joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003220
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, [0x180018ce8]
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.180007d44
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180003270
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.180009520
lea r8, [0x180018cf0]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.180007d68
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.180007c00
add rsp, 0x438
ret

Function at 0x180003c20
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, [0x180018ce8]
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.180007d44
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180003c70
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.180009520
lea r8, [0x180018cf0]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.180007d68
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.180007c00
add rsp, 0x438
ret
Function at 0x180003cf0
Capabilities:
Get hostname

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov r14, rcx
xor r15d, r15d
mov qword [r11 + 0x18], r15
mov dword [r11 - 0x38], r15d
xor eax, eax
mov qword [r11 - 0x30], rax
mov dword [r11 + 0x10], 0x10
mov edi, r15d
mov ebx, r15d
lea ecx, [rax + 0x20]
call fcn.180008748
mov rsi, rax
mov qword [rsp + 0xa8], rax
test rax, rax
jne 0x180003d50
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8d, eax
lea rdx, str._ELEVATE__Out_of_Memory
jmp 0x180003e6b
lea rdx, [rsp + 0x98]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x180003d7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8d, eax
lea rdx, str._ELEVATE__GetComputerNameW_failed
jmp 0x180003e6b
mov ecx, 0x208
call fcn.180008748
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x180003d38
mov ecx, 0x208
call fcn.180008748
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180003d38
mov qword [rsp + 0x20], rsi
lea r9, str._s
or r8, 0xffffffffffffffff
mov edx, 0x104
mov rcx, rdi
call fcn.180007e68
mov qword [rsp + 0x20], r14
lea r9, str.localhost_pipe__s
or r8, 0xffffffffffffffff
mov edx, 0x104
mov rcx, rbx
call fcn.180007e68
nop
mov dword [rsp + 0x20], r15d
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, [rsp + 0xa0]
mov rcx, rdi
call fcn.1800011f0
test eax, eax
jne 0x180003e3c
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov r9, rbx
xor r8d, r8d
mov edx, pe_nt_image_headers64
mov rcx, qword [rsp + 0xa0]
call fcn.180001320
lea rcx, [rsp + 0xa0]
call fcn.1800012e0
nop
jmp 0x180003e77
lea rcx, [0x180018d60]
call fcn.180003c20
test rsi, rsi
je 0x180003e84
mov rcx, rsi
call fcn.180007e28
test rdi, rdi
je 0x180003e91
mov rcx, rdi
call fcn.180007e28
test rbx, rbx
je 0x180003e9e
mov rcx, rbx
call fcn.180007e28
cmp qword [rsp + 0xa0], 0
je 0x180003eb6
lea rcx, [rsp + 0xa0]
call fcn.1800012e0
xor eax, eax
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x180004430
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, [0x180018ce8]
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.180007d44
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180004480
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.180009520
lea r8, [0x180018cf0]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.180007d68
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.180007c00
add rsp, 0x438
ret
Function at 0x180005120
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, [0x180018ce8]
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.180007d44
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180005170
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.180009520
lea r8, [0x180018cf0]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.180007d68
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.180007c00
add rsp, 0x438
ret

Function at 0x1800054c0
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1130
call fcn.180008490
sub rsp, rax
mov ebx, 0x1000
lea r8, [rsp + 0x1140]
lea rcx, [rsp + 0x130]
mov edx, ebx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x180005572
mov eax, dword [rsp + 0x1140]
cmp eax, ebx
cmova eax, ebx
xor ebx, ebx
mov dword [rsp + 0x1140], eax
test eax, 0xfffffffc
jbe 0x180005572
nop
mov r8d, dword [rsp + rbx*4 + 0x130]
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x180005562
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call sub.PSAPI.DLL_GetProcessImageFileNameA
test eax, eax
je 0x180005559
lea rdx, str.lsass.exe
lea rcx, [rsp + 0x20]
call fcn.180005450
test eax, eax
jne 0x180005585
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x1140]
inc ebx
shr eax, 2
cmp ebx, eax
jb 0x180005510
xor eax, eax
mov rbx, qword [rsp + 0x1148]
add rsp, 0x1130
pop rdi
ret
mov rax, rdi
mov rbx, qword [rsp + 0x1148]
add rsp, 0x1130
pop rdi
ret
Function at 0x1800055a0
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
sub rsp, 0x40
xor ebx, ebx
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
lea edx, [rbx + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1800055d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._PASSWD__Failed_to_open_process
jmp 0x18000563e
lea r8, [rsp + 0x34]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x1800055fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._PASSWD__Failed_to_lookup_priv_value
jmp 0x18000563e
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x3c], 2
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x180005652
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._PASSWD__Failed_to_adjust_token_privs
lea rcx, [0x180018d60]
mov r9d, eax
mov r8d, eax
mov ebx, eax
call fcn.180005120
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x180005662
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x180006790
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, [0x180018ce8]
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.180007d44
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1800067e0
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.180009520
lea r8, [0x180018cf0]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.180007d68
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.180007c00
add rsp, 0x438
ret

Function at 0x180006860
Capabilities:
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
jne 0x180006897
mov ebx, 6
lea rdx, str._SERVICE__service_start._cpName_is_NULL
lea rcx, [0x180018d60]
mov r9d, ebx
mov r8d, ebx
call fcn.180006790
jmp 0x180006961
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov qword [rsp + 0x30], rsi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
jne 0x1800068da
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._SERVICE__service_start._OpenSCManagerA_failed
lea rcx, [0x180018d60]
mov r9d, eax
mov r8d, eax
mov ebx, eax
call fcn.180006790
jmp 0x18000695c
mov r8d, 0x10
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
jne 0x180006917
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._SERVICE__service_start._OpenServiceA_failed
lea rcx, [0x180018d60]
mov r9d, eax
mov r8d, eax
mov ebx, eax
call fcn.180006790
jmp 0x180006953
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x18000694a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._SERVICE__service_start._StartService_failed
lea rcx, [0x180018d60]
mov r9d, eax
mov r8d, eax
mov ebx, eax
call fcn.180006790
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x30]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180006980
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
xor eax, eax
xor ebx, ebx
mov rdi, rcx
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x24], rax
mov qword [rsp + 0x2c], rax
mov qword [rsp + 0x34], rax
mov qword [rsp + 0x3c], rax
test rcx, rcx
jne 0x1800069d1
mov ebx, 6
lea rdx, str._SERVICE__service_stop._cpName_is_NULL
lea rcx, [0x180018d60]
mov r9d, ebx
mov r8d, ebx
call fcn.180006790
jmp 0x180006ad0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov qword [rsp + 0x68], rsi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
jne 0x180006a14
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._SERVICE__service_stop._OpenSCManagerA_failed
lea rcx, [0x180018d60]
mov r9d, eax
mov r8d, eax
mov ebx, eax
call fcn.180006790
jmp 0x180006acb
mov r8d, 0x24
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x60], rbp
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbp, rax
test rax, rax
jne 0x180006a56
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._SERVICE__service_stop._OpenServiceA_failed
lea rcx, [0x180018d60]
mov r9d, eax
mov r8d, eax
mov ebx, eax
call fcn.180006790
jmp 0x180006abd
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x180006a7c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._SERVICE__service_stop._ControlService_STOP_failed
jmp 0x180006aa0
mov edx, 1
mov r8d, 0x7530
mov rcx, rdi
call fcn.180006ec0
test eax, eax
je 0x180006ab4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._ELEVATE__service_stop:_service_stop_timed_out.
lea rcx, [0x180018d60]
mov r9d, eax
mov r8d, eax
mov ebx, eax
call fcn.180006790
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x180006af0
Capabilities:
Create service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rdi, rdx
mov r8, rdx
mov rsi, rcx
mov rdx, rcx
lea rcx, str._SERVICE__attempting_to_create_service:__s____s
xor ebx, ebx
call fcn.180006790
test rsi, rsi
je 0x180006c0a
test rdi, rdi
je 0x180006c0a
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbp, rax
test rax, rax
jne 0x180006b62
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._SERVICE__service_create._OpenSCManagerA_failed
mov ebx, eax
mov r9d, eax
mov r8d, eax
jmp 0x180006c1c
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], ebx
mov r9d, 0xf01ff
xor r8d, r8d
mov rdx, rsi
mov rcx, rax
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
mov qword [rsp + 0x80], r14
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov r14, rax
test rax, rax
jne 0x180006bdc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._SERVICE__service_create._CreateServiceA_failed
lea rcx, [0x180018d60]
mov r9d, eax
mov r8d, eax
mov ebx, eax
call fcn.180006790
jmp 0x180006bf7
lea rcx, str._SERVICE__service_created:__s____s
mov r8, rdi
mov rdx, rsi
call fcn.180006790
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r14, qword [rsp + 0x80]
jmp 0x180006c28
mov ebx, 6
lea rdx, str._SERVICE__service_create._cpName_cpPath_is_NULL
mov r9d, ebx
mov r8d, ebx
lea rcx, [0x180018d60]
call fcn.180006790
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180006c50
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
jne 0x180006c87
mov ebx, 6
lea rdx, str._SERVICE__service_destroy._cpName_is_NULL
lea rcx, [0x180018d60]
mov r9d, ebx
mov r8d, ebx
call fcn.180006790
jmp 0x180006d49
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov qword [rsp + 0x30], rsi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
jne 0x180006cc7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._SERVICE__service_destroy._OpenSCManagerA_failed
lea rcx, [0x180018d60]
mov r9d, eax
mov r8d, eax
mov ebx, eax
call fcn.180006790
jmp 0x180006d44
mov r8d, 0x10000
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
jne 0x180006d04
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._SERVICE__service_destroy._OpenServiceA_failed
lea rcx, [0x180018d60]
mov r9d, eax
mov r8d, eax
mov ebx, eax
call fcn.180006790
jmp 0x180006d3b
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x180006d32
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._SERVICE__service_destroy._DeleteService_failed
lea rcx, [0x180018d60]
mov r9d, eax
mov r8d, eax
mov ebx, eax
call fcn.180006790
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x30]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180006d70
Capabilities:
Query service status

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x60
xor ebx, ebx
mov r14, rdx
mov rdi, rcx
test rcx, rcx
jne 0x180006dae
mov r9d, 6
lea rdx, str._SERVICE__service_query_status._cpName_is_NULL
lea rcx, [0x180018d60]
mov r8d, r9d
call fcn.180006790
lea eax, [rdi + 6]
add rsp, 0x60
pop r14
pop rdi
pop rbx
ret
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x90], rsi
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
jne 0x180006df2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._SERVICE__service_query_status._OpenSCManagerA_failed
lea rcx, [0x180018d60]
mov r9d, eax
mov r8d, eax
mov ebx, eax
call fcn.180006790
jmp 0x180006e9a
mov r8d, 4
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x88], rbp
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbp, rax
test rax, rax
jne 0x180006e33
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._SERVICE__service_query_status._QueryServiceStatusEx_failed_for__s._error_d__0x_x_
mov rdx, rdi
mov r9d, eax
mov r8d, eax
mov ebx, eax
call fcn.180006790
jmp 0x180006e89
lea rax, [rsp + 0x80]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x180006e79
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._SERVICE__service_query_status._QueryServiceStatusEx_failed_for__s._error_d__0x_x_
mov rdx, rdi
mov r9d, eax
mov r8d, eax
mov ebx, eax
call fcn.180006790
jmp 0x180006e80
mov eax, dword [rsp + 0x34]
mov dword [r14], eax
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x88]
mov eax, ebx
mov rsi, qword [rsp + 0x90]
add rsp, 0x60
pop r14
pop rdi
pop rbx
ret

Function at 0x180006f40
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, [0x180018ce8]
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.180007d44
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180006f90
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.180009520
lea r8, [0x180018cf0]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.180007d68
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.180007c00
add rsp, 0x438
ret
Function at 0x180007600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov rbx, rcx
mov r15, rdx
add rax, rcx
mov edx, 0x10b
movzx ecx, word [rax + 0x18]
cmp cx, dx
jne 0x18000762e
xor r14d, r14d
add rax, 0x78
jmp 0x180007648
mov edx, 0x20b
cmp cx, dx
jne 0x180007757
mov r14d, 1
add rax, 0x88
mov ecx, dword [rax]
mov qword [rsp + 0x40], rbp
mov r8d, r14d
mov rdx, rbx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r13
call fcn.180007950
mov r8d, r14d
mov rdx, rbx
mov r13d, eax
add r13, rbx
mov ecx, dword [r13 + 0x20]
call fcn.180007950
mov ecx, dword [r13 + 0x24]
mov r8d, r14d
mov edi, eax
mov rdx, rbx
add rdi, rbx
call fcn.180007950
mov ebp, eax
add rbp, rbx
test r15, 0xffffffffffff0000
jne 0x1800076c7
mov ecx, dword [r13 + 0x1c]
mov r8d, r14d
mov rdx, rbx
call fcn.180007950
movzx ecx, r15w
mov r8d, r14d
sub ecx, dword [r13 + 0x10]
mov eax, eax
mov rdx, rbx
add rax, rbx
mov ecx, dword [rax + rcx*4]
call fcn.180007950
jmp 0x180007714
mov qword [rsp + 0x48], rsi
mov esi, dword [r13 + 0x18]
test esi, esi
je 0x18000770d
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rdi]
mov r8d, r14d
mov rdx, rbx
dec esi
call fcn.180007950
mov rdx, r15
mov ecx, eax
add rcx, rbx
call fcn.180008c4c
test rax, rax
jne 0x18000772d
add rdi, 4
add rbp, 2
test esi, esi
jne 0x1800076e0
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x40]
mov r13, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
mov ecx, dword [r13 + 0x1c]
mov r8d, r14d
mov rdx, rbx
call fcn.180007950
movzx r9d, word [rbp]
mov r8d, r14d
mov ecx, eax
mov rdx, rbx
add rcx, rbx
mov ecx, dword [rcx + r9*4]
call fcn.180007950
jmp 0x18000770f
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
Function at 0x180007830
Capabilities:
Create thread
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r14d, r8d
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
test rcx, rcx
je 0x18000791f
test rdx, rdx
je 0x18000791f
test r8d, r8d
je 0x18000791f
mov rdx, r9
mov rcx, rsi
call fcn.180007600
mov r12d, eax
test eax, eax
je 0x18000791f
mov r15d, r14d
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, r14d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
je 0x18000791f
mov qword [rsp + 0x20], rbx
mov r9d, r15d
mov r8, rsi
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000791f
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 0x20]
mov r8d, r15d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x18000791f
lea r9, [r14 + r12]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor edx, edx
mov r8d, 0x100000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
mov qword [rsp + 0x48], rax
jmp 0x180007928
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop r12
ret

Function at 0x180007c00
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [0x180025ec0], 0
mov rbx, rcx
je 0x180007c60
mov rcx, qword [0x180025eb8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
or r8, 0xffffffffffffffff
mov dword [rsp + 0x48], eax
nop dword [rax]
inc r8
cmp byte [rbx + r8], al
jne 0x180007c30
mov rcx, qword [0x180025ec0]
lea r9, [rsp + 0x48]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x180025eb8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
add rsp, 0x30
pop rbx
ret

Function at 0x180007c70
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, [0x180018ce8]
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.180007d44
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180007cc0
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.180009520
lea r8, [0x180018cf0]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.180007d68
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.180007c00
add rsp, 0x438
ret