joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006230
Capabilities:
Check mutex on windows
Print debug messages

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rbx, rcx
lea rbp, str.GlobalIntegratedDRV
mov byte [rcx], 0
xor esi, esi
mov qword [rcx + 8], rsi
mov byte [rcx + 0x10], sil
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x50], rsi
xor r9d, r9d
lea r8, [rsp + 0x50]
lea edx, [rsi + 1]
lea rcx, str.S:_ML__NW___LW_D:_A__0x12019f___WD_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x14000628c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1400062aa
mov edx, 0x18
lea ecx, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdx, rax
test rax, rax
jne 0x1400062c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400062bf
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x50], rsi
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400062e0
mov dword [rax], 0x18
mov rax, qword [rsp + 0x50]
mov qword [rdx + 8], rax
mov dword [rdx + 0x10], esi
mov qword [rsp + 0x68], rdx
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
or rsi, 0xffffffffffffffff
test rbp, 0xffffffffffff0000
jne 0x14000632a
movzx edi, bp
xor edx, edx
mov ecx, edi
call fcn.140001140
test rax, rax
je 0x14000634a
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140009760
jmp 0x14000634a
xor eax, eax
mov rcx, rsi
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.140008bd0
nop
mov rdx, qword [0x140026d48]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.1400079a0
mov rdi, qword [rsp + 0x60]
mov rdx, rdi
lea rcx, str._PI_EXE__MutexName_:__s
call fcn.140004590
mov r8, rdi
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400063a7
lea rcx, str._PI_EXE__ERROR_ALREADY_EXISTS
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [rbx + 0x10], 1
jmp 0x1400063cd
cmp eax, 5
jne 0x1400063bf
lea rcx, str._PI_EXE__ERROR_ACCESS_DENIDED
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [rbx + 0x10], 1
jmp 0x1400063cd
mov edx, eax
lea rcx, str._PI_EXE__LastError:__d
call fcn.140004590
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400063e1
mov edx, 6
call fcn.140006160
nop
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1400063fa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x140006421
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140006413
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, rbx
jmp 0x140006424
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000bf34
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14000bfbd
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x14000bf7f
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x14000bfcd
mov ecx, 0x20b
cmp word [rax + 0x18], cx
je 0x14000bf95
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x14000bfcd
cmp dword [rax + 0x84], 0xe
ja 0x14000bfa9
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x14000bfcd
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xb0], ebx
jmp 0x14000bfcd
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
lea rdi, [0x140000000]
mov ecx, 1
call fcn.14000dadc
test eax, eax
jne 0x14000bffd
cmp dword [0x140025d60], 1
jne 0x14000bfe9
call fcn.14000e138
mov ecx, 0x1c
call fcn.14000df10
mov ecx, 0xff
call fcn.14000db94
call fcn.14000fe5c
test eax, eax
jne 0x14000c028
cmp dword [0x140025d60], 1
jne 0x14000c014
call fcn.14000e138
mov ecx, 0x10
call fcn.14000df10
mov ecx, 0xff
call fcn.14000db94
call fcn.140013638
nop
call fcn.140011130
test eax, eax
jns 0x14000c041
mov ecx, 0x1b
call fcn.14000db28
call sub.KERNEL32.dll_GetCommandLineW
mov qword [0x140027068], rax
call fcn.1400135a4
mov qword [0x140025d58], rax
call fcn.1400134b4
test eax, eax
jns 0x14000c06c
mov ecx, 8
call fcn.14000db28
call fcn.1400131e4
test eax, eax
jns 0x14000c07f
mov ecx, 9
call fcn.14000db28
mov ecx, 1
call fcn.14000dc34
test eax, eax
je 0x14000c094
mov ecx, eax
call fcn.14000db28
call fcn.140013188
test byte [rsp + 0x6c], 1
movzx edx, word [rsp + 0x70]
mov r9d, 0xa
cmovne r9d, edx
mov r8, rax
xor edx, edx
mov rcx, rdi
call fcn.140006440
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x14000c0cb
mov ecx, eax
call fcn.14000de70
call fcn.14000de88
jmp 0x14000c0ec
mov eax, edi
jmp 0x14000c0f5
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.1400b9000
add rsp, 0x28
jmp 0x14000bf34
Function at 0x14000cc1b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140024450]
jne 0x14000a22a
rol rcx, 0x10
test cx, 0xffff
jne 0x14000a226
repz ret
ror rcx, 0x10
jmp 0x14000cb74
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140025e10]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140025f08]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000cbf9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140025e10]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000cc1b
mov rax, qword [rsp + 0x88]
mov qword [0x140025f08], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140025ea8], rax
mov rax, qword [0x140025f08]
mov qword [0x140025d80], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140025e90], rax
mov dword [0x140025d70], 0xc0000409
mov dword [0x140025d74], 1
mov rax, qword [0x140024450]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140024458]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140025e08], eax
mov ecx, 1
call fcn.140010250
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14001c738]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140025e08], 0
jne 0x14000cca2
mov ecx, 1
call fcn.140010250
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14000de70
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.1400128b0
nop
cmp dword [0x140026338], 1
je 0x14000de1c
mov dword [0x140026334], 1
mov byte [0x140026330], r12b
test ebx, ebx
jne 0x14000de08
mov rcx, qword [0x140027050]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000ddf5
mov rcx, qword [0x140027048]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x14000dd94
call fcn.14000fb8c
cmp qword [rdi], rax
jne 0x14000dd94
jmp 0x14000dd7a
cmp rdi, rsi
jb 0x14000ddf5
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.14000fb8c
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140027050]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140027048]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x14000ddd3
cmp r13, rax
je 0x14000ddf3
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14000dd7a
lea rdx, [0x14001c488]
lea rcx, [0x14001c470]
call fcn.14000dbc4
lea rdx, [0x14001c498]
lea rcx, [0x14001c490]
call fcn.14000dbc4
nop
test r12d, r12d
je 0x14000de2b
mov ecx, 8
call fcn.1400127b0
test r12d, r12d
jne 0x14000de56
mov dword [0x140026338], 1
lea ecx, [r12 + 8]
call fcn.1400127b0
mov ecx, r15d
call fcn.14000db58
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x14000dce4

Function at 0x14000de7c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14000dce4
Function at 0x140015f38
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.14000fb8c
xor ebx, ebx
mov rdi, rax
cmp qword [0x140026b88], rbx
jne 0x14001603e
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140016113
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140016113
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140026b88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140026b90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140026b98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140026ba8], rax
test rax, rax
je 0x140016035
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140026ba0], rax
jmp 0x140016045
mov rax, qword [0x140026ba0]
jmp 0x14001604c
mov rax, qword [0x140026ba0]
mov r11, qword [0x140026ba8]
cmp rax, rdi
je 0x1400160b4
cmp r11, rdi
je 0x1400160b4
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140026ba8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1400160b4
test rax, rax
je 0x1400160b4
call rsi
test rax, rax
je 0x1400160ae
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400160ae
test byte [rsp + 0x38], 1
jne 0x1400160b4
bts ebp, 0x15
jmp 0x1400160f2
mov rcx, qword [0x140026b90]
cmp rcx, rdi
je 0x1400160f2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400160f2
call rax
mov rbx, rax
test rax, rax
je 0x1400160f2
mov rcx, qword [0x140026b98]
cmp rcx, rdi
je 0x1400160f2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400160f2
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140026b88]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140016113
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140016115
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180001340
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x870
mov qword [rsp + 0x860], 0xfffffffffffffffe
mov rax, qword [0x180084090]
xor rax, rsp
mov qword [rsp + 0x868], rax
mov dword [rsp + 0x858], 0
lea rcx, [rsp + 0x40]
call fcn.180001700
nop
mov qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x888]
call fcn.18000b4f0
xor edx, edx
mov rcx, rax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
jne 0x1800013bb
jmp 0x18000150a
mov ecx, dword [rsp + 0x48]
call fcn.18004f654
mov qword [rsp + 0x848], rax
mov rax, qword [rsp + 0x848]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x888]
call fcn.18000b4f0
mov r9, qword [rsp + 0x38]
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov rcx, rax
call sub.VERSION.dll_GetFileVersionInfoW
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x18000140a
jmp 0x18000150a
mov dword [rsp + 0x30], 4
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
lea rdx, str.VarFileInfoTranslation
mov rcx, qword [rsp + 0x38]
call sub.VERSION.dll_VerQueryValueW
mov dword [rsp + 0x58], 0
jmp 0x180001442
mov eax, dword [rsp + 0x58]
add eax, 1
mov dword [rsp + 0x58], eax
movsxd rdi, dword [rsp + 0x58]
mov eax, dword [rsp + 0x30]
xor edx, edx
mov ecx, 4
div rcx
cmp rdi, rax
jae 0x18000150a
xor eax, eax
mov word [rsp + 0x70], ax
lea rdi, [rsp + 0x72]
xor eax, eax
mov ecx, 0x7ce
rep stosb byte [rdi], al
movsxd rdx, dword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
movzx r9d, word [rax + rdx*4 + 2]
movsxd rcx, dword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
movzx r8d, word [rax + rcx*4]
mov rax, qword [rsp + 0x890]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea rdx, str.StringFileInfo_04x_04x_s
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
mov dword [rsp + 0x840], eax
cmp dword [rsp + 0x840], 0
jge 0x1800014ca
jmp 0x180001437
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x5c], 0x3e8
lea r9, [rsp + 0x5c]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call sub.VERSION.dll_VerQueryValueW
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1800017e0
jmp 0x18000150a
cmp qword [rsp + 0x38], 0
je 0x18000152c
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x850], rax
mov rcx, qword [rsp + 0x850]
call fcn.18004f750
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x880]
call fcn.180001730
mov eax, dword [rsp + 0x858]
or eax, 1
mov dword [rsp + 0x858], eax
lea rcx, [rsp + 0x40]
call fcn.1800017c0
nop
mov rcx, qword [rsp + 0x888]
call fcn.1800017c0
nop
mov rcx, qword [rsp + 0x890]
call fcn.1800017c0
mov rax, qword [rsp + 0x880]
mov rcx, qword [rsp + 0x868]
xor rcx, rsp
call fcn.18004f770
add rsp, 0x870
pop rdi
ret
Function at 0x1800034c0
Capabilities:
Enumerate processes

Disassembly:
sub rsp, 0x2e8
mov qword [rsp + 0x2b0], 0xfffffffffffffffe
mov rax, qword [0x180084090]
xor rax, rsp
mov qword [rsp + 0x2d8], rax
mov dword [rsp + 0x20], 0
xor edx, edx
mov ecx, 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x270], rax
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x270]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1800036c7
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x270]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x1800036b9
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x278], eax
lea rdx, [rsp + 0x5c]
lea rcx, [rsp + 0x298]
call fcn.180001760
mov qword [rsp + 0x2b8], rax
mov rax, qword [rsp + 0x2b8]
mov qword [rsp + 0x2c0], rax
lea rdx, str.HipsDaemon.exe
mov rcx, qword [rsp + 0x2c0]
call fcn.180002c80
test eax, eax
jne 0x180003597
mov dword [rsp + 0x2c8], 1
jmp 0x1800035a2
mov dword [rsp + 0x2c8], 0
movzx eax, byte [rsp + 0x2c8]
mov byte [rsp + 0x290], al
lea rcx, [rsp + 0x298]
call fcn.1800017c0
movzx r11d, byte [rsp + 0x290]
test r11d, r11d
je 0x1800036b4
lea rcx, [rsp + 0x288]
call fcn.180001700
nop
mov edx, 0x104
lea rcx, [rsp + 0x288]
call fcn.180001df0
mov r8d, 0x104
mov rdx, rax
mov ecx, dword [rsp + 0x278]
call fcn.18000aab0
mov edx, 0xffffffff
lea rcx, [rsp + 0x288]
call fcn.1800037a0
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x2a8], rax
lea rdx, [rsp + 0x288]
mov rcx, qword [rsp + 0x2a8]
call fcn.180001730
mov qword [rsp + 0x2d0], rax
mov rdx, qword [rsp + 0x2d0]
lea rcx, [rsp + 0x280]
call fcn.1800015a0
xor r8d, r8d
lea rdx, [0x180075660]
lea rcx, [rsp + 0x280]
call fcn.1800036f0
test eax, eax
jl 0x180003699
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x280]
call fcn.1800017c0
nop
lea rcx, [rsp + 0x288]
call fcn.1800017c0
jmp 0x1800036b9
lea rcx, [rsp + 0x280]
call fcn.1800017c0
nop
lea rcx, [rsp + 0x288]
call fcn.1800017c0
jmp 0x180003523
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x2d8]
xor rcx, rsp
call fcn.18004f770
add rsp, 0x2e8
ret
Function at 0x180005a10
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x180005ac4
cmp qword [rsp + 0x40], 0
je 0x180005ac4
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11d, dword [rsp + 0x70]
cmp dword [rsp + 0x48], r11d
jne 0x180005ab6
mov dword [rsp + 0x4c], 1
jmp 0x180005abe
mov dword [rsp + 0x4c], 0
mov eax, dword [rsp + 0x4c]
jmp 0x180005ac6
xor eax, eax
add rsp, 0x58
ret

Function at 0x180005ad0
Capabilities:
Create service
Start service

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov dword [rsp + 0x80], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
jne 0x180005b20
jmp 0x180005bd8
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
mov r9d, 0xf01ff
mov r8, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x84], 0
cmp qword [rsp + 0x78], 0
jne 0x180005bad
jmp 0x180005bd8
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x180005bc3
jmp 0x180005bd8
mov dword [rsp + 0x80], 1
xor eax, eax
test eax, eax
jne 0x180005afe
cmp qword [rsp + 0x78], 0
jne 0x180005bf4
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x78], 0
cmp qword [rsp + 0x70], 0
jne 0x180005c10
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x70], 0
mov eax, dword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x180007ed0
Capabilities:
Delete file

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x28]
call fcn.180001700
nop
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x28]
call fcn.1800017e0
lea rcx, [rsp + 0x28]
call fcn.18000b4f0
mov r8d, dword [rsp + 0x98]
mov rdx, qword [rsp + 0x90]
mov rcx, rax
call fcn.180005a10
test eax, eax
jne 0x180007f41
jmp 0x180007fd5
lea rcx, [rsp + 0x28]
call fcn.18000b4f0
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call fcn.180005ad0
test eax, eax
je 0x180007f69
mov dword [rsp + 0x20], 1
jmp 0x180007fd5
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 0
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.180018a00
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x34], eax
jne 0x180007fa4
jmp 0x180007fd5
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x34]
call fcn.180005c20
test eax, eax
je 0x180007fcb
mov dword [rsp + 0x20], 1
jmp 0x180007fd5
xor eax, eax
test eax, eax
jne 0x180007f16
lea rcx, [rsp + 0x28]
call fcn.18000b4f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, str..inf
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x40]
call fcn.180008e90
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.18000b4f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x40]
call fcn.1800017c0
lea r8, str..xBak
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x48]
call fcn.180008e90
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x68]
call fcn.18000b4f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x48]
call fcn.1800017c0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x28]
call fcn.1800017c0
mov eax, dword [rsp + 0x50]
add rsp, 0x78
ret
Function at 0x180008ff0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
cmp qword [rsp + 0x60], 0
je 0x180009044
mov rax, qword [rsp + 0x60]
movzx eax, word [rax]
cmp eax, 0x30
jne 0x18000904b
xor eax, eax
jmp 0x1800090e2
mov rax, qword gs:[0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x20]
add rax, 0x20
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
sub rax, 0x10
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x60], 0
je 0x1800090c4
mov rdx, qword [rsp + 0x40]
mov rdx, qword [rdx + 0x60]
mov rcx, qword [rsp + 0x60]
call fcn.180008f40
test eax, eax
jne 0x1800090c4
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x48], rax
jmp 0x1800090dd
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jne 0x180009083
mov rax, qword [rsp + 0x48]
add rsp, 0x58
ret