joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14015ebb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15d, edx
lea r14d, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov esi, r12d
mov ebp, r12d
test r14d, r14d
je 0x14015edba
mov r8, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [r8 + 0xff]
shl esi, cl
add esi, esi
nop dword [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14015ec74
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14015ec30
mov ecx, dword [r10]
jmp 0x14015ed57
cmp ecx, 0x4e0
jb 0x14015ed57
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14015ec90
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14015ece0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
mov edx, dword [rdi + 0x10]
cmp eax, edx
ja 0x14015ec10
mov r8, qword [rdi + 8]
or esi, eax
lea ecx, [r8 + 0xff]
shl ebp, cl
add ebp, ebp
or ebp, edx
cmp ebp, r14d
jb 0x14015ec00
xor edx, edx
mov eax, ebp
div r15d
mov ecx, eax
mov r8d, edx
xor edx, edx
mov eax, esi
div r15d
cmp eax, ecx
jb 0x14015edda
cmp r8d, r14d
jne 0x14015ebe0
mov rbx, qword [rsp + 0x20]
mov eax, esi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15d
mov eax, edx
pop r15
pop r14
pop r12
ret
Function at 0x140164ab0
Capabilities:
Create directory
Delete directory
Get file attributes

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rsp + 0x98], rax
call fcn.1401e7d10
lea rcx, str.C:ProgramDataASUSASUS_System_Control_InterfaceAsusSystemAnalysisdata_
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xa
jae 0x140164aed
lea rcx, [0x1402ce4c0]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__rmdir
lea rcx, [0x1402ce4c0]
call fcn.1401e7de0
test al, al
jne 0x140164be7
lea rcx, [0x1402ce4c0]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], SafeArrayLock
mov byte [rsp + 0x58], al
lea ecx, [rax + 0x50]
call fcn.1400e1b00
mov rcx, rax
mov qword [rsp + 0x68], 0x4a
mov qword [rsp + 0x70], 0x4f
movaps xmm0, xmmword [0x1402ce4c0]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1402ce4d0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1402ce4e0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1402ce4f0]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [0x1402ce500]
movsd qword [rax + 0x40], xmm0
movzx eax, word [0x1402ce508]
mov word [rcx + 0x48], ax
mov byte [rcx + 0x4a], 0
mov qword [rsp + 0x58], rcx
lea r8, [rsp + 0x58]
lea rdx, str.CreateSqliteDBFolder:
lea rcx, [rsp + 0x38]
call fcn.1400e1940
mov rcx, rax
call fcn.140195010
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140164be7
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140164be2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140164c0c
call fcn.14020be84
lea rcx, str.C:ProgramDataASUSASUS_System_Control_InterfaceAsusSystemAnalysisdata_
call fcn.1401f2b60
nop
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14020c3e0
add rsp, 0xa8
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
int3
Function at 0x1401787f0
Capabilities:
Get geographical location
Terminate process

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], SafeArrayLock
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x14017888e
cmp rax, 0xffffffffffffffff
je 0x14017888e
mov ecx, SafeArrayLock
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140129060
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400ecb90
lea rcx, [rsp + 0x40]
call fcn.1400ebdb0
lea rdx, [rsp + 0x20]
lea rcx, [0x1403e3840]
call fcn.14012cb10
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1401788a0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x140178902
cmp rax, 0xffffffffffffffff
je 0x140178902
lea rcx, [rsp + 0x20]
call fcn.1401ec0a0
nop
lea rdx, [rsp + 0x20]
lea rcx, [0x1403e3840]
call fcn.14012cb10
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140178ae0
Capabilities:
Get geographical location
Identify system language via api
Terminate process

Disassembly:
push rbx
sub rsp, 0x2d0
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x60], SafeArrayLock
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x48], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x140178bfa
cmp rax, 0xffffffffffffffff
je 0x140178bfa
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0xb0]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
mov r9d, 0x208
lea r8, [rsp + 0xb0]
mov edx, 0x5c
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x140178b91
lea rdx, str.en_us
lea rcx, [rsp + 0xb0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x68]
call fcn.1400eaca0
nop
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.1400eabe0
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.140202d30
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400ecb90
lea rcx, [rsp + 0x88]
call fcn.1400ebdb0
lea rdx, [rsp + 0x48]
lea rcx, [0x1403e3840]
call fcn.14012cb10
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140178c10
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], SafeArrayLock
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x140178ca9
cmp rax, 0xffffffffffffffff
je 0x140178ca9
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.14011d870
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400ecb90
lea rcx, [rsp + 0x40]
call fcn.1400ebdb0
lea rdx, [rsp + 0x20]
lea rcx, [0x1403e3840]
call fcn.14012cb10
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140178cc0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x140178d92
cmp rax, 0xffffffffffffffff
je 0x140178d92
lea rcx, [rsp + 0x68]
call fcn.14010bd30
nop
lea rdx, str.https:__www.microsoft.com_
lea rcx, [rsp + 0x28]
call fcn.1400eaca0
lea rdx, [rsp + 0x68]
mov rcx, rax
call fcn.1401e2bb0
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.1400eabe0
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.140202d30
nop
lea r8, [rsp + 0x88]
lea rdx, str._redirurl__msRedirUrl_
lea rcx, [rsp + 0x48]
call fcn.1400e1a70
mov rcx, rax
call fcn.140195010
lea rdx, [rsp + 0x88]
lea rcx, [0x1403e3840]
call fcn.14012cb10
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140178da0
Capabilities:
Terminate process

Disassembly:
push rbx
mov eax, 0x100c0
call fcn.14020cbc0
sub rsp, rax
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rsp + 0x100b0], rax
lea rcx, [rsp + 0x20]
call fcn.140197310
nop
xor edx, edx
mov r8d, 0x10000
lea rcx, [rsp + 0xb0]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], SafeArrayLock
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x50], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x140178e9e
cmp rax, 0xffffffffffffffff
je 0x140178e9e
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.1401984c0
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.1400eaca0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1400eabe0
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140202d30
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400ecb90
lea rcx, [rsp + 0x90]
call fcn.1400ebdb0
lea rdx, [rsp + 0x50]
lea rcx, [0x1403e3840]
call fcn.14012cb10
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140178eb0
Capabilities:
Terminate process

Disassembly:
push rbx
mov eax, 0x100c0
call fcn.14020cbc0
sub rsp, rax
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rsp + 0x100b0], rax
lea rcx, [rsp + 0x20]
call fcn.140197310
nop
xor edx, edx
mov r8d, 0x10000
lea rcx, [rsp + 0xb0]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], SafeArrayLock
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x50], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x140178fae
cmp rax, 0xffffffffffffffff
je 0x140178fae
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.140198400
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.1400eaca0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1400eabe0
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140202d30
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400ecb90
lea rcx, [rsp + 0x90]
call fcn.1400ebdb0
lea rdx, [rsp + 0x50]
lea rcx, [0x1403e3840]
call fcn.14012cb10
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140178fc0
Capabilities:
Terminate process

Disassembly:
push rbx
mov eax, 0x100c0
call fcn.14020cbc0
sub rsp, rax
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rsp + 0x100b0], rax
lea rcx, [rsp + 0x20]
call fcn.140197310
nop
xor edx, edx
mov r8d, 0x10000
lea rcx, [rsp + 0xb0]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], SafeArrayLock
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x50], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x1401790be
cmp rax, 0xffffffffffffffff
je 0x1401790be
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.140198480
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.1400eaca0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1400eabe0
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140202d30
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400ecb90
lea rcx, [rsp + 0x90]
call fcn.1400ebdb0
lea rdx, [rsp + 0x50]
lea rcx, [0x1403e3840]
call fcn.14012cb10
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1401790d0
Capabilities:
Terminate process

Disassembly:
push rbx
mov eax, 0x100c0
call fcn.14020cbc0
sub rsp, rax
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rsp + 0x100b0], rax
lea rcx, [rsp + 0x20]
call fcn.140197310
nop
xor edx, edx
mov r8d, 0x10000
lea rcx, [rsp + 0xb0]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], SafeArrayLock
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x50], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x1401791ce
cmp rax, 0xffffffffffffffff
je 0x1401791ce
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.140198670
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.1400eaca0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1400eabe0
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140202d30
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400ecb90
lea rcx, [rsp + 0x90]
call fcn.1400ebdb0
lea rdx, [rsp + 0x50]
lea rcx, [0x1403e3840]
call fcn.14012cb10
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1401791e0
Capabilities:
Terminate process

Disassembly:
push rbx
mov eax, 0x100c0
call fcn.14020cbc0
sub rsp, rax
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rsp + 0x100b0], rax
lea rcx, [rsp + 0x20]
call fcn.140197310
nop
xor edx, edx
mov r8d, 0x10000
lea rcx, [rsp + 0xb0]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], SafeArrayLock
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x50], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x1401792de
cmp rax, 0xffffffffffffffff
je 0x1401792de
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.140198540
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.1400eaca0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1400eabe0
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140202d30
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400ecb90
lea rcx, [rsp + 0x90]
call fcn.1400ebdb0
lea rdx, [rsp + 0x50]
lea rcx, [0x1403e3840]
call fcn.14012cb10
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1401792f0
Capabilities:
Terminate process

Disassembly:
push rbx
mov eax, 0x100c0
call fcn.14020cbc0
sub rsp, rax
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rsp + 0x100b0], rax
lea rcx, [rsp + 0x20]
call fcn.140197310
nop
xor edx, edx
mov r8d, 0x10000
lea rcx, [rsp + 0xb0]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], SafeArrayLock
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x50], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x1401793ee
cmp rax, 0xffffffffffffffff
je 0x1401793ee
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.140198580
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.1400eaca0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1400eabe0
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140202d30
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400ecb90
lea rcx, [rsp + 0x90]
call fcn.1400ebdb0
lea rdx, [rsp + 0x50]
lea rcx, [0x1403e3840]
call fcn.14012cb10
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140179400
Capabilities:
Terminate process

Disassembly:
push rbx
mov eax, 0x100c0
call fcn.14020cbc0
sub rsp, rax
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rsp + 0x100b0], rax
lea rcx, [rsp + 0x20]
call fcn.140197310
nop
xor edx, edx
mov r8d, 0x10000
lea rcx, [rsp + 0xb0]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], SafeArrayLock
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x50], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x1401794fe
cmp rax, 0xffffffffffffffff
je 0x1401794fe
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.140198500
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.1400eaca0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1400eabe0
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140202d30
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400ecb90
lea rcx, [rsp + 0x90]
call fcn.1400ebdb0
lea rdx, [rsp + 0x50]
lea rcx, [0x1403e3840]
call fcn.14012cb10
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140179510
Capabilities:
Terminate process

Disassembly:
push rbx
mov eax, 0x100c0
call fcn.14020cbc0
sub rsp, rax
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rsp + 0x100b0], rax
lea rcx, [rsp + 0x20]
call fcn.140197310
nop
xor edx, edx
mov r8d, 0x10000
lea rcx, [rsp + 0xb0]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], SafeArrayLock
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x50], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x14017960e
cmp rax, 0xffffffffffffffff
je 0x14017960e
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.1401986b0
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.1400eaca0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1400eabe0
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140202d30
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400ecb90
lea rcx, [rsp + 0x90]
call fcn.1400ebdb0
lea rdx, [rsp + 0x50]
lea rcx, [0x1403e3840]
call fcn.14012cb10
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x14017a470
Capabilities:
Create service

Disassembly:
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x4a8
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov r15, qword [rsp + 0x500]
mov ebp, r8d
mov r12, qword [rsp + 0x508]
mov rdi, rdx
mov rsi, rcx
lea rdx, [rsp + 0x70]
mov r8d, 0x104
xor ecx, ecx
mov r14, r9
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14017a4df
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetModuleFileName_failed_w_err_0x_08lx_n
call fcn.140131570
jmp 0x14017a5cb
lea r8, [rsp + 0x70]
mov qword [rsp + 0x4a0], rbx
lea rdx, str.__s_
lea rcx, [rsp + 0x280]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 3]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x14017a530
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.140131570
jmp 0x14017a5c3
mov qword [rsp + 0x60], r12
xor eax, eax
mov qword [rsp + 0x58], r15
mov r9d, 4
mov qword [rsp + 0x50], r14
mov r8, rdi
mov qword [rsp + 0x48], rax
mov rdx, rsi
mov qword [rsp + 0x40], rax
mov rcx, rbx
lea rax, [rsp + 0x280]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], SafeArrayLock
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x14017a5a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateService_failed_w_err_0x_08lx_n
call fcn.140131570
mov rcx, rbx
jmp 0x14017a5bd
mov rdx, rsi
lea rcx, str._s_is_installed._n
call fcn.140131570
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x4a0]
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.14020c3e0
add rsp, 0x4a8
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14017a5f0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1403debe8]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov rdi, rcx
xorps xmm0, xmm0
mov qword [rsp + 0x30], rax
xor edx, edx
mov dword [rsp + 0x38], eax
xor ecx, ecx
lea r8d, [rax + 1]
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14017a64e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.140131570
jmp 0x14017a76a
mov r8d, 0x10024
mov qword [rsp + 0x68], rbx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14017a689
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService_failed_w_err_0x_08lx_n
call fcn.140131570
mov rcx, rsi
jmp 0x14017a75f
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x14017a721
mov rdx, rdi
lea rcx, str.Stopping__s.
call fcn.140131570
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14017a702
mov eax, dword [rsp + 0x24]
cmp eax, 3
jne 0x14017a706
lea rcx, [0x1402d22ec]
call fcn.140131570
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14017a6d0
mov eax, dword [rsp + 0x24]
lea rcx, str._n_s_is_stopped._n
mov rdx, rdi
cmp eax, 1
je 0x14017a71c
lea rcx, str._n_s_failed_to_stop._n
call fcn.140131570
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x14017a744
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.DeleteService_failed_w_err_0x_08lx_n
call fcn.140131570
jmp 0x14017a753
mov rdx, rdi
lea rcx, str._s_is_removed._n
call fcn.140131570
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14020c3e0
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret