joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000093dc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov r14d, 1
shr eax, 4
mov ebx, r8d
mov rsi, rcx
add ax, r14w
lea r8d, [r14 + 5]
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r13d, r13d
mov r12, rax
cmp rax, r13
je 0x100009552
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, r13
je 0x100009552
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
cmp rax, r13
je 0x100009552
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x100009488
cmp rdi, r11
jae 0x100009552
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x100009472
cmp rdi, r11
jae 0x100009552
cmp word [rdi], r13w
je 0x100009552
mov rax, qword [rsi]
movzx ebx, word [rdi]
mov ecx, r14d
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x1000094ba
mov edx, ebx
mov rcx, rsi
call fcn.100009594
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x1000094db
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
add ecx, r14d
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.10000f0c8
cmp eax, r13d
je 0x10000952a
cmp eax, 0xc
je 0x10000951f
cmp eax, 0x16
je 0x100009514
cmp eax, 0x22
je 0x100009514
cmp eax, 0x50
je 0x10000952a
mov ecx, 0x80004005
call fcn.1000096ec
int3
mov ecx, 0x80070057
call fcn.1000096ec
int3
mov ecx, 0x8007000e
call fcn.1000096ec
int3
cmp ebx, r13d
jl 0x100009547
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x100009547
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, r14d
mov word [rdi + rcx], r13w
jmp 0x100009554
mov ecx, 0x80070057
call fcn.1000096ec
int3
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret

Function at 0x100009a2c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
and dword [rsp + 0x40], 0
mov rbx, rcx
lea r8, [rsp + 0x50]
lea rdx, [0x100004960]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x50]
lea r11, [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], r11
lea rdx, [0x1000049a0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100009aad
cmp dword [rsp + 0x40], 3
jne 0x100009a9c
mov rcx, rbx
call fcn.100009cf0
jmp 0x100009aad
cmp dword [rsp + 0x40], 2
jne 0x100009aad
xor edx, edx
mov rcx, rbx
call fcn.100009f10
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9, qword [rbx + 0x38]
mov rcx, qword [0x10001ff18]
mov edx, 1
mov dword [rsp + 0x20], edx
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x100009ae4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
xor edi, edi
lea r8, [rax + 0x18]
and qword [rax + 0x18], rdi
and dword [rax + 8], edi
lea rdx, [0x1000049b8]
mov rcx, 0xffffffff80000002
mov dword [rax + 0x10], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x100009b5e
lea rax, [rsp + 0x48]
lea rdx, [0x1000049f0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
cmove edi, dword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbx + 0x1c], 0
jne 0x100009b7c
mov rcx, qword [rbx + 0x28]
lea rdx, [0x100009f88]
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerExW]
mov qword [rbx + 0x10], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x38], rax
test dil, 1
je 0x100009c01
lea rax, [0x10001ff18]
lea rdx, [0x100004960]
mov r9d, 0x10
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100009c01
mov r9, qword [rbx + 0x38]
mov rcx, qword [0x10001ff18]
lea edx, [rax + 1]
lea r8d, [rax + 5]
mov dword [0x10001ff24], 1
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x100009f10
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
and qword [rsp + 0x58], 0
and dword [rsp + 0x50], 0
mov ebx, edx
lea rdx, [0x1000049b8]
lea r8, [rsp + 0x58]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x100009f7a
lea rax, [rsp + 0x50]
mov r9d, 4
lea rdx, [0x100004a60]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x10000a610
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x280
mov rax, qword [0x10001d180]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, qword [rsp + 0x2d0]
xor r12d, r12d
mov ebp, r9d
mov rsi, r8
mov qword [rsp + 0x50], r12
cmp r8, r12
jne 0x10000a655
mov ebx, 0x80004003
jmp 0x10000a756
cmp rdi, r12
je 0x10000a64b
mov ebx, r12d
lea rcx, [rsp + 0x60]
cmp rdx, r12
je 0x10000a686
mov qword [rsp + 0x20], rdx
lea r9, [0x100004ba8]
lea r8, [0x100004be0]
mov edx, 0x104
call fcn.100006b70
jmp 0x10000a6cb
lea r8, [0x100004ba8]
lea rax, [rsp + 0x60]
mov edx, 0x104
sub r8, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, r12
je 0x10000a6be
movzx eax, word [r8 + rcx]
cmp ax, r12w
je 0x10000a6be
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10000a69a
cmp rdx, r12
jne 0x10000a6c7
sub rcx, 2
mov word [rcx], r12w
lea rax, [rsp + 0x58]
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r12d
jne 0x10000a737
mov eax, dword [rsp + 0x2d8]
mov rcx, qword [rsp + 0x50]
mov r9d, ebp
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r12d
je 0x10000a746
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r12d
cmovle ebx, eax
mov rcx, qword [rsp + 0x50]
cmp rcx, r12
je 0x10000a756
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.10000e9b0
add rsp, 0x280
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x10000a77c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xf0
mov rax, qword [0x10001d180]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov eax, dword [rcx + 0x128]
xor r13d, r13d
mov r12, rcx
and eax, 0xf
mov edi, r13d
lea r14d, [r13 + 4]
je 0x10000a7e1
cmp eax, 3
lea edi, [r13 + 1]
cmove edi, r14d
xor edx, edx
mov ecx, edi
call fcn.100007910
mov ecx, edi
call fcn.100007edc
mov ecx, edi
call fcn.10000869c
mov eax, dword [r12 + 0x128]
mov ebp, r13d
and eax, 0xf0
je 0x10000a7ff
mov ebp, 1
cmp eax, 0x30
cmove ebp, r14d
mov dword [rsp + 0x40], r13d
lea rbx, [0x100003640]
mov esi, 0x38
lea r9, [rbx + 0x44]
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov edx, esi
call fcn.1000071a4
cmp eax, r13d
jne 0x10000a867
cmp dword [rbx], r13d
jne 0x10000a833
mov dword [rsp + 0x40], edi
jmp 0x10000a841
mov eax, dword [rsp + 0x40]
cmp dword [rbx], 1
cmove eax, ebp
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x60]
lea rdx, [0x100004b90]
mov r9d, r14d
mov rcx, r12
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call fcn.10000a610
lea rax, [0x1000039e8]
add rbx, 0x1d4
cmp rbx, rax
jne 0x10000a810
mov ebx, 0x80004005
cmp qword [r12 + 0x120], r13
je 0x10000a969
mov rcx, qword [r12 + 0x120]
mov qword [rsp + 0x50], r13
lea r9, [rsp + 0x50]
mov rax, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x48], r13
cmp rcx, r13
je 0x10000a969
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x48]
cmp eax, r13d
jl 0x10000a916
lea rax, [rsp + 0x60]
mov r8, rcx
lea rdx, [rsp + 0x60]
sub r8, rax
lea rax, [rsi + 0x7fffffc6]
cmp rax, r13
je 0x10000a906
movzx eax, word [r8 + rdx]
cmp ax, r13w
je 0x10000a906
mov word [rdx], ax
add rdx, 2
sub rsi, 1
jne 0x10000a8e2
cmp rsi, r13
jne 0x10000a90f
sub rdx, 2
mov word [rdx], r13w
mov ebx, r13d
cmp rcx, r13
je 0x10000a926
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x48], r13
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x10000a936
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp ebx, r13d
jne 0x10000a969
lea rax, [rsp + 0x60]
lea r8, [0x100004b48]
lea rdx, [0x100004b70]
mov r9d, 1
mov rcx, r12
mov dword [rsp + 0x28], 0x70
mov qword [rsp + 0x20], rax
call fcn.10000a610
xor r9d, r9d
mov qword [rsp + 0x30], r13
lea rcx, [0x100004b00]
lea r8d, [r9 + 1]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [0x100004ad8]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x48]
lea rdx, [0x100004ad8]
lea r8d, [rax + rax + 2]
mov rcx, rbx
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.10000e9b0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x10000ba50
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
sub rsp, 0x40
xor ebx, ebx
xor edx, edx
xor ecx, ecx
lea r8d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x10000bbb8
lea r12, [0x100004500]
mov r8d, 0x10024
mov rcx, rax
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x10000bb85
lea r8, [rsp + 0x20]
lea edx, [rbx + 1]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x10000bb34
lea rcx, [0x100004f80]
mov rdx, r12
call fcn.10000ec98
jmp 0x10000badd
cmp eax, 3
jne 0x10000bafe
lea rcx, [0x100004f9c]
call fcn.10000ec98
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
mov eax, dword [rsp + 0x24]
jne 0x10000bacc
mov rdx, r12
cmp eax, 1
jne 0x10000bb14
lea rcx, [0x100004fa0]
call fcn.10000ec98
jmp 0x10000bb34
lea rcx, [0x100004fc0]
call fcn.10000ec98
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x10000bb52
lea rcx, [0x100004ff0]
mov rdx, r12
call fcn.10000ec98
jmp 0x10000bb7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100005010]
mov edx, eax
call fcn.10000ec98
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10000bbad
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100005050]
mov edx, eax
call fcn.10000ec98
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10000bbe0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100005088]
mov edx, eax
call fcn.10000ec98
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop r12
ret
Function at 0x10000bc00
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov ebp, edx
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x10000bc4b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
jmp 0x10000bcc7
lea rdx, [0x100004500]
mov r8d, 2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x10000bc89
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x10000bcc7
mov r8, rbx
mov edx, ebp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x10000bcb1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10000bcb3
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x10000c314
Capabilities:
Check for time delay via gettickcount
Enumerate services
Query service status

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xb0
mov qword [rsp + 0x30], rsp
mov rsi, rdx
mov r13, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12d, eax
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea r14d, [r9 + 1]
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
je 0x10000c378
mov eax, r14d
jmp 0x10000c553
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x10000c38c
xor eax, eax
jmp 0x10000c553
mov ebx, dword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x10000c553
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xf0]
mov r8, rdi
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x10000c40a
lea rdx, [0x10000c403]
mov rcx, qword [rsp + 0x30]
call fcn.1000188a0
nop
nop
xor eax, eax
jmp 0x10000c553
xor ebx, ebx
mov dword [rsp + 0x38], ebx
cmp ebx, dword [rsp + 0xf8]
jae 0x10000c53c
lea rdx, [rbx + rbx*2]
shl rdx, 4
lea rcx, [rsp + 0x78]
add rdx, rdi
mov r8d, 0x30
call fcn.100014160
mov r8d, 0x24
mov rdx, qword [rsp + 0x78]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x10000c473
lea rdx, [0x10000c46c]
mov rcx, qword [rsp + 0x30]
call fcn.1000188a0
nop
nop
xor eax, eax
jmp 0x10000c553
lea r8, [rsp + 0x50]
mov edx, r14d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x10000c4a3
lea rdx, [0x10000c49c]
mov rcx, qword [rsp + 0x30]
call fcn.1000188a0
nop
nop
nop
xor eax, eax
jmp 0x10000c553
cmp dword [rsp + 0x54], r14d
je 0x10000c527
mov ecx, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0xf0]
mov qword [rsp + 0x20], r11
mov r9d, 0x24
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x10000c4f3
lea rdx, [0x10000c4ef]
mov rcx, qword [rsp + 0x30]
call fcn.1000188a0
nop
nop
nop
xor eax, eax
jmp 0x10000c553
cmp dword [rsp + 0x54], r14d
je 0x10000c527
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r12d
cmp eax, 0x7530
jbe 0x10000c522
lea rdx, [0x10000c51e]
mov rcx, qword [rsp + 0x30]
call fcn.1000188a0
nop
nop
nop
xor eax, eax
jmp 0x10000c553
jmp 0x10000c4a3
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add ebx, r14d
mov dword [rsp + 0x38], ebx
jmp 0x10000c410
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, r14d
mov rbx, qword [rsp + 0xe0]
add rsp, 0xb0
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x10000d5f8
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
cmp qword [rcx + 0x20], rax
je 0x10000d610
mov eax, 0x80004005
jmp 0x10000d636
mov dword [rcx + 0x28], eax
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x10000d754]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x20], rax
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x10000e2d0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x10001d180]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.10000fbe0
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x100000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.10000fbe0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x10000e363
cmp dword [rsp + 0x24], 5
jb 0x10000e37d
jmp 0x10000e379
cmp dword [rsp + 0x30], esi
jne 0x10000e37d
cmp dword [rsp + 0x24], 4
ja 0x10000e379
jne 0x10000e37d
cmp dword [rsp + 0x28], 0
jbe 0x10000e37d
mov byte [rbx + 0x18], sil
lea rax, [0x100001608]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.10000e12c
movzx ecx, byte [0x10001ff30]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x10001ff30], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.10000e9b0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x10000e750
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x10001d180]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10000e790
mov eax, 0xff
jmp 0x10000e957
mov r8d, dword [rsp + 0x3c]
and r8d, 0x7fff
mov r9d, dword [rsp + 0x40]
cmp r9d, 2
je 0x10000e7ac
bts r8d, 0xf
mov edx, dword [rsp + 0x34]
mov ecx, edx
shl ecx, 8
mov eax, dword [rsp + 0x38]
add ecx, eax
mov dword [0x10001ed9c], r9d
mov dword [0x10001eda4], ecx
mov dword [0x10001eda8], edx
mov dword [0x10001edac], eax
mov dword [0x10001eda0], r8d
mov eax, 0x5a4d
cmp word [0x100000000], ax
jne 0x10000e83f
movsxd rax, dword [0x10000003c]
lea rcx, [0x100000000]
add rax, rcx
cmp dword [rax], 0x4550
je 0x10000e80a
xor ebx, ebx
mov dword [rsp + 0x20], ebx
jmp 0x10000e845
mov ecx, 0x20b
cmp word [rax + 0x18], cx
je 0x10000e81d
xor ebx, ebx
mov dword [rsp + 0x20], ebx
jmp 0x10000e845
cmp dword [rax + 0x84], 0xe
ja 0x10000e82e
xor ebx, ebx
mov dword [rsp + 0x20], ebx
jmp 0x10000e845
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0x20], ebx
jmp 0x10000e845
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov edi, 1
mov ecx, edi
call fcn.100011ef4
test eax, eax
jne 0x10000e877
cmp dword [0x10001ed88], 2
je 0x10000e863
call fcn.100011198
mov ecx, 0x1c
call fcn.100010f9c
mov ecx, 0xff
call fcn.100010bf8
call fcn.100011e6c
test eax, eax
jne 0x10000e8a3
cmp dword [0x10001ed88], 2
je 0x10000e88e
call fcn.100011198
mov ecx, 0x10
call fcn.100010f9c
mov ecx, 0xff
call fcn.100010bf8
nop
call fcn.10001188c
test eax, eax
jns 0x10000e8b6
mov ecx, 0x1b
call fcn.100010b84
call sub.KERNEL32.dll_GetCommandLineW
mov qword [0x1000211b8], rax
call fcn.1000117ec
mov qword [0x10001ed80], rax
call fcn.1000116f4
test eax, eax
jns 0x10000e8e1
mov ecx, 8
call fcn.100010b84
call fcn.1000113b8
test eax, eax
jns 0x10000e8f4
mov ecx, 9
call fcn.100010b84
mov ecx, edi
call fcn.100010d0c
test eax, eax
je 0x10000e906
mov ecx, eax
call fcn.100010b84
mov r8, qword [0x10001edd8]
mov qword [0x10001ede0], r8
mov rdx, qword [0x10001edc0]
mov ecx, dword [0x10001edb0]
call fcn.100005df8
mov edi, eax
mov dword [rsp + 0x24], eax
test ebx, ebx
jne 0x10000e937
mov ecx, eax
call fcn.100010eec
call fcn.100010f10
jmp 0x10000e955
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.100160000
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
sub rsp, 0x28
call fcn.100011f68
add rsp, 0x28
jmp 0x10000e750
Function at 0x10000e9b0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x10001d180]
jne 0x10000e9cb
rol rcx, 0x10
test cx, 0xffff
jne 0x10000e9c7
ret 0
ror rcx, 0x10
jmp 0x100012024
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x10001f3e0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x10001f4d8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1000120a9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x10001f3e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1000120cb
mov rax, qword [rsp + 0x88]
mov qword [0x10001f4d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x10001f478], rax
mov rax, qword [0x10001f4d8]
mov qword [0x10001f350], rax
mov rax, qword [rsp + 0x90]
mov qword [0x10001f460], rax
mov dword [0x10001f340], 0xc0000409
mov dword [0x10001f344], 1
mov rax, qword [0x10001d180]
mov qword [rsp + 0x68], rax
mov rax, qword [0x10001d188]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100001ea0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret