joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14016b980
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r12, r8
mov dword [rsp + 0x30], 0x100
mov r14d, edx
mov rbp, rcx
mov rcx, qword [0x1402c6140]
mov edx, 4
mov r8d, 0x100
mov r15, r9
xor esi, esi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, r14d
xor edx, edx
mov rdi, rax
mov rcx, rbp
lea rax, [rsp + 0x30]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ntdll.dll_NtEnumerateValueKey]
mov ebx, eax
cmp eax, 0x8000001a
je 0x14016babf
nop
cmp ebx, 0x80000005
je 0x14016ba10
cmp ebx, 0xc0000023
jne 0x14016ba68
mov rcx, qword [0x1402c6140]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x30]
mov edx, 4
mov rcx, qword [0x1402c6140]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, r14d
mov edx, esi
mov rdi, rax
mov rcx, rbp
lea rax, [rsp + 0x30]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtEnumerateValueKey]
mov ebx, eax
test ebx, ebx
js 0x14016bac1
lfence
mov r8, r15
mov rdx, rdi
mov rcx, rbp
mov rax, r12
call qword [case.0x14013f76a.0]
test al, al
je 0x14016bac1
lfence
lea rax, [rsp + 0x30]
inc esi
mov qword [rsp + 0x28], rax
mov r9, rdi
mov eax, dword [rsp + 0x30]
mov r8d, r14d
mov edx, esi
mov dword [rsp + 0x20], eax
mov rcx, rbp
call qword [sym.imp.ntdll.dll_NtEnumerateValueKey]
mov ebx, eax
cmp eax, 0x8000001a
jne 0x14016ba00
xor ebx, ebx
mov rcx, qword [0x1402c6140]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret

Function at 0x14016c360
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], r9
mov rbx, rcx
mov dword [rsp + 0x30], r8d
xor r9d, r9d
mov qword [rsp + 0x28], rdx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov edx, eax
cmp eax, 0x103
jne 0x14016c3bd
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
js 0x14016c3d9
mov edx, dword [rsp + 0x50]
nop dword [rax]
test edx, edx
js 0x14016c3d7
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14016c3d7
mov eax, dword [rsp + 0x58]
mov dword [rcx], eax
mov eax, edx
add rsp, 0x60
pop rbx
ret
Function at 0x14016f520
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1402bb040]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rcx
mov rbx, rdx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 0x18
mov r8d, 8
lea rdx, [rsp + 0x38]
mov ecx, 0xe6
call qword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
test eax, eax
js 0x14016f597
mov edx, dword [rsp + 0x30]
xor eax, eax
shr edx, 2
test edx, edx
je 0x14016f592
lea rcx, [rsp + 0x40]
test dword [rcx], 0x80000
jne 0x14016f5ab
inc eax
add rcx, 4
cmp eax, edx
jb 0x14016f580
mov eax, 0xc0000225
mov rcx, qword ds:[rsp + 0x58]
xor rcx, rsp
call fcn.1401e5e40
add rsp, 0x60
pop rbx
ret
movzx eax, word ds:[rsp + rax*4 + 0x40]
mov word [rbx], ax
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401e5e40
add rsp, 0x60
pop rbx
ret

Function at 0x14016fb00
Capabilities:
Get uefi variable

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1402bb040]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rax, [0x14023c748]
mov dword [rsp + 0x38], 0x40002
mov qword [rsp + 0x40], rax
lea r9, [rsp + 0x30]
xor eax, eax
lea rdx, [rsp + 0x48]
xorps xmm0, xmm0
mov dword [rsp + 0x30], eax
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x38]
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.ntdll.dll_NtQuerySystemEnvironmentValueEx]
cmp eax, 0xc0000100
sete al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401e5e40
add rsp, 0x68
ret
Function at 0x14016fb80
Capabilities:
Get uefi variable

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1402bb040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, qword [rsp + 0xb0]
xor eax, eax
mov dword [rsp + 0x30], eax
mov rsi, r9
mov dword [rsp + 0x34], eax
mov r14, r8
movzx eax, word [rcx]
mov word [rsp + 0x38], ax
add ax, 2
mov word [rsp + 0x3a], ax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x40], rax
movzx eax, word [rdx]
mov word [rsp + 0x48], ax
add ax, 2
cmp qword [rdx], 0xfffe
mov word [rsp + 0x4a], ax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x50], rax
jbe 0x14016fbfa
mov eax, 0x80000005
lfence
jmp 0x14016fd0b
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_RtlGUIDFromString]
test eax, eax
jns 0x14016fc16
lfence
jmp 0x14016fd0b
lea rax, [rsp + 0x34]
xor r8d, r8d
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_NtQuerySystemEnvironmentValueEx]
cmp eax, 0xc0000023
je 0x14016fc49
mov eax, 0xc0000001
jmp 0x14016fd0b
mov r8d, dword [rsp + 0x30]
mov edx, 4
mov rcx, qword [0x1402c6140]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rbp
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword ds:[rsp + 0x30]
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.14020c410
lea rax, [rsp + 0x34]
mov r8, rbx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_NtQuerySystemEnvironmentValueEx]
mov ebp, eax
test eax, eax
js 0x14016fce4
test r14, r14
je 0x14016fcb7
mov qword [r14], rbx
jmp 0x14016fccc
lfence
mov rcx, qword [0x1402c6140]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test rsi, rsi
je 0x14016fcd7
mov eax, dword [rsp + 0x30]
mov dword [rsi], eax
test rdi, rdi
je 0x14016fcf9
mov eax, dword [rsp + 0x34]
mov dword [rdi], eax
jmp 0x14016fcf9
lfence
mov rcx, qword [0x1402c6140]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x90]
mov eax, ebp
mov rbp, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1401e5e40
add rsp, 0x70
pop r14
pop rdi
pop rsi
ret

Function at 0x14016fe20
Capabilities:
Get uefi variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov dword [rsp + 0x40], 0x1000
mov esi, ecx
mov r8d, 0x1000
mov rcx, qword [0x1402c6140]
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea r8, [rsp + 0x40]
mov ecx, esi
mov rdx, rax
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtEnumerateSystemEnvironmentValuesEx]
mov ebx, eax
cmp eax, 0xc0000023
je 0x14016fe7d
cmp eax, 0xc0000004
jne 0x14016fe96
mov rcx, qword [0x1402c6140]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x40]
jmp 0x14016fe48
test ebx, ebx
js 0x14016fe9f
mov qword [r14], rdi
jmp 0x14016feb3
mov rcx, qword [0x1402c6140]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140170320
Capabilities:
Get system information on windows

Disassembly:
mov dword [rsp + 8], ecx
push rsi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov r15, rdx
test ecx, ecx
je 0x140170389
sub ecx, 3
je 0x14017037a
nop dword [rax]
sub ecx, 1
je 0x14017036b
cmp ecx, 0xfffb
je 0x14017035c
mov eax, 0xc0000003
add rsp, 0x40
pop r15
pop r14
pop rsi
ret
mov eax, dword [0x1402c1634]
lea rsi, [0x1402c1634]
jmp 0x140170396
mov eax, dword [0x1402c1630]
lea rsi, [0x1402c1630]
jmp 0x140170396
mov eax, dword [0x1402c162c]
lea rsi, [0x1402c162c]
jmp 0x140170396
mov eax, dword [0x1402c1628]
lea rsi, [0x1402c1628]
mov rcx, qword [0x1402c6140]
mov edx, 4
mov qword [rsp + 0x68], rbx
mov ebx, eax
mov qword [rsp + 0x38], rbp
mov r8d, eax
mov dword [rsp + 0x78], ebx
mov qword [rsp + 0x30], rdi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, 4
lea rdx, [rsp + 0x60]
mov rbp, rax
mov ecx, 0x6b
lea rax, [rsp + 0x78]
mov r9, rbp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
xor ebx, ebx
mov edi, eax
cmp eax, 0xc0000004
jne 0x140170467
nop dword [rax + rax]
cmp ebx, 8
jae 0x14017046b
mov rcx, qword [0x1402c6140]
mov r8, rbp
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x78]
mov edx, 4
mov rcx, qword [0x1402c6140]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, 4
lea rdx, [rsp + 0x60]
mov rbp, rax
mov ecx, 0x6b
lea rax, [rsp + 0x78]
mov r9, rbp
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
inc ebx
mov edi, eax
cmp eax, 0xc0000004
je 0x140170400
test edi, edi
jns 0x140170488
lfence
mov rcx, qword [0x1402c6140]
mov r8, rbp
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14017049e
lfence
mov eax, dword [rsp + 0x78]
cmp eax, 0x100000
ja 0x140170498
mov dword [rsi], eax
mov qword [r15], rbp
mov dword [r14], eax
mov rbp, qword [rsp + 0x38]
mov eax, edi
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop r14
pop rsi
ret
Function at 0x1401704c0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r13
sub rsp, 0x48
mov ebx, dword [0x1402c1634]
mov edx, 4
mov rcx, qword [0x1402c6140]
mov r8d, ebx
mov dword [rsp + 0x78], 0xffff
mov dword [rsp + 0x70], ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, 4
lea rdx, [rsp + 0x78]
mov rdi, rax
mov ecx, 0x6b
lea rax, [rsp + 0x70]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
xor r13d, r13d
mov esi, eax
mov ebx, r13d
cmp eax, 0xc0000004
jne 0x140170597
nop
cmp ebx, 8
jae 0x14017059b
mov rcx, qword [0x1402c6140]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x70]
mov edx, 4
mov rcx, qword [0x1402c6140]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, 4
lea rdx, [rsp + 0x78]
mov rdi, rax
mov ecx, 0x6b
lea rax, [rsp + 0x70]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
inc ebx
mov esi, eax
cmp eax, 0xc0000004
je 0x140170530
test esi, esi
jns 0x1401705bc
lfence
mov rcx, qword [0x1402c6140]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, esi
add rsp, 0x48
pop r13
pop rdi
pop rsi
pop rbx
ret
mov eax, dword [rsp + 0x70]
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r14
cmp eax, 0x100000
ja 0x1401705df
mov dword [0x1402c1634], eax
lfence
lea r14, [rdi + rax]
mov ebp, r13d
mov r11d, r13d
mov r9d, r13d
mov ebx, r13d
mov r12, rdi
cmp rdi, r14
jae 0x1401706b3
mov qword [rsp + 0x30], r15
mov r15d, dword [0x1402bb00c]
nop word [rax + rax]
mov ecx, dword [rdi]
test ecx, ecx
je 0x14017062e
sub ecx, 1
je 0x140170629
nop dword [rax + rax]
cmp ecx, 2
jne 0x14017069f
inc ebx
jmp 0x14017069f
inc r11d
jmp 0x14017069f
movzx eax, word [rdi + 0x1e]
inc ebp
cmp r13w, ax
jae 0x14017069f
mov r10d, r15d
lea rdx, [rdi + 0x20]
and r10d, 4
mov r8d, eax
mov rax, qword [rdx]
test r10d, r10d
je 0x140170657
popcnt rax, rax
jmp 0x140170692
mov rcx, rax
shr rcx, 1
and ecx, 0x55555555
sub rax, rcx
mov rcx, rax
and eax, 0x33333333
shr rcx, 2
and ecx, 0x33333333
add rcx, rax
mov rax, rcx
shr rax, 4
add eax, ecx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
add r9d, eax
add rdx, 0x10
sub r8, 1
jne 0x140170648
mov ecx, dword [rdi + 4]
add rdi, rcx
cmp rdi, r14
jb 0x140170610
mov r15, qword [rsp + 0x30]
mov rcx, qword [0x1402c6140]
mov r8, r12
xor edx, edx
mov dword [0x1402c8c50], ebp
mov dword [0x1402c8c54], r11d
mov dword [0x1402c8c58], r9d
mov dword [0x1402c8c5c], ebx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r14, qword [rsp + 0x38]
mov eax, esi
mov r12, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x80]
add rsp, 0x48
pop r13
pop rdi
pop rsi
pop rbx
ret

Function at 0x140170990
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
movzx eax, byte [rax + 2]
ret
Function at 0x140170be0
Capabilities:
Resume thread

Disassembly:
mov r11, rsp
push rbp
push rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x1402bb040]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xor r14d, r14d
lea r8, [r11 - 0x28]
mov rbp, rdx
mov qword [r11 - 0x70], r14
mov edx, 0x1a
mov qword [r11 - 0x78], r14
mov r9d, 8
mov qword [r11 - 0x68], r14
mov qword [r11 - 0x60], r14
mov rdi, rcx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x140170ddf
cmp qword [rsp + 0xa0], r14
lea rax, [0x1402c1688]
mov qword [rsp + 0xe0], rbx
lea rbx, [0x1402c17d8]
mov qword [rsp + 0xe8], rsi
setne sil
test sil, sil
cmove rbx, rax
lfence
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], r14
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, str.RtlExitUserThread
mov rdx, rbx
mov rcx, rdi
call sym.SystemInformer.exe_Ordinal_1525
test eax, eax
js 0x140170dcf
lfence
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], r14
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, str.RtlFlushHeaps
mov rdx, rbx
mov rcx, rdi
call sym.SystemInformer.exe_Ordinal_1525
test eax, eax
js 0x140170dcf
cmp dword [0x1402bbf68], 0x3e
jb 0x140170cf0
lfence
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.14016fee0
mov ebx, eax
test eax, eax
js 0x140170dbe
lfence
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov r8d, 1
mov rax, qword [rsp + 0x58]
mov rcx, rdi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call fcn.140144680
mov rdi, qword [rsp + 0x60]
mov ebx, eax
test eax, eax
js 0x140170db0
mov rdx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rcx, rdi
test sil, sil
je 0x140170d54
call qword [sym.imp.ntdll.dll_RtlQueueApcWow64Thread]
jmp 0x140170d5a
call qword [sym.imp.ntdll.dll_NtQueueApcThread]
mov ebx, eax
test eax, eax
js 0x140170db0
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtResumeThread]
mov ebx, eax
test eax, eax
js 0x140170db0
mov r8, rbp
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov ebx, eax
test eax, eax
js 0x140170db0
mov r9d, 0x30
mov qword [rsp + 0x20], r14
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
mov ebx, eax
cmovns ebx, dword [rsp + 0x70]
test rdi, rdi
je 0x140170dbe
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140170dcd
call fcn.14016ffe0
mov eax, ebx
mov rbx, qword [rsp + 0xe0]
mov rsi, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1401e5e40
add rsp, 0xb0
pop r14
pop rdi
pop rbp
ret
Function at 0x140175840
Capabilities:
Enumerate services

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov eax, dword [0x1402bbf68]
mov r15, rdx
mov r12, rcx
cmp eax, 0x66
jb 0x14017586c
mov esi, 0x3ff
jmp 0x14017587c
cmp eax, 0x64
mov esi, 0x3b
mov ecx, 0x1ff
cmovae esi, ecx
mov rdi, qword [0x1402c98c0]
test rdi, rdi
jne 0x1401758c6
xor edx, edx
xor ecx, ecx
mov r8d, 5
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rcx, rax
test rax, rax
je 0x1401758c6
xor eax, eax
lock cmpxchg qword [0x1402c98c0], rcx
mov rdi, rax
jne 0x1401758ba
mov rdi, rcx
jmp 0x1401758c6
nop word [rax + rax]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebp, dword [0x1402c1b38]
mov edx, 4
mov rcx, qword [0x1402c6140]
mov r8d, ebp
mov qword [rsp + 0x90], rbx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r13d, r13d
mov r9d, 3
mov qword [rsp + 0x48], r13
mov r14, rax
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x38], rax
mov r8d, esi
lea rax, [rsp + 0xa0]
xor edx, edx
mov qword [rsp + 0x30], rax
mov rcx, rdi
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
jne 0x140175a2a
cmp dword [0x1402bbf68], 0xffffffff
nop
jae 0x140175950
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x140175956
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_Ordinal_1343
mov ebx, eax
cmp eax, 0x105
jne 0x140175a0f
mov rcx, qword [0x1402c6140]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add ebp, dword [rsp + 0xa0]
mov edx, 4
mov rcx, qword [0x1402c6140]
mov r8d, ebp
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rsp + 0x48], r13
mov r9d, 3
mov r14, rax
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0xa8]
mov r8d, esi
mov qword [rsp + 0x38], rax
xor edx, edx
lea rax, [rsp + 0xa0]
mov rcx, rdi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
nop dword [rax]
test eax, eax
jne 0x140175a2a
cmp dword [0x1402bbf68], 0xffffffff
jae 0x1401759fb
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x140175a06
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_Ordinal_1343
mov ebx, eax
test ebx, ebx
jns 0x140175a2d
lfence
mov rcx, qword [0x1402c6140]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140175a4c
mov ebx, r13d
lfence
cmp ebp, 0x20000
ja 0x140175a3e
mov dword [0x1402c1b38], ebp
mov eax, dword [rsp + 0xa8]
mov dword [r15], eax
mov qword [r12], r14
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140175a80
Capabilities:
Enumerate services

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rsi, r8
mov r14, rdx
mov rbp, rcx
mov edx, 4
mov rcx, qword [0x1402c6140]
mov r8d, 0x800
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r9d, 0x800
mov edx, 3
mov rdi, rax
mov rcx, rbp
lea rax, [rsp + 0x30]
mov r8, rdi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
je 0x140175b0d
xor ebx, ebx
lfence
mov eax, dword [rsp + 0x30]
mov qword [r14], rdi
mov dword [rsi], eax
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
cmp dword [0x1402bbf68], 0xffffffff
jae 0x140175b24
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x140175b2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_Ordinal_1343
mov ebx, eax
cmp eax, 0x105
jne 0x140175bc7
mov rcx, qword [0x1402c6140]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ebx, dword [rsp + 0x78]
mov edx, 4
mov rcx, qword [0x1402c6140]
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r9d, ebx
mov edx, 3
mov rdi, rax
mov rcx, rbp
lea rax, [rsp + 0x30]
mov r8, rdi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x140175aea
cmp dword [0x1402bbf68], 0xffffffff
jae 0x140175bb3
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x140175bb9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_Ordinal_1343
mov ebx, eax
test ebx, ebx
jns 0x140175aec
lfence
mov rcx, qword [0x1402c6140]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140175af8
Function at 0x140175e80
Capabilities:
Create service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x80
mov r14, r8
mov r15, rdx
mov rsi, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 2
mov ebp, r9d
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140175eed
cmp dword [0x1402bbf68], 0xffffffff
jae 0x140175ed1
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x140175ed7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_Ordinal_1343
nop
test eax, eax
js 0x140175fa9
mov rbx, qword [rsp + 0x70]
mov rax, qword ds:[rsp + 0xe8]
mov r9d, ebp
mov qword [rsp + 0x60], rax
mov r8, r14
mov rax, qword [rsp + 0xe0]
mov rdx, r15
mov qword [rsp + 0x58], rax
mov rcx, rbx
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xa0], rdi
xor edi, edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xd0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
je 0x140175f70
mov qword [rsi], rax
jmp 0x140175f96
cmp dword [0x1402bbf68], 0xffffffff
jae 0x140175f87
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x140175f8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_Ordinal_1343
mov edi, eax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
mov rdi, qword [rsp + 0xa0]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rsi
ret

Function at 0x140175fe0
Capabilities:
Modify service

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [rsp + 0xc0]
mov qword [r11 - 0x18], rax
mov rax, qword [rsp + 0xb8]
mov qword [r11 - 0x20], rax
mov rax, qword [rsp + 0xb0]
mov qword [r11 - 0x28], rax
mov rax, qword [rsp + 0xa8]
mov qword [r11 - 0x30], rax
mov rax, qword [rsp + 0xa0]
mov qword [r11 - 0x38], rax
mov rax, qword [rsp + 0x98]
mov qword [r11 - 0x40], rax
mov rax, qword [rsp + 0x90]
mov qword [r11 - 0x48], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x140176051
xor eax, eax
add rsp, 0x68
ret
cmp dword [0x1402bbf68], 0xffffffff
jae 0x140176071
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
mov ecx, eax
add rsp, 0x68
jmp sym.SystemInformer.exe_Ordinal_1343
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add rsp, 0x68
jmp sym.SystemInformer.exe_Ordinal_1343

Function at 0x140176090
Capabilities:
Modify service

Disassembly:
sub rsp, 0x28
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x1401760a5
xor eax, eax
add rsp, 0x28
ret
cmp dword [0x1402bbf68], 0xffffffff
jae 0x1401760c5
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
mov ecx, eax
add rsp, 0x28
jmp sym.SystemInformer.exe_Ordinal_1343
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add rsp, 0x28
jmp sym.SystemInformer.exe_Ordinal_1343