joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800093a0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rdi
push r13
push r14
sub rsp, 0x978
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x960], rax
mov rbp, rcx
mov r13, rdx
xor r14d, r14d
lea rcx, [rsp + 0x58]
xor edx, edx
mov r8d, 0x7f8
mov edi, r14d
mov qword [rsp + 0x50], r14
call fcn.180055310
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov r8d, 0x800
mov rcx, r13
mov dword [rsp + 0x20], 3
call sub.PSAPI.DLL_EnumProcessModulesEx
test eax, eax
je 0x1800095aa
mov qword [rsp + 0x9b0], rbx
lea rcx, [rsp + 0x851]
mov ebx, r14d
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x970], r12
mov byte [rsp + 0x850], bl
call fcn.180055310
mov eax, dword [rsp + 0x30]
mov r12d, r14d
test rax, 0xfffffffffffffff8
jbe 0x1800095a5
mov qword [rsp + 0x9b8], rsi
lea rsi, [rsp + 0x50]
nop word [rax + rax]
mov rdx, qword [rsi]
lea r8, [rsp + 0x850]
mov r9d, 0x104
mov rcx, r13
call sub.PSAPI.DLL_GetModuleBaseNameA
test eax, eax
je 0x180009552
lea rdx, str.kernel32.dll
lea rcx, [rsp + 0x850]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1800094e8
mov rdx, qword [rsi]
xor eax, eax
lea r8, [rsp + 0x38]
lea r9d, [rax + 0x18]
mov rcx, r13
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call sub.PSAPI.DLL_GetModuleInformation
test eax, eax
je 0x1800094e4
lea rcx, [rsp + 0x38]
mov edi, 1
mov rax, qword [rcx]
mov qword [rbp], rax
mov rax, qword [rcx + 8]
mov qword [rbp + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rbp + 0x10], rax
inc ebx
jmp 0x18000954d
lea rdx, str.user32.dll
lea rcx, [rsp + 0x850]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x18000954d
mov rdx, qword [rsi]
xor eax, eax
lea r8, [rsp + 0x38]
lea r9d, [rax + 0x18]
mov rcx, r13
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call sub.PSAPI.DLL_GetModuleInformation
test eax, eax
je 0x18000954b
lea rcx, [rsp + 0x38]
mov edi, 1
mov rax, qword [rcx]
mov qword [rbp + 0x18], rax
mov rax, qword [rcx + 8]
mov qword [rbp + 0x20], rax
mov rax, qword [rcx + 0x10]
mov qword [rbp + 0x28], rax
inc ebx
cmp ebx, 2
jge 0x18000956d
mov ecx, dword [rsp + 0x30]
inc r12d
add rsi, 8
shr rcx, 3
movsxd rax, r12d
cmp rax, rcx
jb 0x180009460
mov rsi, qword [rsp + 0x9b8]
mov eax, edi
mov rbx, qword [rsp + 0x9b0]
mov r12, qword [rsp + 0x970]
mov rcx, qword [rsp + 0x960]
xor rcx, rsp
call fcn.180050540
add rsp, 0x978
pop r14
pop r13
pop rdi
pop rbp
ret
mov eax, r14d
jmp 0x180009577
mov eax, r14d
jmp 0x180009587
Function at 0x180009e60
Capabilities:
Enumerate processes
Get process image filename

Disassembly:
push rbp
push rsi
push r12
sub rsp, 0x290
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r12, rcx
mov rbp, rdx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x130
xor esi, esi
call fcn.180055310
lea rdx, [rsp + 0x30]
mov rcx, rbp
mov dword [rsp + 0x30], 0x130
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x18000a021
mov qword [rsp + 0x2c8], rdi
mov qword [rsp + 0x288], r13
mov qword [rsp + 0x280], r14
lea r14, [0x18009f41c]
mov qword [rsp + 0x2c0], rbx
lea r13, [0x18009f424]
nop word [rax + rax]
lea rcx, [rsp + 0x161]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x160], sil
call fcn.180055310
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x180009fd2
lea r8, [rsp + 0x160]
mov r9d, 0x104
xor edx, edx
mov rcx, rax
call sub.PSAPI.DLL_GetModuleFileNameExA
mov ebx, eax
test eax, eax
jne 0x180009f71
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x160]
mov r8d, 0x104
mov rcx, rdi
call sub.PSAPI.DLL_GetProcessImageFileNameA
mov ebx, eax
test eax, eax
jne 0x180009f71
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x180009fd2
xor eax, eax
lea rcx, [rsp + 0x160]
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x24], eax
call fcn.180004800
test eax, eax
je 0x180009fd2
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x160]
call fcn.180007840
test eax, eax
je 0x180009fd2
mov ecx, dword [rsp + 0x24]
mov edx, dword [rsp + 0x20]
mov rax, r14
nop word [rax + rax]
cmp edx, dword [rax - 4]
jne 0x180009fc9
cmp ecx, dword [rax]
je 0x180009fe9
add rax, 8
cmp rax, r13
jl 0x180009fc0
lea rdx, [rsp + 0x30]
mov rcx, rbp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x180009ef0
jmp 0x180009ff6
mov eax, dword [rsp + 0x38]
mov esi, 1
mov dword [r12], eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x280]
mov r13, qword [rsp + 0x288]
mov rdi, qword [rsp + 0x2c8]
mov rbx, qword [rsp + 0x2c0]
mov eax, esi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180050540
add rsp, 0x290
pop r12
pop rsi
pop rbp
ret
Function at 0x18000a040
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push rbp
push rsi
push r12
sub rsp, 0x50
mov r12d, ecx
xor ebp, ebp
xor edx, edx
lea ecx, [rbp + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
test rax, rax
jne 0x18000a06b
xor eax, eax
add rsp, 0x50
pop r12
pop rsi
pop rbp
ret
lea rdx, [rsp + 0x30]
mov rcx, rax
mov dword [rsp + 0x30], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x18000a060
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x88], rdi
cmp dword [rsp + 0x3c], r12d
jne 0x18000a139
mov ebx, dword [rsp + 0x38]
lea rcx, [0x1800809b0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x18000a139
lea rdx, str.NtQueryInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x18000a139
xor edx, edx
mov r8d, ebx
lea ecx, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_OpenThread]
test rax, rax
je 0x18000a139
lea rcx, [rsp + 0x78]
mov r9d, 8
lea r8, [rsp + 0x80]
mov qword [rsp + 0x20], rcx
lea edx, [r9 + 1]
mov rcx, rax
mov qword [rsp + 0x80], rbp
mov dword [rsp + 0x78], ebp
call rdi
test eax, eax
jne 0x18000a139
cmp dword [rsp + 0x80], 0x41d050
jne 0x18000a139
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
jne 0x18000a150
lea rdx, [rsp + 0x30]
mov rcx, rsi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x18000a091
jmp 0x18000a167
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, 1
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x70]
mov eax, ebp
add rsp, 0x50
pop r12
pop rsi
pop rbp
ret
Function at 0x18000b2e0
Capabilities:
Get file version info

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x2f0
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
lea esi, [r8 + 1]
mov r12, rcx
mov rbx, rdx
mov ecx, esi
mov ebp, esi
call fcn.18004f9f8
mov rdi, rax
test rax, rax
jne 0x18000b322
xor eax, eax
jmp 0x18000b4ae
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.180055310
mov r9d, esi
xor r8d, r8d
mov rdx, r12
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call sub.VERSION.dll_GetFileVersionInfoExW
test eax, eax
je 0x18000b31b
mov rax, qword [str.VarFileInfoTranslation]
lea rcx, [rsp + 0x50]
xor esi, esi
mov qword [rcx], rax
mov rax, qword [0x180080928]
lea r9, [rsp + 0x30]
mov qword [rcx + 8], rax
mov rax, qword [0x180080930]
lea r8, [rsp + 0x38]
mov qword [rcx + 0x10], rax
mov rax, qword [0x180080938]
lea rdx, [rsp + 0x50]
mov qword [rcx + 0x18], rax
mov rax, qword [0x180080940]
mov qword [rsp + 0x38], rsi
mov qword [rcx + 0x20], rax
mov rax, qword [0x180080948]
mov dword [rsp + 0x30], esi
mov qword [rcx + 0x28], rax
movzx eax, word [0x180080950]
mov word [rcx + 0x30], ax
xor eax, eax
mov rcx, rdi
mov qword [rsp + 0x82], rax
mov qword [rsp + 0x8a], rax
mov qword [rsp + 0x92], rax
mov qword [rsp + 0x9a], rax
mov qword [rsp + 0xa2], rax
mov qword [rsp + 0xaa], rax
mov qword [rsp + 0xb2], rax
mov qword [rsp + 0xba], rax
mov qword [rsp + 0xc2], rax
mov dword [rsp + 0xca], eax
mov word [rsp + 0xce], ax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x18000b31b
lea rcx, [rsp + 0xd2]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0xd0], si
call fcn.180055310
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x34], esi
movzx r9d, word [rax + 2]
movzx r8d, word [rax]
lea rdx, str.StringFileInfo_04x_04xProductVersion
lea rcx, [rsp + 0xd0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0xd0]
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x18000b31b
mov rcx, qword [rsp + 0x40]
sub rbx, rcx
nop
movzx eax, word [rcx]
add rcx, 2
mov word [rbx + rcx - 2], ax
test ax, ax
jne 0x18000b490
mov rcx, rdi
call fcn.1800515dc
mov eax, 1
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.180050540
add rsp, 0x2f0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000b6d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x18000b703
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x18000b747
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x18000b742
cmp rbx, r11
jae 0x18000b747
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x18000b730
cmp rbx, r11
jb 0x18000b74b
xor eax, eax
jmp 0x18000b757
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18000b9b0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
sub rsp, 0x20
mov rdi, rdx
xor r12d, r12d
mov ebx, 0x4000
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rbp, rax
test rax, rax
je 0x18000ba53
mov qword [rsp + 0x40], rsi
mov esi, dword [rsp + 0x48]
nop
mov r8d, ebx
mov edx, 8
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rdi], rax
test rax, rax
je 0x18000ba2e
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
lea ecx, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_ZwQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
jne 0x18000ba4c
mov r8, qword [rdi]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov qword [rdi], r12
add ebx, 0x4000
jmp 0x18000b9e0
cmp esi, 0xc0000004
je 0x18000b9e0
mov eax, r12d
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
mov eax, 1
jmp 0x18000ba39
mov eax, r12d
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret

Function at 0x18000bc60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x30
mov rbp, r8
xor r8d, r8d
xor ebx, ebx
call fcn.18000bb90
mov rdi, rax
test rax, rax
je 0x18000bd26
lea rcx, [0x1800a2ba0]
xor edx, edx
mov r8d, 0x100
mov qword [rsp + 0x40], rsi
mov qword [0x1800a2868], rax
call fcn.180055310
lea r8, [0x18000bc10]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea edx, [rbx + 0x32]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x18000bd09
cmp dword [0x1800a2864], ebx
jne 0x18000bd09
cmp word [0x1800a2ba0], bx
jbe 0x18000bd0f
lea r8, [0x1800a2ba0]
lea rdx, [0x1800809e0]
mov rcx, rbp
call fcn.18000b6a0
mov ebx, 1
jmp 0x18000bd0f
mov dword [0x1800a2864], ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_ZwClose]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18000c3b0
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rdi
sub rsp, 0x40
xor eax, eax
mov rdi, rcx
lea r9, [r11 + 8]
mov dword [rsp + 0x38], eax
mov qword [r11 - 0x18], rax
lea rax, [r11 + 0x10]
mov qword [r11 - 0x20], rax
lea rax, [r11 + 0x18]
lea rcx, [0x1800809f0]
xor r8d, r8d
xor edx, edx
mov qword [r11 - 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [rsp + 0x50]
mov edx, 0xaacd2aec
test eax, eax
mov eax, 0xba2e8ba3
cmove ecx, edx
mov dword [rsp + 0x50], ecx
mul ecx
shr edx, 6
mov rcx, rdi
mov r8d, edx
lea rdx, str._08X
call fcn.18005151c
mov r8, rdi
movsxd rbx, eax
add rbx, rdi
lea rdx, [rbx - 1]
test rdi, rdi
je 0x18000c458
cmp rdi, rdx
jae 0x18000c458
nop word [rax + rax]
movzx eax, byte [rdx]
movzx ecx, byte [r8]
dec rdx
mov byte [r8], al
mov byte [rdx + 1], cl
inc r8
cmp r8, rdx
jb 0x18000c440
lea r8, [0x1800809f4]
lea rdx, [0x1800809f8]
mov rcx, rbx
call fcn.18005151c
lea rdx, str._04X
movsxd rcx, eax
mov eax, dword [rsp + 0x50]
shr eax, 4
add rbx, rcx
movzx r8d, ax
mov rcx, rbx
call fcn.18005151c
lea r8, [0x1800809f4]
lea rdx, [0x1800809f8]
movsxd rcx, eax
add rbx, rcx
mov rcx, rbx
call fcn.18005151c
mov r8d, dword [rsp + 0x50]
lea rdx, str._04X
movsxd rcx, eax
shr r8d, 0x14
add rbx, rcx
mov rcx, rbx
call fcn.18005151c
lea r8, [0x1800809f4]
lea rdx, [0x1800809f8]
movsxd rcx, eax
add rbx, rcx
mov rcx, rbx
call fcn.18005151c
mov r8d, dword [rsp + 0x50]
lea rdx, str._04X
movsxd rcx, eax
shr r8d, 0x15
add rbx, rcx
mov rcx, rbx
call fcn.18005151c
lea r8, [0x1800809f4]
lea rdx, [0x1800809f8]
movsxd rcx, eax
add rbx, rcx
mov rcx, rbx
call fcn.18005151c
mov r8d, dword [rsp + 0x50]
lea rdx, str._08X
movsxd rcx, eax
shl r8d, 6
add rbx, rcx
mov rcx, rbx
call fcn.18005151c
lea rdx, str._04X
movsxd rcx, eax
mov eax, dword [rsp + 0x50]
shr eax, 5
add rbx, rcx
movzx r8d, ax
mov rcx, rbx
call fcn.18005151c
lea r8, [rdi + 9]
lea rdx, str._.18s
movsxd rcx, eax
add rbx, rcx
mov rcx, rbx
call fcn.18005151c
lea rdx, [rbx + 0x11]
test rbx, rbx
je 0x18000c5a6
cmp rbx, rdx
jae 0x18000c5a6
nop word [rax + rax]
movzx eax, byte [rdx]
movzx ecx, byte [rbx]
dec rdx
mov byte [rbx], al
mov byte [rdx + 1], cl
inc rbx
cmp rbx, rdx
jb 0x18000c590
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18000c5c0
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x270
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov ebx, ecx
cmp ecx, 4
ja 0x18000c5ff
mov eax, 1
jmp 0x18000c7bc
mov byte [rsp + 0x40], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x41]
call fcn.180055310
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x18000c7ba
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.18000c9f0
nop
mov rbx, qword [rsp + 0x28]
cmp dword [rbx - 0x10], 0
je 0x18000c79f
lea rdx, str.system
mov rcx, rbx
call fcn.180051fdc
test eax, eax
jne 0x18000c79f
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x40]
call fcn.180055310
mov r9d, 0x104
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rsi
call sub.PSAPI.DLL_GetModuleFileNameExA
mov edi, eax
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test edi, edi
jne 0x18000c6ea
cmp dword [rsp + 0x20], edi
jne 0x18000c6ea
mov dword [rsp + 0x24], 0x800
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.QueryFullProcessImageNameA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000c6ea
lea r9, [rsp + 0x24]
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rsi
call rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x18000c77d
mov byte [rsp + 0x150], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x151]
call fcn.180055310
lea rcx, [0x180080a48]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x18000c741
mov r8, rax
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x40]
call fcn.18000cdc0
lea rdx, str.Microsoft
lea rcx, [rsp + 0x150]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x18000c79f
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000c776
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov eax, 1
jmp 0x18000c7bc
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000c798
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov eax, 1
jmp 0x18000c7bc
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000c7ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180050540
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18000c7f0
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x270
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov ebx, ecx
cmp ecx, 4
ja 0x18000c82f
mov eax, 1
jmp 0x18000c9c6
mov byte [rsp + 0x40], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x41]
call fcn.180055310
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x18000c9c1
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.18000c9f0
nop
mov rbx, qword [rsp + 0x28]
cmp dword [rbx - 0x10], 0
je 0x18000c9a6
lea rdx, str.Administrator
mov rcx, rbx
call fcn.180051fdc
test eax, eax
jne 0x18000c9a6
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x40]
call fcn.180055310
mov r9d, 0x104
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rsi
call sub.PSAPI.DLL_GetModuleFileNameExA
mov edi, eax
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test edi, edi
jne 0x18000c91a
cmp dword [rsp + 0x20], edi
jne 0x18000c91a
mov dword [rsp + 0x24], 0x800
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.QueryFullProcessImageNameA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000c91a
lea r9, [rsp + 0x24]
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rsi
call rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x18000c9a6
mov byte [rsp + 0x150], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x151]
call fcn.180055310
lea rcx, [0x180080a48]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x18000c96d
mov r8, rax
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x40]
call fcn.18000cdc0
lea rdx, str.Microsoft
lea rcx, [rsp + 0x150]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x18000c9a6
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000c9a2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor eax, eax
jmp 0x18000c9c6
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000c9c1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov eax, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180050540
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18000f1b0
Capabilities:
Modify service

Disassembly:
sub rsp, 0x68
lea rcx, [0x180080e54]
call fcn.18000f2d0
cmp eax, 4
jne 0x18000f2c8
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov qword [rsp + 0x70], rbx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
jne 0x18000f1f6
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x180080e54]
mov r8d, 2
mov rcx, rax
mov qword [rsp + 0x60], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
jne 0x18000f237
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
jmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rax
mov qword [rsp + 0x78], rsi
call qword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
xor ecx, ecx
or r9d, 0xffffffff
mov qword [rsp + 0x50], rcx
mov rsi, rax
lea rax, [0x180080e8c]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
lea r8d, [rcx + 2]
mov qword [rsp + 0x20], rcx
or edx, r9d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x18000f292
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [0x180080e54]
call fcn.180023100
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x18000f2d0
Capabilities:
Query service configuration

Disassembly:
push rdi
sub rsp, 0x40
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
jne 0x18000f2fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xffffffff
add rsp, 0x40
pop rdi
ret
lea rdx, [0x180080e54]
mov r8d, 1
mov rcx, rax
mov qword [rsp + 0x38], rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x18000f33d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x38]
or eax, 0xffffffff
add rsp, 0x40
pop rdi
ret
lea r9, [rsp + 0x58]
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbp
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x18000f37d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x18000f3a4
mov ebx, dword [rsp + 0x58]
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
jmp 0x18000f386
mov ebx, dword [rsp + 0x58]
mov rbp, qword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov r8d, ebx
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x18000f3be
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
or eax, 0xffffffff
jmp 0x18000f475
xor r9d, r9d
lea rax, [rsp + 0x58]
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, rsi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfig2A]
test eax, eax
jne 0x18000f403
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x18000f430
mov ebx, dword [rsp + 0x58]
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r12, rax
jmp 0x18000f408
mov r12, qword [rsp + 0x58]
lea rax, [rsp + 0x58]
mov r9d, ebx
mov r8, r12
mov edx, 1
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfig2A]
test eax, eax
jne 0x18000f447
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
or eax, 0xffffffff
jmp 0x18000f470
mov ebx, dword [rbp + 4]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov r12, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x38]
add rsp, 0x40
pop rdi
ret