joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140150e70
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [section..data]
mov rdi, rax
test rax, rax
jne 0x140150eb2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140150ef9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140150f52
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x140150f10
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x140150f93
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1401672aa]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1401672ab]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140150f60
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x140150fe0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.DLL_GetLocaleInfoEx]
test eax, eax
jne 0x14015101a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14015101f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.DLL_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140151068
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x140151068
dec r8
sub rdx, 1
jne 0x14015104e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140152544
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test rax, rax
je 0x14015258e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14015258e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14015258e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14015258e
cmp dword [rcx + 0x84], 0xe
jbe 0x14015258e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140152590
xor al, al
add rsp, 0x28
ret
Function at 0x14001acc0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140032738], rbx
je 0x14001ad27
cmp rax, rbx
jne 0x14001ad1a
mov ebx, 1
mov esi, ebx
jmp 0x14001ad2c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14001acff
mov ebx, 1
mov eax, dword [0x140032740]
cmp eax, ebx
jne 0x14001ad44
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14001adb0
mov eax, dword [0x140032740]
test eax, eax
jne 0x14001ada5
mov dword [0x140032740], ebx
lea r15, [0x1400206d8]
lea rdi, [0x1400206c0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14001ad97
test eax, eax
jne 0x14001ad9b
cmp qword [rdi], r14
je 0x14001ad8c
mov rax, qword [rdi]
mov rcx, qword [0x140020620]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14001ad6e
test eax, eax
je 0x14001adab
mov eax, 0xff
jmp 0x14001af06
mov dword [0x140031ff0], ebx
mov edi, 0x1f
mov eax, dword [0x140032740]
cmp eax, ebx
jne 0x14001add7
lea rdx, [0x1400206b8]
lea rcx, [0x140020628]
call sub.msvcrt.dll__initterm
mov dword [0x140032740], 2
test esi, esi
jne 0x14001ade5
mov rax, r14
xchg qword [0x140032738], rax
cmp qword [0x140032758], r14
je 0x14001ae18
lea rcx, [0x140032758]
call fcn.14001b3b0
test eax, eax
je 0x14001ae18
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140032758]
mov r9, qword [0x140020620]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14001ae31
mov eax, 0xff
jmp 0x14001af06
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14001aeb7
test ax, ax
je 0x14001ae4c
test edx, edx
jne 0x14001aeb7
sub ax, bx
cmp ax, di
ja 0x14001ae62
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14001ae4c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140004034
mov dword [0x140031fec], eax
cmp dword [0x140032010], r14d
jne 0x14001aea0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140031ff0], r14d
jne 0x14001aeb5
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140031fec]
jmp 0x14001af06
cmp ax, 0x22
jne 0x14001aecb
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14001ae3a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.1401a4000
add rsp, 0x28
jmp 0x14001acc0
Function at 0x1800099f4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180009a24
xor eax, eax
jmp 0x180009ae7
mov rbp, rbx
cmp word [rax], si
je 0x180009a49
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180009a30
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180009a2c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180009914
movsxd r14, eax
test eax, eax
jne 0x180009a87
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180009a1d
mov rcx, r14
call fcn.180007d1c
mov rdi, rax
test rax, rax
jne 0x180009aa0
xor ecx, ecx
call fcn.180007d7c
jmp 0x180009a7c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180009914
test eax, eax
jne 0x180009ad1
mov rcx, rdi
call fcn.180007d7c
jmp 0x180009adb
xor ecx, ecx
call fcn.180007d7c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18000f120
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18000f148
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18000f148
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001c80
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
xor esi, esi
lea rax, vtable.IPCService.0
mov rbx, rcx
mov dword [rcx + 0xc0], 0xffffffff
mov qword [rcx], rax
mov qword [rcx + 0xc8], rsi
mov qword [rcx + 0xd0], rsi
mov dword [rcx + 0xc4], esi
add rcx, 8
xor edx, edx
mov r8d, 0xa0
call fcn.140006c90
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.140004680
lea rcx, [rbx + 0xb8]
lea rdx, str.GlobalEEU_Memory_Map_Mutex
mov dword [rbx + 0xd8], esi
call fcn.140004ec0
test eax, eax
jne 0x140001d25
mov rcx, qword [0x1400397c0]
test rcx, rcx
je 0x140001e40
lea r9, str.CreateMutex_failed.
mov edx, 0x60004008
mov r8d, 1
call fcn.140003680
jmp 0x140001e40
xor r9d, r9d
lea rax, str.GlobalEEU_Memory_Map
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r8d, [r9 + 4]
xor ecx, ecx
mov dword [rsp + 0x20], 0x19e0
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rbx + 0xa8], rax
test rax, rax
jne 0x140001d72
mov rcx, qword [0x1400397c0]
test rcx, rcx
je 0x140001e40
lea r9, str.CreateFileMapping_failed.
jmp 0x140001d10
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
mov qword [rsp + 0x20], 0x19e0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0xb0], rax
test rax, rax
jne 0x140001db6
mov rcx, qword [0x1400397c0]
test rcx, rcx
je 0x140001e40
lea r9, str.MapViewOfFile_failed.
jmp 0x140001d10
xor edx, edx
mov r8d, 0x19e0
mov rcx, rax
call fcn.140006c90
mov rax, qword [rbx + 0xb0]
lea rdx, [rsp + 0x80]
lea rcx, str.ClientStatusMonitoring
mov dword [rax], 7
call fcn.140003fe0
test eax, eax
je 0x140001e36
cmp dword [rsp + 0x80], esi
je 0x140001e36
lea r8, [0x1400027a0]
lea rcx, [rbx + 0xd0]
mov r9, rbx
mov edx, 8
call fcn.140005040
test eax, eax
jne 0x140001e36
mov rcx, qword [0x1400397c0]
test rcx, rcx
je 0x140001e40
lea r9, str.CreateTheThread_for_GetClientStatusThread_failed.
lea r8d, [rax + 1]
mov edx, 0x60004002
call fcn.140003680
jmp 0x140001e40
mov dword [rbx + 0xc8], 1
lea r11, [rsp + 0x70]
mov rax, rbx
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400025a0
Capabilities:
Get session information

Disassembly:
push rbx
sub rsp, 0x40
cmp dword [rcx + 0xd8], 0
mov rbx, rcx
jne 0x14000278c
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
xor ebp, ebp
nop word [rax + rax]
lea rcx, [0x1400397a0]
mov edx, 0x3a98
call fcn.140005020
cmp eax, 0x102
jne 0x14000277d
cmp dword [rbx + 0xd8], ebp
jne 0x14000277d
cmp dword [rbx + 0xc0], 0xffffffff
je 0x140002771
cmp dword [rbx + 0xcc], ebp
je 0x140002618
mov dword [rbx + 0xcc], ebp
jmp 0x140002771
lea rcx, [rbx + 0xb8]
call fcn.140004e90
test eax, eax
jne 0x140002652
mov rcx, qword [0x1400397c0]
test rcx, rcx
je 0x140002771
lea r9, str.IPCService::GetClientStatusLoop_AcquireTheMutex_failed.
lea r8d, [rax + 1]
mov edx, 0x60004008
call fcn.140003680
jmp 0x140002771
mov rax, qword [rbx + 0xb0]
mov edx, dword [rbx + 0xc0]
lea rcx, [rbx + 0xb8]
mov edi, dword [rax + rdx*4 + 4]
lea r8, [rax + rdx*4]
mov eax, edi
and eax, 0xfffffffe
mov dword [r8 + 4], eax
call fcn.140004f40
test dil, 1
jne 0x140002771
test dil, 4
jne 0x140002771
mov edx, dword [rbx + 0xc0]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov r8d, 8
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x58], rbp
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x140002771
mov rcx, qword [rsp + 0x58]
cmp dword [rcx], 2
jb 0x1400026d3
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x140002771
call sub.WTSAPI32.dll_WTSFreeMemory
mov edx, dword [rbx + 0xc0]
mov rcx, rbx
call fcn.140002530
test eax, eax
jne 0x140002719
mov rcx, qword [0x1400397c0]
test rcx, rcx
je 0x140002771
mov eax, dword [rbx + 0xc0]
lea r9, str.Create_client_event_failed_for_session_id_u.
mov edx, 0x60004003
mov r8d, 1
mov dword [rsp + 0x20], eax
call fcn.140003680
jmp 0x140002771
mov ecx, dword [rbx + 0xc0]
call fcn.140002ba0
mov rcx, qword [0x1400397c0]
test eax, eax
je 0x14000274e
test rcx, rcx
je 0x140002771
mov r9d, dword [rbx + 0xc0]
lea r8, str.Client_started_for_session_id__u__because_status_was_not_running_
mov edx, 4
call fcn.140003920
jmp 0x140002771
test rcx, rcx
je 0x140002771
mov eax, dword [rbx + 0xc0]
lea r9, str.Client_for_session_id__u_has_to_be_relaunched.
xor r8d, r8d
mov edx, 0x40004003
mov dword [rsp + 0x20], eax
call fcn.140003680
cmp dword [rbx + 0xd8], ebp
je 0x1400025d0
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rbx
ret
Function at 0x140002800
Capabilities:
Enumerate process modules
Enumerate processes on remote desktop session host

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x250
xor ebp, ebp
lea rax, [rax + 0x18]
mov rdi, rdx
mov dword [rax], ebp
mov esi, ecx
lea r9, [rsp + 0x30]
lea r8d, [rbp + 1]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rbp
call sub.WTSAPI32.dll_WTSEnumerateProcessesA
test eax, eax
jne 0x14000286a
mov rcx, qword [0x1400397c0]
test rcx, rcx
je 0x140002995
lea r9, str.WTSEnumerateProcesses_failed.
lea r8d, [rbp + 1]
mov edx, 0x60004002
call fcn.140003680
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x270], rbx
mov ebx, ebp
cmp dword [rsp + 0x280], ebx
jbe 0x140002983
cmp qword [rdi], rbp
jne 0x140002983
mov eax, ebx
lea rcx, [rax + rax*2]
mov rax, qword [rsp + 0x30]
cmp dword [rax + rcx*8], esi
jne 0x140002974
mov r8d, dword [rax + rcx*8 + 4]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140002974
lea r9, [rsp + 0x288]
lea rdx, [rsp + 0x40]
mov r8d, 8
mov rcx, rax
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x288], ebp
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x14000296a
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x200
call fcn.140006c90
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x50]
mov r9d, 0x200
call sub.PSAPI.DLL_GetModuleBaseNameA
lea rdx, str.winlogon.exe
lea rcx, [rsp + 0x50]
mov r8d, 0xc
call fcn.140007624
test eax, eax
jne 0x14000296a
mov rcx, qword [rsp + 0x38]
lea edx, [rax + 0xf]
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14000296a
mov rcx, qword [0x1400397c0]
test rcx, rcx
je 0x14000296a
lea r9, str.OpenProcessToken_failed.
lea r8d, [rax + 1]
mov edx, 0x60004002
call fcn.140003680
lea rcx, [rsp + 0x38]
call fcn.140004650
inc ebx
cmp ebx, dword [rsp + 0x280]
jb 0x140002881
mov rcx, qword [rsp + 0x30]
call sub.WTSAPI32.dll_WTSFreeMemory
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400029a0
Capabilities:
Create service
Persist via windows service

Disassembly:
push rbx
sub rsp, 0x180
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
jne 0x1400029d6
lea rcx, str.SCM_could_not_be_opened.
call fcn.140007448
xor eax, eax
add rsp, 0x180
pop rbx
ret
lea rdx, [rsp + 0x70]
mov r8d, 0x104
xor ecx, ecx
mov qword [rsp + 0x190], rdi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
lea rax, str.Event_log
lea r8, str.AMD_External_Events_Utility
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
lea rdx, str.AMD_External_Events_Utility
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov r9d, 0x10
mov rcx, rbx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x110
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rdi, rax
test rax, rax
jne 0x140002a8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Service_could_not_be_created.__GetLastError___i_n
mov edx, eax
call fcn.140007448
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x190]
xor eax, eax
add rsp, 0x180
pop rbx
ret
lea rcx, str.Service_has_been_installed_successfully._n
call fcn.140007448
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x190]
mov eax, 1
add rsp, 0x180
pop rbx
ret

Function at 0x140002ac0
Capabilities:
Delete service

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
jne 0x140002af0
lea rcx, str.SCM_could_not_be_opened.
call fcn.140007448
xor eax, eax
add rsp, 0x20
pop rbx
ret
lea rdx, str.AMD_External_Events_Utility
mov r8d, 0x10000
mov rcx, rax
mov qword [rsp + 0x30], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
jne 0x140002b35
lea rcx, str.Service_could_not_be_opened._n
call fcn.140007448
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140002b6d
lea rcx, str.Service_could_not_be_deleted._n
call fcn.140007448
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
lea rcx, str.Service_has_been_deleted_successfully._n
call fcn.140007448
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x140002ba0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rdi
sub rsp, 0xf0
xor ebp, ebp
lea rdx, [rax + 0x10]
mov edi, ecx
lea ebx, [rbp + 1]
mov qword [rax + 0x10], rbp
call fcn.140002800
cmp qword [rsp + 0x108], rbp
jne 0x140002bfc
mov rcx, qword [0x1400397c0]
test rcx, rcx
je 0x140002bf5
lea r9, str.GetSystemToken_failed_to_get_a_token.__Session_id__u
xor r8d, r8d
mov edx, 0x60004002
mov dword [rsp + 0x20], edi
call fcn.140003680
xor eax, eax
jmp 0x140002cdb
xor eax, eax
lea rcx, [rsp + 0x80]
xor edx, edx
lea r8d, [rax + 0x68]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
call fcn.140006c90
mov rcx, qword [rsp + 0x108]
lea rax, str.WinSta0Default
lea r8, str.atieclxx
xor r9d, r9d
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x80], 0x68
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], 0x20
mov dword [rsp + 0x28], ebp
mov word [rsp + 0xc0], bp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x140002cb8
mov rcx, qword [0x1400397c0]
test rcx, rcx
je 0x140002cb6
lea r9, str.CreateProcessAsUser_failed.__Session_id__u
mov r8d, ebx
mov edx, 0x60004002
mov dword [rsp + 0x20], edi
call fcn.140003680
mov ebx, ebp
lea rcx, [rsp + 0x60]
call fcn.140004650
lea rcx, [rsp + 0x108]
call fcn.140004650
lea rcx, [rsp + 0x68]
call fcn.140004650
mov eax, ebx
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140002cf0
Capabilities:
Get session information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, vtable.Service.0
xor edx, edx
mov rbx, rcx
mov qword [rcx], rax
lea rsi, [0x1400397e0]
lea r8d, [rdx + 0x50]
mov rcx, rsi
call fcn.140006c90
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov edi, eax
cmp eax, 0x13
ja 0x140002e39
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x48]
mov r8d, 8
mov edx, edi
xor ecx, ecx
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x140002e39
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx]
test eax, eax
jne 0x140002d75
mov dword [rsi + rdi*4], 3
jmp 0x140002d81
cmp eax, 1
jne 0x140002e34
mov dword [rsi + rdi*4], eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov rcx, qword [0x1400397b8]
mov edx, edi
call fcn.1400027d0
mov rcx, qword [0x1400397b8]
mov edx, edi
call fcn.140002530
test eax, eax
jne 0x140002de2
mov rcx, qword [0x1400397c0]
test rcx, rcx
je 0x140002e39
lea r9, str.Create_client_event_failed_for_session_id_u.
lea r8d, [rax + 1]
mov edx, 0x60004003
mov dword [rsp + 0x20], edi
call fcn.140003680
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov ecx, edi
call fcn.140002ba0
test eax, eax
je 0x140002e0d
mov rcx, qword [0x1400397c0]
test rcx, rcx
je 0x140002e0d
lea r8, str.Client_started_at_service_start_time_for_session_id__u
mov r9d, edi
mov edx, 4
call fcn.140003920
mov rcx, qword [0x1400397b8]
xor r8d, r8d
mov edx, 0x200
call fcn.140001f30
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call sub.WTSAPI32.dll_WTSFreeMemory
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140003450
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x130
lea rax, vtable.LogMsg.0
mov rsi, rdx
mov rbx, rcx
mov qword [rcx], rax
xor eax, eax
lea rdx, [r11 + 8]
mov qword [rcx + 0x10c], rax
mov qword [rcx + 0x118], rax
lea rcx, str.LogOutputDebug
mov rbp, r8
mov dword [r11 + 8], eax