joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14034a288
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbp, qword [rsp + 0x70]
mov r12, r8
and dword [rsp + 0x50], 0
mov r15d, edx
movsxd rdi, r9d
mov r14, rcx
and dword [rbp], 0
test rcx, rcx
je 0x14034a370
lea eax, [rdi - 1]
mov r10d, 0xd
movsxd r9, eax
test eax, eax
js 0x14034a2e9
movsx ecx, byte [r9 + r8]
lea eax, [r10*8]
xor ecx, eax
xor r10d, ecx
sub r9, 1
jns 0x14034a2d1
lea esi, [r10*8]
mov eax, r10d
xor rsi, rdx
xor rsi, rax
and esi, 0x1ff
mov rbx, qword [r14 + rsi*8]
test rbx, rbx
je 0x14034a335
cmp dword [rbx + 0xc], r15d
jne 0x14034a326
cmp dword [rbx + 8], edi
jne 0x14034a326
mov rcx, qword [rbx]
mov r8, rdi
mov rdx, r12
call fcn.14038aeb0
test eax, eax
je 0x14034a32c
mov rbx, qword [rbx + 0x10]
jmp 0x14034a304
mov dword [rbp], 1
jmp 0x14034a370
lea rdx, [rdi + 0x18]
lea rcx, [rsp + 0x50]
call fcn.14034848c
mov rbx, rax
test rax, rax
je 0x14034a370
lea rcx, [rax + 0x18]
mov dword [rax + 8], edi
mov r8, rdi
mov qword [rax], rcx
mov rdx, r12
mov dword [rax + 0xc], r15d
call fcn.14038a820
mov rcx, qword [r14 + rsi*8]
mov qword [rbx + 0x10], rcx
mov qword [r14 + rsi*8], rbx
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x14034a84c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r10d, edx
mov r8d, ecx
cmp ecx, 0x80
jge 0x14034a87e
lea eax, [rcx - 0x41]
add ecx, 0x20
cmp eax, 0x19
cmova ecx, r8d
mov r8d, ecx
jmp 0x14034a941
cmp r8d, 0x10000
jge 0x14034a932
xor r9d, r9d
lea rsi, [0x140000000]
mov edi, r9d
or r11d, 0xffffffff
mov ebx, 0xa2
lea eax, [rdi + rbx]
cdq
sub eax, edx
mov edx, r8d
sar eax, 1
movsxd rcx, eax
movzx ecx, word [rsi + rcx*4 + 0x4db1d0]
sub edx, ecx
mov ecx, eax
cmovs ecx, r11d
test edx, edx
movsxd r11, ecx
lea ecx, [rax + 1]
cmovs ecx, edi
dec eax
test edx, edx
mov edi, ecx
cmovs ebx, eax
cmp ebx, ecx
jge 0x14034a8a1
movzx ecx, word [rsi + r11*4 + 0x4db1d0]
movzx eax, byte [rsi + r11*4 + 0x4db1d3]
add eax, ecx
cmp r8d, eax
jge 0x14034a915
movzx eax, byte [rsi + r11*4 + 0x4db1d2]
xor ecx, r8d
and ecx, eax
test cl, 1
jne 0x14034a915
shr rax, 1
movzx eax, word [rsi + rax*2 + 0x4db460]
add eax, r8d
movzx r8d, ax
test r10d, r10d
je 0x14034a941
cmp r10d, 2
mov ecx, r8d
sete r9b
mov edx, r9d
call fcn.140313f7c
mov r8d, eax
jmp 0x14034a941
lea eax, [rcx - 0x10400]
cmp eax, 0x27
ja 0x14034a941
add r8d, 0x28
mov rbx, qword [rsp + 0x30]
mov eax, r8d
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14037a8ec
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov rsi, rcx
mov qword [rcx], rbx
mov rbp, r8
mov r14, rdx
lea ecx, [rbx + 0x28]
call fcn.140350d44
mov rdi, rax
test rax, rax
jne 0x14037a928
lea ebx, [rax + 7]
jmp 0x14037a9a2
cmp byte [0x1404f7ea4], bl
je 0x14037a978
mov rax, qword [0x1404f8030]
test rax, rax
je 0x14037a947
mov ecx, 0xc8
call rax
test eax, eax
jne 0x14037a978
lea rax, [rdi + 8]
mov qword [rdi + 0x10], r14
mov qword [rsp + 0x28], rax
lea r8, [0x14035db24]
mov r9, rdi
mov dword [rsp + 0x20], ebx
xor edx, edx
mov qword [rdi + 0x18], rbp
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
jne 0x14037a986
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 0x28]
call fcn.14038afb0
cmp qword [rdi + 0x10], rbx
jne 0x14037a99f
call qword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov rcx, rbp
mov dword [rdi + 8], eax
call r14
mov qword [rdi + 0x20], rax
mov qword [rsi], rdi
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1403863e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
movsxd r9, dword [rcx + 0xc]
mov r10, rcx
movsxd rbx, r8d
test r8d, r8d
jle 0x14038642e
mov r11, r9
xor edi, edi
mov al, byte [rdi + rdx]
mov rcx, qword [r10]
xor byte [rcx + r11], al
lea ecx, [r9 + 1]
xor r9d, r9d
lea rax, [r11 + 1]
cmp ecx, dword [r10 + 8]
cmovl r9d, ecx
xor r11d, r11d
inc rdi
cmp ecx, dword [r10 + 8]
cmovl r11, rax
cmp rdi, rbx
jl 0x1403863fe
add dword [r10 + 0x10], r8d
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov dword [r10 + 0xc], r9d
ret
Function at 0x140007cc0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov edi, 0x80004005
lea rcx, [rsp + 0x30]
call fcn.140002ef0
nop
xor esi, esi
mov ebx, esi
cmp qword [rsp + 0x30], rbx
je 0x140007d4e
mov ecx, 0xd0
call fcn.14001f7ec
mov qword [rsp + 0x290], rax
test rax, rax
je 0x140007d11
mov rcx, rax
call fcn.1400072e0
mov rbx, rax
jmp 0x140007d14
mov rbx, rsi
test rbx, rbx
je 0x140007d4e
mov rcx, rbx
call fcn.140007920
mov edi, eax
test eax, eax
js 0x140007d4e
lfence
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x140007f40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0xb8], rax
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140007d65
lock inc dword [rax + 8]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140003060
test edi, edi
jns 0x140007ed6
test rbx, rbx
je 0x140007ed6
mov dword [rbx], 1
cmp qword [rbx + 8], 0
je 0x140007da5
lfence
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp qword [rbx + 0xb8], 0
je 0x140007dc6
lfence
mov rcx, qword [rbx + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0xb8], rsi
cmp qword [rbx + 0x28], 0
je 0x140007e70
lfence
xor eax, eax
mov qword [rsp + 0x54], rax
mov dword [rsp + 0x6c], eax
xor edx, edx
mov r8d, 0x1fb
lea rcx, [rsp + 0x84]
call fcn.140021ae0
mov dword [rsp + 0x50], 7
mov dword [rsp + 0x5c], esi
mov rax, qword [rbx + 8]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x3000
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x70], rax
mov rax, qword [rbx + 0x38]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x80], 0x1000
mov dword [rsp + 0x28], reloc.OLEAUT32.dll_SafeArrayAccessData
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, 0x22f
lea rdx, [rsp + 0x50]
mov rcx, qword [rbx + 0x28]
call fcn.140003470
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x40], rsi
cmp qword [rbx + 0x20], 0
je 0x140007e70
lfence
mov rcx, qword [rbx + 0x20]
call fcn.140026d74
mov qword [rbx + 0x20], rsi
cmp qword [rbx + 0x10], 0
je 0x140007e88
lfence
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rsi
cmp qword [rbx + 8], 0
je 0x140007ea0
lfence
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], rsi
cmp qword [rbx + 0x38], 0
je 0x140007eb8
lfence
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x38], rsi
lfence
mov rcx, rbx
call fcn.140007510
lfence
mov edx, 0xd0
mov rcx, rbx
call fcn.14001f828
mov rbx, rsi
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x140007f1a
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140007f1a
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax]
call qword [0x1400365e0]
lock xadd dword [rdi + 0xc], esi
cmp esi, 1
jne 0x140007f1a
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [0x1400365e0]
mov rax, rbx
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400080f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0xc8]
sub rsp, 0x1c8
mov rax, qword [0x14004d0e8]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rbx, rdx
mov edi, ecx
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x104
call fcn.140021ae0
lea rsi, [rbp + 0x100]
call fcn.1400083e0
mov qword [rsp + 0x28], rsi
lea rdx, [rbp - 0x60]
xor esi, esi
mov r9, rbx
mov r8d, 0x104
mov qword [rsp + 0x20], rsi
mov rcx, qword [rax]
call fcn.140028bfc
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test byte [0x14004e8c6], 0x20
je 0x140008230
xorps xmm0, xmm0
mov dword [rsp + 0x40], esi
lea rax, [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x60], rax
lea rcx, [rbp - 0x60]
lea rax, [rsp + 0x38]
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x70], rax
mov rax, 0xffffffffffffffff
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], edi
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rbp - 0x80], xmm0
movaps xmmword [rbp - 0x70], xmm0
mov qword [rsp + 0x68], 4
mov qword [rsp + 0x78], 4
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], sil
jne 0x1400081e0
inc eax
mov dword [rbp - 0x74], esi
mov dword [rbp - 0x78], eax
lea rcx, [rbp - 0x60]
lea rax, [rsp + 0x40]
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x70], rax
lea rdx, [0x140036b40]
lea rax, [rsp + 0x50]
mov qword [rbp - 0x68], 4
mov r9d, 5
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rcx, [section..data]
call fcn.140002c50
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.14001f8c0
add rsp, 0x1c8
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000deb0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x10]
mov rbx, rcx
mov edi, 0x80008003
cmp dword [rcx + 0x30], eax
jbe 0x14000dee5
lea rdx, str.Length_of_Message_write_to_MEI_should_be_shorter_than_m_MTU
xor ecx, ecx
call fcn.1400080f0
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp qword [rcx + 0x40], 0xffffffffffffffff
jne 0x14000df07
lea rdx, str.Invalid_Device_Handle
xor ecx, ecx
call fcn.1400080f0
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rcx + 0x38]
mov edx, 0x4e20
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000df38
lea rdx, str.HECI_lock_timeout
xor ecx, ecx
call fcn.1400080f0
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test eax, eax
je 0x14000df60
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_attain_global_heci_mutex__last_error__d
xor ecx, ecx
mov r8d, eax
call fcn.1400080f0
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8d, dword [rbx + 0x30]
lea r9, [rsp + 0x40]
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000dfde
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x14000dfde
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Write_file_error__last_error__d
xor ecx, ecx
mov r8d, eax
call fcn.1400080f0
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x14000e0a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_release_global_heci_mutex__last_error__d
xor ecx, ecx
mov r8d, eax
call fcn.1400080f0
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8d, dword [rsp + 0x40]
lea rdx, str.message_size_write_to_MEI_is__d
xor ecx, ecx
call fcn.1400080f0
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x40]
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000e05e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Read_file_error__last_error__d
xor ecx, ecx
mov r8d, eax
call fcn.1400080f0
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x14000e0a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_release_global_heci_mutex__last_error__d
xor ecx, ecx
mov r8d, eax
call fcn.1400080f0
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
je 0x14000dfba
mov r8d, dword [rsp + 0x40]
xor ecx, ecx
mov dword [rbx + 0x30], r8d
cmp r8d, dword [rbx + 0x10]
jbe 0x14000e09a
lea rdx, str.Length_of_Message_read_from_MEI_should_be_shorter_than_m_MTU
call fcn.1400080f0
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rdx, str.message_size_read_from_MEI_is__d
call fcn.1400080f0
xor edi, edi
mov rbx, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x14000e9d0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx], 0x50564150
mov rdi, rdx
mov rbx, rcx
je 0x14000e9f6
lea rdx, str.Unexpected_packet_Sig
xor ecx, ecx
call fcn.1400080f0
mov eax, 0x100
cmp word [rbx + 4], ax
je 0x14000ea0f
lea rdx, str.Unexpected_packet_Ver
xor ecx, ecx
call fcn.1400080f0
mov ecx, dword [rbx + 0x10]
lea rax, [rdi - 0x14]
cmp rcx, rax
je 0x14000ea29
lea rdx, str.Unexpected_packet_DataLen
xor ecx, ecx
call fcn.1400080f0
mov r8d, dword [rbx + 0xc]
cmp r8d, 6
ja case.default.0x14000ea49
lea rdx, [0x140000000]
mov ecx, dword [rdx + r8*4 + 0xeaf4]
add rcx, rdx
jmp rcx
lea rdx, str.Invalid_packet_status:_CHS_STATUS_MAX_MESSAGE_LENGTH_EXCEEDED
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400080f0
lea rdx, str.Invalid_packet_status:_CHS_STATUS_UNSPEC_ERROR
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400080f0
lea rdx, str.Invalid_packet_status:_CHS_STATUS_CONN_FAILED
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400080f0
lea rdx, str.Invalid_packet_status:_CHS_STATUS_COMM_FAILED
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400080f0
lea rdx, str.Invalid_packet_status:_CHS_STATUS_NOT_CONNECTED
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400080f0
lea rdx, str.Invalid_packet_status:_CHS_STATUS_HECI_NOT_READY
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400080f0
lea rdx, str.Unsupported_packet_status___d
xor ecx, ecx
call fcn.1400080f0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000eb60
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x58
cmp byte [0x14004e8cc], 0
je 0x14000eb77
mov eax, 0xffffffff
add rsp, 0x58
ret
mov qword [rsp + 0x50], rbx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
lea r8, [rsp + 0x20]
lea rcx, [0x14004e940]
call fcn.14000ee40
cmp al, 1
jne 0x14000ec5a
lea rdx, str.Start__
xor ecx, ecx
call fcn.1400080f0
call fcn.14001d9d0
cmp byte [rax], bl
je 0x14000ec45
call fcn.14001d9d0
cmp byte [rax + 0x70], bl
je 0x14000ec45
call fcn.14001d9d0
cmp byte [rax + 0x30], bl
je 0x14000ec45
call fcn.14001d9d0
cmp byte [rax + 0x80], bl
je 0x14000ec45
call fcn.14001d9d0
cmp byte [rax + 0x90], bl
je 0x14000ec45
call fcn.14001d9d0
cmp byte [rax + 0xa0], bl
je 0x14000ec45
lea rax, [0x14004e9a8]
mov dword [0x14004ebcc], 1
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
lea rax, [0x140011520]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x14000ec5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x14004ebbc], eax
mov ebx, eax
jmp 0x14000ec5e
lea rdx, str.One_or_more_required_APIs_are_not_available__service_will_exit.
xor ecx, ecx
call fcn.1400080f0
mov ebx, 0x80070032
jmp 0x14000ec5e
mov ebx, dword [rsp + 0x20]
cmp dword [0x14004ebcc], 0
jne 0x14000ec76
cmp byte [0x14004e9a2], 0
je 0x14000ec76
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret
Function at 0x14000f4e0
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x28c], 0
mov rbx, rcx
je 0x14000f680
mov qword [rsp + 0x48], rsi
lea rdx, str.SeDebugPrivilege
mov qword [rsp + 0x50], r14
call fcn.14000f830
lea rdx, str.SeImpersonatePrivilege
mov rcx, rbx
call fcn.14000f830
lea rdx, str.SeTcbPrivilege
mov rcx, rbx
call fcn.14000f830
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movzx edx, byte [rbx + 0x299]
movzx ecx, byte [rbx + 0x298]
mov dword [rbx + 0x290], eax
call fcn.14001a640
test rax, rax
jne 0x14000f567
lea rdx, str.pSecureChannelMELSPCON_is_NULL
xor ecx, ecx
mov edi, 0x8007000e
call fcn.1400080f0
jmp 0x14000f58b
xor edx, edx
mov rcx, rax
call fcn.14001a7c0
mov edi, eax
test eax, eax
jns 0x14000f5a1
lfence
mov r8d, eax
lea rdx, str.PerformInitSession__EstablishSecureChannel___failed_hr:0x_x
xor ecx, ecx
call fcn.1400080f0
lfence
mov r8d, edi
lea rdx, str.PerformInitSession_Failed:_0x_x___continue_with_service_bootup
xor ecx, ecx
call fcn.1400080f0
xor edi, edi
lea rcx, [rsp + 0x20]
call fcn.140002ef0
mov rcx, qword [rsp + 0x20]
call fcn.140003ca0
mov rsi, qword [rsp + 0x28]
test eax, eax
setne r14b
test rsi, rsi
je 0x14000f609
mov qword [rsp + 0x40], rbp
mov ebp, 0xffffffff
mov eax, ebp
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x14000f604
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax]
call qword [0x1400365e0]
lock xadd dword [rsi + 0xc], ebp
cmp ebp, 1
jne 0x14000f604
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 8]
call qword [0x1400365e0]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
test r14b, r14b
mov r14, qword [rsp + 0x50]
jne 0x14000f62b
lea rdx, str.Intel_IGFX_adaptor_is_not_present_stop_service_bootup
xor ecx, ecx
call fcn.1400080f0
mov edi, 0x80004005
mov r8d, edi
lea rdx, str.CoInitializeSecurity___Done:_0x_x
xor ecx, ecx
call fcn.1400080f0
xor edx, edx
xor ecx, ecx
call fcn.14001f828
xor ecx, ecx
call fcn.140026d74
xor ecx, ecx
call fcn.140026d74
xor ecx, ecx
call fcn.140026d74
xor ecx, ecx
call fcn.140026d74
test edi, edi
jns 0x14000f680
lea rdx, str.InitializeSecurity_failed
xor ecx, ecx
call fcn.1400080f0
mov eax, edi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
cmp dword [rbx + 0x28c], 0
je 0x14000f6b6
lea rdx, str.PreMessageLoop:_Service_started_resumed
xor ecx, ecx
call fcn.1400080f0
mov eax, 4
lea rdx, [rbx + 0x270]
xchg dword [rbx + 0x274], eax
mov rcx, qword [rbx + 0x268]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rcx, rbx
call fcn.14000fe40
test eax, eax
jns 0x14000f6d8
lfence
mov r8d, eax
lea rdx, str.RegisterDisplayDeviceNotification_failed_hr:_0x_x
xor ecx, ecx
call fcn.1400080f0
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140010c20
Capabilities:
Create service

Disassembly:
push rdi
sub rsp, 0xa90
mov rax, qword [0x14004d0e8]
xor rax, rsp
mov qword [rsp + 0xa80], rax
mov rdi, rcx
call fcn.140010ea0
test eax, eax
je 0x140010c51
mov eax, 1
jmp 0x140010d58
mov r8d, 0x104
lea rdx, [rsp + 0x72]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140010e4e
cmp eax, 0x104
je 0x140010e4e
lea ecx, [rax + 1]
mov r8d, 0x22
mov word [rsp + 0x70], r8w
mov word [rsp + rcx*2 + 0x70], r8w
lea ecx, [rax + 2]
add rcx, rcx
cmp rcx, 0x20c
jae 0x140010e97
mov qword [rsp + 0xaa8], rbx
xor edx, edx
mov qword [rsp + 0xab0], rsi
mov r8d, 0xf003f
xor esi, esi
mov word [rsp + rcx + 0x70], si
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140010d71
mov r8d, 0x400
lea rdx, [rsp + 0x280]
mov ecx, 0xd80a
call fcn.140010b00
test eax, eax
jne 0x140010d2f
lea r8, str.Could_not_open_Service_Manager
mov edx, 0x400
lea rcx, [rsp + 0x280]
call fcn.140028d10
test eax, eax
je 0x140010d2f
cmp eax, 0xc
je 0x140010e6b
cmp eax, 0x16
je 0x140010e60
cmp eax, 0x22
je 0x140010e60
cmp eax, 0x50
jne 0x140010e55
lea r8, [rdi + 0x68]
xor r9d, r9d
lea rdx, [rsp + 0x280]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rbx, qword [rsp + 0xaa8]
mov rsi, qword [rsp + 0xab0]
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.14001f8c0
add rsp, 0xa90
pop rdi
ret
mov qword [rsp + 0x60], rsi
lea rax, str.RPCSS
mov qword [rsp + 0x58], rsi
add rdi, 0x68
mov qword [rsp + 0x50], rax
mov r9d, 0xf01ff
mov qword [rsp + 0x48], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rsi
mov r8, rdi
mov qword [rsp + 0x38], rax
mov rdx, rdi
mov dword [rsp + 0x30], 1
mov rcx, rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x140010e32
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r8d, 0x400
lea rdx, [rsp + 0x280]
mov ecx, 0xd80b
call fcn.140010b00
test eax, eax
jne 0x140010e27
lea r8, str.Could_not_start_service
mov edx, 0x400
lea rcx, [rsp + 0x280]
call fcn.140028d10
test eax, eax
je 0x140010e27
cmp eax, 0xc
je 0x140010e8c
cmp eax, 0x16
je 0x140010e81
cmp eax, 0x22
je 0x140010e81
cmp eax, 0x50
jne 0x140010e76
xor r9d, r9d
mov r8, rdi
jmp 0x140010d36
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x140010d48
xor eax, eax
jmp 0x140010d58
mov ecx, 0x80004005
call fcn.14000d480
int3
mov ecx, 0x80070057
call fcn.14000d480
int3
mov ecx, 0x8007000e
call fcn.14000d480
int3
mov ecx, 0x80004005
call fcn.14000d480
int3
mov ecx, 0x80070057
call fcn.14000d480
int3
mov ecx, 0x8007000e
call fcn.14000d480
int3
call fcn.140020094
int3
Function at 0x140015ed0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x140015f89
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x140015f55
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x140015f6d
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x140015f6d
mov rdx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call qword [0x1400365e0]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp dword [rdi + 8], 0
je case.default.0x140015f6d
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp byte [0x14004ec38], 0
jne 0x140015fd4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140015fc4
lea rdx, [0x14003a228]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14004ec30], rax
mov byte [0x14004ec38], 1
jmp 0x140015fdb
mov rax, qword [0x14004ec30]
mov byte [0x14004ec38], 1
jmp 0x140015fdb
mov rax, qword [0x14004ec30]
mov rcx, qword [rbx]
mov rdx, rsi
test rax, rax
je 0x140015f5e
mov r8d, dword [rbx + 8]
xor r9d, r9d
call qword [0x1400365e0]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
invalid
jg 0x14008288b
push rax
xlatb
fidivr dword [rbp - 0x25]
sti
invalid