joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14028603c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r10, r8
mov r14, rdx
mov rsi, rcx
movabs rax, 0xcbf29ce484222325
lea r9, [r8 + 8]
cmp r9, r8
sbb rdx, rdx
not rdx
and edx, 8
cmp r8, r9
ja 0x1402860a8
movzx ecx, byte [r8]
xor rax, rcx
movabs r9, 0x100000001b3
imul rax, r9
inc r8
mov rcx, r8
sub rcx, r10
cmp rcx, rdx
jne 0x140286085
mov r8, qword [rsi + 0x30]
and r8, rax
add r8, r8
mov rcx, qword [rsi + 0x18]
mov rdi, qword [rsi + 8]
cmp qword [rcx + r8*8], rdi
je 0x1402860c8
mov rdi, qword [rcx + r8*8 + 8]
mov rdi, qword [rdi]
mov r9, rdi
cmp r9, qword [rcx + r8*8]
je 0x140286105
mov rdi, qword [rdi + 8]
mov r9, rdi
mov rax, qword [rdi + 0x10]
cmp qword [r10], rax
jne 0x1402860cb
mov r8, rbx
lea rdx, [rsp + 0x80]
lea rcx, [rsi + 8]
call fcn.140286260
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14028622a
mov qword [rsp + 0x80], rbx
mov rax, qword [rbx]
cmp r9, rax
je 0x140286142
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], r9
mov rcx, qword [r9 + 8]
mov qword [rcx], rbx
mov rdx, qword [r9 + 8]
mov rcx, qword [rax + 8]
mov qword [r9 + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x14028615f
mov qword [rdx + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14028618e
cmp rax, r9
jne 0x14028616a
mov qword [rdx + r8*8], rbx
jmp 0x14028618e
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14028618e
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x1404202fc]
test rax, rax
jns 0x1402861af
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x1402861c0
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x14028621f
cmp rdx, 0x200
jae 0x1402861d8
shl rdx, 3
jmp 0x1402861ea
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x1402861ea
add rdx, rdx
mov rcx, rsi
call fcn.14005e790
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x14028621f
mov r15, qword [rax + 8]
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.14028603c
cmp rdi, r15
jne 0x1402861ff
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14028630c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea r11, [r8 + 0x10]
mov rsi, rdx
lea r9, [r11 + 8]
mov r10, rcx
cmp r9, r11
movabs rax, 0xcbf29ce484222325
mov rdi, r11
sbb rbx, rbx
not rbx
and ebx, 8
cmp r11, r9
ja 0x140286369
movzx ecx, byte [rdi]
movabs rdx, 0x100000001b3
xor rax, rcx
inc rdi
mov rcx, rdi
sub rcx, r11
imul rax, rdx
cmp rcx, rbx
jne 0x140286347
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x1402863a1
cmp qword [rcx + rdx*8], r8
jne 0x140286396
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x14028639a
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1402863ae
cmp qword [rcx + rdx*8], r8
jne 0x1402863ae
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
mov rdx, rsi
call fcn.140286260
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1402868c8
Capabilities:
Parse pe header

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0x50], rax
xor ebx, ebx
mov eax, 0x5a4d
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x30], rbx
cmp word [rcx], ax
jne 0x14028694c
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x108
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
movsxd r9, dword [rsi + 0x3c]
lea rax, [rsp + 0x30]
mov r8d, 0x108
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.1402392f0
test eax, eax
jns 0x140286968
cmp eax, 0x800703e3
jne 0x14028694c
mov rax, qword [rdi]
bts dword [rax + 0x16c], 0x10
xor al, al
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.140356560
add rsp, 0x160
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rax, qword [rsp + 0x30]
add rax, 0xffffffffffffff08
test rax, 0xffffffffffffffef
jne 0x14028694c
cmp dword [rsp + 0x40], 0x4550
mov eax, 0x14c
jne 0x1402869b3
mov eax, dword [rsp + 0x48]
mov bl, 1
mov rcx, qword [rdi]
mov dword [rcx + 0x194], eax
mov rcx, qword [rdi]
mov eax, dword [rbp - 0x68]
mov dword [rcx + 0x198], eax
mov rax, qword [rdi]
movzx ecx, word [rsp + 0x44]
mov dword [rax + 0x1a0], ecx
mov al, bl
jmp 0x14028694e
Function at 0x1402884e0
Capabilities:
Check if file exists
Get disk information

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, rdx
mov rbx, rcx
mov edx, 0x80
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1405668a4], eax
jg 0x1402886ce
mov edx, 0x104
lea rcx, [rbp - 0x51]
call fcn.14019d860
nop
movdqa xmm0, xmmword [0x140420310]
movdqu xmmword [rbp - 0x21], xmm0
xor r14d, r14d
mov word [rbp - 0x31], r14w
mov rax, qword [rbp - 0x49]
mov rdi, qword [rbp - 0x51]
sub rax, rdi
sar rax, 1
cmp qword [rbx + 0x18], 8
jb 0x140288572
mov rbx, qword [rbx]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
nop dword [rax + rax]
test eax, eax
je 0x1402885d9
movdqa xmm0, xmmword [0x140420310]
movdqu xmmword [rbp + 7], xmm0
mov word [rbp - 9], r14w
mov rdx, rdi
lea rcx, [rbp - 9]
call fcn.140055574
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x31]
call fcn.140085570
lea rcx, [rbp - 9]
call fcn.140055f70
jmp 0x14028867d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rbp - 0x59], eax
call fcn.1400550c0
mov rcx, qword [rax + 8]
cmp dword [rcx], 2
jbe 0x140288639
lea rax, [rbp - 0x59]
mov qword [rbp + 0x17], rax
mov edx, 4
mov qword [rbp + 0x1f], rdx
lea rax, str.GetVolumeInformation_failed
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], 0x38
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140483caf]
call fcn.140001208
mov eax, dword [rbp - 0x59]
cmp eax, 0x3ed
je 0x14028866d
cmp eax, 0x80310000
je 0x14028866d
cmp eax, 3
je 0x14028866d
cmp eax, 0x80070005
je 0x14028866d
cmp eax, 0x45d
je 0x14028866d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140288695
lea rdx, [0x1403cb630]
lea rcx, [rbp - 0x31]
call fcn.140055574
xor r8d, r8d
lea rdx, [0x140543f10]
lea rcx, [rbp - 0x31]
call fcn.140235678
mov byte [rsi], al
mov ebx, r14d
lea rcx, [rbp - 0x31]
call fcn.140055f70
nop
lea rcx, [rbp - 0x51]
call fcn.140097a24
mov eax, ebx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140356560
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
lea rcx, [0x1405668a4]
call fcn.14035c740
cmp dword [0x1405668a4], 0xffffffff
jne 0x140288536
lea rdx, [0x1403fa780]
lea rcx, [0x140543f10]
call fcn.140055574
lea rcx, [0x1403a4b40]
call fcn.140356b3c
nop
lea rcx, [0x1405668a4]
call fcn.14035c6d8
jmp 0x140288536
Function at 0x140289b1c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rbx, rdx
cmp qword [r9 + 0x18], 8
mov r10, rcx
mov rdx, qword [r9 + 0x10]
jb 0x140289b3e
mov r9, qword [r9]
add rdx, rdx
xor edi, edi
movabs rax, 0xcbf29ce484222325
mov r11, r9
lea rcx, [rdx + r9]
cmp r9, rcx
cmova rdx, rdi
test rdx, rdx
je 0x140289b83
movzx ecx, byte [r11]
movabs rdi, 0x100000001b3
xor rax, rcx
inc r11
mov rcx, r11
sub rcx, r9
imul rax, rdi
cmp rcx, rdx
jne 0x140289b60
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x140289bbb
cmp qword [rcx + rdx*8], r8
jne 0x140289bb0
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x140289bb4
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140289bc8
cmp qword [rcx + rdx*8], r8
jne 0x140289bc8
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
mov rdx, rbx
call fcn.140289c98
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14028a0d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
mov r15, qword [r8 + 0x10]
mov rdx, r8
cmp qword [r8 + 0x18], 8
jb 0x14028a10f
mov rdx, qword [r8]
movabs rax, 0xcbf29ce484222325
mov r11, rdx
lea r8, [r15 + r15]
lea rcx, [rdx + r8]
xor edi, edi
cmp rdx, rcx
cmova r8, rdi
test r8, r8
je 0x14028a155
movzx ecx, byte [r11]
xor rax, rcx
movabs rdi, 0x100000001b3
imul rax, rdi
inc r11
mov rcx, r11
sub rcx, rdx
cmp rcx, r8
jne 0x14028a132
mov r8, qword [r9 + 0x30]
and r8, rax
add r8, r8
mov r12, qword [r9 + 0x18]
mov rdi, qword [r9 + 8]
cmp rdi, qword [r12 + r8*8]
je 0x14028a206
mov rdi, qword [r12 + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [r12 + r8*8]
je 0x14028a206
mov rdi, qword [rdi + 8]
lea rax, [rdi + 0x10]
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x14028a198
mov rcx, qword [rax]
mov r11, r10
cmp qword [r10 + 0x18], 8
jb 0x14028a1a5
mov r11, qword [r10]
cmp r15, qword [rax + 0x10]
jne 0x14028a179
mov r14, r15
test r15, r15
je 0x14028a1e3
movzx eax, word [r11]
movzx edx, word [rcx]
cmp ax, dx
jb 0x14028a179
sub r11, rcx
cmp ax, dx
ja 0x14028a179
cmp r14, 1
je 0x14028a1e3
dec r14
add rcx, 2
movzx eax, word [rcx + r11]
movzx edx, word [rcx]
cmp ax, dx
jae 0x14028a1c5
jmp 0x14028a179
mov r8, rbx
lea rdx, [rsp + 0x80]
lea rcx, [r9 + 8]
call fcn.140289c98
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14028a29a
mov rax, qword [rbx]
cmp rdi, rax
je 0x14028a23b
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x14028a258
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14028a287
cmp rax, rdi
jne 0x14028a263
mov qword [rdx + r8*8], rbx
jmp 0x14028a287
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14028a287
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.140289fb4
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14028de20
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor r15d, r15d
mov r14, rdx
mov rdi, rcx
mov qword [rbp - 0x49], r15
mov rdx, rcx
lea rcx, [rbp - 0x49]
lea r8d, [r15 + 4]
call fcn.14028dc1c
mov esi, eax
test eax, eax
jns 0x14028dea4
cmp qword [rdi + 0x18], 8
jb 0x14028de76
mov rdi, qword [rdi]
mov rcx, qword [rbp + 0x5f]
lea rax, str.Could_not_get_handle_for_service__ws
mov qword [rsp + 0x28], rdi
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov r9d, esi
mov qword [rsp + 0x20], rax
mov edx, 0x127
call fcn.14018588c
jmp 0x14028df8f
mov rcx, qword [rbp - 0x49]
lea rdx, [rbp - 0x41]
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
nop dword [rax + rax]
test eax, eax
jne 0x14028deee
cmp qword [rdi + 0x18], 8
jb 0x14028dec6
mov rdi, qword [rdi]
mov rcx, qword [rbp + 0x5f]
lea r9, str.Cannot_query_service_status_for_service__ls
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov qword [rsp + 0x20], rdi
mov edx, 0x12b
call fcn.1402297e4
mov esi, eax
jmp 0x14028df8f
call fcn.1400550c0
mov r10, qword [rax + 8]
cmp dword [r10], 4
jbe 0x14028df86
cmp qword [rdi + 0x18], 8
lea rax, str.Read_current_state_of_service
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], 0x3c
jb 0x14028df1e
mov rdi, qword [rdi]
lea rcx, [0x1403cb630]
mov rax, r15
test rdi, rdi
je 0x14028df3e
mov rcx, rdi
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], r15w
jne 0x14028df34
lea eax, [rax*2 + 2]
mov qword [rbp + 0x17], rcx
mov dword [rbp + 0x1f], eax
lea rax, [rbp - 0x3d]
mov qword [rbp + 0x27], rax
mov dword [rbp + 0x23], r15d
mov qword [rbp + 0x2f], 4
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1404866b9]
xor r8d, r8d
mov dword [rsp + 0x20], 5
mov rcx, r10
call fcn.140001208
mov eax, dword [rbp - 0x3d]
mov esi, r15d
mov dword [r14], eax
cmp qword [rbp - 0x49], r15
je 0x14028dfa5
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
mov eax, esi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140356560
lea r11, [rsp + 0xc0]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14028e60c
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor r14d, r14d
mov dword [rbp - 0x29], edx
mov rdi, rcx
mov qword [rbp - 0x21], r14
mov rdx, rcx
lea rcx, [rbp - 0x21]
lea r8d, [r14 + 2]
call fcn.14028dc1c
mov esi, eax
test eax, eax
jns 0x14028e68a
cmp qword [rdi + 0x18], 8
jb 0x14028e65c
mov rdi, qword [rdi]
mov rcx, qword [rbp + 0x5f]
lea rax, str.Could_not_get_handle_for_service__ws
mov qword [rsp + 0x28], rdi
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov r9d, esi
mov qword [rsp + 0x20], rax
mov edx, 0x18a
call fcn.14018588c
jmp 0x14028e79f
mov r8d, dword [rbp - 0x29]
or edx, 0xffffffff
mov rcx, qword [rbp - 0x21]
mov r9d, edx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfigW]
nop dword [rax + rax]
test eax, eax
jne 0x14028e704
cmp qword [rdi + 0x18], 8
jb 0x14028e6d5
mov rdi, qword [rdi]
mov eax, dword [rbp - 0x29]
lea r9, str.Cannot_change_the_service_start_type_to__d_for_service__ws
mov rcx, qword [rbp + 0x5f]
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov qword [rsp + 0x28], rdi
mov edx, 0x19c
mov dword [rsp + 0x20], eax
call fcn.1402297e4
mov esi, eax
jmp 0x14028e79f
call fcn.1400550c0
mov r10, qword [rax + 8]
cmp dword [r10], 4
jbe 0x14028e79c
cmp qword [rdi + 0x18], 8
lea rax, str.Changed_the_service_start_type_successfully
mov qword [rbp + 7], rax
lea rax, [rbp - 0x29]
mov qword [rbp + 0x17], rax
mov qword [rbp + 0xf], 0x58
mov qword [rbp + 0x1f], 4
jb 0x14028e744
mov rdi, qword [rdi]
lea rcx, [0x1403cb630]
mov rax, r14
test rdi, rdi
je 0x14028e764
mov rcx, rdi
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], r14w
jne 0x14028e75a
lea eax, [rax*2 + 2]
mov qword [rbp + 0x27], rcx
mov dword [rbp + 0x2f], eax
mov dword [rbp + 0x33], r14d
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1404867a1]
xor r8d, r8d
mov dword [rsp + 0x20], 5
mov rcx, r10
call fcn.140001208
mov esi, r14d
cmp qword [rbp - 0x21], r14
je 0x14028e7b5
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
mov eax, esi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140356560
mov rsi, qword [rsp + 0x100]
add rsp, 0xd0
pop r14
pop rdi
pop rbp
ret
Function at 0x14028eab0
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14b, dl
mov rdi, rcx
lea rdx, [rbp - 0x45]
call fcn.14028ecd8
xor r15d, r15d
mov ebx, eax
test eax, eax
jns 0x14028eb28
cmp qword [rdi + 0x18], 8
jb 0x14028eaf8
mov rdi, qword [rdi]
mov rcx, qword [rbp + 0x5f]
lea rax, str.Failed_to_query_launch_protected_level_of_service__ws
mov qword [rsp + 0x28], rdi
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov edx, 0x21b
call fcn.14018588c
mov eax, ebx
jmp 0x14028ecae
mov r8d, 2
mov qword [rbp - 0x41], r15
mov rdx, rdi
lea rcx, [rbp - 0x41]
call fcn.14028dc1c
mov esi, eax
test eax, eax
jns 0x14028eb80
cmp qword [rdi + 0x18], 8
jb 0x14028eb4e
mov rdi, qword [rdi]
mov rcx, qword [rbp + 0x5f]
lea rax, str.Could_not_get_handle_for_service__ws
mov qword [rsp + 0x28], rdi
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov r9d, esi
mov qword [rsp + 0x20], rax
mov edx, 0x21e
call fcn.14018588c
mov rbx, qword [rbp - 0x41]
jmp 0x14028ec98
mov rbx, qword [rbp - 0x41]
movzx eax, r14b
add eax, eax
mov dword [rbp - 0x49], eax
cmp dword [rbp - 0x45], eax
je 0x14028ec95
call fcn.1400550c0
mov ecx, 4
mov r10, qword [rax + 8]
cmp dword [r10], ecx
jbe 0x14028ec3d
cmp qword [rdi + 0x18], 8
lea rax, str.Change_the_service_protection_level
mov qword [rbp - 0x19], rax
lea rax, [rbp - 0x45]
mov qword [rbp - 9], rax
lea rax, [rbp - 0x49]
mov qword [rbp + 7], rax
mov rax, rdi
mov qword [rbp - 0x11], VarR8FromUI1
mov qword [rbp - 1], rcx
mov qword [rbp + 0xf], rcx
jb 0x14028ebe5
mov rax, qword [rdi]
lea rdx, [0x1403cb630]
mov rcx, r15
test rax, rax
je 0x14028ec05
mov rdx, rax
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], r15w
jne 0x14028ebfb
lea eax, [rcx*2 + 2]
mov qword [rbp + 0x17], rdx
mov dword [rbp + 0x1f], eax
mov dword [rbp + 0x23], r15d
lea rax, [rbp - 0x39]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1404867dd]
xor r8d, r8d
mov dword [rsp + 0x20], 6
mov rcx, r10
call fcn.140001208
mov eax, dword [rbp - 0x49]
lea r8, [rbp - 0x41]
mov edx, SafeArrayGetDim
mov dword [rbp - 0x41], eax
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfig2W]
nop dword [rax + rax]
test eax, eax
jne 0x14028ec95
cmp qword [rdi + 0x18], 8
jb 0x14028ec69
mov rdi, qword [rdi]
mov eax, dword [rbp - 0x49]
lea r9, str.Failed_to_change_the_service__ws_launch_protected_level_to__d.
mov rcx, qword [rbp + 0x5f]
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov dword [rsp + 0x28], eax
mov edx, 0x232
mov qword [rsp + 0x20], rdi
call fcn.1402297e4
mov esi, eax
jmp 0x14028ec98
mov esi, r15d
test rbx, rbx
je 0x14028ecac
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
mov eax, esi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140356560
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14028f384
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
cmp rdx, 0x400
jbe 0x14028f3cc
lea rbx, [rdx - 0x401]
shr rbx, 0xa
inc rbx
imul rax, rbx, 0xfffffffffffffc00
add rdi, rax
mov r8d, 0x400
lea rdx, [0x1403fd080]
call fcn.14028f214
mov ecx, eax
sub rbx, 1
jne 0x14028f3b2
mov r8, rdi
lea rdx, [0x1403fd080]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14028f214

Function at 0x140291900
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rdx + 0x10]
test rax, rax
jne 0x140291945
call fcn.140329e68
mov rax, qword [rdi + 0x10]
test rax, rax
jne 0x140291945
and qword [rbx], rax
and qword [rbx + 8], rax
and qword [rbx + 0x10], rax
jmp 0x1402919f5
and dword [rsp + 0x78], 0
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140291957
mov rcx, qword [rdi]
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, eax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
nop dword [rax + rax]
test eax, eax
je 0x140291a50
mov edx, dword [rsp + 0x78]
lea rcx, [rsp + 0x48]
call fcn.140083118
nop
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x1402919a7
mov rdi, qword [rdi]
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x48]
mov r9, rsi
mov r8d, 1
mov edx, eax
mov rcx, rdi
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
nop dword [rax + rax]
test eax, eax
je 0x140291a0a
mov qword [rbx], rsi
mov rax, qword [rsp + 0x50]
mov qword [rbx + 8], rax
mov rax, qword [rsp + 0x58]
mov qword [rbx + 0x10], rax
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
nop
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14004f7b4
mov r9d, eax
mov rcx, qword [rsp + 0x68]
lea rax, str.CertificateUtils::ConvertBase64StringToByteArray_failed_conversion
mov qword [rsp + 0x20], rax
lea r8, str.amcorewcd_sourcecommoncertificateutilscertificateutils.cpp
mov edx, 0x3e
call fcn.1400545b8
nop
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14004f7b4
mov r9d, eax
mov rcx, qword [rsp + 0x68]
lea rax, str.CertificateUtils::ConvertBase64StringToByteArray_failed_to_calculate_needed_size_of_converted_message
mov qword [rsp + 0x20], rax
lea r8, str.amcorewcd_sourcecommoncertificateutilscertificateutils.cpp
mov edx, 0x2f
call fcn.1400545b8
int3