joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140076d70
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov rbp, qword [0x140183698]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
lea rcx, [0x14017bd30]
mov rdx, qword [0x14017bd30]
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
lea rdx, [0x140129a38]
test rdx, 0xffffffffffff0000
jne 0x140076dec
movzx esi, dx
mov ecx, esi
call fcn.140002830
test rax, rax
je 0x140076dfe
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400029f0
jmp 0x140076df9
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.140002120
mov rbx, qword [rsp + 0x40]
test edi, edi
je 0x140076ea5
jns 0x140076e13
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140076e35
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.1400020c0
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 8], 1
jle 0x140076e4d
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140001fb0
mov rbx, qword [rsp + 0x40]
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400d4f10
test eax, eax
js 0x140076e9a
cmp eax, dword [rbx - 0xc]
jg 0x140076e9a
mov dword [rbx - 0x10], eax
cdqe
xor ecx, ecx
mov word [rbx + rax*2], cx
cmp dword [rbp + 0x188], ecx
je 0x140076ea5
lea r8, str.SysWOW64
lea rdx, str.system32
lea rcx, [rsp + 0x40]
call fcn.140014000
jmp 0x140076ea5
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov r8d, socket
lea rdx, str._sstray_devlists.dat
lea rcx, [rsp + 0x40]
call fcn.14003bd50
lea rdx, [rbp + 0x228]
lea rcx, [rsp + 0x40]
call fcn.1400763a0
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140076eee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140076f10
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov r12, rdx
mov rbp, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
lea rcx, [0x14017bd30]
mov r8, qword [0x14017bd30]
call qword [r8 + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
lea rdx, [0x140129a38]
test rdx, 0xffffffffffff0000
jne 0x140076f8a
movzx esi, dx
mov ecx, esi
call fcn.140002830
test rax, rax
je 0x140076f9c
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400029f0
jmp 0x140076f97
xor r8d, r8d
lea rcx, [rsp + 0x70]
call fcn.140002120
mov rbx, qword [rsp + 0x70]
test edi, edi
je 0x140077043
jns 0x140076fb1
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140076fd3
mov edx, edi
lea rcx, [rsp + 0x70]
call fcn.1400020c0
mov rbx, qword [rsp + 0x70]
cmp dword [rbx - 8], 1
jle 0x140076feb
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x70]
call fcn.140001fb0
mov rbx, qword [rsp + 0x70]
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400d4f10
test eax, eax
js 0x140077038
cmp eax, dword [rbx - 0xc]
jg 0x140077038
mov dword [rbx - 0x10], eax
cdqe
xor ecx, ecx
mov word [rbx + rax*2], cx
cmp dword [rbp + 0x188], ecx
je 0x140077043
lea r8, str.SysWOW64
lea rdx, str.system32
lea rcx, [rsp + 0x70]
call fcn.140014000
jmp 0x140077043
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str._sstray_forbidden.dat
lea rcx, [rsp + 0x70]
call fcn.14003bd50
lea rdx, [0x140131864]
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call fcn.1400d9d24
mov rsi, rax
test rax, rax
je 0x1400770ed
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call fcn.1400d9ee4
mov rcx, rsi
call fcn.1400da118
mov edi, eax
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.1400d9ee4
mov ebp, edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400770ed
mov qword [rsp + 0x20], rsi
mov r9d, ebp
mov r8d, 1
mov edx, ebp
mov rcx, rax
call fcn.1400d8b5c
test rax, rax
je 0x1400770e4
mov r8d, eax
mov rdx, rdi
mov rcx, r12
call fcn.1400147e0
mov rcx, rsi
call fcn.1400d79b4
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140077108
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x140077120
Capabilities:
Get common file path
Write file on windows

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbp
mov rbp, rcx
mov r12, qword [0x140183698]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
lea rcx, [0x14017bd30]
mov rdx, qword [0x14017bd30]
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
lea rdx, [0x140129a38]
test rdx, 0xffffffffffff0000
jne 0x14007719d
movzx esi, dx
mov ecx, esi
call fcn.140002830
test rax, rax
je 0x1400771af
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400029f0
jmp 0x1400771aa
xor r8d, r8d
lea rcx, [rsp + 0x58]
call fcn.140002120
mov rbx, qword [rsp + 0x58]
test edi, edi
je 0x140077258
jns 0x1400771c4
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400771e6
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.1400020c0
mov rbx, qword [rsp + 0x58]
cmp dword [rbx - 8], 1
jle 0x1400771fe
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140001fb0
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400d4f10
test eax, eax
js 0x14007724d
cmp eax, dword [rbx - 0xc]
jg 0x14007724d
mov dword [rbx - 0x10], eax
cdqe
xor ecx, ecx
mov word [rbx + rax*2], cx
cmp dword [r12 + 0x188], ecx
je 0x140077258
lea r8, str.SysWOW64
lea rdx, str.system32
lea rcx, [rsp + 0x58]
call fcn.140014000
jmp 0x140077258
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str._sstray_forbidden.dat
lea rcx, [rsp + 0x58]
call fcn.14003bd50
lea rdx, [0x140131868]
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.1400d9d24
mov rdi, rax
test rax, rax
je 0x1400772c2
mov rcx, qword [rbp]
movsxd rsi, dword [rcx - 0x10]
cmp dword [rcx - 8], 1
jle 0x1400772a4
mov edx, dword [rcx - 0x10]
mov rcx, rbp
call fcn.140002b80
mov rdx, rsi
mov r9, rdi
mov r8d, 1
mov rcx, qword [rbp]
call fcn.1400d6c94
mov rcx, rdi
call fcn.1400d79b4
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400772dd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x140077ee0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x308
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rcx, qword [0x140183698]
lea rdx, [rcx + 0x2a8]
call fcn.14006c950
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rsp + 0xe2]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r11d, 0x22
lea r8, str.___repair
lea rcx, [rsp + 0xe0]
mov edx, 0x104
mov word [rsp + 0xe0], r11w
call fcn.1400d9a0c
xor edx, edx
lea rcx, [rsp + 0x78]
lea r8d, [rdx + 0x60]
mov dword [rsp + 0x70], WSAGetLastError
call fcn.1400dd9f0
mov rcx, qword [0x140183698]
mov rcx, qword [rcx + 0x1b8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11, qword [0x140183698]
mov rcx, qword [r11 + 0x158]
test rcx, rcx
je 0x140077fa8
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0xe0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1400d4d90
add rsp, 0x308
ret
Function at 0x140081810
Capabilities:
Create directory
Delete file
Set file attributes
Write file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x2b0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rsi, rcx
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call fcn.1400853d0
nop
lea r8, [0x14012b480]
lea rdx, [0x14012f6a8]
lea rcx, [rsp + 0x30]
call fcn.140045040
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov edx, 2
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsi + 8]
lea rdx, [rsp + 0x40]
call fcn.1400376c0
nop
lea rcx, [0x14012b498]
mov qword [rsp + 0x20], rcx
mov r9, qword [rax]
mov r8, qword [rsp + 0x30]
lea rdx, str._s_s._s
lea rcx, [rsp + 0x38]
call fcn.140016060
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400818f9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rsp + 0x38]
cmp dword [rsi + 0x18], 0
je 0x14008192d
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14008192d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp qword [rsi + 0x28], 0
je 0x140081969
lea rdx, [0x140131ba8]
mov rcx, rbx
call fcn.1400d9d24
mov rbx, rax
test rax, rax
je 0x140081969
mov r8d, dword [rsi + 0x30]
mov r9, rax
mov edx, 1
mov rcx, qword [rsi + 0x28]
call fcn.1400d6c94
mov rcx, rbx
call fcn.1400d79b4
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140081989
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
dec edi
test edi, edi
jg 0x1400819a6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor eax, eax
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400d4d90
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140083d10
Capabilities:
Create directory
Delete file
Set file attributes
Write file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x2b0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rsi, rcx
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call fcn.1400853d0
nop
lea r8, [0x14012ad70]
lea rdx, [0x14012f6a8]
lea rcx, [rsp + 0x30]
call fcn.140045040
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov edx, 2
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsi + 8]
lea rdx, [rsp + 0x40]
call fcn.1400376c0
nop
lea rcx, [0x14012ad88]
mov qword [rsp + 0x20], rcx
mov r9, qword [rax]
mov r8, qword [rsp + 0x30]
lea rdx, str._s_s._s
lea rcx, [rsp + 0x38]
call fcn.140016060
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140083df9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rsp + 0x38]
cmp dword [rsi + 0x18], 0
je 0x140083e2d
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140083e2d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp qword [rsi + 0x28], 0
je 0x140083e69
lea rdx, [0x140131ba8]
mov rcx, rbx
call fcn.1400d9d24
mov rbx, rax
test rax, rax
je 0x140083e69
mov r8d, dword [rsi + 0x30]
mov r9, rax
mov edx, 1
mov rcx, qword [rsi + 0x28]
call fcn.1400d6c94
mov rcx, rbx
call fcn.1400d79b4
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140083e89
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
dec edi
test edi, edi
jg 0x140083ea6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor eax, eax
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400d4d90
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140084f10
Capabilities:
Create directory
Set file attributes
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rcx
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
call fcn.1400853d0
nop
mov rax, qword [0x140183738]
test rax, rax
je 0x140084f73
cmp dword [rax + 0x2a0], 0
je 0x140084f73
mov rdx, qword [rbx + 0x78]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.14003bd50
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov edx, 2
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea r8, [0x14012ab30]
lea rdx, [0x14012f530]
lea rcx, [rsp + 0x48]
call fcn.140045040
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov edx, 2
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov r9, qword [rbx + 0x148]
mov r8, qword [rsp + 0x48]
lea rdx, [0x14012f290]
lea rcx, [rsp + 0x50]
call fcn.140016060
lea rdx, [0x1401317b0]
mov rcx, qword [rsp + 0x50]
call fcn.1400d9d24
mov rdi, rax
test rax, rax
jne 0x140085048
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140085024
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x140085041
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov eax, 1
jmp 0x1400850ae
mov edx, dword [rbx + 0x140]
mov r9, rax
mov r8d, 1
mov rcx, qword [rbx + 0x138]
call fcn.1400d6c94
mov rcx, rdi
call fcn.1400d79b4
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14008508f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x1400850ac
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400853d0
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rbx, rcx
xor esi, esi
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
lea rdx, [0x140129a38]
mov rcx, rbx
call fcn.140002ad0
mov dword [rsp + 0x20], 1
test edi, edi
je 0x1400854a6
jns 0x14008542e
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov rax, qword [rbx]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or eax, ecx
jge 0x14008544c
mov edx, edi
mov rcx, rbx
call fcn.1400020c0
mov rax, qword [rbx]
cmp dword [rax - 8], 1
jle 0x140085460
mov edx, dword [rax - 0x10]
mov rcx, rbx
call fcn.140001fb0
mov rdx, qword [rbx]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140085477
mov eax, esi
jmp 0x140085484
movsxd rdx, dword [rcx - 0xc]
call fcn.1400d4f10
test eax, eax
js 0x14008549b
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14008549b
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], si
jmp 0x1400854a6
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov r8d, 1
lea rdx, [0x14012ed28]
mov rcx, rbx
call fcn.14003bd50
mov r8d, recv
lea rdx, str.TimeCtrlLibs
mov rcx, rbx
call fcn.14003bd50
mov r8d, 1
lea rdx, [0x14012ed28]
mov rcx, rbx
call fcn.14003bd50
cmp byte [0x140183050], 0
je 0x140085504
lea r8, str.SysWOW64
lea rdx, str.system32
mov rcx, rbx
call fcn.140014000
xor r8d, r8d
mov rdx, qword [rbx]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140085530
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rbx, rcx
xor esi, esi
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
lea rdx, [0x140129a38]
mov rcx, rbx
call fcn.140002ad0
mov dword [rsp + 0x20], 1
test edi, edi
je 0x140085606
jns 0x14008558e
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov rax, qword [rbx]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400855ac
mov edx, edi
mov rcx, rbx
call fcn.1400020c0
mov rax, qword [rbx]
cmp dword [rax - 8], 1
jle 0x1400855c0
mov edx, dword [rax - 0x10]
mov rcx, rbx
call fcn.140001fb0
mov rdx, qword [rbx]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1400855d7
mov eax, esi
jmp 0x1400855e4
movsxd rdx, dword [rcx - 0xc]
call fcn.1400d4f10
test eax, eax
js 0x1400855fb
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x1400855fb
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], si
jmp 0x140085606
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov r8d, 1
lea rdx, [0x14012ed28]
mov rcx, rbx
call fcn.14003bd50
mov r8d, 5
lea rdx, str.TCLog
mov rcx, rbx
call fcn.14003bd50
mov r8d, 1
lea rdx, [0x14012ed28]
mov rcx, rbx
call fcn.14003bd50
cmp byte [0x140183050], 0
je 0x140085664
lea r8, str.SysWOW64
lea rdx, str.system32
mov rcx, rbx
call fcn.140014000
xor r8d, r8d
mov rdx, qword [rbx]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140085690
Capabilities:
Query service status
Start service

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x1400856de
lea rcx, str.Cannot_open_SCM_Manager_n
call fcn.1400d8d08
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400d4d90
add rsp, 0x50
pop rdi
ret
lea rdx, [0x14012a890]
mov r8d, 0xf01ff
mov rcx, rax
mov qword [rsp + 0x68], rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x14008571d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, str.Cannot_open_The_Service_n
call fcn.1400d8d08
xor al, al
jmp 0x1400857fe
xor eax, eax
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1400857e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x41d
jne 0x1400857c3
xor ebx, ebx
nop dword [rax]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ecx, dword [rsp + 0x24]
test eax, eax
je 0x140085791
cmp ecx, 2
jne 0x140085791
mov eax, ebx
inc ebx
cmp eax, 5
jl 0x140085760
jmp 0x140085796
cmp ecx, 4
je 0x1400857e5
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, str.Cannot_start_The_Service_n
call fcn.1400d8d08
mov ecx, 0x41d
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x1400857f9
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, str.Cannot_start_The_Service_n
call fcn.1400d8d08
xor al, al
jmp 0x1400857f9
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400d4d90
add rsp, 0x50
pop rdi
ret
Function at 0x140085820
Capabilities:
Query service status
Stop service

Disassembly:
push rsi
sub rsp, 0x50
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14008586e
lea rcx, str.Cannot_open_SCM_Manager_n
call fcn.1400d8d08
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400d4d90
add rsp, 0x50
pop rsi
ret
lea rdx, [0x14012a890]
mov r8d, 0xf01ff
mov rcx, rax
mov qword [rsp + 0x68], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x1400858ad
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, str.Cannot_open_The_Service_n
call fcn.1400d8d08
xor al, al
jmp 0x14008595b
lea rcx, str.Stopping_The_Service_n
mov qword [rsp + 0x60], rbx
call fcn.1400d8d08
xor r11d, r11d
lea r8, [rsp + 0x20]
lea edx, [r11 + 1]
mov rcx, rdi
mov qword [rsp + 0x20], r11
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x38], r11d
call qword [sym.imp.ADVAPI32.dll_ControlService]
xor ebx, ebx
nop dword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140085928
mov eax, dword [rsp + 0x24]
cmp eax, 1
je 0x14008591a
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x24]
cmp eax, 3
jne 0x140085928
mov eax, ebx
inc ebx
cmp eax, 0x14
jl 0x1400858f0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.Starting_The_Service_n
call fcn.1400d8d08
call fcn.140085690
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400d4d90
add rsp, 0x50
pop rsi
ret