joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000dfd0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x58
mov rax, qword [0x180043040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdx, qword [0x1800459d8]
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rcx
mov rax, qword [rdx]
cmp rax, rdx
je 0x18000e01c
nop word [rax + rax]
cmp qword [rax + 0x10], rcx
je 0x18000e12d
cmp qword [rax + 0x18], rcx
je 0x18000e12d
mov rax, qword [rax]
cmp rax, rdx
jne 0x18000e000
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x50], rsi
xor esi, esi
mov qword [rsp + 0x48], rdi
mov edi, esi
cmp qword [rcx], rsi
je 0x18000e03d
inc rdi
cmp qword [rcx + rdi*8], rsi
jne 0x18000e034
mov rax, qword [0x180045a50]
test rax, rax
jne 0x18000e10d
mov rax, qword gs:[0x60]
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x40], r14
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov r11, rbp
nop
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x18000e0e4
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x18000e0e4
mov r14d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [r14 + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x18000e0df
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x18000e0c0
cmp edx, 0x3285501
je 0x18000e141
test r8d, r8d
jne 0x18000e0a0
mov rax, qword [r11]
mov r11, rax
cmp rax, rbp
je 0x18000e0f9
cmp qword [rax + 0x30], rsi
jne 0x18000e070
mov rax, rsi
mov r14, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x70]
mov qword [0x180045a50], rax
xor ecx, ecx
lea rdx, [rdi*8]
mov r8d, 0x3000
lea r9d, [rcx + 4]
call rax
mov rbx, rax
test rax, rax
jne 0x18000e15a
jmp 0x18000e18d
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800102f0
add rsp, 0x58
ret
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x18000e0fc
test rdi, rdi
je 0x18000e175
nop
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + rsi*8]
mov qword [rbx + rsi*8], rcx
inc rsi
cmp rsi, rdi
jb 0x18000e160
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
call fcn.18000e2f0
mov rcx, qword [rax]
mov al, 1
mov qword [rcx + 0x18], rbx
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800102f0
add rsp, 0x58
ret
Function at 0x18000e600
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18000e7dd
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1800459d8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1800459e8]
lea rdx, [rdi + rdi]
call fcn.1800030d0
mov rcx, qword [0x1800459d8]
lea r9, [rdi - 1]
mov qword [0x180045a00], r9
mov qword [0x180045a08], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x18000e7d2
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x14]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x15]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x16]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x17]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1800459e8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18000e71b
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x18000e793
mov rax, qword [r11 + 8]
mov r8, qword [rcx + 0x10]
cmp r8, qword [rax + 0x10]
jne 0x18000e758
mov r8, qword [rax]
cmp r8, rcx
je 0x18000e752
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x18000e793
cmp r9, rax
je 0x18000e76f
nop dword [rax]
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
je 0x18000e7a7
cmp r9, rax
jne 0x18000e760
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x18000e7cd
mov r9, qword [0x180045a00]
jmp 0x18000e6a0
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x18000e793
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.18000f668
int3
Function at 0x18000eb90
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x180043040]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor eax, eax
mov rbx, r8
mov qword [rdx], rax
mov r14, rdx
mov qword [rdx + 8], rax
mov qword [rdx + 0x10], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x18000ec47
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x18000ec47
mov esi, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rsi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18000ec42
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x18000ec20
cmp r8d, 0x58ba3d97
je 0x18000ec4c
test r9d, r9d
jne 0x18000ec00
mov rax, qword [rax]
jmp 0x18000ebd0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbx
add rax, r10
call rax
mov qword [rsp + 0x20], rbx
lea rsi, [rbx + rax]
cmp rbx, rsi
jae 0x18000ed88
mov rax, rbx
nop dword [rax]
cmp byte [rbx], 0x3f
jne 0x18000eca4
inc rax
mov qword [rsp + 0x20], rax
cmp byte [rax], 0x3f
jne 0x18000ec9a
inc rax
mov qword [rsp + 0x20], rax
mov eax, 0xffffffff
jmp 0x18000ed65
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x18000ed37
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x18000ed37
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x18000ed32
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x18000ed10
cmp r8d, 0xc6fd0d8
je 0x18000ed3c
test r9d, r9d
jne 0x18000ecf0
mov rax, qword [rax]
jmp 0x18000ecc0
mov ecx, dword [rbx + 0x24]
mov r8d, 0x10
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x20]
add rax, r10
call rax
mov edx, eax
mov rcx, r14
call fcn.18000f1e0
mov rbx, qword [rsp + 0x20]
inc rbx
mov qword [rsp + 0x20], rbx
mov rax, rbx
cmp rbx, rsi
jb 0x18000ec80
mov rax, r14
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800102f0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x18000ef50
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv

Disassembly:
push rdi
push r12
sub rsp, 0x68
mov rax, qword [0x180043040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword gs:[0x60]
mov r10, rdx
mov r12, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov rdx, qword [rax + 0x60]
movzx r8d, word [rax + 0x58]
shr r8, 1
lea r9, [rdx + r8*2]
mov r8d, 0x811c9dc5
cmp rdx, r9
je 0x18000efbf
nop dword [rax + rax]
movsx ecx, byte [rdx]
add rdx, 2
xor ecx, r8d
imul r8d, ecx, 0x1000193
cmp rdx, r9
jne 0x18000efa0
cmp r8d, 0x5f038fde
je 0x18000efc4
mov rax, qword [rax]
jmp 0x18000ef80
mov rdi, qword [rax + 0x30]
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r15
test rdi, rdi
jne 0x18000eff3
xor ebx, ebx
jmp 0x18000f136
movsxd rax, dword [rdi + 0x3c]
add rax, rdi
jne 0x18000f003
xor ebx, ebx
jmp 0x18000f136
mov ebx, dword [rax + 0x50]
test ebx, ebx
jne 0x18000f011
xor ebx, ebx
jmp 0x18000f136
xorps xmm0, xmm0
lea rdx, [rsp + 0x28]
xor eax, eax
mov r8, r10
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rax
call fcn.18000edb0
mov r11, qword [rsp + 0x30]
mov r14, rbx
mov r9, qword [rsp + 0x28]
mov r15, rbx
sub r11, r9
xor ebx, ebx
sar r11, 2
sub r14, r11
je 0x18000f16a
mov edx, ebx
mov r10d, ebx
test r11, r11
je 0x18000f09c
nop dword [rax]
mov rcx, rbx
mov esi, r10d
lea rbp, [r15 + rdi]
nop word [rax + rax]
lea rax, [rsi + rcx]
add rax, rdi
cmp rax, rbp
jae 0x18000f0f8
mov r8d, dword [r9 + rcx*4]
lea eax, [rdx + r10]
movzx eax, byte [rax + rdi]
cmp eax, r8d
je 0x18000f093
cmp r8d, 0xffffffff
jne 0x18000f0e6
inc edx
mov ecx, edx
cmp rcx, r11
jb 0x18000f070
mov eax, r10d
add rdi, rax
test r9, r9
je 0x18000f139
mov rdx, qword [rsp + 0x38]
mov rax, r9
sub rdx, r9
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x18000f0dc
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000f1d4
mov rcx, r9
call fcn.180010310
jmp 0x18000f139
inc r10d
mov eax, r10d
cmp rax, r14
jae 0x18000f16a
mov edx, ebx
jmp 0x18000f060
test r9, r9
je 0x18000f136
mov rdx, qword [rsp + 0x38]
mov rax, r9
sub rdx, r9
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x18000f12e
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000f1d4
mov rcx, r9
call fcn.180010310
mov rdi, rbx
mov rdx, rdi
lea rcx, str.FunctionAddress:_0x_x_n
call fcn.18000f4d0
mov rax, rbx
nop dword [rax + rax]
cmp qword [r12 + rax*8], rdi
je 0x18000f19e
inc ebx
inc rax
cmp rax, 0x3a98
jl 0x18000f150
mov eax, 0xffffffff
jmp 0x18000f1a0
test r9, r9
je 0x18000f136
mov rdx, qword [rsp + 0x38]
mov rax, r9
sub rdx, r9
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x18000f12e
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000f1d4
jmp 0x18000f12e
mov eax, ebx
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800102f0
add rsp, 0x68
pop r12
pop rdi
ret
call fcn.18001713c
int3
Function at 0x18000f1e0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
mov rax, qword [rcx + 8]
mov ebp, edx
mov rsi, rcx
cmp qword [rcx + 0x10], rax
jne 0x18000f2ee
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r14
test rax, rax
jne 0x18000f218
mov eax, 1
jmp 0x18000f21b
add rax, rax
mov qword [rcx + 8], rax
lea r14, [rax*4]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x18000f2b7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x18000f2b7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x18000f2b2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x18000f290
cmp r8d, 0xbf26b345
je 0x18000f2bc
test r9d, r9d
jne 0x18000f270
mov rax, qword [rax]
jmp 0x18000f240
mov ecx, dword [rbx + 0x24]
mov rdx, r14
add rcx, r10
movzx r8d, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + r8*4]
mov rcx, qword [rsi]
add rax, r10
call rax
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov qword [rsi], rax
mov rcx, qword [rsi + 0x10]
mov rax, qword [rsi]
mov dword [rax + rcx*4], ebp
inc qword [rsi + 0x10]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x180026980
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800269b0
xor eax, eax
jmp 0x180026a73
mov rbp, rbx
cmp word [rax], si
je 0x1800269d5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800269bc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800269b8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180025068
movsxd r14, eax
test eax, eax
jne 0x180026a13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800269a9
mov rcx, r14
call fcn.180021054
mov rdi, rax
test rax, rax
jne 0x180026a2c
xor ecx, ecx
call fcn.180021018
jmp 0x180026a08
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180025068
test eax, eax
jne 0x180026a5d
mov rcx, rdi
call fcn.180021018
jmp 0x180026a67
xor ecx, ecx
call fcn.180021018
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1800292c4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.18001f438
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x180029365
cmp ebx, dword [rsp + 0x30]
je 0x18002935e
test esi, esi
je 0x18002935e
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x180029339
sub r8w, 0x61
cmp r8w, 0x19
ja 0x180029346
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x180029323
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x18002934a
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x180029367
mov eax, 1
jmp 0x180029367
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18002ae74
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x18002ae8a
mov al, 1
jmp 0x18002aeea
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x18002ae9b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x18002aee8
mov ecx, dword [rcx + 0x18]
nop
call fcn.18002b2c8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18002aee8
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x18002aee8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x18002aee8
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x18002aeea
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x18002f010
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18002f038
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18002f038
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140007050
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1401eb978]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x260]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
mov rcx, qword [rbx + 0x278]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rax, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x140007040]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ede60
add rsp, 0x40
pop rbx
ret

Function at 0x140015510
Capabilities:
Query service status
Stop service

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x254
mov eax, dword [rcx + rdx]
mov r8d, 0x250
test al, 1
jne 0x140015552
or eax, 1
mov dword [rcx + rdx], eax
mov ecx, r8d
add rcx, rdx
call fcn.14000c1c0
nop
cmp byte [r8 + rdx + 1], 0
je 0x140015579
lea rdx, str.unsigned_long___cdecl_MinifilterStopCommand::Execute_int_wchar_t____
lea rcx, [0x1401faaf0]
call fcn.140014900
lea rcx, [0x1401faaf0]
call fcn.140012e10
mov rcx, qword [rbx + 8]
add rsp, 0x30
pop rbx
jmp fcn.140019dc0
Function at 0x1400156a0
Capabilities:
Start service

Disassembly:
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov rsi, rcx
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov r14d, 0x254
mov eax, dword [r14 + rdi]
mov edx, 0x250
test al, 1
jne 0x1400156f2
or eax, 1
mov dword [r14 + rdi], eax
mov ecx, edx
add rcx, rdi
call fcn.14000c1c0
nop
mov ebx, edx
add rbx, rdi
cmp byte [rbx + 1], 0
je 0x14001571c
lea rdx, str.unsigned_long___cdecl_MinifilterStartCommand::Execute_int_wchar_t____
lea rcx, [0x1401faaf0]
call fcn.140014900
lea rcx, [0x1401faaf0]
call fcn.140012e10
mov eax, dword [r14 + rdi]
test al, 1
jne 0x140015734
or eax, 1
mov dword [r14 + rdi], eax
mov rcx, rbx
call fcn.14000c1c0
nop
cmp byte [rbx + 1], 0
je 0x140015759
lea rdx, str.Start_Minifilter
lea rcx, [0x1401faaf0]
call fcn.140014900
lea rcx, [0x1401faaf0]
call fcn.140012e10
mov rcx, qword [rsi + 8]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
jmp 0x140019c60
push rbx
sub rsp, 0x150
mov qword [rsp + 0x20], 0xfffffffffffffffe
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140019d5d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x30]
cmp eax, 0x420
jne 0x140019cde
call fcn.14000c8b0
xor eax, eax
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], ax
lea rdx, str.Cannot_start_service._ERROR_SERVICE_ALREADY_RUNNING
lea rcx, [rsp + 0x40]
call fcn.140014140
lea rcx, [rsp + 0x40]
call fcn.14000d170
nop
jmp 0x140019d4c
call fcn.14000c8b0
xor eax, eax
mov qword [rsp + 0x140], 7
mov qword [rsp + 0x138], rax
mov word [rsp + 0x128], ax
cmp ebx, 2
jne 0x140019d24
lea rdx, str.Cannot_start_service._ERROR_FILE_NOT_FOUND
lea rcx, [rsp + 0x40]
call fcn.140014140
lea rcx, [rsp + 0x40]
call fcn.14000d170
nop
jmp 0x140019d4c
lea rdx, str.Cannot_start_service._Error
lea rcx, [rsp + 0x40]
call fcn.140014140
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.140017e80
lea rcx, [rsp + 0x40]
call fcn.14000d170
nop
lea rcx, [rsp + 0x30]
call fcn.14000c270
mov eax, 0x6e
jmp 0x140019db6
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x254
mov eax, dword [rcx + rdx]
mov r8d, 0x250
test al, 1
jne 0x140019d8d
or eax, 1
mov dword [rcx + rdx], eax
mov ecx, r8d
add rcx, rdx
call fcn.14000c1c0
nop
cmp byte [r8 + rdx + 1], 0
je 0x140019db4
lea rdx, str.Service_started_successfully.
lea rcx, [0x1401faaf0]
call fcn.140014900
lea rcx, [0x1401faaf0]
call fcn.140012e10
xor eax, eax
add rsp, 0x150
pop rbx
ret
Function at 0x140015a70
Capabilities:
Start service

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x254
mov eax, dword [rcx + rdx]
mov r8d, 0x250
test al, 1
jne 0x140015ab2
or eax, 1
mov dword [rcx + rdx], eax
mov ecx, r8d
add rcx, rdx
call fcn.14000c1c0
nop
cmp byte [r8 + rdx + 1], 0
je 0x140015ad9
lea rdx, str.Starting_service
lea rcx, [0x1401faaf0]
call fcn.140014900
lea rcx, [0x1401faaf0]
call fcn.140012e10
mov rcx, qword [rbx + 8]
add rsp, 0x30
pop rbx
jmp 0x140019c60
Function at 0x140019c60
Capabilities:
Start service

Disassembly:
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov rsi, rcx
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov r14d, 0x254
mov eax, dword [r14 + rdi]
mov edx, 0x250
test al, 1
jne 0x1400156f2
or eax, 1
mov dword [r14 + rdi], eax
mov ecx, edx
add rcx, rdi
call fcn.14000c1c0
nop
mov ebx, edx
add rbx, rdi
cmp byte [rbx + 1], 0
je 0x14001571c
lea rdx, str.unsigned_long___cdecl_MinifilterStartCommand::Execute_int_wchar_t____
lea rcx, [0x1401faaf0]
call fcn.140014900
lea rcx, [0x1401faaf0]
call fcn.140012e10
mov eax, dword [r14 + rdi]
test al, 1
jne 0x140015734
or eax, 1
mov dword [r14 + rdi], eax
mov rcx, rbx
call fcn.14000c1c0
nop
cmp byte [rbx + 1], 0
je 0x140015759
lea rdx, str.Start_Minifilter
lea rcx, [0x1401faaf0]
call fcn.140014900
lea rcx, [0x1401faaf0]
call fcn.140012e10
mov rcx, qword [rsi + 8]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
jmp 0x140019c60
push rbx
sub rsp, 0x150
mov qword [rsp + 0x20], 0xfffffffffffffffe
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140019d5d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x30]
cmp eax, 0x420
jne 0x140019cde
call fcn.14000c8b0
xor eax, eax
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], ax
lea rdx, str.Cannot_start_service._ERROR_SERVICE_ALREADY_RUNNING
lea rcx, [rsp + 0x40]
call fcn.140014140
lea rcx, [rsp + 0x40]
call fcn.14000d170
nop
jmp 0x140019d4c
call fcn.14000c8b0
xor eax, eax
mov qword [rsp + 0x140], 7
mov qword [rsp + 0x138], rax
mov word [rsp + 0x128], ax
cmp ebx, 2
jne 0x140019d24
lea rdx, str.Cannot_start_service._ERROR_FILE_NOT_FOUND
lea rcx, [rsp + 0x40]
call fcn.140014140
lea rcx, [rsp + 0x40]
call fcn.14000d170
nop
jmp 0x140019d4c
lea rdx, str.Cannot_start_service._Error
lea rcx, [rsp + 0x40]
call fcn.140014140
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.140017e80
lea rcx, [rsp + 0x40]
call fcn.14000d170
nop
lea rcx, [rsp + 0x30]
call fcn.14000c270
mov eax, 0x6e
jmp 0x140019db6
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x254
mov eax, dword [rcx + rdx]
mov r8d, 0x250
test al, 1
jne 0x140019d8d
or eax, 1
mov dword [rcx + rdx], eax
mov ecx, r8d
add rcx, rdx
call fcn.14000c1c0
nop
cmp byte [r8 + rdx + 1], 0
je 0x140019db4
lea rdx, str.Service_started_successfully.
lea rcx, [0x1401faaf0]
call fcn.140014900
lea rcx, [0x1401faaf0]
call fcn.140012e10
xor eax, eax
add rsp, 0x150
pop rbx
ret