joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021fe0
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x1400f6670]
lea rdx, [0x1400dde00]
mov r8, rcx
mov rbx, qword [rax + 0x1d18]
add rbx, 0x108
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 9]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xa]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xb]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xc]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xd]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xe]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xf]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x1400220e1
lea ecx, [r9 + 1]
test r8d, r8d
je 0x1400220cd
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x1400220d2
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.1400347b0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140022100
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x1400f6670]
lea rdx, [0x1400dde00]
mov r8d, ecx
mov rbx, qword [rax + 0x1d18]
add rbx, 0x108
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x1400221b7
lea ecx, [r9 + 1]
test r8d, r8d
je 0x1400221a3
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x1400221a8
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.1400347b0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140023010
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400f4080]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400f6670]
mov edi, edx
cmp byte [rbx + 0x20d5], 0
jne 0x140023070
cmp byte [rbx + 0x20d6], 0
jne 0x140023070
mov r9d, dword [rbx + 0x3178]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.1400137c0
test dil, 1
je 0x140023196
jmp 0x1400230ff
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
mov r9d, dword [rbx + 0x3178]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400e2d54]
mulss xmm1, dword [0x1400e2d48]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
mov qword [rbx + 0x1ddc], rax
mov dword [rbx + 0x1dc4], 1
movss dword [rbx + 0x1dd4], xmm0
mov byte [rbx + 0x1dfc], 1
movss dword [rbx + 0x1dd8], xmm1
movss xmm0, dword [rbx + 0x1748]
mulss xmm0, dword [0x1400e2cc0]
or dword [rbx + 0x1dc0], 0x41
movss dword [rbx + 0x1e20], xmm0
call fcn.1400137c0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140023150
lea r11, [0x1400dde00]
nop
cmp r9b, 0x23
jne 0x140023133
cmp byte [r8], r9b
jne 0x140023133
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140023120
not ecx
call fcn.14001b9d0
test rax, rax
je 0x140023196
cmp byte [rax + 0xcf], 0
je 0x140023196
mov byte [rax + 0xd6], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3178]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x3178]
call fcn.1400137c0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.14001e480
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400ca670
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140027e90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3260], 0
lea rbx, [rcx + 0x3268]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140027f37
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x140027eea
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.1400344a0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400140f0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x3260]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x3270]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400f6668]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x140027f3f
mov rcx, rbx
call fcn.1400140f0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140028380
Capabilities:
Hash data with crc32

Disassembly:
push rbx
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov rbx, rcx
mov eax, r10d
test r9b, r9b
je 0x1400283d2
lea r11, [0x1400dde00]
cmp r9b, 0x23
jne 0x1400283b5
cmp byte [r8], r9b
jne 0x1400283b5
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400283a2
mov r11, qword [0x1400f6670]
mov r10, qword [r11 + 0x3228]
test r10, r10
je 0x140028419
lea r9, [r10 + 4]
test r9, r9
je 0x140028419
not eax
cmp dword [r9], eax
je 0x140028422
movsxd r8, dword [r9 - 4]
movsxd rdx, dword [r11 + 0x3220]
add r8, r9
add rdx, 4
xor r9d, r9d
add rdx, r10
cmp r8, rdx
cmovne r9, r8
test r9, r9
jne 0x1400283f0
mov rcx, rbx
pop rbx
jmp fcn.140028290
mov rax, r9
pop rbx
ret
Function at 0x14002b870
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14002baae
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x1400f4080]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x1400dde00]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x14002ba76
mov rcx, rbp
call fcn.14002af00
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x14002b941
movsxd rdx, dword [rbp + 0x31c0]
mov r8, qword [rbp + 0x31c8]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x14002b931
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x14002b929
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x14002b92c
mov rdx, rcx
test rdx, rdx
jne 0x14002b900
cmp r8, r10
je 0x14002b941
cmp dword [r8], r9d
jne 0x14002b941
mov rcx, qword [r8 + 8]
jmp 0x14002b943
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xb8]
and eax, 0xfffffe49
movss dword [rbx + 0x50], xmm1
or eax, 0x49
mov dword [rbx + 0xb8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x14002b9d7
cmp qword [rcx + 0x18], 0
jne 0x14002b9cc
mov qword [rcx + 0x18], rbx
jmp 0x14002b9d7
cmp qword [rcx + 0x20], 0
jne 0x14002b9d7
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xe]
mov rcx, rbx
mov dword [rbx + 0xb0], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 6]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14002ba0c
nop
mov rcx, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14002ba00
mov r9d, dword [rcx]
lea r8, str.DockNode__02X
lea rcx, [rsp + 0x20]
mov edx, reloc.WS2_32.dll_sendto
call fcn.1400137c0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x14002ba68
cmp r9b, 0x23
jne 0x14002ba4b
cmp byte [r8], r9b
jne 0x14002ba4b
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x14002ba38
not ecx
call fcn.14001b9d0
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x14002b8c0
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ca670
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x14005bc20
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400f6be8]
test rax, rax
jne 0x14005be24
mov rax, qword gs:[0x60]
xor r8d, r8d
mov qword [rsp + 0x58], rbx
mov ebx, 0x694a8c81
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
movups xmmword [rsp + 0x20], xmm0
sub ax, 8
test r8d, r8d
je 0x14005bcbd
mov rcx, qword [rsp + 0x28]
mov edx, 0x811c9dc5
movzx eax, ax
shr rax, 1
lea r9, [rcx + rax*2]
cmp rcx, r9
je 0x14005bcb4
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r9
jne 0x14005bca0
cmp edx, r8d
jne 0x14005bde7
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
mov r11d, ecx
shr r15, 0x20
add r11, r10
cmp r11, r10
je 0x14005bde7
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x14005bde7
mov r14d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov edx, 0x811c9dc5
lea rax, [r14 + r9*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14005bd37
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x14005bd20
cmp edx, ebx
je 0x14005bd45
test r9d, r9d
jne 0x14005bd00
jmp 0x14005bde7
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
cmp rax, r11
jbe 0x14005bdff
lea rcx, [r15 + r11]
cmp rax, rcx
jae 0x14005bdff
movzx ecx, byte [rax]
mov r8d, 0x811c9dc5
mov dword [rsp + 0x50], r8d
mov edx, r8d
mov dword [rsp + 0x54], edx
cmp cl, 0x2e
je 0x14005bdad
nop
movsx ecx, cl
inc rax
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rax]
cmp cl, 0x2e
jne 0x14005bd90
mov dword [rsp + 0x50], r8d
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
je 0x14005bdda
nop dword [rax + rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
test cl, cl
jne 0x14005bdc0
mov dword [rsp + 0x54], edx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rbp]
shr rbx, 0x20
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x14005bdfd
cmp qword [rax + 0x30], 0
jne 0x14005bc71
xor eax, eax
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov qword [0x1400f6be8], rax
add rsp, 0x48
jmp rax
Function at 0x14005be30
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1400f6c40]
test rax, rax
jne 0x14005c06d
xor r8d, r8d
mov dword [rsp + 0x28], r8d
mov eax, 0xfaba0065
mov dword [rsp + 0x24], eax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x10]
mov r11, qword [rdx]
mov qword [rsp + 0x48], r11
mov r15, r11
mov qword [rsp + 0x50], r11
mov rcx, r11
nop dword [rax]
nop dword [rax + rax]
movups xmm0, xmmword [rcx + 0x58]
movups xmmword [rsp + 0x58], xmm0
movd ecx, xmm0
sub cx, 8
mov word [rsp + 0x58], cx
test r8d, r8d
je 0x14005bee6
mov rdx, qword [rsp + 0x60]
movzx ecx, cx
shr rcx, 1
lea r10, [rdx + rcx*2]
mov r9d, 0x811c9dc5
mov qword [rsp + 0x38], rdx
cmp rdx, r10
je 0x14005bedd
movsx ecx, byte [rdx]
xor ecx, r9d
imul r9d, ecx, 0x1000193
add rdx, 2
jmp 0x14005bec0
cmp r9d, r8d
jne 0x14005c046
mov rbx, qword [r11 + 0x30]
mov qword [rsp + 0x68], rbx
movsxd rcx, dword [rbx + 0x3c]
mov r14, qword [rcx + rbx + 0x88]
mov qword [rsp + 0xb8], r14
mov r9d, r14d
add r9, rbx
mov qword [rsp + 0x70], r9
shr r14, 0x20
mov dword [rsp + 0x78], r14d
cmp r9, rbx
je 0x14005c046
mov edi, dword [r9 + 0x18]
mov dword [rsp + 0x20], edi
nop dword [rax + rax]
mov ecx, edi
dec edi
mov dword [rsp + 0x20], edi
test ecx, ecx
je 0x14005c046
mov edx, dword [r9 + 0x20]
add rdx, rbx
mov ecx, dword [rdx + rdi*4]
add rcx, rbx
mov qword [rsp + 0x40], rcx
mov r10d, 0x811c9dc5
nop dword [rax + rax]
movsx edx, byte [rcx]
inc rcx
mov qword [rsp + 0x40], rcx
test dl, dl
jne 0x14005c037
cmp r10d, eax
jne 0x14005c032
mov ecx, dword [r9 + 0x1c]
add rcx, rbx
mov eax, dword [r9 + 0x24]
add rax, rbx
movzx eax, word [rax + rdi*2]
mov edx, dword [rcx + rax*4]
add rdx, rbx
cmp rdx, r9
jbe 0x14005c063
lea rax, [r9 + r14]
cmp rdx, rax
jae 0x14005c063
mov r8d, 0x811c9dc5
mov dword [rsp + 0xb0], r8d
mov ecx, r8d
mov dword [rsp + 0xb4], ecx
mov r9d, ecx
mov qword [rsp + 0x30], rdx
movsx eax, byte [rdx]
cmp al, 0x2e
je 0x14005bfeb
xor eax, r9d
imul r8d, eax, 0x1000193
mov r9d, r8d
mov dword [rsp + 0xb0], r8d
inc rdx
jmp 0x14005bfc5
inc rdx
mov qword [rsp + 0x30], rdx
movsx eax, byte [rdx]
test al, al
je 0x14005c00b
xor eax, ecx
imul ecx, eax, 0x1000193
mov dword [rsp + 0xb4], ecx
jmp 0x14005bfeb
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xc0], rax
shr rax, 0x20
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x28], r8d
mov r11, qword [r15]
mov qword [rsp + 0x48], r11
jmp 0x14005c046
jmp 0x14005bf30
xor edx, r10d
imul r10d, edx, 0x1000193
jmp 0x14005bf60
mov r11, qword [r11]
mov rcx, r11
mov qword [rsp + 0x48], r11
cmp r11, r15
je 0x14005c061
cmp qword [r11 + 0x30], 0
jne 0x14005be90
xor edx, edx
mov qword [0x1400f6c40], rdx
mov rax, rdx
mov ecx, 0x13333337
call rax
jmp 0x14005c078
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14005cd60
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x1400f4080]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, qword [0x1400f6c48]
mov dword [rsp + 0x20], 0
test rsi, rsi
jne 0x14005ce47
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x14005ce28
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14005ce28
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x14005ce23
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x14005ce00
cmp edx, 0x4cfe97c1
je 0x14005cf49
test r8d, r8d
jne 0x14005cde0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x14005ce3e
cmp qword [rax + 0x30], 0
jne 0x14005cdb0
xor esi, esi
mov qword [0x1400f6c48], rsi
mov rax, qword [0x1400f6c10]
test rax, rax
jne 0x14005cf18
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbp
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov r11, rbp
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x14005cef4
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14005cef4
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14005ceef
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x14005ced0
cmp edx, 0x6dd8a845
je 0x14005cf65
test r8d, r8d
jne 0x14005ceb0
mov rax, qword [r11]
mov r11, rax
cmp rax, rbp
je 0x14005cf0a
cmp qword [rax + 0x30], 0
jne 0x14005ce80
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov qword [0x1400f6c10], rax
call rax
lea rdx, [rsp + 0x20]
mov rcx, rax
call rsi
cmp dword [rsp + 0x20], 0
setne al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400ca670
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov esi, dword [rcx + rdx*4]
add rsi, r9
jmp 0x14005ce40
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x14005cf0c
Function at 0x14005cf80
Capabilities:
Execute command
Terminate process

Disassembly:
sub rsp, 0x198
mov rax, qword [0x1400f4080]
xor rax, rsp
mov qword [rsp + 0x180], rax
lea rdx, str.message.vbs
lea rcx, [rsp + 0x30]
call fcn.140011a20
nop
lea rcx, [rsp + 0x70]
call fcn.140058bf0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.140064df0
nop
lea rdx, str.MsgBox__No.___vbCritical___Error_
lea rcx, [rsp + 0x70]
call fcn.1400662c0
lea rcx, [rsp + 0x70]
call fcn.140064db0
lea r8, [rsp + 0x30]
lea rdx, str.start_wscript
lea rcx, [rsp + 0x50]
call fcn.140066570
lea rcx, [rsp + 0x50]
call fcn.140034f60
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14005da30
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400f4080]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
mov rdi, rcx
xor ecx, ecx
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x14005daa0
mov r8d, 4
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x14005da97
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov rcx, rdi
test eax, eax
jne 0x14005daa4
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x14005dabb
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [rsp + 0x24], 4
sete al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400ca670
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140064510
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140064538
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14006455e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140064560
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400645b9
test ecx, ecx
jle 0x140064599
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400645b9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400645b9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x1400645e0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140064602
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140064618
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140064634
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140064636
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140064672
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14006470e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400646ad
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1400646ee
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14006470e
cmp rbx, rax
ja 0x1400646c0
test rbx, rbx
je 0x14006470e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret