joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e6f08
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rdi, r8
mov rbx, rdx
mov rdx, rcx
lea r12, [0x140162280]
mov r10, qword [0x140162280]
cmp r10, r12
je 0x1400e6f77
test byte [r10 + 0x1c], 4
je 0x1400e6f77
mov rax, qword [r8 + 8]
add rax, qword [r8]
mov r9, qword [rbx + 8]
add r9, qword [rbx]
mov edx, 0xf
mov qword [rsp + 0x20], rax
lea r8, [0x14013d320]
mov rcx, qword [r10 + 0x10]
call fcn.1400448fc
mov r10, qword [0x140162280]
mov rdx, qword [rsp + 0xc0]
mov rsi, qword [rdi + 8]
add rsi, qword [rdi]
mov qword [rsp + 0xd0], rsi
mov rbp, qword [rbx + 8]
add rbp, qword [rbx]
mov qword [rsp + 0xd8], rbp
cmp rsi, rbp
je 0x1400e6fca
xor r14d, r14d
cmp rsi, rbp
jge 0x1400e6fdd
cmp r10, r12
je 0x1400e6fca
test byte [r10 + 0x1c], 1
je 0x1400e6fca
lea edx, [r14 + 0x10]
mov qword [rsp + 0x20], rsi
mov r9, rbp
lea r8, [0x14013d320]
mov rcx, qword [r10 + 0x10]
call fcn.1400448fc
xor eax, eax
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
add rdx, 0x10
mov r8, rbx
lea rcx, [rsp + 0x48]
call fcn.1400e79e4
nop
mov r15d, 0x400
mov ecx, r15d
call fcn.140031048
mov rbx, rax
mov qword [rsp + 0x30], rax
lea rdi, [rax + 0x400]
mov qword [rsp + 0x40], rdi
mov r8d, r15d
xor edx, edx
mov rcx, rax
call fcn.140032ec0
mov qword [rsp + 0x38], rdi
mov rax, rsi
sub rax, rbp
mov r15d, 0
je 0x1400e70f3
mov r12, rdi
sub r12, rbx
mov rsi, rax
mov rbp, qword [rsp + 0xc0]
mov r13, rsi
sub r13, r15
cmp r13, r12
cmovae r13, r12
mov r8, r13
mov rdx, rbx
mov rcx, rbp
call fcn.1400e759c
xor edx, edx
mov r9, r12
cmp r13, r12
cmovbe r9, r13
mov rcx, r9
shr rcx, 2
and r9d, 3
xor eax, eax
test rcx, rcx
je 0x1400e708c
xor edx, dword [rax + rbx]
add rax, 4
sub rcx, 1
jne 0x1400e707f
test r9, r9
je 0x1400e70cd
and dword [rsp + 0xc8], 0
xor r8d, r8d
lea rcx, [rsp + 0xc8]
sub rax, rcx
lea r10, [rax + rbx]
cmp r8, r9
jae 0x1400e70c6
lea rcx, [rsp + 0xc8]
add rcx, r8
mov al, byte [rcx + r10]
mov byte [rcx], al
inc r8
jmp 0x1400e70ab
xor edx, dword [rsp + 0xc8]
xor r14d, edx
add r15, r13
cmp r15, rsi
jb 0x1400e7046
mov rsi, qword [rsp + 0xd0]
mov rbp, qword [rsp + 0xd8]
lea r12, [0x140162280]
test rbx, rbx
je 0x1400e7128
sub rdi, rbx
cmp rdi, 0x1000
jb 0x1400e711c
add rdi, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x1400e7170
mov rbx, rcx
mov rdx, rdi
mov rcx, rbx
call fcn.140030c60
nop
mov rdx, qword [rsp + 0x50]
add rdx, qword [rsp + 0x58]
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
call fcn.1400e767c
nop
mov rcx, qword [0x140162280]
cmp rcx, r12
je 0x1400e7168
test byte [rcx + 0x1c], 4
je 0x1400e7168
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
mov r9, rbp
mov rcx, qword [rcx + 0x10]
call fcn.1400c2460
mov eax, r14d
jmp 0x1400e6fcc
call fcn.140006144
int3
Function at 0x1400eaab8
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140168900]
xor rax, rsp
mov qword [rsp + 0x18], rax
mov rax, qword [rcx + 0x148]
xor r9d, r9d
shr rcx, 4
mov r8d, r9d
mov qword [rsp], rcx
mov ecx, r9d
mov rdx, qword [rax + 8]
movups xmm0, xmmword [rdx - 0x10]
movdqu xmmword [rsp + 8], xmm0
movzx eax, byte [rsp + rcx + 8]
inc rcx
add eax, r8d
imul r8d, eax, 0x401
mov eax, r8d
shr eax, 6
xor r8d, eax
cmp rcx, 0x10
jb 0x1400eaaf1
movzx eax, byte [rsp + r9]
inc r9
add eax, r8d
imul r8d, eax, 0x401
mov eax, r8d
shr eax, 6
xor r8d, eax
cmp r9, 8
jb 0x1400eab12
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, 0x6fd91d85
imul r8d, ecx, 0x8001
mul r8d
shr edx, 0x12
imul ecx, edx, 0x927c0
sub r8d, ecx
lea eax, [r8 + 0x927c0]
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.140030c40
add rsp, 0x28
ret

Function at 0x1400ec27c
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rbx, rdx
cmp qword [0x14016b8c8], 0
jne 0x1400ec39d
mov edi, 0x48
mov ecx, edi
call fcn.140031048
mov qword [rsp + 0x50], rax
mov r9b, 1
mov r8, rbx
mov rcx, rax
call fcn.1400eba40
nop
mov rbx, qword [0x14016b8c8]
mov qword [0x14016b8c8], rax
test rbx, rbx
je 0x1400ec2e7
mov rcx, rbx
call fcn.1400ebb64
mov edx, edi
mov rcx, rbx
call fcn.140030c60
nop
jmp 0x1400ec2f1
and qword [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
call fcn.1400ec0e4
lea rdx, str._n_n______________________________________________________________________________________n
lea rcx, [0x14013f700]
call fcn.1400ec5f0
lea rdi, [0x1401304b8]
mov rbx, qword [rsp + 0x50]
test rbx, rbx
cmovne rdi, rbx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r9, rdi
mov r8, rax
lea rdx, [0x1401172c8]
lea rcx, str._s:_Command_Line:__s_n_Start_Time:__s_n_n
call fcn.1400ec5f0
test rbx, rbx
je 0x1400ec39d
mov rcx, rbx
call qword [sym.imp.mpclient.dll_MpFreeMemory]
jmp 0x1400ec39d
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400ec838
Capabilities:
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
and qword [rax + 0x10], 0
mov r8, rcx
lea rdx, str._ls.bak
lea rcx, [rax + 0x10]
call fcn.1400f23a4
mov ebx, eax
test eax, eax
jns 0x1400ec87f
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400ec878
call fcn.140030c60
mov eax, ebx
jmp 0x1400ec958
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.1400edec0
mov edi, eax
cmp eax, 0x80070001
jle 0x1400ec905
lea ecx, [rax + 0x7ff8fffc]
cmp ecx, 0x7ff8fffb
jbe 0x1400ec905
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1400ec8f4
call fcn.1400f259c
mov edi, eax
test eax, eax
jns 0x1400ec8f4
lea rax, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rax
je 0x1400ec949
test byte [rcx + 0x1c], 1
je 0x1400ec949
mov edx, 0x1d
mov r9d, edi
lea r8, [0x14013f888]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
jmp 0x1400ec949
test rbx, rbx
je 0x1400ec901
mov rcx, rbx
call fcn.140030c60
xor eax, eax
jmp 0x1400ec958
lea rax, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rax
je 0x1400ec93b
test byte [rcx + 0x1c], 1
je 0x1400ec93b
mov edx, 0x1c
mov qword [rsp + 0x20], rbx
mov r9d, edi
lea r8, [0x14013f888]
mov rcx, qword [rcx + 0x10]
call fcn.1400444c8
mov edx, edi
lea rcx, str.ERROR:_UtilDeletePathSafe___failed___X__n
call fcn.1400ec5f0
test rbx, rbx
je 0x1400ec956
mov rcx, rbx
call fcn.140030c60
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400ee0f0
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, edi
mov rcx, rbp
mov ebx, eax
call fcn.1400f1e80
test al, al
je 0x1400ee171
lea esi, [rdi + 0x3a98]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, ebx
cmp esi, ecx
ja 0x1400ee139
sub ebx, eax
cmp esi, ebx
jbe 0x1400ee15b
mov edx, edi
lea rcx, str.ERROR:_Process_Hand___timeout__lu_n
call fcn.1400ec5f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x5b4
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, edi
mov rcx, rbp
mov ebx, eax
call fcn.1400f1e80
test al, al
jne 0x1400ee125
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400f11dc
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400f11f7
xor eax, eax
jmp 0x1400f1240
call fcn.1400f259c
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x1400f123e
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x1400f123e
test byte [rcx + 0x1c], 1
je 0x1400f123e
mov rcx, qword [rcx + 0x10]
lea r8, [0x140140910]
mov edx, 0x25
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.140044764
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400f124c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, dword [rdx]
mov rdi, r8
mov rsi, rdx
mov r8d, ebx
mov rdx, rdi
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
mov r9d, eax
test eax, eax
jne 0x1400f12c0
call fcn.1400f259c
mov ebx, eax
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x1400f12bc
test byte [rcx + 0x1c], 1
je 0x1400f12bc
mov rcx, qword [rcx + 0x10]
lea r8, [0x140140910]
mov edx, 0x28
mov dword [rsp + 0x20], ebx
mov r9, rbp
call fcn.140044764
mov eax, ebx
jmp 0x1400f12e2
cmp r9d, ebx
ja 0x1400f12d6
lea eax, [r9 - 1]
cmp word [rdi + rax*2], dx
je 0x1400f12dd
mov eax, 0x8000ffff
jmp 0x1400f12e2
test ebx, ebx
je 0x1400f12dd
mov word [rdi], dx
mov qword [rsi], r9
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400f1350
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400f13b9
call fcn.1400f259c
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x1400f13b5
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x1400f13b5
test byte [rcx + 0x1c], 1
je 0x1400f13b5
mov rcx, qword [rcx + 0x10]
lea r8, [0x140140910]
mov edx, 0x1f
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.140044764
mov eax, ebx
jmp 0x1400f13bd
mov dword [rbx], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400f13c8
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edx, 0x80
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1400f1425
call fcn.1400f259c
mov ebx, eax
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x1400f1421
test byte [rcx + 0x1c], 1
je 0x1400f1421
mov rcx, qword [rcx + 0x10]
mov edx, 0x27
mov dword [rsp + 0x28], ebx
mov r9, rdi
mov dword [rsp + 0x20], 0x80
call fcn.1400f1fb4
mov eax, ebx
jmp 0x1400f1427
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400f1434
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor edx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400f1451
xor eax, eax
jmp 0x1400f14b0
call fcn.1400f259c
mov ebx, eax
cmp eax, 0x800700b7
je 0x1400f149c
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x1400f1498
mov edx, 1
test byte [rcx + 0x1c], dl
je 0x1400f1498
mov rcx, qword [rcx + 0x10]
lea r8, [0x140140910]
mov edx, 0x22
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.140044764
mov eax, ebx
jmp 0x1400f14b0
mov rcx, rdi
call fcn.1400f18e0
test eax, eax
mov edx, 1
cmovs edx, eax
mov eax, edx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400f166c
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1400f11dc
lea edx, [rax + 0x7ff8fffe]
cmp edx, 1
jbe 0x1400f16a5
cmp eax, 0x80070005
jne 0x1400f16aa
mov rcx, rbx
call fcn.1400f13c8
test eax, eax
js 0x1400f16aa
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400f11dc
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1400f1870
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rax, rdx
mov rbx, rcx
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1400f18d0
call fcn.1400f259c
mov ebx, eax
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x1400f18cc
test byte [rcx + 0x1c], 1
je 0x1400f18cc
mov rcx, qword [rcx + 0x10]
lea r8, [0x140140910]
mov edx, 0x16
mov r9d, ebx
call fcn.140044450
mov eax, ebx
jmp 0x1400f18da
mov rax, qword [rsp + 0x40]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400f1cb4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edi, dword [rdx]
mov r10, r8
mov rbx, rdx
cmp rdi, qword [rdx]
je 0x1400f1cd5
mov eax, 0x80070057
jmp 0x1400f1d58
and qword [rdx], 0
lea r9, [rsp + 0x48]
and dword [rsp + 0x48], 0
mov rdx, r10
and qword [rsp + 0x20], 0
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400f1d42
call fcn.1400f259c
mov edi, eax
cmp eax, 0x80070026
jne 0x1400f1d0d
and qword [rbx], 0
jmp 0x1400f1d56
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x1400f1d3e
test byte [rcx + 0x1c], 1
je 0x1400f1d3e
mov rcx, qword [rcx + 0x10]
lea r8, [0x140140910]
mov edx, 0x17
mov r9d, edi
call fcn.140044450
mov eax, edi
jmp 0x1400f1d58
cmp dword [rsp + 0x48], edi
jbe 0x1400f1d4f
mov eax, 0x8000ffff
jmp 0x1400f1d58
mov eax, dword [rsp + 0x48]
mov qword [rbx], rax
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400f1ef4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, edx
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp rax, rdx
je 0x1400f1f1d
mov eax, 0x80070057
jmp 0x1400f1fa3
mov r8d, edx
jmp 0x1400f1f3d
mov eax, dword [rsp + 0x48]
cmp eax, ebx
je 0x1400f1fa1
test eax, eax
je 0x1400f1f9a
cmp eax, ebx
ja 0x1400f1f9a
sub ebx, eax
mov rcx, rsi
add rdi, rax
mov r8d, ebx
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
and dword [rsp + 0x48], 0
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400f1f22
call fcn.1400f259c
mov ebx, eax
test eax, eax
jns 0x1400f1fa1
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x1400f1f96
test byte [rcx + 0x1c], 1
je 0x1400f1f96
mov rcx, qword [rcx + 0x10]
lea r8, [0x140140910]
mov edx, 0x14
mov r9d, ebx
call fcn.140044450
mov eax, ebx
jmp 0x1400f1fa3
mov ebx, 0x8000ffff
jmp 0x1400f1f65
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400f25c4
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140168900]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0x2b8]
mov edi, edx
or edx, 0xffffffff
mov rsi, rcx
cmp edi, edx
jne 0x1400f2605
test rax, rax
je 0x1400f26d0
and qword [rsp + 0x50], 0
mov r9d, edx
and qword [rsp + 0x48], 0
mov r8d, edi
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x1400f26d0
call fcn.1400f259c
mov ebx, eax
mov rax, qword [0x140162280]
lea rcx, [0x140162280]
cmp rax, rcx
je 0x1400f26cc
test byte [rax + 0x1c], 1
je 0x1400f26cc
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x200
call fcn.140032ec0
and dword [rsp + 0x60], 0
lea r9, [rsp + 0x60]
mov r8d, 0x200
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x1400f26ac
call fcn.1400f259c
lea r9, str._unknown_
mov qword [rsp + 0xa8], r9
jmp 0x1400f26b4
mov r9, qword [rsp + 0xa8]
mov rcx, qword [0x140162280]
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x28], edi
mov rcx, qword [rcx + 0x10]
call fcn.1400f33bc
mov eax, ebx
jmp 0x1400f26d2
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140030c40
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400f2a54
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140168900]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rdx
mov rdx, rcx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1400f2b1a
call fcn.1400f259c
mov ebx, eax
mov rax, qword [0x140162280]
lea rcx, [0x140162280]
cmp rax, rcx
je 0x1400f2b16
test byte [rax + 0x1c], 1
je 0x1400f2b16
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x200
call fcn.140032ec0
and dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x200
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x1400f2af1
call fcn.1400f259c
lea r9, str._unknown_
mov qword [rsp + 0x78], r9
jmp 0x1400f2af6
mov r9, qword [rsp + 0x78]
mov rcx, qword [0x140162280]
lea r8, [0x140140ba0]
mov edx, 0xe
mov dword [rsp + 0x20], ebx
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov eax, ebx
jmp 0x1400f2b1c
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140030c40
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
Function at 0x1400f2b40
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140168900]
xor rax, rsp
mov qword [rsp + 0x240], rax
and dword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov rdi, rdx
mov qword [rsp + 0x20], rax
mov r8, rcx
mov r9d, 0x24
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1400f2c1d
call fcn.1400f259c
mov ebx, eax
mov rax, qword [0x140162280]
lea rcx, [0x140162280]
cmp rax, rcx
je 0x1400f2c19
test byte [rax + 0x1c], 1
je 0x1400f2c19
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x200
call fcn.140032ec0
and dword [rsp + 0x34], 0
lea r9, [rsp + 0x34]
mov r8d, 0x200
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x1400f2bf4
call fcn.1400f259c
lea r9, str._unknown_
mov qword [rsp + 0x78], r9
jmp 0x1400f2bf9
mov r9, qword [rsp + 0x78]
mov rcx, qword [0x140162280]
lea r8, [0x140140ba0]
mov edx, 0xd
mov dword [rsp + 0x20], ebx
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov eax, ebx
jmp 0x1400f2c1f
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140030c40
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret

Function at 0x1400f2c40
Capabilities:
Start service

Disassembly:
push rbp
push rbx
push rsi
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x140168900]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov rsi, rcx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1400f2d19
call fcn.1400f259c
mov ebx, eax
cmp eax, 0x80070420
jne 0x1400f2c8d
mov eax, 1
jmp 0x1400f2d9c
mov rdx, qword [0x140162280]
lea rax, [0x140162280]
cmp rdx, rax
je 0x1400f2d12
test byte [rdx + 0x1c], 1
je 0x1400f2d12
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x200
call fcn.140032ec0
and dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x200
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x1400f2ced
call fcn.1400f259c
lea r9, str._unknown_
mov qword [rsp + 0x78], r9
jmp 0x1400f2cf2
mov r9, qword [rsp + 0x78]
mov rcx, qword [0x140162280]
lea r8, [0x140140ba0]
mov edx, 0x12
mov dword [rsp + 0x20], ebx
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov eax, ebx
jmp 0x1400f2d9c
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x1400f2d9a
test byte [rcx + 0x1c], 4
je 0x1400f2d9a
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x200
call fcn.140032ec0
and dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x200
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x1400f2d79
call fcn.1400f259c
lea r9, str._unknown_
mov qword [rsp + 0x78], r9
jmp 0x1400f2d7e
mov r9, qword [rsp + 0x78]
mov rcx, qword [0x140162280]
lea r8, [0x140140ba0]
mov edx, 0x13
mov rcx, qword [rcx + 0x10]
call fcn.140044708
xor eax, eax
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.140030c40
add rsp, 0x250
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400f3960
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
cmp qword [rcx + 0x20], 0
mov r12, rdx
mov rdi, rcx
jne 0x1400f3993
mov eax, 0x80070057
jmp 0x1400f3b50
mov rsi, qword [rdi + 0x28]
mov r15, qword [rdi + 0x20]
mov r13, rsi
mov r14, qword [rdi + 0x18]
mov eax, esi
mov dword [rbp + 0x40], esi
cmp rax, rsi
je 0x1400f39b6
mov ebx, 0x80070057
jmp 0x1400f3ac2
mov eax, r14d
cmp rax, r14
jne 0x1400f39ac
mov rcx, qword [rdi + 0x10]
lea r9, [rbp + 0x40]
mov qword [rsp + 0x38], r8
mov edx, r14d
and qword [rsp + 0x30], 0
mov r8, r15
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
test eax, eax
jle 0x1400f39f8
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x1400f3a52
mov ecx, dword [rbp + 0x40]
mov edx, 0x800700ea
inc ecx
mov dword [rbp + 0x40], ecx
test r15, r15
je 0x1400f3a16
mov eax, ecx
cmp rax, rsi
cmova ebx, edx
mov esi, ecx
mov eax, ebx
mov qword [rbp - 0x10], rsi
cmp ebx, edx
je 0x1400f3ab8
cmp ebx, 0x80070103
je 0x1400f3ab8
test ebx, ebx
js 0x1400f3ac2
mov r9, r15
lea r8, [rbp - 0x10]
mov rdx, r13
mov rcx, r14
call fcn.1400f4644
mov rsi, qword [rbp - 0x10]
jmp 0x1400f3ab8
cmp ebx, 0x80070103
jne 0x1400f3a5e
mov eax, ebx
jmp 0x1400f3ab8
mov edx, 0x800700ea
cmp ebx, edx
je 0x1400f3a9e
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x1400f3ac2
test byte [rcx + 0x1c], 1
je 0x1400f3ac2
mov rcx, qword [rcx + 0x10]
lea r8, [0x140140bb0]
mov edx, 0x1c
mov dword [rsp + 0x20], ebx
mov r9d, r14d
call fcn.140044484
jmp 0x1400f3ac2
mov ecx, dword [rbp + 0x40]
inc ecx
mov eax, ecx
mov dword [rbp + 0x40], ecx
cmp rsi, rax
jb 0x1400f3ab4
mov ebx, 0x8000ffff
jmp 0x1400f3ac2
mov esi, ecx
mov eax, edx
mov ebx, eax
test eax, eax
jns 0x1400f3b42
cmp ebx, 0x80070103
je 0x1400f3b3b
xor eax, eax
mov ecx, 0x800700ea
cmp ebx, ecx
cmovne eax, ebx
cmp eax, 0x8007139f
jne 0x1400f3aea
inc qword [rdi + 0x18]
mov r8, qword [rbp + 0x50]
jmp 0x1400f3993
test eax, eax
js 0x1400f3b50
and qword [rbp + 0x40], 0
lea rcx, [rbp + 0x40]
mov rdx, rsi
call fcn.1400c3aa8
mov ebx, eax
test eax, eax
js 0x1400f3b29
mov rcx, qword [rdi + 0x20]
mov rax, qword [rbp + 0x40]
mov r8, qword [rbp + 0x50]
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x28], rsi
test rcx, rcx
je 0x1400f3993
call fcn.140030c60
jmp 0x1400f3ae1
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x1400f3b37
call fcn.140030c60
mov eax, ebx
jmp 0x1400f3b50
and qword [r12], 0
jmp 0x1400f3b4e
mov rax, qword [rdi + 0x20]
inc qword [rdi + 0x18]
mov qword [r12], rax
xor eax, eax
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret