joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ade50
Capabilities:
Connect socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rbx, rdx
mov rsi, rcx
mov rcx, rdx
mov edx, 1
call sym.mio::sys::windows::net::new_ip_socket::h3c918b581e409ca7
mov rdi, rdx
test rax, rax
je 0x1400ade82
mov qword [rsi + 8], rdi
mov qword [rsi], 0xffffffffffffffff
jmp 0x1400adf1b
cmp word [rbx], 0
je 0x1400adea7
movups xmm0, xmmword [rbx + 4]
movzx eax, word [rbx + 0x1c]
rol ax, 8
mov ecx, dword [rbx + 0x18]
add rbx, 0x14
mov r8d, 0x1c
mov dx, 0x17
jmp 0x1400adec0
movzx eax, word [rbx + 6]
rol ax, 8
add rbx, 2
xorps xmm0, xmm0
mov r8d, 0x10
mov dx, 2
mov r9d, dword [rbx]
mov word [rsp + 0x24], dx
mov word [rsp + 0x26], ax
mov dword [rsp + 0x28], r9d
movups xmmword [rsp + 0x2c], xmm0
mov dword [rsp + 0x3c], ecx
lea rdx, [rsp + 0x24]
mov rcx, rdi
call sub.ws2_32.dll_connect
cmp eax, 0xffffffff
jne 0x1400adf10
call sym.std::sys::pal::windows::os::errno::h64d3f6efc49f2d2e
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov rcx, rbx
call sym._ZN3std2io5error5Error4kind17h58f73e445c83dc12E.llvm.7490366666914169801
cmp al, 0xd
jne 0x1400adf26
mov rcx, rbx
call sym._ZN4core3ptr42drop_in_place_LT_std..io..error..Error_GT_17hf4291b1b139fb7c1E.llvm.7490366666914169801
mov qword [rsi], rdi
mov qword [rsi + 8], 0
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov qword [rsi + 8], rbx
mov qword [rsi], 0xffffffffffffffff
mov rcx, rdi
call sub.ws2_32.dll_closesocket
jmp 0x1400adf1b

Function at 0x1400ae1f0
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
sub rsp, 0x40
movzx eax, word [rdx]
cmp eax, 2
je 0x1400ae215
mov r8, qword [rdx + 8]
cmp eax, 3
jne 0x1400ae219
mov edx, 1
add rsp, 0x40
pop rsi
jmp sym.std::sys_common::net::UdpSocket::connect::h045641db31a0bdfb
xor eax, eax
jmp 0x1400ae24f
mov word [rsp + 0x20], ax
mov eax, dword [rdx + 2]
mov dword [rsp + 0x22], eax
movzx eax, word [rdx + 6]
mov word [rsp + 0x26], ax
mov qword [rsp + 0x28], r8
movups xmm0, xmmword [rdx + 0x10]
movups xmmword [rsp + 0x30], xmm0
xor esi, esi
lea r8, [rsp + 0x20]
xor edx, edx
call sym.std::sys_common::net::UdpSocket::connect::h045641db31a0bdfb
test rax, rax
je 0x1400ae25d
test rax, rax
lea rsi, str.could_not_resolve_to_any_addresses
cmovne rsi, rax
mov rax, rsi
add rsp, 0x40
pop rsi
ret

Function at 0x1400ae590
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rcx, qword [str.pH_v_]
xor edx, edx
jmp sym.std::sys::thread_local::os::Storage_T_::get::h87056b7d0b3afeaf

Function at 0x1400b23a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rcx, qword [str.pH_v_]
xor edx, edx
jmp sym.std::sys::thread_local::os::Storage_T_::get::h87056b7d0b3afeaf

Function at 0x1400b3310
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rcx, qword [str.pH_v_]
xor edx, edx
jmp sym.std::sys::thread_local::os::Storage_T_::get::h87056b7d0b3afeaf
Function at 0x1400b3d40
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov edi, dword [rcx]
mov edx, 1
mov ecx, edi
call fcn.14016fdbc
mov edx, 8
mov r8d, 4
mov rcx, rsi
call sym.__rust_dealloc
mov ecx, edi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14016fdbc

Function at 0x1400b3d80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rdx
mov esi, dword [rcx + 0x18]
test esi, esi
je 0x1400b3ec7
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x1400b3ebc
je 0x1400b3eba
test rdi, rdi
je 0x1400b3de7
mov rax, qword [rdi]
mov qword [rdi], 0
test rax, rax
je 0x1400b3de7
movups xmm0, xmmword [rdi + 8]
movups xmm1, xmmword [rdi + 0x18]
movups xmm2, xmmword [rdi + 0x28]
movups xmmword [rsp + 0x50], xmm2
movups xmmword [rsp + 0x40], xmm1
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x28], rax
jmp 0x1400b3df1
lea rcx, [rsp + 0x28]
call sym.parking_lot_core::parking_lot::ThreadData::new::h1a6fd3c82dd9ad4e
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
movups xmm0, xmmword [rsp + 0x38]
movups xmm1, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x98], esi
mov rax, qword [0x1401bf7e8]
movzx eax, byte [rax]
mov ecx, 0x40
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x1400b3ee1
movaps xmm0, xmmword [rsp + 0x60]
movaps xmm1, xmmword [rsp + 0x70]
movaps xmm2, xmmword [rsp + 0x80]
movaps xmm3, xmmword [rsp + 0x90]
movups xmmword [rax + 0x30], xmm3
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call fcn.14016fdbc
test rdi, rdi
je 0x1400b3eb5
mov rcx, rdi
call sym.__parking_lot_core::parking_lot::ThreadData_as_core::ops::drop::Drop_::drop::hafe228a4678c7072
mov edx, 0x40
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov rax, rsi
jmp 0x1400b3ebc
xor eax, eax
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
call sym.std::sys::thread_local::key::windows::LazyKey::init::h597144e332ffcf99
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400b3dab
jmp 0x1400b3ebc
mov ecx, 8
mov edx, 0x40
call sym.alloc::alloc::handle_alloc_error::h526f0ddc898dc940
ud2
Function at 0x1400b4070
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov esi, dword [0x1401743c8]
test esi, esi
je 0x1400b4098
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400b40b3
add rax, 4
jmp 0x1400b4116
lea rcx, str.__v_
call sym.std::sys::thread_local::key::windows::LazyKey::init::h597144e332ffcf99
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x1400b4092
je 0x1400b4114
mov rax, qword [0x1401bf7e8]
movzx eax, byte [rax]
mov ecx, 8
mov edx, 4
call sym.__rust_alloc
test rax, rax
je 0x1400b4120
mov rbx, rax
mov dword [rax], esi
add rax, 4
mov r14, rax
mov byte [rbx + 4], 0
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rdx, rbx
call fcn.14016fdbc
test rdi, rdi
je 0x1400b410f
mov edx, 8
mov r8d, 4
mov rcx, rdi
call sym.__rust_dealloc
mov rax, r14
jmp 0x1400b4116
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 4
mov edx, 8
call sym.alloc::alloc::handle_alloc_error::h526f0ddc898dc940
int3

Function at 0x1400b4870
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov edi, dword [rcx + 0x38]
mov edx, 1
mov ecx, edi
call fcn.14016fdbc
lock dec qword [0x1401f30d8]
mov edx, 0x40
mov r8d, 8
mov rcx, rsi
call sym.__rust_dealloc
mov ecx, edi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14016fdbc
Function at 0x1400b5390
Capabilities:
Link many functions at runtime

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x1400b53e2
mov rsi, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x1400b53e2
mov rdi, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rsi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x1400b53e2
mov rbx, rax
xor esi, esi
jmp 0x1400b5466
lea rcx, str.ntdll.dll
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x1400b54d8
mov rdi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x1400b54d8
mov rbx, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x1400b54d8
mov rsi, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x1400b54d8
mov rdi, rax
lea rcx, [rsp + 0x28]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x1400b54d8
mov rbx, qword [rsp + 0x28]
mov rax, qword [0x1401bf7e8]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x1400b550f
mov r14, rax
mov qword [rax], rsi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rbx
xor eax, eax
lock cmpxchg qword [0x1401f30e8], r14
je 0x1400b54cb
mov rsi, rax
cmp qword [r14], 0
je 0x1400b54b5
mov rcx, qword [r14 + 0x10]
call sub.kernel32.dll_CloseHandle
mov edx, 0x18
mov r8d, 8
mov rcx, r14
call sym.__rust_dealloc
mov r14, rsi
mov rax, r14
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rax, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rdx, str.C:UsersSIDAHMED.cargo_registry_srcindex.crates.io_6f17d22bba15001fparking_lot_core_0.9.10_src_thread_parkerwindowsmod.rs
lea rcx, [rsp + 0x28]
call sym.core::panicking::panic_fmt::h50bba86df16ca19f
mov ecx, 8
mov edx, 0x18
call sym.alloc::alloc::handle_alloc_error::h526f0ddc898dc940
ud2
Function at 0x1400bf3a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov rdi, rdx
mov esi, dword [rcx + 0x18]
test esi, esi
je 0x1400bf46f
dec esi
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x1400bf462
je 0x1400bf460
test rdi, rdi
je 0x1400bf3e9
movups xmm6, xmmword [rdi + 8]
cmp qword [rdi], 0
mov qword [rdi], 0
jne 0x1400bf405
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsp + 0x20]
mov rax, qword [0x1401bf7e8]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x1400bf489
movups xmmword [rax], xmm6
mov dword [rax + 0x10], esi
mov ecx, esi
mov rbx, rax
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call fcn.14016fdbc
test rdi, rdi
je 0x1400bf45b
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov rax, rsi
jmp 0x1400bf462
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call sym.std::sys::thread_local::key::windows::LazyKey::init::h597144e332ffcf99
mov esi, eax
mov ecx, esi
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400bf3cd
jmp 0x1400bf462
mov ecx, 8
mov edx, 0x18
call sym.alloc::alloc::handle_alloc_error::h526f0ddc898dc940
int3

Function at 0x1400c0760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
sub rsp, 0x28
movzx eax, byte [rcx]
cmp eax, 1
je 0x1400c078d
cmp eax, 2
jne 0x1400c0857
mov rcx, qword [rcx + 8]
mov rax, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
cmp r9, r8
je 0x1400c07b7
jmp 0x1400c083f
xor r9d, r9d
cmp byte [rcx + 1], 0
sete r9b
lea rcx, str.httphttps
lea rax, [0x14019648c]
cmove rax, rcx
xor r9, 5
cmp r9, r8
jne 0x1400c083f
test r8, r8
je 0x1400c0843
movzx ecx, byte [rax]
movzx r9d, byte [rdx]
lea r10d, [rcx - 0x41]
cmp r10b, 0x1a
setb r10b
shl r10b, 5
lea r11d, [r9 - 0x41]
cmp r11b, 0x1a
setb r11b
shl r11b, 5
or r10b, cl
or r11b, r9b
cmp r10b, r11b
jne 0x1400c083f
lea r9, [r8 - 1]
xor ecx, ecx
nop dword [rax + rax]
cmp r9, rcx
je 0x1400c0847
movzx r10d, byte [rax + rcx + 1]
movzx r11d, byte [rdx + rcx + 1]
lea esi, [r10 - 0x41]
cmp sil, 0x1a
setb bl
shl bl, 5
lea esi, [r11 - 0x41]
cmp sil, 0x1a
setb sil
shl sil, 5
or bl, r10b
or sil, r11b
inc rcx
cmp bl, sil
je 0x1400c0800
jmp 0x1400c084a
xor eax, eax
jmp 0x1400c0850
mov al, 1
jmp 0x1400c0850
mov rcx, r8
cmp rcx, r8
setae al
add rsp, 0x28
pop rbx
pop rsi
ret
lea rcx, [0x1401963de]
lea r8, [0x140196470]
mov edx, 0x28
call sym.core::panicking::panic::h82631201f060ca88
int3
Function at 0x1400c0870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
sub rsp, 0x28
movzx eax, byte [r8]
cmp eax, 1
je 0x1400c089e
cmp eax, 2
jne 0x1400c0967
mov r8, qword [r8 + 8]
mov rax, qword [r8 + 8]
mov r9, qword [r8 + 0x10]
cmp r9, rdx
je 0x1400c08c9
jmp 0x1400c094f
xor r9d, r9d
cmp byte [r8 + 1], 0
sete r9b
lea r8, str.httphttps
lea rax, [0x14019648c]
cmove rax, r8
xor r9, 5
cmp r9, rdx
jne 0x1400c094f
test rdx, rdx
je 0x1400c0953
movzx r8d, byte [rax]
movzx r9d, byte [rcx]
lea r10d, [r8 - 0x41]
cmp r10b, 0x1a
setb r10b
shl r10b, 5
lea r11d, [r9 - 0x41]
cmp r11b, 0x1a
setb r11b
shl r11b, 5
or r10b, r8b
or r11b, r9b
cmp r10b, r11b
jne 0x1400c094f
lea r9, [rdx - 1]
xor r8d, r8d
nop dword [rax]
cmp r9, r8
je 0x1400c0957
movzx r10d, byte [rax + r8 + 1]
movzx r11d, byte [rcx + r8 + 1]
lea esi, [r10 - 0x41]
cmp sil, 0x1a
setb bl
shl bl, 5
lea esi, [r11 - 0x41]
cmp sil, 0x1a
setb sil
shl sil, 5
or bl, r10b
or sil, r11b
inc r8
cmp bl, sil
je 0x1400c0910
jmp 0x1400c095a
xor eax, eax
jmp 0x1400c0960
mov al, 1
jmp 0x1400c0960
mov r8, rdx
cmp r8, rdx
setae al
add rsp, 0x28
pop rbx
pop rsi
ret
lea rcx, [0x1401963de]
lea r8, [0x140196470]
mov edx, 0x28
call sym.core::panicking::panic::h82631201f060ca88
int3

Function at 0x1400c1110
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rcx, qword [0x1401745a8]
xor edx, edx
jmp sym.std::sys::thread_local::os::Storage_T_::get::hd44087437a862f9d

Function at 0x1400cc320
Capabilities:
Stop service

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
movabs rdi, 0x8000000000000000
mov rcx, qword [rdx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x2c], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x20]
mov edx, 1
call sub.advapi32.dll_ControlService
test eax, eax
je 0x1400cc3de
mov eax, dword [rsp + 0x24]
lea ecx, [rax - 1]
cmp ecx, 6
ja 0x1400cc3f9
mov edx, dword [rsp + 0x38]
mov ecx, 0x173
and ecx, dword [rsp + 0x20]
mov r10d, dword [rsp + 0x2c]
mov r8d, 0x7ff
and r8d, dword [rsp + 0x28]
mov r9d, dword [rsp + 0x34]
xor r11d, r11d
cmp r10d, 0x42a
sete r11b
jne 0x1400cc3a3
mov r10d, dword [rsp + 0x30]
imul rbx, rdx, 0x10624dd3
shr rbx, 0x26
imul ebp, ebx, 0x3e8
sub edx, ebp
imul edx, edx, 0xf4240
mov dword [rsi], r11d
mov dword [rsi + 4], r10d
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rbx
mov dword [rsi + 0x18], edx
mov dword [rsi + 0x20], eax
mov dword [rsi + 0x24], ecx
mov dword [rsi + 0x28], r8d
mov dword [rsi + 0x2c], r9d
jmp 0x1400cc41a
call sym.std::sys::pal::windows::os::errno::h64d3f6efc49f2d2e
shl rax, 0x20
or rax, 2
add rdi, 6
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rax
jmp 0x1400cc414
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rax
lea rax, str.service_statusservice_action_failures_commandservice_action_failures_reboot_messageToo_long_timeout
mov qword [rsi + 0x20], rax
mov qword [rsi + 0x28], 0xe
mov dword [rsi], 2
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400cc430
Capabilities:
Pause service

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
movabs rdi, 0x8000000000000000
mov rcx, qword [rdx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x2c], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x20]
mov edx, 2
call sub.advapi32.dll_ControlService
test eax, eax
je 0x1400cc4ee
mov eax, dword [rsp + 0x24]
lea ecx, [rax - 1]
cmp ecx, 6
ja 0x1400cc509
mov edx, dword [rsp + 0x38]
mov ecx, 0x173
and ecx, dword [rsp + 0x20]
mov r10d, dword [rsp + 0x2c]
mov r8d, 0x7ff
and r8d, dword [rsp + 0x28]
mov r9d, dword [rsp + 0x34]
xor r11d, r11d
cmp r10d, 0x42a
sete r11b
jne 0x1400cc4b3
mov r10d, dword [rsp + 0x30]
imul rbx, rdx, 0x10624dd3
shr rbx, 0x26
imul ebp, ebx, 0x3e8
sub edx, ebp
imul edx, edx, 0xf4240
mov dword [rsi], r11d
mov dword [rsi + 4], r10d
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rbx
mov dword [rsi + 0x18], edx
mov dword [rsi + 0x20], eax
mov dword [rsi + 0x24], ecx
mov dword [rsi + 0x28], r8d
mov dword [rsi + 0x2c], r9d
jmp 0x1400cc52a
call sym.std::sys::pal::windows::os::errno::h64d3f6efc49f2d2e
shl rax, 0x20
or rax, 2
add rdi, 6
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rax
jmp 0x1400cc524
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rax
lea rax, str.service_statusservice_action_failures_commandservice_action_failures_reboot_messageToo_long_timeout
mov qword [rsi + 0x20], rax
mov qword [rsi + 0x28], 0xe
mov dword [rsi], 2
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x1400cc540
Capabilities:
Continue service

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
movabs rdi, 0x8000000000000000
mov rcx, qword [rdx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x2c], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x20]
mov edx, 3
call sub.advapi32.dll_ControlService
test eax, eax
je 0x1400cc5fe
mov eax, dword [rsp + 0x24]
lea ecx, [rax - 1]
cmp ecx, 6
ja 0x1400cc619
mov edx, dword [rsp + 0x38]
mov ecx, 0x173
and ecx, dword [rsp + 0x20]
mov r10d, dword [rsp + 0x2c]
mov r8d, 0x7ff
and r8d, dword [rsp + 0x28]
mov r9d, dword [rsp + 0x34]
xor r11d, r11d
cmp r10d, 0x42a
sete r11b
jne 0x1400cc5c3
mov r10d, dword [rsp + 0x30]
imul rbx, rdx, 0x10624dd3
shr rbx, 0x26
imul ebp, ebx, 0x3e8
sub edx, ebp
imul edx, edx, 0xf4240
mov dword [rsi], r11d
mov dword [rsi + 4], r10d
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rbx
mov dword [rsi + 0x18], edx
mov dword [rsi + 0x20], eax
mov dword [rsi + 0x24], ecx
mov dword [rsi + 0x28], r8d
mov dword [rsi + 0x2c], r9d
jmp 0x1400cc63a
call sym.std::sys::pal::windows::os::errno::h64d3f6efc49f2d2e
shl rax, 0x20
or rax, 2
add rdi, 6
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rax
jmp 0x1400cc634
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rax
lea rax, str.service_statusservice_action_failures_commandservice_action_failures_reboot_messageToo_long_timeout
mov qword [rsi + 0x20], rax
mov qword [rsi + 0x28], 0xe
mov dword [rsi], 2
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400cc760
Capabilities:
Query service status

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x2c], 0
mov rcx, qword [rdx]
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
xor edx, edx
mov r9d, 0x24
call sub.advapi32.dll_QueryServiceStatusEx
test eax, eax
je 0x1400cc84b
mov eax, dword [rsp + 0x34]
lea ecx, [rax - 1]
cmp ecx, 6
ja 0x1400cc870
mov r10d, dword [rsp + 0x48]
xor edx, edx
cmp eax, 4
sete r11b
mov ecx, 0x173
and ecx, dword [rsp + 0x30]
mov edi, dword [rsp + 0x3c]
mov r8d, 0x7ff
and r8d, dword [rsp + 0x38]
mov r9d, dword [rsp + 0x44]
xor ebx, ebx
cmp edi, 0x42a
sete bl
jne 0x1400cc7ff
mov edi, dword [rsp + 0x40]
imul r14, r10, 0x10624dd3
shr r14, 0x26
imul ebp, r14d, 0x3e8
sub r10d, ebp
imul r10d, r10d, 0xf4240
mov r15d, dword [rsp + 0x4c]
shl r15, 0x20
mov dl, r11b
or rdx, r15
mov dword [rsi], ebx
mov dword [rsi + 4], edi
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r14
mov dword [rsi + 0x18], r10d
mov dword [rsi + 0x20], eax
mov dword [rsi + 0x24], ecx
mov dword [rsi + 0x28], r8d
mov dword [rsi + 0x2c], r9d
jmp 0x1400cc89b
call sym.std::sys::pal::windows::os::errno::h64d3f6efc49f2d2e
shl rax, 0x20
or rax, 2
movabs rcx, 0x8000000000000000
or rcx, 6
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
jmp 0x1400cc895
movabs rcx, 0x8000000000000000
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
lea rax, str.service_statusservice_action_failures_commandservice_action_failures_reboot_messageToo_long_timeout
mov qword [rsi + 0x20], rax
mov qword [rsi + 0x28], 0xe
mov dword [rsi], 2
mov rax, rsi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400cc8b0
Capabilities:
Delete service

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
movabs rdi, 0x8000000000000006
mov rcx, qword [rdx]
call sub.advapi32.dll_DeleteService
test eax, eax
je 0x1400cc8d5
or rdi, 1
jmp 0x1400cc8e6
call sym.std::sys::pal::windows::os::errno::h64d3f6efc49f2d2e
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], rdi
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400cc9f0
Capabilities:
Modify service

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x178
mov rdi, rdx
mov rsi, rcx
movabs rbx, 0x8000000000000000
lea rcx, [rsp + 0x100]
mov rdx, r8
call sym.windows_service::service::RawServiceInfo::new::hbb084a9690d35f6c
mov rax, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x128]
mov qword [rsp + 0x80], rcx
lea rcx, [rbx + 1]
movups xmm0, xmmword [rsp + 0x108]
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rsp + 0x118]
movaps xmmword [rsp + 0x70], xmm0
cmp rax, rcx
jne 0x1400cca79
mov rax, qword [rsp + 0x80]
mov qword [rsi + 0x20], rax
movaps xmm0, xmmword [rsp + 0x60]
movaps xmm1, xmmword [rsp + 0x70]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
jmp 0x1400ccb9e
mov rcx, qword [rsp + 0x170]
mov qword [rsp + 0xf8], rcx
movups xmm0, xmmword [rsp + 0x130]
movups xmm1, xmmword [rsp + 0x140]
movups xmm2, xmmword [rsp + 0x150]
movups xmm3, xmmword [rsp + 0x160]
movups xmmword [rsp + 0xe8], xmm3
movups xmmword [rsp + 0xd8], xmm2
movups xmmword [rsp + 0xc8], xmm1
movups xmmword [rsp + 0xb8], xmm0
movaps xmm0, xmmword [rsp + 0x60]
movaps xmm1, xmmword [rsp + 0x70]
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm1
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0x88], rax
mov rcx, qword [rdi]
mov edx, dword [rsp + 0xf0]
mov r8d, dword [rsp + 0xf4]
mov r9d, dword [rsp + 0xf8]
mov r11, qword [rsp + 0xb0]
mov r10, qword [rsp + 0xc0]
cmp rax, rbx
je 0x1400ccb34
mov rax, qword [rsp + 0x90]
jmp 0x1400ccb36
xor eax, eax
mov rdi, qword [rsp + 0xd0]
mov r14, qword [rsp + 0xe0]
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], r10
call sub.advapi32.dll_ChangeServiceConfigW
test eax, eax
je 0x1400ccb79
add rbx, 7
mov qword [rsi], rbx
jmp 0x1400ccb91
call sym.std::sys::pal::windows::os::errno::h64d3f6efc49f2d2e
shl rax, 0x20
or rax, 2
add rbx, 6
mov qword [rsi], rbx
mov qword [rsi + 8], rax
lea rcx, [rsp + 0x88]
call fcn.1400c9490
mov rax, rsi
add rsp, 0x178
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400ccbd0
Capabilities:
Modify service

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
movabs rdi, 0x8000000000000006
movzx eax, r8b
mov dword [rsp + 0x24], eax
mov rcx, qword [rdx]
lea r8, [rsp + 0x24]
mov edx, 4
call sub.advapi32.dll_ChangeServiceConfig2W
test eax, eax
je 0x1400ccc07
or rdi, 1
jmp 0x1400ccc18
call sym.std::sys::pal::windows::os::errno::h64d3f6efc49f2d2e
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], rdi
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1400ccdf0
Capabilities:
Modify service

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
movabs rdi, 0x8000000000000006
mov dword [rsp + 0x24], r8d
mov rcx, qword [rdx]
lea r8, [rsp + 0x24]
mov edx, 5
call sub.advapi32.dll_ChangeServiceConfig2W
test eax, eax
je 0x1400cce24
or rdi, 1
jmp 0x1400cce35
call sym.std::sys::pal::windows::os::errno::h64d3f6efc49f2d2e
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], rdi
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret