joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c0b40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x4c0c15
movdqa xmm0, xmmword [0x00511400]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x4c0b81
movdqa xmm0, xmmword [0x00511410]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x4c0c97
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x4c0c6b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x005112e8]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x00511770]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x140004600
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r12
sub rsp, 0x30
cmp dword [rcx + 0x58], 0
mov ebp, r8d
mov r12, rdx
mov rsi, rcx
je 0x14000462d
mov r8, rbp
xor edx, edx
mov rcx, r12
add rsp, 0x30
pop r12
pop rsi
pop rbp
jmp fcn.1401a6e60
test r8d, r8d
je 0x140004722
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x58], rbx
mov dword [rcx + 0x28], ebp
mov qword [rsp + 0x60], rdi
mov qword [rcx + 0x20], rdx
xor r13d, r13d
nop
cmp dword [rsi + 0x10], r13d
jne 0x140004692
mov rdx, qword [rsi + 0x50]
mov rcx, qword [rsi]
lea r9, [rsp + 0x50]
mov r8d, 0x10000
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000472b
mov ecx, dword [rsp + 0x50]
test ecx, ecx
je 0x14000472b
mov rax, qword [rsi + 0x50]
mov dword [rsi + 0x10], ecx
mov qword [rsi + 8], rax
cmp dword [rsi + 0x5c], r13d
je 0x1400046c7
mov edi, dword [rsi + 0x28]
mov eax, dword [rsi + 0x10]
mov rdx, qword [rsi + 8]
mov rcx, qword [rsi + 0x20]
cmp edi, eax
cmova edi, eax
mov r8d, edi
mov ebx, edi
call fcn.1401a6b10
add qword [rsi + 8], rbx
add qword [rsi + 0x20], rbx
sub dword [rsi + 0x10], edi
sub dword [rsi + 0x28], edi
jne 0x140004650
jmp 0x140004713
lea rcx, [rsi + 8]
call fcn.14017f4f0
test eax, eax
je 0x1400046d9
cmp eax, 4
jne 0x140004747
cmp dword [rsi + 0x28], r13d
je 0x140004713
cmp eax, 4
jne 0x140004650
mov edx, eax
lea rcx, str.BZ2_bzDecompress__:__d:_Unexpected_EOF_in_decompression_stream._n
call fcn.1400b35e0
lea rcx, [rsi + 8]
call fcn.14017f620
mov r8, rbp
xor edx, edx
mov rcx, r12
mov dword [rsi + 0x58], 1
call fcn.1401a6e60
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov r13, qword [rsp + 0x68]
add rsp, 0x30
pop r12
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ReadFile__:__d:_Failed_to_read._n
mov edx, eax
call fcn.1400b35e0
cmp dword [rsi + 0x5c], r13d
jne 0x1400046ff
jmp 0x1400046f6
mov edx, eax
lea rcx, str.BZ2_bzDecompress__:__d:_Failed_to_decompress._n
jmp 0x1400046f1
Function at 0x140004760
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0x40
cmp dword [rcx + 0x58], 0
mov rsi, rcx
je 0x140004777
xor eax, eax
add rsp, 0x40
pop rsi
ret
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x60], rbx
mov dword [rcx + 0x28], 1
xor ebp, ebp
mov qword [rsp + 0x30], rdi
mov qword [rcx + 0x20], rax
cmp dword [rsi + 0x10], ebp
jne 0x1400047d9
mov rdx, qword [rsi + 0x50]
mov rcx, qword [rsi]
lea r9, [rsp + 0x58]
mov r8d, 0x10000
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140004881
mov ecx, dword [rsp + 0x58]
test ecx, ecx
je 0x140004866
mov rax, qword [rsi + 0x50]
mov dword [rsi + 0x10], ecx
mov qword [rsi + 8], rax
cmp dword [rsi + 0x5c], ebp
je 0x140004824
mov edi, dword [rsi + 0x28]
mov eax, dword [rsi + 0x10]
mov rdx, qword [rsi + 8]
mov rcx, qword [rsi + 0x20]
cmp edi, eax
cmova edi, eax
mov r8d, edi
mov ebx, edi
call fcn.1401a6b10
add qword [rsi + 8], rbx
add qword [rsi + 0x20], rbx
sub dword [rsi + 0x10], edi
sub dword [rsi + 0x28], edi
jne 0x140004798
mov al, byte [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
pop rsi
ret
lea rcx, [rsi + 8]
call fcn.14017f4f0
test eax, eax
je 0x140004836
cmp eax, 4
jne 0x14000489c
cmp dword [rsi + 0x28], ebp
je 0x14000480b
cmp eax, 4
jne 0x140004798
mov edx, eax
lea rcx, str.BZ2_bzDecompress__:__d:_Unexpected_EOF_in_decompression_stream._n
call fcn.1400b35e0
lea rcx, [rsi + 8]
call fcn.14017f620
mov dword [rsi + 0x58], 1
xor eax, eax
jmp 0x14000480f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ReadFile__:__d:_Failed_to_read._n
mov edx, eax
call fcn.1400b35e0
cmp dword [rsi + 0x5c], ebp
jne 0x14000485b
jmp 0x140004852
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ReadFile__:__d:_Failed_to_read._n
mov edx, eax
call fcn.1400b35e0
cmp dword [rsi + 0x5c], ebp
jne 0x14000485b
jmp 0x140004852
mov edx, eax
lea rcx, str.BZ2_bzDecompress__:__d:_Failed_to_decompress._n
jmp 0x14000484d
Function at 0x1400048b0
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0x40
cmp dword [rcx + 0x58], 0
mov rsi, rcx
je 0x1400048c7
xor eax, eax
add rsp, 0x40
pop rsi
ret
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rbx
mov dword [rcx + 0x28], 8
xor ebp, ebp
mov qword [rsp + 0x30], rdi
mov qword [rcx + 0x20], rax
cmp dword [rsi + 0x10], ebp
jne 0x140004929
mov rdx, qword [rsi + 0x50]
mov rcx, qword [rsi]
lea r9, [rsp + 0x50]
mov r8d, 0x10000
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400049d2
mov ecx, dword [rsp + 0x50]
test ecx, ecx
je 0x1400049b7
mov rax, qword [rsi + 0x50]
mov dword [rsi + 0x10], ecx
mov qword [rsi + 8], rax
cmp dword [rsi + 0x5c], ebp
je 0x140004975
mov edi, dword [rsi + 0x28]
mov eax, dword [rsi + 0x10]
mov rdx, qword [rsi + 8]
mov rcx, qword [rsi + 0x20]
cmp edi, eax
cmova edi, eax
mov r8d, edi
mov ebx, edi
call fcn.1401a6b10
add qword [rsi + 8], rbx
add qword [rsi + 0x20], rbx
sub dword [rsi + 0x10], edi
sub dword [rsi + 0x28], edi
jne 0x1400048e8
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
pop rsi
ret
lea rcx, [rsi + 8]
call fcn.14017f4f0
test eax, eax
je 0x140004987
cmp eax, 4
jne 0x1400049ed
cmp dword [rsi + 0x28], ebp
je 0x14000495b
cmp eax, 4
jne 0x1400048e8
mov edx, eax
lea rcx, str.BZ2_bzDecompress__:__d:_Unexpected_EOF_in_decompression_stream._n
call fcn.1400b35e0
lea rcx, [rsi + 8]
call fcn.14017f620
mov dword [rsi + 0x58], 1
xor eax, eax
jmp 0x140004960
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ReadFile__:__d:_Failed_to_read._n
mov edx, eax
call fcn.1400b35e0
cmp dword [rsi + 0x5c], ebp
jne 0x1400049ac
jmp 0x1400049a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ReadFile__:__d:_Failed_to_read._n
mov edx, eax
call fcn.1400b35e0
cmp dword [rsi + 0x5c], ebp
jne 0x1400049ac
jmp 0x1400049a3
mov edx, eax
lea rcx, str.BZ2_bzDecompress__:__d:_Failed_to_decompress._n
jmp 0x14000499e
Function at 0x140004d70
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0x40
cmp dword [rcx + 0x58], 0
mov rsi, rcx
je 0x140004d87
xor eax, eax
add rsp, 0x40
pop rsi
ret
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x60], rbx
mov dword [rcx + 0x28], 4
xor ebp, ebp
mov qword [rsp + 0x30], rdi
mov qword [rcx + 0x20], rax
cmp dword [rsi + 0x10], ebp
jne 0x140004de9
mov rdx, qword [rsi + 0x50]
mov rcx, qword [rsi]
lea r9, [rsp + 0x58]
mov r8d, 0x10000
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140004e91
mov ecx, dword [rsp + 0x58]
test ecx, ecx
je 0x140004e76
mov rax, qword [rsi + 0x50]
mov dword [rsi + 0x10], ecx
mov qword [rsi + 8], rax
cmp dword [rsi + 0x5c], ebp
je 0x140004e34
mov edi, dword [rsi + 0x28]
mov eax, dword [rsi + 0x10]
mov rdx, qword [rsi + 8]
mov rcx, qword [rsi + 0x20]
cmp edi, eax
cmova edi, eax
mov r8d, edi
mov ebx, edi
call fcn.1401a6b10
add qword [rsi + 8], rbx
add qword [rsi + 0x20], rbx
sub dword [rsi + 0x10], edi
sub dword [rsi + 0x28], edi
jne 0x140004da8
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
pop rsi
ret
lea rcx, [rsi + 8]
call fcn.14017f4f0
test eax, eax
je 0x140004e46
cmp eax, 4
jne 0x140004eac
cmp dword [rsi + 0x28], ebp
je 0x140004e1b
cmp eax, 4
jne 0x140004da8
mov edx, eax
lea rcx, str.BZ2_bzDecompress__:__d:_Unexpected_EOF_in_decompression_stream._n
call fcn.1400b35e0
lea rcx, [rsi + 8]
call fcn.14017f620
mov dword [rsi + 0x58], 1
xor eax, eax
jmp 0x140004e1f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ReadFile__:__d:_Failed_to_read._n
mov edx, eax
call fcn.1400b35e0
cmp dword [rsi + 0x5c], ebp
jne 0x140004e6b
jmp 0x140004e62
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ReadFile__:__d:_Failed_to_read._n
mov edx, eax
call fcn.1400b35e0
cmp dword [rsi + 0x5c], ebp
jne 0x140004e6b
jmp 0x140004e62
mov edx, eax
lea rcx, str.BZ2_bzDecompress__:__d:_Failed_to_decompress._n
jmp 0x140004e5d

Function at 0x140004ec0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140004760
cmp al, 0xff
jne 0x140004edf
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140004d70
movzx eax, al
add rsp, 0x20
pop rbx
ret
Function at 0x1400056c0
Capabilities:
Delete service
Stop service

Disassembly:
push rbx
sub rsp, 0x50
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rbx, rax
je 0x1400057d8
lea rdx, str.Everything_Client
mov r8d, 0x20
mov rcx, rax
mov qword [rsp + 0x60], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rdi, rax
je 0x140005721
lea r8, [rsp + 0x30]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, str.Everything_Client
mov r8d, 0x10000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rdi, rax
je 0x140005790
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140005773
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x1401fd5f8]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x20a0]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d47d0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
mov rdi, qword [rsp + 0x60]
add rsp, 0x50
pop rbx
jmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
je 0x1400057c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x1401fd5f8]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2078]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d47d0
mov rcx, rbx
mov rdi, qword [rsp + 0x60]
add rsp, 0x50
pop rbx
jmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x1401fd5f8]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2088]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d47d0
add rsp, 0x50
pop rbx
ret
Function at 0x140005810
Capabilities:
Start service

Disassembly:
push rbx
sub rsp, 0x30
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rbx, rax
je 0x1400058f1
lea rdx, str.Everything_Client
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rax
mov qword [rsp + 0x40], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rdi, rax
je 0x1400058b6
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140005899
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x140005899
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x1401fd5f8]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2090]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d47d0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
jmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x1401fd5f8]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2078]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d47d0
mov rcx, rbx
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
jmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x1401fd5f8]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2088]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d47d0
add rsp, 0x30
pop rbx
ret

Function at 0x140005920
Capabilities:
Stop service

Disassembly:
push rbx
sub rsp, 0x50
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rbx, rax
je 0x140005a08
lea rdx, str.Everything_Client
mov r8d, 0x20
mov rcx, rax
mov qword [rsp + 0x60], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rdi, rax
je 0x1400059cd
lea r8, [rsp + 0x30]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1400059b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x1400059b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x1401fd5f8]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2098]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d47d0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
mov rdi, qword [rsp + 0x60]
add rsp, 0x50
pop rbx
jmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x1401fd5f8]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2078]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d47d0
mov rcx, rbx
mov rdi, qword [rsp + 0x60]
add rsp, 0x50
pop rbx
jmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x1401fd5f8]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2088]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d47d0
add rsp, 0x50
pop rbx
ret
Function at 0x140005a40
Capabilities:
Create service
Persist via windows service

Disassembly:
push rbx
sub rsp, 0x4e0
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
call fcn.1400056c0
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rbx, rax
je 0x140005bc3
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x4f0], rdi
call fcn.1400012c0
lea rcx, [rsp + 0x190]
call fcn.1400012c0
lea rcx, [rsp + 0x2b0]
call fcn.1400012c0
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.1400d85c0
mov r8, qword [rsp + 0x78]
lea rdx, str.__s___client_svc
lea rcx, [rsp + 0x190]
call fcn.140176700
mov rdx, qword [rsp + 0x198]
lea rcx, [rsp + 0x2b0]
call fcn.14017b470
mov rax, qword [rsp + 0x2b8]
xor r11d, r11d
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r11d
lea r9d, [r11 + 2]
lea r8, str.Everything_Client
lea rdx, str.Everything_Client
mov rcx, rbx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
mov rdi, rax
je 0x140005b51
call fcn.140005810
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140005b8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x140005b65
call fcn.140005810
jmp 0x140005b8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x1401fd5f8]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2080]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d47d0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [rsp + 0x2b0]
call fcn.140175010
lea rcx, [rsp + 0x190]
call fcn.140175010
lea rcx, [rsp + 0x70]
call fcn.140175010
mov rdi, qword [rsp + 0x4f0]
jmp 0x140005bea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x1401fd5f8]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2088]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d47d0
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.1401a6ae0
add rsp, 0x4e0
pop rbx
ret
Function at 0x140006000
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x270
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbp, rcx
lea rcx, [rsp + 0x140]
call fcn.1400012c0
lea rcx, [rsp + 0x20]
call fcn.1400012c0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rsp + 0x140]
mov rdx, rax
call fcn.140175db0
mov rcx, rbp
call fcn.140175fb0
mov rsi, qword [rsp + 0x148]
cmp byte [rsi], 0
je 0x140006148
mov qword [rsp + 0x288], rbx
mov qword [rsp + 0x290], rdi
xor ebx, ebx
xor edi, edi
nop
mov rcx, rsi
call fcn.140173310
xor r8d, r8d
mov rcx, rax
movzx eax, byte [rax]
test al, al
je 0x1400060ec
test r8d, r8d
jne 0x1400060aa
cmp al, 0x20
je 0x1400060ec
cmp al, 9
je 0x1400060ec
cmp al, 0xd
je 0x1400060ec
cmp al, 0xa
je 0x1400060ec
cmp al, 0x22
jne 0x1400060d8
add rcx, 1
cmp byte [rcx], al
jne 0x1400060cb
cmp byte [rcx + 1], al
jne 0x1400060cb
add rcx, 2
test edi, edi
je 0x1400060c5
mov byte [rbx], al
add rbx, 1
jmp 0x1400060e6
xor eax, eax
test r8d, r8d
sete al
mov r8d, eax
jmp 0x1400060e6
test edi, edi
je 0x1400060de
mov byte [rbx], al
add rbx, 1
add rcx, 1
mov al, byte [rcx]
test al, al
jne 0x140006095
test edi, edi
je 0x1400060fd
mov byte [rbx], 0
call fcn.140173310
mov rsi, rax
jmp 0x140006119
lea edx, [rbx + 1]
cmp edx, dword [rsp + 0x24]
mov dword [rsp + 0x20], edx
jle 0x140006114
lea rcx, [rsp + 0x20]
call fcn.140175030
mov rbx, qword [rsp + 0x28]
add edi, 1
cmp edi, 2
jl 0x140006080
mov rcx, rsi
call fcn.140173310
mov rcx, rbp
mov rdx, rax
call fcn.140175d10
mov rdi, qword [rsp + 0x290]
mov rbx, qword [rsp + 0x288]
lea rcx, [rsp + 0x20]
call fcn.140175010
lea rcx, [rsp + 0x140]
call fcn.140175010
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401a6ae0
mov rbp, qword [rsp + 0x298]
add rsp, 0x270
pop rsi
ret
Function at 0x140009f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1e8
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rax, qword [rsp + 0x280]
mov rsi, qword [rsp + 0x250]
mov rbp, qword [rsp + 0x258]
mov r12, qword [rsp + 0x260]
mov r13, qword [rsp + 0x268]
mov r14, qword [rsp + 0x270]
mov r15, qword [rsp + 0x278]
mov qword [rsp + 0x70], rcx
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x50], rax
mov rdi, r9
mov rbx, r8
mov qword [rsp + 0x48], rdx
call fcn.1400012c0
lea rcx, [rsp + 0xb0]
mov rdx, rbx
call fcn.140177ec0
test rax, rax
mov rbx, rax
mov qword [rsp + 0x40], rax
je 0x14000a1c7
lea rdx, [rsp + 0x3c]
mov r8d, 1
mov rcx, rdi
call fcn.140173340
lea rdx, [rsp + 0x34]
mov r8d, 0x10000
mov rcx, rsi
mov rdi, rax
mov qword [rsp + 0x90], rax
call fcn.140173340
lea rdx, [rsp + 0x2c]
xor r8d, r8d
mov rcx, rbp
mov rsi, rax
mov qword [rsp + 0x58], rax
call fcn.140173340
lea rdx, [rsp + 0x24]
mov r8d, 2
mov rcx, r12
mov rbp, rax
mov qword [rsp + 0x60], rax
call fcn.140173340
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov rcx, r13
mov r12, rax
mov qword [rsp + 0x68], rax
call fcn.140173340
lea rdx, [rsp + 0x38]
mov r8d, 3
mov rcx, r14
mov r13, rax
mov qword [rsp + 0x78], rax
call fcn.140173340
lea rdx, [rsp + 0x28]
mov r8d, 6
mov rcx, r15
mov r14, rax
mov qword [rsp + 0x88], rax
call fcn.140173340
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x30]
mov r8d, 1
mov r15, rax
mov qword [rsp + 0x98], rax
call fcn.140173340
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xb8]
cmp byte [rax], 0
mov qword [rsp + 0x80], rax
je 0x14000a1a6
mov r15d, dword [rsp + 0x30]
mov r14d, dword [rsp + 0x28]
mov r13d, dword [rsp + 0x38]
mov r12d, dword [rsp + 0x20]
mov ebp, dword [rsp + 0x24]
mov esi, dword [rsp + 0x2c]
mov edi, dword [rsp + 0x34]
mov ebx, dword [rsp + 0x3c]
mov ecx, 0x38
call fcn.1400ce030
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0xa0], rax
call fcn.14016bb20
mov rcx, qword [rsp + 0xa0]
mov dword [rcx + 0x20], esi
mov rsi, qword [rsp + 0x70]
mov dword [rcx + 0x1c], edi
mov rdi, qword [rsp + 0x48]
mov qword [rcx], rax
mov dword [rcx + 0x18], ebx
mov byte [rcx + 0x24], bpl
mov dword [rcx + 0x30], r12d
mov dword [rcx + 0x34], r13d
mov dword [rcx + 0x28], r14d
mov dword [rcx + 0x2c], r15d
cmp qword [rsi], 0
je 0x14000a15f
mov rax, qword [rdi]
mov qword [rax + 8], rcx
mov rax, qword [rdi]
mov qword [rcx + 0x10], rax
jmp 0x14000a16a
mov qword [rsi], rcx
mov qword [rcx + 0x10], 0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov r13, qword [rsp + 0x78]
mov r14, qword [rsp + 0x88]
mov r15, qword [rsp + 0x98]
mov qword [rcx + 8], 0
mov qword [rdi], rcx
mov rdi, qword [rsp + 0x90]
lea rcx, [rsp + 0xb0]
mov rdx, rbx
call fcn.140177ec0
test rax, rax
mov rbx, rax
mov qword [rsp + 0x40], rax
jne 0x140009fe1
lea rcx, [rsp + 0xb0]
call fcn.140175010
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401a6ae0
add rsp, 0x1e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret