joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002cd4
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1400419a0
mov rax, rsp
push rdi
sub rsp, 0x2a0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov esi, edx
mov rbp, rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
xor r8d, r8d
lea rdx, [0x1400624f4]
lea rcx, [rsp + 0x30]
call fcn.140002ef5
nop
xor edx, edx
lea ecx, [rbx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140041aaf
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x54]
call sub.MSVCR110.dll_memset
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140041a8f
cmp dword [rsp + 0x58], esi
je 0x140041a60
lea rdx, [rsp + 0x50]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x140041aa4
jmp 0x140041a47
cmp word [rsp + 0x7c], 0
je 0x140041a7b
lea rax, [rsp + 0x7c]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140041a71
mov r8, rbx
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x30]
call fcn.140002ef5
jmp 0x140041aa4
cmp byte [0x14007ca60], 0
je 0x140041aa4
lea rcx, str.GetAppNameUsingSnapshot:Process32FirstW_failed_n
call fcn.1400031a2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140041ac4
cmp byte [0x14007ca60], 0
je 0x140041ac4
lea rcx, str.GetAppNameUsingSnapshot:CreateToolhelp32Snapshot_failed_n
call fcn.1400031a2
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.1400010c8
nop
cmp qword [rsp + 0x48], 8
jb 0x140041ae4
mov rcx, qword [rsp + 0x30]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov rax, rbp
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140052d40
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140002ff4
Capabilities:
Check os version

Disassembly:
jmp 0x1400343f0
push rbx
sub rsp, 0x150
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor ebx, ebx
cmp dword [0x14007cbc4], ebx
jne 0x1400345e3
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
mov dword [0x14007cbc4], ebx
call sub.MSVCR110.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1400345e3
cmp dword [rsp + 0x30], 2
je 0x140034471
cmp byte [0x14007ca62], bl
je 0x140034583
mov r9d, 0x16c
lea rdx, str.__Unknown_platform_ID_
jmp 0x140034570
mov eax, dword [rsp + 0x24]
cmp eax, 3
jb 0x14003458f
cmp eax, 4
jbe 0x14003455b
cmp eax, 5
je 0x1400344f8
cmp eax, 6
jne 0x14003458f
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x1400344e9
dec eax
je 0x1400345b7
dec eax
je 0x1400344da
dec eax
je 0x1400344cb
cmp byte [0x14007ca62], bl
je 0x1400345b7
mov r9d, 0x15d
lea rdx, str.__Unknown_minor_version__assume_Win7__
jmp 0x1400345a4
mov dword [0x14007cbc4], 6
jmp 0x1400345c1
mov dword [0x14007cbc4], 5
jmp 0x1400345c1
mov dword [0x14007cbc4], 3
jmp 0x1400345c1
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x14003454b
dec eax
je 0x140034530
dec eax
je 0x14003453f
cmp byte [0x14007ca62], bl
je 0x140034530
lea r8, str...Commonwinplats.cpp
lea rdx, str.__Unknown_minor_version__assume_XP__
lea rcx, str.Assert:__s__in__s_at__i_n
mov r9d, 0x143
call fcn.1400031a2
mov dword [0x14007cbc4], 1
jmp 0x1400345c1
mov dword [0x14007cbc4], 2
jmp 0x1400345c1
cmp byte [0x14007ca62], bl
je 0x140034583
mov r9d, 0x136
jmp 0x140034569
cmp byte [0x14007ca62], bl
je 0x140034583
mov r9d, 0x12e
lea rdx, str.__Obsolete_platform_ID_
lea r8, str...Commonwinplats.cpp
lea rcx, str.Assert:__s__in__s_at__i_n
call fcn.1400031a2
mov dword [0x14007cbc4], 7
jmp 0x1400345c1
cmp byte [0x14007ca62], bl
je 0x1400345b7
mov r9d, 0x164
lea rdx, str.__Unknown_NT_Platform__assume_Win7__
lea r8, str...Commonwinplats.cpp
lea rcx, str.Assert:__s__in__s_at__i_n
call fcn.1400031a2
mov dword [0x14007cbc4], 4
mov edx, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x24]
call fcn.140002a27
movzx ecx, word [rsp + 0x134]
mov word [0x14007cbc8], cx
mov dword [0x14007cbcc], eax
cmp dword [0x14007cbc4], 6
sete al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140052d40
add rsp, 0x150
pop rbx
ret
Function at 0x1400034f4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140019c60
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, qword [rcx + 0x28]
movzx ebp, dx
mov rsi, rcx
movzx edi, dx
cmp rcx, rbx
je 0x140019c99
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
call fcn.14000254a
mov eax, dword [rbx + 0x20]
xor r8d, r8d
mov r14d, 0x3ff
mov dword [rsi + 0x20], eax
movzx eax, word [rbx + 0x24]
mov r10d, 0x804
mov word [rsi + 0x24], ax
movzx edx, word [rsi + 0x64]
lea r9d, [r8 + 4]
mov byte [rsi + 0x68], 0
mov r15d, 0xfc00
lea r11d, [r8 + 9]
nop dword [rax]
cmp di, dx
je 0x140019d92
mov rbx, qword [rsi + 0x28]
mov rax, qword [rsi + 0x30]
cmp rbx, rax
je 0x140019cf5
cmp word [rbx + 0x24], di
je 0x140019d61
add rbx, 0x28
cmp rbx, rax
jne 0x140019ce6
movzx ecx, di
cmp r8w, di
je 0x140019dbc
movzx eax, di
and ax, r14w
cmp ax, r9w
jne 0x140019d3d
movzx eax, di
shr eax, 0xa
test eax, eax
je 0x140019d52
jle 0x140019d37
cmp eax, 2
jle 0x140019d31
add eax, 0xfffffffd
test eax, 0xfffffffd
jne 0x140019d37
mov edi, 0x404
jmp 0x140019d56
movzx edi, r9w
jmp 0x140019d56
movzx edi, r10w
jmp 0x140019d56
test r15w, di
je 0x140019d48
movzx edi, ax
jmp 0x140019d56
movzx edi, r11w
cmp ax, r11w
jne 0x140019d56
movzx edi, r8w
cmp di, cx
jne 0x140019cd0
jmp 0x140019dbc
cmp rsi, rbx
je 0x140019d75
or r9, 0xffffffffffffffff
mov rdx, rbx
mov rcx, rsi
call fcn.14000254a
mov eax, dword [rbx + 0x20]
xor di, bp
mov dword [rsi + 0x20], eax
movzx eax, word [rbx + 0x24]
test r14w, di
mov word [rsi + 0x24], ax
sete al
mov byte [rsi + 0x68], al
jmp 0x140019dbc
lea rbx, [rsi + 0x40]
mov byte [rsi + 0x68], 1
cmp rsi, rbx
je 0x140019dae
or r9, 0xffffffffffffffff
mov rdx, rbx
mov rcx, rsi
call fcn.14000254a
mov eax, dword [rbx + 0x20]
mov dword [rsi + 0x20], eax
movzx eax, word [rbx + 0x24]
mov word [rsi + 0x24], ax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14000356c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x14001de90
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov qword [r11 - 0x80], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbp, r9
movzx ebx, r8w
movzx r15d, dx
mov r14, rcx
mov qword [r11 - 0x70], rcx
mov rsi, qword [rsp + 0xe0]
mov qword [r11 - 0x78], rsi
xor r13d, r13d
mov r12d, r13d
mov qword [r11 - 0x50], 0xf
mov qword [r11 - 0x58], r13
mov byte [r11 - 0x68], r12b
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rcx
lea rcx, [r11 - 0x68]
call fcn.14000254a
nop
mov word [rsp + 0x20], bx
movzx edi, byte [rsp + 0xe8]
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r8, qword [rsp + 0x50]
movzx r9d, bx
mov edx, 0xa
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceExA]
test rax, rax
jne 0x14001df5f
test dil, dil
je 0x14001e016
lea rcx, [rsp + 0x20]
call fcn.14000385a
test al, al
je 0x14001e016
movzx ebx, word [rsp + 0x20]
jmp 0x14001df15
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x14001e016
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14001e00c
mov edi, 0xffff
cmp word [rax], di
je 0x14001e00c
mov rcx, qword [rsi + 0x18]
cmp word [rbx], r15w
je 0x14001dfca
add rbx, 2
mov qword [rsp + 0x28], rbx
test rcx, rcx
je 0x14001dfc3
mov rax, qword [rcx]
lea rdx, [rsp + 0x28]
call qword [rax + 0x10]
add rbx, rax
cmp word [rbx], di
jne 0x14001df96
jmp 0x14001e00c
call qword [sym.imp.MSVCP110.dll_void___cdecl_std::_Xbad_function_call_void_]
int3
add rbx, 2
mov qword [rsp + 0x30], rbx
test rcx, rcx
jne 0x14001dfdf
call qword [sym.imp.MSVCP110.dll_void___cdecl_std::_Xbad_function_call_void_]
int3
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x10]
mov rdi, rax
mov edx, 1
mov rcx, rax
call qword [sym.imp.MSVCR110.dll_calloc]
mov r12, rax
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call sub.MSVCR110.dll_memcpy
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
nop
cmp qword [rsp + 0x68], 0x10
jb 0x14001e028
mov rcx, qword [rsp + 0x50]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x68], 0xf
mov qword [rsp + 0x60], r13
mov byte [rsp + 0x50], 0
cmp qword [r14 + 0x18], 0x10
jb 0x14001e04a
mov rcx, qword [r14]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [r14 + 0x18], 0xf
mov qword [r14 + 0x10], r13
mov byte [r14], 0
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14001e073
mov rax, qword [rcx]
cmp rcx, rsi
setne dl
call qword [rax + 0x20]
mov qword [rsi + 0x18], r13
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14001e08c
mov rax, qword [rcx]
cmp rcx, rsi
setne dl
call qword [rax + 0x20]
mov qword [rsi + 0x18], r13
mov rax, r12
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140052d40
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400036a2
Capabilities:
Check os version

Disassembly:
jmp 0x140034930
push rbx
sub rsp, 0x150
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor ebx, ebx
cmp dword [0x14007cbc4], ebx
jne 0x140034b23
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
mov dword [0x14007cbc4], ebx
call sub.MSVCR110.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140034b23
cmp dword [rsp + 0x30], 2
je 0x1400349b1
cmp byte [0x14007ca62], bl
je 0x140034ac3
mov r9d, 0x16c
lea rdx, str.__Unknown_platform_ID_
jmp 0x140034ab0
mov eax, dword [rsp + 0x24]
cmp eax, 3
jb 0x140034acf
cmp eax, 4
jbe 0x140034a9b
cmp eax, 5
je 0x140034a38
cmp eax, 6
jne 0x140034acf
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x140034a29
dec eax
je 0x140034af7
dec eax
je 0x140034a1a
dec eax
je 0x140034a0b
cmp byte [0x14007ca62], bl
je 0x140034af7
mov r9d, 0x15d
lea rdx, str.__Unknown_minor_version__assume_Win7__
jmp 0x140034ae4
mov dword [0x14007cbc4], 6
jmp 0x140034b01
mov dword [0x14007cbc4], 5
jmp 0x140034b01
mov dword [0x14007cbc4], 3
jmp 0x140034b01
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x140034a8b
dec eax
je 0x140034a70
dec eax
je 0x140034a7f
cmp byte [0x14007ca62], bl
je 0x140034a70
lea r8, str...Commonwinplats.cpp
lea rdx, str.__Unknown_minor_version__assume_XP__
lea rcx, str.Assert:__s__in__s_at__i_n
mov r9d, 0x143
call fcn.1400031a2
mov dword [0x14007cbc4], 1
jmp 0x140034b01
mov dword [0x14007cbc4], 2
jmp 0x140034b01
cmp byte [0x14007ca62], bl
je 0x140034ac3
mov r9d, 0x136
jmp 0x140034aa9
cmp byte [0x14007ca62], bl
je 0x140034ac3
mov r9d, 0x12e
lea rdx, str.__Obsolete_platform_ID_
lea r8, str...Commonwinplats.cpp
lea rcx, str.Assert:__s__in__s_at__i_n
call fcn.1400031a2
mov dword [0x14007cbc4], 7
jmp 0x140034b01
cmp byte [0x14007ca62], bl
je 0x140034af7
mov r9d, 0x164
lea rdx, str.__Unknown_NT_Platform__assume_Win7__
lea r8, str...Commonwinplats.cpp
lea rcx, str.Assert:__s__in__s_at__i_n
call fcn.1400031a2
mov dword [0x14007cbc4], 4
mov edx, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x24]
call fcn.140002a27
movzx ecx, word [rsp + 0x134]
mov word [0x14007cbc8], cx
mov dword [0x14007cbcc], eax
cmp dword [0x14007cbc4], 1
sete al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140052d40
add rsp, 0x150
pop rbx
ret
Function at 0x1400036de
Capabilities:
Check os version

Disassembly:
jmp 0x140033620
push rbx
sub rsp, 0x150
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor ebx, ebx
cmp dword [0x14007cbc4], ebx
jne 0x140033813
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
mov dword [0x14007cbc4], ebx
call sub.MSVCR110.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140033813
cmp dword [rsp + 0x30], 2
je 0x1400336a1
cmp byte [0x14007ca62], bl
je 0x1400337b3
mov r9d, 0x16c
lea rdx, str.__Unknown_platform_ID_
jmp 0x1400337a0
mov eax, dword [rsp + 0x24]
cmp eax, 3
jb 0x1400337bf
cmp eax, 4
jbe 0x14003378b
cmp eax, 5
je 0x140033728
cmp eax, 6
jne 0x1400337bf
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x140033719
dec eax
je 0x1400337e7
dec eax
je 0x14003370a
dec eax
je 0x1400336fb
cmp byte [0x14007ca62], bl
je 0x1400337e7
mov r9d, 0x15d
lea rdx, str.__Unknown_minor_version__assume_Win7__
jmp 0x1400337d4
mov dword [0x14007cbc4], 6
jmp 0x1400337f1
mov dword [0x14007cbc4], 5
jmp 0x1400337f1
mov dword [0x14007cbc4], 3
jmp 0x1400337f1
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x14003377b
dec eax
je 0x140033760
dec eax
je 0x14003376f
cmp byte [0x14007ca62], bl
je 0x140033760
lea r8, str...Commonwinplats.cpp
lea rdx, str.__Unknown_minor_version__assume_XP__
lea rcx, str.Assert:__s__in__s_at__i_n
mov r9d, 0x143
call fcn.1400031a2
mov dword [0x14007cbc4], 1
jmp 0x1400337f1
mov dword [0x14007cbc4], 2
jmp 0x1400337f1
cmp byte [0x14007ca62], bl
je 0x1400337b3
mov r9d, 0x136
jmp 0x140033799
cmp byte [0x14007ca62], bl
je 0x1400337b3
mov r9d, 0x12e
lea rdx, str.__Obsolete_platform_ID_
lea r8, str...Commonwinplats.cpp
lea rcx, str.Assert:__s__in__s_at__i_n
call fcn.1400031a2
mov dword [0x14007cbc4], 7
jmp 0x1400337f1
cmp byte [0x14007ca62], bl
je 0x1400337e7
mov r9d, 0x164
lea rdx, str.__Unknown_NT_Platform__assume_Win7__
lea r8, str...Commonwinplats.cpp
lea rcx, str.Assert:__s__in__s_at__i_n
call fcn.1400031a2
mov dword [0x14007cbc4], 4
mov edx, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x24]
call fcn.140002a27
movzx ecx, word [rsp + 0x134]
mov word [0x14007cbc8], cx
mov dword [0x14007cbcc], eax
cmp dword [0x14007cbc4], 2
sete al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140052d40
add rsp, 0x150
pop rbx
ret
Function at 0x140019c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140019c60
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, qword [rcx + 0x28]
movzx ebp, dx
mov rsi, rcx
movzx edi, dx
cmp rcx, rbx
je 0x140019c99
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
call fcn.14000254a
mov eax, dword [rbx + 0x20]
xor r8d, r8d
mov r14d, 0x3ff
mov dword [rsi + 0x20], eax
movzx eax, word [rbx + 0x24]
mov r10d, 0x804
mov word [rsi + 0x24], ax
movzx edx, word [rsi + 0x64]
lea r9d, [r8 + 4]
mov byte [rsi + 0x68], 0
mov r15d, 0xfc00
lea r11d, [r8 + 9]
nop dword [rax]
cmp di, dx
je 0x140019d92
mov rbx, qword [rsi + 0x28]
mov rax, qword [rsi + 0x30]
cmp rbx, rax
je 0x140019cf5
cmp word [rbx + 0x24], di
je 0x140019d61
add rbx, 0x28
cmp rbx, rax
jne 0x140019ce6
movzx ecx, di
cmp r8w, di
je 0x140019dbc
movzx eax, di
and ax, r14w
cmp ax, r9w
jne 0x140019d3d
movzx eax, di
shr eax, 0xa
test eax, eax
je 0x140019d52
jle 0x140019d37
cmp eax, 2
jle 0x140019d31
add eax, 0xfffffffd
test eax, 0xfffffffd
jne 0x140019d37
mov edi, 0x404
jmp 0x140019d56
movzx edi, r9w
jmp 0x140019d56
movzx edi, r10w
jmp 0x140019d56
test r15w, di
je 0x140019d48
movzx edi, ax
jmp 0x140019d56
movzx edi, r11w
cmp ax, r11w
jne 0x140019d56
movzx edi, r8w
cmp di, cx
jne 0x140019cd0
jmp 0x140019dbc
cmp rsi, rbx
je 0x140019d75
or r9, 0xffffffffffffffff
mov rdx, rbx
mov rcx, rsi
call fcn.14000254a
mov eax, dword [rbx + 0x20]
xor di, bp
mov dword [rsi + 0x20], eax
movzx eax, word [rbx + 0x24]
test r14w, di
mov word [rsi + 0x24], ax
sete al
mov byte [rsi + 0x68], al
jmp 0x140019dbc
lea rbx, [rsi + 0x40]
mov byte [rsi + 0x68], 1
cmp rsi, rbx
je 0x140019dae
or r9, 0xffffffffffffffff
mov rdx, rbx
mov rcx, rsi
call fcn.14000254a
mov eax, dword [rbx + 0x20]
mov dword [rsi + 0x20], eax
movzx eax, word [rbx + 0x24]
mov word [rsi + 0x24], ax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14001de90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x14001de90
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov qword [r11 - 0x80], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbp, r9
movzx ebx, r8w
movzx r15d, dx
mov r14, rcx
mov qword [r11 - 0x70], rcx
mov rsi, qword [rsp + 0xe0]
mov qword [r11 - 0x78], rsi
xor r13d, r13d
mov r12d, r13d
mov qword [r11 - 0x50], 0xf
mov qword [r11 - 0x58], r13
mov byte [r11 - 0x68], r12b
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rcx
lea rcx, [r11 - 0x68]
call fcn.14000254a
nop
mov word [rsp + 0x20], bx
movzx edi, byte [rsp + 0xe8]
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r8, qword [rsp + 0x50]
movzx r9d, bx
mov edx, 0xa
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceExA]
test rax, rax
jne 0x14001df5f
test dil, dil
je 0x14001e016
lea rcx, [rsp + 0x20]
call fcn.14000385a
test al, al
je 0x14001e016
movzx ebx, word [rsp + 0x20]
jmp 0x14001df15
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x14001e016
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14001e00c
mov edi, 0xffff
cmp word [rax], di
je 0x14001e00c
mov rcx, qword [rsi + 0x18]
cmp word [rbx], r15w
je 0x14001dfca
add rbx, 2
mov qword [rsp + 0x28], rbx
test rcx, rcx
je 0x14001dfc3
mov rax, qword [rcx]
lea rdx, [rsp + 0x28]
call qword [rax + 0x10]
add rbx, rax
cmp word [rbx], di
jne 0x14001df96
jmp 0x14001e00c
call qword [sym.imp.MSVCP110.dll_void___cdecl_std::_Xbad_function_call_void_]
int3
add rbx, 2
mov qword [rsp + 0x30], rbx
test rcx, rcx
jne 0x14001dfdf
call qword [sym.imp.MSVCP110.dll_void___cdecl_std::_Xbad_function_call_void_]
int3
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x10]
mov rdi, rax
mov edx, 1
mov rcx, rax
call qword [sym.imp.MSVCR110.dll_calloc]
mov r12, rax
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call sub.MSVCR110.dll_memcpy
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
nop
cmp qword [rsp + 0x68], 0x10
jb 0x14001e028
mov rcx, qword [rsp + 0x50]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x68], 0xf
mov qword [rsp + 0x60], r13
mov byte [rsp + 0x50], 0
cmp qword [r14 + 0x18], 0x10
jb 0x14001e04a
mov rcx, qword [r14]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [r14 + 0x18], 0xf
mov qword [r14 + 0x10], r13
mov byte [r14], 0
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14001e073
mov rax, qword [rcx]
cmp rcx, rsi
setne dl
call qword [rax + 0x20]
mov qword [rsi + 0x18], r13
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14001e08c
mov rax, qword [rcx]
cmp rcx, rsi
setne dl
call qword [rax + 0x20]
mov qword [rsi + 0x18], r13
mov rax, r12
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140052d40
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400229a0
Capabilities:
Get common file path
Get startup folder

Disassembly:
jmp 0x1400229a0
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x840
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rdi, rcx
xor ebx, ebx
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x7fe
mov dword [rsp + 0x20], ebx
mov word [rsp + 0x30], bx
call sub.MSVCR110.dll_memset
lea r8d, [rbx + 0x1a]
lea rdx, [rsp + 0x30]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
mov word [rdi], bx
cmp word [rsp + 0x30], bx
je 0x140022a1c
lea rax, [rsp + 0x30]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140022a12
lea rdx, [rsp + 0x30]
mov r8, rbx
mov rcx, rdi
call fcn.140002ef5
mov rax, rdi
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.140052d40
mov rbx, qword [rsp + 0x858]
add rsp, 0x840
pop rdi
ret

Function at 0x140023be0
Capabilities:
Query environment variable

Disassembly:
jmp 0x140023be0
push rbx
push rsi
push rdi
sub rsp, 0x830
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov rbx, rcx
mov esi, r8d
mov rdi, rdx
xor eax, eax
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x20], ax
call sub.MSVCR110.dll_memset
lea rdx, [rsp + 0x20]
mov r8d, 0x400
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x140023cab
lea rcx, [rsp + 0x20]
or rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140023c40
lea r9, [rsp + 0x20]
lea rcx, [rsp + 0x20]
lea r10, [0x14006311a]
lea r9, [r9 + rax*2]
lea rax, [0x140063118]
cmp rcx, r9
je 0x140023c91
lea r8, [rsp + 0x20]
sub r8, rax
cmp rax, r10
je 0x140023cab
movzx ecx, word [rax]
cmp word [r8 + rax], cx
jne 0x140023c96
add rax, 2
lea rdx, [r8 + rax]
cmp rdx, r9
jne 0x140023c75
cmp rax, r10
je 0x140023cab
lea rdx, [rsp + 0x20]
mov r8, rsi
mov rcx, rdi
call qword [sym.imp.MSVCR110.dll_wcsncpy]
mov al, 1
jmp 0x140023cad
xor al, al
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.140052d40
add rsp, 0x830
pop rdi
pop rsi
pop rbx
ret
Function at 0x14002b1d0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
jmp 0x14002b1d0
push rdi
sub rsp, 0x70
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ecx, ecx
xor edi, edi
call fcn.1400022ca
cmp byte [0x14007ca62], dil
je 0x14002b267
call fcn.14000283d
cmp eax, 0x14
je 0x14002b267
call fcn.14000283d
cmp eax, 0x15
je 0x14002b267
call fcn.14000283d
cmp eax, 0x1e
je 0x14002b267
call fcn.14000283d
cmp eax, 0x28
je 0x14002b267
call fcn.14000283d
cmp eax, 0x32
je 0x14002b267
call fcn.14000283d
cmp eax, 0x33
je 0x14002b267
call fcn.14000283d
cmp eax, 0x3c
je 0x14002b267
call fcn.14000283d
cmp eax, 0x3d
je 0x14002b267
lea r8, str.ServiceMain.cpp
lea rdx, str.EOSTYPE_IS_WIN_CSystemState::GetOSType___
lea rcx, str.Assert:__s__in__s_at__i_n
mov r9d, 0x24d
call fcn.1400031a2
call fcn.14000283d
cmp eax, 0x14
je 0x14002b2bb
call fcn.14000283d
cmp eax, 0x15
je 0x14002b2bb
call fcn.14000283d
cmp eax, 0x1e
je 0x14002b2bb
call fcn.14000283d
cmp eax, 0x28
je 0x14002b2bb
call fcn.14000283d
cmp eax, 0x32
je 0x14002b2bb
call fcn.14000283d
cmp eax, 0x33
je 0x14002b2bb
call fcn.14000283d
cmp eax, 0x3c
je 0x14002b2bb
call fcn.14000283d
cmp eax, 0x3d
jne 0x14002b3e1
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x88], rsi
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x14002b3d9
lea rcx, [rsp + 0x40]
mov edx, 4
mov r8d, 0x201
mov qword [rsp + 0x80], rbx
call fcn.140003337
cmp qword [rax + 0x18], 0x10
jb 0x14002b304
mov rax, qword [rax]
mov r8d, 0x10024
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
cmp qword [rsp + 0x58], 0x10
mov rbx, rax
jb 0x14002b32b
mov rcx, qword [rsp + 0x40]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], rdi
mov byte [rsp + 0x40], dil
test rbx, rbx
je 0x14002b3c8
xor eax, eax
lea r8, [rsp + 0x20]
mov rcx, rbx
lea edx, [rax + 1]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x14002b3b4
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14002b3b4
nop
cmp dword [rsp + 0x24], 1
je 0x14002b3b4
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14002b390
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140052d40
add rsp, 0x70
pop rdi
ret