joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180021cc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0xf0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1801fdc38]
xor rax, rsp
mov qword [rsp + 0xe8], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor r13d, r13d
mov dword [rsp + 0x20], r13d
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
mov dword [rsp + 0x24], eax
lea edx, [rax + 1]
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
cmp qword [rbx + 0x10], r13
je 0x180021d65
cmp qword [rsi + 0x10], r13
je 0x180021d65
lea r8d, [r13 + 0x2f]
mov rdx, rbx
lea rcx, [rsp + 0xc0]
call fcn.180028b40
nop
mov dword [rsp + 0x20], 1
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.180028c00
mov rsi, rax
lea ebx, [r13 + 3]
jmp 0x180021d80
mov r8, rsi
mov rdx, rbx
lea rcx, [rsp + 0x98]
call fcn.180007a30
mov rsi, rax
mov ebx, 4
mov dword [rsp + 0x20], ebx
call fcn.180023e50
mov r8, rsi
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.180023f10
nop
mov byte [rdi], 0
lea rcx, [rdi + 8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rcx
test rcx, rcx
je 0x180021dd0
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], r13
mov word [rcx], r13w
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
call fcn.180016bb0
nop
mov byte [rdi], 1
or ebx, 8
cmp qword [rsp + 0x60], 8
jb 0x180021de8
mov rcx, qword [rsp + 0x48]
call fcn.1801196dc
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r13
mov word [rsp + 0x48], r13w
test bl, 4
je 0x180021e39
and ebx, 0xfffffffb
cmp qword [rsp + 0xb0], 8
jb 0x180021e1c
mov rcx, qword [rsp + 0x98]
call fcn.1801196dc
mov qword [rsp + 0xb0], 7
mov qword [rsp + 0xa8], r13
mov word [rsp + 0x98], r13w
test bl, 2
je 0x180021e70
and ebx, 0xfffffffd
cmp qword [rsp + 0x88], 8
jb 0x180021e56
mov rcx, qword [rsp + 0x70]
call fcn.1801196dc
mov qword [rsp + 0x88], 7
mov qword [rsp + 0x80], r13
mov word [rsp + 0x70], r13w
test bl, 1
je 0x180021eaa
cmp qword [rsp + 0xd8], 8
jb 0x180021e8d
mov rcx, qword [rsp + 0xc0]
call fcn.1801196dc
mov qword [rsp + 0xd8], 7
mov qword [rsp + 0xd0], r13
mov word [rsp + 0xc0], r13w
mov edx, r12d
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rdi
jmp 0x180021ed3
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.180119820
add rsp, 0xf0
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x180021f00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0xc0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1801fdc38]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor r13d, r13d
mov dword [rsp + 0x20], r13d
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
mov dword [rsp + 0x24], eax
lea edx, [rax + 1]
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
cmp qword [rbx + 0x10], r13
je 0x180021fa5
cmp qword [rsi + 0x10], r13
je 0x180021fa5
lea r8d, [r13 + 0x2f]
mov rdx, rbx
lea rcx, [rsp + 0x88]
call fcn.180028b40
nop
mov dword [rsp + 0x20], 1
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.180028c00
mov rsi, rax
lea ebx, [r13 + 3]
jmp 0x180021fbd
mov r8, rsi
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.180007a30
mov rsi, rax
mov ebx, 4
mov dword [rsp + 0x20], ebx
call fcn.180023e50
mov rdx, rsi
mov rcx, rax
call fcn.180024080
mov r11d, eax
mov byte [rdi], 0
lea rax, [rdi + 4]
test rax, rax
je 0x180021fe3
mov dword [rax], r11d
mov byte [rdi], 1
or ebx, 8
test bl, 4
je 0x180022017
and ebx, 0xfffffffb
cmp qword [rsp + 0x78], 8
jb 0x180022003
mov rcx, qword [rsp + 0x60]
call fcn.1801196dc
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], r13
mov word [rsp + 0x60], r13w
test bl, 2
je 0x180022045
and ebx, 0xfffffffd
cmp qword [rsp + 0x50], 8
jb 0x180022031
mov rcx, qword [rsp + 0x38]
call fcn.1801196dc
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r13
mov word [rsp + 0x38], r13w
test bl, 1
je 0x18002207f
cmp qword [rsp + 0xa0], 8
jb 0x180022062
mov rcx, qword [rsp + 0x88]
call fcn.1801196dc
mov qword [rsp + 0xa0], 7
mov qword [rsp + 0x98], r13
mov word [rsp + 0x88], r13w
mov edx, r12d
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rdi
jmp 0x1800220a8
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180119820
add rsp, 0xc0
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800220d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0xc0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1801fdc38]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor r13d, r13d
mov dword [rsp + 0x20], r13d
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
mov dword [rsp + 0x24], eax
lea edx, [rax + 1]
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
cmp qword [rbx + 0x10], r13
je 0x180022175
cmp qword [rdi + 0x10], r13
je 0x180022175
lea r8d, [r13 + 0x2f]
mov rdx, rbx
lea rcx, [rsp + 0x88]
call fcn.180028b40
nop
mov dword [rsp + 0x20], 1
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.180028c00
mov rdi, rax
lea ebx, [r13 + 3]
jmp 0x18002218d
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.180007a30
mov rdi, rax
mov ebx, 4
mov dword [rsp + 0x20], ebx
call fcn.180023e50
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.1800241b0
or ebx, 8
test bl, 4
je 0x1800221d5
and ebx, 0xfffffffb
cmp qword [rsp + 0x78], 8
jb 0x1800221c1
mov rcx, qword [rsp + 0x60]
call fcn.1801196dc
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], r13
mov word [rsp + 0x60], r13w
test bl, 2
je 0x180022203
and ebx, 0xfffffffd
cmp qword [rsp + 0x50], 8
jb 0x1800221ef
mov rcx, qword [rsp + 0x38]
call fcn.1801196dc
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r13
mov word [rsp + 0x38], r13w
test bl, 1
je 0x18002223d
cmp qword [rsp + 0xa0], 8
jb 0x180022220
mov rcx, qword [rsp + 0x88]
call fcn.1801196dc
mov qword [rsp + 0xa0], 7
mov qword [rsp + 0x98], r13
mov word [rsp + 0x88], r13w
mov edx, r12d
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rsi
jmp 0x180022266
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180119820
add rsp, 0xc0
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x180022310
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0xb0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1801fdc38]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov dword [rsp + 0x24], eax
lea edx, [rax + 1]
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
cmp qword [rdi + 0x10], r12
je 0x1800223b1
cmp qword [rbx + 0x10], r12
je 0x1800223b1
lea r8d, [r12 + 0x2f]
mov rdx, rdi
lea rcx, [rsp + 0x80]
call fcn.180028b40
nop
mov dword [rsp + 0x20], 1
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180028c00
mov rdi, rax
lea ebx, [r12 + 3]
jmp 0x1800223c9
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.180007a30
mov rdi, rax
mov ebx, 4
mov dword [rsp + 0x20], ebx
call fcn.180023e50
mov rcx, rax
mov r8, rbp
mov rdx, rdi
call fcn.180024370
movzx edi, al
test bl, 4
je 0x180022411
and ebx, 0xfffffffb
cmp qword [rsp + 0x70], 8
jb 0x1800223fd
mov rcx, qword [rsp + 0x58]
call fcn.1801196dc
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r12
mov word [rsp + 0x58], r12w
test bl, 2
je 0x18002243f
and ebx, 0xfffffffd
cmp qword [rsp + 0x48], 8
jb 0x18002242b
mov rcx, qword [rsp + 0x30]
call fcn.1801196dc
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], r12w
test bl, 1
je 0x180022479
cmp qword [rsp + 0x98], 8
jb 0x18002245c
mov rcx, qword [rsp + 0x80]
call fcn.1801196dc
mov qword [rsp + 0x98], 7
mov qword [rsp + 0x90], r12
mov word [rsp + 0x80], r12w
mov edx, esi
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
movzx eax, dil
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.180119820
add rsp, 0xb0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800224b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0xb0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1801fdc38]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov ebp, r8d
mov rbx, rdx
mov rdi, rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov dword [rsp + 0x24], eax
lea edx, [rax + 1]
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
cmp qword [rdi + 0x10], r12
je 0x180022551
cmp qword [rbx + 0x10], r12
je 0x180022551
lea r8d, [r12 + 0x2f]
mov rdx, rdi
lea rcx, [rsp + 0x80]
call fcn.180028b40
nop
mov dword [rsp + 0x20], 1
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180028c00
mov rdi, rax
lea ebx, [r12 + 3]
jmp 0x180022569
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.180007a30
mov rdi, rax
mov ebx, 4
mov dword [rsp + 0x20], ebx
call fcn.180023e50
mov rcx, rax
mov r8d, ebp
mov rdx, rdi
call fcn.1800244c0
movzx edi, al
test bl, 4
je 0x1800225b1
and ebx, 0xfffffffb
cmp qword [rsp + 0x70], 8
jb 0x18002259d
mov rcx, qword [rsp + 0x58]
call fcn.1801196dc
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r12
mov word [rsp + 0x58], r12w
test bl, 2
je 0x1800225df
and ebx, 0xfffffffd
cmp qword [rsp + 0x48], 8
jb 0x1800225cb
mov rcx, qword [rsp + 0x30]
call fcn.1801196dc
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], r12w
test bl, 1
je 0x180022619
cmp qword [rsp + 0x98], 8
jb 0x1800225fc
mov rcx, qword [rsp + 0x80]
call fcn.1801196dc
mov qword [rsp + 0x98], 7
mov qword [rsp + 0x90], r12
mov word [rsp + 0x80], r12w
mov edx, esi
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
movzx eax, dil
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.180119820
add rsp, 0xb0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1800226e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rsi
mov rsi, rdx
mov rbx, rcx
mov dword [rsp + 0x50], 0
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov dword [rsp + 0x50], eax
