joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c7ee0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c811b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
nop
call sym.crypto_internal_boring_sig.StandardCrypto.abi0
xorps xmm15, xmm15
mov r14, qword [0x00639230]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x4c802a
nop dword [rax]
cmp rdx, 0x40
ja 0x4c810d
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x4c7f99
mov rax, rdx
mov rcx, rsi
nop
call sym.runtime.memmove
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x4c8001
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call sym.crypto_sha256.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x00639230]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x4c8102
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rax
sub r8, rsi
add rbx, rdx
jmp 0x4c8037
mov r8, rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
cmp r8, 0x40
jl 0x4c80b5
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call sym.crypto_sha256.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x00639230]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x30]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test r8, r8
je 0x4c80f8
lea rdx, [rcx + 0x20]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
cmp rbx, rdx
je 0x4c80f4
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
nop dword [rax + rax]
call sym.runtime.memmove
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rcx, rax
mov rax, rsi
call sym.runtime.panicSliceB
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicSliceB
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.crypto_sha256._digest_.Write
Function at 0x4cfb80
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4cfb97
inc rax
cmp rax, 4
jge 0x4cfbaf
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4cfb94
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4cfbc0
inc rax
cmp rax, 4
jge 0x4cfbce
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4cfbf7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4cfbdb
jmp 0x4cfbbd
Function at 0x14000dc80
Capabilities:
Delete file
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x4b8
mov rax, qword [0x14004b078]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov edx, 0x104
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdx, str.Prefetch_
lea rcx, [rsp + 0x170]
call fcn.14001c490
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x280]
call fcn.14001c530
lea rdx, [0x14003565c]
lea rcx, [rsp + 0x280]
call fcn.14001c490
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x14000dd79
mov rdx, qword [rsp + 0x4c0]
lea rcx, [rsp + 0x5c]
call fcn.1400116f0
test rax, rax
je 0x14000dd5a
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x390]
call fcn.14001c530
lea rdx, [rsp + 0x5c]
lea rcx, [rsp + 0x390]
call fcn.14001c490
lea rcx, [rsp + 0x390]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14000dd0e
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.140015310
add rsp, 0x4b8
ret
Function at 0x14000e150
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x4198
call fcn.1400152a0
sub rsp, rax
mov rax, qword [0x14004b078]
xor rax, rsp
mov qword [rsp + 0x4180], rax
mov dword [rsp + 0x44], 0
mov byte [rsp + 0x40], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0x41a8]
mov rcx, qword [rsp + 0x41a0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14000e343
mov dword [rsp + 0x70], 0
mov dword [rsp + 0x48], 0
xor eax, eax
cmp eax, 1
je 0x14000e32f
mov dword [rsp + 0x4c], 0xff
mov eax, 1
imul rax, rax, 0
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0xff
jae 0x14000e206
jmp 0x14000e20b
call fcn.140014ff8
mov rax, qword [rsp + 0x68]
mov byte [rsp + rax + 0x80], 0
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x50], eax
mov r9d, dword [rsp + 0x4c]
lea r8, [rsp + 0x80]
mov edx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x44], 0
jne 0x14000e328
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14000e322
mov dword [rsp + 0x54], 0x3fff
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x180]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x10000006
mov r8, qword [rsp + 0x41b0]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14000e315
mov rdx, qword [rsp + 0x41b8]
lea rcx, [rsp + 0x180]
call fcn.1400116f0
test rax, rax
je 0x14000e315
lea rdx, [rsp + 0x180]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x14000e315
mov byte [rsp + 0x40], 0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000e326
xor al, al
jmp 0x14000e345
jmp 0x14000e32a
jmp 0x14000e32f
jmp 0x14000e1d8
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [rsp + 0x40]
jmp 0x14000e345
xor al, al
mov rcx, qword [rsp + 0x4180]
xor rcx, rsp
call fcn.140015310
add rsp, 0x4198
ret
Function at 0x14000e360
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x4088
call fcn.1400152a0
sub rsp, rax
mov rax, qword [0x14004b078]
xor rax, rsp
mov qword [rsp + 0x4070], rax
mov dword [rsp + 0x44], 0
mov byte [rsp + 0x40], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0x4098]
mov rcx, qword [rsp + 0x4090]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14000e539
mov dword [rsp + 0x48], 0
xor eax, eax
cmp eax, 1
je 0x14000e525
mov dword [rsp + 0x4c], 0x3fff
mov dword [rsp + 0x4c], 0x3fff
mov eax, 1
imul rax, rax, 0
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0x3fff
jae 0x14000e416
jmp 0x14000e41b
call fcn.140014ff8
mov rax, qword [rsp + 0x60]
mov byte [rsp + rax + 0x70], 0
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x70]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x44], 0
jne 0x14000e4be
mov rdx, qword [rsp + 0x40a0]
lea rcx, [rsp + 0x70]
call fcn.1400116f0
test rax, rax
je 0x14000e4bc
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x14000e4ba
mov byte [rsp + 0x40], 0
jmp 0x14000e525
jmp 0x14000e525
jmp 0x14000e520
movzx eax, byte [rsp + 0x40a8]
test eax, eax
je 0x14000e51e
mov dword [rsp + 0x48], 0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0x4098]
mov rcx, qword [rsp + 0x4090]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x14000e517
xor al, al
jmp 0x14000e53b
jmp 0x14000e3e0
jmp 0x14000e525
jmp 0x14000e3e0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [rsp + 0x40]
jmp 0x14000e53b
xor al, al
mov rcx, qword [rsp + 0x4070]
xor rcx, rsp
call fcn.140015310
add rsp, 0x4088
ret
Function at 0x14000e560
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x4198
call fcn.1400152a0
sub rsp, rax
mov rax, qword [0x14004b078]
xor rax, rsp
mov qword [rsp + 0x4180], rax
mov dword [rsp + 0x44], 0
mov byte [rsp + 0x40], 1
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0x41a8]
mov rcx, qword [rsp + 0x41a0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14000e7a6
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x48], 0
xor eax, eax
cmp eax, 1
je 0x14000e792
mov dword [rsp + 0x50], 0xff
mov eax, 1
imul rax, rax, 0
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0xff
jae 0x14000e611
jmp 0x14000e616
call fcn.140014ff8
mov rax, qword [rsp + 0x70]
mov byte [rsp + rax + 0x80], 0
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x54], eax
mov r9d, dword [rsp + 0x50]
lea r8, [rsp + 0x80]
mov edx, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x44], 0
jne 0x14000e78b
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14000e785
xor eax, eax
cmp eax, 1
je 0x14000e778
mov dword [rsp + 0x58], 0x3fff
mov eax, 1
imul rax, rax, 0
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0x3fff
jae 0x14000e6c3
jmp 0x14000e6c8
call fcn.140014ff8
mov rax, qword [rsp + 0x78]
mov byte [rsp + rax + 0x180], 0
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x5c], eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x180]
mov edx, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x44], 0
jne 0x14000e771
mov rdx, qword [rsp + 0x41b0]
lea rcx, [rsp + 0x180]
call fcn.1400116f0
test rax, rax
je 0x14000e76f
lea rdx, [rsp + 0x180]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x14000e76f
mov byte [rsp + 0x40], 0
jmp 0x14000e773
jmp 0x14000e778
jmp 0x14000e695
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000e789
xor al, al
jmp 0x14000e7a8
jmp 0x14000e78d
jmp 0x14000e792
jmp 0x14000e5e3
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [rsp + 0x40]
jmp 0x14000e7a8
xor al, al
mov rcx, qword [rsp + 0x4180]
xor rcx, rsp
call fcn.140015310
add rsp, 0x4198
ret
Function at 0x14000e930
Capabilities:
Terminate process

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x14004b078]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov byte [rsp + 0x20], 0
movzx r8d, byte [rsp + 0x21]
lea rdx, str.TslGame.exe
lea rcx, [rsp + 0x78]
call fcn.140005980
mov rcx, rax
call fcn.14000f560
mov rcx, rax
call fcn.14000fd30
mov dword [rsp + 0x28], eax
movzx r8d, byte [rsp + 0x22]
lea rdx, str.TslGame_BE.exe
lea rcx, [rsp + 0x98]
call fcn.140005150
mov rcx, rax
call fcn.14000f6a0
mov rcx, rax
call fcn.14000fd30
mov dword [rsp + 0x2c], eax
movzx r8d, byte [rsp + 0x23]
lea rdx, str.BEService.exe
lea rcx, [rsp + 0x88]
call fcn.1400055a0
mov rcx, rax
call fcn.14000f600
mov rcx, rax
call fcn.14000fd30
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x28], 0
je 0x14000ea1b
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x14000ea16
mov edx, 9
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x20], 1
cmp dword [rsp + 0x2c], 0
je 0x14000ea61
mov r8d, dword [rsp + 0x2c]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x14000ea5c
mov edx, 9
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x20], 1
cmp dword [rsp + 0x30], 0
je 0x14000eaa7
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000eaa2
mov edx, 9
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x20], 1
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14000eafd
movzx r8d, byte [rsp + 0x24]
lea rdx, str.Start_as_admin_n
lea rcx, [rsp + 0xa8]
call fcn.1400047f0
mov rcx, rax
call fcn.14000f740
mov rcx, rax
call fcn.140011db0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
jmp 0x14000eb77
movzx r8d, byte [rsp + 0x25]
lea rdx, str.BEDaisy
lea rcx, [rsp + 0x58]
call fcn.140006160
mov rcx, rax
call fcn.14000ede0
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call fcn.140010d60
test eax, eax
je 0x14000eb32
mov byte [rsp + 0x20], 1
movzx r8d, byte [rsp + 0x26]
lea rdx, str.BEService
lea rcx, [rsp + 0x68]
call fcn.140005e80
mov rcx, rax
call fcn.14000ef20
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call fcn.140010d60
test eax, eax
je 0x14000eb67
mov byte [rsp + 0x20], 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140015310
add rsp, 0xd8
ret
Function at 0x14000fd30
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x178
mov rax, qword [0x14004b078]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor edx, edx
mov ecx, 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x130
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32First
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14000fdbd
mov rdx, qword [rsp + 0x180]
lea rcx, [rsp + 0x5c]
call fcn.14001c600
test eax, eax
jne 0x14000fda8
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
jmp 0x14000fdca
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32Next
mov dword [rsp + 0x20], eax
jmp 0x14000fd7a
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140015310
add rsp, 0x178
ret

Function at 0x140010d60
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14004b078]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], 0
mov r8d, 0xf01ff
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140010dae
mov eax, dword [rsp + 0x20]
jmp 0x140010e1a
mov dword [rsp + 0x24], 3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, [rsp + 0x30]
mov edx, 1
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140010de0
jmp 0x140010e0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x41b
je 0x140010def
jmp 0x140010e0b
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x24]
dec eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jne 0x140010db6
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140015310
add rsp, 0x68
ret
Function at 0x1400142d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400142f5
xor eax, eax
jmp 0x140014405
cmp qword [rcx + 0x68], 0
je 0x140014309
lfence
call fcn.140011a80
jmp 0x140014405
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov qword [rsp + 0x60], rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x140014325
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140014327
xor ecx, ecx
movsxd rax, ecx
mov rbx, rdi
test ecx, ecx
je 0x140014361
cmp rax, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.140015f00
mov rax, qword [rsi + 0x50]
sub rbp, rbx
add r14, rbx
mov qword [rsp + 0x60], rbp
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
mov rbx, rbp
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400143fa
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14001439c
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
cmp rbx, r15
jbe 0x1400143d6
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call fcn.14001e0ec
sub rbp, rax
add r14, rax
mov qword [rsp + 0x60], rbp
mov rbx, rbp
cmp rax, r15
jne 0x1400143fa
cmp rbp, r15
ja 0x1400143a7
test rbx, rbx
je 0x1400143fa
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.14001e0ec
sub rbx, rax
mov qword [rsp + 0x60], rbx
lfence
sub rdi, qword [rsp + 0x60]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400222f0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14002211c
Function at 0x1400c3350
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x1400c33e0
jmp 0x1400c33cf
jae 0x1400c34a0
cmp r8, 0x201
jae 0x1400c33e0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x1400c3438
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x1400c340f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.1400d9730
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x1400c3461
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400c3508
mov r8d, r14d
cmp r15, r8
jne 0x1400c33c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400c352b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x1400c33cf
jmp 0x1400c33e0
cmp rsi, r8
jb 0x1400c3545
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.1400c5160
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x1400c34f1
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.1400c0a70
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x1400c34d9
jmp 0x1400c34f1
lea rcx, str.internal_error:_entered_unreachable_code_rustc_65ea825f4021eaf77f1b25139969712d65b435a4library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.1400da210
jmp 0x1400c355a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1400da660
ud2
Function at 0x1400ca3b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x1400dc9b8]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x1400ca3f4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400ca45a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1400ca491
test eax, eax
js 0x1400ca46b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400ca484
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1400c4d00
mov rcx, rax
call fcn.1400c1340
mov ecx, 7
int 0x29
ud2