joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180042d00
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x150
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov ebp, r8d
mov rbx, rdx
mov rsi, rcx
test rcx, rcx
je 0x1800417f1
test rdx, rdx
je 0x1800417f1
xor edx, edx
call fcn.180039d90
test eax, eax
jne 0x18004167f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18013f60c], eax
test eax, eax
je 0x18004167b
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800416eb
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x148], r12
mov rcx, rbx
mov qword [rsp + 0x140], r13
xor r12d, r12d
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea r13d, [r12 + 1]
cmp eax, 0xffffffff
je 0x1800416bd
test al, 0x10
jne 0x1800416bd
mov r12d, r13d
test r12b, al
cmovne edi, r13d
test r13b, bpl
je 0x180041706
test r12d, r12d
je 0x180041706
mov dword [0x18013f60c], 0x50
xor eax, eax
mov r12, qword [rsp + 0x148]
mov rdi, qword [rsp + 0x180]
mov r13, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x150
pop rsi
pop rbp
pop rbx
ret
test bpl, 2
je 0x18004171c
test edi, edi
je 0x18004171c
mov dword [0x18013f60c], 5
jmp 0x1800416d1
cmp eax, 0xffffffff
je 0x180041734
mov rcx, rbx
test al, 0x10
je 0x18004172f
call fcn.18003d920
jmp 0x180041734
call fcn.18003a2b0
mov rdx, rbx
mov rcx, rsi
mov dword [0x18013f60c], 0
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov edi, eax
test eax, eax
jne 0x1800417cd
test bpl, 4
jne 0x1800417d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x1800417d4
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], dil
call fcn.180043ef0
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rbx
call fcn.180037d70
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.18003a980
test eax, eax
jne 0x1800417b5
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.18003b410
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18013f60c], eax
test eax, eax
je 0x1800417cd
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
jmp 0x1800416d3
test bpl, 8
je 0x1800417b5
mov rdx, rbx
mov rcx, rsi
call fcn.18003a820
test eax, eax
je 0x1800417b5
mov eax, r13d
jmp 0x1800416d3
mov ecx, 0x57
mov dword [0x18013f60c], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800416eb
jmp 0x180041620
Function at 0x180043060
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov esi, r8d
mov r14, rdx
mov r13, rcx
lea rcx, [rax - 0x48]
call fcn.180043030
nop
mov r8d, 0x10
lea rdx, [0x1800e2ed0]
lea rcx, [rsp + 0x50]
call fcn.180042e50
mov r12d, 1
xor r15d, r15d
mov dword [rsp + 0x30], r15d
lea rdx, [rsp + 0x30]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1800430ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1800430ed
mov dword [rsp + 0x34], eax
lea rdx, [0x180114150]
lea rcx, [rsp + 0x34]
call fcn.180048be8
mov ecx, dword [rsp + 0x30]
shl rcx, 0x20
or rcx, rbx
mov qword [rsp + 0x40], rcx
mov r8d, 8
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.180042e20
mov ecx, 0x8000
call fcn.180045488
mov rbx, rax
test rax, rax
jne 0x180043135
lea rcx, [rsp + 0x50]
call fcn.180042e40
xor eax, eax
jmp 0x18004320f
xor edx, edx
mov r8d, 0x8000
mov rcx, rax
call fcn.180043ef0
mov edi, r15d
nop dword [rax + rax]
mov dword [rsp + 0xb8], r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0xb8]
mov r8d, 0x8000
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800431a3
test rbx, rbx
je 0x180043188
mov rcx, rbx
call fcn.180045904
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
lea rdx, [0x180114150]
lea rcx, [rsp + 0x38]
call fcn.180048be8
mov r8d, dword [rsp + 0xb8]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.180042e20
mov r11d, dword [rsp + 0xb8]
add edi, r11d
cmp r11d, 0x8000
jb 0x1800431dd
cmp esi, 0xffffffff
je 0x180043150
cmp edi, esi
jb 0x180043150
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.180042f90
test rbx, rbx
je 0x1800431f8
mov rcx, rbx
call fcn.180045904
nop
jmp 0x180043202
lea rcx, [rsp + 0x50]
call fcn.180042e40
mov eax, r12d
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x180043750
Capabilities:
Get file size
Read file on windows

Disassembly:
mov r8d, 0x100000
jmp fcn.180043060
Function at 0x18004d4d7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18011a300]
jne 0x180043eda
rol rcx, 0x10
test cx, 0xffff
jne 0x180043ed6
repz ret
ror rcx, 0x10
jmp 0x18004d430
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18013f7f0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x18013f8e8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18004d4b5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18013f7f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18004d4d7
mov rax, qword [rsp + 0x88]
mov qword [0x18013f8e8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18013f888], rax
mov rax, qword [0x18013f8e8]
mov qword [0x18013f760], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18013f870], rax
mov dword [0x18013f750], 0xc0000409
mov dword [0x18013f754], 1
mov rax, qword [0x18011a300]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18011a308]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18013f7e8], eax
mov ecx, 1
call fcn.180060150
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800e32f0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18013f7e8], 0
jne 0x18004d55e
mov ecx, 1
call fcn.180060150
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x18006cbfc
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.18004e1c4
xor ebx, ebx
cmp qword [0x1801408b0], rbx
mov rdi, rax
jne 0x18006cd0f
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x18006cde6
lea rdx, [0x1800e6708]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18006cde6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1801408b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1801408b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1800e66c0]
mov rcx, rsi
mov qword [0x1801408c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1801408d0], rax
test rax, rax
je 0x18006cd06
lea rdx, [0x1800e66a8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1801408c8], rax
jmp 0x18006cd16
mov rax, qword [0x1801408c8]
jmp 0x18006cd1d
mov rax, qword [0x1801408c8]
mov r11, qword [0x1801408d0]
cmp rax, rdi
je 0x18006cd84
cmp r11, rdi
je 0x18006cd84
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1801408d0]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x18006cd84
test rax, rax
je 0x18006cd84
call rsi
test rax, rax
je 0x18006cd7e
lea rcx, [rsp + 0x30]
mov r9d, SafeArrayCreate
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18006cd7e
test byte [rsp + 0x40], 1
jne 0x18006cd84
bts ebp, 0x15
jmp 0x18006cdc4
mov rcx, qword [0x1801408b8]
cmp rcx, rdi
je 0x18006cdc4
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18006cdc4
call rax
mov rbx, rax
test rax, rax
je 0x18006cdc4
mov rcx, qword [0x1801408c0]
cmp rcx, rdi
je 0x18006cdc4
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18006cdc4
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1801408b0]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18006cde6
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x18006cde8
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180075860
Capabilities:
Delete service

Disassembly:
push rdi
sub rsp, 0x50
mov rdi, rcx
call fcn.180036cb0
test eax, eax
je 0x180075884
mov dword [0x1801408e0], 0x32
xor eax, eax
add rsp, 0x50
pop rdi
ret
test rdi, rdi
jne 0x18007589b
mov dword [0x1801408e0], 0x57
xor eax, eax
add rsp, 0x50
pop rdi
ret
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x20]
xor ebx, ebx
mov r9d, 0xf01ff
mov r8d, 0xf003f
mov rdx, rdi
mov dword [0x1801408e0], ebx
call fcn.180075540
lea rcx, [rsp + 0x20]
call fcn.1800755e0
test rax, rax
je 0x1800758f7
lea rcx, [rsp + 0x20]
call fcn.1800755e0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebx, eax
test eax, eax
jne 0x180075915
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1801408e0], eax
jmp 0x1800758fd
mov eax, dword [0x1801408e0]
test eax, eax
jne 0x180075915
mov eax, dword [rsp + 0x20]
test eax, eax
jne 0x18007590f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1801408e0], eax
lea rcx, [rsp + 0x20]
call fcn.180075640
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x180075930
Capabilities:
Start service

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, r8
mov ebp, edx
mov rdi, rcx
call fcn.180036cb0
test eax, eax
je 0x18007596c
mov dword [0x1801408e0], 0x32
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
test rdi, rdi
jne 0x18007598d
mov dword [0x1801408e0], 0x57
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov qword [rsp + 0x60], rbx
xor ebx, ebx
lea rcx, [rsp + 0x20]
lea r9d, [rbx + 0x10]
lea r8d, [rbx + 2]
mov rdx, rdi
mov dword [0x1801408e0], ebx
call fcn.180075540
lea rcx, [rsp + 0x20]
call fcn.1800755e0
test rax, rax
je 0x1800759f6
lea rcx, [rsp + 0x20]
call fcn.1800755e0
mov r8, rsi
mov edx, ebp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov ebx, eax
test eax, eax
jne 0x180075a14
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1801408e0], eax
cmp eax, 0x420
jne 0x1800759fc
mov ebx, 1
jmp 0x180075a14
mov eax, dword [0x1801408e0]
test eax, eax
jne 0x180075a14
mov eax, dword [rsp + 0x20]
test eax, eax
jne 0x180075a0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1801408e0], eax
lea rcx, [rsp + 0x20]
call fcn.180075640
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180075bd0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rdx
mov rsi, rcx
call fcn.180036cb0
test eax, eax
je 0x180075c0c
mov dword [0x1801408e0], 0x32
xor eax, eax
jmp 0x180075caf
xor eax, eax
mov qword [rsp + 0x90], rbx
xor ebx, ebx
lea rcx, [rsp + 0x20]
lea r9d, [rbx + 4]
lea r8d, [rbx + 1]
mov rdx, rsi
mov dword [0x1801408e0], ebx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], eax
call fcn.180075540
lea rcx, [rsp + 0x20]
call fcn.1800755e0
test rax, rax
je 0x180075c87
lea rcx, [rsp + 0x20]
call fcn.1800755e0
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebx, eax
test eax, eax
jne 0x180075c7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x180075c8b
mov eax, dword [rsp + 0x54]
mov dword [rdi], eax
jmp 0x180075c9b
mov eax, dword [rsp + 0x20]
test eax, eax
jne 0x180075c95
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1801408e0], eax
lea rcx, [rsp + 0x20]
call fcn.180075640
mov eax, ebx
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180043ec0
mov rsi, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret

Function at 0x180075ec0
Capabilities:
Query service configuration

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rdi, rcx
call fcn.180036cb0
test eax, eax
je 0x180075ef1
mov dword [0x1801408e0], 0x32
xor eax, eax
jmp 0x180075fbe
xor ebx, ebx
mov dword [0x1801408e0], ebx
lea r9d, [rbx + 1]
mov r8d, 0x80000000
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.180075540
nop
lea rcx, [rsp + 0x28]
call fcn.1800755e0
test rax, rax
je 0x180075f8e
mov dword [rsp + 0x78], ebx
lea rcx, [rsp + 0x28]
call fcn.1800755e0
mov rcx, rax
lea r9, [rsp + 0x78]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
mov r11d, dword [rsp + 0x78]
test r11d, r11d
je 0x180075f8e
mov ecx, r11d
call fcn.180045488
mov rbx, rax
test rax, rax
je 0x180075f8e
mov r8d, dword [rsp + 0x78]
xor edx, edx
mov rcx, rax
call fcn.180043ef0
lea rcx, [rsp + 0x28]
call fcn.1800755e0
mov rcx, rax
lea r9, [rsp + 0x78]
mov r8d, dword [rsp + 0x78]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x180075fb1
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x180075f9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1801408e0], eax
test rbx, rbx
je 0x180075fb1
mov rcx, rbx
call fcn.180045904
xor ebx, ebx
lea rcx, [rsp + 0x28]
call fcn.180075640
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1800761c0
Capabilities:
Modify service

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4c8
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov r15d, r9d
mov r14d, r8d
mov r13d, edx
mov rsi, rcx
mov rax, qword [rsp + 0x530]
mov qword [rsp + 0xa0], rax
mov rdi, qword [rsp + 0x538]
mov rax, qword [rsp + 0x540]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x80], rax
mov r12, qword [rsp + 0x550]
mov rbx, qword [rsp + 0x558]
mov rax, qword [rsp + 0x560]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x568]
mov qword [rsp + 0x98], rax
xor ebp, ebp
lea rcx, [rsp + 0x68]
call fcn.1800274b0
nop
test r12, r12
je 0x180076285
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.18002cdb0
test rbx, rbx
je 0x180076297
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.18002cdb0
mov byte [rsp + 0xb0], 0
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rsp + 0xb1]
call fcn.180043ef0
mov dword [rsp + 0x60], 0x400
cmp dword [rsp + 0x70], 0
jle 0x1800762f9
lea r9, [rsp + 0x60]
lea r8, [rsp + 0xb0]
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.18002fe50
test eax, eax
jne 0x1800762f1
lea rcx, [rsp + 0x68]
call fcn.18002cc10
xor eax, eax
jmp 0x18007637d
lea rbp, [rsp + 0xb0]
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, r15d
mov r8d, r14d
mov edx, r13d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov ebx, eax
test eax, eax
je 0x180076371
test rdi, rdi
je 0x180076371
mov rdx, rdi
mov rcx, rsi
call fcn.180075790
nop
lea rcx, [rsp + 0x68]
call fcn.18002cc10
mov eax, ebx
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x4c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180076610
Capabilities:
Enumerate services

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, r9
mov rdi, r8
mov ebp, edx
mov r12d, ecx
call fcn.180036cb0
test eax, eax
je 0x18007665a
mov dword [0x1801408e0], 0x32
xor eax, eax
jmp 0x180076772
xor ebx, ebx
mov qword [rdi], rbx
mov dword [rsi], ebx
mov dword [0x1801408e0], ebx
xor r9d, r9d
xor edx, edx
mov r8d, 0x80000000
lea rcx, [rsp + 0x50]
call fcn.180075540
nop
lea rcx, [rsp + 0x50]
call fcn.180075560
test rax, rax
je 0x180076748
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x44], ebx
lea rcx, [rsp + 0x50]
call fcn.180075560
mov rcx, rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, ebp
mov edx, r12d
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
mov r11d, dword [rsp + 0x40]
test r11d, r11d
je 0x180076748
mov ecx, r11d
call fcn.180045488
mov qword [rdi], rax
test rax, rax
je 0x180076748
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call fcn.180043ef0
lea rcx, [rsp + 0x50]
call fcn.180075560
mov rcx, rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov r9, qword [rdi]
mov r8d, ebp
mov edx, r12d
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
je 0x180076748
mov eax, dword [rsp + 0x44]
mov dword [rsi], eax
mov ebx, 1
jmp 0x180076766
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1801408e0], eax
mov rcx, qword [rdi]
test rcx, rcx
je 0x180076766
call fcn.180045904
mov qword [rdi], rbx
mov dword [rsi], ebx
lea rcx, [rsp + 0x50]
call fcn.180075640
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x180076d30
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov esi, r9d
mov edi, r8d
mov rbx, rcx
cmp r8d, 0xffffffff
je 0x180076d70
cmp r8d, 4
jbe 0x180076d70
mov dword [0x1801408e4], 0x57
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbp
mov rbp, qword [rcx]
cmp edx, 0xffffffff
je 0x180076d8c
mov r8d, edx
mov rdx, qword [0x18011be38]
call fcn.1800320f0
cmp edi, 0xffffffff
je 0x180076da3
mov rdx, qword [0x18011be40]
mov r8d, edi
mov rcx, rbx
call fcn.1800320f0
cmp esi, 0xffffffff
je 0x180076dba
mov rdx, qword [str.ErrorControl]
mov r8d, esi
mov rcx, rbx
call fcn.1800320f0
mov r8, qword [rsp + 0x60]
test r8, r8
je 0x180076dd3
mov rdx, qword [str.DisplayName]
mov rcx, rbx
call fcn.180032170
mov r8, qword [rsp + 0x68]
test r8, r8
je 0x180076dec
mov rdx, qword [str.Description]
mov rcx, rbx
call fcn.180032170
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x180076e26
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
lea r9d, [rax + 2]
xor r8d, r8d
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rdx
mov rdx, qword [str.ImagePath]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov r8, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x40]
test r8, r8
je 0x180076e44
mov rdx, qword [str.Group]
mov rcx, rbx
call fcn.180032170
mov r8, qword [rsp + 0x80]
test r8, r8
je 0x180076e60
mov rdx, qword [str.DependOnGroup]
mov rcx, rbx
call fcn.180033760
mov r8, qword [rsp + 0x88]
test r8, r8
je 0x180076e7c
mov rdx, qword [str.DependOnService]
mov rcx, rbx
call fcn.180033760
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x180076ea0
Capabilities:
Persist via run registry key

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rbx, rcx
test rcx, rcx
jne 0x180076ec3
xor eax, eax
jmp 0x180076f70
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x180076f70
xor edi, edi
lea rcx, [rsp + 0x28]
call fcn.1800338e0
nop
mov r9d, 0x2001f
mov r8, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800332e0
test rax, rax
je 0x180076f27
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180032190
mov edi, eax
lea rcx, [rsp + 0x28]
call fcn.180031f70
test edi, edi
jne 0x180076f64
mov r9d, 0x2001f
mov r8, qword [str.SystemCurrentControlSetServicesVxD]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800332e0
test rax, rax
je 0x180076f64
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180032190
mov edi, eax
lea rcx, [rsp + 0x28]
call fcn.180031f70
nop
lea rcx, [rsp + 0x28]
call fcn.180033260
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180077580
Capabilities:
Persist via run registry key

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x1800775fb
cmp byte [rcx], 0
je 0x1800775fb
lea rcx, [rsp + 0x28]
call fcn.1800338e0
nop
mov r9d, 0x20019
mov r8, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800332e0
test rax, rax
je 0x180077644
mov r8d, 1
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.1800338d0
test eax, eax
jne 0x180077602
lea rcx, [rsp + 0x28]
call fcn.180033260
xor eax, eax
jmp 0x1800776fc
test rsi, rsi
je 0x180077630
mov r8, rdi
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.1800333a0
nop
mov rdx, rax
mov rcx, rsi
call fcn.180027ce0
nop
lea rcx, [rsp + 0x68]
call fcn.180027bd0
test rbx, rbx
je 0x1800776ed
mov dword [rbx], 0x10
jmp 0x1800776ed
mov rax, qword [0x1800e0ed0]
mov qword [rsp + 0x50], rax
mov r9, rdi
mov r8, qword [str.SystemCurrentControlSetServicesVxD]
lea rdx, [0x1800d1c4c]
lea rcx, [rsp + 0x50]
call fcn.180028c40
mov r9d, 0x20019
mov r8, qword [rsp + 0x50]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800332e0
test rax, rax
jne 0x1800776a5
lea rcx, [rsp + 0x50]
call fcn.180027bd0
nop
lea rcx, [rsp + 0x28]
call fcn.180033260
xor eax, eax
jmp 0x1800776fc
test rsi, rsi
je 0x1800776d7
mov r8, qword [str.StaticVxD]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.1800333a0
nop
mov rdx, rax
mov rcx, rsi
call fcn.180027ce0
nop
lea rcx, [rsp + 0x68]
call fcn.180027bd0
test rbx, rbx
je 0x1800776e2
mov dword [rbx], 1
lea rcx, [rsp + 0x50]
call fcn.180027bd0
nop
lea rcx, [rsp + 0x28]
call fcn.180033260
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret