joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002be70
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x270
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r14, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.180113150
mov dword [rsp + 0x40], 0x208
lea rbx, [rsp + 0x50]
mov rsi, 0xffffffffffffffff
inc rsi
cmp word [r14 + rsi*2], 0
jne 0x18002bec3
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlCrashControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18002bf25
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DumpFilters
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18002bf60
xor edi, edi
cmp eax, 2
jmp 0x18002c02c
movzx eax, word [rbx]
test ax, ax
jne 0x18002bf86
cmp word [rbx + 2], ax
jne 0x18002bf78
mov edi, 1
jmp 0x18002c030
test ax, ax
jne 0x18002bf86
add rbx, 2
mov qword [rsp + 0x30], rbx
mov rdx, r14
mov rcx, rbx
call fcn.1801153c8
test eax, eax
jne 0x18002c05e
lea rax, [rsp + 0x50]
mov rcx, rbx
sub rcx, rax
sar rcx, 1
mov r9d, esi
lea rdx, [r9 + rcx]
add rdx, rdx
mov r8d, dword [rsp + 0x40]
cmp r8, rdx
jbe 0x18002bfdb
mov edi, 1
sub edi, ecx
sub edi, esi
lea r8d, [r8 + rdi*2]
inc r9
lea rdx, [rbx + r9*2]
mov rcx, rbx
call fcn.180112cb0
xor edi, edi
jmp 0x18002bff5
xor edi, edi
mov word [rbx], di
lea rax, [rbx + 2]
mov qword [rsp + 0x30], rax
mov word [rax], di
add rax, 2
mov qword [rsp + 0x30], rax
lea eax, [rsi + rsi]
mov ecx, dword [rsp + 0x40]
sub ecx, eax
sub ecx, 2
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
lea rdx, str.DumpFilters
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete dil
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x18002c057
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, r14
lea rcx, str.RemoveDumpFilter::_Failed_szServiceName_s_GetLastError_returned__u_n
call sym.SafeBase64.dll_DbgPrintW
mov eax, edi
jmp 0x18002befb
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x18002c065
lea rbx, [rbx + rax*2]
mov qword [rsp + 0x30], rbx
jmp 0x18002bf60
Function at 0x18002c080
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x270
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r14, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.180113150
mov dword [rsp + 0x48], 0x208
lea rbx, [rsp + 0x50]
xor edi, edi
mov esi, edi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlCrashControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18002c127
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DumpFilters
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18002c1a9
movzx eax, word [rbx]
test ax, ax
jne 0x18002c173
cmp word [rbx + 2], ax
je 0x18002c1a9
test ax, ax
jne 0x18002c173
add rbx, 2
mov qword [rsp + 0x38], rbx
inc edi
mov dword [rsp + 0x30], edi
mov rdx, r14
mov rcx, rbx
call fcn.1801153c8
test eax, eax
jne 0x18002c18d
lea esi, [rax + 1]
jmp 0x18002c1a9
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x18002c194
lea rbx, [rbx + rax*2]
mov qword [rsp + 0x38], rbx
jmp 0x18002c157
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
cmovne esi, edi
mov eax, esi
jmp 0x18002c0fd
Function at 0x18002c1c0
Capabilities:
Create service

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x3b0
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x2d0]
mov r8d, 0xc8
call fcn.180113150
mov rdx, rdi
mov rcx, rbx
call sym.SafeBase64.dll_CopyDriverFile
test eax, eax
jne 0x18002c253
cmp word [rsp + 0x2d0], ax
je 0x18002c3b0
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x18002c3b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
test byte [rsp + 0x80], 0x10
jne 0x18002c3b0
lea r8, str.System32Drivers_
mov edx, 0x63
lea rcx, [rsp + 0x2d0]
call fcn.1801259f0
mov r8, rdi
lea rcx, [rsp + 0x2d0]
mov edx, 0x63
call fcn.180125a58
lea r8, str..sys
mov edx, 0x63
lea rcx, [rsp + 0x2d0]
call fcn.180125a58
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x18002c3b0
xor ebx, ebx
lea rax, str.SCSI_Class
mov qword [rsp + 0x60], rbx
mov r9d, 0xf01ff
mov qword [rsp + 0x58], rbx
mov r8, rdi
mov qword [rsp + 0x50], rbx
mov rdx, rdi
mov qword [rsp + 0x48], rbx
mov rcx, rsi
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x18002c342
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
je 0x18002c32a
xor edx, edx
mov rcx, rdi
call sym.SafeBase64.dll_SetDriverStartType
mov rcx, rdi
call sym.SafeBase64.dll_CheckDriverRemoved
test eax, eax
je 0x18002c34b
xor edx, edx
mov rcx, rdi
call sym.SafeBase64.dll_SetDriverStartType
jmp 0x18002c34b
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [rsp + 0x70], 4
nop dword [rax]
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, rdi
call sym.SafeBase64.dll_QueryDriverValue
mov esi, eax
test eax, eax
je 0x18002c37e
mov ecx, dword [rsp + 0x70]
test ecx, ecx
je 0x18002c393
xor edx, edx
mov rcx, rdi
call sym.SafeBase64.dll_SetDriverStartType
inc ebx
cmp ebx, 5
jl 0x18002c360
mov ecx, dword [rsp + 0x70]
test esi, esi
je 0x18002c3b0
test ecx, ecx
jne 0x18002c3b0
lea r8d, [rcx + 1]
mov rdx, rdi
lea rcx, str.SYSTEMCurrentControlSetControlClass4D36E967_E325_11CE_BFC1_08002BE10318
call sym.SafeBase64.dll_AddClassFilter
jmp 0x18002c3b2
xor eax, eax
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x18002c3e0
Capabilities:
Delete service

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rdx, rcx
lea rcx, str.SYSTEMCurrentControlSetControlClass4D36E967_E325_11CE_BFC1_08002BE10318
mov r8d, 1
call sym.SafeBase64.dll_RemoveClassFilter
test eax, eax
je 0x18002c40f
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.SafeBase64.dll_RemoveDriver
add rsp, 0x20
pop rbx
ret
Function at 0x18002c420
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rdx, rcx
lea rcx, str.SYSTEMCurrentControlSetControlClass4D36E967_E325_11CE_BFC1_08002BE10318
mov r8d, 1
call sym.SafeBase64.dll_RemoveClassFilter
test eax, eax
je 0x18002c454
mov edx, 4
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.SafeBase64.dll_SetDriverStartType
add rsp, 0x20
pop rbx
ret

Function at 0x18002c460
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x360
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x280]
mov r8d, 0xc8
call fcn.180113150
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.Wow64DisableWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
test rax, rax
jne 0x18002c4c4
mov esi, ebx
jmp 0x18002c4cd
lea rcx, [rsp + 0x20]
call rax
mov esi, eax
mov edx, 0x64
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test esi, esi
je 0x18002c510
mov rsi, qword [rsp + 0x20]
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.Wow64RevertWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18002c510
mov rcx, rsi
call rax
lea r8, str.Drivers_
mov edx, 0x63
lea rcx, [rsp + 0x280]
call fcn.180125a58
mov r8, rdi
lea rcx, [rsp + 0x280]
mov edx, 0x63
call fcn.180125a58
lea r8, str..sys
mov edx, 0x63
lea rcx, [rsp + 0x280]
call fcn.180125a58
cmp word [rsp + 0x280], bx
je 0x18002c58a
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x18002c58a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
test byte [rsp + 0x30], 0x10
je 0x18002c598
mov rdx, rdi
xor ecx, ecx
call sym.SafeBase64.dll_CopyDriverFile
test eax, eax
je 0x18002c600
xor edx, edx
mov rcx, rdi
call sym.SafeBase64.dll_SetDriverStartType
mov dword [rsp + 0x28], 4
nop word [rax + rax]
xor r8d, r8d
lea rdx, [rsp + 0x28]
mov rcx, rdi
call sym.SafeBase64.dll_QueryDriverValue
mov esi, eax
test eax, eax
je 0x18002c5ce
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x18002c5e3
xor edx, edx
mov rcx, rdi
call sym.SafeBase64.dll_SetDriverStartType
inc ebx
cmp ebx, 5
jl 0x18002c5b0
mov ecx, dword [rsp + 0x28]
test esi, esi
je 0x18002c600
test ecx, ecx
jne 0x18002c600
lea r8d, [rcx + 1]
mov rdx, rdi
lea rcx, str.SYSTEMCurrentControlSetControlClass4D36E967_E325_11CE_BFC1_08002BE10318
call sym.SafeBase64.dll_AddClassFilter
jmp 0x18002c602
xor eax, eax
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18002c630
Capabilities:
Create service

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2a0
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x208
call fcn.180113150
mov rdx, rdi
mov rcx, rbx
call sym.SafeBase64.dll_CopyDriverFile
lea r8, str.System32Drivers_
mov edx, 0x103
lea rcx, [rsp + 0x80]
call fcn.1801259f0
mov r8, rdi
lea rcx, [rsp + 0x80]
mov edx, 0x103
call fcn.180125a58
lea r8, str..sys
mov edx, 0x103
lea rcx, [rsp + 0x80]
call fcn.180125a58
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x18002c7e4
xor ebx, ebx
lea rax, str.Filter
mov qword [rsp + 0x60], rbx
mov r9d, 0xf01ff
mov qword [rsp + 0x58], rbx
mov r8, rdi
mov qword [rsp + 0x50], rbx
mov rdx, rdi
mov qword [rsp + 0x48], rbx
mov rcx, rsi
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x18002c771
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
je 0x18002c756
lea edx, [rbx + 1]
mov rcx, rdi
call sym.SafeBase64.dll_SetDriverStartType
mov rcx, rdi
call sym.SafeBase64.dll_CheckDriverRemoved
test eax, eax
je 0x18002c77a
mov edx, 1
mov rcx, rdi
call sym.SafeBase64.dll_SetDriverStartType
jmp 0x18002c77a
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [rsp + 0x70], 4
nop dword [rax + rax]
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, rdi
call sym.SafeBase64.dll_QueryDriverValue
mov esi, eax
test eax, eax
je 0x18002c7af
mov ecx, dword [rsp + 0x70]
cmp ecx, 1
je 0x18002c7c7
mov edx, 1
mov rcx, rdi
call sym.SafeBase64.dll_SetDriverStartType
inc ebx
cmp ebx, 5
jl 0x18002c790
mov ecx, dword [rsp + 0x70]
test esi, esi
je 0x18002c7e4
cmp ecx, 1
jne 0x18002c7e4
mov r8d, ecx
mov rdx, rdi
lea rcx, str.SYSTEMCurrentControlSetControlClass4D36E965_E325_11CE_BFC1_08002BE10318
call sym.SafeBase64.dll_AddClassFilter
jmp 0x18002c7e6
xor eax, eax
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x18002c810
Capabilities:
Delete service

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rdx, rcx
lea rcx, str.SYSTEMCurrentControlSetControlClass4D36E965_E325_11CE_BFC1_08002BE10318
mov r8d, 1
call sym.SafeBase64.dll_RemoveClassFilter
test eax, eax
je 0x18002c83f
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.SafeBase64.dll_RemoveDriver
add rsp, 0x20
pop rbx
ret
Function at 0x18002c850
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x18002c880
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r8d, 0xf01ff
mov qword [rsp + 0x30], rsi
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x18002c8bb
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [rsi + 1]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x18002c8d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
je 0x18002c8d9
xor ebx, ebx
jmp 0x18002c8de
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x30]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18002c910
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x4c0
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov rbp, rcx
xor edx, edx
lea rcx, [rsp + 0x2a0]
mov r8d, 0x208
call fcn.180113150
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.Wow64DisableWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
test rax, rax
jne 0x18002c979
mov edi, ebx
jmp 0x18002c982
lea rcx, [rsp + 0x40]
call rax
mov edi, eax
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, eax
test edi, edi
je 0x18002c9c7
mov rdi, qword [rsp + 0x40]
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.Wow64RevertWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18002c9c7
mov rcx, rdi
call rax
test esi, esi
jne 0x18002c9d2
xor eax, eax
jmp 0x18002ca91
lea r8, str.Drivers_
mov edx, 0x103
lea rcx, [rsp + 0x2a0]
call fcn.180125a58
mov r8, rbp
lea rcx, [rsp + 0x2a0]
mov edx, 0x103
call fcn.180125a58
lea r8, str..sys
mov edx, 0x103
lea rcx, [rsp + 0x2a0]
call fcn.180125a58
cmp word [rsp + 0x2a0], bx
je 0x18002ca8f
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x18002ca8f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
test byte [rsp + 0x50], 0x10
jne 0x18002ca8f
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x82
lea rcx, [rsp + 0x2a0]
mov edx, 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x18002ca86
lea ebx, [rax + 2]
jmp 0x18002ca8f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18002ce40
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.180113150
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.Wow64DisableWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x18002ce9a
xor ebx, ebx
jmp 0x18002cea3
lea rcx, [rsp + 0x20]
call rax
mov ebx, eax
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x18002ceee
test ebx, ebx
je 0x18002cee7
mov rbx, qword [rsp + 0x20]
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.Wow64RevertWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18002cee7
mov rcx, rbx
call rax
xor eax, eax
jmp 0x18002cf8d
lea r8, str.Drivers_
mov edx, 0x103
lea rcx, [rsp + 0x30]
call fcn.180125a58
mov r8, rdi
lea rcx, [rsp + 0x30]
mov edx, 0x103
call fcn.180125a58
lea r8, str..sys
mov edx, 0x103
lea rcx, [rsp + 0x30]
call fcn.180125a58
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test eax, eax
jne 0x18002cf5b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x18002cf5b
xor edx, edx
lea r8d, [rdi + 4]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, eax
test ebx, ebx
je 0x18002cf8b
mov rbx, qword [rsp + 0x20]
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.Wow64RevertWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18002cf8b
mov rcx, rbx
call rax
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x18002cfb0
Capabilities:
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor edi, edi
test eax, eax
je 0x18002d03e
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, str.SeLoadDriverPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x18002d06e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.StartDriver:_Manager_Error_x_n
call sym.SafeBase64.dll_DbgPrintW
xor eax, eax
jmp 0x18002d0e1
mov r8d, 0x14
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x18002d0a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.StartDriver:_service_Error_x_n
call sym.SafeBase64.dll_DbgPrintW
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x18002d0e1
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x18002d0c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x18002d0cd
mov edi, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x18002d100
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18002d189
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, str.SeLoadDriverPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
xor eax, eax
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x18002d201
mov r8d, 0x24
mov qword [rsp + 0x88], rsi
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x18002d1d0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x18002d1f9
lea r8, [rsp + 0x48]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rsi, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret

Function at 0x18002d220
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.180113150
test rbx, rbx
je 0x18002d2f6
mov r9, rdi
lea r8, str.SYSTEMCurrentControlSetServices_s
mov edx, 0x103
lea rcx, [rsp + 0x40]
call fcn.18000f870
lea rax, [rsp + 0x30]
xor edi, edi
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18002d2f6
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rbx + rcx*2], di
jne 0x18002d2b0
add ecx, ecx
lea rdx, str.InstPath
mov dword [rsp + 0x28], ecx
mov r9d, 1
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete dil
mov eax, edi
jmp 0x18002d2f8
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret