]
lea rcx, [0x1800cd3a8]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x1800341cc
lea rcx, [rsp + 0x20]
call fcn.18002d490
test eax, eax
je 0x1800341b3
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.1800369b0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180032750
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800341ab
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180038a00
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.18002d6d0
mov eax, 1
jmp 0x1800341ce
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180036980
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800340c0
Function at 0x180036480
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.1800369b0
lea rdx, [rsp + 0x20]
lea rcx, [0x1800cd3d8]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x18003443c
lea rcx, [rsp + 0x20]
call fcn.18002d490
test eax, eax
je 0x180034423
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.1800369b0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180032750
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x18003441b
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180038a00
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.18002d6d0
mov eax, 1
jmp 0x18003443e
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180036980
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x180034330
Function at 0x1800367c0
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x150
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov ebp, r8d
mov rbx, rdx
mov rsi, rcx
test rcx, rcx
je 0x1800352b1
test rdx, rdx
je 0x1800352b1
xor edx, edx
call fcn.18002f1d0
test eax, eax
jne 0x18003513f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180121474], eax
test eax, eax
je 0x18003513b
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800351ab
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x148], r12
mov rcx, rbx
mov qword [rsp + 0x140], r13
xor r12d, r12d
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea r13d, [r12 + 1]
cmp eax, 0xffffffff
je 0x18003517d
test al, 0x10
jne 0x18003517d
mov r12d, r13d
test r12b, al
cmovne edi, r13d
test r13b, bpl
je 0x1800351c6
test r12d, r12d
je 0x1800351c6
mov dword [0x180121474], 0x50
xor eax, eax
mov r12, qword [rsp + 0x148]
mov rdi, qword [rsp + 0x180]
mov r13, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180036980
add rsp, 0x150
pop rsi
pop rbp
pop rbx
ret
test bpl, 2
je 0x1800351dc
test edi, edi
je 0x1800351dc
mov dword [0x180121474], 5
jmp 0x180035191
cmp eax, 0xffffffff
je 0x1800351f4
mov rcx, rbx
test al, 0x10
je 0x1800351ef
call fcn.1800315d0
jmp 0x1800351f4
call fcn.18002f6f0
mov rdx, rbx
mov rcx, rsi
mov dword [0x180121474], 0
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov edi, eax
test eax, eax
jne 0x18003528d
test bpl, 4
jne 0x180035294
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x180035294
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], dil
call fcn.1800369b0
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rbx
call fcn.18002d1d0
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.18002fdc0
test eax, eax
jne 0x180035275
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.180030850
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180121474], eax
test eax, eax
je 0x18003528d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
jmp 0x180035193
test bpl, 8
je 0x180035275
mov rdx, rbx
mov rcx, rsi
call fcn.18002fc60
test eax, eax
je 0x180035275
mov eax, r13d
jmp 0x180035193
mov ecx, 0x57
mov dword [0x180121474], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800351ab
jmp 0x1800350e0
Function at 0x18003e84b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1801003f0]
jne 0x18003699a
rol rcx, 0x10
test cx, 0xffff
jne 0x180036996
repz ret
ror rcx, 0x10
jmp 0x18003e7a4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180121640]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x180121738]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18003e829
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180121640]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18003e84b
mov rax, qword [rsp + 0x88]
mov qword [0x180121738], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1801216d8], rax
mov rax, qword [0x180121738]
mov qword [0x1801215b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1801216c0], rax
mov dword [0x1801215a0], 0xc0000409
mov dword [0x1801215a4], 1
mov rax, qword [0x1801003f0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1801003f8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180121638], eax
mov ecx, 1
call fcn.180051964
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800cd890]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180121638], 0
jne 0x18003e8d2
mov ecx, 1
call fcn.180051964
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x18005e0f4
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.18003f538
xor ebx, ebx
cmp qword [0x180122708], rbx
mov rdi, rax
jne 0x18005e207
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x18005e2de
lea rdx, [0x1800d01b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18005e2de
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180122708], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180122710], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1800d0168]
mov rcx, rsi
mov qword [0x180122718], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x180122728], rax
test rax, rax
je 0x18005e1fe
lea rdx, [0x1800d0150]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x180122720], rax
jmp 0x18005e20e
mov rax, qword [0x180122720]
jmp 0x18005e215
mov rax, qword [0x180122720]
mov r11, qword [0x180122728]
cmp rax, rdi
je 0x18005e27c
cmp r11, rdi
je 0x18005e27c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x180122728]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x18005e27c
test rax, rax
je 0x18005e27c
call rsi
test rax, rax
je 0x18005e276
lea rcx, [rsp + 0x30]
mov r9d, SafeArrayCreate
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18005e276
test byte [rsp + 0x40], 1
jne 0x18005e27c
bts ebp, 0x15
jmp 0x18005e2bc
mov rcx, qword [0x180122710]
cmp rcx, rdi
je 0x18005e2bc
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18005e2bc
call rax
mov rbx, rax
test rax, rax
je 0x18005e2bc
mov rcx, qword [0x180122718]
cmp rcx, rdi
je 0x18005e2bc
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18005e2bc
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180122708]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18005e2de
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x18005e2e0
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180036980
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800684b0
Capabilities:
Delete service

Disassembly:
push rdi
sub rsp, 0x50
mov rdi, rcx
call fcn.18002c2b0
test eax, eax
je 0x1800684d4
mov dword [0x180122748], 0x32
xor eax, eax
add rsp, 0x50
pop rdi
ret
test rdi, rdi
jne 0x1800684eb
mov dword [0x180122748], 0x57
xor eax, eax
add rsp, 0x50
pop rdi
ret
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x20]
xor ebx, ebx
mov r9d, 0xf01ff
mov r8d, 0xf003f
mov rdx, rdi
mov dword [0x180122748], ebx
call fcn.180068190
lea rcx, [rsp + 0x20]
call fcn.180068230
test rax, rax
je 0x180068547
lea rcx, [rsp + 0x20]
call fcn.180068230
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebx, eax
test eax, eax
jne 0x180068565
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180122748], eax
jmp 0x18006854d
mov eax, dword [0x180122748]
test eax, eax
jne 0x180068565
mov eax, dword [rsp + 0x20]
test eax, eax
jne 0x18006855f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180122748], eax
lea rcx, [rsp + 0x20]
call fcn.180068290
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x180068580
Capabilities:
Start service

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, r8
mov ebp, edx
mov rdi, rcx
call fcn.18002c2b0
test eax, eax
je 0x1800685bc
mov dword [0x180122748], 0x32
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
test rdi, rdi
jne 0x1800685dd
mov dword [0x180122748], 0x57
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov qword [rsp + 0x60], rbx
xor ebx, ebx
lea rcx, [rsp + 0x20]
lea r9d, [rbx + 0x10]
lea r8d, [rbx + 2]
mov rdx, rdi
mov dword [0x180122748], ebx
call fcn.180068190
lea rcx, [rsp + 0x20]
call fcn.180068230
test rax, rax
je 0x180068646
lea rcx, [rsp + 0x20]
call fcn.180068230
mov r8, rsi
mov edx, ebp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov ebx, eax
test eax, eax
jne 0x180068664
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180122748], eax
cmp eax, 0x420
jne 0x18006864c
mov ebx, 1
jmp 0x180068664
mov eax, dword [0x180122748]
test eax, eax
jne 0x180068664
mov eax, dword [rsp + 0x20]
test eax, eax
jne 0x18006865e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180122748], eax
lea rcx, [rsp + 0x20]
call fcn.180068290
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret