joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001ed04
Capabilities:
Enumerate process modules

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x298]
sub rsp, 0x390
mov r14, rdx
mov ebx, ecx
xor edx, edx
lea rcx, [rbp + 0x50]
mov r8d, 0x238
xor edi, edi
call fcn.14003a5c0
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x104
call fcn.14003a5c0
mov rcx, r14
call fcn.140004e8c
mov r8d, ebx
xor edx, edx
mov ecx, 0x411
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14001ee50
mov edx, ebx
lea ecx, [rdi + 8]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001ee39
lea rdx, [rbp + 0x50]
mov dword [rbp + 0x50], 0x238
mov rcx, rax
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x14001ee39
mov edi, 1
mov rdx, qword [rbp + 0x78]
lea r8, [rsp + 0x40]
mov r9d, 0x104
mov rcx, rsi
call sub.KERNEL32.dll_K32GetModuleFileNameExA
and qword [rsp + 0x30], 0
cmp byte [rsp + 0x40], 0
mov qword [rsp + 0x38], reloc.WSOCK32.dll_ntohs
mov byte [rsp + 0x20], 0
jne 0x14001ede1
xor eax, eax
jmp 0x14001edeb
lea rcx, [rsp + 0x40]
call fcn.140045e50
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140004d8c
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.140009638
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001ee25
mov rcx, qword [rsp + 0x20]
inc rdx
mov r8, rdi
call fcn.140004554
lea rdx, [rbp + 0x50]
mov rcx, rbx
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x14001edab
test rbx, rbx
je 0x14001ee47
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x390]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14001ee70
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x150
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x130
xor edi, edi
call fcn.14003a5c0
mov rax, qword [rsi]
lea ecx, [rdi + 2]
xor edx, edx
mov qword [rsi + 8], rax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001eef2
test rax, rax
je 0x14001ef00
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14001eef2
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140021784
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14001eed1
lea edi, [rax + 1]
test rbx, rbx
je 0x14001ef00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x150]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14001ef18
Capabilities:
Enumerate internet cache

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r14d, edx
lea r8, [rbp + 0x40]
mov r15, rcx
xor edi, edi
and dword [rbp + 0x40], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov ecx, dword [rbp + 0x40]
call fcn.140037e70
lea r8, [rbp + 0x40]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov r12, rax
test rax, rax
je 0x14001f02b
mov edi, 1
test r14d, r14d
jne 0x14001ef85
test dword [rbx + 0x18], 0x100000
jne 0x14001efed
jmp 0x14001ef93
cmp r14d, edi
jne 0x14001efed
test dword [rbx + 0x18], 0x100000
je 0x14001efed
mov rsi, qword [rbx + 8]
and qword [rbp - 0x10], 0
mov qword [rbp - 8], reloc.WSOCK32.dll_ntohs
mov byte [rbp - 0x20], 0
cmp byte [rsi], 0
jne 0x14001efb1
xor eax, eax
jmp 0x14001efb9
mov rcx, rsi
call fcn.140045e50
mov r8, rax
lea rcx, [rbp - 0x20]
mov rdx, rsi
call fcn.140004d8c
lea rdx, [rbp - 0x20]
mov rcx, r15
call fcn.140009638
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14001efed
mov rcx, qword [rbp - 0x20]
mov r8, rdi
inc rdx
call fcn.140004554
and dword [rbp + 0x40], 0
lea r8, [rbp + 0x40]
xor edx, edx
mov rcx, r12
call qword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
mov rcx, rbx
call fcn.1400383d4
mov ecx, dword [rbp + 0x40]
call fcn.140037e70
lea r8, [rbp + 0x40]
mov rdx, rax
mov rcx, r12
mov rbx, rax
call qword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
jne 0x14001ef75
test rbx, rbx
je 0x14001f038
mov rcx, rbx
call fcn.1400383d4
mov rbx, qword [rsp + 0x70]
mov eax, edi
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14001f16c
Capabilities:
Get routing table
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0xa0
mov rsi, rcx
xor edi, edi
and dword [rax + 8], edi
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x80
call fcn.14003a5c0
mov rax, qword [rsi]
lea r8d, [rdi + 1]
lea rdx, [rsp + 0xb0]
mov qword [rsi + 8], rax
xor ecx, ecx
call sub.IPHLPAPI.DLL_GetIpForwardTable
cmp eax, 0x7a
je 0x14001f1df
mov r9d, eax
lea r8, str.GetDefaultIpForward:_error_d_r_n
lea edx, [rdi + 0x7f]
lea rcx, [rsp + 0x20]
call fcn.14000ce80
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x14001f270
mov ecx, dword [rsp + 0xb0]
call fcn.140037e70
mov r8d, 1
lea rdx, [rsp + 0xb0]
mov rcx, rax
mov rbx, rax
call sub.IPHLPAPI.DLL_GetIpForwardTable
test eax, eax
je 0x14001f22e
mov r9d, eax
lea r8, str.GetDefaultIpForward:_error_d_r_n
mov edx, 0x7f
lea rcx, [rsp + 0x20]
call fcn.14000ce80
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x14001f25e
cmp dword [rbx], edi
jbe 0x14001f259
mov eax, edi
lea rdx, [rbx + 4]
imul rcx, rax, 0x38
add rdx, rcx
cmp dword [rdx], 0
jne 0x14001f253
cmp dword [rcx + rbx + 8], 0
jne 0x14001f253
mov rcx, rsi
call fcn.1400216b0
inc edi
cmp edi, dword [rbx]
jb 0x14001f232
mov edi, 1
test rbx, rbx
je 0x14001f270
mov edx, 0x3c
mov rcx, rbx
call fcn.140037e68
lea r11, [rsp + 0xa0]
mov eax, edi
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14001f590
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x130
call fcn.14003a5c0
xor edx, edx
lea rcx, [rsp + 0x150]
mov r8d, 0x104
call fcn.14003a5c0
xor ebx, ebx
xor edx, edx
lea ecx, [rbx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001f5e5
or eax, eax
jmp 0x14001f661
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rdi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14001f653
xor edx, edx
lea rcx, [rsp + 0x150]
mov r8d, 0x104
call fcn.14003a5c0
mov ecx, dword [rsp + 0x28]
lea rdx, [rsp + 0x150]
mov r8d, 0x103
call fcn.140016400
lea rdx, [rsp + 0x150]
mov rcx, rsi
call fcn.14007f078
test eax, eax
jne 0x14001f640
inc ebx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14001f5fe
jmp 0x14001f656
or ebx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14001f78c
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x150
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x130
call fcn.14003a5c0
xor ebx, ebx
xor edx, edx
lea ecx, [rbx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001f7cc
or eax, eax
jmp 0x14001f819
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rdi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14001f80b
lea rdx, [rsp + 0x4c]
mov rcx, rsi
call fcn.14007f078
test eax, eax
jne 0x14001f7f8
inc ebx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14001f7e5
jmp 0x14001f80e
or ebx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14001fcc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x14001fdc0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
and qword [rbp - 0x20], 0
xor eax, eax
and dword [rbp + 0x28], 0
mov r14d, r9d
and dword [rbp - 0x18], 0
mov rsi, r8
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov qword [rbp - 8], rax
mov rdi, rcx
test rdx, rdx
jne 0x14001fe05
or eax, 0xffffffff
jmp 0x14001febf
mov rcx, rbx
call fcn.140045e50
test rax, rax
jne 0x14001fe1a
or ebx, 0xffffffff
jmp 0x14001feaf
and qword [rbp - 0x10], 0
lea rcx, [rbp + 0x28]
neg dword [rbp + 0x50]
mov rdx, rbx
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x20]
sbb eax, eax
mov qword [rsp + 0x38], rcx
and eax, 0x100
mov dword [rbp - 0x18], 0x18
lea rcx, [rbp - 0x18]
mov dword [rbp - 8], 1
mov qword [rsp + 0x30], rcx
or eax, 0xf003f
mov dword [rsp + 0x28], eax
xor r9d, r9d
and dword [rsp + 0x20], 0
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, eax
test eax, eax
jne 0x14001fe12
mov rdi, qword [rbp - 0x20]
test rdi, rdi
jne 0x14001fe86
or ebx, 0xffffffff
jmp 0x14001febd
test rsi, rsi
je 0x14001feaf
mov eax, dword [rbp + 0x48]
mov r9d, r14d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rax, qword [rbp + 0x40]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
test rdi, rdi
je 0x14001febd
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140021108
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
xor ebx, ebx
test eax, eax
je 0x140021126
lea eax, [rbx + 1]
jmp 0x140021146
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
test eax, eax
je 0x14002113f
cmp eax, 0xb7
jne 0x140021144
mov ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140021154
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov esi, r8d
mov qword [rax - 0x18], rbx
mov rbp, rdx
mov dword [rax - 0x20], 0x10000000
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rax - 0x28], 2
lea r8d, [rbx + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
or rcx, 0xffffffffffffffff
mov rdi, rax
cmp rax, rcx
jne 0x1400211aa
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400211e6
lea r9, [rsp + 0x68]
mov dword [rsp + 0x68], ebx
mov r8d, esi
mov qword [rsp + 0x20], rbx
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400211d0
mov rcx, rdi
jmp 0x1400211a0
cmp dword [rsp + 0x68], esi
jne 0x1400211db
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140021474
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
mov qword [rbp - 0x28], reloc.WSOCK32.dll_ntohs
mov rdi, rcx
mov qword [rbp - 0x30], rbx
mov byte [rbp - 0x40], bl
cmp byte [rcx], bl
jne 0x1400213e2
mov eax, ebx
jmp 0x1400213e7
call fcn.140045e50
mov r8, rax
lea rcx, [rbp - 0x40]
mov rdx, rdi
call fcn.140004d8c
mov qword [rbp - 8], reloc.WSOCK32.dll_ntohs
mov qword [rbp - 0x10], rbx
mov byte [rbp - 0x20], bl
cmp byte [rdi], bl
je 0x140021414
mov rcx, rdi
call fcn.140045e50
mov rbx, rax
mov r8, rbx
lea rcx, [rbp - 0x20]
mov rdx, rdi
call fcn.140004d8c
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.1400211fc
cmp qword [rbp - 0x28], 0x10
lea rcx, [rbp - 0x40]
cmovae rcx, qword [rbp - 0x40]
call fcn.140021108
mov rdx, qword [rbp - 0x28]
mov ebx, eax
cmp rdx, 0x10
jb 0x140021461
mov rcx, qword [rbp - 0x40]
inc rdx
mov r8d, 1
call fcn.140004554
mov rdi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
test edx, edx
jne 0x1400213b4
jmp fcn.140021108
Function at 0x140021484
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
xor ebx, ebx
mov ebp, r8d
mov qword [rax - 0x28], rbx
mov rsi, r9
mov r14, rdx
mov dword [rax - 0x30], 0x10000000
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbx + 3]
mov dword [rax - 0x38], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
or rcx, 0xffffffffffffffff
mov rdi, rax
cmp rax, rcx
jne 0x1400214df
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140021531
mov edx, dword [rsp + 0x80]
test edx, edx
je 0x1400214f9
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test rsi, rsi
mov dword [rsp + 0x40], ebx
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbx
cmovne r9, rsi
mov r8d, ebp
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140021526
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret

Function at 0x1400215d8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbp, rdx
mov rdi, r9
mov edx, dword [rsp + 0x60]
mov esi, r8d
mov rbx, rcx
test edx, edx
je 0x14002160c
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and dword [rsp + 0x60], 0
lea r9, [rsp + 0x60]
test rdi, rdi
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
cmovne r9, rdi
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140021643
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140021648
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14002193c
Capabilities:
Query service configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
or dword [rdx], 0xffffffff
mov r14, rdx
mov rbp, rcx
mov dword [rsp + 0x48], 0x1000
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor edi, edi
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x1400219f5
mov r8d, 0xf01ff
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbp, rax
test rax, rax
je 0x1400219cf
mov ecx, 0x1000
mov dword [rsp + 0x48], 0x1000
call fcn.140037e70
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
mov rdx, rax
mov rcx, rbp
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x1400219cf
mov eax, dword [rbx + 4]
mov edi, 1
mov dword [r14], eax
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x1400219f3
mov edx, 1
mov rcx, rbx
call fcn.140037e68
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140021a08
Capabilities:
Create service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rbp, r9
mov r14, r8
mov r15, rdx
mov rsi, rcx
call fcn.140021bcc
xor ebx, ebx
test eax, eax
je 0x140021a3f
lea eax, [rbx + 1]
jmp 0x140021ad5
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x140021ad5
mov qword [rsp + 0x60], rbp
lea rax, [0x14009d610]
mov qword [rsp + 0x58], r14
mov r9d, 0xf01ff
mov qword [rsp + 0x50], rax
mov r8, rsi
mov rax, qword [rsp + 0xc0]
mov rdx, rsi
mov qword [rsp + 0x48], rbx
mov rcx, rdi
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb8]
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
test rax, rax
je 0x140021aca
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x140021c64
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov ebp, edx
mov rdi, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x140021cde
mov r8d, 0xf01ff
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
je 0x140021cca
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140021cca
cmp dword [rsp + 0x24], ebp
sete bl
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140021d00
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
xor ebx, ebx
mov rdi, rax
test rax, rax
jne 0x140021d30
xor eax, eax
jmp 0x140021da6
mov r8d, 0xf01ff
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x140021d5d
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140021d2c
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140021d74
mov rcx, rsi
jmp 0x140021d4c
cmp dword [rsp + 0x24], 4
je 0x140021d8d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x140021d92
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140021db8
Capabilities:
Query service status
Stop service

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
xor eax, eax
mov rsi, rcx
xor ebx, ebx
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
mov r8d, 0xf003f
mov qword [r11 - 0x24], rax
mov qword [r11 - 0x1c], rax
mov qword [r11 - 0x14], rax
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
jne 0x140021dfb
xor eax, eax
jmp 0x140021e76
mov r8d, 0xf01ff
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x140021e28
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140021df7
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140021e3f
mov rcx, rsi
jmp 0x140021e17
cmp dword [rsp + 0x24], 1
je 0x140021e5d
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140021e62
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140021e88
Capabilities:
Delete service
Stop service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov ebx, edx
mov r14, rcx
call fcn.140021bcc
xor edi, edi
test eax, eax
jne 0x140021eb9
lea eax, [rdi + 1]
jmp 0x140021f5e
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
jne 0x140021ed8
xor eax, eax
jmp 0x140021f5e
mov r8d, 0x10020
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbp, rax
test rax, rax
jne 0x140021efd
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140021ed1
test ebx, ebx
je 0x140021f39
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov ebx, edi
mov edx, 1
mov rcx, r14
call fcn.140021c64
test eax, eax
jne 0x140021f39
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x14
jb 0x140021f16
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
setne dil
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400236ec
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor ebx, ebx
mov qword [rsp + 0x38], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0x30], rbx
mov rdi, rax
mov byte [rsp + 0x20], bl
cmp byte [rax], bl
jne 0x14002371b
mov eax, ebx
jmp 0x140023723
mov rcx, rdi
call fcn.140045e50
mov r8, rax
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.140004d8c
lea rcx, [0x1400a15e8]
call fcn.140045e50
mov r9, rax
lea rdx, [0x1400a15e8]
xor r8d, r8d
lea rcx, [rsp + 0x20]
call fcn.14000501c
mov rdx, qword [rsp + 0x38]
cmp rax, 0xffffffffffffffff
setne bl
cmp rdx, 0x10
jb 0x14002377b
mov rcx, qword [rsp + 0x20]
inc rdx
mov r8d, 1
call fcn.140004554
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140023788
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, rdx
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
mov rbx, rax
mov edi, 1
call fcn.140045e50
cmp rax, rdi
jbe 0x1400237f1
mov esi, edi
mov rcx, r14
call fcn.140045e50
mov r8, rax
lea rcx, [rsi + rbx]
mov rdx, r14
call fcn.140069ef0
test eax, eax
je 0x14002380f
inc edi
mov rcx, rbx
movsxd rsi, edi
call fcn.140045e50
cmp rsi, rax
jb 0x1400237c4
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rcx, r14
call fcn.140045e50
movsxd rcx, edi
lea rsi, [rax + 1]
add rsi, rbx
add rsi, rcx
je 0x1400237f1
mov rcx, rbx
call fcn.140045e50
add rax, rbx
cmp rsi, rax
jae 0x1400237f1
lea rcx, [rsi + 1]
lea rdx, [0x14009e7a0]
call fcn.14003a760
mov rdi, rax
test rax, rax
jne 0x14002385f
mov rcx, rbx
call fcn.140045e50
lea rdi, [rbx - 1]
add rdi, rax
jmp 0x140023863
sub rdi, 2
test rdi, rdi
je 0x1400237f1
cmp rdi, rsi
jb 0x1400237f1
mov ebp, 0x80
mov ecx, ebp
call fcn.140037e70
mov r8d, ebp
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.14003a5c0
sub rdi, rsi
mov rdx, rsi
mov rcx, rbx
lea r8, [rdi + 1]
call fcn.140045fa0
mov rax, rbx
jmp 0x1400237f4