lea edx, [rax + 1]
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
call fcn.180023e50
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.180024600
nop
mov edx, edi
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rbx
jmp 0x18002276a
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1800227a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rsi
mov rsi, rdx
mov rbx, rcx
mov dword [rsp + 0x50], 0
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov dword [rsp + 0x50], eax
lea edx, [rax + 1]
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
call fcn.180023e50
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1800247f0
nop
mov edx, edi
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rbx
jmp 0x18002282a
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x180022840
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rcx
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov dword [rsp + 0x48], eax
lea edx, [rax + 1]
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
call fcn.180023e50
mov rcx, rax
mov rdx, rbx
call fcn.1800249e0
movzx ebx, al
mov edx, edi
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1800228b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x90
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1801fdc38]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rdx
mov rbx, rcx
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov dword [rsp + 0x20], eax
lea edx, [rax + 1]
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov r8d, 0x2f
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.180028b40
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180028c00
mov rbx, rax
call fcn.180023e50
mov rcx, rax
mov rdx, rbx
call fcn.1800249e0
movzx ebx, al
cmp qword [rsp + 0x48], 8
jb 0x180022953
mov rcx, qword [rsp + 0x30]
call fcn.1801196dc
mov qword [rsp + 0x48], 7
xor edi, edi
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x30], di
cmp qword [rsp + 0x70], 8
jb 0x18002297a
mov rcx, qword [rsp + 0x58]
call fcn.1801196dc
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rdi
mov word [rsp + 0x58], di
mov edx, esi
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
movzx eax, bl
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180119820
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180024ff0
Capabilities:
Modify service
Query service status
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1801fdc38]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor edx, edx
mov rsi, rcx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
lea rdx, str.SmdmFService2
mov r8d, 0x16
mov rcx, rax
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x180025066
lea r8d, [rax + 0x16]
lea rdx, str.SmdmFService
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
cmovne rbx, rax
xor eax, eax
lea rdx, [rsp + 0x60]
xor ebp, ebp
mov rcx, rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], eax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1800250ee
cmp dword [rsp + 0x64], 4
je 0x1800250e6
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
or r9d, 0xffffffff
mov qword [rsp + 0x30], rbp
lea r8d, [rbp + 2]
mov rcx, rbx
or edx, r9d
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rsi
call fcn.180047ee0
test rbx, rbx
je 0x1800250fc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x18002510a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180119820
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180025210
Capabilities:
Modify service
Query service status
Start service

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1801fdc38]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rsi, rcx
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
mov qword [rsp + 0x70], rax
mov r8d, 0x16
lea rdx, str.SmdmFService2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x18002529e
lea r8d, [rax + 0x16]
lea rdx, str.SmdmFService
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
cmovne rbx, rax
mov qword [rsp + 0x60], rbx
xor ebp, ebp
xor eax, eax
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x90], eax
lea rdx, [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1800252e1
test rbx, rbx
je 0x1800252df
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
jmp 0x18002535a
cmp dword [rsp + 0x7c], 4
je 0x18002533a
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
or r9d, 0xffffffff
mov r8d, 2
or edx, r9d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rsi
call fcn.180047ee0
mov rcx, rsi
call fcn.180043410
nop
test rbx, rbx
je 0x18002535a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
test rdi, rdi
je 0x180025368
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.180119820
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180036200
Capabilities:
Get session information

Disassembly:
mov r11, rsp
push rbp
push rdi
push r12
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1801fdc38]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
xor r12d, r12d
mov dword [rbp - 0x50], r12d
mov qword [rbp - 0x48], r12
mov esi, 7
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x28], r12
mov word [rbp - 0x38], r12w
mov dword [rbp - 0x50], r12d
lea rax, [rbp - 0x50]
mov qword [r11 - 0x78], rax
lea r9, [rbp - 0x48]
mov r8d, edx
or edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
jne 0x1800362f9
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x10], r12
mov word [rbx], r12w
lea rax, [rbp - 0x38]
cmp rbx, rax
je 0x1800362f0
cmp qword [rbx + 0x18], 8
jb 0x180036299
mov rcx, qword [rbx]
call fcn.1801196dc
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x10], r12
mov word [rbx], r12w
mov rcx, qword [rbp - 0x20]
cmp rcx, 8
jae 0x1800362ca
mov r8, qword [rbp - 0x28]
lea r8, [r8 + r8 + 2]
lea rdx, [rbp - 0x38]
mov rcx, rbx
call fcn.180119850
mov rcx, qword [rbp - 0x20]
jmp 0x1800362d5
mov rax, qword [rbp - 0x38]
mov qword [rbx], rax
mov qword [rbp - 0x38], r12
mov rax, qword [rbp - 0x28]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rcx
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x28], r12
mov word [rbp - 0x38], r12w
jmp 0x1800362f4
mov rsi, qword [rbp - 0x20]
jmp 0x1800363a2
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdx, qword [rbp - 0x48]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp - 0x38]
call fcn.180015970
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x10], r12
mov word [rbx], r12w
lea rax, [rbp - 0x38]
cmp rbx, rax
je 0x18003639e
cmp qword [rbx + 0x18], 8
jb 0x180036347
mov rcx, qword [rbx]
call fcn.1801196dc
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x10], r12
mov word [rbx], r12w
mov rcx, qword [rbp - 0x20]
cmp rcx, 8
jae 0x180036378
mov r8, qword [rbp - 0x28]
lea r8, [r8 + r8 + 2]
lea rdx, [rbp - 0x38]
mov rcx, rbx
call fcn.180119850
mov rcx, qword [rbp - 0x20]
jmp 0x180036383
mov rax, qword [rbp - 0x38]
mov qword [rbx], rax
mov qword [rbp - 0x38], r12
mov rax, qword [rbp - 0x28]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rcx
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x28], r12
mov word [rbp - 0x38], r12w
jmp 0x1800363a2
mov rsi, qword [rbp - 0x20]
cmp rsi, 8
jb 0x1800363b1
mov rcx, qword [rbp - 0x38]
call fcn.1801196dc
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180119820
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x18003fb10
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x2f]
sub rsp, 0xa8
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov rax, qword [0x1801fdc38]
xor rax, rsp
mov qword [rbp + 0x17], rax
movzx esi, r9b
mov r12, r8
mov rbx, rdx
mov rdi, rcx
mov dword [rbp - 0x49], 0x64
mov qword [rbp - 0x21], 7
xor r13d, r13d
mov qword [rbp - 0x29], r13
mov word [rbp - 0x39], r13w
lea edx, [r13 + 0x5c]
xor r8d, r8d
mov rcx, rbx
call fcn.180015630
cmp rax, 0xffffffffffffffff
je 0x18003fbdd
mov r9d, 0x20019
mov r8, rbx
movzx edx, sil
mov rcx, rdi
call fcn.18003f7c0
mov rsi, rax
cmp qword [rbx + 0x18], 8
jb 0x18003fb9a
mov rbx, qword [rbx]
cmp word [rbx], 0
je 0x18003fbaa
add rbx, 2
cmp word [rbx], 0
jne 0x18003fba0
cmp word [rbx], 0x5c
je 0x18003fbba
sub rbx, 2
cmp word [rbx], 0x5c
jne 0x18003fbb0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbx + 2]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbx + 2]
lea rcx, [rbp - 0x39]
call fcn.180015970
jmp 0x18003fc4f
mov qword [rbp + 7], 7
mov qword [rbp - 1], r13
mov word [rbp - 0x11], r13w
xor r8d, r8d
lea rdx, [0x18019bf30]
lea rcx, [rbp - 0x11]
call fcn.180015970
nop
mov r9d, 0x20019
lea r8, [rbp - 0x11]
movzx edx, sil
mov rcx, rdi
call fcn.18003f7c0
mov rsi, rax
cmp qword [rbp + 7], 8
jb 0x18003fc2b
mov rcx, qword [rbp - 0x11]
call fcn.1801196dc
mov qword [rbp + 7], 7
mov qword [rbp - 1], r13
mov word [rbp - 0x11], r13w
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.180016bb0
test rsi, rsi
jne 0x18003fc56
jmp 0x18003fcaa
mov dword [rbp - 0x49], 0x208
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rdx, qword [rbp - 0x39]
lea rax, [rbp - 0x49]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x45]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rbp - 0x45], 1
jne 0x18003fcaa
test eax, eax
jne 0x18003fcaa
cmp qword [rbp - 0x21], 8
jb 0x18003fca3
mov rcx, qword [rbp - 0x39]
call fcn.1801196dc
mov eax, 1
jmp 0x18003fcbc
cmp qword [rbp - 0x21], 8
jb 0x18003fcba
mov rcx, qword [rbp - 0x39]
call fcn.1801196dc
xor eax, eax
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.180119820
add rsp, 0xa8
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret