joyce8/EMBER2024-capa huggingface dataset:
Function at 0x525380
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5254ce
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x00819440]
call fcn.004ebd40
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x005254e0]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00403d00
xorps xmm15, xmm15
mov r14, qword [0x00883940]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x525492
mov rdx, qword [rsp + 0x28]
nop dword [rax + rax]
cmp rdx, rcx
jb 0x5254c8
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x5254bd
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x38]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call fcn.00466700
call fcn.00466680
nop
call fcn.00464380
jmp fcn.00525380
Function at 0x53fc20
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x53fe69
push rbp
mov rbp, rsp
sub rsp, 0xa8
nop word [rax + rax]
test rax, rax
je 0x53fe54
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x53fc62
xor ebx, ebx
xor ecx, ecx
nop
jmp 0x53fc7c
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call fcn.00532140
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x53fd91
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop dword [rax + rax]
call fcn.00470340
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x006ce7b8]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044f2c0
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403d00
xorps xmm15, xmm15
mov r14, qword [0x00883940]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x53fd5b
xor eax, eax
lea rbx, [0x006ce8e0]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x00643cea]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044f380
jmp 0x53fd88
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x006ce7a0]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044f2c0
add rsp, 0xa8
pop rbp
ret
mov rax, qword [rax + 0x18]
call fcn.00470340
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00403d00
xorps xmm15, xmm15
mov r14, qword [0x00883940]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x53fe1e
xor eax, eax
lea rbx, [0x006ce8e0]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00643cea]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044f380
jmp 0x53fe4b
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x006ce7a0]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044f2c0
add rsp, 0xa8
pop rbp
ret
lea rax, [0x00644232]
mov ebx, 5
add rsp, 0xa8
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.00464380
mov rax, qword [rsp + 8]
jmp fcn.0053fc20
Function at 0x55c980
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
je 0x55c9a2
cmp rbx, 9
jg 0x55c9a2
xor ecx, ecx
mov edx, 0x9acb0442
nop
jmp 0x55c9b9
xor eax, eax
add rsp, 0x10
pop rbp
ret
movzx esi, byte [rax + rcx]
xor edx, esi
inc rcx
imul edx, edx, 0x1000193
cmp rbx, rcx
jg 0x55c9aa
mov esi, edx
and edx, 7
lea rdi, [0x007eb0a0]
mov r8d, dword [rdi + rdx*4]
movzx r9d, r8b
cmp rbx, r9
jne 0x55ca16
mov r10d, r8d
shr r8d, 8
lea ecx, [r9 + r8]
cmp rcx, 0x2a
ja 0x55cae5
cmp r8, rcx
ja 0x55cadb
sub rcx, r8
mov r9, rcx
neg r9
sar r9, 0x3f
and r8, r9
lea r9, [0x00653ce2]
add r8, r9
xor edx, edx
jmp 0x55caaa
shr esi, 0x10
and esi, 7
mov esi, dword [rdi + rsi*4]
movzx edi, sil
cmp rbx, rdi
jne 0x55ca5a
mov r8d, esi
shr esi, 8
lea ecx, [rsi + rdi]
cmp rcx, 0x2a
ja 0x55ca9d
cmp rsi, rcx
ja 0x55ca96
sub rcx, rsi
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and rsi, rdx
lea rdx, [0x00653ce2]
add rdx, rsi
xor esi, esi
jmp 0x55ca65
xor eax, eax
add rsp, 0x10
pop rbp
ret
inc rsi
cmp rbx, rsi
jle 0x55ca85
cmp rsi, rcx
jae 0x55ca8e
movzx edi, byte [rsi + rdx]
movzx r9d, byte [rsi + rax]
cmp r9b, dil
je 0x55ca62
xor eax, eax
add rsp, 0x10
pop rbp
ret
mov eax, r8d
add rsp, 0x10
pop rbp
ret
mov rax, rsi
call fcn.00466640
mov eax, esi
call fcn.00466700
mov edx, 0x2a
call fcn.00466680
inc rdx
cmp rbx, rdx
jle 0x55caca
cmp rdx, rcx
jae 0x55cad3
movzx r9d, byte [rdx + r8]
movzx r11d, byte [rax + rdx]
nop
cmp r11b, r9b
je 0x55caa7
jmp 0x55ca16
mov eax, r10d
add rsp, 0x10
pop rbp
ret
mov rax, rdx
call fcn.00466640
mov eax, r8d
nop
call fcn.00466700
mov edx, 0x2a
call fcn.00466680
nop
int3
Function at 0x575ec0
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
je 0x575ee2
cmp rbx, 9
jg 0x575ee2
xor ecx, ecx
mov edx, 0x9acb0442
nop
jmp 0x575ef9
xor eax, eax
add rsp, 0x10
pop rbp
ret
movzx esi, byte [rax + rcx]
xor edx, esi
inc rcx
imul edx, edx, 0x1000193
cmp rbx, rcx
jg 0x575eea
mov esi, edx
and edx, 0xf
lea rdi, [0x007ebf40]
mov r8d, dword [rdi + rdx*4]
movzx r9d, r8b
cmp rbx, r9
jne 0x575f56
mov r10d, r8d
shr r8d, 8
lea ecx, [r9 + r8]
cmp rcx, 0x2b
ja 0x576025
cmp r8, rcx
ja 0x57601b
sub rcx, r8
mov r9, rcx
neg r9
sar r9, 0x3f
and r8, r9
lea r9, [0x00654010]
add r8, r9
xor edx, edx
jmp 0x575fea
shr esi, 0x10
and esi, 0xf
mov esi, dword [rdi + rsi*4]
movzx edi, sil
cmp rbx, rdi
jne 0x575f9a
mov r8d, esi
shr esi, 8
lea ecx, [rsi + rdi]
cmp rcx, 0x2b
ja 0x575fdd
cmp rsi, rcx
ja 0x575fd6
sub rcx, rsi
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and rsi, rdx
lea rdx, [0x00654010]
add rdx, rsi
xor esi, esi
jmp 0x575fa5
xor eax, eax
add rsp, 0x10
pop rbp
ret
inc rsi
cmp rbx, rsi
jle 0x575fc5
cmp rsi, rcx
jae 0x575fce
movzx edi, byte [rsi + rdx]
movzx r9d, byte [rsi + rax]
cmp r9b, dil
je 0x575fa2
xor eax, eax
add rsp, 0x10
pop rbp
ret
mov eax, r8d
add rsp, 0x10
pop rbp
ret
mov rax, rsi
call fcn.00466640
mov eax, esi
call fcn.00466700
mov edx, 0x2b
call fcn.00466680
inc rdx
cmp rbx, rdx
jle 0x57600a
cmp rdx, rcx
jae 0x576013
movzx r9d, byte [rdx + r8]
movzx r11d, byte [rax + rdx]
nop
cmp r11b, r9b
je 0x575fe7
jmp 0x575f56
mov eax, r10d
add rsp, 0x10
pop rbp
ret
mov rax, rdx
call fcn.00466640
mov eax, r8d
nop
call fcn.00466700
mov edx, 0x2b
call fcn.00466680
nop
int3
Function at 0x5b9420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5b963f
push rbp
mov rbp, rsp
sub rsp, 0x28
lea rax, [0x00610000]
mov ebx, 0xe
xor ecx, ecx
call fcn.0040e140
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x1f], 0x3d
mov rbx, rax
lea rcx, [rsp + 0x1f]
lea rax, [0x00610000]
nop
call fcn.0040eb80
mov word [rax], 0x601
mov byte [rsp + 0x1f], 0x21
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x604
mov byte [rsp + 0x1f], 0x3c
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x607
mov byte [rsp + 0x1f], 0x3e
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x60b
mov byte [rsp + 0x1f], 0x2b
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x611
mov byte [rsp + 0x1f], 0x2d
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x614
mov byte [rsp + 0x1f], 0x2a
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x617
mov byte [rsp + 0x1f], 0x2f
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x61b
mov byte [rsp + 0x1f], 0x25
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x61d
mov byte [rsp + 0x1f], 0x26
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x61f
mov byte [rsp + 0x1f], 0x7c
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x620
mov byte [rsp + 0x1f], 0x5e
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x621
mov byte [rsp + 0x1f], 0x7e
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x622
mov byte [rsp + 0x1f], 0x3f
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x20a
cmp dword [0x008839e0], 0
jne 0x5b961a
mov rax, qword [rsp + 0x20]
jmp 0x5b9632
call fcn.004662a0
mov rax, qword [rsp + 0x20]
mov qword [r11], rax
mov rcx, qword [0x0082ee10]
mov qword [r11 + 8], rcx
mov qword [0x0082ee10], rax
add rsp, 0x28
pop rbp
ret
nop
call fcn.00464380
jmp fcn.005b9420
Function at 0x5b9660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5b983f
push rbp
mov rbp, rsp
sub rsp, 0x28
lea rax, [0x00610000]
mov ebx, 0xc
xor ecx, ecx
call fcn.0040e140
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x1f], 0x3d
mov rbx, rax
lea rcx, [rsp + 0x1f]
lea rax, [0x00610000]
nop
call fcn.0040eb80
mov word [rax], 0x602
mov byte [rsp + 0x1f], 0x21
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x605
mov byte [rsp + 0x1f], 0x3c
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x608
mov byte [rsp + 0x1f], 0x3e
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x60c
mov byte [rsp + 0x1f], 0x2b
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x612
mov byte [rsp + 0x1f], 0x2d
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x615
mov byte [rsp + 0x1f], 0x2a
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x618
mov byte [rsp + 0x1f], 0x2f
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x61c
mov byte [rsp + 0x1f], 0x25
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x61e
mov byte [rsp + 0x1f], 0x26
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x623
mov byte [rsp + 0x1f], 0x7c
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x624
mov byte [rsp + 0x1f], 0x5e
lea rax, [0x00610000]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x625
cmp dword [0x008839e0], 0
jne 0x5b981a
mov rax, qword [rsp + 0x20]
jmp 0x5b9832
call fcn.004662a0
mov rax, qword [rsp + 0x20]
mov qword [r11], rax
mov rcx, qword [0x0082ee18]
mov qword [r11 + 8], rcx
mov qword [0x0082ee18], rax
add rsp, 0x28
pop rbp
ret
nop
call fcn.00464380
jmp fcn.005b9660
Function at 0x140022940
Capabilities:
Create service

Disassembly:
push rbx
push rbp
push rsi
push r12
push r14
push r15
sub rsp, 0x298
mov rax, qword [0x14008d028]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r15, qword [rsp + 0x2f0]
mov ebp, r8d
mov r12, qword [rsp + 0x2f8]
mov rbx, rdx
mov rsi, rcx
lea rdx, [rsp + 0x70]
mov r8d, 0x104
xor ecx, ecx
mov r14, r9
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
jne 0x1400229af
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.GetModuleFileName_failed_w_err_0x_08lx_n
call fcn.140022c50
jmp 0x140022a80
xor edx, edx
mov qword [rsp + 0x290], rdi
xor ecx, ecx
lea r8d, [rdx + 3]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x1400229e6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.140022c50
jmp 0x140022a78
mov qword [rsp + 0x60], r12
xor eax, eax
mov qword [rsp + 0x58], r15
mov r9d, 4
mov qword [rsp + 0x50], r14
mov r8, rbx
mov qword [rsp + 0x48], rax
mov rdx, rsi
mov qword [rsp + 0x40], rax
mov rcx, rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CreateServiceW]
mov rbx, rax
test rax, rax
jne 0x140022a52
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateService_failed_w_err_0x_08lx_n
call fcn.140022c50
jmp 0x140022a61
mov rdx, rsi
lea rcx, str._s_is_installed._n
call fcn.140022c50
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
test rbx, rbx
je 0x140022a78
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140024d20
add rsp, 0x298
pop r15
pop r14
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x140022ab0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14008d028]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov rdi, rcx
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
lea r8d, [rax + 1]
mov dword [rsp + 0x38], eax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x140022b10
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.140022c50
jmp 0x140022c2f
mov r8d, 0x10024
mov qword [rsp + 0x68], rbx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x140022b48
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService_failed_w_err_0x_08lx_n
call fcn.140022c50
jmp 0x140022c13
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
test eax, eax
je 0x140022be1
mov rdx, rdi
lea rcx, str.Stopping__s.
call fcn.140022c50
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
test eax, eax
je 0x140022bc2
nop
mov eax, dword [rsp + 0x24]
cmp eax, 3
jne 0x140022bc6
lea rcx, [0x14006fe84]
call fcn.140022c50
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
test eax, eax
jne 0x140022b90
mov eax, dword [rsp + 0x24]
lea rcx, [0x14006fe88]
mov rdx, rdi
cmp eax, 1
je 0x140022bdc
lea rcx, str._n_s_failed_to_stop._n
call fcn.140022c50
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_DeleteService]
test eax, eax
jne 0x140022c04
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.DeleteService_failed_w_err_0x_08lx_n
call fcn.140022c50
jmp 0x140022c13
mov rdx, rdi
lea rcx, str._s_is_removed._n
call fcn.140022c50
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
test rbx, rbx
je 0x140022c2a
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140024d20
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140026be0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
test eax, eax
je 0x140026bf3
add rsp, 0x48
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.140027200
lea rdx, [0x14008a228]
lea rcx, [rsp + 0x20]
call fcn.1400423a0
int3
Function at 0x140032960
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x14008fe90]
xor edx, edx
jmp fcn.140026be0

Function at 0x1400332f8
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x14008fe90]
jmp fcn.140026be0

Function at 0x14003ef48
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14003f004]
mov r9, qword [r9 + 8]
jmp fcn.14002ee34

Function at 0x14003efdc
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14003f014]
mov r9, qword [r9 + 8]
jmp fcn.14002ee34
Function at 0x140013e14
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140013e27
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.140014428
lea rdx, [0x14007c6a0]
lea rcx, [rsp + 0x20]
call fcn.1400300a4
int3

Function at 0x14001fb08
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x14008f4e8]
xor edx, edx
jmp fcn.140013e14

Function at 0x1400204ac
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x14008f4e8]
jmp fcn.140013e14

Function at 0x14002bd78
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14002be34]
mov r9, qword [r9 + 8]
jmp fcn.14001c078

Function at 0x14002be0c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14002be44]
mov r9, qword [r9 + 8]
jmp fcn.14001c078

Function at 0x1400396c8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400394f4
Function at 0x14000f880
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x14000f903
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
add rax, 1
cmp rax, 2
jb 0x14000f8ce
call fcn.140014640
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsi]
mov rdx, rsi
mov r9, rax
call fcn.1400146c0
mov rcx, qword [rsi]
call fcn.140014650
mov qword [rsi], 0
lea rax, [rdi + 1]
cmp rax, 2
jb case.default.0x14000f8fc
mov qword [rsi], rdi
call fcn.140014640
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
mov r9, rax
call fcn.140014680
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov ecx, 0x949db5ff
imul eax, dword ss:[rax], 0x43b1d49b
nop
sbb eax, 0x61e8fa61
hlt
leave
xor eax, 0x3b6531c0
xchg ecx, eax
xchg edx, eax
enter 0xffffffffffffd373, 0x4a
xor byte [rdi], dl
sub dword [rcx - 0x8010103], ebx
std
invalid
invalid
test dword [rcx + 0x14], 0xb7458bde
invalid
std
invalid
jl 0x1400c3e51
clc
rcr dword [rdi], 1
invalid

Function at 0x140010e90
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x230
mov r14, rcx
mov rax, qword [0x140065020]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov word [rdi], 0
xor ebx, ebx
lea r15, str.PROGRAMFILES
mov rsi, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx + r15]
mov word [rsp + 0x20], 0
mov r8d, 0x104
mov rdx, rdi
call rsi
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140010eff
mov edx, eax
mov rcx, rdi
mov r8, r14
call fcn.140010e20
test al, al
jne 0x140010f0d
add rbx, 8
cmp rbx, 0x18
jne 0x140010ecd
xor esi, esi
jmp 0x140010f10
mov sil, 1
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.14002a340
mov eax, esi
add rsp, 0x230
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140002160
Capabilities:
Set console window title

Disassembly:
push rbx
sub rsp, 0x80
mov rbx, qword [0x14005e248]
movabs rax, 0x1f97ae60909df663
mov qword [rsp + 0x50], rax
movabs rax, 0x357cf255b75d3e90
mov qword [rsp + 0x58], rax
movabs rax, 0x3ff2c30ff3f19334
mov qword [rsp + 0x40], rax
movabs rax, 0x357cf255b77d51e4
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400021d0
movabs rax, 0x7fffffffffffffff
mov rdx, qword [0x14007ca40]
sub rax, rdx
cmp rax, rcx
jb 0x140002301
lea rax, [0x14007ca30]
cmp qword [0x14007ca48], 0x10
cmovae rax, qword [0x14007ca30]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.1400076e0
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
mov rcx, rbx
call fcn.140007800
lea rdx, [0x140006700]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14000229b
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002296
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002296
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005a350
lea rcx, [rsp + 0x60]
call fcn.140004c10
cmp qword [rax + 0x18], 0x10
jb 0x1400022af
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400022f8
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400022f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400022f3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005a350
add rsp, 0x80
pop rbx
ret
call fcn.140001c00
int3