joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140079780
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x138
mov rsi, rcx
mov rax, qword [0x1401e3a68]
xor rax, rsp
mov qword [rsp + 0x130], rax
mfence
mov rax, qword [0x1401e6f58]
test rax, rax
jne 0x1400797ca
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mfence
mov rax, qword [0x1401e6f58]
test rax, rax
je 0x1400797b4
cmp eax, 2
jne 0x140079812
mov ecx, 2
call fcn.14003c410
test al, al
je 0x1400798a4
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0x83
mov r9d, 2
call fcn.14003c4c0
lea rcx, [rsp + 0x28]
lea rdx, str.crash_server_failed_to_launch__self_terminating
jmp 0x140079897
mov eax, 1
lock xadd qword [0x1401e6f90], rax
test rax, rax
jle 0x140079832
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1401e6f10], eax
mov qword [0x1401e6f08], rsi
mov rcx, qword [0x1401e3a40]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.14003c410
test al, al
je 0x1400798a4
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0xaf
mov r9d, 2
call fcn.14003c4c0
lea rcx, [rsp + 0x28]
lea rdx, str.crash_server_did_not_respond__self_terminating
call fcn.140002b70
mov rcx, rsi
call fcn.14003c960
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14014ac50
xor eax, eax
add rsp, 0x138
pop rdi
pop rsi
ret
Function at 0x14007a530
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
sub rsp, 0x20
xor ecx, ecx
lea r8, [0x1401e6fa0]
mov edx, 8
mov eax, ecx
mov esi, eax
shr esi, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, esi
dec edx
jne 0x14007a545
mov dword [r8 + rcx*4], eax
inc rcx
cmp rcx, 0x100
jne 0x14007a53e
mov eax, 0x100
mov ecx, dword [r8 + rax*4 - 0x400]
movzx edx, cl
shr ecx, 8
xor ecx, dword [r8 + rdx*4]
mov dword [r8 + rax*4], ecx
inc rax
cmp rax, 0x800
jne 0x14007a56e
lea rax, [0x1400c1a10]
mov qword [0x1401e8fa0], rax
mov qword [0x1401e6f98], rax
lea rsi, [0x1400c1ae0]
mov qword [0x1401e8fa8], rsi
call fcn.1400c1c10
test eax, eax
jne 0x14007a5c2
mov qword [0x1401e6f98], rsi
add rsp, 0x20
pop rsi
ret

Function at 0x14007a5d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r13, r8
mov r14, rdx
mov r15, rcx
mov rax, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0xf
mov rcx, r8
jbe 0x14007a5fa
mov rcx, qword [r13]
movabs rdi, 0xcbf29ce484222325
test rax, rax
je 0x14007a62d
xor edx, edx
movabs rsi, 0x100000001b3
movzx ebx, byte [rcx + rdx]
xor rbx, rdi
imul rbx, rsi
inc rdx
mov rdi, rbx
cmp rax, rdx
jne 0x14007a615
jmp 0x14007a630
mov rbx, rdi
and rbx, qword [r15 + 0x30]
lea r12, [rbx + rbx]
mov rdi, qword [r15 + 8]
mov rax, qword [r15 + 0x18]
mov rcx, rbx
shl rcx, 4
mov rsi, qword [rax + rcx]
cmp rsi, rdi
je 0x14007a685
lea rcx, [r12*8]
or rcx, 8
mov rax, qword [rax + rcx]
mov rdi, qword [rax]
jmp 0x14007a685
mov rdi, qword [rdi + 8]
lea rdx, [rdi + 0x10]
mov rcx, r13
call fcn.140013430
test al, al
jne 0x14007a6fd
mov rax, qword [r15 + 0x18]
mov rsi, qword [rax + r12*8]
cmp rsi, rdi
jne 0x14007a665
lea r12, [r15 + 8]
mov rax, qword [r12]
mov rdx, qword [rax]
mov rcx, r12
mov r8, r13
call fcn.140014180
mov rax, qword [r12]
mov r12, qword [rax]
mov rax, qword [r12]
cmp rax, rsi
je 0x14007a6e0
mov rcx, qword [r12 + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], r12
mov rcx, qword [rsi + 8]
mov rdx, qword [rax + 8]
mov qword [rsi + 8], rdx
mov rdx, qword [r12 + 8]
mov qword [rax + 8], rdx
mov qword [r12 + 8], rcx
mov rcx, r15
mov rdx, r12
mov r8, rdi
mov r9, rbx
call fcn.140014210
mov rcx, r15
call fcn.140014270
mov al, 1
jmp 0x14007a702
xor eax, eax
mov r12, rdi
mov qword [r14], r12
mov byte [r14 + 8], al
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14007c7e0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x270
mov rsi, rdx
mov edx, ecx
mov rax, qword [0x1401e3a68]
xor rax, rsp
mov qword [rsp + 0x268], rax
lea rbx, [rsp + 0x60]
mov word [rbx], 0
mov qword [rsp + 0x20], rbx
xor edi, edi
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14007c86f
mov qword [rsp + 0x30], rbx
cmp word [rsp + 0x60], 0
je 0x14007c841
xor eax, eax
cmp word [rsp + rax*2 + 0x62], 0
lea rax, [rax + 1]
jne 0x14007c833
jmp 0x14007c843
xor eax, eax
lea rdx, [rsp + 0x30]
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.140032330
mov rcx, rsi
mov rdx, rdi
call fcn.1400324c0
mov rcx, rdi
call fcn.1400323e0
mov dil, 1
mov rcx, qword [rsp + 0x268]
xor rcx, rsp
call fcn.14014ac50
mov eax, edi
add rsp, 0x270
pop rbx
pop rdi
pop rsi
ret

Function at 0x14007cb30
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x1401e3a68]
xor rax, rsp
mov qword [rsp + 0x178], rax
cmp qword [rcx + 0x18], 7
jbe 0x14007cb59
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x14007cc47
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14007cb9b
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14014ac50
mov rcx, rsi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
jmp fcn.14007cc70
mov ecx, 2
call fcn.14003c410
test al, al
je 0x14007cc45
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x239
mov r9d, 2
call fcn.14003d2f0
lea rcx, [rsp + 0x50]
lea rdx, str.CreateDirectory
call fcn.140002b70
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x14007cbf7
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x158]
mov rcx, rsi
call fcn.14004ebe0
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14007cc2d
mov rdx, qword [rsp + 0x158]
mov rcx, rbx
call fcn.140009cb0
mov rcx, rsi
call fcn.140006b10
mov rcx, rdi
call fcn.14003d430
xor edi, edi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14014ac50
mov eax, edi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
Function at 0x14007cc70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x190
mov rsi, rcx
mov rax, qword [0x1401e3a68]
xor rax, rsp
mov qword [rsp + 0x188], rax
cmp qword [rcx + 0x18], 7
jbe 0x14007cc99
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14007cd68
mov dil, 1
test al, 0x10
jne 0x14007ce14
mov ecx, 2
call fcn.14003c410
test al, al
je 0x14007ce12
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov r8d, 0x227
mov r9d, 2
call fcn.14003c4c0
lea rcx, [rsp + 0x58]
lea rdx, str.GetFileAttributes
call fcn.140002b70
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x14007cd06
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x168]
mov rcx, rsi
call fcn.14004ebe0
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14007cd3c
mov rdx, qword [rsp + 0x168]
mov rcx, rbx
call fcn.140009cb0
lea rdx, str.:_not_a_directory
mov rcx, rax
call fcn.140002b70
mov rcx, rsi
call fcn.140006b10
mov rcx, rdi
call fcn.14003c960
jmp 0x14007ce12
mov ecx, 2
call fcn.14003c410
test al, al
je 0x14007ce12
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov r8d, 0x223
mov r9d, 2
call fcn.14003d2f0
lea rcx, [rsp + 0x60]
lea rdx, str.GetFileAttributes
call fcn.140002b70
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x14007cdc4
mov rax, qword [rsi]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x168]
mov rcx, rsi
call fcn.14004ebe0
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14007cdfa
mov rdx, qword [rsp + 0x168]
mov rcx, rbx
call fcn.140009cb0
mov rcx, rsi
call fcn.140006b10
mov rcx, rdi
call fcn.14003d430
xor edi, edi
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.14014ac50
mov eax, edi
add rsp, 0x190
pop rbx
pop rdi
pop rsi
ret
Function at 0x14007f2a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x70]
cmp eax, edx
jne 0x14007f2b8
cmp qword [rcx + 0x28], 7
jbe 0x14007f2c8
mov rcx, qword [rcx + 0x10]
jmp 0x14007f2cc
xor ecx, ecx
cmp eax, 1
sete cl
lea eax, [rcx + rcx*2]
add eax, 1
jmp 0x14007f2e5
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov eax, 1
cmovne eax, ecx
add rsp, 0x28
ret

Function at 0x140080440
Capabilities:
Check os version
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x160
mov rax, qword [0x1401e3a68]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov eax, dword [0x1401e92b8]
mov ecx, dword [0x1401e8ff8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x18]
jg 0x1400804a2
lea rsi, [0x1401e92b0]
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.14014ac50
mov rax, rsi
add rsp, 0x160
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1401e92b8]
call fcn.14014aa00
mov eax, dword [0x1401e92b8]
cmp eax, 0xffffffff
jne 0x14008047d
lea rcx, [rsp + 0x3c]
xor esi, esi
mov r8d, 0x118
xor edx, edx
call fcn.14016ed50
mov dword [rsp + 0x38], 0x11c
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x3c]
cmp eax, 0xa
je 0x1400804f6
cmp eax, 6
jne 0x140080531
lea rcx, [0x140198f90]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetProductInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x40]
lea rbx, [rsp + 0x34]
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor r9d, r9d
call rax
mov esi, dword [rsp + 0x34]
mov ecx, pe_nt_image_headers64
call fcn.14014a810
mov rdi, rax
lea rbx, [0x1401e92c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rdx, [rsp + 0x38]
mov rcx, rdi
mov r8, rbx
mov r9d, esi
call fcn.140080630
mov qword [0x1401e92b0], rdi
lea rcx, [0x1401e92b8]
call fcn.14014aa70
jmp 0x14008047d

Function at 0x1400805a0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
lea rcx, [0x1401e92c0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [0x1401e92c0]
cmp rcx, 0xc
ja case.0x1400805ce.1
xor eax, eax
lea rdx, [0x1400805f0]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov eax, 2
jmp case.0x1400805ce.0
mov eax, 4
jmp case.0x1400805ce.0
mov eax, 1
jmp case.0x1400805ce.0
mov eax, 3
add rsp, 0x28
ret
Function at 0x140080fd0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x80
mov r14, rdx
mov ebp, ecx
mov rax, qword [0x1401e3a68]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea rcx, [0x1401ae418]
lea r9, [0x1401a68b0]
xor esi, esi
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140081128
mov qword [rsp + 0x68], 0
mov rdi, qword [rsp + 0x70]
lea rax, [0x1401a68c0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xa
lea rbx, [rsp + 0x60]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400c64e0
mov rdx, qword [rsp + 0x60]
mov rax, qword [rdi]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor esi, esi
mov rcx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [rax + 0x18]
mov edi, eax
mov rcx, rbx
call fcn.1400c6530
test edi, edi
js 0x14008110a
test bpl, bpl
je 0x1400810e8
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor esi, esi
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x14008110a
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], 0
mov rcx, qword [r14]
mov qword [r14], rax
test rcx, rcx
je 0x140081125
mov rax, qword [rcx]
call qword [rax + 0x10]
mov sil, 1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140081128
mov qword [rsp + 0x68], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x140081128
mov sil, 1
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140081141
mov qword [rsp + 0x70], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14014ac50
mov eax, esi
add rsp, 0x80
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1400857b0
Capabilities:
Create process on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
mov rax, qword [0x1401e3a68]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rdx, [0x1401a6cb8]
lea r8, str..._.._base_win_shortcut.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x16c
call fcn.14003bd00
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.14004f9f0
cmp qword [rsi + 0x18], 7
jbe 0x140085807
mov rsi, qword [rsi]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, str.taskbarpin
xor ecx, ecx
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
setg bl
mov rcx, rdi
call fcn.14004fb20
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14014ac50
mov eax, ebx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret

Function at 0x140085860
Capabilities:
Create process on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
mov rax, qword [0x1401e3a68]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rdx, str.UnpinShortcutFromTaskbar
lea r8, str..._.._base_win_shortcut.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x175
call fcn.14003bd00
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.14004f9f0
cmp qword [rsi + 0x18], 7
jbe 0x1400858b7
mov rsi, qword [rsi]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, str.taskbarunpin
xor ecx, ecx
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
setg bl
mov rcx, rdi
call fcn.14004fb20
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14014ac50
mov eax, ebx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret

Function at 0x140086310
Capabilities:
Delete service

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rcx, qword [rdx]
test rcx, rcx
je 0x14008633f
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov dil, 1
test eax, eax
jne 0x140086341
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
sete dil
jmp 0x140086341
xor edi, edi
mov rcx, rsi
call fcn.140086cb0
mov eax, edi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140086af0
Capabilities:
Create service

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rsi, rcx
mov rax, qword [0x1401e3a68]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rax, qword [rdx + 0x30]
xor ebx, ebx
cmp rax, qword [rdx + 0x38]
cmovne rbx, rax
cmp qword [rdx + 0x28], 7
jbe 0x140086b33
mov r15, qword [rdx + 0x10]
jmp 0x140086b37
lea r15, [rdx + 0x10]
mov r13d, dword [rdx + 0xc]
mov r12d, dword [rdx + 4]
mov ebp, dword [rdx + 8]
lea rdi, [rsi + 0x20]
mov eax, 8
cmp qword [rsi + 0x38], rax
jb 0x140086b54
mov rdi, qword [rdi]
lea r14, [rsp + 0x70]
mov rcx, rsi
mov rdx, r14
call fcn.140086160
cmp qword [r14 + 0x18], 7
mov rdx, r14
jbe 0x140086b73
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsi + 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x50], rbx
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r12d
mov r8, rdi
mov r9d, 0x10003
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
lea rdi, [rsp + 0x68]
mov qword [rdi], 0
mov rcx, rdi
mov rdx, rax
call fcn.140085d80
mov rcx, r14
call fcn.140006b50
mov rdi, qword [rdi]
test rdi, rdi
je 0x140086c12
add rsi, 0x68
xor ebx, ebx
mov qword [rsp + 0x68], rbx
call fcn.14003bd20
mov rcx, rsi
mov rdx, rdi
call fcn.140085d80
mov sil, 1
cmp qword [rsp + 0x68], rbx
je 0x140086c14
call fcn.14003bd20
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x68], 0
jmp 0x140086c14
xor esi, esi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14014ac50
mov eax, esi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140086c40
Capabilities:
Modify service

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [rdx + 0x30]
xor esi, esi
cmp rax, qword [rdx + 0x38]
cmovne rsi, rax
cmp qword [rdx + 0x28], 7
jbe 0x140086c60
mov r11, qword [rdx + 0x10]
jmp 0x140086c64
lea r11, [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
mov r10d, dword [rdx + 4]
mov r8d, dword [rdx + 8]
mov rcx, qword [rcx + 0x68]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], rsi
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], r11
mov qword [rsp + 0x50], 0
mov edx, r10d
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
setne al
add rsp, 0x60
pop rsi
ret
Function at 0x140092250
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401e3af0]
cmp ecx, 0xffffffff
je 0x14009226e
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, 1
sete al
jmp 0x140092270
xor eax, eax
add rsp, 0x28
ret

Function at 0x140092280
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r14, rdx
mov r15, rcx
mov ecx, dword [0x1401e3af0]
cmp ecx, 0xffffffff
je 0x1400922ad
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x1400922b2
call fcn.1400923e0
mov eax, dword [0x1401eabb8]
mov ecx, dword [0x1401e8ff8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x18]
jg 0x14009237b
mov rbx, qword [0x1401eabb0]
mov rcx, rbx
call fcn.14004f250
mov rcx, qword [0x1401e93a0]
add rcx, 1
xor edx, edx
lea rax, [0x1401e93b0]
nop word [rax + rax]
movzx edi, cl
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x140092331
lea edi, [rcx + 1]
movzx edi, dil
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x140092331
add rdx, 2
add rcx, 2
cmp rdx, 0x100
jb 0x140092300
jmp 0x140092356
lea rcx, [rax + rsi*8]
mov dword [rcx], 1
lea rcx, [rdi + rdi*2]
mov qword [rax + rcx*8 + 8], r14
mov qword [0x1401e93a0], rdi
mov dword [r15], edi
mov eax, dword [rax + rcx*8 + 0x10]
mov dword [r15 + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [r15]
cmp eax, 0xffffffff
je 0x1400923c3
cmp eax, 0x100
jge 0x1400923ca
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, [0x1401eabb8]
call fcn.14014aa00
mov eax, dword [0x1401eabb8]
cmp eax, 0xffffffff
jne 0x1400922d7
mov ecx, 8
call fcn.14014a810
mov rbx, rax
mov rcx, rax
call fcn.14004f240
mov qword [0x1401eabb0], rbx
lea rcx, [0x1401eabb8]
call fcn.14014aa70
jmp 0x1400922d7
int3
int3
Function at 0x1400923e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0x1040
call fcn.14014abe0
sub rsp, rax
lea rbp, [rsp + 0x80]
mov rax, qword [0x1401e3a68]
xor rax, rbp
mov qword [rbp + 0xfb8], rax
mov ecx, dword [0x1401e3af0]
mov dword [rbp - 0x54], ecx
cmp ecx, 0xffffffff
jne 0x140092478
lea rcx, [rbp - 0x54]
call fcn.1400cb080
test al, al
je 0x1400924ef
mov ecx, dword [rbp - 0x54]
cmp ecx, 0xffffffff
jne 0x140092458
lea rcx, [rbp - 0x54]
call fcn.1400cb080
test al, al
je 0x1400924f6
cmp dword [rbp - 0x54], 0xffffffff
je 0x1400924f6
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rbp - 0x54]
mov eax, 0xffffffff
lock cmpxchg dword [0x1401e3af0], ecx
mov ecx, dword [rbp - 0x54]
je 0x140092478
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x1401e3af0]
mov dword [rbp - 0x54], ecx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x1400924e8
lea rsi, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.14016ed50
mov ecx, dword [rbp - 0x54]
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.14014a890
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.14016e8e0
mov ecx, dword [rbp - 0x54]
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rbp + 0xfb8]
xor rcx, rbp
call fcn.14014ac50
mov rax, rdi
add rsp, 0x1040
pop rdi
pop rsi
pop rbp
ret
int3
int3
int3

Function at 0x1400925d0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1401e3af0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400925ff
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x1400925ff
mov rax, qword [rax + rcx]
jmp 0x140092601
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x140092610
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1401e3af0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140092637
test rdi, rdi
je 0x140092650
call fcn.1400923e0
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1400998d0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test rdx, rdx
je 0x140099912
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14009991d
add rdi, rbx
sub rsi, rbx
jne 0x1400998f0
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
int3