joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002b650
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdx, rcx
lea rcx, [0x140072198]
call fcn.14000a610
mov edx, dword [0x1400723b0]
xor ecx, ecx
test edx, edx
je 0x14002b6c5
mov r8, qword [rbx + 0x18]
lea rax, [0x1400721b0]
cmp qword [rax], r8
je 0x14002b694
inc ecx
add rax, 8
cmp ecx, edx
jb 0x14002b683
jmp 0x14002b6c5
inc ecx
lea r9, [0x140071d30]
mov r8, rdx
movsxd rax, ecx
sub r8, rax
lea rdx, [r9 + rax*8 + 0x480]
lea eax, [rcx - 1]
shl r8, 3
movsxd rcx, eax
lea rcx, [r9 + rcx*8 + 0x480]
call fcn.140043b10
mov dword [rbx + 0x20], 1
dec dword [0x1400723b0]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, 0xffffe5d4
test eax, eax
jne 0x14002b728
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002b6fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002b728
jmp 0x14002b6fd
mov eax, edi
mov dword [rsp + 0x28], eax
lea rax, str.SetEvent__
lea r8, str.PollRemoveWorker
lea rdx, str._s:_d____s_failed:__d_n
mov r9d, 0x1f0
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.140025be0
mov rcx, qword [rbx]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x14002b780
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002b751
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002b787
jmp 0x14002b753
mov eax, edi
mov dword [rsp + 0x28], eax
lea rax, str.WaitForSingleObject__
lea r8, str.PollRemoveWorker
lea rdx, str._s:_d____s_failed:__d_n
mov r9d, 0x1f4
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.140025be0
jmp 0x14002b787
cmp eax, 0x102
jne 0x14002b7d7
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x14002b7d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002b7ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
je 0x14002b7d7
lea rax, str.TerminateThread__
lea r8, str.PollRemoveWorker
lea rdx, str._s:_d____s_failed:__d_n
mov r9d, 0x1fa
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call fcn.140025be0
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x10]
mov qword [rbx], 0
test rcx, rcx
je 0x14002b7fe
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], 0
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14002b815
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x18], 0
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140044620
Function at 0x14002c340
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
lea r8, [rsp + 0x58]
lea rdx, str.SOFTWAREApple_Inc.Bonjour
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x58], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov ebx, eax
test eax, eax
jne 0x14002c3e1
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.ManageLLRouting
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x14002c3e1
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
lea rdx, str.ManageLLRouting
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14002c3f1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x14002c400
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x38
lea r8, [rsp + 0x68]
lea rdx, str.SOFTWAREApple_Inc.Bonjour
xor edi, edi
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x68], rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov ebx, eax
test eax, eax
jne 0x14002c4c4
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea rdx, str.ManageLLRouting
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002c479
cmp dword [rsp + 0x58], edi
setne dil
mov dword [reloc.WS2_32.dll_accept], edi
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea rdx, str.CacheEntryCount
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov eax, dword [0x14008ed74]
test ebx, ebx
cmove eax, dword [rsp + 0x58]
mov dword [0x14008ed74], eax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14002c4d4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x14002c7e0
Capabilities:
Modify service

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
jne 0x14002c828
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x14002c828
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002c95c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14002c954
mov rcx, rbx
mov qword [rsp + 0x78], rsi
call qword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov rsi, rax
test rax, rax
jne 0x14002c85a
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002c969
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14002c94f
mov r8d, setsockopt
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x14002c892
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002c97b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x14002c93f
lea r8, [rsp + 0x88]
mov edx, 1
mov rcx, rdi
mov qword [rsp + 0x88], rbp
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x14002c8ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002c982
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x14002c931
xor ebp, ebp
lea rax, [rsp + 0x70]
lea r8, [rsp + 0x20]
lea edx, [rbp + 2]
mov rcx, rdi
mov dword [rsp + 0x20], 0xffffffff
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x74], 0x1f4
mov dword [rsp + 0x70], 1
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x14002c92f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002c982
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x14002c931
mov ebx, ebp
test rdi, rdi
je 0x14002c93f
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rsi, rsi
je 0x14002c94d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov eax, ebx
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov eax, 0xffffe59d
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov eax, 0xffffe5bf
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov ebx, 0xffffe5b9
jmp 0x14002c93f
mov ebx, 0xffffe5cf
jmp 0x14002c931
Function at 0x14002c990
Capabilities:
Access the windows event log

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
sub rsp, 0x480
mov rax, qword [0x14006a110]
xor rax, rsp
mov qword [rsp + 0x460], rax
cmp dword [0x14008ecdc], 0
mov ebx, ecx
jne 0x14002ca4f
cmp qword [0x14008ed68], 0
mov qword [r11 - 0x10], rdi
lea rdi, [r11 + 0x18]
je 0x14002ca2e
lea rcx, [rsp + 0x60]
mov r8, rdi
call fcn.1400458fc
xor ecx, ecx
mov edx, 1
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x50]
lea r11, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], dx
mov qword [rsp + 0x20], rcx
mov rcx, qword [0x14008ed68]
lea r9d, [rdx + 0x63]
xor r8d, r8d
movzx edx, bx
mov qword [rsp + 0x50], r11
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
jmp 0x14002ca47
call fcn.140044acc
mov rdx, qword [rsp + 0x498]
mov r8, rdi
lea rcx, [rax + 0x60]
call fcn.140045820
mov rdi, qword [rsp + 0x478]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400437e0
add rsp, 0x480
pop rbx
ret

Function at 0x14002ca70
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x14006a110]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea r8, [rsp + 0x30]
lea rdx, str.SYSTEMCurrentControlSetServicesEventLogApplicationBonjour_Service
xor ebx, ebx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov edi, eax
test eax, eax
jne 0x14002cb83
lea rdx, [rsp + 0x40]
mov r8d, 0x104
xor ecx, ecx
mov word [rsp + 0x40], bx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
lea r9d, [rbx + 2]
repne scasw ax, word [rdi]
lea rdx, str.EventMessageFile
xor r8d, r8d
not rcx
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test eax, eax
jne 0x14002cb83
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea r9d, [rbx + 4]
lea rdx, str.TypesSupported
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0x1f
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test eax, eax
jne 0x14002cb83
lea rdx, [0x140059ce0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov qword [0x14008ed68], rax
test rax, rax
je 0x14002cb6a
mov edi, ebx
jmp 0x14002cb83
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002cb7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14002cb83
mov edi, 0xffffe5cf
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14002cb93
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400437e0
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
Function at 0x14002d400
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x60
mov rax, qword [0x14006a110]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [0x14008ed78], 0
mov rdi, rcx
mov qword [rsp + 0x38], 0
jne 0x14002d440
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400437e0
add rsp, 0x60
pop rdi
ret
cmp qword [0x14008ed80], 0
je 0x14002d42b
lea r8, [rsp + 0x38]
lea rdx, str.SOFTWAREApple_Inc.BonjourPower_Management
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x78], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x14002d473
xor bl, bl
jmp 0x14002d569
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea rdx, [0x1400595f0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14002d4b2
xor bl, bl
jmp 0x14002d569
cmp dword [rsp + 0x30], 0
jne 0x14002d4c0
xor bl, bl
jmp 0x14002d569
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
test al, al
jne 0x14002d4d6
xor bl, bl
jmp 0x14002d569
cmp byte [rsp + 0x48], 1
je 0x14002d4e4
xor bl, bl
jmp 0x14002d569
lea rcx, [0x14008ff40]
call fcn.140028ee0
test al, al
jne 0x14002d4f8
xor bl, bl
jmp 0x14002d569
lea rcx, [0x14008ff40]
call fcn.140011ba0
test al, al
jne 0x14002d50c
xor bl, bl
jmp 0x14002d569
xor ecx, ecx
call fcn.140044430
mov rdx, qword [0x14008ff40]
mov ecx, 4
mov r8, qword [rdx + 0x20]
lea r9, [rax + 0x1c20]
lea rdx, [0x14005a110]
pxor xmm0, xmm0
cmp r8, r9
cmovl r9, r8
sub r9, rax
cvtsi2sd xmm0, r9
mulsd xmm0, qword [0x14005a108]
cvttsd2si ebx, xmm0
mov r8d, ebx
call fcn.14002c990
neg ebx
movsxd rax, ebx
mov bl, 1
imul rax, rax, 0x989680
mov qword [rdi], rax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14002d579
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400437e0
add rsp, 0x60
pop rdi
ret
Function at 0x14002d7c0
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push rbx
push rbp
push r12
sub rsp, 0x2c0
mov rax, qword [0x14006a110]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rax, r9
mov rbp, r8
mov rbx, rdx
mov r12, rcx
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x80]
mov rcx, rax
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x14002d825
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002d997
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14002d97b
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov qword [rsp + 0x2b0], rdi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14002d861
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002d99e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14002d973
lea rax, str.Tcpip
mov qword [rsp + 0x2b8], rsi
mov qword [rsp + 0x2a8], r13
xor r13d, r13d
mov r9d, 0xf01ff
mov r8, rbx
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov rdx, r12
mov rcx, rdi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rsi, rax
test rax, rax
jne 0x14002d8f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002d9a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x14002d953
call fcn.14002c340
test rbp, rbp
je 0x14002d908
mov r8, rbp
mov rdx, r12
mov rcx, rdi
call fcn.14002c7e0
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14002d934
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002d9ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x14002d945
lea rdx, str.installed_service_n
xor ecx, ecx
call fcn.14002c990
mov ebx, r13d
test rsi, rsi
je 0x14002d953
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r13, qword [rsp + 0x2a8]
mov rsi, qword [rsp + 0x2b8]
test rdi, rdi
je 0x14002d971
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rdi, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400437e0
add rsp, 0x2c0
pop r12
pop rbp
pop rbx
ret
mov eax, 0xffffe5d0
jmp 0x14002d97b
mov eax, 0xffffe59d
jmp 0x14002d973
mov ebx, 0xffffe5b6
jmp 0x14002d953
mov ebx, 0xffffe5bf
jmp 0x14002d945
Function at 0x14002d9c0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x50
mov rax, qword [0x14006a110]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14002da10
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002db01
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14002dae9
mov r8d, 0x10024
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x68], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x14002da4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002db08
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x14002dad4
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14002da79
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002db0f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x14002dac6
cmp dword [rsp + 0x24], 1
je 0x14002da93
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x14002dab6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002db16
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x14002dac6
lea rdx, str.Removed_service_n
xor ecx, ecx
call fcn.14002c990
xor ebx, ebx
test rdi, rdi
je 0x14002dad4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x68]
test rsi, rsi
je 0x14002dae7
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400437e0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rsi
ret
mov eax, 0xffffe59d
jmp 0x14002dae9
mov ebx, 0xffffe5b9
jmp 0x14002dad4
mov ebx, 0xffffe59e
jmp 0x14002dac6
mov ebx, 0xffffe5ba
jmp 0x14002dac6
Function at 0x14002e480
Capabilities:
Get mac address on windows

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x30
mov rbp, rcx
lea rcx, str.169.254.0.0
mov r14, rdx
call qword [sym.imp.WS2_32.dll_inet_addr]
mov rdx, rbp
mov ecx, eax
call sub.IPHLPAPI.DLL_GetBestInterface
xor r15d, r15d
test eax, eax
je 0x14002e4b2
mov dword [rbp], r15d
lea rdx, [rsp + 0x60]
xor ecx, ecx
mov qword [rsp + 0x28], r12
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
je 0x14002e4dc
mov eax, 0xffffe5d4
mov r12, qword [rsp + 0x28]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
mov ecx, dword [rsp + 0x60]
mov qword [rsp + 0x20], r13
call fcn.140044568
mov r13, rax
test rax, rax
jne 0x14002e4fc
mov eax, 0xffffe5b8
jmp 0x14002e681
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov r12d, eax
test eax, eax
jne 0x14002e676
mov qword [rsp + 0x68], rdi
mov r12d, 0xffffe5d4
mov rdi, r13
cmp dword [rdi + 0x1a4], 6
jne 0x14002e56a
cmp dword [rdi + 0x194], 6
jne 0x14002e56a
cmp byte [rdi + 0x198], 0x44
jne 0x14002e56a
cmp byte [rdi + 0x199], 0x45
jne 0x14002e56a
cmp byte [rdi + 0x19a], 0x53
jne 0x14002e56a
cmp byte [rdi + 0x19b], 0x54
jne 0x14002e56a
cmp byte [rdi + 0x19c], 0x42
jne 0x14002e56a
cmp byte [rdi + 0x19d], r15b
je 0x14002e5d0
lea rcx, [rdi + 0x110]
lea rdx, str.Juniper
mov r8d, 0x84
call fcn.14002d680
test rax, rax
jne 0x14002e5d0
cmp dword [rdi + 0x1a4], 6
jne 0x14002e5e5
cmp dword [rdi + 0x194], 6
jne 0x14002e5e5
cmp byte [rdi + 0x198], r15b
jne 0x14002e5e5
cmp byte [rdi + 0x199], 5
jne 0x14002e5e5
cmp byte [rdi + 0x19a], 0x9a
jne 0x14002e5e5
cmp byte [rdi + 0x19b], 0x3c
jne 0x14002e5e5
cmp byte [rdi + 0x19c], 0x7a
jne 0x14002e5e5
cmp byte [rdi + 0x19d], r15b
jne 0x14002e5e5
lea rcx, [rdi + 0x1c0]
call qword [sym.imp.WS2_32.dll_inet_addr]
test eax, eax
jne 0x14002e671
mov rdi, qword [rdi]
test rdi, rdi
jne 0x14002e522
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
nop dword [rax + rax]
mov rbx, r13
cmp dword [rbx + 0x1a4], 6
jne 0x14002e637
lea rsi, [rbx + 0x1c0]
test rsi, rsi
je 0x14002e637
lea rdi, str.0.0.0.0
mov ecx, 8
repe cmpsb byte [rsi], byte [rdi]
je 0x14002e637
mov eax, dword [rbp]
test eax, eax
je 0x14002e64b
cmp dword [rbx + 0x1a0], eax
je 0x14002e64b
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14002e603
cmp dword [rbp], r15d
je 0x14002e667
mov dword [rbp], r15d
jmp 0x14002e600
lea rcx, [rbx + 0x1c0]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov r12d, r15d
mov dword [r14], eax
mov eax, dword [rbx + 0x1a0]
mov dword [rbp], eax
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
mov rcx, r13
call fcn.140044620
mov eax, r12d
mov r13, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
Function at 0x14002e6a0
Capabilities:
Get routing table

Disassembly:
push rbp
push r13
lea rbp, [rsp - 0x4f]
sub rsp, 0xa8
mov rax, qword [0x14006a110]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rax, qword [rcx]
xor r13d, r13d
cmp dword [rax + 0x6198], 6
jae 0x14002e89d
cmp dword [reloc.WS2_32.dll_accept], r13d
je 0x14002e89d
cmp dword [0x14008a630], r13d
jne 0x14002e89d
xor eax, eax
lea rdx, [rbp - 0x25]
lea rcx, [rbp - 0x35]
mov qword [rsp + 0xd0], rdi
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
call fcn.14002e480
mov edi, eax
test eax, eax
jne 0x14002e87a
mov qword [rsp + 0xc0], rbx
lea rcx, str.169.254.0.0
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xa0], r12
call qword [sym.imp.WS2_32.dll_inet_addr]
lea rcx, str.255.255.0.0
mov dword [rbp - 0x31], eax
mov eax, dword [rbp - 0x35]
mov dword [rbp - 0x21], eax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [rbp - 0x35]
mov dword [rbp - 0x2d], eax
mov dword [rbp - 0x1d], 3
mov qword [rbp - 0x19], 3
mov dword [rbp - 0x29], r13d
call fcn.14002d5a0
lea rcx, str.169.254.0.0
add eax, 0x14
mov qword [rbp - 9], 0xffffffffffffffff
mov qword [rbp - 1], 0xffffffffffffffff
mov dword [rbp - 0xd], eax
call qword [sym.imp.WS2_32.dll_inet_addr]
lea rdx, [rbp - 0x39]
xor r8d, r8d
xor ecx, ecx
mov dword [rbp - 0x39], r13d
mov esi, eax
mov r12d, r13d
call sub.IPHLPAPI.DLL_GetIpForwardTable
cmp eax, 0x7a
jne 0x14002e853
mov ecx, dword [rbp - 0x39]
call fcn.140044568
mov rbx, rax
test rax, rax
je 0x14002e853
lea rdx, [rbp - 0x39]
xor r8d, r8d
mov rcx, rax
call sub.IPHLPAPI.DLL_GetIpForwardTable
test eax, eax
jne 0x14002e822
mov edx, dword [rbx]
mov eax, r13d
test edx, edx
je 0x14002e822
lea rcx, [rbx + 4]
cmp dword [rcx], esi
je 0x14002e804
inc eax
add rcx, 0x38
cmp eax, edx
jb 0x14002e7f4
jmp 0x14002e822
imul rax, rax, 0x38
lea rcx, [rbp + 7]
mov r8d, 0x38
lea rdx, [rax + rbx + 4]
call fcn.140043b10
mov r12d, 1
mov rcx, rbx
call fcn.140044620
test r12d, r12d
je 0x14002e853
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x31]
mov r8d, 0x38
mov dword [rbp + 0x23], r13d
call fcn.1400444a0
test eax, eax
je 0x14002e899
lea rcx, [rbp + 7]
call sub.IPHLPAPI.DLL_DeleteIpForwardEntry
cmp dword [rbp - 0x25], r13d
je 0x14002e899
lea rcx, [rbp - 0x31]
call sub.IPHLPAPI.DLL_CreateIpForwardEntry
mov rbx, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xd0]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400437e0
add rsp, 0xa8
pop r13
pop rbp
ret
mov eax, edi
jmp 0x14002e862
mov eax, r13d
jmp 0x14002e882