joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001b1e0
Capabilities:
Read file on windows

Disassembly:
jmp 0x180267440
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x1100
call fcn.180005520
sub rsp, rax
lea rdi, [rsp + 0x50]
mov ecx, 0x42c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1110]
mov rax, qword [0x1805a6200]
xor rax, rsp
mov qword [rsp + 0x10f0], rax
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 1
mov r9d, 0x80
mov r8d, 0x120089
mov rdx, qword [rsp + 0x1110]
lea rcx, [rsp + 0x68]
call sym.ProcessMonitor.dll_PhCreateFileWin32
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jl 0x180267688
mov dword [rsp + 0xb8], 0x1000
mov eax, dword [rsp + 0xb8]
mov ecx, eax
call sym.ProcessMonitor.dll_PhAllocate
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xbc], 0
mov eax, dword [rsp + 0xb8]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0xb0]
call fcn.180013180
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x1000
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtReadFile]
test eax, eax
jl 0x180267613
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0xc0], eax
cmp dword [rsp + 0xc0], 0
jne 0x180267580
jmp 0x180267613
mov eax, dword [rsp + 0xc0]
mov ecx, dword [rsp + 0xbc]
add ecx, eax
mov eax, ecx
cmp dword [rsp + 0xb8], eax
jae 0x1802675c9
mov eax, dword [rsp + 0xb8]
shl eax, 1
mov dword [rsp + 0xb8], eax
mov eax, dword [rsp + 0xb8]
mov edx, eax
mov rcx, qword [rsp + 0xb0]
call sym.ProcessMonitor.dll_PhReAllocate
mov qword [rsp + 0xb0], rax
mov eax, dword [rsp + 0xc0]
mov ecx, dword [rsp + 0xbc]
mov rdx, qword [rsp + 0xb0]
add rdx, rcx
mov rcx, rdx
mov r8d, eax
lea rdx, [rsp + 0xe0]
call fcn.18000cf00
mov eax, dword [rsp + 0xc0]
mov ecx, dword [rsp + 0xbc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xbc], eax
jmp 0x180267514
mov eax, dword [rsp + 0xbc]
inc eax
cmp dword [rsp + 0xb8], eax
jae 0x180267653
mov eax, dword [rsp + 0xb8]
inc eax
mov dword [rsp + 0xb8], eax
mov eax, dword [rsp + 0xb8]
mov edx, eax
mov rcx, qword [rsp + 0xb0]
call sym.ProcessMonitor.dll_PhReAllocate
mov qword [rsp + 0xb0], rax
mov eax, dword [rsp + 0xbc]
mov rcx, qword [rsp + 0xb0]
mov byte [rcx + rax], 0
mov rcx, qword [rsp + 0xb0]
call fcn.180008af0
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0xb0]
call sym.ProcessMonitor.dll_PhFree
mov rax, qword [rsp + 0xa8]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x180507c68]
call fcn.180014e20
mov rax, rdi
mov rcx, qword [rsp + 0x10f0]
xor rcx, rsp
call fcn.18000ce90
add rsp, 0x1100
pop rdi
ret

Function at 0x18001b3d0
Capabilities:
Shutdown system

Disassembly:
jmp 0x18002c110
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x18002c12e
mov al, 1
jmp 0x18002c14d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
xor r8d, r8d
lea rdx, str.Unable_to_log_off_the_computer.
mov rcx, qword [rsp + 0x30]
call sym.ProcessMonitor.dll_PhShowStatus
xor al, al
add rsp, 0x20
pop rdi
ret
Function at 0x18002b560
Capabilities:
Hide graphical window

Disassembly:
jmp 0x18002b560
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
cmp qword [0x1805a94a0], 0
jne 0x18002b5dd
cmp dword [0x1808ecbe4], 0
je 0x18002b588
mov qword [rsp + 0x30], 0
jmp 0x18002b592
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], 0
lea r9, [0x18002b920]
mov r8, qword [rsp + 0x30]
mov edx, 0x79
mov rcx, qword [0x1808e91b0]
call sym.ProcessMonitor.dll_PhCreateDialog
mov qword [0x1805a94a0], rax
mov rcx, qword [0x1805a94a0]
call sym.ProcessMonitor.dll_PhRegisterDialog
mov edx, 5
mov rcx, qword [0x1805a94a0]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1805a94a0]
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x18002b602
mov edx, 9
mov rcx, qword [0x1805a94a0]
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x18002b60f
mov rcx, qword [0x1805a94a0]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
add rsp, 0x40
pop rdi
ret

Function at 0x18002c0c0
Capabilities:
Lock the desktop

Disassembly:
jmp 0x18002c0c0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
call qword [sym.imp.USER32.dll_LockWorkStation]
test eax, eax
je 0x18002c0da
mov al, 1
jmp 0x18002c0f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
xor r8d, r8d
lea rdx, str.Unable_to_lock_the_computer.
mov rcx, qword [rsp + 0x30]
call sym.ProcessMonitor.dll_PhShowStatus
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x18002c110
Capabilities:
Shutdown system

Disassembly:
jmp 0x18002c110
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x18002c12e
mov al, 1
jmp 0x18002c14d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
xor r8d, r8d
lea rdx, str.Unable_to_log_off_the_computer.
mov rcx, qword [rsp + 0x30]
call sym.ProcessMonitor.dll_PhShowStatus
xor al, al
add rsp, 0x20
pop rdi
ret
Function at 0x18002ce50
Capabilities:
Shutdown system

Disassembly:
jmp 0x18002ce50
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x78
mov dword [rsp + 0x30], 0xc0000001
lea rcx, str.EnableWarnings
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x18002cea6
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.the_computer
lea rdx, str.restart
mov rcx, qword [rsp + 0x90]
call sym.ProcessMonitor.dll_PhShowConfirmMessage
movzx eax, al
test eax, eax
jne 0x18002cea6
jmp 0x18002cfd4
lea rcx, str.EnableBootObjectsEnumerate
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x18002cec0
mov dword [rsp + 0x60], 1
jmp 0x18002cec8
mov dword [rsp + 0x60], 0
movzx eax, byte [rsp + 0x60]
mov byte [rsp + 0x34], al
lea rcx, str.EnableUpdateDefaultFirmwareBootEntry
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x18002ceeb
mov dword [rsp + 0x64], 1
jmp 0x18002cef3
mov dword [rsp + 0x64], 0
movzx eax, byte [rsp + 0x64]
mov byte [rsp + 0x35], al
movzx ecx, byte [rsp + 0x34]
call fcn.180002ba0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18002cf6d
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
cmp dword [rsp + 0x98], eax
jae 0x18002cf63
mov eax, dword [rsp + 0x98]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 8]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov rdi, rax
mov rsi, qword [rsp + 0x40]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
movzx edx, byte [rsp + 0x35]
lea rcx, [rsp + 0x50]
call fcn.180009900
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x38]
call fcn.180016ea0
cmp dword [rsp + 0x30], 0
jl 0x18002cfb8
mov dword [rsp + 0x20], 0x80000000
mov r9d, 4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x18002cfb6
mov r9d, dword [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Unable_to_configure_the_boot_application.
mov rcx, qword [rsp + 0x90]
call sym.ProcessMonitor.dll_PhShowStatus
jmp 0x18002cfd4
xor r9d, r9d
mov r8d, dword [rsp + 0x30]
lea rdx, str.Unable_to_configure_the_boot_application.
mov rcx, qword [rsp + 0x90]
call sym.ProcessMonitor.dll_PhShowStatus
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x18002cff0
Capabilities:
Shutdown system

Disassembly:
jmp 0x18002cff0
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x68
mov dword [rsp + 0x30], 0xc0000001
lea rcx, str.EnableWarnings
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x18002d046
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.the_computer
lea rdx, str.restart
mov rcx, qword [rsp + 0x80]
call sym.ProcessMonitor.dll_PhShowConfirmMessage
movzx eax, al
test eax, eax
jne 0x18002d046
jmp 0x18002d114
call fcn.1800123c0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18002d0ad
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
cmp dword [rsp + 0x88], eax
jae 0x18002d0a3
mov eax, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 8]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov rdi, rax
mov rsi, qword [rsp + 0x40]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x50]
call fcn.18000d680
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x38]
call fcn.180016ea0
cmp dword [rsp + 0x30], 0
jl 0x18002d0f8
mov dword [rsp + 0x20], 0x80000000
mov r9d, 4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x18002d0f6
mov r9d, dword [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Unable_to_configure_the_boot_application.
mov rcx, qword [rsp + 0x80]
call sym.ProcessMonitor.dll_PhShowStatus
jmp 0x18002d114
xor r9d, r9d
mov r8d, dword [rsp + 0x30]
lea rdx, str.Unable_to_configure_the_boot_application.
mov rcx, qword [rsp + 0x80]
call sym.ProcessMonitor.dll_PhShowStatus
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x180030220
Capabilities:
Start service

Disassembly:
jmp 0x180030220
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x30]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x80]
mov rax, qword [0x1805a6200]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x38], 0
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x10]
mov edx, 0x10
mov rcx, qword [rax + 8]
call sym.ProcessMonitor.dll_PhOpenService
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1800302a7
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x18003029c
mov byte [rsp + 0x38], 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, byte [rsp + 0x38]
test eax, eax
jne 0x180030389
call fcn.180010890
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 8]
lea rcx, str.Unable_to_start
call fcn.1800023e0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x3c]
mov rdx, qword [rax + 8]
mov rcx, qword [rsp + 0x80]
call fcn.180004330
movzx eax, al
test eax, eax
je 0x180030360
movzx eax, byte [rsp + 0x44]
test eax, eax
je 0x18003035e
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x10]
mov edx, 1
mov rcx, qword [rax + 8]
call fcn.180014350
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jl 0x180030330
mov byte [rsp + 0x38], 1
jmp 0x180030359
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x3c]
mov r8, qword [rsp + 0x88]
lea rdx, str.start
mov rcx, qword [rsp + 0x80]
call fcn.180033d10
call sym.ProcessMonitor.dll_PhUiDisconnectFromPhSvc
jmp 0x180030389
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x3c]
mov r8, qword [rsp + 0x88]
lea rdx, str.start
mov rcx, qword [rsp + 0x80]
call fcn.180033d10
movzx eax, byte [rsp + 0x38]
mov edi, eax
mov rcx, rsp
lea rdx, [0x18039ab60]
call fcn.180014e20
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18000ce90
add rsp, 0x70
pop rdi
ret
Function at 0x1800303c0
Capabilities:
Continue service

Disassembly:
jmp 0x1800303c0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
lea rdi, [rsp + 0x30]
mov ecx, 0x20
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xc0]
mov rax, qword [0x1805a6200]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov byte [rsp + 0x38], 0
mov rax, qword [rsp + 0xc8]
mov rax, qword [rax + 0x10]
mov edx, 0x40
mov rcx, qword [rax + 8]
call sym.ProcessMonitor.dll_PhOpenService
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x180030452
lea r8, [rsp + 0x48]
mov edx, 3
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x180030447
mov byte [rsp + 0x38], 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, byte [rsp + 0x38]
test eax, eax
jne 0x18003053a
call fcn.180010890
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0xc8]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 8]
lea rcx, str.Unable_to_continue
call fcn.1800023e0
lea r9, [rsp + 0x84]
mov r8d, dword [rsp + 0x74]
mov rdx, qword [rax + 8]
mov rcx, qword [rsp + 0xc0]
call fcn.180004330
movzx eax, al
test eax, eax
je 0x180030511
movzx eax, byte [rsp + 0x84]
test eax, eax
je 0x18003050f
mov rax, qword [rsp + 0xc8]
mov rax, qword [rax + 0x10]
mov edx, 2
mov rcx, qword [rax + 8]
call fcn.180014350
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0
jl 0x1800304e1
mov byte [rsp + 0x38], 1
jmp 0x18003050a
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x74]
mov r8, qword [rsp + 0xc8]
lea rdx, [0x18039e1f8]
mov rcx, qword [rsp + 0xc0]
call fcn.180033d10
call sym.ProcessMonitor.dll_PhUiDisconnectFromPhSvc
jmp 0x18003053a
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x74]
mov r8, qword [rsp + 0xc8]
lea rdx, [0x18039e1f8]
mov rcx, qword [rsp + 0xc0]
call fcn.180033d10
movzx eax, byte [rsp + 0x38]
mov edi, eax
mov rcx, rsp
lea rdx, [0x18039ac10]
call fcn.180014e20
mov eax, edi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.18000ce90
add rsp, 0xb0
pop rdi
ret
Function at 0x180030580
Capabilities:
Pause service

Disassembly:
jmp 0x180030580
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
lea rdi, [rsp + 0x30]
mov ecx, 0x20
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xc0]
mov rax, qword [0x1805a6200]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov byte [rsp + 0x38], 0
mov rax, qword [rsp + 0xc8]
mov rax, qword [rax + 0x10]
mov edx, 0x40
mov rcx, qword [rax + 8]
call sym.ProcessMonitor.dll_PhOpenService
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x180030612
lea r8, [rsp + 0x48]
mov edx, 2
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x180030607
mov byte [rsp + 0x38], 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, byte [rsp + 0x38]
test eax, eax
jne 0x1800306fa
call fcn.180010890
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0xc8]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 8]
lea rcx, str.Unable_to_pause
call fcn.1800023e0
lea r9, [rsp + 0x84]
mov r8d, dword [rsp + 0x74]
mov rdx, qword [rax + 8]
mov rcx, qword [rsp + 0xc0]
call fcn.180004330
movzx eax, al
test eax, eax
je 0x1800306d1
movzx eax, byte [rsp + 0x84]
test eax, eax
je 0x1800306cf
mov rax, qword [rsp + 0xc8]
mov rax, qword [rax + 0x10]
mov edx, 3
mov rcx, qword [rax + 8]
call fcn.180014350
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0
jl 0x1800306a1
mov byte [rsp + 0x38], 1
jmp 0x1800306ca
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x74]
mov r8, qword [rsp + 0xc8]
lea rdx, str.pause
mov rcx, qword [rsp + 0xc0]
call fcn.180033d10
call sym.ProcessMonitor.dll_PhUiDisconnectFromPhSvc
jmp 0x1800306fa
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x74]
mov r8, qword [rsp + 0xc8]
lea rdx, str.pause
mov rcx, qword [rsp + 0xc0]
call fcn.180033d10
movzx eax, byte [rsp + 0x38]
mov edi, eax
mov rcx, rsp
lea rdx, [0x18039acc0]
call fcn.180014e20
mov eax, edi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.18000ce90
add rsp, 0xb0
pop rdi
ret
Function at 0x180030740
Capabilities:
Stop service

Disassembly:
jmp 0x180030740
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
lea rdi, [rsp + 0x30]
mov ecx, 0x20
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xc0]
mov rax, qword [0x1805a6200]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov byte [rsp + 0x38], 0
mov rax, qword [rsp + 0xc8]
mov rax, qword [rax + 0x10]
mov edx, 0x20
mov rcx, qword [rax + 8]
call sym.ProcessMonitor.dll_PhOpenService
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1800307d2
lea r8, [rsp + 0x48]
mov edx, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1800307c7
mov byte [rsp + 0x38], 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, byte [rsp + 0x38]
test eax, eax
jne 0x1800308ba
call fcn.180010890
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0xc8]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 8]
lea rcx, str.Unable_to_stop
call fcn.1800023e0
lea r9, [rsp + 0x84]
mov r8d, dword [rsp + 0x74]
mov rdx, qword [rax + 8]
mov rcx, qword [rsp + 0xc0]
call fcn.180004330
movzx eax, al
test eax, eax
je 0x180030891
movzx eax, byte [rsp + 0x84]
test eax, eax
je 0x18003088f
mov rax, qword [rsp + 0xc8]
mov rax, qword [rax + 0x10]
mov edx, 4
mov rcx, qword [rax + 8]
call fcn.180014350
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0
jl 0x180030861
mov byte [rsp + 0x38], 1
jmp 0x18003088a
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x74]
mov r8, qword [rsp + 0xc8]
lea rdx, str.stop
mov rcx, qword [rsp + 0xc0]
call fcn.180033d10
call sym.ProcessMonitor.dll_PhUiDisconnectFromPhSvc
jmp 0x1800308ba
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x74]
mov r8, qword [rsp + 0xc8]
lea rdx, str.stop
mov rcx, qword [rsp + 0xc0]
call fcn.180033d10
movzx eax, byte [rsp + 0x38]
mov edi, eax
mov rcx, rsp
lea rdx, [0x18039ad70]
call fcn.180014e20
mov eax, edi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.18000ce90
add rsp, 0xb0
pop rdi
ret
Function at 0x180030900
Capabilities:
Delete service

Disassembly:
jmp 0x180030900
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x30]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x80]
mov rax, qword [0x1805a6200]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x38], 0
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x10]
mov byte [rsp + 0x20], 1
lea r9, str.Deleting_a_service_can_prevent_the_system_from_starting_or_functioning_properly.
mov r8, qword [rax + 8]
lea rdx, [0x18039e348]
mov rcx, qword [rsp + 0x80]
call sym.ProcessMonitor.dll_PhShowConfirmMessage
movzx eax, al
test eax, eax
jne 0x18003097a
xor al, al
jmp 0x180030aa7
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x10]
mov edx, 0x10000
mov rcx, qword [rax + 8]
call sym.ProcessMonitor.dll_PhOpenService
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1800309c0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x1800309b5
mov byte [rsp + 0x38], 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, byte [rsp + 0x38]
test eax, eax
jne 0x180030aa2
call fcn.180010890
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 8]
lea rcx, str.Unable_to_delete
call fcn.1800023e0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x3c]
mov rdx, qword [rax + 8]
mov rcx, qword [rsp + 0x80]
call fcn.180004330
movzx eax, al
test eax, eax
je 0x180030a79
movzx eax, byte [rsp + 0x44]
test eax, eax
je 0x180030a77
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x10]
mov edx, 5
mov rcx, qword [rax + 8]
call fcn.180014350
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jl 0x180030a49
mov byte [rsp + 0x38], 1
jmp 0x180030a72
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x3c]
mov r8, qword [rsp + 0x88]
lea rdx, [0x18039e348]
mov rcx, qword [rsp + 0x80]
call fcn.180033d10
call sym.ProcessMonitor.dll_PhUiDisconnectFromPhSvc
jmp 0x180030aa2
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x3c]
mov r8, qword [rsp + 0x88]
lea rdx, [0x18039e348]
mov rcx, qword [rsp + 0x80]
call fcn.180033d10
movzx eax, byte [rsp + 0x38]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x18039add0]
call fcn.180014e20
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18000ce90
add rsp, 0x70
pop rdi
ret
Function at 0x180030fb0
Capabilities:
Suspend thread

Disassembly:
jmp 0x180030fb0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x30]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa0]
mov rax, qword [0x1805a6200]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x31], 0
mov dword [rsp + 0x34], 0
jmp 0x180031010
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0xb0]
cmp dword [rsp + 0x34], eax
jae 0x180031188
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rcx + rax*8]
mov r8, qword [rax]
mov edx, 2
lea rcx, [rsp + 0x48]
call fcn.180012810
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jl 0x18003106a
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_NtSuspendThread]
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_NtClose]
cmp dword [rsp + 0x38], 0
jge 0x180031183
mov byte [rsp + 0x30], 0
movzx eax, byte [rsp + 0x31]
test eax, eax
jne 0x180031149
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax]
call fcn.180001d20
mov edx, eax
lea rcx, str.Unable_to_suspend_thread__lu
call fcn.180010960
lea r9, [rsp + 0x64]
mov r8d, dword [rsp + 0x38]
mov rdx, qword [rax + 8]
mov rcx, qword [rsp + 0xa0]
call fcn.180004330
movzx eax, al
test eax, eax
je 0x180031149
movzx eax, byte [rsp + 0x64]
test eax, eax
je 0x180031142
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rcx + rax*8]
xor r8d, r8d
mov edx, 2
mov rcx, qword [rax]
call fcn.18001a500
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jl 0x18003110a
mov byte [rsp + 0x30], 1
jmp 0x18003113b
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xa8]
mov r8, qword [rcx + rax*8]
lea rdx, str.suspend
mov rcx, qword [rsp + 0xa0]
call fcn.180033e10
call sym.ProcessMonitor.dll_PhUiDisconnectFromPhSvc
jmp 0x180031147
mov byte [rsp + 0x31], 1
jmp 0x180031183
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xa8]
mov r8, qword [rcx + rax*8]
lea rdx, str.suspend
mov rcx, qword [rsp + 0xa0]
call fcn.180033e10
movzx eax, al
test eax, eax
jne 0x180031183
jmp 0x180031188
jmp 0x180031006
movzx eax, byte [rsp + 0x30]
mov edi, eax
mov rcx, rsp
lea rdx, [0x18039afe0]
call fcn.180014e20
mov eax, edi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18000ce90
add rsp, 0x90
pop rdi
ret