joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002050
Capabilities:
Create process on windows
Create thread
Find taskbar
Get common file path

Disassembly:
sub rsp, 0x2e8
mov rax, qword [0x18001b008]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
xor edx, edx
mov qword [rsp + 0x2e0], rdi
mov r8d, 0x208
lea rcx, [rsp + 0xc0]
call fcn.180003f90
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowW]
xor edi, edi
test rax, rax
je 0x180002136
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x30], rcx
xor r9d, r9d
mov dword [rsp + 0x28], 0x7d0
mov rcx, rax
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x5b4
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
jne 0x180002136
cmp qword [rsp + 0x40], rdi
je 0x180002136
mov qword [rsp + 0x28], rdi
lea r8, [fcn.180001f60]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
mov qword [rsp + 0x2f0], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x180002129
mov edx, 0x7d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000212e
call fcn.180001f60
mov rbx, qword [rsp + 0x2f0]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x104
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, str._taskkill.exe
mov edx, 0x104
lea rcx, [rsp + 0xc0]
call fcn.180006984
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x70]
call fcn.180003f90
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x50], 0x70
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x50]
lea rax, str._f__im_explorer.exe
mov dword [rsp + 0x54], 0x40
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x80], 2
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov rdi, qword [rsp + 0x2e0]
test eax, eax
je 0x180002200
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x180002200
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.180002420
add rsp, 0x2e8
ret
Function at 0x14000c63f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400311e8]
jne 0x14000996a
rol rcx, 0x10
test cx, 0xffff
jne 0x140009966
repz ret
ror rcx, 0x10
jmp 0x14000c598
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140032870]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140032968]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000c61d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140032870]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000c63f
mov rax, qword [rsp + 0x88]
mov qword [0x140032968], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140032908], rax
mov rax, qword [0x140032968]
mov qword [0x1400327e0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400328f0], rax
mov dword [0x1400327d0], 0xc0000409
mov dword [0x1400327d4], 1
mov rax, qword [0x1400311e8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400311f0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140032868], eax
mov ecx, 1
call fcn.14000c808
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140025848]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140032868], 0
jne 0x14000c6c6
mov ecx, 1
call fcn.14000c808
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14000d0fc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.14000e750
nop
cmp dword [0x140032db0], 1
je 0x14000d0a8
mov dword [0x140032dac], 1
mov byte [0x140032da8], r12b
test ebx, ebx
jne 0x14000d094
mov rcx, qword [0x140034a70]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000d081
mov rcx, qword [0x140034a68]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x14000d020
call fcn.14000c818
cmp qword [rdi], rax
jne 0x14000d020
jmp 0x14000d006
cmp rdi, rsi
jb 0x14000d081
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.14000c818
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140034a70]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140034a68]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x14000d05f
cmp r13, rax
je 0x14000d07f
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14000d006
lea rdx, [0x140025600]
lea rcx, [0x1400255e8]
call fcn.14000ce50
lea rdx, [0x140025610]
lea rcx, [0x140025608]
call fcn.14000ce50
nop
test r12d, r12d
je 0x14000d0b7
mov ecx, 8
call fcn.14000e650
test r12d, r12d
jne 0x14000d0e2
mov dword [0x140032db0], 1
lea ecx, [r12 + 8]
call fcn.14000e650
mov ecx, r15d
call fcn.14000cde4
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x14000cf70

Function at 0x14000d108
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14000cf70
Function at 0x1400156b0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.14000c818
xor ebx, ebx
mov rdi, rax
cmp qword [0x140033560], rbx
jne 0x1400157b6
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14001588b
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001588b
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140033560], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140033568], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140033570], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140033580], rax
test rax, rax
je 0x1400157ad
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140033578], rax
jmp 0x1400157bd
mov rax, qword [0x140033578]
jmp 0x1400157c4
mov rax, qword [0x140033578]
mov r11, qword [0x140033580]
cmp rax, rdi
je 0x14001582c
cmp r11, rdi
je 0x14001582c
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140033580]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14001582c
test rax, rax
je 0x14001582c
call rsi
test rax, rax
je 0x140015826
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140015826
test byte [rsp + 0x38], 1
jne 0x14001582c
bts ebp, 0x15
jmp 0x14001586a
mov rcx, qword [0x140033568]
cmp rcx, rdi
je 0x14001586a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14001586a
call rax
mov rbx, rax
test rax, rax
je 0x14001586a
mov rcx, qword [0x140033570]
cmp rcx, rdi
je 0x14001586a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14001586a
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140033560]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14001588b
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14001588d
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140018260
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x170
mov rax, qword [0x1400311e8]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov byte [rsp + 0x50], 0
lea rdi, [rsp + 0x51]
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
lea rdx, str.SOFTWAREAutoRunInstallCount
lea rcx, [rsp + 0x50]
call fcn.14000a6f0
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x40], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
je 0x140018369
cmp dword [rsp + 0x190], 1
jne 0x140018364
cmp dword [rsp + 0x3c], 2
jne 0x140018319
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x140018364
mov dword [rsp + 0x40], 1
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x1400291b4]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x3c], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140018462
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140029964]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x140018417
cmp dword [rsp + 0x190], 1
jne 0x1400183c8
cmp dword [rsp + 0x40], 0
jbe 0x1400183be
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
jmp 0x1400183c6
mov dword [rsp + 0x40], 1
jmp 0x1400183e4
cmp dword [rsp + 0x40], 1
jbe 0x1400183dc
mov eax, dword [rsp + 0x40]
sub eax, 1
mov dword [rsp + 0x40], eax
jmp 0x1400183e4
mov dword [rsp + 0x40], 0
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x140029b98]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x3c], eax
jmp 0x140018457
cmp dword [rsp + 0x3c], 2
jne 0x140018457
mov dword [rsp + 0x40], 1
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.value
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x3c], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x3c], 0
jne 0x140018480
mov rcx, qword [rsp + 0x188]
mov eax, dword [rsp + 0x40]
mov dword [rcx], eax
mov eax, 1
jmp 0x140018490
mov rax, qword [rsp + 0x188]
mov dword [rax], 0
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140009950
add rsp, 0x170
pop rdi
ret
Function at 0x1400185c0
Capabilities:
Get disk information

Disassembly:
sub rsp, 0xf8
mov qword [rsp + 0xe0], 0xfffffffffffffffe
mov rax, qword [0x1400311e8]
xor rax, rsp
mov qword [rsp + 0xe8], rax
lea rcx, [0x140033708]
call fcn.140004d10
mov r8d, 0x64
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.14000a120
lea rdx, [rsp + 0x40]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov dword [rsp + 0x28], eax
mov byte [rsp + 0x2c], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
jmp 0x140018644
mov rcx, qword [rsp + 0x20]
call fcn.14000a060
mov r11, rax
mov rax, qword [rsp + 0x20]
lea rax, [rax + r11 + 1]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
test eax, eax
je 0x1400186b1
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0xb8]
call fcn.1400047b0
nop
lea rcx, [rsp + 0xb8]
call fcn.140004a40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [rsp + 0xb0], eax
cmp dword [rsp + 0xb0], 5
jne 0x14001869f
lea rdx, [rsp + 0xb8]
lea rcx, [0x140033708]
call fcn.140004c30
nop
lea rcx, [rsp + 0xb8]
call fcn.140004860
jmp 0x140018628
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.140009950
add rsp, 0xf8
ret
Function at 0x140018720
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x510
mov qword [rsp + 0x500], 0xfffffffffffffffe
mov rax, qword [0x1400311e8]
xor rax, rsp
mov qword [rsp + 0x508], rax
cmp dword [rsp + 0x520], 1
jne 0x140018762
call fcn.14001bc20
test eax, eax
jne 0x140018762
jmp 0x140018976
movzx eax, byte [0x1400275b7]
mov byte [rsp + 0x390], al
lea rdi, [rsp + 0x391]
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
lea rdx, str.DCSHelper.exe
lea rcx, [rsp + 0x4a0]
call fcn.1400047b0
nop
lea rcx, [rsp + 0x4c8]
call fcn.140004760
nop
mov dword [rsp + 0x260], 0x130
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x4f0], rax
mov r8d, 0x104
xor edx, edx
lea rcx, [rsp + 0x140]
call fcn.14000a120
lea rcx, [rsp + 0x4a0]
call fcn.140004a40
mov rdx, rax
lea rcx, [rsp + 0x140]
call fcn.14000a6f0
lea rcx, [rsp + 0x140]
call fcn.14000bc38
lea rdx, [rsp + 0x140]
lea rcx, str.The_Monitor1_Name_is_:_s
call fcn.140021de0
cmp qword [rsp + 0x4f0], 0
jne 0x140018841
lea rcx, [rsp + 0x4c8]
call fcn.140004860
nop
lea rcx, [rsp + 0x4a0]
call fcn.140004860
jmp 0x140018976
lea rdx, [rsp + 0x260]
mov rcx, qword [rsp + 0x4f0]
call sub.KERNEL32.dll_Process32First
mov dword [rsp + 0x250], eax
cmp dword [rsp + 0x250], 0
je 0x14001894c
mov r8d, 0x104
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14000a120
lea rdx, [rsp + 0x28c]
lea rcx, [rsp + 0x30]
call fcn.14000a6f0
lea rcx, [rsp + 0x30]
call fcn.14000bc38
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x140]
call fcn.140017c24
test eax, eax
je 0x1400188c6
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x140]
call fcn.1400089d0
test rax, rax
je 0x14001892b
lea rcx, [rsp + 0x4c8]
call fcn.140004a40
mov rdx, rax
lea rcx, str.The_monitor_name2_is__s
call fcn.140021de0
lea rcx, str.get_same_process
call fcn.140021de0
mov r8d, dword [rsp + 0x268]
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x4f8], rax
xor edx, edx
mov rcx, qword [rsp + 0x4f8]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x4f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001894c
lea rdx, [rsp + 0x260]
mov rcx, qword [rsp + 0x4f0]
call sub.KERNEL32.dll_Process32Next
mov dword [rsp + 0x250], eax
jmp 0x14001885d
mov rcx, qword [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x4c8]
call fcn.140004860
nop
lea rcx, [rsp + 0x4a0]
call fcn.140004860
mov rcx, qword [rsp + 0x508]
xor rcx, rsp
call fcn.140009950
add rsp, 0x510
pop rdi
ret
Function at 0x1400189a0
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x2c], 0
mov dword [rsp + 0x28], 0
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140018a00
lea rcx, [0x140029610]
call fcn.140021d50
xor al, al
jmp 0x140018b6f
cmp dword [rsp + 0x3c], 4
jne 0x140018a1a
lea rcx, str.Service_has_been_started
call fcn.140021de0
mov al, 1
jmp 0x140018b6f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jne 0x140018a72
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2c], eax
lea rcx, [0x140033640]
call fcn.140004a40
mov r8d, dword [rsp + 0x2c]
mov rdx, rax
lea rcx, str.error_happens_during_starting_a_service:__s_Error_Code:_d
call fcn.140021d50
xor al, al
jmp 0x140018b6f
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140018a9d
lea rcx, [0x140029690]
call fcn.140021d50
xor al, al
jmp 0x140018b6f
cmp dword [rsp + 0x3c], 2
jne 0x140018b48
xor edx, edx
mov eax, dword [rsp + 0x50]
mov ecx, 0xa
div ecx
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x3e8
jae 0x140018acd
mov dword [rsp + 0x24], 0x3e8
jmp 0x140018adf
cmp dword [rsp + 0x24], 0x2710
jbe 0x140018adf
mov dword [rsp + 0x24], 0x2710
mov edx, dword [rsp + 0x24]
lea rcx, str.ChangeSrvStatusToRuning_sleep_:_d
call fcn.140021de0
mov ecx, dword [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140018b13
jmp 0x140018b48
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x4c], eax
jbe 0x140018b31
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x20], eax
jmp 0x140018b43
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsp + 0x30]
cmp eax, dword [rsp + 0x50]
jbe 0x140018b43
jmp 0x140018b48
jmp 0x140018a9d
cmp dword [rsp + 0x3c], 4
jne 0x140018b61
lea rcx, str.StartService_SUCCESS._n
call fcn.140021de0
mov al, 1
jmp 0x140018b6f
lea rcx, str.StartService_fail._n
call fcn.140021d50
xor al, al
add rsp, 0x68
ret
Function at 0x140018b80
Capabilities:
Modify service

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
cmp qword [rax + 8], 0
je 0x140018bad
mov rax, qword [rsp + 0x90]
cmp qword [rax], 0
jne 0x140018bb4
xor eax, eax
jmp 0x140018d31
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jne 0x140018ca1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x41f
je 0x140018bef
lea rcx, str.LockServiceDatabase_fail
call fcn.140021d50
mov edx, 0x118
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x140018c18
lea rcx, str.LocalAlloc_is_fail
call fcn.140021d50
lea r9, [rsp + 0x70]
mov r8d, 0x118
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusA]
test eax, eax
jne 0x140018c54
lea rcx, str.QueryServiceLockStatus
call fcn.140021de0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x60]
cmp dword [rax], 0
je 0x140018c7e
mov rax, qword [rsp + 0x60]
mov r8d, dword [rax + 0x10]
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx + 8]
lea rcx, str.Locked_by:__s__duration:__d_seconds_n
call fcn.140021de0
jmp 0x140018c8a
lea rcx, str.No_longer_locked_n
call fcn.140021de0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, str.Could_not_lock_database
call fcn.140021de0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8d, dword [rsp + 0x98]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x140018d15
lea rcx, str.ChangeServiceConfig_fail
call fcn.140021d50
lea rcx, str.ChangeServiceConfig_SUCCESS_n
call fcn.140021de0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov eax, 1
add rsp, 0x88
ret
Function at 0x140018d40
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2b8
mov rax, qword [0x1400311e8]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rcx, qword [rsp + 0x2c8]
call fcn.140008910
movzx eax, al
test eax, eax
je 0x140018dd0
lea rcx, str.Not_specify_the_service_name_.
call fcn.140021de0
mov rcx, qword [rsp + 0x2c0]
add rcx, 0x10
lea rdx, str.C:WINDOWS_system32
call fcn.140004910
mov rcx, qword [rsp + 0x2c0]
add rcx, 0x10
lea rdx, [0x140027d64]
call fcn.140004f90
mov rcx, qword [rsp + 0x2c0]
add rcx, 0x10
lea rdx, [0x140029410]
call fcn.140004910
jmp 0x140018e96
lea rax, [rsp + 0x190]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8023
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x140018e83
lea rdx, [0x140029430]
lea rcx, [rsp + 0x190]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rdx, [rsp + 0x190]
lea rcx, [0x140033668]
call fcn.1400048b0
lea rdx, [0x140027df4]
lea rcx, [0x140033668]
call fcn.140004f90
lea rdx, [0x140029440]
lea rcx, [rsp + 0x190]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rdx, [0x140029460]
lea rcx, [0x140033640]
call fcn.1400048b0
mov rcx, qword [rsp + 0x2c0]
add rcx, 0x10
lea rdx, [rsp + 0x190]
call fcn.1400048b0
lea rcx, str.Get_path_successfully_where_the_service_in_.
call fcn.140021de0
jmp 0x140018e96
lea rcx, str.Get_path_fail_where_the_service_in_.
call fcn.140021d50
xor al, al
jmp 0x140018f1c
mov rcx, qword [rsp + 0x2c0]
add rcx, 0x10
call fcn.140004a40
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x180], rax
cmp qword [rsp + 0x180], 0xffffffffffffffff
jne 0x140018eec
mov rcx, qword [rsp + 0x2c0]
add rcx, 0x10
call fcn.140004a40
mov rdx, rax
lea rcx, str.Not_find_the_service_application_:__s__
call fcn.140021d50
xor al, al
jmp 0x140018f1c
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x2c0]
add rcx, 0x10
call fcn.140004a40
mov rdx, rax
lea rcx, str.Find_the_service_application_:__s__
call fcn.140021de0
mov al, 1
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140009950
add rsp, 0x2b8
ret