joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140017170
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, rdx
mov qword [rsp + 0x68], rdx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], rbx
mov qword [rdx + 0x18], 7
mov word [rdx], bx
mov dword [rsp + 0x20], 1
nop word [rax + rax]
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.14030b3a0
mov ecx, ebx
test ebx, ebx
je 0x14001720e
sub ecx, 1
je 0x1400171f4
cmp ecx, 1
jne 0x140017222
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x14001721e
mov r8d, 0x104
lea rdx, [rsp + 0x70]
lea rcx, str.TEMP
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x14001721e
lea rdx, [rsp + 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x14001722e
inc ebx
cmp ebx, 3
jl 0x1400171c0
jmp 0x1400172bd
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.140031e00
nop
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.14002eb40
nop
lea rcx, [rsp + 0x28]
call fcn.1400166f0
cmp ebx, 2
jne 0x1400172bd
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
lea r8d, [rbx + 2]
lea rdx, str.Temp
lea rcx, [rsp + 0x48]
call fcn.140031e00
nop
lea r8, [rsp + 0x48]
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.1400a2f80
lea rcx, [rsp + 0x28]
call fcn.1400166f0
nop
lea rcx, [rsp + 0x48]
call fcn.1400166f0
mov rax, rdi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1402ba9b0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x290
pop rdi
ret

Function at 0x140017520
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
cmp qword [rcx + 0x30], rsi
jbe 0x140017565
add rcx, 0x20
cmp qword [rbx + 0x38], 7
jbe 0x140017549
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [rbx + 0x38], 7
lea rax, [rbx + 0x20]
jbe 0x14001755e
mov rax, qword [rbx + 0x20]
mov qword [rbx + 0x30], rsi
mov word [rax], si
cmp qword [rbx + 0x10], rsi
lea rdi, [rbx + 0x10]
jbe 0x140017592
cmp qword [rbx + 0x18], 7
mov rcx, rbx
jbe 0x14001757c
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp qword [rbx + 0x18], 7
jbe 0x14001758c
mov rbx, qword [rbx]
mov qword [rdi], rsi
mov word [rbx], si
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400175b0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rbx, rcx
call fcn.140017520
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rax
lea rcx, [rbp - 0x20]
call fcn.140139480
nop
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x20]
call fcn.1401395e0
nop
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140139a60
nop
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1400a3da0
nop
lea rcx, [rsp + 0x60]
call fcn.140016400
nop
lea rcx, [rsp + 0x50]
call fcn.140107a50
lea rdx, [rbp - 0x60]
call fcn.140017170
nop
cmp qword [rbp - 0x50], 0
je 0x140017730
cmp qword [rbp - 0x30], 0
je 0x140017730
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x80]
call fcn.1400a2f80
nop
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140017700
call fcn.14001e910
mov rdi, rax
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rcx
lea rax, str.Could_not_create_directory__s__u
mov qword [rsp + 0x30], rax
lea rcx, str.Sledgehammer
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 1
mov r9d, 0x63
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcPackagesSledgehammer.5.1.0.94_build_nativeincludeTemporaryResourceFile.inl
lea rdx, [0x14041a6b8]
mov rcx, rdi
call rbx
xor bl, bl
jmp 0x140017725
lea rax, [rbp - 0x80]
cmp rbx, rax
je 0x140017723
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x70]
mov rcx, rbx
call fcn.140031b60
mov bl, 1
lea rcx, [rbp - 0x80]
call fcn.1400166f0
jmp 0x14001779e
call fcn.14001e910
mov rcx, qword [rax]
mov r10, qword [rcx + 0x20]
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova rcx, qword [rbp - 0x40]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
lea rcx, str.Invalid_argument__s__s
mov qword [rsp + 0x30], rcx
lea rcx, str.Sledgehammer
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 1
mov r9d, 0x5c
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcPackagesSledgehammer.5.1.0.94_build_nativeincludeTemporaryResourceFile.inl
lea rdx, [0x14041a6b8]
mov rcx, rax
call r10
xor bl, bl
lea rcx, [rbp - 0x60]
call fcn.1400166f0
nop
lea rcx, [rbp - 0x40]
call fcn.1400166f0
nop
lea rcx, [rbp - 0x20]
call fcn.1401394c0
movzx eax, bl
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1402ba9b0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140019b50
Capabilities:
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
lea r12, vtable.mb::common::system::ScopedAny_wchar_t____ptr64__void____cdecl___void____ptr64___void___cdecl_CoTaskMemFree_void____ptr64___0__0__4_.0
mov qword [rbp - 0x21], r12
xor r15d, r15d
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x19], r15
lea r9, [rbp - 0x19]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov r14d, eax
test eax, eax
js 0x140019c05
mov rdx, qword [rbp - 0x19]
test rdx, rdx
je 0x140019c05
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x140019bd3
lea rcx, [rbp - 1]
call fcn.140031e00
nop
lea rdx, [rbp - 1]
mov rcx, rsi
call fcn.14002eb40
nop
lea rcx, [rbp - 1]
call fcn.1400166f0
mov bl, 1
jmp 0x140019d06
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf], xmm1
movdqa xmm0, xmmword [0x140445990]
movdqu xmmword [rbp + 0xf], xmm0
mov word [rbp - 1], r15w
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
lea rsi, vtable.mb::common::system::ScopedAny_unsigned_short_int____ptr64__void____cdecl___unsigned_short_int____ptr64___void___cdecl_mb::common::system::Internal::RpcStringFreeHelperW_unsigned_short_int____ptr64___0__0__2_.0
mov qword [rbp - 0x11], rsi
mov qword [rbp - 9], r15
mov qword [rbp - 9], r15
lea rdx, [rbp - 9]
mov rcx, rdi
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
js 0x140019c75
mov rdx, qword [rbp - 9]
test rdx, rdx
je 0x140019c75
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x140019c61
lea rcx, [rbp - 1]
call fcn.140031b60
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140019cdc
mov rax, qword [rcx]
mov r10, qword [rax + 0x20]
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 7
cmova rdx, qword [rbp - 1]
lea rax, [rbx + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140019ca1
mov rax, qword [rax]
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x38], rdx
lea rdx, str.Failed_to_get_known_folder_path__ls._0x_08X
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, reloc.WS2_32.dll_WSACleanup
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcmbupdatrDUMaintenance.cpp
lea rdx, str.DUMaintenance::GetKnownFolderPath
call r10
nop
mov qword [rbp - 0x11], rsi
mov rax, qword [rbp - 9]
test rax, rax
je 0x140019cf7
mov qword [rbp - 0x29], rax
lea rcx, [rbp - 0x29]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov qword [rbp - 9], r15
lea rcx, [rbp - 1]
call fcn.1400166f0
xor bl, bl
mov qword [rbp - 0x21], r12
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140019d19
call qword [sym.imp.ole32.dll_CoTaskMemFree]
movzx eax, bl
mov qword [rbp - 0x19], r15
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1402ba9b0
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14001dea0
Capabilities:
Move file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
test rbx, rbx
je 0x14001df0a
mov qword [rsp + 0x30], rbx
cmp qword [rbx + 0x10], 0
je 0x14001dee6
cmp qword [rbx + 0x30], 0
je 0x14001dee6
lea rdx, [rbx + 0x20]
cmp qword [rdx + 0x18], 7
jbe 0x14001decf
mov rdx, qword [rdx]
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14001dedc
mov rcx, qword [rbx]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop
lea rcx, [rbx + 0x20]
call fcn.1400166f0
nop
mov rcx, rbx
call fcn.1400166f0
mov edx, 0x40
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1402ba9fc
add rsp, 0x20
pop rbx
ret
Function at 0x1400421f0
Capabilities:
Delete registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
movzx esi, cl
xorps xmm0, xmm0
movups xmmword [r11 - 0x28], xmm0
mov byte [rsp + 0x20], 0
lea rcx, [r11 - 0x28]
call fcn.14006d1b0
nop
mov rdi, qword [rsp + 0x80]
test rdi, rdi
jne 0x14004230e
lea rcx, [rsp + 0x50]
call fcn.1400098d0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140042259
mov rax, qword [rax]
mov rdx, rax
lea rcx, [0x1404b5d00]
call fcn.140035a10
lea rdx, str.Failed_to_get_MBAMService_instance
mov rcx, rax
call fcn.140034a00
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140035dd0
movzx edx, al
mov rcx, rbx
call fcn.140035860
mov rcx, rbx
call fcn.14002eff0
nop
lea rcx, [rsp + 0x50]
call fcn.140016400
xor dil, dil
mov rbx, qword [rsp + 0x88]
test rbx, rbx
je 0x1400422e5
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400422e5
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x1400422e5
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
movzx eax, dil
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1402ba9b0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rax, qword [rdi]
mov rbx, qword [rax + 0xc0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0x24
lea rdx, str.04657AB6_7CE0_4DB8_A183_C82F68264327
lea rcx, [rsp + 0x30]
call fcn.140031e00
nop
movzx r8d, sil
lea rdx, [rsp + 0x30]
mov rcx, rdi
call rbx
movzx ebx, al
lea rcx, [rsp + 0x30]
call fcn.1400166f0
test bl, bl
je 0x1400422a9
test sil, sil
je 0x140042385
lea rdx, str.SystemCurrentControlSetServicesMBAMService630E9C3A_8B00_490E_81C4_DDD5EF234BAA
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dil, 1
jmp 0x1400422ac
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rbx, vtable.mb::common::system::ScopedAny_struct_HKEY______ptr64__long_int____cdecl___struct_HKEY______ptr64___long_int___cdecl_RegCloseKey_struct_HKEY______ptr64___0__0__0_.0
mov qword [rsp + 0x70], rbx
xor edi, edi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x78], rdi
lea r8, [rsp + 0x78]
lea rdx, str.SystemCurrentControlSetServicesMBAMService630E9C3A_8B00_490E_81C4_DDD5EF234BAA
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop
mov qword [rsp + 0x70], rbx
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400423d4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], rdi
mov dil, 1
jmp 0x1400422ac
Function at 0x140046e10
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140046e32
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x140046eac
mov rdi, r14
mov rcx, rbx
call fcn.140031480
test rax, rax
jle 0x140046e84
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.14030ac20
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140046e9c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140046ea4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140046e46
sub r14, rdi
jmp 0x140046f8f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140046ec3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140046ec5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140046ef7
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14030ac20
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140046f8c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140046f32
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x140046f6d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1402d49c4
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x140046f8c
cmp rbp, rax
ja 0x140046f40
test rbp, rbp
je 0x140046f8c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1402d49c4
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x14006b220
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov rdi, r8
mov rbx, rdx
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp]
call fcn.14030b3a0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov dword [rbp - 0x70], 0x68
cmp qword [rbx + 0x18], 7
jbe 0x14006b29c
mov rbx, qword [rbx]
mov r8, rbx
mov edx, 0x200
lea rcx, [rbp]
call fcn.1402cabb0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14006b37c
mov dword [rbp - 0x78], ebx
mov edx, 0xea60
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [rbx + 0xa]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp - 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14006b324
mov eax, dword [rbp - 0x78]
mov dword [rdi], eax
jmp 0x14006b362
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r8d, 0x1b
lea rdx, str.GetExitCodeProcess_failed:
lea rcx, [rsp + 0x50]
call fcn.140015370
nop
lea rcx, [rsp + 0x50]
call fcn.1400615f0
nop
lea rcx, [rsp + 0x50]
call fcn.140016400
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14006b3bc
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r8d, reloc.WS2_32.dll_shutdown
lea rdx, str.CreateProcess_failed:
lea rcx, [rsp + 0x50]
call fcn.140015370
nop
lea rcx, [rsp + 0x50]
call fcn.1400615f0
nop
lea rcx, [rsp + 0x50]
call fcn.140016400
xor al, al
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.1402ba9b0
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140073c50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x100
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rsi, r8
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov rdi, qword [0x1404b5bf0]
mov qword [rsp + 0x60], rdi
lea rdx, str.MBUpdatrService::Start.
lea rcx, [0x1404b5d00]
call fcn.140034a00
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140035dd0
movzx edx, al
mov rcx, rbx
call fcn.140035860
mov rcx, rbx
call fcn.14002eff0
nop
xor r8d, r8d
lea edx, [r14 + 2]
mov rcx, rdi
call fcn.140073c10
mov rdx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], r14
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140073d00
lea rcx, [rsp + 0x68]
call fcn.140031e00
nop
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x90]
call fcn.1400a3bc0
nop
lea rcx, str.Starting_
mov qword [rsp + 0xd0], rcx
mov qword [rsp + 0xd8], reloc.WS2_32.dll_inet_addr
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], reloc.WS2_32.dll_inet_addr
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xb0]
call fcn.1400099a0
nop
mov rcx, rax
call fcn.1400614b0
nop
lea rcx, [rsp + 0xb0]
call fcn.140016400
nop
lea rcx, [rsp + 0x90]
call fcn.140016400
nop
lea rcx, [rsp + 0x68]
call fcn.1400166f0
mov rdx, qword [rsi]
nop word [rax + rax]
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x140073da0
lea rcx, [rdi + 8]
mov r8, rbx
call fcn.140031b60
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
mov r9, rdi
lea r8, [0x140073fa0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x60], rax
mov dword [rdi + 0x2c], 4
mov dword [rdi + 0x34], r14d
mov dword [rdi + 0x40], r14d
mov dword [rdi + 0x3c], r14d
lea rdx, [rdi + 0x28]
mov rcx, qword [rdi + 0x48]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
nop
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1402ba9b0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140081c40
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
xor edi, edi
cmp qword [rcx + 0x10], rdi
jne 0x140081d1b
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
lea r8d, [rdi + 0x21]
lea rdx, str.Attempt_to_check_svc_without_name
lea rcx, [rbp - 0x39]
call fcn.140015370
nop
lea rcx, [rbp - 0x19]
call fcn.1400098d0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140081cb0
mov rax, qword [rax]
mov rdx, rax
lea rcx, [0x1404b5d00]
call fcn.140035a10
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov r8, qword [rbp - 0x29]
mov rcx, rax
call fcn.140035a10
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140035dd0
movzx edx, al
mov rcx, rbx
call fcn.140035860
mov rcx, rbx
call fcn.14002eff0
nop
lea rcx, [rbp - 0x19]
call fcn.140016400
nop
lea rcx, [rbp - 0x39]
call fcn.140016400
xor al, al
jmp 0x140081e64
mov qword [rbp + 0x17], rdi
xor edx, edx
xor ecx, ecx
mov r8d, 0x20000004
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rbp + 0x17], rax
test rax, rax
jne 0x140081d76
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
lea r8d, [rax + 0x16]
lea rdx, str.OpenSCManager_failed:
lea rcx, [rbp - 0x39]
call fcn.140015370
nop
lea rcx, [rbp - 0x39]
call fcn.1400615f0
nop
lea rcx, [rbp - 0x39]
call fcn.140016400
xor bl, bl
jmp 0x140081e58
mov qword [rbp + 0xf], rdi
cmp qword [rbx + 0x18], 7
jbe 0x140081d84
mov rbx, qword [rbx]
mov r8d, reloc.WS2_32.dll_sendto
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbp + 0xf], rax
xorps xmm0, xmm0
test rax, rax
jne 0x140081dda
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
lea r8d, [rax + 0x14]
lea rdx, str.OpenService_failed:
lea rcx, [rbp - 0x39]
call fcn.140015370
nop
lea rcx, [rbp - 0x39]
call fcn.1400615f0
nop
lea rcx, [rbp - 0x39]
call fcn.140016400
xor bl, bl
jmp 0x140081e4e
mov dword [rbp + 7], edi
xor ecx, ecx
movups xmmword [rbp + 0x1f], xmm0
movups xmmword [rbp + 0x2f], xmm0
mov dword [rbp + 0x3f], ecx
lea rcx, [rbp + 7]
mov qword [rsp + 0x20], rcx
mov r9d, 0x24
lea r8, [rbp + 0x1f]
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x140081e47
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
lea r8d, [rax + 0x1d]
lea rdx, str.QueryServiceStatusEx_failed:
lea rcx, [rbp - 0x39]
call fcn.140015370
nop
lea rcx, [rbp - 0x39]
call fcn.1400615f0
nop
lea rcx, [rbp - 0x39]
call fcn.140016400
xor bl, bl
jmp 0x140081e4e
cmp dword [rbp + 0x23], 1
setne bl
lea rcx, [rbp + 0xf]
call fcn.1400e9a10
nop
lea rcx, [rbp + 0x17]
call fcn.1400e9a10
movzx eax, bl
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1402ba9b0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret