joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bb4b0
Capabilities:
Accept command line arguments

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [r11 - 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x14017da30]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rcx
mov qword [r11 - 0x48], rcx
xor r14d, r14d
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov dword [r11 - 0x58], r14d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbp, rax
test rax, rax
je 0x1400bb59c
mov ebx, r14d
cmp dword [rsp + 0x20], ebx
jle 0x1400bb592
mov rdi, rax
nop
mov rdx, qword [rdi]
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
cmp word [rdx], 0
jne 0x1400bb542
mov r8, r14
jmp 0x1400bb55b
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400bb550
lea rcx, [rsp + 0x38]
call fcn.140007670
nop
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.1400c1e50
nop
cmp qword [rsp + 0x50], 8
jb 0x1400bb586
mov rcx, qword [rsp + 0x38]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x20]
jl 0x1400bb520
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
mov rax, rsi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14010a480
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400c1580
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
movzx r9d, byte [r8]
mov rbx, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r11, rdx
mov rdx, qword [rbx + 0x28]
xor r9, rax
movzx eax, byte [r8 + 1]
mov r10, r8
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, r9
shr rcx, 0x20
xor rcx, r9
and rcx, rdx
cmp qword [rbx + 0x30], rcx
ja 0x1400c15f5
shr rdx, 1
or rax, 0xffffffffffffffff
sub rax, rdx
add rcx, rax
mov r8, qword [rbx + 0x10]
mov rdx, qword [rbx]
mov rax, rcx
add rax, rax
add rcx, rcx
mov r9, qword [r8 + rcx*8]
mov rax, qword [r8 + rax*8]
lea r8, [r8 + rcx*8]
cmp r9, rdx
jne 0x1400c161b
mov rcx, rdx
jmp 0x1400c1622
mov rcx, qword [r8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400c165a
mov ecx, dword [r10]
cmp dword [rax + 0x10], ecx
je 0x1400c1634
mov rax, qword [rax]
jmp 0x1400c1611
mov ecx, dword [rax + 0x10]
mov qword [rsp + 8], rdx
cmp dword [r10], ecx
jne 0x1400c1646
mov qword [rsp + 8], rax
lea rax, [rsp + 8]
mov rax, qword [rax]
mov qword [r11], rax
mov rax, r11
mov rbx, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 0x10]
mov qword [r11], rdx
mov rax, r11
ret

Function at 0x1400c1670
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
movzx r9d, byte [r8]
mov rbx, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r11, rdx
mov rdx, qword [rbx + 0x28]
xor r9, rax
movzx eax, byte [r8 + 1]
mov r10, r8
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, r9
shr rcx, 0x20
xor rcx, r9
and rcx, rdx
cmp qword [rbx + 0x30], rcx
ja 0x1400c16e5
shr rdx, 1
or rax, 0xffffffffffffffff
sub rax, rdx
add rcx, rax
mov r8, qword [rbx + 0x10]
mov rdx, qword [rbx]
mov rax, rcx
add rax, rax
add rcx, rcx
mov r9, qword [r8 + rcx*8]
mov rax, qword [r8 + rax*8]
lea r8, [r8 + rcx*8]
cmp r9, rdx
jne 0x1400c170b
mov rcx, rdx
jmp 0x1400c1712
mov rcx, qword [r8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400c174a
mov ecx, dword [r10]
cmp dword [rax + 0x10], ecx
je 0x1400c1724
mov rax, qword [rax]
jmp 0x1400c1701
mov ecx, dword [rax + 0x10]
mov qword [rsp + 8], rdx
cmp dword [r10], ecx
jne 0x1400c1736
mov qword [rsp + 8], rax
lea rax, [rsp + 8]
mov rax, qword [rax]
mov qword [r11], rax
mov rax, r11
mov rbx, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 0x10]
mov qword [r11], rdx
mov rax, r11
ret
Function at 0x1400c1760
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
movzx r9d, byte [r8]
mov rbx, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r11, rdx
mov rdx, qword [rbx + 0x28]
xor r9, rax
movzx eax, byte [r8 + 1]
mov r10, r8
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, r9
shr rcx, 0x20
xor rcx, r9
and rcx, rdx
cmp qword [rbx + 0x30], rcx
ja 0x1400c17d5
shr rdx, 1
or rax, 0xffffffffffffffff
sub rax, rdx
add rcx, rax
mov r8, qword [rbx + 0x10]
mov rdx, qword [rbx]
mov rax, rcx
add rax, rax
add rcx, rcx
mov r9, qword [r8 + rcx*8]
mov rax, qword [r8 + rax*8]
lea r8, [r8 + rcx*8]
cmp r9, rdx
jne 0x1400c17fb
mov rcx, rdx
jmp 0x1400c1802
mov rcx, qword [r8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400c183a
mov ecx, dword [r10]
cmp dword [rax + 0x10], ecx
je 0x1400c1814
mov rax, qword [rax]
jmp 0x1400c17f1
mov ecx, dword [rax + 0x10]
mov qword [rsp + 8], rdx
cmp dword [r10], ecx
jne 0x1400c1826
mov qword [rsp + 8], rax
lea rax, [rsp + 8]
mov rax, qword [rax]
mov qword [r11], rax
mov rax, r11
mov rbx, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 0x10]
mov qword [r11], rdx
mov rax, r11
ret
Function at 0x1400c58a0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x14017da30]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rax, [rsp + 0x40]
mov rdi, rcx
xor ebx, ebx
mov qword [rsp + 0x28], rax
mov rax, qword [0x14017d7d0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801c
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], ebx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
mov word [rdi], bx
test eax, eax
je 0x1400c5921
cmp word [0], bx
je 0x1400c591d
mov eax, ebx
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], ax
jne 0x1400c5914
xor edx, edx
jmp 0x1400c5940
cmp word [rsp + 0x40], bx
je 0x1400c593b
lea rax, [rsp + 0x40]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400c5931
lea rdx, [rsp + 0x40]
mov r8, rbx
mov rcx, rdi
call fcn.140007670
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14010a480
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret

Function at 0x1400c62d0
Capabilities:
Read file via mapping

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov qword [rcx], 0
mov qword [rcx + 8], 0
add rcx, 0x10
xor r8d, r8d
mov dl, 1
call fcn.1400c6180
xor r9d, r9d
lea rax, str.ThettaProgressValue
mov qword [rsp + 0x28], rax
lea r8d, [r9 + 4]
xor edx, edx
or rcx, 0xffffffffffffffff
mov qword [rbx + 0x18], 0
mov dword [rsp + 0x20], 0xd
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
mov qword [rsp + 0x20], setsockopt
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 8], rax
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400cb410
Capabilities:
Query service status

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x1400cb419
mov al, 1
ret
mov rcx, qword [rcx + 0x38]
jmp fcn.1400cd050
Function at 0x1400cbfa0
Capabilities:
Compute adler32 checksum

Disassembly:
push rbp
push rsi
push r15
sub rsp, 0xa0
mov rax, qword [0x14017da30]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r15d, r8d
mov rsi, rdx
mov rbp, rcx
cmp r8d, 8
jae 0x1400cbfd4
xor eax, eax
jmp 0x1400cc0f5
lea rdx, [rcx + 0x20]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0x90], r14
call fcn.1400d3c60
mov eax, r15d
shr eax, 4
mov rbx, rsi
test eax, eax
je 0x1400cc02e
mov qword [rsp + 0x98], rdi
mov edi, eax
nop dword [rax]
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.1400d3830
add rbx, 0x10
dec rdi
jne 0x1400cc010
mov rdi, qword [rsp + 0x98]
lea rcx, [rsp + 0x20]
call fcn.1400d3a20
mov ebx, dword [rsi + 4]
xor r11d, r11d
mov dword [rsi + 4], r11d
mov r8d, dword [rbp + 0x1c]
mov ecx, r11d
xor r8d, dword [rbp + 0x18]
lea r9d, [r11 + 1]
xor r8d, dword [rbp + 0x14]
xor r8d, dword [rbp + 0x10]
xor r8d, dword [rbp + 0xc]
xor r8d, dword [rbp + 8]
xor r8d, dword [rbp + 4]
xor r8d, dword [rbp]
mov dword [rsi + 4], r11d
test r15d, r15d
jle 0x1400cc0b8
mov r10, r15
nop word [rax + rax]
movzx eax, byte [rsi]
lea rsi, [rsi + 1]
add r9d, eax
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xfff1
sub r9d, eax
mov eax, 0x80078071
add ecx, r9d
mul ecx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
dec r10
jne 0x1400cc080
mov r14, qword [rsp + 0x90]
shl ecx, 0x10
or ecx, r9d
xor r8d, ecx
mov ecx, dword [rbp + 0x3c]
xor ecx, dword [rbp + 0x38]
xor ecx, dword [rbp + 0x34]
xor ecx, dword [rbp + 0x30]
xor ecx, dword [rbp + 0x2c]
xor ecx, dword [rbp + 0x28]
xor ecx, dword [rbp + 0x24]
xor ecx, r8d
xor ecx, dword [rbp + 0x20]
cmp ecx, ebx
mov rbx, qword [rsp + 0xd0]
sete r11b
mov eax, r11d
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14010a480
add rsp, 0xa0
pop r15
pop rsi
pop rbp
ret
Function at 0x1400cc1b0
Capabilities:
Compute adler32 checksum

Disassembly:
cmp r8d, 8
jb 0x1400cc2e0
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x14017da30]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r9d, dword [rcx + 0x1c]
mov edi, r8d
mov qword [rsp + 0xb0], rsi
xor r9d, dword [rcx + 0x18]
lea rsi, [rcx + 0x20]
mov rbx, rdx
xor r9d, dword [rcx + 0x14]
xor r9d, dword [rcx + 0x10]
xor r9d, dword [rcx + 0xc]
xor r9d, dword [rcx + 8]
xor r9d, dword [rcx + 4]
xor r9d, dword [rcx]
xor ecx, ecx
lea r8d, [rcx + 1]
mov dword [rdx + 4], ecx
test edi, edi
jle 0x1400cc259
mov r10, rdx
mov r11d, edi
nop dword [rax]
movzx eax, byte [r10]
lea r10, [r10 + 1]
add r8d, eax
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul eax, edx, 0xfff1
sub r8d, eax
mov eax, 0x80078071
add ecx, r8d
mul ecx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
dec r11
jne 0x1400cc220
mov eax, dword [rsi + 0x1c]
shl ecx, 0x10
mov rdx, rsi
xor eax, dword [rsi + 0x18]
or ecx, r8d
xor eax, dword [rsi + 0x14]
xor r9d, ecx
lea rcx, [rsp + 0x20]
xor eax, dword [rsi + 0x10]
xor eax, dword [rsi + 0xc]
xor eax, dword [rsi + 8]
xor eax, dword [rsi + 4]
xor eax, dword [rsi]
xor eax, r9d
mov dword [rbx + 4], eax
call fcn.1400d3c60
mov rsi, qword [rsp + 0xb0]
shr edi, 4
test edi, edi
je 0x1400cc2b6
nop dword [rax + rax]
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.1400d3a50
add rbx, 0x10
dec rdi
jne 0x1400cc2a0
lea rcx, [rsp + 0x20]
call fcn.1400d3a20
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14010a480
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret

Function at 0x1400cc1ba
Capabilities:
Compute adler32 checksum

Disassembly:
cmp r8d, 8
jb 0x1400cc2e0
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x14017da30]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r9d, dword [rcx + 0x1c]
mov edi, r8d
mov qword [rsp + 0xb0], rsi
xor r9d, dword [rcx + 0x18]
lea rsi, [rcx + 0x20]
mov rbx, rdx
xor r9d, dword [rcx + 0x14]
xor r9d, dword [rcx + 0x10]
xor r9d, dword [rcx + 0xc]
xor r9d, dword [rcx + 8]
xor r9d, dword [rcx + 4]
xor r9d, dword [rcx]
xor ecx, ecx
lea r8d, [rcx + 1]
mov dword [rdx + 4], ecx
test edi, edi
jle 0x1400cc259
mov r10, rdx
mov r11d, edi
nop dword [rax]
movzx eax, byte [r10]
lea r10, [r10 + 1]
add r8d, eax
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul eax, edx, 0xfff1
sub r8d, eax
mov eax, 0x80078071
add ecx, r8d
mul ecx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
dec r11
jne 0x1400cc220
mov eax, dword [rsi + 0x1c]
shl ecx, 0x10
mov rdx, rsi
xor eax, dword [rsi + 0x18]
or ecx, r8d
xor eax, dword [rsi + 0x14]
xor r9d, ecx
lea rcx, [rsp + 0x20]
xor eax, dword [rsi + 0x10]
xor eax, dword [rsi + 0xc]
xor eax, dword [rsi + 8]
xor eax, dword [rsi + 4]
xor eax, dword [rsi]
xor eax, r9d
mov dword [rbx + 4], eax
call fcn.1400d3c60
mov rsi, qword [rsp + 0xb0]
shr edi, 4
test edi, edi
je 0x1400cc2b6
nop dword [rax + rax]
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.1400d3a50
add rbx, 0x10
dec rdi
jne 0x1400cc2a0
lea rcx, [rsp + 0x20]
call fcn.1400d3a20
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14010a480
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
Function at 0x1400ccbb0
Capabilities:
Create service

Disassembly:
push rdi
sub rsp, 0xd0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0xe8], rbx
mov rax, qword [0x14017da30]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea rdx, [rsp + 0x70]
call fcn.1400cc6a0
nop
mov rax, qword [rsp + 0x70]
cmp dword [rax + 4], 0
jne 0x1400ccbf9
xor bl, bl
jmp 0x1400ccd4c
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_QString::toStdWString_void____ptr64]
nop
mov qword [rsp + 0x98], 7
xor edi, edi
mov qword [rsp + 0x90], rdi
mov word [rsp + 0x80], di
lea r8d, [rdi + 6]
lea rdx, [0x140126098]
lea rcx, [rsp + 0x80]
call fcn.140007670
nop
xor edx, edx
xor ecx, ecx
lea r8d, [rdi + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x1400ccce2
lea rax, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rax, qword [rsp + 0xa0]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
mov r9d, 0xf01ff
lea r8, [0x140126098]
lea rdx, [0x140126098]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
je 0x1400ccce2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov bl, 1
jmp 0x1400ccce4
xor bl, bl
cmp qword [rsp + 0x98], 8
jb 0x1400cccfc
mov rcx, qword [rsp + 0x80]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x98], 7
mov qword [rsp + 0x90], rdi
mov word [rsp + 0x80], di
cmp qword [rsp + 0xb8], 8
jb 0x1400ccd30
mov rcx, qword [rsp + 0xa0]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0xb8], 7
mov qword [rsp + 0xb0], rdi
mov word [rsp + 0xa0], di
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
movzx eax, bl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14010a480
mov rbx, qword [rsp + 0xe8]
add rsp, 0xd0
pop rdi
ret

Function at 0x1400cd050
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x50
mov rax, qword [0x14017da30]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0x20015
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x1400cd0d7
lea rdx, [0x140126098]
mov r8d, 0x2008d
mov rcx, rax
mov qword [rsp + 0x60], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x1400cd0c9
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400cd0c0
cmp dword [rsp + 0x24], 4
sete bl
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x60]
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010a480
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
Function at 0x1400cd100
Capabilities:
Delete service
Stop service

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rax - 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, qword [0x14017da30]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x1400cd16b
mov r8d, 0xf01ff
lea rdx, [0x140126098]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x1400cd172
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x1400cd241
lea r8, [rsp + 0x50]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
setne sil
test sil, sil
jne 0x1400cd222
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x30]
cmp eax, 0x426
jne 0x1400cd1e6
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QMessageLogger::constructor_char_const____ptr64__int__char_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug___cdecl_QMessageLogger::warning_void____ptr64]
nop
lea rdx, str.Unload_driver:_ERROR_SERVICE_NOT_ACTIVE
mov rcx, rax
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug____ptr64___cdecl_QDebug::operator___char_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QDebug::destructor_void____ptr64]
mov sil, 1
jmp 0x1400cd222
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QMessageLogger::constructor_char_const____ptr64__int__char_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug___cdecl_QMessageLogger::critical_void____ptr64]
nop
lea rdx, str.Cannot_unload_driver__error:
mov rcx, rax
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug____ptr64___cdecl_QDebug::operator___char_const____ptr64____ptr64]
mov rcx, rax
mov edx, ebp
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug____ptr64___cdecl_QDebug::operator___unsigned_long_int____ptr64]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QDebug::destructor_void____ptr64]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, sil
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14010a480
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400cd600
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x70], bx
lea ebx, [rax + 1]
mov edx, ebx
lea r8, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.1400ad6a0
mov edx, ebx
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
or r8d, 0xffffffff
mov rdx, rbx
lea rcx, [rsp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const____ptr64__int_]
nop
mov edx, 7
lea rcx, str.x64.sys
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rsp + 0x80], rax
lea r8, str.drivers_
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x28]
call fcn.1400889a0
nop
lea r8, [rdi + 0x10]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140087840
nop
lea r8, [rsp + 0x80]
mov rdx, rax
mov rcx, rsi
call fcn.140087840
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x88]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
test rbx, rbx
je 0x1400cd71c
mov rcx, rbx
call sub.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_
mov rax, rsi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400cf430
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14017da30]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400cf48c
lea r8, [rsp + 0x44]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x1400cf4a0
call qword [0x14011e328]
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14010a480
add rsp, 0x68
ret
lea rax, [rsp + 0x38]
lea r8, [rsp + 0x40]
mov r9d, setsockopt
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x4c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
call qword [0x14011e328]
mov al, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14010a480
add rsp, 0x68
ret
Function at 0x1400d0d70
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x840
mov rax, qword [0x14017da30]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rbx, rdx
xor esi, esi
mov ecx, 0x410
xor edx, edx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x1400d0dbd
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_void____ptr64]
jmp 0x1400d0e02
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x30], si
call sub.MSVCR120.dll_memset
lea rdx, [rsp + 0x30]
mov r8d, 0x800
mov rcx, rdi
call sub.PSAPI.DLL_GetProcessImageFileNameW
mov rcx, rdi
call qword [0x14011e328]
lea rdx, [rsp + 0x30]
or r8d, 0xffffffff
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const____ptr64__int_]
mov rax, rbx
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.14010a480
lea r11, [rsp + 0x840]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400d0e30
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rsi, rdx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov rax, qword [0x14011f270]
mov qword [rdx], rax
mov dword [rsp + 0x20], 1
mov edi, 0x400
nop word [rax + rax]
mov rax, qword [rsi]
mov ecx, dword [rax + 8]
mov r8d, ecx
btr r8d, 0x1f
mov r9d, ebx
cmp edi, r8d
jg 0x1400d0e98
test ecx, ecx
js 0x1400d0ea1
cmp edi, dword [rax + 4]
jge 0x1400d0ea1
mov eax, r8d
sar eax, 1
cmp edi, eax
jge 0x1400d0ea1
mov r9d, 8
mov r8d, edi
mov edx, edi
mov rcx, rsi
call fcn.1400d24d0
mov rax, qword [rsi]
mov ebp, dword [rax + 4]
cmp dword [rax], 1
jbe 0x1400d0ee9
mov r8d, dword [rax + 8]
and r8d, 0x7fffffff
jne 0x1400d0edc
lea r9d, [r8 + 2]
xor r8d, r8d
lea edx, [r9 + 6]
lea ecx, [rdx - 4]
call qword [sym.imp.Qt5Core.dll_public:_static_struct_QArrayData____ptr64___cdecl_QArrayData::allocate_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64___class_QFlags_enum_QArrayData::AllocationOption__]
mov qword [rsi], rax
jmp 0x1400d0ee9
mov r9d, ebx
mov edx, ebp
mov rcx, rsi
call fcn.1400d24d0
mov rcx, qword [rsi]
lea edx, [rbp*4]
add rcx, qword [rcx + 0x10]
lea r8, [rsp + 0x60]
call sub.PSAPI.DLL_EnumProcesses
add edi, edi
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
shl rcx, 2
mov edx, dword [rsp + 0x60]
cmp rdx, rcx
je 0x1400d0e70
shr edx, 2
mov ecx, dword [rax + 8]
mov r8d, ecx
btr r8d, 0x1f
cmp edx, r8d
jg 0x1400d0f40
test ecx, ecx
js 0x1400d0f48
cmp edx, dword [rax + 4]
jge 0x1400d0f48
mov eax, r8d
sar eax, 1
cmp edx, eax
jge 0x1400d0f48
mov ebx, 8
mov r8d, edx
mov r9d, ebx
mov rcx, rsi
call fcn.1400d24d0
mov rax, rsi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret