joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180151850
Capabilities:
Start service

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, r8
mov ebp, edx
mov rdi, rcx
call fcn.180127c10
test eax, eax
je 0x18015188c
mov dword [0x18023cf20], 0x32
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
test rdi, rdi
jne 0x1801518ad
mov dword [0x18023cf20], 0x57
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov qword [rsp + 0x60], rbx
xor ebx, ebx
lea rcx, [rsp + 0x20]
lea r9d, [rbx + 0x10]
lea r8d, [rbx + 2]
mov rdx, rdi
mov dword [0x18023cf20], ebx
call fcn.180151460
lea rcx, [rsp + 0x20]
call fcn.180151500
test rax, rax
je 0x180151916
lea rcx, [rsp + 0x20]
call fcn.180151500
mov r8, rsi
mov edx, ebp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebx, eax
test eax, eax
jne 0x180151934
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18023cf20], eax
cmp eax, 0x420
jne 0x18015191c
mov ebx, 1
jmp 0x180151934
mov eax, dword [0x18023cf20]
test eax, eax
jne 0x180151934
mov eax, dword [rsp + 0x20]
test eax, eax
jne 0x18015192e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18023cf20], eax
lea rcx, [rsp + 0x20]
call fcn.180151560
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x180151af0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x18021dd90]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rdx
mov rsi, rcx
call fcn.180127c10
test eax, eax
je 0x180151b2c
mov dword [0x18023cf20], 0x32
xor eax, eax
jmp 0x180151bcf
xor eax, eax
mov qword [rsp + 0x90], rbx
xor ebx, ebx
lea rcx, [rsp + 0x20]
lea r9d, [rbx + 4]
lea r8d, [rbx + 1]
mov rdx, rsi
mov dword [0x18023cf20], ebx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], eax
call fcn.180151460
lea rcx, [rsp + 0x20]
call fcn.180151500
test rax, rax
je 0x180151ba7
lea rcx, [rsp + 0x20]
call fcn.180151500
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebx, eax
test eax, eax
jne 0x180151b9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x180151bab
mov eax, dword [rsp + 0x54]
mov dword [rdi], eax
jmp 0x180151bbb
mov eax, dword [rsp + 0x20]
test eax, eax
jne 0x180151bb5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18023cf20], eax
lea rcx, [rsp + 0x20]
call fcn.180151560
mov eax, ebx
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800f98f0
mov rsi, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
Function at 0x1801520f0
Capabilities:
Modify service

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x8c8
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov rax, qword [0x18021dd90]
xor rax, rsp
mov qword [rsp + 0x8b0], rax
mov r15d, r9d
mov r14d, r8d
mov r13d, edx
mov rsi, rcx
mov rax, qword [rsp + 0x930]
mov qword [rsp + 0xa0], rax
mov rdi, qword [rsp + 0x938]
mov rax, qword [rsp + 0x940]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x948]
mov qword [rsp + 0x80], rax
mov r12, qword [rsp + 0x950]
mov rbx, qword [rsp + 0x958]
mov rax, qword [rsp + 0x960]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x968]
mov qword [rsp + 0x98], rax
xor eax, eax
mov ebp, eax
lea rcx, [rsp + 0x68]
call fcn.1800e7600
nop
test r12, r12
je 0x1801521b7
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.1800ea150
test rbx, rbx
je 0x1801521c9
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.1800ea150
xor ebx, ebx
mov word [rsp + 0xb0], bx
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0xb2]
call fcn.1800f8b90
mov dword [rsp + 0x60], 0x400
cmp dword [rsp + 0x70], ebx
jle 0x18015222c
xor edx, edx
lea r9, [rsp + 0x60]
lea r8, [rsp + 0xb0]
lea rcx, [rsp + 0x68]
call fcn.1800ef760
test eax, eax
jne 0x180152224
lea rcx, [rsp + 0x68]
call fcn.1800e9fb0
xor eax, eax
jmp 0x1801522ac
lea rbp, [rsp + 0xb0]
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, r15d
mov r8d, r14d
mov edx, r13d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov ebx, eax
test eax, eax
je 0x1801522a0
test rdi, rdi
je 0x1801522a0
mov rdx, rdi
mov rcx, rsi
call fcn.1801516b0
nop
lea rcx, [rsp + 0x68]
call fcn.1800e9fb0
mov eax, ebx
mov rcx, qword [rsp + 0x8b0]
xor rcx, rsp
call fcn.1800f98f0
add rsp, 0x8c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180152530
Capabilities:
Enumerate services

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, r9
mov rdi, r8
mov ebp, edx
mov r12d, ecx
call fcn.180127c10
test eax, eax
je 0x18015257a
mov dword [0x18023cf20], 0x32
xor eax, eax
jmp 0x180152692
xor ebx, ebx
mov qword [rdi], rbx
mov dword [rsi], ebx
mov dword [0x18023cf20], ebx
xor r9d, r9d
xor edx, edx
mov r8d, 0x80000000
lea rcx, [rsp + 0x50]
call fcn.180151460
nop
lea rcx, [rsp + 0x50]
call fcn.180151480
test rax, rax
je 0x180152668
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x44], ebx
lea rcx, [rsp + 0x50]
call fcn.180151480
mov rcx, rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, ebp
mov edx, r12d
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
mov r11d, dword [rsp + 0x40]
test r11d, r11d
je 0x180152668
mov ecx, r11d
call fcn.1800f8d24
mov qword [rdi], rax
test rax, rax
je 0x180152668
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call fcn.1800f8b90
lea rcx, [rsp + 0x50]
call fcn.180151480
mov rcx, rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov r9, qword [rdi]
mov r8d, ebp
mov edx, r12d
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
je 0x180152668
mov eax, dword [rsp + 0x44]
mov dword [rsi], eax
mov ebx, 1
jmp 0x180152686
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18023cf20], eax
mov rcx, qword [rdi]
test rcx, rcx
je 0x180152686
call fcn.1800f8dc8
mov qword [rdi], rbx
mov dword [rsi], ebx
lea rcx, [rsp + 0x50]
call fcn.180151560
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x180152c50
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov esi, r9d
mov edi, r8d
mov rbx, rcx
cmp r8d, 0xffffffff
je 0x180152c90
cmp r8d, 4
jbe 0x180152c90
mov dword [0x18023cf24], 0x57
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbp
mov rbp, qword [rcx]
cmp edx, 0xffffffff
je 0x180152cac
mov r8d, edx
mov rdx, qword [0x1802203e0]
call fcn.1800f2420
cmp edi, 0xffffffff
je 0x180152cc3
mov rdx, qword [str.Start]
mov r8d, edi
mov rcx, rbx
call fcn.1800f2420
cmp esi, 0xffffffff
je 0x180152cda
mov rdx, qword [str.ErrorControl]
mov r8d, esi
mov rcx, rbx
call fcn.1800f2420
mov r8, qword [rsp + 0x60]
test r8, r8
je 0x180152cf3
mov rdx, qword [str.DisplayName]
mov rcx, rbx
call fcn.1800f24a0
mov r8, qword [rsp + 0x68]
test r8, r8
je 0x180152d0c
mov rdx, qword [str.Description]
mov rcx, rbx
call fcn.1800f24a0
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x180152d4a
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
mov r9d, 2
xor r8d, r8d
not rcx
lea eax, [rcx + rcx]
mov rcx, rbp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov rdx, qword [str.ImagePath]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x40]
test r8, r8
je 0x180152d68
mov rdx, qword [str.Group]
mov rcx, rbx
call fcn.1800f24a0
mov r8, qword [rsp + 0x80]
test r8, r8
je 0x180152d84
mov rdx, qword [str.DependOnGroup]
mov rcx, rbx
call fcn.1800f3b10
mov r8, qword [rsp + 0x88]
test r8, r8
je 0x180152da0
mov rdx, qword [str.DependOnService]
mov rcx, rbx
call fcn.1800f3b10
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x180152dc0
Capabilities:
Persist via run registry key

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rbx, rcx
test rcx, rcx
jne 0x180152de3
xor eax, eax
jmp 0x180152e91
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x180152e91
xor edi, edi
lea rcx, [rsp + 0x28]
call fcn.1800f3c90
nop
mov r9d, 0x2001f
mov r8, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800f3690
test rax, rax
je 0x180152e48
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1800f24c0
mov edi, eax
lea rcx, [rsp + 0x28]
call fcn.1800f22a0
test edi, edi
jne 0x180152e85
mov r9d, 0x2001f
mov r8, qword [str.SystemCurrentControlSetServicesVxD]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800f3690
test rax, rax
je 0x180152e85
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1800f24c0
mov edi, eax
lea rcx, [rsp + 0x28]
call fcn.1800f22a0
nop
lea rcx, [rsp + 0x28]
call fcn.1800f3610
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1801534a0
Capabilities:
Persist via run registry key

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x18015351c
cmp word [rcx], 0
je 0x18015351c
lea rcx, [rsp + 0x28]
call fcn.1800f3c90
nop
mov r9d, 0x20019
mov r8, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800f3690
test rax, rax
je 0x180153565
mov r8d, 1
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.1800f3c80
test eax, eax
jne 0x180153523
lea rcx, [rsp + 0x28]
call fcn.1800f3610
xor eax, eax
jmp 0x18015361d
test rsi, rsi
je 0x180153551
mov r8, rdi
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.1800f3750
nop
mov rdx, rax
mov rcx, rsi
call fcn.1800e5d40
nop
lea rcx, [rsp + 0x68]
call fcn.1800e5c00
test rbx, rbx
je 0x18015360e
mov dword [rbx], reloc.WS2_32.dll_recv
jmp 0x18015360e
mov rax, qword [0x1801cd028]
mov qword [rsp + 0x50], rax
mov r9, rdi
mov r8, qword [str.SystemCurrentControlSetServicesVxD]
lea rdx, [0x1801a7038]
lea rcx, [rsp + 0x50]
call fcn.1800e6ce0
mov r9d, 0x20019
mov r8, qword [rsp + 0x50]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800f3690
test rax, rax
jne 0x1801535c6
lea rcx, [rsp + 0x50]
call fcn.1800e5c00
nop
lea rcx, [rsp + 0x28]
call fcn.1800f3610
xor eax, eax
jmp 0x18015361d
test rsi, rsi
je 0x1801535f8
mov r8, qword [str.StaticVxD]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.1800f3750
nop
mov rdx, rax
mov rcx, rsi
call fcn.1800e5d40
nop
lea rcx, [rsp + 0x68]
call fcn.1800e5c00
test rbx, rbx
je 0x180153603
mov dword [rbx], 1
lea rcx, [rsp + 0x50]
call fcn.1800e5c00
nop
lea rcx, [rsp + 0x28]
call fcn.1800f3610
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180153630
Capabilities:
Persist via run registry key

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rbx, r8
mov esi, edx
mov rdi, rcx
test rcx, rcx
je 0x1801537e2
test rbx, rbx
je 0x1801537e2
cmp word [rcx], 0
je 0x1801537e2
cmp word [r8], 0
je 0x1801537e2
lea rcx, [rsp + 0x28]
call fcn.1800f3c90
nop
cmp esi, 2
je 0x1801536ef
cmp esi, 1
je 0x1801536ef
mov r9d, 0x2001f
mov r8, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800f3690
test rax, rax
jne 0x1801536d8
mov r9d, 0x2001f
mov r8, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800f22c0
test rax, rax
jne 0x1801536d8
jmp 0x1801537d8
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.1800f24a0
mov ebx, eax
jmp 0x1801537bf
mov rax, qword [0x1801cd028]
mov qword [rsp + 0x50], rax
mov r9, rdi
mov r8, qword [str.SystemCurrentControlSetServicesVxD]
lea rdx, [0x1801a7038]
lea rcx, [rsp + 0x50]
call fcn.1800e6ce0
mov r9d, 0x2001f
mov r8, qword [rsp + 0x50]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x28]
call fcn.1800f3690
test rax, rax
jne 0x180153747
lea rcx, [rsp + 0x50]
call fcn.1800e5c00
nop
jmp 0x1801537d8
mov rax, qword [0x1801cd028]
mov qword [rsp + 0x68], rax
mov edx, 0x5c
mov rcx, rbx
call fcn.1800f9be8
test rax, rax
je 0x180153773
lea rdx, [rax + 2]
lea rcx, [rsp + 0x68]
call fcn.1800e5dc0
mov r8, qword [rsp + 0x68]
cmp dword [r8 - 8], 0
jne 0x180153797
lea rcx, [rsp + 0x68]
call fcn.1800e5c00
nop
lea rcx, [rsp + 0x50]
call fcn.1800e5c00
nop
jmp 0x1801537d8
mov rdx, qword [str.StaticVxD]
lea rcx, [rsp + 0x28]
call fcn.1800f24a0
mov ebx, eax
lea rcx, [rsp + 0x68]
call fcn.1800e5c00
nop
lea rcx, [rsp + 0x50]
call fcn.1800e5c00
lea rcx, [rsp + 0x28]
call fcn.1800f22a0
nop
lea rcx, [rsp + 0x28]
call fcn.1800f3610
mov eax, ebx
jmp 0x1801537e4
lea rcx, [rsp + 0x28]
call fcn.1800f3610
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180153800
Capabilities:
Persist via run registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov rsi, r8
mov r14, rdx
mov rdi, rcx
mov rax, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov qword [rbp - 0x28], rax
mov rax, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce]
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x38]
call fcn.1800f3c90
nop
lea r12, [rbp - 0x28]
mov r13d, 2
xor r15d, r15d
nop dword [rax]
mov r9d, 0x20019
mov r8, qword [r12]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x38]
call fcn.1800f3690
test rax, rax
je 0x180153930
lea rcx, [rbp - 0x18]
call fcn.1800e7600
nop
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x38]
call fcn.1800f3c70
test eax, eax
je 0x18015391d
mov ebx, r15d
cmp dword [rbp - 0x10], ebx
jle 0x18015391d
nop word [rax + rax]
mov r8d, ebx
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x18]
call fcn.1800f2690
nop
mov r8, qword [rbp + 0x58]
cmp dword [r8 - 8], 0
je 0x18015390d
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x38]
call fcn.1800f3750
nop
mov rax, qword [rbp + 0x40]
cmp dword [rax - 8], 0
je 0x180153903
lea r8, [rbp + 0x58]
mov edx, dword [rdi + 8]
mov rcx, rdi
call fcn.1800ea230
lea r8, [rbp + 0x40]
mov edx, dword [rsi + 8]
mov rcx, rsi
call fcn.1800ea230
nop
lea rcx, [rbp + 0x40]
call fcn.1800e5c00
nop
lea rcx, [rbp + 0x58]
call fcn.1800e5c00
inc ebx
cmp ebx, dword [rbp - 0x10]
jl 0x1801538b0
lea rcx, [rbp - 0x38]
call fcn.1800f22a0
nop
lea rcx, [rbp - 0x18]
call fcn.1800e9fb0
add r12, 8
dec r13
jne 0x180153860
or r8d, 0xffffffff
xor edx, edx
mov rcx, r14
call fcn.1800efe20
mov esi, r15d
cmp dword [rdi + 8], r15d
jle 0x1801539ae
mov rbx, r15
nop word [rax + rax]
mov dword [rbp + 0x40], r15d
lea rdx, [0x1801a6e60]
lea rcx, [rbp + 0x58]
call fcn.1800e9640
nop
mov rax, qword [rdi]
lea r8, [rbp + 0x58]
lea rdx, [rbp + 0x40]
mov rcx, qword [rbx + rax]
call fcn.1801534a0
mov r8d, dword [rbp + 0x40]
mov edx, dword [r14 + 8]
mov rcx, r14
call fcn.1800f0080
nop
lea rcx, [rbp + 0x58]
call fcn.1800e5c00
inc esi
add rbx, 8
cmp esi, dword [rdi + 8]
jl 0x180153960
lea rcx, [rbp - 0x38]
call fcn.1800f3610
mov eax, 1
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801539e0
Capabilities:
Persist via run registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov r12, rdx
mov r13, rcx
mov rax, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
mov qword [rbp - 0x28], rax
mov rax, qword [str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce]
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x38]
call fcn.1800f3c90
nop
lea rdi, [rbp - 0x28]
mov esi, 2
nop
mov r9d, 0x20019
mov r8, qword [rdi]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x38]
call fcn.1800f3690
test rax, rax
je 0x180153b03
lea rcx, [rbp - 0x18]
call fcn.1800e7600
nop
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x38]
call fcn.1800f3c70
test eax, eax
je 0x180153af0
xor ebx, ebx
cmp dword [rbp - 0x10], ebx
jle 0x180153af0
nop dword [rax + rax]
mov r8d, ebx
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x18]
call fcn.1800f2690
nop
mov r8, qword [rbp + 0x48]
cmp dword [r8 - 8], 0
je 0x180153ae0
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x38]
call fcn.1800f3750
nop
mov rax, qword [rbp + 0x40]
cmp dword [rax - 8], 0
je 0x180153ad6
lea r8, [rbp + 0x48]
mov edx, dword [r13 + 8]
mov rcx, r13
call fcn.1800ea230
lea r8, [rbp + 0x40]
mov edx, dword [r12 + 8]
mov rcx, r12
call fcn.1800ea230
nop
lea rcx, [rbp + 0x40]
call fcn.1800e5c00
nop
lea rcx, [rbp + 0x48]
call fcn.1800e5c00
inc ebx
cmp ebx, dword [rbp - 0x10]
jl 0x180153a80
lea rcx, [rbp - 0x38]
call fcn.1800f22a0
nop
lea rcx, [rbp - 0x18]
call fcn.1800e9fb0
add rdi, 8
dec rsi
jne 0x180153a30
lea rcx, [rbp - 0x38]
call fcn.1800f3610
lea eax, [rsi + 1]
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180154570
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
mov qword [rsp + 0x38], rbp
mov rbp, rcx
lea r8, [rsp + 0x68]
lea rdx, str.SystemCurrentControlSetControlProductOptions
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x58], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x18015468f
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.ProductSuite
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18015468f
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x18015468f
lea ecx, [rdi + 0x40]
mov edx, eax
mov qword [rsp + 0x30], rsi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x18015468a
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.ProductSuite
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180154681
cmp dword [rsp + 0x60], 7
jne 0x180154681
mov qword [rsp + 0x50], rbx
mov rbx, rsi
cmp byte [rsi], dil
je 0x18015467c
nop dword [rax + rax]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x180154677
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cdqe
add rbx, rax
cmp byte [rbx], dil
jne 0x180154650
jmp 0x18015467c
mov edi, 1
mov rbx, qword [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x38]
test rcx, rcx
je 0x1801546a4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
add rsp, 0x40
pop rdi
ret
Function at 0x1801546b0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18021dd90]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
call fcn.180127c90
test eax, eax
je 0x180154787
call fcn.180127cf0
test eax, eax
je 0x180154779
xor edx, edx
xor ecx, ecx
mov r8d, 0x20000
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x180154727
lea r8d, [rbx + 4]
lea rdx, str.TermService
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x18015472b
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x180154789
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x180154765
mov eax, dword [rsp + 0x24]
cmp eax, 4
je 0x180154760
cmp eax, 2
jne 0x180154765
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180154787
lea rcx, str.Terminal_Server
call fcn.180154570
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800f98f0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
jmp 0x1801546b0

Function at 0x180154a30
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18021dd90]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
call fcn.180127c90
test eax, eax
je 0x180154787
call fcn.180127cf0
test eax, eax
je 0x180154779
xor edx, edx
xor ecx, ecx
mov r8d, 0x20000
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x180154727
lea r8d, [rbx + 4]
lea rdx, str.TermService
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x18015472b
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x180154789
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x180154765
mov eax, dword [rsp + 0x24]
cmp eax, 4
je 0x180154760
cmp eax, 2
jne 0x180154765
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180154787
lea rcx, str.Terminal_Server
call fcn.180154570
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800f98f0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
jmp 0x1801546b0