joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004a30
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor ebx, ebx
xor eax, eax
lock cmpxchg dword [0x140028070], ebx
mov ecx, eax
jne 0x140004a92
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140004a85
lea rdx, str.RemoveDllDirectory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [rbx + 2]
test rax, rax
jne 0x140004a8a
mov ecx, 1
mov eax, ecx
xchg dword [0x140028070], eax
cmp ecx, 1
jne 0x140004c2b
mov qword [rsp + 0x260], rbp
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x268], rsi
xor edx, edx
mov qword [rsp + 0x270], rdi
mov r8d, 0x208
mov qword [rsp + 0x248], r14
mov qword [rsp + 0x240], r15
call fcn.140007a90
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140004c27
cmp word [rsp + 0x20], bx
je 0x140004c27
mov ebp, ebx
lea rax, [rsp + 0x20]
mov rsi, rbx
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], bx
jne 0x140004b10
mov r15d, 0x5c
test rdi, rdi
je 0x140004b43
movzx eax, word [rsp + rdi*2 + 0x1e]
mov rbx, rdi
cmp r15w, ax
je 0x140004b43
mov ecx, 0x2f
cmp cx, ax
je 0x140004b43
lea ebp, [rcx - 0x2e]
lea rbx, [rdi + 1]
add rbx, 7
je 0x140004c27
lea rbx, [rbx*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
je 0x140004c27
test rdi, rdi
je 0x140004b91
lea r8, [rdi + rdi]
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.14000a130
mov rsi, rdi
test ebp, ebp
je 0x140004b9d
mov word [r14 + rsi*2], r15w
inc rsi
movsd xmm0, qword [str.msi.dll]
mov rcx, r14
movsd qword [r14 + rsi*2], xmm0
mov eax, dword [0x140021ec0]
mov dword [r14 + rsi*2 + 8], eax
movzx eax, word [0x140021ec4]
mov word [r14 + rsi*2 + 0xc], ax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, rbx
mov r14, qword [rsp + 0x248]
mov rdi, qword [rsp + 0x270]
mov rsi, qword [rsp + 0x268]
mov rbp, qword [rsp + 0x260]
mov r15, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140005df0
add rsp, 0x250
pop rbx
ret
xor eax, eax
jmp 0x140004be6
xor edx, edx
lea rcx, str.msi.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x140004c0e
Function at 0x140004f00
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x140028074], 0
jne 0x140005022
call fcn.140004a30
mov rbx, rax
test rax, rax
je 0x140005013
lea rdx, str.MsiViewExecute
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MsiCloseHandle
mov rcx, rbx
mov qword [0x140028020], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MsiViewFetch
mov rcx, rbx
mov qword [0x140028030], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MsiViewClose
mov rcx, rbx
mov qword [0x140028018], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MsiOpenDatabaseW
mov rcx, rbx
mov qword [0x140028040], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MsiDatabaseOpenViewW
mov rcx, rbx
mov qword [0x140028048], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MsiRecordGetStringW
mov rcx, rbx
mov qword [0x140028038], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MsiGetSummaryInformationW
mov rcx, rbx
mov qword [0x140028028], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MsiSummaryInfoGetPropertyW
mov rcx, rbx
mov qword [0x140028010], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MsiEnumRelatedProductsW
mov rcx, rbx
mov qword [0x140028058], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028050], rax
mov byte [0x140028074], 1
jmp 0x140005029
mov byte [0x140028074], 1
xor al, al
add rsp, 0x20
pop rbx
ret
mov rax, qword [0x140028050]
cmp qword [0x140028048], 0
je 0x14000501a
cmp qword [0x140028038], 0
je 0x14000501a
cmp qword [0x140028020], 0
je 0x14000501a
cmp qword [0x140028030], 0
je 0x14000501a
cmp qword [0x140028018], 0
je 0x14000501a
cmp qword [0x140028028], 0
je 0x14000501a
cmp qword [0x140028040], 0
je 0x14000501a
cmp qword [0x140028010], 0
je 0x14000501a
cmp qword [0x140028058], 0
je 0x14000501a
test rax, rax
je 0x14000501a
mov al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x140001008
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140001069
lea rcx, str.Windows_original_main_args:_n
call fcn.140001148
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp dword [rax], ebx
jle 0x140001069
xor edi, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov edx, ebx
lea rcx, str.wwwd_args__d____s_n
mov r8, qword [rax]
mov r8, qword [rdi + r8]
call fcn.140001148
inc ebx
lea rdi, [rdi + 8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp ebx, dword [rax]
jl 0x14000103e
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
test edi, edi
jle 0x1400010b5
xor edx, edx
mov r9d, edi
mov rcx, qword [rax]
lea rax, [rax + 0x10]
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x1400010a2
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010cc
mov rcx, qword [rbx]
mov rax, qword [section..data]
test rax, rax
jne 0x1400010db
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
lea r9, str._J_ms8m
mov byte [rsp + 0x60], 0
mov r8d, 2
mov byte [rsp + 0x58], 0
mov rdx, rbx
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov ecx, edi
mov qword [rsp + 0x40], rax
lea rax, [0x1400022d4]
mov qword [rsp + 0x38], rax
lea rax, [0x1400022d8]
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x1400045f0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r12
sub rsp, 0x30
cmp dword [rcx + 0x58], 0
mov ebp, r8d
mov r12, rdx
mov rsi, rcx
je 0x14000461d
mov r8, rbp
xor edx, edx
mov rcx, r12
add rsp, 0x30
pop r12
pop rsi
pop rbp
jmp fcn.1401a9330
test r8d, r8d
je 0x140004712
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x58], rbx
mov dword [rcx + 0x28], ebp
mov qword [rsp + 0x60], rdi
mov qword [rcx + 0x20], rdx
xor r13d, r13d
nop
cmp dword [rsi + 0x10], r13d
jne 0x140004682
mov rdx, qword [rsi + 0x50]
mov rcx, qword [rsi]
lea r9, [rsp + 0x50]
mov r8d, 0x10000
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000471b
mov ecx, dword [rsp + 0x50]
test ecx, ecx
je 0x14000471b
mov rax, qword [rsi + 0x50]
mov dword [rsi + 0x10], ecx
mov qword [rsi + 8], rax
cmp dword [rsi + 0x5c], r13d
je 0x1400046b7
mov edi, dword [rsi + 0x28]
mov eax, dword [rsi + 0x10]
mov rdx, qword [rsi + 8]
mov rcx, qword [rsi + 0x20]
cmp edi, eax
cmova edi, eax
mov r8d, edi
mov ebx, edi
call fcn.1401a8fe0
add qword [rsi + 8], rbx
add qword [rsi + 0x20], rbx
sub dword [rsi + 0x10], edi
sub dword [rsi + 0x28], edi
jne 0x140004640
jmp 0x140004703
lea rcx, [rsi + 8]
call fcn.1401819e0
test eax, eax
je 0x1400046c9
cmp eax, 4
jne 0x140004737
cmp dword [rsi + 0x28], r13d
je 0x140004703
cmp eax, 4
jne 0x140004640
mov edx, eax
lea rcx, str.BZ2_bzDecompress__:__d:_Unexpected_EOF_in_decompression_stream._n
call fcn.1400b3fb0
lea rcx, [rsi + 8]
call fcn.140181b10
mov r8, rbp
xor edx, edx
mov rcx, r12
mov dword [rsi + 0x58], 1
call fcn.1401a9330
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov r13, qword [rsp + 0x68]
add rsp, 0x30
pop r12
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ReadFile__:__d:_Failed_to_read._n
mov edx, eax
call fcn.1400b3fb0
cmp dword [rsi + 0x5c], r13d
jne 0x1400046ef
jmp 0x1400046e6
mov edx, eax
lea rcx, str.BZ2_bzDecompress__:__d:_Failed_to_decompress._n
jmp 0x1400046e1
Function at 0x140004750
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0x40
cmp dword [rcx + 0x58], 0
mov rsi, rcx
je 0x140004767
xor eax, eax
add rsp, 0x40
pop rsi
ret
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x60], rbx
mov dword [rcx + 0x28], 1
xor ebp, ebp
mov qword [rsp + 0x30], rdi
mov qword [rcx + 0x20], rax
cmp dword [rsi + 0x10], ebp
jne 0x1400047c9
mov rdx, qword [rsi + 0x50]
mov rcx, qword [rsi]
lea r9, [rsp + 0x58]
mov r8d, 0x10000
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140004871
mov ecx, dword [rsp + 0x58]
test ecx, ecx
je 0x140004856
mov rax, qword [rsi + 0x50]
mov dword [rsi + 0x10], ecx
mov qword [rsi + 8], rax
cmp dword [rsi + 0x5c], ebp
je 0x140004814
mov edi, dword [rsi + 0x28]
mov eax, dword [rsi + 0x10]
mov rdx, qword [rsi + 8]
mov rcx, qword [rsi + 0x20]
cmp edi, eax
cmova edi, eax
mov r8d, edi
mov ebx, edi
call fcn.1401a8fe0
add qword [rsi + 8], rbx
add qword [rsi + 0x20], rbx
sub dword [rsi + 0x10], edi
sub dword [rsi + 0x28], edi
jne 0x140004788
mov al, byte [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
pop rsi
ret
lea rcx, [rsi + 8]
call fcn.1401819e0
test eax, eax
je 0x140004826
cmp eax, 4
jne 0x14000488c
cmp dword [rsi + 0x28], ebp
je 0x1400047fb
cmp eax, 4
jne 0x140004788
mov edx, eax
lea rcx, str.BZ2_bzDecompress__:__d:_Unexpected_EOF_in_decompression_stream._n
call fcn.1400b3fb0
lea rcx, [rsi + 8]
call fcn.140181b10
mov dword [rsi + 0x58], 1
xor eax, eax
jmp 0x1400047ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ReadFile__:__d:_Failed_to_read._n
mov edx, eax
call fcn.1400b3fb0
cmp dword [rsi + 0x5c], ebp
jne 0x14000484b
jmp 0x140004842
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ReadFile__:__d:_Failed_to_read._n
mov edx, eax
call fcn.1400b3fb0
cmp dword [rsi + 0x5c], ebp
jne 0x14000484b
jmp 0x140004842
mov edx, eax
lea rcx, str.BZ2_bzDecompress__:__d:_Failed_to_decompress._n
jmp 0x14000483d
Function at 0x1400048a0
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0x40
cmp dword [rcx + 0x58], 0
mov rsi, rcx
je 0x1400048b7
xor eax, eax
add rsp, 0x40
pop rsi
ret
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rbx
mov dword [rcx + 0x28], 8
xor ebp, ebp
mov qword [rsp + 0x30], rdi
mov qword [rcx + 0x20], rax
cmp dword [rsi + 0x10], ebp
jne 0x140004919
mov rdx, qword [rsi + 0x50]
mov rcx, qword [rsi]
lea r9, [rsp + 0x50]
mov r8d, 0x10000
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400049c2
mov ecx, dword [rsp + 0x50]
test ecx, ecx
je 0x1400049a7
mov rax, qword [rsi + 0x50]
mov dword [rsi + 0x10], ecx
mov qword [rsi + 8], rax
cmp dword [rsi + 0x5c], ebp
je 0x140004965
mov edi, dword [rsi + 0x28]
mov eax, dword [rsi + 0x10]
mov rdx, qword [rsi + 8]
mov rcx, qword [rsi + 0x20]
cmp edi, eax
cmova edi, eax
mov r8d, edi
mov ebx, edi
call fcn.1401a8fe0
add qword [rsi + 8], rbx
add qword [rsi + 0x20], rbx
sub dword [rsi + 0x10], edi
sub dword [rsi + 0x28], edi
jne 0x1400048d8
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
pop rsi
ret
lea rcx, [rsi + 8]
call fcn.1401819e0
test eax, eax
je 0x140004977
cmp eax, 4
jne 0x1400049dd
cmp dword [rsi + 0x28], ebp
je 0x14000494b
cmp eax, 4
jne 0x1400048d8
mov edx, eax
lea rcx, str.BZ2_bzDecompress__:__d:_Unexpected_EOF_in_decompression_stream._n
call fcn.1400b3fb0
lea rcx, [rsi + 8]
call fcn.140181b10
mov dword [rsi + 0x58], 1
xor eax, eax
jmp 0x140004950
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ReadFile__:__d:_Failed_to_read._n
mov edx, eax
call fcn.1400b3fb0
cmp dword [rsi + 0x5c], ebp
jne 0x14000499c
jmp 0x140004993
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ReadFile__:__d:_Failed_to_read._n
mov edx, eax
call fcn.1400b3fb0
cmp dword [rsi + 0x5c], ebp
jne 0x14000499c
jmp 0x140004993
mov edx, eax
lea rcx, str.BZ2_bzDecompress__:__d:_Failed_to_decompress._n
jmp 0x14000498e
Function at 0x140004d60
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0x40
cmp dword [rcx + 0x58], 0
mov rsi, rcx
je 0x140004d77
xor eax, eax
add rsp, 0x40
pop rsi
ret
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x60], rbx
mov dword [rcx + 0x28], 4
xor ebp, ebp
mov qword [rsp + 0x30], rdi
mov qword [rcx + 0x20], rax
cmp dword [rsi + 0x10], ebp
jne 0x140004dd9
mov rdx, qword [rsi + 0x50]
mov rcx, qword [rsi]
lea r9, [rsp + 0x58]
mov r8d, 0x10000
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140004e81
mov ecx, dword [rsp + 0x58]
test ecx, ecx
je 0x140004e66
mov rax, qword [rsi + 0x50]
mov dword [rsi + 0x10], ecx
mov qword [rsi + 8], rax
cmp dword [rsi + 0x5c], ebp
je 0x140004e24
mov edi, dword [rsi + 0x28]
mov eax, dword [rsi + 0x10]
mov rdx, qword [rsi + 8]
mov rcx, qword [rsi + 0x20]
cmp edi, eax
cmova edi, eax
mov r8d, edi
mov ebx, edi
call fcn.1401a8fe0
add qword [rsi + 8], rbx
add qword [rsi + 0x20], rbx
sub dword [rsi + 0x10], edi
sub dword [rsi + 0x28], edi
jne 0x140004d98
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
pop rsi
ret
lea rcx, [rsi + 8]
call fcn.1401819e0
test eax, eax
je 0x140004e36
cmp eax, 4
jne 0x140004e9c
cmp dword [rsi + 0x28], ebp
je 0x140004e0b
cmp eax, 4
jne 0x140004d98
mov edx, eax
lea rcx, str.BZ2_bzDecompress__:__d:_Unexpected_EOF_in_decompression_stream._n
call fcn.1400b3fb0
lea rcx, [rsi + 8]
call fcn.140181b10
mov dword [rsi + 0x58], 1
xor eax, eax
jmp 0x140004e0f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ReadFile__:__d:_Failed_to_read._n
mov edx, eax
call fcn.1400b3fb0
cmp dword [rsi + 0x5c], ebp
jne 0x140004e5b
jmp 0x140004e52
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ReadFile__:__d:_Failed_to_read._n
mov edx, eax
call fcn.1400b3fb0
cmp dword [rsi + 0x5c], ebp
jne 0x140004e5b
jmp 0x140004e52
mov edx, eax
lea rcx, str.BZ2_bzDecompress__:__d:_Failed_to_decompress._n
jmp 0x140004e4d

Function at 0x140004eb0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140004750
cmp al, 0xff
jne 0x140004ecf
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140004d60
movzx eax, al
add rsp, 0x20
pop rbx
ret
Function at 0x1400056b0
Capabilities:
Delete service
Stop service

Disassembly:
push rbx
sub rsp, 0x50
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rbx, rax
je 0x1400057c8
lea rdx, str.Everything_Client
mov r8d, 0x20
mov rcx, rax
mov qword [rsp + 0x60], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rdi, rax
je 0x140005711
lea r8, [rsp + 0x30]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, str.Everything_Client
mov r8d, 0x10000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rdi, rax
je 0x140005780
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140005763
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x140200708]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x20a0]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d5b60
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
mov rdi, qword [rsp + 0x60]
add rsp, 0x50
pop rbx
jmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
je 0x1400057b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x140200708]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2078]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d5b60
mov rcx, rbx
mov rdi, qword [rsp + 0x60]
add rsp, 0x50
pop rbx
jmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x140200708]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2088]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d5b60
add rsp, 0x50
pop rbx
ret
Function at 0x140005800
Capabilities:
Start service

Disassembly:
push rbx
sub rsp, 0x30
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rbx, rax
je 0x1400058e1
lea rdx, str.Everything_Client
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rax
mov qword [rsp + 0x40], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rdi, rax
je 0x1400058a6
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140005889
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x140005889
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x140200708]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2090]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d5b60
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
jmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x140200708]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2078]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d5b60
mov rcx, rbx
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
jmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x140200708]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2088]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d5b60
add rsp, 0x30
pop rbx
ret

Function at 0x140005910
Capabilities:
Stop service

Disassembly:
push rbx
sub rsp, 0x50
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rbx, rax
je 0x1400059f8
lea rdx, str.Everything_Client
mov r8d, 0x20
mov rcx, rax
mov qword [rsp + 0x60], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rdi, rax
je 0x1400059bd
lea r8, [rsp + 0x30]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1400059a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x1400059a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x140200708]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2098]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d5b60
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
mov rdi, qword [rsp + 0x60]
add rsp, 0x50
pop rbx
jmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x140200708]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2078]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d5b60
mov rcx, rbx
mov rdi, qword [rsp + 0x60]
add rsp, 0x50
pop rbx
jmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x140200708]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2088]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d5b60
add rsp, 0x50
pop rbx
ret
Function at 0x140005a30
Capabilities:
Create service
Persist via windows service

Disassembly:
push rbx
sub rsp, 0x4e0
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
call fcn.1400056b0
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rbx, rax
je 0x140005bb3
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x4f0], rdi
call fcn.140177280
lea rcx, [rsp + 0x190]
call fcn.140177280
lea rcx, [rsp + 0x2b0]
call fcn.140177280
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.1400d97f0
mov r8, qword [rsp + 0x78]
lea rdx, str.__s___client_svc
lea rcx, [rsp + 0x190]
call fcn.1401789a0
mov rdx, qword [rsp + 0x198]
lea rcx, [rsp + 0x2b0]
call fcn.14017d850
mov rax, qword [rsp + 0x2b8]
xor r11d, r11d
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r11d
lea r9d, [r11 + 2]
lea r8, str.Everything_Client
lea rdx, str.Everything_Client
mov rcx, rbx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
mov rdi, rax
je 0x140005b41
call fcn.140005800
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140005b7c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x140005b55
call fcn.140005800
jmp 0x140005b7c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x140200708]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2080]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d5b60
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [rsp + 0x2b0]
call fcn.14017d580
lea rcx, [rsp + 0x190]
call fcn.14017d580
lea rcx, [rsp + 0x70]
call fcn.14017d580
mov rdi, qword [rsp + 0x4f0]
jmp 0x140005bda
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x140200708]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2088]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d5b60
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.1401a8fb0
add rsp, 0x4e0
pop rbx
ret
Function at 0x140005ff0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x270
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbp, rcx
lea rcx, [rsp + 0x140]
call fcn.140177280
lea rcx, [rsp + 0x20]
call fcn.140177280
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rsp + 0x140]
mov rdx, rax
call fcn.140178050
mov rcx, rbp
call fcn.140178250
mov rsi, qword [rsp + 0x148]
cmp byte [rsi], 0
je 0x140006138
mov qword [rsp + 0x288], rbx
mov qword [rsp + 0x290], rdi
xor ebx, ebx
xor edi, edi
nop
mov rcx, rsi
call fcn.1401754e0
xor r8d, r8d
mov rcx, rax
movzx eax, byte [rax]
test al, al
je 0x1400060dc
test r8d, r8d
jne 0x14000609a
cmp al, 0x20
je 0x1400060dc
cmp al, 9
je 0x1400060dc
cmp al, 0xd
je 0x1400060dc
cmp al, 0xa
je 0x1400060dc
cmp al, 0x22
jne 0x1400060c8
add rcx, 1
cmp byte [rcx], al
jne 0x1400060bb
cmp byte [rcx + 1], al
jne 0x1400060bb
add rcx, 2
test edi, edi
je 0x1400060b5
mov byte [rbx], al
add rbx, 1
jmp 0x1400060d6
xor eax, eax
test r8d, r8d
sete al
mov r8d, eax
jmp 0x1400060d6
test edi, edi
je 0x1400060ce
mov byte [rbx], al
add rbx, 1
add rcx, 1
mov al, byte [rcx]
test al, al
jne 0x140006085
test edi, edi
je 0x1400060ed
mov byte [rbx], 0
call fcn.1401754e0
mov rsi, rax
jmp 0x140006109
lea edx, [rbx + 1]
cmp edx, dword [rsp + 0x24]
mov dword [rsp + 0x20], edx
jle 0x140006104
lea rcx, [rsp + 0x20]
call fcn.140177290
mov rbx, qword [rsp + 0x28]
add edi, 1
cmp edi, 2
jl 0x140006070
mov rcx, rsi
call fcn.1401754e0
mov rcx, rbp
mov rdx, rax
call fcn.140177fb0
mov rdi, qword [rsp + 0x290]
mov rbx, qword [rsp + 0x288]
lea rcx, [rsp + 0x20]
call fcn.14017d580
lea rcx, [rsp + 0x140]
call fcn.14017d580
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401a8fb0
mov rbp, qword [rsp + 0x298]
add rsp, 0x270
pop rsi
ret