joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140114700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x140114894
mov r15, qword [rsp + 0x60]
lea r9d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x140114894
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r9w, dx
jae 0x14011479b
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x1401148bb
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x1401147b2
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x1401147b2
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x1401147c5
movzx r8d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x140114812
mov r8d, eax
cmp eax, 0x800
jae 0x1401147df
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x140114812
cmp eax, 0x10000
jae 0x1401147f9
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x140114812
shr r8d, 0x12
mov r10d, 3
movzx r11d, sil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r9d
cmp rdx, rcx
jl 0x140114894
add qword [r14], 2
test sil, sil
jne 0x140114833
cmp r10d, 3
jae 0x14011483f
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
test r9d, r9d
je 0x140114871
lea r8d, [r10 + r10*2]
add r8d, r8d
nop dword [rax + rax]
sub r8d, 6
mov edx, eax
mov ecx, r8d
dec r9d
shr edx, cl
mov rcx, qword [rbx]
and dl, 0x3f
or dl, 0x80
mov byte [rcx], dl
inc qword [rbx]
test r9d, r9d
jg 0x140114850
shr eax, 0xa
mov r9d, 1
test sil, sil
mov ecx, r9d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x14011474f
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x1401148a2
Function at 0x14012f730
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15d, edx
lea r14d, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov esi, r12d
mov ebp, r12d
test r14d, r14d
je 0x14012f93a
mov r8, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [r8 + 0xff]
shl esi, cl
add esi, esi
nop dword [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14012f7f4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14012f7b0
mov ecx, dword [r10]
jmp 0x14012f8d7
cmp ecx, 0x4e0
jb 0x14012f8d7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14012f810
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14012f860
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
mov edx, dword [rdi + 0x10]
cmp eax, edx
ja 0x14012f790
mov r8, qword [rdi + 8]
or esi, eax
lea ecx, [r8 + 0xff]
shl ebp, cl
add ebp, ebp
or ebp, edx
cmp ebp, r14d
jb 0x14012f780
xor edx, edx
mov eax, ebp
div r15d
mov ecx, eax
mov r8d, edx
xor edx, edx
mov eax, esi
div r15d
cmp eax, ecx
jb 0x14012f95a
cmp r8d, r14d
jne 0x14012f760
mov rbx, qword [rsp + 0x20]
mov eax, esi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15d
mov eax, edx
pop r15
pop r14
pop r12
ret
Function at 0x140135630
Capabilities:
Create directory
Delete directory
Get file attributes

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x14035cb78]
xor rax, rsp
mov qword [rsp + 0x98], rax
call fcn.1401a8010
lea rcx, str.C:ProgramDataASUSASUS_System_Control_InterfaceAsusSystemAnalysisdata_
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xa
jae 0x14013566d
lea rcx, [0x140275cf0]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__rmdir
lea rcx, [0x140275cf0]
call fcn.1401a80e0
test al, al
jne 0x140135767
lea rcx, [0x140275cf0]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], SafeArrayGetLBound
mov byte [rsp + 0x58], al
lea ecx, [rax + 0x50]
call fcn.1400b9950
mov rcx, rax
mov qword [rsp + 0x68], 0x4a
mov qword [rsp + 0x70], 0x4f
movaps xmm0, xmmword [0x140275cf0]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140275d00]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140275d10]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140275d20]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [0x140275d30]
movsd qword [rax + 0x40], xmm0
movzx eax, word [0x140275d38]
mov word [rcx + 0x48], ax
mov byte [rcx + 0x4a], 0
mov qword [rsp + 0x58], rcx
lea r8, [rsp + 0x58]
lea rdx, str.CreateSqliteDBFolder:
lea rcx, [rsp + 0x38]
call fcn.1400b9790
mov rcx, rax
call fcn.1401630b0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140135767
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140135762
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013578c
call fcn.1401c72f8
lea rcx, str.C:ProgramDataASUSASUS_System_Control_InterfaceAsusSystemAnalysisdata_
call fcn.1401b00d0
nop
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401c7850
add rsp, 0xa8
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
int3
Function at 0x140146d80
Capabilities:
Get geographical location
Terminate process

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x14035cb78]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], SafeArrayGetLBound
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x140146e1e
cmp rax, 0xffffffffffffffff
je 0x140146e1e
mov ecx, SafeArrayGetLBound
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.1400fa270
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400c49e0
lea rcx, [rsp + 0x40]
call fcn.1400c3c00
lea rdx, [rsp + 0x20]
lea rcx, [0x140361420]
call fcn.1400fdcb0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140147000
Capabilities:
Get geographical location
Identify system language via api
Terminate process

Disassembly:
push rbx
sub rsp, 0x2d0
mov rax, qword [0x14035cb78]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x60], SafeArrayGetLBound
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x48], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x14014711a
cmp rax, 0xffffffffffffffff
je 0x14014711a
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0xb0]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
mov r9d, 0x208
lea r8, [rsp + 0xb0]
mov edx, 0x5c
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1401470b1
lea rdx, str.en_us
lea rcx, [rsp + 0xb0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x68]
call fcn.1400c2af0
nop
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.1400c2a30
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.1401be080
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400c49e0
lea rcx, [rsp + 0x88]
call fcn.1400c3c00
lea rdx, [rsp + 0x48]
lea rcx, [0x140361420]
call fcn.1400fdcb0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140147130
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x14035cb78]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], SafeArrayGetLBound
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x1401471c9
cmp rax, 0xffffffffffffffff
je 0x1401471c9
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.1400f4040
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400c49e0
lea rcx, [rsp + 0x40]
call fcn.1400c3c00
lea rdx, [rsp + 0x20]
lea rcx, [0x140361420]
call fcn.1400fdcb0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1401471e0
Capabilities:
Terminate process

Disassembly:
push rbx
mov eax, 0x100c0
call fcn.1401c8030
sub rsp, rax
mov rax, qword [0x14035cb78]
xor rax, rsp
mov qword [rsp + 0x100b0], rax
lea rcx, [rsp + 0x20]
call fcn.1401653b0
nop
xor edx, edx
mov r8d, 0x10000
lea rcx, [rsp + 0xb0]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], SafeArrayGetLBound
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x50], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x1401472de
cmp rax, 0xffffffffffffffff
je 0x1401472de
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.140166470
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.1400c2af0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1400c2a30
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1401be080
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400c49e0
lea rcx, [rsp + 0x90]
call fcn.1400c3c00
lea rdx, [rsp + 0x50]
lea rcx, [0x140361420]
call fcn.1400fdcb0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1401472f0
Capabilities:
Terminate process

Disassembly:
push rbx
mov eax, 0x100c0
call fcn.1401c8030
sub rsp, rax
mov rax, qword [0x14035cb78]
xor rax, rsp
mov qword [rsp + 0x100b0], rax
lea rcx, [rsp + 0x20]
call fcn.1401653b0
nop
xor edx, edx
mov r8d, 0x10000
lea rcx, [rsp + 0xb0]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], SafeArrayGetLBound
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x50], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x1401473ee
cmp rax, 0xffffffffffffffff
je 0x1401473ee
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.1401663b0
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.1400c2af0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1400c2a30
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1401be080
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400c49e0
lea rcx, [rsp + 0x90]
call fcn.1400c3c00
lea rdx, [rsp + 0x50]
lea rcx, [0x140361420]
call fcn.1400fdcb0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140147400
Capabilities:
Terminate process

Disassembly:
push rbx
mov eax, 0x100c0
call fcn.1401c8030
sub rsp, rax
mov rax, qword [0x14035cb78]
xor rax, rsp
mov qword [rsp + 0x100b0], rax
lea rcx, [rsp + 0x20]
call fcn.1401653b0
nop
xor edx, edx
mov r8d, 0x10000
lea rcx, [rsp + 0xb0]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], SafeArrayGetLBound
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x50], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x1401474fe
cmp rax, 0xffffffffffffffff
je 0x1401474fe
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.140166430
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.1400c2af0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1400c2a30
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1401be080
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400c49e0
lea rcx, [rsp + 0x90]
call fcn.1400c3c00
lea rdx, [rsp + 0x50]
lea rcx, [0x140361420]
call fcn.1400fdcb0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140147510
Capabilities:
Terminate process

Disassembly:
push rbx
mov eax, 0x100c0
call fcn.1401c8030
sub rsp, rax
mov rax, qword [0x14035cb78]
xor rax, rsp
mov qword [rsp + 0x100b0], rax
lea rcx, [rsp + 0x20]
call fcn.1401653b0
nop
xor edx, edx
mov r8d, 0x10000
lea rcx, [rsp + 0xb0]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], SafeArrayGetLBound
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x50], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x14014760e
cmp rax, 0xffffffffffffffff
je 0x14014760e
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.140166620
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.1400c2af0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1400c2a30
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1401be080
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400c49e0
lea rcx, [rsp + 0x90]
call fcn.1400c3c00
lea rdx, [rsp + 0x50]
lea rcx, [0x140361420]
call fcn.1400fdcb0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140147620
Capabilities:
Terminate process

Disassembly:
push rbx
mov eax, 0x100c0
call fcn.1401c8030
sub rsp, rax
mov rax, qword [0x14035cb78]
xor rax, rsp
mov qword [rsp + 0x100b0], rax
lea rcx, [rsp + 0x20]
call fcn.1401653b0
nop
xor edx, edx
mov r8d, 0x10000
lea rcx, [rsp + 0xb0]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], SafeArrayGetLBound
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x50], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x14014771e
cmp rax, 0xffffffffffffffff
je 0x14014771e
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.1401664f0
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.1400c2af0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1400c2a30
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1401be080
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400c49e0
lea rcx, [rsp + 0x90]
call fcn.1400c3c00
lea rdx, [rsp + 0x50]
lea rcx, [0x140361420]
call fcn.1400fdcb0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140147730
Capabilities:
Terminate process

Disassembly:
push rbx
mov eax, 0x100c0
call fcn.1401c8030
sub rsp, rax
mov rax, qword [0x14035cb78]
xor rax, rsp
mov qword [rsp + 0x100b0], rax
lea rcx, [rsp + 0x20]
call fcn.1401653b0
nop
xor edx, edx
mov r8d, 0x10000
lea rcx, [rsp + 0xb0]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], SafeArrayGetLBound
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x50], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x14014782e
cmp rax, 0xffffffffffffffff
je 0x14014782e
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.140166530
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.1400c2af0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1400c2a30
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1401be080
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400c49e0
lea rcx, [rsp + 0x90]
call fcn.1400c3c00
lea rdx, [rsp + 0x50]
lea rcx, [0x140361420]
call fcn.1400fdcb0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140147840
Capabilities:
Terminate process

Disassembly:
push rbx
mov eax, 0x100c0
call fcn.1401c8030
sub rsp, rax
mov rax, qword [0x14035cb78]
xor rax, rsp
mov qword [rsp + 0x100b0], rax
lea rcx, [rsp + 0x20]
call fcn.1401653b0
nop
xor edx, edx
mov r8d, 0x10000
lea rcx, [rsp + 0xb0]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], SafeArrayGetLBound
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x50], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x14014793e
cmp rax, 0xffffffffffffffff
je 0x14014793e
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.1401664b0
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.1400c2af0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1400c2a30
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1401be080
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400c49e0
lea rcx, [rsp + 0x90]
call fcn.1400c3c00
lea rdx, [rsp + 0x50]
lea rcx, [0x140361420]
call fcn.1400fdcb0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140147950
Capabilities:
Terminate process

Disassembly:
push rbx
mov eax, 0x100c0
call fcn.1401c8030
sub rsp, rax
mov rax, qword [0x14035cb78]
xor rax, rsp
mov qword [rsp + 0x100b0], rax
lea rcx, [rsp + 0x20]
call fcn.1401653b0
nop
xor edx, edx
mov r8d, 0x10000
lea rcx, [rsp + 0xb0]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], SafeArrayGetLBound
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x50], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, 0xffffffffffffffff
je 0x140147a4e
cmp rax, 0xffffffffffffffff
je 0x140147a4e
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.140166660
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.1400c2af0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1400c2a30
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1401be080
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400c49e0
lea rcx, [rsp + 0x90]
call fcn.1400c3c00
lea rdx, [rsp + 0x50]
lea rcx, [0x140361420]
call fcn.1400fdcb0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140148470
Capabilities:
Create service

Disassembly:
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x4a8
mov rax, qword [0x14035cb78]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov r15, qword [rsp + 0x500]
mov ebp, r8d
mov r12, qword [rsp + 0x508]
mov rdi, rdx
mov rsi, rcx
lea rdx, [rsp + 0x70]
mov r8d, 0x104
xor ecx, ecx
mov r14, r9
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1401484df
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetModuleFileName_failed_w_err_0x_08lx_n
call fcn.1401025b0
jmp 0x1401485cb
lea r8, [rsp + 0x70]
mov qword [rsp + 0x4a0], rbx
lea rdx, str.__s_
lea rcx, [rsp + 0x280]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 3]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140148530
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.1401025b0
jmp 0x1401485c3
mov qword [rsp + 0x60], r12
xor eax, eax
mov qword [rsp + 0x58], r15
mov r9d, 4
mov qword [rsp + 0x50], r14
mov r8, rdi
mov qword [rsp + 0x48], rax
mov rdx, rsi
mov qword [rsp + 0x40], rax
mov rcx, rbx
lea rax, [rsp + 0x280]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], SafeArrayGetLBound
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x1401485a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateService_failed_w_err_0x_08lx_n
call fcn.1401025b0
mov rcx, rbx
jmp 0x1401485bd
mov rdx, rsi
lea rcx, str._s_is_installed._n
call fcn.1401025b0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x4a0]
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1401c7850
add rsp, 0x4a8
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401485f0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14035cb78]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov rdi, rcx
xorps xmm0, xmm0
mov qword [rsp + 0x30], rax
xor edx, edx
mov dword [rsp + 0x38], eax
xor ecx, ecx
lea r8d, [rax + 1]
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14014864e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.1401025b0
jmp 0x14014876a
mov r8d, 0x10024
mov qword [rsp + 0x68], rbx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x140148689
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService_failed_w_err_0x_08lx_n
call fcn.1401025b0
mov rcx, rsi
jmp 0x14014875f
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140148721
mov rdx, rdi
lea rcx, str.Stopping__s.
call fcn.1401025b0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140148702
mov eax, dword [rsp + 0x24]
cmp eax, 3
jne 0x140148706
lea rcx, [0x1402791ac]
call fcn.1401025b0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1401486d0
mov eax, dword [rsp + 0x24]
lea rcx, str._n_s_is_stopped._n
mov rdx, rdi
cmp eax, 1
je 0x14014871c
lea rcx, str._n_s_failed_to_stop._n
call fcn.1401025b0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140148744
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.DeleteService_failed_w_err_0x_08lx_n
call fcn.1401025b0
jmp 0x140148753
mov rdx, rdi
lea rcx, str._s_is_removed._n
call fcn.1401025b0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401c7850
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret