joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005c04
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rdi
mov qword [r11 + 0x18], r12
mov qword [r11 + 0x20], r13
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r13, r9
mov r15, r8
mov r14, rdx
mov r12, rcx
lea rax, section..data
mov rcx, qword [section..data]
cmp rcx, rax
je 0x140005c6a
test byte [rcx + 0x1c], 1
je 0x140005c6a
cmp byte [rcx + 0x19], 5
jb 0x140005c6a
mov edx, 0x4a
mov qword [r11 - 0x58], r8
mov r9, r14
lea r8, [0x1400afc70]
mov rcx, qword [rcx + 0x10]
call fcn.140052630
xor eax, eax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov rdx, r14
lea rcx, [rbp - 0x28]
call fcn.140017070
nop
lea rcx, [rbp - 0x28]
call fcn.140007760
mov rbx, qword [rbp - 0x28]
mov r8, rbx
lea rdx, [rbp - 0x20]
mov rcx, r12
call fcn.140006740
mov edi, eax
test eax, eax
jne 0x140005d32
mov dword [rbp - 0x30], 4
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x28]
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x140005d23
cmp eax, 2
jne 0x140005d5d
mov edi, 0x490
mov r10, qword [section..data]
lea r14, section..data
cmp r10, r14
je 0x140005da5
test byte [r10 + 0x1c], al
je 0x140005d6b
cmp byte [r10 + 0x19], 4
jb 0x140005d6b
lea edx, [rax + 0x49]
lea r8, [0x1400afc70]
mov rcx, qword [r10 + 0x10]
call fcn.140045cf4
jmp 0x140005d64
mov eax, dword [rbp - 0x28]
sub eax, 4
neg eax
sbb edi, edi
and edi, 0xd
jmp 0x140005d5d
cmp eax, 2
jne 0x140005d5d
mov rax, qword [r12]
movabs r10, 0x9f351e90765dd070
mov r9, r13
mov r8, r15
mov rdx, r14
mov rcx, r12
mov rax, qword [rax + 0x38]
call qword [case.0x140028cb6.0]
mov edi, eax
lea r14, section..data
mov r10, qword [section..data]
cmp r10, r14
je 0x140005da5
test byte [r10 + 0x1c], 1
je 0x140005da5
movzx edx, byte [r10 + 0x19]
mov eax, edi
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jb 0x140005da5
mov edx, 0x4c
mov r9d, edi
lea r8, [0x1400afc70]
mov rcx, qword [r10 + 0x10]
call fcn.1400438d8
nop
lea rcx, [rbx - 0x18]
call fcn.14000ccd0
nop
cmp qword [rbp - 0x20], 0
je 0x140005dc6
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140034dc8
Capabilities:
Get session information
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
mov rcx, qword [section..data]
lea rsi, section..data
cmp rcx, rsi
je 0x140034e0e
test byte [rcx + 0x1c], 1
je 0x140034e0e
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400ae358]
mov edx, 0x105
call fcn.140045cf4
xor r13d, r13d
lea rax, [rbp + 0x48]
mov edi, 1
mov qword [rbp + 0x58], r13
mov r8d, edi
mov dword [rbp + 0x48], r13d
lea r9, [rbp + 0x58]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ext_ms_win_session_wtsapi32_l1_1_0.dll_WTSEnumerateSessionsW]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [section..data]
cmp rcx, rsi
je 0x140034e87
test byte [rcx + 0x1c], 2
je 0x140034e87
cmp byte [rcx + 0x19], 5
jb 0x140034e87
mov eax, dword [rbp + 0x48]
lea r8, [0x1400ae358]
mov rcx, qword [rcx + 0x10]
mov edx, 0x106
mov dword [rsp + 0x28], eax
mov r9d, ebx
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.140052c88
mov rcx, qword [section..data]
test ebx, ebx
je 0x140034fb4
cmp dword [rbp + 0x48], r13d
jne 0x140034e9d
mov edi, r13d
jmp 0x140034f99
mov r14d, r13d
lea rdi, section..data
mov r15d, r13d
mov esi, r13d
cmp esi, dword [rbp + 0x48]
jae 0x140034f81
mov rdx, qword [rbp + 0x58]
mov eax, esi
lea rbx, [rax + rax*2]
mov ecx, dword [rdx + rbx*8 + 0x10]
test ecx, ecx
je 0x140034ed6
sub ecx, 3
je 0x140034ed6
cmp ecx, 1
jne 0x140034f76
mov qword [rbp + 0x60], r13
lea rax, [rbp + 0x50]
mov dword [rbp + 0x50], r13d
lea r9, [rbp + 0x60]
mov edx, dword [rdx + rbx*8]
mov r8d, 5
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ext_ms_win_session_wtsapi32_l1_1_0.dll_WTSQuerySessionInformationW]
nop dword [rax + rax]
mov r12d, eax
mov rcx, qword [section..data]
cmp rcx, rdi
je 0x140034f42
test byte [rcx + 0x1c], 2
je 0x140034f42
cmp byte [rcx + 0x19], 5
jb 0x140034f42
mov rax, qword [rbp + 0x60]
mov r9d, esi
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x58]
mov dword [rsp + 0x28], r12d
mov edx, dword [rax + rbx*8]
mov dword [rsp + 0x20], edx
call fcn.1400529c8
test r12d, r12d
je 0x140034f70
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x140034f70
movzx ebx, word [rcx]
call qword [sym.imp.ext_ms_win_session_wtsapi32_l1_1_0.dll_WTSFreeMemory]
nop dword [rax + rax]
lea eax, [r14 + 1]
cmp r13w, bx
cmove eax, r14d
mov r14d, eax
jmp 0x140034f76
mov r15d, 1
inc esi
test r14d, r14d
je 0x140034ead
lea rsi, section..data
mov edi, 1
test r15d, r15d
jne 0x140034f99
test r14d, r14d
cmove edi, r13d
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ext_ms_win_session_wtsapi32_l1_1_0.dll_WTSFreeMemory]
nop dword [rax + rax]
mov rcx, qword [section..data]
mov qword [rbp + 0x58], r13
cmp rcx, rsi
je 0x140034fdd
test byte [rcx + 0x1c], 1
je 0x140034fdd
cmp byte [rcx + 0x19], 5
jb 0x140034fdd
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400ae358]
mov edx, 0x108
mov r9d, edi
call fcn.140043960
mov eax, edi
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140038478
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [section..data]
lea r14, section..data
lea r15, [0x1400ae6b0]
cmp rcx, r14
je 0x1400384d0
test byte [rcx + 0x1c], 1
je 0x1400384d0
cmp byte [rcx + 0x19], 5
jb 0x1400384d0
mov rcx, qword [rcx + 0x10]
mov edx, 0xa
mov r9, rdi
mov qword [rsp + 0x20], rsi
mov r8, r15
call fcn.140063b74
xor edx, edx
mov r8d, 0x80
mov rcx, rsi
xor ebx, ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
and qword [rsp + 0x90], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x30], 4
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
mov rcx, qword [section..data]
cmp rcx, r14
je 0x14003852e
test byte [rcx + 0x1c], 2
je 0x14003852e
cmp byte [rcx + 0x19], 5
jb 0x14003852e
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0xb]
mov r9, rdi
mov r8, r15
call fcn.140043490
lea r9, [rsp + 0x90]
xor edx, edx
lea r8, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
nop dword [rax + rax]
test eax, eax
jg 0x140038556
je 0x1400385a7
mov ebx, eax
jmp 0x14003855f
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
mov ecx, 0x80004005
cmovns ebx, ecx
mov rcx, qword [section..data]
cmp rcx, r14
je 0x140038625
test byte [rcx + 0x1c], 2
je 0x140038625
cmp byte [rcx + 0x19], 2
jb 0x140038625
mov rcx, qword [rcx + 0x10]
mov edx, SafeArrayGetDim
mov r9d, ebx
mov dword [rsp + 0x20], eax
mov r8, r15
call fcn.140052810
jmp 0x140038625
mov rax, qword [rsp + 0x90]
mov r9, qword [rax + 0x10]
cmp r9, 0x80
jbe 0x1400385e4
mov rcx, qword [section..data]
cmp rcx, r14
je 0x1400385dd
test byte [rcx + 0x1c], 2
je 0x1400385dd
cmp byte [rcx + 0x19], 2
jb 0x1400385dd
mov rcx, qword [rcx + 0x10]
call fcn.14009f008
mov ebx, 0x80004005
jmp 0x140038625
mov rcx, qword [section..data]
cmp rcx, r14
je 0x14003860d
test byte [rcx + 0x1c], 2
je 0x14003860d
cmp byte [rcx + 0x19], 5
jb 0x14003860d
mov rcx, qword [rcx + 0x10]
mov edx, SafeArrayGetDim
mov r8, r15
call fcn.14004391c
mov rdx, qword [rsp + 0x90]
mov rcx, rsi
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.WS2_32.dll_FreeAddrInfoW]
nop dword [rax + rax]
mov r10, qword [section..data]
cmp r10, r14
je 0x140038685
test byte [r10 + 0x1c], 1
je 0x140038685
movzx eax, byte [r10 + 0x19]
mov ecx, ebx
sar ecx, 0x1f
and ecx, 0xfffffffd
add ecx, 5
cmp eax, ecx
jl 0x140038685
test ebx, ebx
js 0x140038669
movzx eax, word [rsi]
jmp 0x14003866c
or eax, 0xffffffff
mov rcx, qword [r10 + 0x10]
mov edx, reloc.OLEAUT32.dll_SafeArrayDestroy
mov r9d, ebx
mov word [rsp + 0x20], ax
mov r8, r15
call fcn.14009f17c
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14003aaa8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
nop dword [rax + rax]
test rax, rax
je 0x14003ab31
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14003ab31
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
nop dword [rax + rax]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x14003ab1e
cmp rbx, rcx
jae 0x14003ab31
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x14003ab09
cmp rbx, rcx
jae 0x14003ab31
movzx eax, word [rbx]
neg ax
sbb rax, rax
and rax, rbx
jmp 0x14003ab33
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14003ac44
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [r11 + 8]
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x20]
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x14003ac7f
add rsp, 0x38
ret
mov eax, dword [rsp + 0x58]
sub eax, 4
neg eax
sbb eax, eax
and eax, 0xd
jmp 0x14003ac79
Function at 0x14003cf34
Capabilities:
Get local ipv4 addresses

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov ebp, ecx
mov r10, qword [section..data]
lea r13, section..data
cmp r10, r13
je 0x14003cf92
test byte [r10 + 0x1c], 2
je 0x14003cf92
cmp byte [r10 + 0x19], 5
jb 0x14003cf92
mov r9d, ecx
lea r8, [0x1400acf88]
mov rcx, qword [r10 + 0x10]
mov edx, 0x1c
call fcn.140045d20
mov r10, qword [section..data]
xor ebx, ebx
mov dword [rsp + 0x68], ebx
mov edi, ebx
mov ecx, ebx
test rsi, rsi
jne 0x14003cfab
mov edi, 0x80070057
jmp 0x14003d0c5
xor r9d, r9d
mov qword [rsi], rbx
lea rax, [rsp + 0x68]
xor r8d, r8d
mov ecx, ebp
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0xe]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
nop dword [rax + rax]
mov r15d, 0xa
cmp eax, 0x6f
jne 0x14003d017
mov rcx, qword [rsi]
call fcn.140044524
mov ecx, dword [rsp + 0x68]
call fcn.140044530
lea rcx, [rsp + 0x68]
mov qword [rsi], rax
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov r9, rax
mov ecx, ebp
lea edx, [r8 + 0xe]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
nop dword [rax + rax]
add r15d, 0xffffffff
jne 0x14003cfd6
test eax, eax
je 0x14003d077
jg 0x14003d021
mov edi, eax
jmp 0x14003d02a
movzx edi, ax
or edi, 0x80070000
test edi, edi
mov ecx, 0x80004005
cmovns edi, ecx
mov r10, qword [section..data]
cmp r10, r13
je 0x14003d0af
test byte [r10 + 0x1c], 0x20
je 0x14003d071
cmp byte [r10 + 0x19], 2
jb 0x14003d071
mov rcx, qword [r10 + 0x10]
lea r8, [0x1400acf88]
mov edx, 0x1e
mov dword [rsp + 0x20], eax
mov r9d, edi
call fcn.140052810
mov r10, qword [section..data]
test edi, edi
js 0x14003d0af
jmp 0x14003d07e
mov r10, qword [section..data]
mov ecx, dword [rsp + 0x68]
cmp ecx, 0x1c0
jae 0x14003d0c5
mov edi, 0x8000ffff
cmp r10, r13
je 0x14003d0af
test byte [r10 + 0x1c], 0x20
je 0x14003d0af
cmp byte [r10 + 0x19], 2
jb 0x14003d0af
mov dword [rsp + 0x20], ecx
mov rcx, qword [r10 + 0x10]
call fcn.1400a2a3c
mov rcx, qword [rsi]
call fcn.140044524
mov ecx, dword [rsp + 0x68]
mov r10, qword [section..data]
mov qword [rsi], rbx
test r14, r14
je 0x14003d0db
test edi, edi
mov eax, ebx
cmovns eax, ecx
mov dword [r14], eax
mov r10, qword [section..data]
cmp r10, r13
je 0x14003d130
test byte [r10 + 0x1c], 2
je 0x14003d130
movzx eax, byte [r10 + 0x19]
mov ecx, edi
sar ecx, 0x1f
and ecx, 0xfffffffd
add ecx, 5
cmp eax, ecx
jl 0x14003d130
test r14, r14
je 0x14003d105
mov eax, dword [r14]
jmp 0x14003d107
mov eax, ebx
test rsi, rsi
je 0x14003d10f
mov rbx, qword [rsi]
mov rcx, qword [r10 + 0x10]
lea r8, [0x1400acf88]
mov dword [rsp + 0x28], eax
mov edx, 0x20
mov r9d, edi
mov qword [rsp + 0x20], rbx
call fcn.140052c88
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x14003f774
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, dword [r9]
mov rbx, r8
mov rcx, qword [rcx]
add eax, eax
mov dword [rsp + 0x40], eax
mov rdi, r9
lea rax, [r11 + 8]
xor esi, esi
mov dword [r9], esi
xor r8d, r8d
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x20]
mov qword [r11 - 0x18], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14003f7ec
mov eax, dword [rsp + 0x58]
dec eax
cmp eax, 1
ja 0x14003f7e7
mov ecx, dword [rsp + 0x40]
test rbx, rbx
je 0x14003f800
test ecx, ecx
je 0x14003f7fd
test cl, 1
jne 0x14003f7e7
mov eax, ecx
shr rax, 1
cmp word [rbx + rax*2 - 2], si
je 0x14003f800
mov eax, SafeArrayGetDim
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov word [rbx], si
shr ecx, 1
mov dword [rdi], ecx
xor eax, eax
jmp 0x14003f7ec

Function at 0x140044b00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140044b4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140044b4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140044b4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140044b4a
cmp dword [rcx + 0x84], 0xe
jbe 0x140044b4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140044b4c
xor al, al
add rsp, 0x28
ret
Function at 0x14004870c
Capabilities:
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1400ca1c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov r9, rcx
mov rcx, qword [section..data]
lea rbp, section..data
cmp rcx, rbp
je 0x140048760
test byte [rcx + 0x1c], 1
je 0x140048760
cmp byte [rcx + 0x19], 5
jb 0x140048760
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rdx
call fcn.140049950
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x58], eax
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
nop dword [rax + rax]
xor ebx, ebx
lea r8, [rsp + 0x38]
mov esi, eax
mov dword [rsp + 0x30], ebx
lea rax, [rsp + 0x30]
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 0x24]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
nop dword [rax + rax]
lea r14, [0x1400afc60]
test eax, eax
jne 0x140048800
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov r10, qword [section..data]
cmp r10, rbp
je 0x1400488ba
test byte [r10 + 0x1c], 2
je 0x140048885
cmp byte [r10 + 0x19], 2
jb 0x140048885
mov rcx, qword [r10 + 0x10]
mov edx, 0x3a
mov r9d, eax
mov r8, r14
call fcn.1400438d8
jmp 0x14004887e
cmp dword [rsp + 0x3c], 1
jne 0x140048838
mov r10, qword [section..data]
cmp r10, rbp
je 0x1400488ba
test byte [r10 + 0x1c], 2
je 0x140048885
cmp byte [r10 + 0x19], 5
jb 0x140048885
mov rcx, qword [r10 + 0x10]
mov edx, 0x3b
mov r8, r14
call fcn.140045cf4
jmp 0x14004887e
cmp dword [rsp + 0x3c], 3
jne 0x1400488df
mov rcx, qword [section..data]
cmp rcx, rbp
je 0x14004886c
test byte [rcx + 0x1c], 2
je 0x14004886c
cmp byte [rcx + 0x19], 5
jb 0x14004886c
mov rcx, qword [rcx + 0x10]
mov edx, 0x3c
mov r8, r14
call fcn.140045cf4
mov r8d, esi
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.14004917c
mov ebx, eax
mov r10, qword [section..data]
cmp r10, rbp
je 0x1400488ba
test byte [r10 + 0x1c], 1
je 0x1400488ba
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jb 0x1400488ba
mov rcx, qword [r10 + 0x10]
mov edx, 0x3e
mov r9d, ebx
mov r8, r14
call fcn.1400438d8
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140044080
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov rcx, qword [section..data]
cmp rcx, rbp
je 0x140048908
test byte [rcx + 0x1c], 2
je 0x140048908
cmp byte [rcx + 0x19], 5
jb 0x140048908
mov rcx, qword [rcx + 0x10]
mov edx, 0x3d
mov r8, r14
call fcn.140045cf4
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
nop dword [rax + rax]
test eax, eax
jne 0x14004886c
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
jmp 0x14004887c
Function at 0x140048e28
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov ebp, r8d
mov r14, rdx
mov r15, rcx
mov r10, qword [section..data]
lea r12, section..data
cmp r10, r12
je 0x140048e8e
test byte [r10 + 0x1c], 1
je 0x140048e8e
cmp byte [r10 + 0x19], 5
jb 0x140048e8e
mov dword [rax - 0x30], r8d
mov r9, rcx
mov rax, qword [rdx]
mov rcx, qword [r10 + 0x10]
mov qword [rsp + 0x20], rax
call fcn.140049864
mov r10, qword [section..data]
xor ebx, ebx
lea esi, [rbx + 1]
cmp r10, r12
je 0x140048ec0
test byte [r10 + 0x1c], 2
je 0x140048ec0
cmp byte [r10 + 0x19], 5
jb 0x140048ec0
mov rcx, qword [r10 + 0x10]
lea edx, [rbx + 0x2b]
lea r8, [0x1400afc60]
call fcn.140045cf4
mov r10, qword [section..data]
test esi, esi
je 0x14004903e
cmp r10, r12
je 0x140048ef6
test byte [r10 + 0x1c], 2
je 0x140048ef6
cmp byte [r10 + 0x19], 5
jb 0x140048ef6
mov rcx, qword [r10 + 0x10]
lea r8, [0x1400afc60]
mov edx, 0x2c
mov r9d, 0x1f4
call fcn.1400438d8
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax + rax]
mov rcx, qword [section..data]
cmp rcx, r12
je 0x140048f34
test byte [rcx + 0x1c], 2
je 0x140048f34
cmp byte [rcx + 0x19], 5
jb 0x140048f34
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400afc60]
mov edx, 0x2d
call fcn.140045cf4
mov rdx, qword [r14]
mov r8d, 1
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x140048f95
mov esi, 1
mov rcx, qword [section..data]
cmp rcx, r12
je 0x140048f84
test byte [rcx + 0x1c], 2
je 0x140048f84
cmp byte [rcx + 0x19], 5
jb 0x140048f84
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x2d]
lea r8, [0x1400afc60]
call fcn.140045cf4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop dword [rax + rax]
jmp 0x140048fc4
mov esi, ebx
mov rcx, qword [section..data]
cmp rcx, r12
je 0x140048fc4
test byte [rcx + 0x1c], 2
je 0x140048fc4
cmp byte [rcx + 0x19], 5
jb 0x140048fc4
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400afc60]
mov edx, 0x2f
call fcn.140045cf4
call qword [sym.imp.KERNEL32.dll_GetTickCount]
nop dword [rax + rax]
sub eax, ebp
cmp eax, 0xea60
jbe 0x140048eb9
mov ebx, 0x5b4
mov r10, qword [section..data]
cmp r10, r12
je 0x140049077
test byte [r10 + 0x1c], 2
je 0x14004903e
cmp byte [r10 + 0x19], 2
jb 0x14004903e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
nop dword [rax + rax]
mov rcx, qword [section..data]
lea r8, [0x1400afc60]
mov edx, 0x30
mov dword [rsp + 0x28], 0xea60
mov r9d, ebp
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.140049464
mov r10, qword [section..data]
cmp r10, r12
je 0x140049077
test byte [r10 + 0x1c], 1
je 0x140049077
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jb 0x140049077
mov rcx, qword [r10 + 0x10]
lea r8, [0x1400afc60]
mov edx, 0x31
mov r9d, ebx
call fcn.1400438d8
mov rcx, r14
call fcn.1400043f0
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x14004917c
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov dword [rax + 0x20], r9d
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov rsi, rdx
mov r14, rcx
mov r10, qword [section..data]
lea r12, section..data
cmp r10, r12
je 0x1400491dc
test byte [r10 + 0x1c], 1
je 0x1400491dc
cmp byte [r10 + 0x19], 5
jb 0x1400491dc
mov r9, rcx
mov dword [rax - 0x40], r8d
mov rcx, qword [r10 + 0x10]
mov qword [rax - 0x48], rdx
call fcn.1400499c0
mov r10, qword [section..data]
xor ebx, ebx
mov dword [rsp + 0x88], ebx
lea r13, [0x1400afc60]
cmp r10, r12
je 0x140049215
test byte [r10 + 0x1c], 2
je 0x140049215
cmp byte [r10 + 0x19], 5
jb 0x140049215
mov rcx, qword [r10 + 0x10]
lea edx, [rbx + 0x33]
mov r8, r13
call fcn.140045cf4
mov r10, qword [section..data]
cmp dword [rsi + 4], 1
mov eax, 0x1f4
je 0x140049390
mov edi, dword [rsi + 0x18]
cmp edi, 0x7530
jae 0x140049236
cmp edi, eax
cmovb edi, eax
jmp 0x14004923b
mov edi, 0x7530
cmp r10, r12
je 0x140049262
test byte [r10 + 0x1c], 2
je 0x140049262
cmp byte [r10 + 0x19], 5
jb 0x140049262
mov rcx, qword [r10 + 0x10]
mov edx, 0x34
mov r9d, edi
mov r8, r13
call fcn.1400438d8
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax + rax]
lea rax, [rsp + 0x88]
mov r9d, 0x24
mov r8, rsi
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
nop dword [rax + rax]
test eax, eax
je 0x14004934d
cmp dword [rsi + 4], 1
je 0x14004931c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
nop dword [rax + rax]
sub eax, ebp
mov edi, 0x7530
cmp eax, edi
jbe 0x14004920e
mov ebx, 0x5b4
mov r10, qword [section..data]
cmp r10, r12
je 0x1400493c5
test byte [r10 + 0x1c], 2
je 0x140049390
cmp byte [r10 + 0x19], 2
jb 0x140049390
call qword [sym.imp.KERNEL32.dll_GetTickCount]
nop dword [rax + rax]
mov rcx, qword [section..data]
mov edx, 0x37
mov dword [rsp + 0x28], edi
mov r9d, ebp
mov r8, r13
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.140049464
jmp 0x140049389
mov r10, qword [section..data]
cmp r10, r12
je 0x1400493c5
test byte [r10 + 0x1c], 2
je 0x140049390
cmp byte [r10 + 0x19], 5
jb 0x140049390
mov rcx, qword [r10 + 0x10]
mov edx, 0x36
mov r8, r13
call fcn.140045cf4
jmp 0x140049389
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov r10, qword [section..data]
cmp r10, r12
je 0x1400493c5
test byte [r10 + 0x1c], 2
je 0x140049390
cmp byte [r10 + 0x19], 2
jb 0x140049390
mov rcx, qword [r10 + 0x10]
mov edx, 0x35
mov r9d, eax
mov r8, r13
call fcn.1400438d8
mov r10, qword [section..data]
cmp r10, r12
je 0x1400493c5
test byte [r10 + 0x1c], 1
je 0x1400493c5
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jb 0x1400493c5
mov rcx, qword [r10 + 0x10]
mov edx, 0x38
mov r9d, ebx
mov r8, r13
call fcn.1400438d8
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret