joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180151320
Capabilities:
Start service

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, r8
mov ebp, edx
mov rdi, rcx
call fcn.1801276e0
test eax, eax
je 0x18015135c
mov dword [0x18023cf20], 0x32
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
test rdi, rdi
jne 0x18015137d
mov dword [0x18023cf20], 0x57
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov qword [rsp + 0x60], rbx
xor ebx, ebx
lea rcx, [rsp + 0x20]
lea r9d, [rbx + 0x10]
lea r8d, [rbx + 2]
mov rdx, rdi
mov dword [0x18023cf20], ebx
call fcn.180150f30
lea rcx, [rsp + 0x20]
call fcn.180150fd0
test rax, rax
je 0x1801513e6
lea rcx, [rsp + 0x20]
call fcn.180150fd0
mov r8, rsi
mov edx, ebp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebx, eax
test eax, eax
jne 0x180151404
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18023cf20], eax
cmp eax, 0x420
jne 0x1801513ec
mov ebx, 1
jmp 0x180151404
mov eax, dword [0x18023cf20]
test eax, eax
jne 0x180151404
mov eax, dword [rsp + 0x20]
test eax, eax
jne 0x1801513fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18023cf20], eax
lea rcx, [rsp + 0x20]
call fcn.180151030
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x1801515c0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x18021dd90]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rdx
mov rsi, rcx
call fcn.1801276e0
test eax, eax
je 0x1801515fc
mov dword [0x18023cf20], 0x32
xor eax, eax
jmp 0x18015169f
xor eax, eax
mov qword [rsp + 0x90], rbx
xor ebx, ebx
lea rcx, [rsp + 0x20]
lea r9d, [rbx + 4]
lea r8d, [rbx + 1]
mov rdx, rsi
mov dword [0x18023cf20], ebx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], eax
call fcn.180150f30
lea rcx, [rsp + 0x20]
call fcn.180150fd0
test rax, rax
je 0x180151677
lea rcx, [rsp + 0x20]
call fcn.180150fd0
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebx, eax
test eax, eax
jne 0x18015166f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x18015167b
mov eax, dword [rsp + 0x54]
mov dword [rdi], eax
jmp 0x18015168b
mov eax, dword [rsp + 0x20]
test eax, eax
jne 0x180151685
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18023cf20], eax
lea rcx, [rsp + 0x20]
call fcn.180151030
mov eax, ebx
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800f93c0
mov rsi, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
Function at 0x180151bc0
Capabilities:
Modify service

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x8c8
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov rax, qword [0x18021dd90]
xor rax, rsp
mov qword [rsp + 0x8b0], rax
mov r15d, r9d
mov r14d, r8d
mov r13d, edx
mov rsi, rcx
mov rax, qword [rsp + 0x930]
mov qword [rsp + 0xa0], rax
mov rdi, qword [rsp + 0x938]
mov rax, qword [rsp + 0x940]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x948]
mov qword [rsp + 0x80], rax
mov r12, qword [rsp + 0x950]
mov rbx, qword [rsp + 0x958]
mov rax, qword [rsp + 0x960]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x968]
mov qword [rsp + 0x98], rax
xor eax, eax
mov ebp, eax
lea rcx, [rsp + 0x68]
call fcn.1800e70d0
nop
test r12, r12
je 0x180151c87
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.1800e9c20
test rbx, rbx
je 0x180151c99
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.1800e9c20
xor ebx, ebx
mov word [rsp + 0xb0], bx
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0xb2]
call fcn.1800f8660
mov dword [rsp + 0x60], 0x400
cmp dword [rsp + 0x70], ebx
jle 0x180151cfc
xor edx, edx
lea r9, [rsp + 0x60]
lea r8, [rsp + 0xb0]
lea rcx, [rsp + 0x68]
call fcn.1800ef230
test eax, eax
jne 0x180151cf4
lea rcx, [rsp + 0x68]
call fcn.1800e9a80
xor eax, eax
jmp 0x180151d7c
lea rbp, [rsp + 0xb0]
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, r15d
mov r8d, r14d
mov edx, r13d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov ebx, eax
test eax, eax
je 0x180151d70
test rdi, rdi
je 0x180151d70
mov rdx, rdi
mov rcx, rsi
call fcn.180151180
nop
lea rcx, [rsp + 0x68]
call fcn.1800e9a80
mov eax, ebx
mov rcx, qword [rsp + 0x8b0]
xor rcx, rsp
call fcn.1800f93c0
add rsp, 0x8c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180152000
Capabilities:
Enumerate services

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, r9
mov rdi, r8
mov ebp, edx
mov r12d, ecx
call fcn.1801276e0
test eax, eax
je 0x18015204a
mov dword [0x18023cf20], 0x32
xor eax, eax
jmp 0x180152162
xor ebx, ebx
mov qword [rdi], rbx
mov dword [rsi], ebx
mov dword [0x18023cf20], ebx
xor r9d, r9d
xor edx, edx
mov r8d, 0x80000000
lea rcx, [rsp + 0x50]
call fcn.180150f30
nop
lea rcx, [rsp + 0x50]
call fcn.180150f50
test rax, rax
je 0x180152138
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x44], ebx
lea rcx, [rsp + 0x50]
call fcn.180150f50
mov rcx, rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, ebp
mov edx, r12d
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
mov r11d, dword [rsp + 0x40]
test r11d, r11d
je 0x180152138
mov ecx, r11d
call fcn.1800f87f4
mov qword [rdi], rax
test rax, rax
je 0x180152138
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call fcn.1800f8660
lea rcx, [rsp + 0x50]
call fcn.180150f50
mov rcx, rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov r9, qword [rdi]
mov r8d, ebp
mov edx, r12d
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
je 0x180152138
mov eax, dword [rsp + 0x44]
mov dword [rsi], eax
mov ebx, 1
jmp 0x180152156
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18023cf20], eax
mov rcx, qword [rdi]
test rcx, rcx
je 0x180152156
call fcn.1800f8898
mov qword [rdi], rbx
mov dword [rsi], ebx
lea rcx, [rsp + 0x50]
call fcn.180151030
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x180152720
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov esi, r9d
mov edi, r8d
mov rbx, rcx
cmp r8d, 0xffffffff
je 0x180152760
cmp r8d, 4
jbe 0x180152760
mov dword [0x18023cf24], 0x57
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbp
mov rbp, qword [rcx]
cmp edx, 0xffffffff
je 0x18015277c
mov r8d, edx
mov rdx, qword [0x1802203e0]
call fcn.1800f1ef0
cmp edi, 0xffffffff
je 0x180152793
mov rdx, qword [str.Start]
mov r8d, edi
mov rcx, rbx
call fcn.1800f1ef0
cmp esi, 0xffffffff
je 0x1801527aa
mov rdx, qword [str.ErrorControl]
mov r8d, esi
mov rcx, rbx
call fcn.1800f1ef0
mov r8, qword [rsp + 0x60]
test r8, r8
je 0x1801527c3
mov rdx, qword [str.DisplayName]
mov rcx, rbx
call fcn.1800f1f70
mov r8, qword [rsp + 0x68]
test r8, r8
je 0x1801527dc
mov rdx, qword [str.Description]
mov rcx, rbx
call fcn.1800f1f70
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x18015281a
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
mov r9d, 2
xor r8d, r8d
not rcx
lea eax, [rcx + rcx]
mov rcx, rbp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov rdx, qword [str.ImagePath]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x40]
test r8, r8
je 0x180152838
mov rdx, qword [str.Group]
mov rcx, rbx
call fcn.1800f1f70
mov r8, qword [rsp + 0x80]
test r8, r8
je 0x180152854
mov rdx, qword [str.DependOnGroup]
mov rcx, rbx
call fcn.1800f35e0
mov r8, qword [rsp + 0x88]
test r8, r8
je 0x180152870
mov rdx, qword [str.DependOnService]
mov rcx, rbx
call fcn.1800f35e0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x180152890
Capabilities:
Persist via run registry key

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rbx, rcx
test rcx, rcx
jne 0x1801528b3
xor eax, eax
jmp 0x180152961
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x180152961
xor edi, edi
lea rcx, [rsp + 0x28]
call fcn.1800f3760
nop
mov r9d, 0x2001f
mov r8, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800f3160
test rax, rax
je 0x180152918
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1800f1f90
mov edi, eax
lea rcx, [rsp + 0x28]
call fcn.1800f1d70
test edi, edi
jne 0x180152955
mov r9d, 0x2001f
mov r8, qword [str.SystemCurrentControlSetServicesVxD]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800f3160
test rax, rax
je 0x180152955
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1800f1f90
mov edi, eax
lea rcx, [rsp + 0x28]
call fcn.1800f1d70
nop
lea rcx, [rsp + 0x28]
call fcn.1800f30e0
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180152f70
Capabilities:
Persist via run registry key

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x180152fec
cmp word [rcx], 0
je 0x180152fec
lea rcx, [rsp + 0x28]
call fcn.1800f3760
nop
mov r9d, 0x20019
mov r8, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800f3160
test rax, rax
je 0x180153035
mov r8d, 1
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.1800f3750
test eax, eax
jne 0x180152ff3
lea rcx, [rsp + 0x28]
call fcn.1800f30e0
xor eax, eax
jmp 0x1801530ed
test rsi, rsi
je 0x180153021
mov r8, rdi
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.1800f3220
nop
mov rdx, rax
mov rcx, rsi
call fcn.1800e5810
nop
lea rcx, [rsp + 0x68]
call fcn.1800e56d0
test rbx, rbx
je 0x1801530de
mov dword [rbx], reloc.WS2_32.dll_recv
jmp 0x1801530de
mov rax, qword [0x1801cced8]
mov qword [rsp + 0x50], rax
mov r9, rdi
mov r8, qword [str.SystemCurrentControlSetServicesVxD]
lea rdx, [0x1801a7038]
lea rcx, [rsp + 0x50]
call fcn.1800e67b0
mov r9d, 0x20019
mov r8, qword [rsp + 0x50]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800f3160
test rax, rax
jne 0x180153096
lea rcx, [rsp + 0x50]
call fcn.1800e56d0
nop
lea rcx, [rsp + 0x28]
call fcn.1800f30e0
xor eax, eax
jmp 0x1801530ed
test rsi, rsi
je 0x1801530c8
mov r8, qword [str.StaticVxD]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.1800f3220
nop
mov rdx, rax
mov rcx, rsi
call fcn.1800e5810
nop
lea rcx, [rsp + 0x68]
call fcn.1800e56d0
test rbx, rbx
je 0x1801530d3
mov dword [rbx], 1
lea rcx, [rsp + 0x50]
call fcn.1800e56d0
nop
lea rcx, [rsp + 0x28]
call fcn.1800f30e0
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180153100
Capabilities:
Persist via run registry key

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rbx, r8
mov esi, edx
mov rdi, rcx
test rcx, rcx
je 0x1801532b2
test rbx, rbx
je 0x1801532b2
cmp word [rcx], 0
je 0x1801532b2
cmp word [r8], 0
je 0x1801532b2
lea rcx, [rsp + 0x28]
call fcn.1800f3760
nop
cmp esi, 2
je 0x1801531bf
cmp esi, 1
je 0x1801531bf
mov r9d, 0x2001f
mov r8, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800f3160
test rax, rax
jne 0x1801531a8
mov r9d, 0x2001f
mov r8, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800f1d90
test rax, rax
jne 0x1801531a8
jmp 0x1801532a8
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.1800f1f70
mov ebx, eax
jmp 0x18015328f
mov rax, qword [0x1801cced8]
mov qword [rsp + 0x50], rax
mov r9, rdi
mov r8, qword [str.SystemCurrentControlSetServicesVxD]
lea rdx, [0x1801a7038]
lea rcx, [rsp + 0x50]
call fcn.1800e67b0
mov r9d, 0x2001f
mov r8, qword [rsp + 0x50]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800f3160
test rax, rax
jne 0x180153217
lea rcx, [rsp + 0x50]
call fcn.1800e56d0
nop
jmp 0x1801532a8
mov rax, qword [0x1801cced8]
mov qword [rsp + 0x68], rax
mov edx, 0x5c
mov rcx, rbx
call fcn.1800f96b8
test rax, rax
je 0x180153243
lea rdx, [rax + 2]
lea rcx, [rsp + 0x68]
call fcn.1800e5890
mov r8, qword [rsp + 0x68]
cmp dword [r8 - 8], 0
jne 0x180153267
lea rcx, [rsp + 0x68]
call fcn.1800e56d0
nop
lea rcx, [rsp + 0x50]
call fcn.1800e56d0
nop
jmp 0x1801532a8
mov rdx, qword [str.StaticVxD]
lea rcx, [rsp + 0x28]
call fcn.1800f1f70
mov ebx, eax
lea rcx, [rsp + 0x68]
call fcn.1800e56d0
nop
lea rcx, [rsp + 0x50]
call fcn.1800e56d0
lea rcx, [rsp + 0x28]
call fcn.1800f1d70
nop
lea rcx, [rsp + 0x28]
call fcn.1800f30e0
mov eax, ebx
jmp 0x1801532b4
lea rcx, [rsp + 0x28]
call fcn.1800f30e0
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1801532d0
Capabilities:
Persist via run registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov rsi, r8
mov r14, rdx
mov rdi, rcx
mov rax, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov qword [rbp - 0x28], rax
mov rax, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce]
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x38]
call fcn.1800f3760
nop
lea r12, [rbp - 0x28]
mov r13d, 2
xor r15d, r15d
nop dword [rax]
mov r9d, 0x20019
mov r8, qword [r12]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x38]
call fcn.1800f3160
test rax, rax
je 0x180153400
lea rcx, [rbp - 0x18]
call fcn.1800e70d0
nop
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x38]
call fcn.1800f3740
test eax, eax
je 0x1801533ed
mov ebx, r15d
cmp dword [rbp - 0x10], ebx
jle 0x1801533ed
nop word [rax + rax]
mov r8d, ebx
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x18]
call fcn.1800f2160
nop
mov r8, qword [rbp + 0x58]
cmp dword [r8 - 8], 0
je 0x1801533dd
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x38]
call fcn.1800f3220
nop
mov rax, qword [rbp + 0x40]
cmp dword [rax - 8], 0
je 0x1801533d3
lea r8, [rbp + 0x58]
mov edx, dword [rdi + 8]
mov rcx, rdi
call fcn.1800e9d00
lea r8, [rbp + 0x40]
mov edx, dword [rsi + 8]
mov rcx, rsi
call fcn.1800e9d00
nop
lea rcx, [rbp + 0x40]
call fcn.1800e56d0
nop
lea rcx, [rbp + 0x58]
call fcn.1800e56d0
inc ebx
cmp ebx, dword [rbp - 0x10]
jl 0x180153380
lea rcx, [rbp - 0x38]
call fcn.1800f1d70
nop
lea rcx, [rbp - 0x18]
call fcn.1800e9a80
add r12, 8
dec r13
jne 0x180153330
or r8d, 0xffffffff
xor edx, edx
mov rcx, r14
call fcn.1800ef8f0
mov esi, r15d
cmp dword [rdi + 8], r15d
jle 0x18015347e
mov rbx, r15
nop word [rax + rax]
mov dword [rbp + 0x40], r15d
lea rdx, [0x1801a6e60]
lea rcx, [rbp + 0x58]
call fcn.1800e9110
nop
mov rax, qword [rdi]
lea r8, [rbp + 0x58]
lea rdx, [rbp + 0x40]
mov rcx, qword [rbx + rax]
call fcn.180152f70
mov r8d, dword [rbp + 0x40]
mov edx, dword [r14 + 8]
mov rcx, r14
call fcn.1800efb50
nop
lea rcx, [rbp + 0x58]
call fcn.1800e56d0
inc esi
add rbx, 8
cmp esi, dword [rdi + 8]
jl 0x180153430
lea rcx, [rbp - 0x38]
call fcn.1800f30e0
mov eax, 1
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801534b0
Capabilities:
Persist via run registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov r12, rdx
mov r13, rcx
mov rax, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov qword [rbp - 0x28], rax
mov rax, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce]
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x38]
call fcn.1800f3760
nop
lea rdi, [rbp - 0x28]
mov esi, 2
nop
mov r9d, 0x20019
mov r8, qword [rdi]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x38]
call fcn.1800f3160
test rax, rax
je 0x1801535d3
lea rcx, [rbp - 0x18]
call fcn.1800e70d0
nop
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x38]
call fcn.1800f3740
test eax, eax
je 0x1801535c0
xor ebx, ebx
cmp dword [rbp - 0x10], ebx
jle 0x1801535c0
nop dword [rax + rax]
mov r8d, ebx
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x18]
call fcn.1800f2160
nop
mov r8, qword [rbp + 0x48]
cmp dword [r8 - 8], 0
je 0x1801535b0
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x38]
call fcn.1800f3220
nop
mov rax, qword [rbp + 0x40]
cmp dword [rax - 8], 0
je 0x1801535a6
lea r8, [rbp + 0x48]
mov edx, dword [r13 + 8]
mov rcx, r13
call fcn.1800e9d00
lea r8, [rbp + 0x40]
mov edx, dword [r12 + 8]
mov rcx, r12
call fcn.1800e9d00
nop
lea rcx, [rbp + 0x40]
call fcn.1800e56d0
nop
lea rcx, [rbp + 0x48]
call fcn.1800e56d0
inc ebx
cmp ebx, dword [rbp - 0x10]
jl 0x180153550
lea rcx, [rbp - 0x38]
call fcn.1800f1d70
nop
lea rcx, [rbp - 0x18]
call fcn.1800e9a80
add rdi, 8
dec rsi
jne 0x180153500
lea rcx, [rbp - 0x38]
call fcn.1800f30e0
lea eax, [rsi + 1]
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180154040
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
mov qword [rsp + 0x38], rbp
mov rbp, rcx
lea r8, [rsp + 0x68]
lea rdx, str.SystemCurrentControlSetControlProductOptions
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x58], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x18015415f
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.ProductSuite
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18015415f
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x18015415f
lea ecx, [rdi + 0x40]
mov edx, eax
mov qword [rsp + 0x30], rsi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x18015415a
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.ProductSuite
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180154151
cmp dword [rsp + 0x60], 7
jne 0x180154151
mov qword [rsp + 0x50], rbx
mov rbx, rsi
cmp byte [rsi], dil
je 0x18015414c
nop dword [rax + rax]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x180154147
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cdqe
add rbx, rax
cmp byte [rbx], dil
jne 0x180154120
jmp 0x18015414c
mov edi, 1
mov rbx, qword [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x38]
test rcx, rcx
je 0x180154174
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
add rsp, 0x40
pop rdi
ret
Function at 0x180154180
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18021dd90]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
call fcn.180127760
test eax, eax
je 0x180154257
call fcn.1801277c0
test eax, eax
je 0x180154249
xor edx, edx
xor ecx, ecx
mov r8d, 0x20000
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x1801541f7
lea r8d, [rbx + 4]
lea rdx, str.TermService
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x1801541fb
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x180154259
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x180154235
mov eax, dword [rsp + 0x24]
cmp eax, 4
je 0x180154230
cmp eax, 2
jne 0x180154235
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180154257
lea rcx, str.Terminal_Server
call fcn.180154040
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800f93c0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
jmp 0x180154180

Function at 0x180154500
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18021dd90]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
call fcn.180127760
test eax, eax
je 0x180154257
call fcn.1801277c0
test eax, eax
je 0x180154249
xor edx, edx
xor ecx, ecx
mov r8d, 0x20000
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x1801541f7
lea r8d, [rbx + 4]
lea rdx, str.TermService
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x1801541fb
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x180154259
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x180154235
mov eax, dword [rsp + 0x24]
cmp eax, 4
je 0x180154230
cmp eax, 2
jne 0x180154235
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180154257
lea rcx, str.Terminal_Server
call fcn.180154040
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800f93c0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
jmp 0x180154180