joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e8960
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ecx, 0xc0
call fcn.1403590cc
mov rdi, rax
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_obj2_class_RampartResponseMonitor_.0
mov qword [rdi], rax
lea rbx, [rdi + 0x10]
mov rcx, rbx
call fcn.1400a0cd0
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [0x140689b88], rbx
mov rbx, qword [0x140689b90]
mov qword [0x140689b90], rdi
test rbx, rbx
je 0x1400e8a1d
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400e8a1d
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1401cd220.0]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400e8a1d
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x1401cd220.0]
mov rdi, qword [0x140689b88]
mov ecx, 0x78
call fcn.1403590cc
mov rsi, rax
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm0
movups xmmword [rsi + 0x40], xmm0
movups xmmword [rsi + 0x50], xmm0
movups xmmword [rsi + 0x60], xmm0
mov qword [rsi + 0x70], rax
lea rax, vtable.RampartSessionWorker.0
mov qword [rsi], rax
lea rbx, [rsi + 0x48]
xor ebp, ebp
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], rbp
lfence
lea ecx, [rbp + 0x10]
call fcn.1403590cc
mov qword [rax + 8], rbp
mov qword [rbx], rax
mov qword [rax], rbx
mov qword [rsi + 0x70], rdi
xor r9d, r9d
xor r8d, r8d
lea edx, [rbp + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 8], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rbp + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x40], rax
lea rcx, [rsi + 0x10]
mov edx, 0xfa0
call fcn.1401d2870
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov r9, rsi
lea r8, [0x1400edb60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0x38], rax
mov rcx, qword [0x140689b98]
mov qword [0x140689b98], rsi
test rcx, rcx
je 0x1400e8b16
mov rax, qword [rcx]
lea edx, [rbp + 1]
mov rax, qword [rax]
call qword [case.0x1401cd220.0]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
xor r9d, r9d
lea r8, [0x1400e8c70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140686c68], rax
test rax, rax
setne al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x1400e8b70
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [0x140686c68]
test rdx, rdx
je 0x1400e8bbf
mov rcx, qword [0x140686c70]
xor r9d, r9d
mov r8d, 0x2710
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
cmp eax, 0x102
jne 0x1400e8bb2
mov rcx, qword [0x140686c68]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x140686c68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140686c70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1406765b0]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, [0x140686c40]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [0x140689b98]
xor edi, edi
mov qword [0x140689b98], rdi
test rcx, rcx
je 0x1400e8c0f
mov rax, qword [rcx]
lea edx, [rdi + 1]
mov rax, qword [rax]
call qword [case.0x1401cd220.0]
mov rbx, qword [0x140689b90]
mov qword [0x140689b88], rdi
mov qword [0x140689b90], rdi
test rbx, rbx
je 0x1400e8c63
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400e8c63
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1401cd220.0]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400e8c63
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x1401cd220.0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ed8d0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
lea rax, vtable.RampartSessionWorker.0
mov rdx, qword [rcx + 0x38]
mov rbx, rcx
mov qword [rcx], rax
test rdx, rdx
je 0x1400ed922
mov rcx, qword [rcx + 8]
xor r9d, r9d
mov r8d, 0x2710
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
cmp eax, 0x102
jne 0x1400ed918
mov rcx, qword [rbx + 0x38]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [rbx + 0x48]
call fcn.1400edec0
test dil, 1
je 0x1400ed95c
mov edx, 0x78
mov rcx, rbx
call fcn.140359090
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400efe10
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
xor edx, edx
mov cl, 1
xor sil, sil
call fcn.1401d3b80
mov rdi, rax
test rax, rax
je 0x1400efe91
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 8
mov r9d, 0xb
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
lea rdx, str.ReportID
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 1
movzx ebx, sil
test eax, eax
cmove ebx, ecx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
jmp 0x1400efe95
movzx eax, sil
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400efec0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx esi, cl
xor bl, bl
lea rcx, [0x140686cd8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
mov cl, 1
call fcn.1401d3b80
mov rdi, rax
test rax, rax
je 0x1400eff46
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x30], esi
lea rdx, str.InstallReported
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, 1
movzx ebx, bl
test eax, eax
mov rcx, rdi
cmove ebx, edx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x140686cd8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400fb490
Capabilities:
Delete registry value
Set registry value

Disassembly:
push r12
push r13
push r15
sub rsp, 0x40
mov r13, qword [0x140687ec8]
mov r12b, 1
mov r15, qword [0x140687ec0]
cmp r15, r13
je 0x1400fb693
mov rcx, qword [str.0cg_]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r14
lea r14, str.0cg_
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
nop dword [rax + rax]
cmp byte [r15 + 0x70], 0
je 0x1400fb66d
cmp qword [r15 + 0x68], 8
lea rbx, [r15 + 0x50]
jb 0x1400fb4f9
mov rbx, qword [rbx]
mov edi, dword [r15]
cmp edi, 0x8f
je 0x1400fb669
mov rax, qword [0x140687ec0]
xor bpl, bpl
mov rdx, qword [0x140687ec8]
cmp rax, rdx
je 0x1400fb700
cmp dword [rax], edi
je 0x1400fb534
add rax, 0x78
cmp rax, rdx
jne 0x1400fb522
jmp 0x1400fb700
cmp qword [rax + 0x20], 8
lea rsi, [rax + 8]
jb 0x1400fb542
mov rsi, qword [rsi]
cmp qword [rax + 0x68], 8
lea rdx, [rax + 0x50]
jb 0x1400fb550
mov rdx, qword [rdx]
mov rcx, rbx
call fcn.1403681bc
test eax, eax
movzx ebp, bpl
mov eax, 1
cmove ebp, eax
test rsi, rsi
je 0x1400fb6f9
xor edx, edx
movzx ecx, al
call fcn.1401d3b80
mov r14, rax
test rax, rax
je 0x1400fb6a2
test bpl, bpl
je 0x1400fb5da
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
cmp eax, 2
mov eax, 0
cmove ebx, eax
mov rcx, qword [str.0cg_]
lea rbp, str.0cg_
cmp rcx, rbp
je 0x1400fb614
test byte [rcx + 0x1c], 1
je 0x1400fb614
cmp byte [rcx + 0x19], 2
jb 0x1400fb614
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0xe]
mov r9d, edi
lea r8, [0x1405f8a90]
call fcn.140082b10
jmp 0x1400fb614
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400fb5e1
add eax, eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
lea rbp, str.0cg_
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1400fb65b
mov rcx, qword [str.0cg_]
cmp rcx, rbp
je 0x1400fb6ed
test byte [rcx + 0x1c], 1
je 0x1400fb6b0
cmp byte [rcx + 0x19], 2
jb 0x1400fb6b0
mov rcx, qword [rcx + 0x10]
lea r8, [0x1405f8a90]
mov edx, 0xf
mov dword [rsp + 0x20], ebx
mov r9, rsi
call fcn.140079f00
jmp 0x1400fb6a9
mov rcx, qword [str.0cg_]
lea r14, str.0cg_
and r12b, 1
add r15, 0x78
cmp r15, r13
jne 0x1400fb4e0
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
movzx eax, r12b
add rsp, 0x40
pop r15
pop r13
pop r12
ret
lea rbp, str.0cg_
mov rcx, qword [str.0cg_]
cmp rcx, rbp
je 0x1400fb6ed
test byte [rcx + 0x1c], 1
je 0x1400fb6ed
cmp byte [rcx + 0x19], 2
jb 0x1400fb6ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.0cg_]
lea r8, [0x1405f8a90]
mov edx, 0x10
mov r9d, eax
mov rcx, qword [rcx + 0x10]
call fcn.140082b10
mov rcx, qword [str.0cg_]
lea r14, str.0cg_
jmp 0x1400fb66d
mov rcx, qword [str.0cg_]
cmp rcx, r14
je 0x1400fb66d
test byte [rcx + 0x1c], 1
je 0x1400fb66d
cmp byte [rcx + 0x19], 2
jb 0x1400fb66d
mov rcx, qword [rcx + 0x10]
lea r8, [0x1405f8a90]
mov edx, 0xd
mov r9d, edi
call fcn.140082b10
mov rcx, qword [str.0cg_]
jmp 0x1400fb66d
Function at 0x1400fcfd0
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, cl
movabs r10, 0x100000001b3
mov r9d, ecx
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov eax, ecx
imul r8, r10
sar eax, 8
movzx edx, al
mov eax, ecx
xor r8, rdx
sar eax, 0x10
mov rdx, qword [0x140687f48]
imul r8, r10
movzx ecx, al
mov eax, r9d
xor r8, rcx
sar eax, 0x18
imul r8, r10
movzx ecx, al
xor r8, rcx
mov rcx, qword [0x140687f70]
imul r8, r10
and rcx, r8
shl rcx, 4
add rcx, qword [0x140687f58]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1400fd064
mov rcx, qword [rcx]
cmp r9d, dword [rax + 0x10]
je 0x1400fd05f
nop
cmp rax, rcx
je 0x1400fd064
mov rax, qword [rax + 8]
cmp r9d, dword [rax + 0x10]
jne 0x1400fd050
test rax, rax
jne 0x1400fd067
mov rax, rdx
cmp rax, rdx
setne al
ret
Function at 0x1400fd070
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbp, rdx
mov ebx, ecx
cmp ecx, 0x8f
je 0x1400fd270
mov rax, qword [0x140687ec0]
xor sil, sil
mov rcx, qword [0x140687ec8]
cmp rax, rcx
je 0x1400fd0c2
cmp dword [rax], ebx
je 0x1400fd100
add rax, 0x78
cmp rax, rcx
jne 0x1400fd0b5
mov rcx, qword [str.0cg_]
lea rsi, str.0cg_
cmp rcx, rsi
je 0x1400fd0f9
test byte [rcx + 0x1c], 1
je 0x1400fd0f9
cmp byte [rcx + 0x19], 2
jb 0x1400fd0f9
mov rcx, qword [rcx + 0x10]
lea r8, [0x1405f8a90]
mov edx, 0xd
mov r9d, ebx
call fcn.140082b10
xor al, al
jmp 0x1400fd272
cmp qword [rax + 0x20], 8
lea rdi, [rax + 8]
jb 0x1400fd10e
mov rdi, qword [rdi]
cmp qword [rax + 0x68], 8
lea rdx, [rax + 0x50]
jb 0x1400fd11c
mov rdx, qword [rdx]
mov rcx, rbp
call fcn.1403681bc
test eax, eax
movzx r14d, sil
mov r12d, 1
cmove r14d, r12d
test rdi, rdi
je 0x1400fd0c2
xor edx, edx
movzx ecx, r12b
call fcn.1401d3b80
lea rsi, str.0cg_
mov r15, rax
test rax, rax
je 0x1400fd223
test r14b, r14b
je 0x1400fd1a2
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebp, eax
xor eax, eax
cmp ebp, 2
cmove ebp, eax
mov rcx, qword [str.0cg_]
cmp rcx, rsi
je 0x1400fd1da
test byte [rcx + 0x1c], r12b
je 0x1400fd1da
cmp byte [rcx + 0x19], 2
jb 0x1400fd1da
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0xe]
mov r9d, ebx
lea r8, [0x1405f8a90]
call fcn.140082b10
jmp 0x1400fd1da
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbp + rax*2], 0
jne 0x1400fd1b0
add eax, eax
mov r9d, r12d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbp
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebp, eax
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x1400fd270
mov rcx, qword [str.0cg_]
cmp rcx, rsi
je 0x1400fd0f9
test byte [rcx + 0x1c], r12b
je 0x1400fd22a
cmp byte [rcx + 0x19], 2
jb 0x1400fd22a
mov rcx, qword [rcx + 0x10]
lea r8, [0x1405f8a90]
mov edx, 0xf
mov dword [rsp + 0x20], ebp
mov r9, rdi
call fcn.140079f00
mov rcx, qword [str.0cg_]
cmp rcx, rsi
je 0x1400fd0f9
test byte [rcx + 0x1c], r12b
je 0x1400fd0f9
cmp byte [rcx + 0x19], 2
jb 0x1400fd0f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.0cg_]
lea r8, [0x1405f8a90]
mov edx, 0x10
mov r9d, eax
mov rcx, qword [rcx + 0x10]
call fcn.140082b10
xor al, al
jmp 0x1400fd272
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x140100ab0
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
mov rdx, qword [0x140686db8]
test rdx, rdx
je 0x140100b04
mov rcx, qword [0x140686db0]
xor r9d, r9d
mov r8d, 0x2710
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
cmp eax, 0x102
jne 0x140100aec
mov rcx, qword [0x140686db8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x140686db8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140686db8], 0
mov rcx, qword [0x140686db0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140686dc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140686d88]
mov qword [0x140686db0], 0
mov qword [0x140686dc0], 0
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]

Function at 0x140100b50
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x140100bb0]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [0x140686db8], rax
setne al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140359070
add rsp, 0x48
ret
Function at 0x1401099b0
Capabilities:
Get token membership

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x68], 0
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x68]
xor eax, eax
mov word [rsp + 0x6c], 0x500
mov dword [rsp + 0x48], eax
mov r9d, 0x220
mov dword [rsp + 0x40], eax
mov dl, 2
mov dword [rsp + 0x38], eax
xor bl, bl
mov dword [rsp + 0x30], eax
lea r8d, [rax + 0x20]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140109a41
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x140109a36
cmp dword [rsp + 0x70], 1
sete bl
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
movzx eax, bl
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140359070
add rsp, 0x80
pop rbx
ret
Function at 0x140109a60
Capabilities:
Enumerate services

Disassembly:
push rbx
push r14
sub rsp, 0x68
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rdx
mov rbx, rcx
test rcx, rcx
je 0x140109c06
test rdx, rdx
je 0x140109c06
mov qword [rsp + 0x90], rsi
xor ecx, ecx
mov qword [rsp + 0x58], r12
xor r12d, r12d
mov dword [rdx], r12d
mov esi, r12d
lea rdx, str.ServicesActive
mov qword [rsp + 0x50], r15
lea r8d, [r12 + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r15, rax
test rax, rax
je 0x140109bf0
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea edx, [r12 + 0x30]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8d, [r12 + 3]
mov rcx, r15
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
jne 0x140109be7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140109be7
mov ecx, dword [rsp + 0x40]
mov qword [rsp + 0x80], rbp
call fcn.140368330
mov rbp, rax
test rax, rax
je 0x140109bdf
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea edx, [r12 + 0x30]
lea rax, [rsp + 0x40]
mov r9, rbp
mov qword [rsp + 0x28], rax
lea r8d, [r12 + 3]
mov eax, dword [rsp + 0x40]
mov rcx, r15
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
je 0x140109bd7
mov qword [rsp + 0x60], rdi
mov edi, r12d
cmp dword [rsp + 0x44], r12d
jbe 0x140109bd2
nop
mov eax, edi
mov rdx, 0xffffffffffffffff
lea rcx, [rax + rax*2]
add rcx, rcx
mov rcx, qword [rbp + rcx*8]
inc rdx
cmp word [rcx + rdx*2], r12w
jne 0x140109b95
call fcn.1401d5cd0
mov ecx, eax
mov rax, r12
nop dword [rax]
cmp dword [rbx + rax*4], ecx
je 0x140109bc0
inc rax
cmp rax, 1
jl 0x140109bb0
jmp 0x140109bca
mov dword [r14 + rax*4], 1
inc esi
inc edi
cmp edi, dword [rsp + 0x44]
jb 0x140109b80
mov rdi, qword [rsp + 0x60]
mov rcx, rbp
call fcn.1403683a0
mov rbp, qword [rsp + 0x80]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r15, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x90]
mov r12, qword [rsp + 0x58]
jmp 0x140109c08
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140359070
add rsp, 0x68
pop r14
pop rbx
ret
Function at 0x140109c20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str._volatile_
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
cmove rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x140109cba
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 4
mov qword [rsp + 0x28], rax
lea rdx, str.RebootRequired
lea rax, [rsp + 0x3c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140109cb1
mov eax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140359070
add rsp, 0x50
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140359070
add rsp, 0x50
pop rbx
ret
Function at 0x14010d0e0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x158
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r14, rdx
mov r15, rcx
lea rdx, [rsp + 0x40]
mov ebp, r9d
lea rcx, [0x1406876b0]
mov rsi, r8
xor bl, bl
call fcn.1401f6180
lea eax, [rbp + 0x10]
mov ecx, eax
mov dword [rsp + 0x30], eax
call fcn.140368330
mov rdi, rax
test rax, rax
je 0x14010d1fc
lea rax, [rsp + 0x40]
mov r8, rdi
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, ebp
mov rcx, rsi
call fcn.1401eeac0
test al, al
je 0x14010d1fc
mov ebp, dword [rsp + 0x30]
mov rdx, rdi
mov r8d, ebp
mov rcx, rsi
call fcn.14035bc80
cmp rsi, qword [r14 + 0x10]
je 0x14010d191
mov rcx, qword [r15 + 8]
mov r9d, ebp
mov r8, rsi
mov rdx, r14
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1401cd220.0]
mov rcx, qword [r14]
lea rax, [r14 + 0x20]
lea r9, [r14 + 0x40]
mov qword [rsp + 0x20], rax
mov r8d, ebp
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
je 0x14010d1c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
cmp eax, 0x3e5
jne 0x14010d1c6
mov bl, 1
jmp 0x14010d235
mov rcx, qword [str.0cg_]
lea rax, str.0cg_
cmp rcx, rax
je 0x14010d235
test byte [rcx + 0x1c], 1
je 0x14010d235
cmp byte [rcx + 0x19], 2
jb 0x14010d235
mov rcx, qword [rcx + 0x10]
lea r8, [0x1405f97c8]
mov edx, 0x21
call fcn.140082b10
jmp 0x14010d235
mov rcx, qword [str.0cg_]
lea rax, str.0cg_
cmp rcx, rax
je 0x14010d230
test byte [rcx + 0x1c], 1
je 0x14010d230
cmp byte [rcx + 0x19], 4
jb 0x14010d230
mov rcx, qword [rcx + 0x10]
lea r8, [0x1405f97c8]
mov edx, 0x20
call fcn.14007d150
test rdi, rdi
je 0x14010d23d
mov rcx, rdi
call fcn.1403683a0
movzx eax, bl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140359070
add rsp, 0x158
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140115ee0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rdx, str._Service__Stopping...
mov ecx, 1
call fcn.140109e80
lea rdi, str.0cg_
mov rcx, qword [str.0cg_]
cmp rcx, rdi
je 0x140115f43
test byte [rcx + 0x1c], 1
je 0x140115f43
cmp byte [rcx + 0x19], 2
jb 0x140115f43
mov edx, 0x11
lea r8, [0x1405fa6c0]
mov rcx, qword [rcx + 0x10]
call fcn.14007d150
call fcn.1401d3a20
mov rbx, rax
test rax, rax
je 0x140115f59
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor esi, esi
cmp qword [0x140686de8], rsi
je 0x140115f8c
call fcn.14010b530
mov rcx, qword [0x140686de8]
test rcx, rcx
je 0x140115f85
mov rax, qword [rcx]
lea edx, [rsi + 1]
mov rax, qword [rax + 0x50]
call qword [case.0x1401cd220.0]
mov qword [0x140686de8], rsi
mov rcx, qword [str.0cg_]
cmp rcx, rdi
je 0x140115fb9
test byte [rcx + 0x1c], 1
je 0x140115fb9
cmp byte [rcx + 0x19], 2
jb 0x140115fb9
mov edx, 0x12
lea r8, [0x1405fa6c0]
mov rcx, qword [rcx + 0x10]
call fcn.14007d150
xor edx, edx
mov cl, 1
call fcn.1401d3b80
mov rdi, rax
test rax, rax
je 0x140115fe3
lea rdx, str.RunningVersion
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [0x140689ba0]
test rcx, rcx
je 0x140115ffb
lea rdx, [0x140687f90]
call fcn.1401fcd60
call fcn.1400ef710
call fcn.14008a0e0
mov dword [rsp + 0x20], 0x8e
lea rcx, [0x140687f00]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x20]
call fcn.1400ff6d0
lea rcx, [0x140687f00]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.140079f80
call fcn.1400953c0
call fcn.1400b8290
mov dword [rsp + 0x20], 0x80
lea rcx, [0x140687f00]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x20]
call fcn.1400ff6d0
lea rcx, [0x140687f00]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.14007d660
call fcn.1400e8b70
call fcn.1400faa30
call fcn.1400ef520
call fcn.14006b7d0
call fcn.1400f7420
call fcn.140100ab0
call fcn.1400d7030
mov eax, 1
lock cmpxchg dword [0x1406877b8], esi
call fcn.14008d050
cmp byte [0x140686a5c], sil
je 0x1401160da
mov byte [0x140686a5c], sil
mov rcx, qword [0x140686b48]
test rcx, rcx
je 0x1401160d3
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x1401cd220.0]
mov qword [0x140686b48], rsi
call fcn.1400913e0
call fcn.1400ee1f0
cmp byte [0x1406869ee], sil
je 0x1401160f9
call fcn.140089ee0
mov byte [0x1406869ee], sil
call fcn.1400893a0
call fcn.140081c20
call fcn.14009b350
lea rdx, str._Service__Stopped
mov ecx, 1
call fcn.140109e80
call fcn.1400cbf60
call fcn.140082b80
test rbx, rbx
je 0x140116131
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret