joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002a2e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xa8]
sub rsp, 0x1a8
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rdi, rcx
mov word [rsp + 0x6a], 0x5446
lea rcx, [rsp + 0x48]
mov word [rsp + 0x70], 0x5c
mov r15d, r9d
mov word [rsp + 0x6d], 0x5241
mov r14d, r8d
mov word [rsp + 0x68], 0x4f53
mov rsi, rdx
mov byte [rsp + 0x6f], 0x45
mov byte [rsp + 0x6c], 0x57
call fcn.180001bf0
mov r8, rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
call fcn.180001aa0
mov rcx, rax
call fcn.180001c70
mov rdx, rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.1800294f0
lea rcx, [rsp + 0x50]
movsxd rbx, eax
call fcn.180001be0
lea rcx, [rsp + 0x48]
call fcn.180001be0
test rbx, rbx
jne 0x18002a487
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x104
call fcn.1800043a0
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x68]
lea rax, [rbp - 0x80]
mov dword [rsp + 0x6a], 0x736c61
mov qword [rsp + 0x20], rax
mov word [rsp + 0x68], 0x7668
call fcn.1800297d0
test eax, eax
jne 0x18002a47d
cmp dword [rsp + 0x58], eax
jbe 0x18002a47d
lea rcx, [rsp + 0x50]
call fcn.180001c40
mov r8, rdi
mov word [rsp + 0x40], 0x6425
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x42], bl
lea rcx, [rsp + 0x50]
call fcn.180002450
lea rcx, [rsp + 0x48]
call fcn.180001c40
lea r8, [rbp - 0x80]
lea rdx, [0x18003660c]
lea rcx, [rsp + 0x48]
call fcn.180002450
lea rcx, [rsp + 0x50]
call fcn.180001c70
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.180001b60
test eax, eax
js 0x18002a469
mov rcx, qword [rsp + 0x60]
call fcn.180029440
lea rcx, [rsp + 0x48]
call fcn.180001be0
lea rcx, [rsp + 0x50]
call fcn.180001be0
lea eax, [rbx + 1]
jmp 0x18002a4b7
lea rcx, [rsp + 0x48]
call fcn.180001be0
lea rcx, [rsp + 0x50]
call fcn.180001be0
mov rcx, qword [rsp + 0x60]
call fcn.180029440
mov eax, dword [rbp + 0x110]
mov r9d, r15d
mov dword [rsp + 0x30], eax
mov r8d, r14d
mov eax, dword [rbp + 0x108]
mov rdx, rsi
mov dword [rsp + 0x28], eax
mov rcx, rdi
mov eax, dword [rbp + 0x100]
mov dword [rsp + 0x20], eax
call qword [0x1800678b8]
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x1a8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x18002a4e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x38], rax
call fcn.180029ae0
test rax, rax
je 0x18002a548
lea rdx, [rsp + 0x20]
mov word [rsp + 0x25], 0x6957
mov rcx, rax
mov dword [rsp + 0x20], 0x6e697242
mov dword [rsp + 0x27], 0x776f646e
mov dword [rsp + 0x2d], 0x706f54
mov byte [rsp + 0x24], 0x67
mov word [rsp + 0x2b], 0x6f54
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x48
ret
Function at 0x18002a560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.180029ae0
test rax, rax
je 0x18002a5c6
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2b], 0x776f646e
mov rcx, rax
mov dword [rsp + 0x25], 0x65766974
mov dword [rsp + 0x20], 0x41746553
mov word [rsp + 0x29], 0x6957
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x24], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x48
ret

Function at 0x18002a5e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x38], rax
call fcn.180029ae0
test rax, rax
je 0x18002a657
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x23], 0x65726f46
mov rcx, rax
mov dword [rsp + 0x2f], 0x776f646e
mov dword [rsp + 0x2a], 0x57646e75
mov word [rsp + 0x20], 0x6553
mov word [rsp + 0x27], 0x7267
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x33], 0
mov byte [rsp + 0x2e], 0x69
mov byte [rsp + 0x29], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x48
ret

Function at 0x18002a670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.180029ae0
test rax, rax
je 0x18002a6d3
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x21], 0x69577465
mov rcx, rax
mov dword [rsp + 0x28], 0x736f5077
mov word [rsp + 0x25], 0x646e
mov byte [rsp + 0x20], 0x53
mov byte [rsp + 0x2c], 0
mov byte [rsp + 0x27], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x48
ret
Function at 0x18002acc0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x500
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov ebp, r8d
mov rsi, rdx
mov r8d, ecx
call fcn.180029150
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x18002ad95
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, rbx
cmp eax, 0xffffffff
je 0x18002adc7
mov qword [rsp + 0x518], rdi
lea rdx, [rsp + 0x20]
xor edi, edi
mov dword [rsp + 0x50], 0x100001
call fcn.1800291e0
test eax, eax
je 0x18002ad8a
nop dword [rax + rax]
mov rcx, qword [rsp + 0x118]
cmp rcx, rsi
jb 0x18002ad8a
lea rax, [rsi + rbp]
cmp rcx, rax
jae 0x18002ad8a
mov rcx, rbx
call fcn.180029320
cmp edi, 3
jge 0x18002adba
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SuspendThread]
lea rdx, [rsp + 0x20]
mov rcx, rbx
inc edi
call fcn.1800291e0
test eax, eax
jne 0x18002ad40
mov rax, rbx
mov rdi, qword [rsp + 0x518]
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.1800025d0
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x18002ad8d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x18002ad95
Function at 0x14000a9e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push r14
sub rsp, 0x40
and qword [rax - 0x10], 0
mov r14, r9
mov rbp, r8
lea r9, [rax - 0x10]
xor ebx, ebx
mov rcx, 0xffffffff80000002
lea r8d, [rbx + 1]
call fcn.14000cf8c
mov esi, eax
test eax, eax
jns 0x14000aa27
mov ecx, eax
jmp 0x14000aaef
and dword [rsp + 0x50], ebx
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x14000aa6c
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x14000aaa8
test rbx, rbx
jne 0x14000aab3
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x14000aaac
mov ebx, eax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14000aa2b
mov esi, 0x8007000e
mov ecx, esi
jmp 0x14000aaef
mov esi, 0x8000ffff
jmp 0x14000aaa8
cmp dword [rsp + 0x30], 0xb
je 0x14000aac1
mov esi, 0x8007000d
jmp 0x14000aaa8
xor ebp, ebp
cmp dword [rsp + 0x50], 8
je 0x14000aada
mov esi, 0x8007000d
mov ecx, esi
mov ebp, esi
call fcn.14000b750
jmp 0x14000aae0
mov rax, qword [rbx]
mov qword [r14], rax
mov ecx, ebp
call fcn.14000b770
mov esi, ebp
test ebp, ebp
jns 0x14000aaf4
mov ecx, ebp
call fcn.14000b750
mov ecx, esi
call fcn.14000b770
test rbx, rbx
je 0x14000ab20
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
cmp qword [rsp + 0x38], 0
je 0x14000ab39
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x58]
mov eax, esi
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
Function at 0x14000ab58
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
and qword [rbp + 0x20], 0
lea r8, [rbp + 0x20]
xor ebx, ebx
lea rcx, str.D:PAI_A_OICI_FA___WD_
xor esi, esi
xor r9d, r9d
mov qword [rbp + 0x28], rsi
lea edi, [rbx + 1]
mov edx, edi
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
nop dword [rax + rax]
test eax, eax
jne 0x14000abc3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14000abae
mov edi, 0x80004005
jmp 0x14000abbc
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
jmp 0x14000aca0
mov rax, qword [rbp + 0x20]
lea r8, str.GlobalMicrosoft.Windows.Remediation.TelemetryUpdateHealthTools
and dword [rbp - 0x1c], ebx
lea rcx, [rbp - 0x20]
and dword [rbp - 0xc], ebx
xor edx, edx
and dword [rbp - 0x10], ebx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x20], 0x18
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14000ab97
mov edx, 0x2710
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
test eax, eax
je 0x14000ac55
cmp eax, 0x102
je 0x14000ac4b
cmp eax, 0xffffffff
jne 0x14000aba7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14000ac34
xor edi, edi
jmp 0x14000aca5
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
je 0x14000aca5
jmp 0x14000abbc
mov edi, 0x800705b4
jmp 0x14000abbc
lea r9, [rbp + 0x28]
lea r8, [0x14003a5c0]
lea rdx, str.SoftwareMicrosoftRemediationLocalStateTelemetryUpdateHealthTools
call fcn.14000a9e0
mov rsi, qword [rbp + 0x28]
test eax, eax
cmovs rsi, rdi
call fcn.14000c000
mov edi, eax
test eax, eax
js 0x14000ac9e
lea r9, [rsi + 1]
lea r8, [0x14003a5c0]
lea rdx, str.SoftwareMicrosoftRemediationLocalStateTelemetryUpdateHealthTools
call fcn.14000bf0c
mov edi, eax
test eax, eax
jns 0x14000aca5
mov ecx, eax
call fcn.14000b750
test rbx, rbx
je 0x14000acb9
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
nop dword [rax + rax]
test edi, edi
jns 0x14000accb
lea rdx, str.Failed_to_get_a_proper_GlobalEventCounter_for_telemetry__using_0
mov ecx, edi
call fcn.14000afb0
test rbx, rbx
je 0x14000acdf
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x14000acf4
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x70]
mov rax, rsi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000bf0c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rbx, r9
mov rsi, r8
mov rdi, rdx
xor ecx, ecx
call fcn.14000b770
and qword [rsp + 0x50], 0
lea r9, [rsp + 0x50]
mov r8d, 2
mov qword [rsp + 0x30], rbx
mov rdx, rdi
mov rcx, 0xffffffff80000002
call fcn.14000cf8c
mov rbx, qword [rsp + 0x50]
mov edi, eax
test eax, eax
jns 0x14000bf64
mov ecx, eax
jmp 0x14000bfb4
xor ecx, ecx
call fcn.14000b770
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 8
mov r9d, 0xb
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000bfa0
xor edi, edi
jmp 0x14000bfb9
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
je 0x14000bfb9
mov ecx, edi
call fcn.14000b750
mov ecx, edi
call fcn.14000b770
test rbx, rbx
je 0x14000bfd4
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test edi, edi
jns 0x14000bfdf
mov ecx, edi
call fcn.14000b750
mov ecx, edi
call fcn.14000b770
mov rbx, qword [rsp + 0x58]
mov eax, edi
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000dde8
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x140055910]
xor rax, rsp
mov qword [rbp + 0x140], rax
and qword [rdx], 0
mov r15, rdx
mov r8, rcx
mov edi, 0x104
mov edx, edi
lea rcx, [rsp + 0x30]
xor r14d, r14d
call fcn.140003870
lea r8, [0x140036010]
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.1400038fc
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
lea r13, [0x140035fd4]
mov rbx, rax
test rax, rax
jne 0x14000dea0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
je 0x14000dfa6
mov rcx, qword [rbp + 0x178]
lea edx, [rdi - 0x3b]
mov r8, r13
call fcn.140005220
mov esi, eax
jmp 0x14000df87
and dword [rsp + 0x24], r14d
lea rdx, [rsp + 0x24]
and dword [rsp + 0x20], r14d
mov rcx, rbx
call fcn.14000534c
mov esi, eax
test eax, eax
jns 0x14000dee1
mov rcx, qword [rbp + 0x178]
mov r9d, eax
mov r8, r13
mov edx, 0xcf
call fcn.1400051e8
mov rcx, rbx
call fcn.1400052c4
jmp 0x14000df87
lea r8, [0x140036018]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400038fc
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x14000df2d
mov rcx, qword [rbp + 0x178]
mov r8, r13
mov edx, 0xd5
call fcn.140005220
mov esi, eax
jmp 0x14000ded4
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14000534c
mov esi, eax
test eax, eax
jns 0x14000df64
mov rcx, qword [rbp + 0x178]
mov r9d, eax
mov r8, r13
mov edx, 0xd7
call fcn.1400051e8
mov rcx, rdi
call fcn.1400052c4
jmp 0x14000ded4
mov rcx, rdi
call fcn.1400052c4
movsxd rax, dword [rsp + 0x20]
mov rcx, rbx
movsxd r14, dword [rsp + 0x24]
shl rax, 0x1f
or r14, rax
call fcn.1400052c4
xor esi, esi
test esi, esi
jns 0x14000dfa6
mov rcx, qword [rbp + 0x178]
mov r9d, esi
mov r8, r13
mov edx, 0x62
call fcn.1400051e8
mov eax, esi
jmp 0x14000dfab
mov qword [r15], r14
xor eax, eax
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.14002fd10
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x14000eab8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r10]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x14000eaf0
mov r8, qword [r9 + 0x30]
and r8, rcx
mov rdi, qword [r9 + 8]
mov rax, r8
add rax, rax
mov rcx, qword [r9 + 0x18]
mov rdx, qword [rcx + rax*8]
cmp rdi, rdx
je 0x14000eb84
mov rdi, qword [rcx + rax*8 + 8]
mov rdi, qword [rdi]
cmp rdi, rdx
je 0x14000eb84
mov rdi, qword [rdi + 8]
mov eax, dword [rdi + 0x10]
cmp dword [r10], eax
jne 0x14000eb35
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
lea rcx, [rbx + 0x18]
call fcn.14000b9a0
mov edx, 0x38
mov rcx, rbx
call fcn.14002fd38
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14000ec21
mov rax, qword [rbx]
cmp rdi, rax
je 0x14000ebb9
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov r10, r8
add r10, r10
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10*8]
add r8, r8
cmp rax, qword [r9 + 8]
jne 0x14000ebdf
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14000ec0e
cmp rax, rdi
jne 0x14000ebea
mov qword [rdx + r8*8], rbx
jmp 0x14000ec0e
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14000ec0e
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10*8 + 8], rcx
mov rcx, r9
call fcn.14000ec38
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000f1c8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rdi + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000f1ec
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14000f243
cmp qword [rcx + rdx*8], rdi
jne 0x14000f238
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x14000f23c
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14000f250
cmp qword [rcx + rdx*8], rdi
jne 0x14000f250
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x18]
dec qword [r9 + 0x10]
call fcn.14000b9a0
mov edx, 0x38
mov rcx, rdi
call fcn.14002fd38
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000f29c
Capabilities:
Create service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x140055910]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r8d, 0x104
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
nop dword [rax + rax]
test eax, eax
je 0x14000f396
mov ebx, 3
xor edx, edx
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x14000f396
and qword [rsp + 0x60], 0
lea rax, [rsp + 0x70]
and qword [rsp + 0x58], 0
lea r9d, [rbx + 1]
and qword [rsp + 0x50], 0
lea r8, str.Restores_Health_of_Windows_Update_Components
and qword [rsp + 0x48], 0
lea rdx, str.Update_Health_Service
and qword [rsp + 0x40], 0
mov rcx, rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CreateServiceW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14000f371
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x14000f3a2
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
jmp 0x14000f3a2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14002fd10
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x290
pop rdi
ret
Function at 0x14000f3cc
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140055910]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
xorps xmm0, xmm0
xor edx, edx
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov dword [rsp + 0x38], eax
movups xmmword [rsp + 0x20], xmm0
lea r8d, [rax + 1]
mov esi, 0xe10
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x14000f4dd
mov r8d, 0x10024
lea rdx, str.Update_Health_Service
mov rcx, rax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14000f4ba
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
nop dword [rax + rax]
test eax, eax
je 0x14000f4ab
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
nop dword [rax + rax]
jmp 0x14000f493
cmp dword [rsp + 0x24], 3
jne 0x14000f4ab
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
nop dword [rax + rax]
sub esi, 1
je 0x14000f4ab
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
nop dword [rax + rax]
test eax, eax
jne 0x14000f476
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_DeleteService]
nop dword [rax + rax]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x14000f4dd
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002fd10
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret