joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010180
Capabilities:
Shutdown system

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbp, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov esi, ecx
lea rcx, str.guest_shutdown_called__mode:__s
mov rbx, rdx
mov rdi, r8
mov rax, qword [rbp]
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rsp + 0x40], 0
call dbg.slog
test sil, sil
je 0x1400101cf
lea rdx, str.powerdown
mov rcx, rbx
call sym.strcmp
test eax, eax
jne 0x140010210
mov ebx, 0xc
lea rdx, [rsp + 0x40]
lea rcx, str.SeShutdownPrivilege
call dbg.acquire_privilege
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x140010230
mov rcx, rdi
call sym.error_propagate
mov rax, qword [rsp + 0x48]
sub rax, qword [rbp]
jne 0x140010301
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, str.halt
mov rcx, rbx
call sym.strcmp
test eax, eax
jne 0x1400102a0
mov ebx, 5
jmp 0x1400101d4
mov edx, 0x80000000
mov ecx, ebx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x1400101f7
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
mov ecx, eax
call sym.g_win32_error_message
lea rcx, str.guest_shutdown_failed:__s
mov rdx, rax
mov rbx, rax
call dbg.slog
call rsi
lea rsi, str.guest_shutdown_failed
mov dword [rsp + 0x20], eax
mov rcx, rdi
lea r9, global___func__.55
mov qword [rsp + 0x28], rsi
mov r8d, 0x161
lea rdx, str..._qga_commands_win32.c
call dbg.error_setg_win32_internal
mov rcx, rbx
call sym.g_free
jmp 0x1400101f7
mov rcx, rbx
lea rdx, str.reboot
mov ebx, 6
call sym.strcmp
test eax, eax
je 0x1400101d4
lea rax, str.halt__powerdown__or_reboot
mov r8d, 0x151
mov rcx, rdi
mov qword [rsp + 0x30], rax
lea rax, [0x140089bf1]
lea r9, global___func__.55
mov qword [rsp + 0x28], rax
lea rax, [0x140089bf6]
lea rdx, str..._qga_commands_win32.c
mov qword [rsp + 0x20], rax
call dbg.error_setg_internal
jmp 0x1400101f7
call sym.__stack_chk_fail
mov rsi, rax
mov rcx, rbx
call sym.g_free
mov rcx, rsi
call dbg._Unwind_Resume
nop
nop word [rax + rax]
Function at 0x140010320
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbp, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov r12, qword [rcx + 8]
mov rax, qword [rbp]
mov qword [rsp + 0x38], rax
xor eax, eax
lea rcx, [rdx + 1]
mov rsi, rdx
mov rdi, r8
call sym.g_malloc0
lea r9, [rsp + 0x34]
mov r8d, esi
mov rcx, r12
mov qword [rsp + 0x20], 0
mov rbx, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400103d0
mov eax, dword [rsp + 0x34]
mov ecx, 0x18
mov byte [rbx + rax], 0
call sym.g_malloc0
mov rsi, rax
mov eax, dword [rsp + 0x34]
test eax, eax
mov qword [rsi], rax
mov rdx, rax
sete byte [rsi + 0x10]
jne 0x1400103c0
mov rcx, rbx
call sym.g_free
mov rax, qword [rsp + 0x38]
sub rax, qword [rbp]
jne 0x140010406
mov rax, rsi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbx
call sym.g_base64_encode
mov qword [rsi + 8], rax
jmp 0x14001039a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rsi, str.failed_to_read_file
mov rcx, rdi
lea r9, global___func__.25
mov qword [rsp + 0x28], rsi
mov r8d, 0x171
lea rdx, str..._qga_commands_win32.c
xor esi, esi
mov dword [rsp + 0x20], eax
call dbg.error_setg_win32_internal
jmp 0x14001039a
call sym.__stack_chk_fail
nop
nop dword [rax]
Function at 0x140010410
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbp, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov r13, qword [rsp + 0xb0]
mov rax, qword [rbp]
mov qword [rsp + 0x48], rax
mov rax, qword [0x140083ba0]
mov rbx, rcx
mov r12d, r8d
mov rcx, rdx
mov rsi, r9
test rax, rax
jne 0x140010465
jmp 0x140010540
mov rax, qword [rax + 0x10]
test rax, rax
je 0x140010540
cmp rbx, qword [rax]
jne 0x140010458
mov r9, r13
lea r8, [rsp + 0x40]
mov rdx, 0xffffffffffffffff
mov r14, qword [rax + 8]
call dbg.qbase64_decode
mov rdi, rax
test rax, rax
je 0x14001056d
test r12b, r12b
je 0x140010578
test rsi, rsi
js 0x1400105a8
cmp qword [rsp + 0x40], rsi
jb 0x1400105a8
lea r9, [rsp + 0x3c]
mov r8d, esi
mov rdx, rdi
mov rcx, r14
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140010588
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rsi, str.failed_to_write_to_file
mov rcx, r13
lea rdx, str..._qga_commands_win32.c
mov qword [rsp + 0x28], rsi
lea r9, global___func__.136
mov r8d, 0x1a0
mov dword [rsp + 0x20], eax
call dbg.error_setg_win32_internal
mov rdx, rbx
lea rcx, str.guest_file_write_failed__handle:__lld
call dbg.slog
xor ebx, ebx
mov rcx, rdi
call sym.g_free
mov rax, qword [rsp + 0x48]
sub rax, qword [rbp]
jne 0x1400105da
mov rax, rbx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rax, str.handle__lld_has_not_been_found
mov qword [rsp + 0x28], rbx
mov rcx, r13
lea r9, str.guest_file_handle_find
mov qword [rsp + 0x20], rax
mov r8d, 0xad
lea rdx, str..._qga_commands_win32.c
call dbg.error_setg_internal
xor ebx, ebx
jmp 0x14001051b
mov rsi, qword [rsp + 0x40]
jmp 0x1400104ab
mov ecx, 0x10
call sym.g_malloc0
mov rbx, rax
mov eax, dword [rsp + 0x3c]
mov qword [rbx], rax
jmp 0x140010513
lea rax, str.value__lld_is_invalid_for_argument_count
mov qword [rsp + 0x28], rsi
mov rcx, r13
lea r9, global___func__.136
mov qword [rsp + 0x20], rax
mov r8d, 0x199
lea rdx, str..._qga_commands_win32.c
call dbg.error_setg_internal
jmp 0x140010511
call sym.__stack_chk_fail
nop
Function at 0x140011710
Capabilities:
Check os version
Enumerate disk volumes
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov qword [rsp + 0x20], 0
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
xor eax, eax
call dbg.vss_initialized
test al, al
jne 0x140011750
mov rax, qword [rsp + 0x28]
sub rax, qword [rbx]
jne 0x1400117a4
add rsp, 0x30
pop rbx
ret
mov rax, qword [str._1_v_]
mov rcx, qword [rax]
call sym.ga_is_frozen
test al, al
jne 0x140011770
mov ecx, 1
call sym.vss_deinit
jmp 0x140011738
lea rcx, [rsp + 0x20]
call sym.qmp_guest_fsfreeze_thaw
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140011763
call sym.error_get_pretty
lea rcx, str.failed_to_clean_up_frozen_filesystems:__s
mov rdx, rax
call dbg.slog
mov rcx, qword [rsp + 0x20]
call sym.error_free
jmp 0x140011763
call sym.__stack_chk_fail
nop
nop word [rax + rax]
Function at 0x140011c40
Capabilities:
Create thread

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov qword [rsp + 0x38], 0
mov rdi, rcx
mov ecx, 4
mov rax, qword [rsi]
mov qword [rsp + 0x98], rax
xor eax, eax
call sym.g_malloc
pxor xmm0, xmm0
lea rcx, [rsp + 0x40]
mov dword [rax], 0
mov rbx, rax
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x7c], xmm0
call sym.GetPwrCapabilities
test al, al
je 0x140011d90
cmp byte [rsp + 0x46], 0
je 0x140011d50
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140011cf0
mov rcx, rdi
call sym.error_propagate
mov rcx, rbx
call sym.g_free
mov rax, qword [rsp + 0x98]
sub rax, qword [rsi]
jne 0x140011e09
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rbp, [rsp + 0x38]
lea rcx, str.SeShutdownPrivilege
mov rdx, rbp
call dbg.acquire_privilege
mov rdx, qword [rsp + 0x38]
test rdx, rdx
jne 0x140011cc2
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [dbg.do_suspend]
mov qword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140011dd0
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140011cd2
jmp 0x140011cc2
lea rax, str.suspend_to_disk_not_supported_by_OS
lea rcx, [rsp + 0x38]
mov r8d, 0x5b3
mov qword [rsp + 0x28], rax
lea rax, str.Guest_agent_command_failed__error_was__s
lea r9, str.check_suspend_mode
mov qword [rsp + 0x20], rax
lea rdx, str..._qga_commands_win32.c
call dbg.error_setg_internal
jmp 0x140011cb8
lea rax, str.failed_to_determine_guest_suspend_capabilities
lea rcx, [rsp + 0x38]
mov r8d, 0x5ab
mov qword [rsp + 0x28], rax
lea rax, str.Guest_agent_command_failed__error_was__s
lea r9, str.check_suspend_mode
mov qword [rsp + 0x20], rax
lea rdx, str..._qga_commands_win32.c
call dbg.error_setg_internal
jmp 0x140011cb8
lea rax, str.failed_to_dispatch_asynchronous_command
mov r8d, 0x13e
mov rcx, rbp
mov qword [rsp + 0x28], rax
lea rax, str.Guest_agent_command_failed__error_was__s
lea r9, str.execute_async
mov qword [rsp + 0x20], rax
lea rdx, str..._qga_commands_win32.c
call dbg.error_setg_internal
jmp 0x140011d3a
call sym.__stack_chk_fail
nop
nop
Function at 0x140011e10
Capabilities:
Create thread

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov qword [rsp + 0x38], 0
mov rdi, rcx
mov ecx, 4
mov rax, qword [rsi]
mov qword [rsp + 0x98], rax
xor eax, eax
call sym.g_malloc
pxor xmm0, xmm0
lea rcx, [rsp + 0x40]
mov dword [rax], 1
mov rbx, rax
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x7c], xmm0
call sym.GetPwrCapabilities
test al, al
je 0x140011f60
cmp byte [rsp + 0x45], 0
je 0x140011f20
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140011ec0
mov rcx, rdi
call sym.error_propagate
mov rcx, rbx
call sym.g_free
mov rax, qword [rsp + 0x98]
sub rax, qword [rsi]
jne 0x140011fd9
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rbp, [rsp + 0x38]
lea rcx, str.SeShutdownPrivilege
mov rdx, rbp
call dbg.acquire_privilege
mov rdx, qword [rsp + 0x38]
test rdx, rdx
jne 0x140011e92
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [dbg.do_suspend]
mov qword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140011fa0
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140011ea2
jmp 0x140011e92
lea rax, str.suspend_to_ram_not_supported_by_OS
lea rcx, [rsp + 0x38]
mov r8d, 0x5b9
mov qword [rsp + 0x28], rax
lea rax, str.Guest_agent_command_failed__error_was__s
lea r9, str.check_suspend_mode
mov qword [rsp + 0x20], rax
lea rdx, str..._qga_commands_win32.c
call dbg.error_setg_internal
jmp 0x140011e88
lea rax, str.failed_to_determine_guest_suspend_capabilities
lea rcx, [rsp + 0x38]
mov r8d, 0x5ab
mov qword [rsp + 0x28], rax
lea rax, str.Guest_agent_command_failed__error_was__s
lea r9, str.check_suspend_mode
mov qword [rsp + 0x20], rax
lea rdx, str..._qga_commands_win32.c
call dbg.error_setg_internal
jmp 0x140011e88
lea rax, str.failed_to_dispatch_asynchronous_command
mov r8d, 0x13e
mov rcx, rbp
mov qword [rsp + 0x28], rax
lea rax, str.Guest_agent_command_failed__error_was__s
lea r9, str.execute_async
mov qword [rsp + 0x20], rax
lea rdx, str..._qga_commands_win32.c
call dbg.error_setg_internal
jmp 0x140011f0a
call sym.__stack_chk_fail
nop
nop
Function at 0x140012550
Capabilities:
Execute command

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rdi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
lea rbx, [rsp + 0x40]
mov rsi, rcx
mov qword [rsp + 0x40], 0
mov rax, qword [rdi]
mov qword [rsp + 0x58], rax
xor eax, eax
mov rcx, rbx
mov qword [rsp + 0x48], 0
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [rsp + 0x40]
sub ax, 0x641
cmp ax, 0x722a
ja 0x1400125e0
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x140012611
mov rax, qword [rsp + 0x38]
lea rax, [rax + rax*4]
lea rdx, [rax + rax*4]
movabs rax, 0x5e6684f4b3960000
lea rax, [rax + rdx*4]
mov rdx, qword [rsp + 0x58]
sub rdx, qword [rdi]
jne 0x140012645
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
lea rax, str.Failed_to_get_time
mov r8d, 0x6e9
mov rcx, rsi
mov qword [rsp + 0x20], rax
lea r9, global___func__.65
lea rdx, str..._qga_commands_win32.c
call dbg.error_setg_internal
mov rax, 0xffffffffffffffff
jmp 0x1400125c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, global___func__.65
mov r8d, 0x6ee
mov rcx, rsi
mov dword [rsp + 0x28], eax
lea rax, str.Failed_to_convert_system_time:__d
lea rdx, str..._qga_commands_win32.c
mov qword [rsp + 0x20], rax
call dbg.error_setg_internal
jmp 0x140012608
call sym.__stack_chk_fail
nop
nop dword [rax + rax]
Function at 0x140013170
Capabilities:
Get session information
Get system information on windows
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x70], xmm7
mov r12, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rdx, qword [sub.libglib_2.0_0.dll_g_str_equal]
xor ebx, ebx
mov rcx, qword [sub.libglib_2.0_0.dll_g_str_hash]
mov rax, qword [r12]
mov qword [rsp + 0x58], rax
xor eax, eax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x3c], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
call sym.g_hash_table_new
lea r9, [rsp + 0x50]
xor edx, edx
xor ecx, ecx
mov rsi, rax
lea rax, [rsp + 0x3c]
mov r8d, 1
mov qword [rsp + 0x20], rax
call sym.WTSEnumerateSessionsA
test eax, eax
je 0x140013367
mov ecx, dword [rsp + 0x3c]
test ecx, ecx
je 0x14001335d
movsd xmm7, qword [0x14008b128]
lea r13, [rsp + 0x40]
lea rbp, [rsp + 0x48]
movabs r14, 0xfe624e212ac18000
lea rdi, [rsp + 0x38]
jmp 0x14001327f
mov rax, qword [rsp + 0x48]
mov rcx, rsi
lea rdx, [rax + 0x51]
call sym.g_hash_table_lookup
movsd xmm0, qword [rax + 8]
comisd xmm0, xmm6
jbe 0x140013268
movsd qword [rax + 8], xmm6
nop dword [rax]
mov rcx, qword [rsp + 0x48]
call sym.WTSFreeMemory
add ebx, 1
cmp ebx, dword [rsp + 0x3c]
jae 0x140013358
mov rdx, qword [rsp + 0x50]
mov eax, ebx
xor ecx, ecx
mov r9, rbp
lea rax, [rax + rax*2]
mov dword [rsp + 0x38], 0
mov r8d, 0x18
mov qword [rsp + 0x48], 0
lea rax, [rdx + rax*8]
mov edx, dword [rax]
mov qword [rsp + 0x20], rdi
call sym.WTSQuerySessionInformationA
test eax, eax
je 0x140013268
mov rcx, qword [rsp + 0x48]
cmp byte [rcx + 0x51], 0
je 0x14001326d
mov rax, qword [rcx + 0x80]
pxor xmm6, xmm6
lea rdx, [rcx + 0x51]
mov rcx, rsi
add rax, r14
cvtsi2sd xmm6, rax
divsd xmm6, xmm7
call sym.g_hash_table_contains
test eax, eax
jne 0x140013240
mov ecx, 0x20
call sym.g_malloc0
mov r15, rax
mov rax, qword [rsp + 0x48]
lea rcx, [rax + 0x51]
call sym.g_strdup
mov qword [r15], rax
mov rax, qword [rsp + 0x48]
lea rcx, [rax + 0x40]
call sym.g_strdup
mov byte [r15 + 0x10], 1
mov rdx, qword [r15]
mov rcx, rsi
mov qword [r15 + 0x18], rax
movsd qword [r15 + 8], xmm6
call sym.g_hash_table_add
mov ecx, 0x10
call sym.g_malloc0
mov qword [r13], rax
mov qword [rax + 8], r15
mov r13, qword [r13]
jmp 0x140013268
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
call sym.WTSFreeMemory
mov rcx, rsi
call sym.g_hash_table_destroy
mov rax, qword [rsp + 0x58]
sub rax, qword [r12]
jne 0x14001339b
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
mov rax, rbx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call sym.__stack_chk_fail
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x1400142f0
Capabilities:
Create service
Delete service
Modify service
Persist via windows service

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x190
mov r12, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [r12]
mov qword [rsp + 0x188], rax
lea rax, str.Enables_integration_with_QEMU_machine_emulator_and_virtualizer.
mov r13, rcx
mov rbp, rdx
mov rdi, r8
lea r14, [rsp + 0x80]
xor ecx, ecx
mov r8d, 0x104
mov rdx, r14
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140014510
lea rbx, [0x14008b1c5]
mov rcx, rbx
call sym.g_string_new
mov rcx, rbx
mov rsi, rax
call sym.g_string_new
mov rdx, rsi
mov rcx, r14
mov rbx, rax
call dbg.win_escape_arg
lea rdx, str._s__d
mov rcx, rbx
mov r8, rax
call sym.g_string_append_printf
test r13, r13
je 0x1400143a6
mov rdx, rsi
mov rcx, r13
call dbg.win_escape_arg
lea rdx, str.__p__s
mov rcx, rbx
mov r8, rax
call sym.g_string_append_printf
test rbp, rbp
je 0x1400143c8
mov rdx, rsi
mov rcx, rbp
call dbg.win_escape_arg
lea rdx, str.__l__s__v
mov rcx, rbx
mov r8, rax
call sym.g_string_append_printf
test rdi, rdi
je 0x1400143ea
mov rdx, rsi
mov rcx, rdi
call dbg.win_escape_arg
lea rdx, str.__t__s
mov rcx, rbx
mov r8, rax
call sym.g_string_append_printf
mov r9, qword [rbx]
lea r8, str.services_cmdline:__s
mov edx, pe_nt_image_headers64
xor ecx, ecx
call sym.g_log
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x140014548
mov qword [rsp + 0x60], 0
mov r9d, 0xf01ff
mov rcx, rdi
lea r8, str.QEMU_Guest_Agent
mov qword [rsp + 0x58], 0
lea rdx, str.qemu_ga
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov rax, qword [rbx]
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rbp, rax
test rax, rax
je 0x140014528
lea r8, [rsp + 0x78]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
mov ecx, 2
call qword [sym.__acrt_iob_func]
lea rdx, str.Service_was_installed_successfully._n
mov rcx, rax
call sym.fprintf
mov rcx, rbp
mov r13, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor ebp, ebp
call r13
mov rcx, rdi
call r13
mov edx, 1
mov rcx, rbx
call sym.g_string_free
mov edx, 1
mov rcx, rsi
call sym.g_string_free
mov rax, qword [rsp + 0x188]
sub rax, qword [r12]
jne 0x14001455e
mov eax, ebp
add rsp, 0x190
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rcx, str.No_full_path_to_services_executable
mov ebp, 1
call sym.printf_win_error.isra.0
jmp 0x1400144ee
lea rcx, str.Failed_to_install_service
mov ebp, 1
call sym.printf_win_error.isra.0
mov r13, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400144ce
lea rcx, str.No_handle_to_service_control_manager
mov ebp, 1
call sym.printf_win_error.isra.0
jmp 0x1400144d4
call sym.__stack_chk_fail
nop
nop word cs:[rax + rax]
nop
Function at 0x140014570
Capabilities:
Delete service

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
je 0x140014600
mov r8d, 0x10000
lea rdx, str.qemu_ga
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
je 0x140014620
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x1400145f0
mov ecx, 2
call qword [sym.__acrt_iob_func]
lea rdx, str.Service_was_deleted_successfully._n
mov rcx, rax
call sym.fprintf
mov rcx, rsi
mov rsi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call rsi
mov rcx, rbx
call rsi
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
lea rcx, str.Failed_to_delete_service
call sym.printf_win_error.isra.0
jmp 0x1400145d3
lea rcx, str.No_handle_to_service_control_manager
call sym.printf_win_error.isra.0
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
ret
lea rcx, str.No_handle_to_service
call sym.printf_win_error.isra.0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14001460c

Function at 0x140014640
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov qword [rsp + 0x50], r8
lea r8, [rsp + 0x50]
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x20], r8
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
xor eax, eax
call sym.__mingw_vfprintf
mov rdx, qword [rsp + 0x28]
sub rdx, qword [rbx]
jne 0x14001467f
add rsp, 0x30
pop rbx
ret
call sym.__stack_chk_fail
nop
nop word cs:[rax + rax]

Function at 0x140014690
Capabilities:
Check os version

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rsi]
mov qword [rsp + 0x48], rax
xor eax, eax
mov rbx, rcx
mov rcx, qword [0x1400b3180]
test rcx, rcx
je 0x1400146e0
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140014707
call rax
mov rdx, qword [rsp + 0x48]
sub rdx, qword [rsi]
jne 0x140014781
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
lea rax, str.provider_lib
lea r9, global___func__.179
mov r8d, 0x1e
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea rdx, str..._qga_vss_win32.c
call sym.g_assertion_message_expr
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x400
xor edx, edx
mov ecx, 0x1100
mov r8d, eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rdi, qword [rsp + 0x40]
mov ecx, 2
call qword [sym.__acrt_iob_func]
lea r9, str.qga_vss.dll
mov r8, rbx
lea rdx, str.failed_to_load__s_from__s:__s
mov qword [rsp + 0x20], rdi
mov rcx, rax
call sym.fprintf_1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 0x80004005
jmp 0x1400146c7
call sym.__stack_chk_fail
nop
nop word [rax + rax]
Function at 0x140014790
Capabilities:
Check os version

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0xf0
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rsi]
mov qword [rsp + 0xe8], rax
xor eax, eax
mov dword [rsp + 0x50], 0x94
mov ebx, ecx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x54], 5
je 0x1400147f0
ja 0x1400147f7
mov ecx, 2
call qword [sym.__acrt_iob_func]
lea rdx, str.VSS_provider_is_not_supported_in_this_OS_version:_fsfreeze_is_disabled._n
mov rcx, rax
call sym.fprintf_1
xor eax, eax
jmp 0x14001481c
cmp dword [rsp + 0x58], 1
jbe 0x1400147cc
lea rdi, str.qga_vss.dll
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1400b3180], rax
test rax, rax
je 0x140014890
test bl, bl
jne 0x140014840
mov eax, 1
mov rdx, qword [rsp + 0xe8]
sub rdx, qword [rsi]
jne 0x1400148fe
add rsp, 0xf0
pop rbx
pop rsi
pop rdi
ret
lea rcx, str.requester_init
call dbg.call_vss_provider_func
test eax, eax
jns 0x140014817
mov ecx, 2
call qword [sym.__acrt_iob_func]
lea rdx, str.fsfreeze_is_disabled._n
mov rcx, rax
call sym.fprintf_1
mov rcx, qword [0x1400b3180]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov qword [0x1400b3180], 0
jmp 0x14001481c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x400
xor edx, edx
mov ecx, 0x1100
mov r8d, eax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rbx, qword [rsp + 0x48]
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov r8, rdi
lea rdx, str.failed_to_load__s:__sfsfreeze_is_disabled_n
mov rcx, rax
mov r9, rbx
call sym.fprintf_1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
jmp 0x14001481c
call sym.__stack_chk_fail
nop
nop word cs:[rax + rax]
nop

Function at 0x1400149d0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call dbg.vss_init
test al, al
je 0x140014a10
lea rcx, str.COMUnregister
call dbg.call_vss_provider_func
mov rcx, qword [0x1400b3180]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1400b3180], 0
add rsp, 0x28
ret
mov ecx, 2
call qword [sym.__acrt_iob_func]
lea rdx, str.Removal_of_VSS_provider_is_skipped._n
mov rcx, rax
add rsp, 0x28
jmp sym.fprintf_1

Function at 0x140015200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rdi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rbp, qword [rsp + 0x90]
mov rax, qword [rdi]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rbx, rdx
mov rsi, r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
call qword [r9]
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
test rdx, rdx
je 0x140015268
mov rcx, rbp
call sym.error_propagate
mov rax, qword [rsp + 0x38]
sub rax, qword [rdi]
jne 0x140015287
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbx
mov r9, rbp
lea r8, [rsp + 0x28]
mov rdx, rsi
call dbg.visit_type_str
mov rcx, qword [rsp + 0x28]
call sym.g_free
jmp 0x14001524f
call sym.__stack_chk_fail
nop
nop dword [rax]