joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002115c
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x290
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x140065010]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r15, r8
mov r14, rdx
mov ebp, ecx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
or rdi, 0xffffffffffffffff
cmp rax, rdi
jne 0x1400211ec
mov ecx, 0x10c
call fcn.1400263b4
mov qword [rsp + 0x30], rax
lea r9, str.CreateToolhelp32Snapshot_failed
mov edx, 0xe1232723
mov r8d, 0x260
mov rcx, rax
call fcn.14001d7a0
nop
mov qword [rsp + 0x20], rax
lea rdx, [0x140062a10]
lea rcx, [rsp + 0x20]
call fcn.140028338
int3
xor ebx, ebx
mov dword [r14], ebx
mov dword [rsp + 0x40], 0x238
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140021248
cmp dword [rsp + 0x48], ebp
je 0x140021221
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x140021207
mov eax, dword [rsp + 0x5c]
mov dword [r14], eax
lea rax, [rsp + 0x6c]
inc rdi
cmp word [rax + rdi*2], bx
jne 0x14002122d
mov r8d, edi
lea rdx, [rsp + 0x6c]
mov rcx, r15
call fcn.140007134
mov bl, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140026390
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x290
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x14002127c
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140065010]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov ebp, ecx
test ecx, ecx
je 0x140021365
mov qword [r11 - 0x38], rax
lea ecx, [rax + 4]
mov qword [r11 - 0x30], rax
xor edx, edx
mov qword [r11 - 0x28], rax
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400212d6
xor eax, eax
jmp 0x140021365
xor ebx, ebx
mov dword [rsp + 0x20], 0x1c
xor dil, dil
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x140021353
cmp dword [rsp + 0x2c], ebp
je 0x14002130b
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
jmp 0x1400212f1
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x140021353
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, 1
movzx edi, dil
cmp eax, ecx
cmove edi, ecx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test dil, dil
jne 0x140021353
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
neg dil
sbb rax, rax
and rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140026390
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140021400
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x40
mov rbx, r9
mov rdi, r8
mov ebp, edx
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [rsp + 0x68], 0
mov r12d, 4
mov esi, eax
mov rcx, qword [r14 + 0x38]
mov dword [rsp + 0x30], ebp
cmp qword [rcx], 0xffffffffffffffff
je 0x140021467
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], r12d
mov r9d, r12d
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
mov edx, 0x8000a418
call fcn.14000fd1c
jmp 0x140021469
xor eax, eax
cmp eax, 1
jne 0x140021475
cmp dword [rsp + 0x68], 0
je 0x1400214aa
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x2710
jbe 0x140021436
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r12
pop rdi
ret
mov rcx, rdi
call fcn.140021388
test al, al
jne 0x14002148f
test rbx, rbx
je 0x14002148f
jmp 0x1400214de
cmp dword [rsp + 0x30], 0
je 0x140021503
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x4e20
ja 0x14002148f
lea rax, [rsp + 0x38]
mov r9, r12
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rdx, [rbx + 0x24]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x1400214bd
jmp 0x14002148f
mov al, 1
jmp 0x140021491

Function at 0x140021818
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x140065010]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor ebx, ebx
mov rbp, rdx
mov edi, ecx
test rdx, rdx
jne 0x140021849
xor eax, eax
jmp 0x1400218c6
test edi, edi
je 0x140021845
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x438
call fcn.1400280e0
mov edx, edi
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140021845
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x438
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1400218bb
cmp dword [rsp + 0x28], edi
jne 0x1400218a6
mov rdx, rbp
lea rcx, [rsp + 0x50]
call fcn.14002d7f0
test eax, eax
je 0x1400218b6
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Module32NextW]
jmp 0x14002188b
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140026390
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x470
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400228dc
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Resume thread
Spawn thread to rwx shellcode
Terminate thread

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov r14d, r9d
mov r12, r8
mov r15, rdx
mov rbx, rcx
lea rax, vtable.SCleaner.0
mov qword [rbp - 0x20], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
xor edi, edi
mov qword [rbp - 8], rdi
lea eax, [r14*2 + 0x1020]
test rcx, rcx
je 0x140022a8e
mov qword [rbp - 0x18], rcx
movsxd r8, eax
mov dword [rsp + 0x20], 0x40
mov r13d, 0x1000
mov r9d, r13d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x140022a92
mov rdi, rax
mov qword [rbp - 8], rax
or qword [rbp + 0x40], 0xffffffffffffffff
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8, r15
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140022a92
cmp qword [rbp + 0x40], r13
jne 0x140022a92
lea r15, [rdi + 0x1020]
or r13, 0xffffffffffffffff
mov qword [rbp + 0x40], r13
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, r12
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140022a92
cmp qword [rbp + 0x40], r14
jne 0x140022a92
lea rax, [rbp + 0x58]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r15
mov r9, rdi
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rsi, rax
test rax, rax
je 0x140022a92
mov qword [rbp - 0x10], rax
lea edx, [r13 + 3]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0x2710
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140022a4d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x140022a92
xor edi, edi
mov qword [rbp - 8], rdi
jmp 0x140022a92
test eax, eax
jne 0x140022a92
mov r8, r14
xor edx, edx
mov rcx, r12
call fcn.1400280e0
mov qword [rbp - 0x30], r13
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9, r14
mov r8, r12
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140022a92
cmp qword [rbp - 0x30], r14
jne 0x140022a92
mov esi, 1
jmp 0x140022a94
mov rbx, qword [rbp - 0x18]
xor esi, esi
lea rax, vtable.SCleaner.0
mov qword [rbp - 0x20], rax
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140022aae
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x140022acd
test rdi, rdi
je 0x140022acd
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, esi
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140022ae8
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x140022b00
mov al, 1
jmp 0x140022b8c
lea rax, [rsp + 0x68]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftVisualStudio9.0General
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140022b8a
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x50], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.UserCanAutoSendErrorReport
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140022b8a
cmp dword [rsp + 0x58], 4
jne 0x140022b8a
cmp dword [rsp + 0x50], 4
jne 0x140022b8a
cmp dword [rsp + 0x60], 1
sete al
jmp 0x140022b8c
xor al, al
add rsp, 0x38
pop rdi
pop rbx
ret

Function at 0x140022b94
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
lea rax, [rsp + 0x68]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, str.SoftwareWow6432nodeMicrosoftPCHealthErrorReportingDWInstalled
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
test eax, eax
je 0x140022bd0
xor al, al
jmp 0x140022c46
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.DW0201
mov dword [rsp + 0x60], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [rdi + 0x206], si
test ebx, ebx
jne 0x140022bcc
cmp dword [rsp + 0x58], 2
jne 0x140022c3d
mov r8d, 0x104
mov rdx, rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x103
jbe 0x140022c44
jmp 0x140022bcc
cmp dword [rsp + 0x58], 1
jne 0x140022bcc
mov al, 1
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x140023454
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140065010]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov rax, qword [rcx]
mov qword [rcx + 8], rax
xor esi, esi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], rsi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], si
lea rdx, str.SYSTEMCurrentControlSetServicesVSPerfSrv
lea rcx, [rbp - 0x28]
call fcn.14000346c
nop
lea rdx, str.Properties
lea rcx, [rbp - 0x28]
call fcn.140003188
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140023513
cmp eax, 2
je 0x140023580
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14002359a
mov eax, 0x100
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], 3
mov edx, eax
mov rcx, rbx
call fcn.140011324
mov rax, qword [rbx]
lea rcx, [rbp - 0x3c]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rdx, str.Security
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140023564
cmp dword [rbp - 0x40], 3
je 0x140023571
lea edi, [rax + 0xd]
cmp edi, 0xea
jne 0x140023571
mov eax, dword [rbp - 0x3c]
jmp 0x140023522
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 2
jne 0x14002358c
mov rcx, rbx
call fcn.1400233ec
mov ebx, eax
jmp 0x14002359a
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
lea rcx, [rbp - 0x28]
call fcn.1400033dc
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140026390
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140023980
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp + 0x27], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140065010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_IsValidSecurityDescriptor]
xor esi, esi
test eax, eax
jne 0x1400239da
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x140023b5f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorLength]
mov dword [rbp - 5], eax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], rsi
lea r8, [rbp + 7]
lea rdx, [rbp - 9]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
test eax, eax
jne 0x140023a0f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140023a50
mov eax, 0x8000
test word [rbp - 9], ax
jne 0x140023a67
mov edx, dword [rbp - 5]
lea rcx, [rbp + 0xf]
call fcn.140011324
lea r8, [rbp - 5]
mov rdx, qword [rbp + 0xf]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_MakeSelfRelativeSD]
test eax, eax
je 0x140023a43
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140023a45
mov eax, esi
cmp eax, 0xea
je 0x140023a1a
test eax, eax
je 0x140023a63
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140023b54
mov rbx, qword [rbp + 0xf]
mov qword [rbp + 0x3f], rsi
mov qword [rbp + 0x47], rsi
mov qword [rbp + 0x3f], rsi
mov qword [rbp + 0x47], 7
mov word [rbp + 0x2f], si
lea rdx, str.SYSTEMCurrentControlSetServicesVSPerfSrv
lea rcx, [rbp + 0x2f]
call fcn.14000346c
nop
lea rdx, str.Properties
lea rcx, [rbp + 0x2f]
call fcn.140003188
lea rdx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 8
cmovae rdx, qword [rbp + 0x2f]
mov qword [rsp + 0x40], rsi
lea rax, [rbp - 1]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140023af4
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140023b4a
mov eax, dword [rbp - 5]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
lea rdx, str.Security
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x140023b3c
mov rcx, rbx
call fcn.1400235c8
mov rcx, rbx
call fcn.140023718
mov edi, eax
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
lea rcx, [rbp + 0x2f]
call fcn.1400033dc
nop
lea rcx, [rbp + 0xf]
call fcn.140002ee4
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140026390
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140024ac0
Capabilities:
Query service status

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x140065010]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rbp - 0x21], r8
mov rcx, qword [rbp - 0x21]
test rcx, rcx
jne 0x140024b1f
lea rdx, str.operator_SCM_HANDLE__
lea rcx, [rbp - 0x11]
call fcn.14002490c
lea rdx, [0x140062b38]
lea rcx, [rbp - 0x11]
call fcn.140028338
int3
mov r8d, 0x84
lea rdx, str.VSPerfSrv
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
jne 0x140024b3b
xor ebx, ebx
jmp 0x140024b98
mov qword [rbp - 0x29], rax
mov ebx, 1
mov dword [rsi], ebx
mov rcx, qword [rbp - 0x29]
test rcx, rcx
jne 0x140024b70
lea rdx, str.operator_SCM_HANDLE__
lea rcx, [rbp + 7]
call fcn.14002490c
lea rdx, [0x140062b38]
lea rcx, [rbp + 7]
call fcn.140028338
int3
lea rdx, [rbp + 0x1f]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140024b86
cmp dword [rbp + 0x23], 4
jne 0x140024b86
mov dword [rdi], ebx
xor ecx, ecx
xchg qword [rbp - 0x29], rcx
test rcx, rcx
je 0x140024b98
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
xor ecx, ecx
xchg qword [rbp - 0x21], rcx
test rcx, rcx
je 0x140024ba9
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140026390
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x140024bcc
Capabilities:
Create service

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x140065010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov r8d, 3
lea rdx, str.ServicesActive
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
xor edi, edi
test rax, rax
je 0x140024de9
mov qword [rbp - 0x39], rax
mov qword [rbp + 0x1f], rdi
mov qword [rbp + 0x27], rdi
mov qword [rbp + 0x1f], rdi
mov qword [rbp + 0x27], 7
mov word [rbp + 0xf], di
lea rcx, [rbp - 0x29]
call fcn.14002fe80
test eax, eax
jne 0x140024dc9
mov rdx, qword [rbp - 0x29]
test rdx, rdx
je 0x140024dc9
lea rcx, [rbp + 0xf]
call fcn.14000346c
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 8
cmovae rdx, qword [rbp + 0xf]
or r10, 0xffffffffffffffff
mov qword [rbp - 0x19], r10
mov rax, qword [rbp + 0x1f]
test rax, rax
je 0x140024cb2
dec rax
mov qword [rbp - 0x21], rax
lea rcx, [rbp - 0x21]
lea r8, [rbp - 0x19]
cmp rax, r10
cmovae rcx, r8
mov rax, qword [rcx]
lea r9, [rdx + rax*2]
jmp 0x140024ca3
cmp r9, rdx
je 0x140024cb2
sub r9, 2
cmp word [r9], 0x5c
jne 0x140024c9a
sub r9, rdx
sar r9, 1
jmp 0x140024cb5
mov r9, r10
cmp r9, r10
je 0x140024dc9
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
call fcn.1400253d8
mov rbx, rax
lea rax, [rbp + 0xf]
cmp rax, rbx
je 0x140024cfe
lea rcx, [rbp + 0xf]
call fcn.1400033dc
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0xf], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x1f], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
lea rcx, [rbp + 0x2f]
call fcn.1400033dc
lea rdx, [0x140052b58]
lea rcx, [rbp + 0xf]
call fcn.140003188
lea rdx, str.VSPerfSrv.exe
lea rcx, [rbp + 0xf]
call fcn.140003188
lea rax, [rbp + 0xf]
cmp qword [rbp + 0x27], 8
cmovae rax, qword [rbp + 0xf]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
jne 0x140024d5f
lea rdx, str.operator_SCM_HANDLE__
lea rcx, [rbp - 9]
call fcn.14002490c
lea rdx, [0x140062b38]
lea rcx, [rbp - 9]
call fcn.140028338
int3
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov ebx, 1
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
mov r9d, 0xf01ff
lea rdx, str.VSPerfSrv
mov r8, rdx
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
je 0x140024dc9
mov qword [rbp - 0x31], rax
mov rcx, rdi
xchg qword [rbp - 0x31], rcx
test rcx, rcx
je 0x140024dcb
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140024dcb
mov ebx, edi
lea rcx, [rbp + 0xf]
call fcn.1400033dc
nop
mov rcx, rdi
xchg qword [rbp - 0x39], rcx
test rcx, rcx
je 0x140024de7
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140026390
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140025174
Capabilities:
Delete service

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov r8d, 3
lea rdx, str.ServicesActive
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
je 0x14002524e
mov qword [rbp + 0x18], rax
mov rcx, qword [rbp + 0x18]
test rcx, rcx
jne 0x1400251d7
lea rdx, str.operator_SCM_HANDLE__
lea rcx, [rbp - 0x38]
call fcn.14002490c
lea rdx, [0x140062b38]
lea rcx, [rbp - 0x38]
call fcn.140028338
int3
mov r8d, 0x20010084
lea rdx, str.VSPerfSrv
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
jne 0x1400251f3
xor ebx, ebx
jmp 0x14002523b
mov qword [rbp + 0x10], rax
mov rcx, qword [rbp + 0x10]
test rcx, rcx
jne 0x140025221
lea rdx, str.operator_SCM_HANDLE__
lea rcx, [rbp - 0x20]
call fcn.14002490c
lea rdx, [0x140062b38]
lea rcx, [rbp - 0x20]
call fcn.140028338
int3
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebx, eax
xor ecx, ecx
xchg qword [rbp + 0x10], rcx
test rcx, rcx
je 0x14002523b
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
xor ecx, ecx
xchg qword [rbp + 0x18], rcx
test rcx, rcx
je 0x14002524c
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret
Function at 0x14002525c
Capabilities:
Modify service

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov ebx, ecx
lea eax, [rcx - 2]
mov r8d, 1
cmp eax, r8d
jbe 0x140025291
mov eax, 0x80070057
jmp 0x1400253c6
lea rdx, str.ServicesActive
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
jne 0x1400252bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x1400253c6
mov qword [rbp + 0x77], rax
mov rcx, qword [rbp + 0x77]
test rcx, rcx
jne 0x1400252ed
lea rdx, str.operator_SCM_HANDLE__
lea rcx, [rbp + 0x1f]
call fcn.14002490c
lea rdx, [0x140062b38]
lea rcx, [rbp + 0x1f]
call fcn.140028338
int3
mov r8d, 2
lea rdx, str.VSPerfSrv
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
jne 0x14002531e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400253b3
mov qword [rbp + 0x6f], rax
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
jne 0x14002534c
lea rdx, str.operator_SCM_HANDLE__
lea rcx, [rbp + 0x37]
call fcn.14002490c
lea rdx, [0x140062b38]
lea rcx, [rbp + 0x37]
call fcn.140028338
int3
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
or edx, 0xffffffff
mov r9d, edx
mov r8d, ebx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x14002539f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400253a1
xor ebx, ebx
xor ecx, ecx
xchg qword [rbp + 0x6f], rcx
test rcx, rcx
je 0x1400253b3
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
xor ecx, ecx
xchg qword [rbp + 0x77], rcx
test rcx, rcx
je 0x1400253c4
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rbp
ret