joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007c3ae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x198
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
jmp 0x14007d22e
mov rax, rcx
mov qword [rsp + 0x58], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax + 0x88]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a0]
jmp 0x14007a2d4

Function at 0x14007c5fd
Capabilities:
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
test eax, eax
je 0x14007b7c3
jmp 0x14007acab
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x100]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x4550
jne 0x14007c694
jmp 0x14007d7a3
mov ecx, 0xc1
call qword [0x1400f439b]
xor eax, eax
jmp 0x14007cf58
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x14007c39c
jmp 0x14007eb13
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x30], rax
mov edx, 0x40
mov rcx, qword [rsp + 0x108]
call fcn.1400799d3
jmp 0x140079529
xor eax, eax
jmp 0x14007cf58
xor eax, eax
jmp 0x14007cf58
mov ecx, 0xc1
call qword [0x1400f6f70]
xor eax, eax
jmp 0x14007cf58
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xe8
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x58], 0
jmp 0x14007acfa
mov ecx, 0xc1
call qword [0x1400f7203]
xor eax, eax
jmp 0x14007cf58
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 4]
cmp eax, 0x8664
jne 0x14007984e
jmp fcn.14007c384
test eax, eax
je 0x14007b830
jmp 0x1400796b8
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
add rax, 0x108
mov rdx, rax
mov rcx, qword [rsp + 0x108]
call fcn.1400799d3
jmp 0x14007df50
Function at 0x14007e52d
Capabilities:
Inspect section memory permissions

Disassembly:
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x2000000
test eax, eax
je 0x14007a988
jmp 0x1400795c6
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x98]
mov rcx, qword [rcx + 8]
cmp qword [rax], rcx
je 0x14007ee17
jmp 0x14007c7bc
cmp qword [rsp + 0x38], 0
jne 0x14007be71
jmp 0x14007e4e6
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x20000000
test eax, eax
je 0x14007e1c9
mov r8d, 0x4000
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
mov rax, qword [rsp + 0x38]
call qword [rax + 8]
jmp 0x14007e412
mov rax, qword [rsp + 0x90]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x90]
mov ecx, dword [rcx + 0x40]
cmp dword [rax + 0x38], ecx
je 0x140079975
jmp 0x14007d89e
mov eax, 1
jmp 0x140079b2f
mov eax, 1
jmp 0x140079b2f
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0x40]
mov qword [rsp + 0x70], rax
xor edx, edx
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rsp + 0x70]
div rcx
mov rax, rdx
test rax, rax
jne 0x14007e412
jmp 0x140079975
mov dword [rsp + 0x24], 0
jmp 0x140079986
mov eax, 1
jmp 0x140079b2f
mov r8d, 0x4000
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
call qword [0x1400f9b60]
jmp 0x14007e412
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x98]
cmp qword [rax + 0x10], 0
jne 0x1400793db
jmp 0x14007d4b0
mov rax, qword [rsp + 0x98]
cmp dword [rax + 0x1c], 0
je 0x14007c00d
jmp 0x140079975
Function at 0x140005730
Capabilities:
Access the windows event log

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140184aa8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r10, qword [rcx + 8]
mov qword [rsp + 0x50], r8
test r10, r10
je 0x1400057b1
test r8, r8
je 0x1400057b1
mov r11d, 1
test edx, edx
je 0x14000576b
cmp edx, r11d
jne 0x14000576b
movzx eax, r11w
jmp 0x140005770
mov eax, 4
cmp edx, r11d
mov ecx, 0xc0020011
mov r9d, 0x40020010
mov r8d, r11d
cmove r9d, ecx
xor edx, edx
mov qword [rsp + 0x40], rdx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov rcx, r10
mov dword [rsp + 0x30], edx
mov word [rsp + 0x28], r11w
mov qword [rsp + 0x20], rdx
movzx edx, ax
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400b48a0
add rsp, 0x68
ret

Function at 0x1400057f0
Capabilities:
Access the windows event log

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140184aa8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r10, qword [rcx + 8]
mov qword [rsp + 0x50], r8
test r10, r10
je 0x140005871
test r8, r8
je 0x140005871
mov r11d, 1
test edx, edx
je 0x14000582b
cmp edx, r11d
jne 0x14000582b
movzx eax, r11w
jmp 0x140005830
mov eax, 4
cmp edx, r11d
mov ecx, 0xc0020011
mov r9d, 0x40020010
mov r8d, r11d
cmove r9d, ecx
xor edx, edx
mov qword [rsp + 0x40], rdx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov rcx, r10
mov dword [rsp + 0x30], edx
mov word [rsp + 0x28], r11w
mov qword [rsp + 0x20], rdx
movzx edx, ax
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400b48a0
add rsp, 0x68
ret

Function at 0x140005fe0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140184aa8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
lea r8, str.Service_start
mov rcx, qword [rcx + 0x270]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [rbx + 0x260]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
lea rax, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x140005fd0]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400b48a0
add rsp, 0x40
pop rbx
ret
Function at 0x1400061c0
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rsi, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor ebx, ebx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140006273
lea rdx, [rsi + 0x278]
mov qword [rsp + 0x70], rbp
cmp qword [rdx + 0x18], 8
jb 0x140006206
mov rdx, qword [rdx]
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov rbp, rax
test rax, rax
je 0x140006261
mov qword [rsp + 0x50], rbx
or r9d, 0xffffffff
mov qword [rsp + 0x48], rbx
mov r8d, 4
mov qword [rsp + 0x40], rbx
or edx, r9d
mov qword [rsp + 0x38], rbx
mov rcx, rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfigW]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x70]
test ebx, ebx
jne 0x140006289
mov rcx, qword [rsi + 0x270]
lea r8, str.Error_while_disabling_service.
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x140014f80
Capabilities:
Query service status
Stop service

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x254
mov eax, dword [rcx + rdx]
mov r8d, 0x250
test al, 1
jne 0x140014fc2
or eax, 1
mov dword [rcx + rdx], eax
mov ecx, r8d
add rcx, rdx
call fcn.14000c690
nop
cmp byte [r8 + rdx + 1], 0
je 0x140014fe9
lea rdx, str.unsigned_long___cdecl_MinifilterStopCommand::Execute_int_wchar_t____
lea rcx, [0x140191c70]
call fcn.14000d110
lea rcx, [0x140191c70]
call fcn.14000cbe0
mov rcx, qword [rbx + 8]
add rsp, 0x30
pop rbx
jmp fcn.140024660
Function at 0x140015110
Capabilities:
Start service

Disassembly:
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov rsi, rcx
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov r14d, 0x254
mov eax, dword [r14 + rdi]
mov edx, 0x250
test al, 1
jne 0x140015162
or eax, 1
mov dword [r14 + rdi], eax
mov ecx, edx
add rcx, rdi
call fcn.14000c690
nop
mov ebx, edx
add rbx, rdi
cmp byte [rbx + 1], 0
je 0x14001518c
lea rdx, str.unsigned_long___cdecl_MinifilterStartCommand::Execute_int_wchar_t____
lea rcx, [0x140191c70]
call fcn.14000d110
lea rcx, [0x140191c70]
call fcn.14000cbe0
mov eax, dword [r14 + rdi]
test al, 1
jne 0x1400151a4
or eax, 1
mov dword [r14 + rdi], eax
mov rcx, rbx
call fcn.14000c690
nop
cmp byte [rbx + 1], 0
je 0x1400151c9
lea rdx, str.Start_Minifilter
lea rcx, [0x140191c70]
call fcn.14000d110
lea rcx, [0x140191c70]
call fcn.14000cbe0
mov rcx, qword [rsi + 8]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
jmp 0x140024500
push rbx
sub rsp, 0x150
mov qword [rsp + 0x20], 0xfffffffffffffffe
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_StartServiceW]
test eax, eax
jne 0x1400245fd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x30]
cmp eax, 0x420
jne 0x14002457e
call fcn.140015360
xor eax, eax
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], ax
lea rdx, str.Cannot_start_service._ERROR_SERVICE_ALREADY_RUNNING
lea rcx, [rsp + 0x40]
call fcn.140016a20
lea rcx, [rsp + 0x40]
call fcn.140015ba0
nop
jmp 0x1400245ec
call fcn.140015360
xor eax, eax
mov qword [rsp + 0x140], 7
mov qword [rsp + 0x138], rax
mov word [rsp + 0x128], ax
cmp ebx, 2
jne 0x1400245c4
lea rdx, str.Cannot_start_service._ERROR_FILE_NOT_FOUND
lea rcx, [rsp + 0x40]
call fcn.140016a20
lea rcx, [rsp + 0x40]
call fcn.140015ba0
nop
jmp 0x1400245ec
lea rdx, str.Cannot_start_service._Error
lea rcx, [rsp + 0x40]
call fcn.140016a20
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.140019260
lea rcx, [rsp + 0x40]
call fcn.140015ba0
nop
lea rcx, [rsp + 0x30]
call fcn.1400149b0
mov eax, 0x6e
jmp 0x140024656
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x254
mov eax, dword [rcx + rdx]
mov r8d, 0x250
test al, 1
jne 0x14002462d
or eax, 1
mov dword [rcx + rdx], eax
mov ecx, r8d
add rcx, rdx
call fcn.14000c690
nop
cmp byte [r8 + rdx + 1], 0
je 0x140024654
lea rdx, str.Service_started_successfully.
lea rcx, [0x140191c70]
call fcn.14000d110
lea rcx, [0x140191c70]
call fcn.14000cbe0
xor eax, eax
add rsp, 0x150
pop rbx
ret
Function at 0x140016e40
Capabilities:
Start service

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x254
mov eax, dword [rcx + rdx]
mov r8d, 0x250
test al, 1
jne 0x140016e82
or eax, 1
mov dword [rcx + rdx], eax
mov ecx, r8d
add rcx, rdx
call fcn.14000c690
nop
cmp byte [r8 + rdx + 1], 0
je 0x140016ea9
lea rdx, str.Starting_service
lea rcx, [0x140191c70]
call fcn.14000d110
lea rcx, [0x140191c70]
call fcn.14000cbe0
mov rcx, qword [rbx + 8]
add rsp, 0x30
pop rbx
jmp 0x140024500
Function at 0x140023d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x30
sub r9, r8
mov rax, rdx
sub rax, rcx
mov r14, r8
xor rax, r9
mov rbp, rdx
mov rbx, rcx
test rax, 0xfffffffffffffffe
je 0x140023d31
xor al, al
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r15
cmp rcx, rbp
je 0x140023d81
mov r15, qword [rsp + 0x70]
sub r14, rcx
nop dword [rax]
mov rcx, qword [r15 + 8]
movzx edx, word [rbx]
movzx esi, word [r14 + rbx]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, qword [r15 + 8]
movzx edx, si
movzx edi, ax
mov r8, qword [rcx]
call qword [r8 + 0x40]
cmp di, ax
jne 0x140023d9b
add rbx, 2
cmp rbx, rbp
jne 0x140023d50
mov al, 1
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret
xor al, al
jmp 0x140023d83
Function at 0x140024500
Capabilities:
Start service

Disassembly:
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov rsi, rcx
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov r14d, 0x254
mov eax, dword [r14 + rdi]
mov edx, 0x250
test al, 1
jne 0x140015162
or eax, 1
mov dword [r14 + rdi], eax
mov ecx, edx
add rcx, rdi
call fcn.14000c690
nop
mov ebx, edx
add rbx, rdi
cmp byte [rbx + 1], 0
je 0x14001518c
lea rdx, str.unsigned_long___cdecl_MinifilterStartCommand::Execute_int_wchar_t____
lea rcx, [0x140191c70]
call fcn.14000d110
lea rcx, [0x140191c70]
call fcn.14000cbe0
mov eax, dword [r14 + rdi]
test al, 1
jne 0x1400151a4
or eax, 1
mov dword [r14 + rdi], eax
mov rcx, rbx
call fcn.14000c690
nop
cmp byte [rbx + 1], 0
je 0x1400151c9
lea rdx, str.Start_Minifilter
lea rcx, [0x140191c70]
call fcn.14000d110
lea rcx, [0x140191c70]
call fcn.14000cbe0
mov rcx, qword [rsi + 8]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
jmp 0x140024500
push rbx
sub rsp, 0x150
mov qword [rsp + 0x20], 0xfffffffffffffffe
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_StartServiceW]
test eax, eax
jne 0x1400245fd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x30]
cmp eax, 0x420
jne 0x14002457e
call fcn.140015360
xor eax, eax
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], ax
lea rdx, str.Cannot_start_service._ERROR_SERVICE_ALREADY_RUNNING
lea rcx, [rsp + 0x40]
call fcn.140016a20
lea rcx, [rsp + 0x40]
call fcn.140015ba0
nop
jmp 0x1400245ec
call fcn.140015360
xor eax, eax
mov qword [rsp + 0x140], 7
mov qword [rsp + 0x138], rax
mov word [rsp + 0x128], ax
cmp ebx, 2
jne 0x1400245c4
lea rdx, str.Cannot_start_service._ERROR_FILE_NOT_FOUND
lea rcx, [rsp + 0x40]
call fcn.140016a20
lea rcx, [rsp + 0x40]
call fcn.140015ba0
nop
jmp 0x1400245ec
lea rdx, str.Cannot_start_service._Error
lea rcx, [rsp + 0x40]
call fcn.140016a20
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.140019260
lea rcx, [rsp + 0x40]
call fcn.140015ba0
nop
lea rcx, [rsp + 0x30]
call fcn.1400149b0
mov eax, 0x6e
jmp 0x140024656
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x254
mov eax, dword [rcx + rdx]
mov r8d, 0x250
test al, 1
jne 0x14002462d
or eax, 1
mov dword [rcx + rdx], eax
mov ecx, r8d
add rcx, rdx
call fcn.14000c690
nop
cmp byte [r8 + rdx + 1], 0
je 0x140024654
lea rdx, str.Service_started_successfully.
lea rcx, [0x140191c70]
call fcn.14000d110
lea rcx, [0x140191c70]
call fcn.14000cbe0
xor eax, eax
add rsp, 0x150
pop rbx
ret
Function at 0x140024a80
Capabilities:
Modify service

Disassembly:
push rdi
sub rsp, 0x190
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x1a0], rbx
xor edi, edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
or r9d, 0xffffffff
mov r8d, edx
or edx, r9d
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfigW]
test eax, eax
jne 0x140024b88
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x70]
call fcn.140015360
mov qword [rsp + 0x178], rdi
mov qword [rsp + 0x180], 7
mov word [rsp + 0x168], di
lea rdx, str.ChangeServiceConfig_returned_0x
lea rcx, [rsp + 0x80]
call fcn.140016a20
mov rcx, qword [rsp + 0x80]
movsxd rdx, dword [rcx + 4]
and dword [rsp + rdx + 0x98], 0xfffff9ff
or dword [rsp + rdx + 0x98], 0x800
mov edx, ebx
lea rcx, [rsp + 0x80]
call fcn.140019260
mov rax, qword [rsp + 0x80]
movsxd rcx, dword [rax + 4]
and dword [rsp + rcx + 0x98], 0xfffff3ff
or dword [rsp + rcx + 0x98], 0x200
lea rcx, [rsp + 0x80]
call fcn.140015ba0
nop
lea rcx, [rsp + 0x70]
call fcn.1400149b0
xor eax, eax
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x190
pop rdi
ret
Function at 0x140024ba0
Capabilities:
Modify service

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x190
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x1c0], rbx
mov rax, qword [0x140184aa8]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rdi, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0xe8
lea rcx, [rsp + 0x90]
call fcn.1400d5b20
lea rcx, [rsp + 0x90]
call fcn.140025500
nop
xor ebp, ebp
mov ebx, ebp
cmp qword [rdi], rbx
je 0x140024c33
mov rax, qword [rdi]
nop dword [rax]
nop word [rax + rax]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140012d80
mov rcx, rax
call fcn.1400256b0
inc ebx
mov rax, qword [rdi + rbx*8]
test rax, rax
jne 0x140024c10
lea rcx, [rsp + 0x90]
call fcn.1400256b0
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x90]
call fcn.140025450
cmp qword [rax + 0x18], 8
jb 0x140024c5c
mov rax, qword [rax]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
or r9d, 0xffffffff
or r8d, r9d
or edx, r9d
mov rcx, qword [rsi + 8]
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfigW]
test eax, eax
sete bl
mov r8, qword [rsp + 0x80]
cmp r8, 8
jb 0x140024cb8
inc r8
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
call fcn.140005b70
test bl, bl
je 0x140024d62
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov rcx, qword gs:[0x58]
mov rdx, qword [rcx]
mov eax, 0x254
mov ecx, dword [rax + rdx]
mov r8d, 0x250
test cl, 1
jne 0x140024cf9
or ecx, 1
mov dword [rax + rdx], ecx
mov ecx, r8d
add rcx, rdx
call fcn.14000c690
nop
cmp byte [r8 + rdx + 1], 0
je 0x140024d62
lea rdx, str.ChangeServiceConfig_returned_0x
lea rdi, [0x140191c70]
mov rcx, rdi
call fcn.14000d110
mov rax, qword [0x140191c70]
movsxd rdx, dword [rax + 4]
add rdx, rdi
and dword [rdx + 0x18], 0xfffff9ff
or dword [rdx + 0x18], 0x800
mov edx, ebx
mov rcx, rdi
call fcn.140016080
mov rax, qword [0x140191c70]
movsxd rdx, dword [rax + 4]
add rdx, rdi
and dword [rdx + 0x18], 0xfffff3ff
or dword [rdx + 0x18], 0x200
mov rcx, rdi
call fcn.14000cbe0
nop
lea rcx, [rsp + 0x118]
call fcn.140025480
nop
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x118], rax
lea rcx, [rsp + 0x118]
call fcn.140099364
nop
xor eax, eax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400b48a0
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x190
pop rdi
pop rsi
pop rbp
ret
Function at 0x140025060
Capabilities:
Query service status

Disassembly:
push rbx
sub rsp, 0x170
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x140184aa8]
xor rax, rsp
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
jne 0x140025146
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x40]
call fcn.140015360
xor eax, eax
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], 7
mov word [rsp + 0x138], ax
lea rdx, str.Cannot_query_service_state_0x
lea rcx, [rsp + 0x50]
call fcn.140016a20
mov rcx, qword [rsp + 0x50]
movsxd rdx, dword [rcx + 4]
and dword [rsp + rdx + 0x68], 0xfffff9ff
or dword [rsp + rdx + 0x68], 0x800
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.140019260
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
and dword [rsp + rcx + 0x68], 0xfffff3ff
or dword [rsp + rcx + 0x68], 0x200
lea rcx, [rsp + 0x50]
call fcn.140015ba0
nop
lea rcx, [rsp + 0x40]
call fcn.1400149b0
mov eax, ebx
jmp 0x140025148
xor eax, eax
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1400b48a0
add rsp, 0x170
pop rbx
ret

Function at 0x140025170
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rax, qword [0x140184aa8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x254
mov eax, dword [rcx + rdx]
mov r8d, 0x250
test al, 1
jne 0x1400251c6
or eax, 1
mov dword [rcx + rdx], eax
mov ecx, r8d
add rcx, rdx
call fcn.14000c690
nop
cmp byte [r8 + rdx + 1], 0
je 0x1400251ed
lea rdx, str.Waiting_for_the_pending_service_stop...
lea rcx, [0x140191c70]
call fcn.14000d110
lea rcx, [0x140191c70]
call fcn.14000cbe0
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov ebx, eax
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140025060
cmp dword [rsp + 0x2c], 1
je 0x140025273
nop dword [rax]
mov eax, 0xcccccccd
mul dword [rsp + 0x40]
shr edx, 3
mov ecx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140025060
test eax, eax
jne 0x140025275
cmp dword [rsp + 0x2c], 1
je 0x140025267
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x7530
ja 0x140025254
cmp dword [rsp + 0x2c], 1
jne 0x140025210
jmp 0x140025273
lea rcx, str.Service_stop_timed_out._n
call fcn.1400243c0
mov eax, 0x41d
jmp 0x140025275
lea rcx, str.Service_stopped_successfully._n
call fcn.1400243c0
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400b48a0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140025290
Capabilities:
Enumerate services

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140184aa8]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor ebp, ebp
mov rbx, rcx
mov qword [rdx], rbp
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400252c8
call fcn.1400b48c4
mov qword [rbx + 0x10], rbp
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x30]
xor r9d, r9d
lea rsi, [rbx + 0x20]
mov qword [rsp + 0x28], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_service_core_l1_1_1.dll_EnumDependentServicesW]
test eax, eax
jne 0x140025392
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0xea
jne 0x140025394
mov ecx, dword [rsp + 0x30]
call fcn.1400b4f68
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x140025321
mov eax, 0xe
jmp 0x140025394
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call fcn.1400d5b20
mov r8, qword [rbx + 0x10]
lea rax, [rsp + 0x30]
mov r9d, dword [rsp + 0x30]
mov edx, 1
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x28], rsi
mov qword [rbx + 0x18], r8
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_service_core_l1_1_1.dll_EnumDependentServicesW]
test eax, eax
jne 0x140025374
mov rcx, qword [rbx + 0x10]
call fcn.1400b48c4
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
mov dword [rsi], ebp
jmp 0x140025392
mov dword [rbx + 0x24], ebp
cmp dword [rsi], ebp
ja 0x140025380
mov qword [rdi], rbp
jmp 0x140025392
mov rcx, qword [rbx + 0x18]
mov rdx, rdi
mov rcx, qword [rcx]
call fcn.140024420
inc dword [rbx + 0x24]
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400b48a0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret