joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401ab170
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rax, qword [0x14042f270]
mov r13, rcx
lea rcx, [0x14042f270]
mov rdi, r9
mov rbx, r8
mov rbp, rdx
call qword [rax + 0x18]
mov rdx, rbp
mov rcx, r13
add rax, 0x18
mov qword [rsp + 0x20], rax
call fcn.1401aaf20
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov r9, rbp
mov rcx, r13
mov qword [rsp + 0x28], rax
call fcn.1401ab070
mov rdx, rbp
mov rcx, r13
call fcn.1401aaf20
mov esi, dword [rdi]
mov edx, 0xd
sub esi, dword [rbx]
mov rbx, qword [rsp + 0x20]
mov r12d, dword [rbx - 0x10]
mov rcx, rbx
add esi, eax
call fcn.140252630
or edi, 0xffffffff
test rax, rax
jne 0x1401ab206
mov eax, edi
jmp 0x1401ab20c
sub rax, rbx
sar rax, 1
lea rcx, [rsp + 0x20]
mov r8d, r12d
mov edx, eax
call fcn.1400a53b0
mov eax, esi
lea rcx, [rsp + 0x20]
cdq
sub eax, edx
xor edx, edx
sar eax, 1
mov r8d, eax
call fcn.1400a53b0
mov rbx, qword [rsp + 0x20]
mov esi, dword [rbx - 0x10]
test esi, esi
jg 0x1401ab241
mov eax, edi
jmp 0x1401ab25d
mov edx, 0xd
mov rcx, rbx
call fcn.140257c6c
test rax, rax
jne 0x1401ab257
mov eax, edi
jmp 0x1401ab25d
sub rax, rbx
sar rax, 1
lea r8d, [rax + 1]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r9d, esi
call fcn.140042880
add rbx, 0xffffffffffffffe8
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
cmp rcx, rbx
je 0x1401ab2cc
cmp dword [rbx + 0x10], 0
jl 0x1401ab2be
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1401ab2be
call fcn.1400026b0
mov ecx, edi
mov rsi, rax
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1401ab2b3
mov rcx, qword [rbx]
mov rdx, rbx
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x20], rax
jmp 0x1401ab2cc
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.140002560
mov rdx, qword [rsp + 0x30]
mov eax, edi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401ab2eb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
mov r8, rbp
mov rcx, r13
call fcn.1401aafb0
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
dec edi
test edi, edi
jg 0x1401ab321
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x1401ab790
Capabilities:
Read http header
Receive http response

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
mov qword [rbp - 0x69], 0xfffffffffffffffe
mov qword [rsp + 0x148], rbx
mov rax, qword [0x140437340]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov esi, r8d
mov r12, rdx
mov r14, rcx
mov ecx, r8d
call fcn.140218cbc
mov rbx, rax
mov qword [rbp - 0x61], rax
mov dword [rsp + 0x30], 1
xor r15d, r15d
mov word [rbp - 0x29], r15w
xor eax, eax
mov qword [rbp - 0x27], rax
mov qword [rbp - 0x1f], rax
mov qword [rbp - 0x17], rax
mov qword [rbp - 0xf], rax
mov qword [rbp - 7], rax
mov qword [rbp + 1], rax
mov qword [rbp + 9], rax
mov dword [rbp + 0x11], eax
mov word [rbp + 0x15], ax
mov dword [rsp + 0x34], 0x40
mov edi, r15d
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x29]
xor r8d, r8d
lea edx, [r15 + 5]
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x1401ab8b2
mov qword [rbp - 0x41], 0xf
mov qword [rbp - 0x49], r15
mov byte [rbp - 0x59], dil
lea r8d, [r15 + 0x78]
lea rdx, str.Error_by_receiving_data_from_server___asynchronously__._Available_data_size_is_unknown._Cant_get_content_length_header.
lea rcx, [rbp - 0x59]
call fcn.1400243d0
nop
lea rax, [rbp - 0x59]
cmp qword [rbp - 0x41], 0x10
cmovae rax, qword [rbp - 0x59]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.140251b88
lea r11, vtable.Cxx::Network::Exception::CNetworkException.0
mov qword [rsp + 0x40], r11
mov dword [rbp - 0x71], 7
lea rdx, [0x1403df7a0]
lea rcx, [rsp + 0x40]
call fcn.1402510b4
nop
lea rcx, [rbp - 0x29]
call fcn.1402543c8
mov r13d, eax
cmp dword [rsp + 0x30], edi
je 0x1401ab98f
nop dword [rax + rax]
lea r9, [rsp + 0x30]
mov r8d, esi
mov rdx, rbx
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x1401ab921
mov r9d, dword [rsp + 0x30]
add edi, r9d
test r9d, r9d
je 0x1401ab98f
mov rax, qword [r12]
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], edi
mov r8d, esi
mov rdx, rbx
mov rcx, r12
call qword [rax]
test al, al
je 0x1401ab91f
cmp dword [rsp + 0x30], r15d
jne 0x1401ab8d0
jmp 0x1401ab98f
jmp 0x1401ab98f
mov qword [rbp - 0x41], 0xf
mov qword [rbp - 0x49], r15
mov byte [rbp - 0x59], r15b
mov r8d, 0x37
lea rdx, str.Error_by_receiving_data_from_server___asynchronously__.
lea rcx, [rbp - 0x59]
call fcn.1400243d0
nop
lea rax, [rbp - 0x59]
cmp qword [rbp - 0x41], 0x10
cmovae rax, qword [rbp - 0x59]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.140251b88
lea r11, vtable.Cxx::Network::Exception::CNetworkException.0
mov qword [rsp + 0x40], r11
mov dword [rbp - 0x71], 7
lea rdx, [0x1403df7a0]
lea rcx, [rsp + 0x40]
call fcn.1402510b4
nop
mov rcx, rbx
call fcn.1402512b0
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140250fd0
mov rbx, qword [rsp + 0x148]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401abf50
Capabilities:
Prepare http request
Receive http response

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0xa0
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
mov rax, qword [0x140437340]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x30], edi
mov qword [r11 - 0x80], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, qword [rdx]
lea rdx, [0x140340bc8]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x1401ac016
mov qword [rbp + 0x3f], 0xf
mov qword [rbp + 0x37], rdi
mov byte [rbp + 0x27], dil
lea r8d, [rdi + 0x23]
lea rdx, str.Cant_create_request_to_the_server.
lea rcx, [rbp + 0x27]
call fcn.1400243d0
nop
lea rax, [rbp + 0x27]
cmp qword [rbp + 0x3f], 0x10
cmovae rax, qword [rbp + 0x27]
mov qword [rbp - 9], rax
lea rdx, [rbp - 9]
lea rcx, [rbp - 1]
call fcn.140251b88
lea r11, vtable.Cxx::Network::Exception::CNetworkException.0
mov qword [rbp - 1], r11
mov dword [rbp + 0x17], 7
lea rdx, [0x1403df7a0]
lea rcx, [rbp - 1]
call fcn.1402510b4
nop
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x1401ac09f
mov qword [rbp + 0x3f], 0xf
mov qword [rbp + 0x37], rdi
mov byte [rbp + 0x27], dil
lea r8d, [rax + 0x21]
lea rdx, str.Cant_send_request_to_the_server.
lea rcx, [rbp + 0x27]
call fcn.1400243d0
nop
lea rax, [rbp + 0x27]
cmp qword [rbp + 0x3f], 0x10
cmovae rax, qword [rbp + 0x27]
mov qword [rbp - 9], rax
lea rdx, [rbp - 9]
lea rcx, [rbp - 1]
call fcn.140251b88
lea r11, vtable.Cxx::Network::Exception::CNetworkException.0
mov qword [rbp - 1], r11
mov dword [rbp + 0x17], 7
lea rdx, [0x1403df7a0]
lea rcx, [rbp - 1]
call fcn.1402510b4
nop
xor edx, edx
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x1401ac116
mov qword [rbp + 0x3f], 0xf
mov qword [rbp + 0x37], rdi
mov byte [rbp + 0x27], dil
lea r8d, [rax + 0x24]
lea rdx, str.Cant_receive_request_to_the_server.
lea rcx, [rbp + 0x27]
call fcn.1400243d0
nop
lea rax, [rbp + 0x27]
cmp qword [rbp + 0x3f], 0x10
cmovae rax, qword [rbp + 0x27]
mov qword [rbp - 9], rax
lea rdx, [rbp - 9]
lea rcx, [rbp - 1]
call fcn.140251b88
lea r11, vtable.Cxx::Network::Exception::CNetworkException.0
mov qword [rbp - 1], r11
mov dword [rbp + 0x17], 7
lea rdx, [0x1403df7a0]
lea rcx, [rbp - 1]
call fcn.1402510b4
nop
mov dword [rbp - 9], edi
mov rax, qword [rbx]
lea r9, [rbp - 9]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140250fd0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1401ac190
Capabilities:
Send data
Send http request

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov qword [rbp - 0x69], 0xfffffffffffffffe
mov rax, qword [0x140437340]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rsi, r8
mov rdi, rcx
xor r12d, r12d
mov dword [rsp + 0x48], r12d
mov rcx, qword [rdx]
sub rcx, 0x18
call fcn.1400026b0
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
test rsi, rsi
je 0x1401ac213
lea rdx, [0x140340c70]
lea rcx, [rsp + 0x40]
call fcn.140194650
mov r11, qword [rsi]
lea rdx, [rsp + 0x48]
mov rcx, rsi
call qword [r11 + 0x10]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140194650
mov rbx, qword [rsp + 0x40]
mov edx, 0x1bb
mov eax, 0x80000000
mov ecx, 0x80800000
cmp word [rdi + 0x28], dx
cmove eax, ecx
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rbx
lea rdx, [0x140340bc8]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.WININET.dll_HttpOpenRequestW]
mov qword [rdi + 0x18], rax
test rax, rax
jne 0x1401ac2c2
mov qword [rbp - 9], 0xf
mov qword [rbp - 0x11], r12
mov byte [rbp - 0x21], al
lea r8d, [rax + 0x23]
lea rdx, str.Cant_create_request_to_the_server.
lea rcx, [rbp - 0x21]
call fcn.1400243d0
nop
lea rax, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rax, qword [rbp - 0x21]
mov qword [rbp - 0x79], rax
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x41]
call fcn.140251b88
lea r11, vtable.Cxx::Network::Exception::CNetworkException.0
mov qword [rbp - 0x41], r11
mov dword [rbp - 0x29], 7
lea rdx, [0x1403df7a0]
lea rcx, [rbp - 0x41]
call fcn.1402510b4
nop
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
jne 0x1401ac34b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbp + 0x1f], 0xf
mov qword [rbp + 0x17], r12
mov byte [rbp + 7], 0
mov r8d, 0x21
lea rdx, str.Cant_send_request_to_the_server.
lea rcx, [rbp + 7]
call fcn.1400243d0
nop
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rax, qword [rbp + 7]
mov qword [rbp - 0x71], rax
lea rdx, [rbp - 0x71]
lea rcx, [rbp - 0x61]
call fcn.140251b88
lea r11, vtable.Cxx::Network::Exception::CNetworkException.0
mov qword [rbp - 0x61], r11
mov dword [rbp - 0x49], 7
lea rdx, [0x1403df7a0]
lea rcx, [rbp - 0x61]
call fcn.1402510b4
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401ac366
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140250fd0
add rsp, 0x100
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1401ac630
Capabilities:
Connect to http server
Create http request

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov qword [rbp - 1], 0xfffffffffffffffe
mov rax, qword [0x140437340]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rsi, r9
mov rdi, r8
mov rax, rdx
mov rbx, rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rax]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rbx + 8], rax
test rax, rax
jne 0x1401ac6ef
mov qword [rbp + 0x1f], 0xf
mov qword [rbp + 0x17], r12
mov byte [rbp + 7], r12b
lea r8d, [r12 + 0x29]
lea rdx, str.Cant_open_http_connection_to_the_server.
lea rcx, [rbp + 7]
call fcn.1400243d0
nop
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rax, qword [rbp + 7]
mov qword [rbp - 0x29], rax
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x21]
call fcn.140251b88
lea r11, vtable.Cxx::Network::Exception::CNetworkException.0
mov qword [rbp - 0x21], r11
mov dword [rbp - 9], 7
lea rdx, [0x1403df7a0]
lea rcx, [rbp - 0x21]
call fcn.1402510b4
nop
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r12
xor r9d, r9d
movzx r8d, word [rsi]
mov rdx, qword [rdi]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetConnectW]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1401ac789
mov qword [rbp + 0x1f], 0xf
mov qword [rbp + 0x17], r12
mov byte [rbp + 7], r12b
lea r8d, [rax + 0x1c]
lea rdx, str.Cant_connect_to_the_server.
lea rcx, [rbp + 7]
call fcn.1400243d0
nop
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rax, qword [rbp + 7]
mov qword [rbp - 0x29], rax
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x21]
call fcn.140251b88
lea r11, vtable.Cxx::Network::Exception::CNetworkException.0
mov qword [rbp - 0x21], r11
mov dword [rbp - 9], 7
lea rdx, [0x1403df7a0]
lea rcx, [rbp - 0x21]
call fcn.1402510b4
nop
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140250fd0
add rsp, 0xa0
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1401ac7b0
Capabilities:
Read data from internet
Receive data

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
mov qword [rbp - 0x69], 0xfffffffffffffffe
mov qword [rsp + 0x148], rbx
mov rax, qword [0x140437340]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov esi, r8d
mov r12, rdx
mov r14, rcx
mov ecx, r8d
call fcn.140218cbc
mov rbx, rax
mov qword [rbp - 0x61], rax
mov dword [rsp + 0x30], 1
xor r15d, r15d
mov word [rbp - 0x29], r15w
xor eax, eax
mov qword [rbp - 0x27], rax
mov qword [rbp - 0x1f], rax
mov qword [rbp - 0x17], rax
mov qword [rbp - 0xf], rax
mov qword [rbp - 7], rax
mov qword [rbp + 1], rax
mov qword [rbp + 9], rax
mov dword [rbp + 0x11], eax
mov word [rbp + 0x15], ax
mov dword [rsp + 0x34], 0x40
mov edi, r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x34]
lea r8, [rbp - 0x29]
lea edx, [rax + 5]
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x1401ac8c9
mov qword [rbp - 0x41], 0xf
mov qword [rbp - 0x49], r15
mov byte [rbp - 0x59], dil
lea r8d, [r15 + 0x78]
lea rdx, str.Error_by_receiving_data_from_server___asynchronously__._Available_data_size_is_unknown._Cant_get_content_length_header.
lea rcx, [rbp - 0x59]
call fcn.1400243d0
nop
lea rax, [rbp - 0x59]
cmp qword [rbp - 0x41], 0x10
cmovae rax, qword [rbp - 0x59]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.140251b88
lea r11, vtable.Cxx::Network::Exception::CNetworkException.0
mov qword [rsp + 0x40], r11
mov dword [rbp - 0x71], 7
lea rdx, [0x1403df7a0]
lea rcx, [rsp + 0x40]
call fcn.1402510b4
nop
lea rcx, [rbp - 0x29]
call fcn.1402543c8
mov r13d, eax
cmp dword [rsp + 0x30], edi
je 0x1401ac99f
nop
lea r9, [rsp + 0x30]
mov r8d, esi
mov rdx, rbx
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1401ac931
mov r9d, dword [rsp + 0x30]
add edi, r9d
test r9d, r9d
je 0x1401ac99f
mov rax, qword [r12]
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], edi
mov r8d, esi
mov rdx, rbx
mov rcx, r12
call qword [rax]
test al, al
je 0x1401ac92f
cmp dword [rsp + 0x30], r15d
jne 0x1401ac8e0
jmp 0x1401ac99f
jmp 0x1401ac99f
mov qword [rbp - 0x41], 0xf
mov qword [rbp - 0x49], r15
mov byte [rbp - 0x59], r15b
mov r8d, 0x37
lea rdx, str.Error_by_receiving_data_from_server___asynchronously__.
lea rcx, [rbp - 0x59]
call fcn.1400243d0
nop
lea rax, [rbp - 0x59]
cmp qword [rbp - 0x41], 0x10
cmovae rax, qword [rbp - 0x59]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.140251b88
lea r11, vtable.Cxx::Network::Exception::CNetworkException.0
mov qword [rsp + 0x40], r11
mov dword [rbp - 0x71], 7
lea rdx, [0x1403df7a0]
lea rcx, [rsp + 0x40]
call fcn.1402510b4
nop
mov rcx, rbx
call fcn.1402512b0
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140250fd0
mov rbx, qword [rsp + 0x148]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401accd0
Capabilities:
Modify service
Query service status
Start service

Disassembly:
push rbp
sub rsp, 0x90
mov rax, qword [0x140437340]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
je 0x1401ace61
lea rdx, str.Schedule
mov qword [rsp + 0xb0], rdi
mov r8d, 0x17
mov rcx, rax
mov qword [rsp + 0xb8], r12
xor r12b, r12b
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x1401ace3b
mov qword [rsp + 0xa0], rbx
lea r9, [rsp + 0x60]
xor ebx, ebx
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x60], ebx
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1401ace33
mov ecx, dword [rsp + 0x60]
mov qword [rsp + 0xa8], rsi
call fcn.140218cbc
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x60]
mov rdx, rax
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x1401ace1e
test byte [rsi + 4], 4
je 0x1401acddf
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea edx, [rbx + 0x10]
lea r8d, [rbx + 2]
or r9d, 0xffffffff
mov rcx, rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x1401ace1e
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov r12b, 1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
add ebx, 0x3e8
cmp dword [rsp + 0x6c], 4
je 0x1401ace1e
cmp ebx, 0x7530
jb 0x1401acdf0
test rsi, rsi
je 0x1401ace2b
mov rcx, rsi
call fcn.1402512b0
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0xb0]
movzx eax, r12b
mov r12, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140250fd0
add rsp, 0x90
pop rbp
ret
Function at 0x1401acee0
Capabilities:
Schedule task via itaskscheduler

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
xor edx, edx
mov rbx, r8
lea rax, [rsp + 0x68]
lea r9, [0x140340f28]
lea rcx, [0x14035c490]
lea r8d, [rdx + 1]
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rcx, qword [rsp + 0x68]
test eax, eax
js 0x1401acf5d
mov rdx, qword [rdi]
mov qword [rsp + 0x30], 0
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
lea r8, [0x140340f88]
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
test eax, eax
jns 0x1401acf75
test rcx, rcx
je 0x1401acf58
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1401acf68
mov rax, qword [rcx]
call qword [rax + 0x10]
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov qword [rsp + 0x38], 0
mov rax, qword [rcx]
lea r8, [rsp + 0x38]
xor edx, edx
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x38]
test eax, eax
jns 0x1401acfa6
test rcx, rcx
je 0x1401acf9f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x30]
jmp 0x1401acf4d
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x38]
test eax, eax
js 0x1401acf94
test rcx, rcx
je 0x1401acfc3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1401acfd3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1401acfe3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1401ad170
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor edx, edx
lea rax, [rsp + 0x50]
lea r9, [0x140340f28]
lea rcx, [0x14035c490]
lea r8d, [rdx + 1]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rcx, qword [rsp + 0x50]
test eax, eax
jns 0x1401ad1c2
test rcx, rcx
je 0x1401ad1ba
mov rax, qword [rcx]
call qword [rax + 0x10]
xor al, al
add rsp, 0x30
pop rbx
ret
mov rax, qword [rcx]
mov rdx, qword [rbx]
call qword [rax + 0x38]
mov rcx, qword [rsp + 0x50]
test eax, eax
js 0x1401ad1af
test rcx, rcx
je 0x1401ad1df
mov rax, qword [rcx]
call qword [rax + 0x10]
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x1401ad1f0
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor edx, edx
lea rax, [rsp + 0x50]
lea r9, [0x140340f28]
lea rcx, [0x14035c490]
lea r8d, [rdx + 1]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rcx, qword [rsp + 0x50]
test eax, eax
js 0x1401ad266
mov rdx, qword [rbx]
mov qword [rsp + 0x58], 0
mov rax, qword [rcx]
lea r9, [rsp + 0x58]
lea r8, [0x140340f88]
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x58]
test eax, eax
jns 0x1401ad279
test rcx, rcx
je 0x1401ad261
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1401ad271
mov rax, qword [rcx]
call qword [rax + 0x10]
xor al, al
add rsp, 0x30
pop rbx
ret
test rcx, rcx
je 0x1401ad284
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1401ad294
mov rax, qword [rcx]
call qword [rax + 0x10]
mov al, 1
add rsp, 0x30
pop rbx
ret

Function at 0x1401ad2a0
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rdx
xor edx, edx
lea rax, [rsp + 0x50]
lea r9, [0x140340f28]
lea rcx, [0x14035c490]
lea r8d, [rdx + 1]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x1401ad2f2
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1401ad2ea
mov rax, qword [rcx]
call qword [rax + 0x10]
xor al, al
add rsp, 0x30
pop rdi
ret
mov rax, qword [rdi + 8]
mov qword [rsp + 0x40], rbx
mov rbx, qword [rax]
cmp rbx, rax
je 0x1401ad374
nop word [rax + rax]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rbx + 0x18]
mov rax, qword [rcx]
call qword [rax + 0x38]
cmp byte [rbx + 0x21], 0
jne 0x1401ad36e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x21], 0
jne 0x1401ad34e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x21], 0
jne 0x1401ad36e
nop dword [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x21], 0
je 0x1401ad340
jmp 0x1401ad36e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x21], 0
jne 0x1401ad36b
cmp rbx, qword [rax + 0x10]
jne 0x1401ad36b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x21], 0
je 0x1401ad358
mov rbx, rax
cmp rbx, qword [rdi + 8]
jne 0x1401ad310
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test rcx, rcx
je 0x1401ad389
mov rax, qword [rcx]
call qword [rax + 0x10]
mov al, 1
add rsp, 0x30
pop rdi
ret