joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14020e222
Capabilities:
Create directory

Disassembly:
jmp 0x1403cf9a0
push rdi
sub rsp, 0x1b0
lea rdi, [rsp + 0x20]
mov ecx, 0x64
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140961e80]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
lea rcx, [0x14095f498]
call fcn.1402116e3
movzx eax, al
test eax, eax
je 0x1403cfc2c
call fcn.14021012b
mov qword [rsp + 0xe8], rax
lea rcx, [0x1407c2bf0]
call fcn.14020ddfe
mov eax, eax
mov qword [rsp + 0x188], rax
mov rcx, qword [rsp + 0xe8]
call fcn.14020ddfe
mov eax, eax
mov rcx, qword [rsp + 0x188]
lea rax, [rcx + rax + 0x48]
mov qword [rsp + 0x190], rax
lea rcx, [0x1407c2c50]
call fcn.14020ddfe
mov eax, eax
mov rcx, qword [rsp + 0x190]
lea rax, [rcx + rax + 0xc]
mov dword [rsp + 0x170], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x168], rax
mov rax, qword [rsp + 0x168]
add rax, 0x28
mov qword [rsp + 0x178], rax
mov edx, 1
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
mov eax, dword [rsp + 0x170]
sub rax, 0x28
mov r8d, 2
mov edx, eax
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.ntdll.dll_RtlCreateAcl]
lea r9, [0x1407c2bf0]
mov r8d, 0xf000f
mov edx, 2
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
mov r9, qword [rsp + 0xe8]
mov r8d, 0xf000f
mov edx, 2
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
lea r9, [0x1407c2c50]
mov r8d, 7
mov edx, 2
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
xor r9d, r9d
mov r8, qword [rsp + 0x178]
mov dl, 1
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
lea rdx, str.BaseNamedObjectsSystemInformer
lea rcx, [rsp + 0xf8]
call fcn.140213ae2
nop
mov dword [rsp + 0x128], 0x30
mov qword [rsp + 0x130], 0
cmp dword [0x14095f7f0], 0x64
jae 0x1403cfb5f
mov dword [rsp + 0x198], 0
jmp 0x1403cfb6a
mov dword [rsp + 0x198], 0x1000
mov eax, dword [rsp + 0x198]
bts eax, 7
mov dword [rsp + 0x140], eax
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x138], rax
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], 0
lea r8, [rsp + 0x128]
mov edx, 0x2000000
lea rcx, [0x14096b030]
call qword [sym.imp.ntdll.dll_NtCreateDirectoryObject]
mov eax, dword [rsp + 0x170]
cmp rax, 0xa8
jb 0x1403cfbec
mov r8d, 0x1db7
lea rdx, str.D:_source_repos_systeminformerphlibutil.c
lea rcx, str.sdAllocationLength___sizeof_securityDescriptorBuffer_
call fcn.14020a9dd
xor eax, eax
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.ntdll.dll_RtlLengthSecurityDescriptor]
mov eax, eax
cmp rax, 0xa8
jb 0x1403cfc1f
mov r8d, 0x1db8
lea rdx, str.D:_source_repos_systeminformerphlibutil.c
lea rcx, str.RtlLengthSecurityDescriptor_securityDescriptor____sizeof_securityDescriptorBuffer_
call fcn.14020a9dd
xor eax, eax
lea rcx, [0x14095f498]
call sym.SystemInformer.exe_PhfEndInitOnce
nop
mov rax, qword [0x14096b030]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x14078fdf0]
call fcn.1402124fd
mov rax, rdi
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14020ee98
add rsp, 0x1b0
pop rdi
ret
Function at 0x14020e385
Capabilities:
Check processdebugport

Disassembly:
jmp 0x1403f6830
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
lea rdi, [rsp + 0x30]
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rsp + 0x48]
mov edx, 7
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x1403f68bf
cmp qword [rsp + 0x48], 0
je 0x1403f689f
mov dword [rsp + 0x74], 1
jmp 0x1403f68a7
mov dword [rsp + 0x74], 0
mov rax, qword [rsp + 0x98]
movzx ecx, byte [rsp + 0x74]
mov byte [rax], cl
mov eax, dword [rsp + 0x30]
jmp 0x1403f6941
call sym.SystemInformer.exe_KsiLevel
cmp eax, 2
jl 0x1403f693d
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x64]
mov edx, 1
mov rcx, qword [rsp + 0x90]
call fcn.14020cc4c
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x1403f693d
mov eax, dword [rsp + 0x64]
and eax, 0x100
test eax, eax
je 0x1403f690e
mov byte [rsp + 0x78], 1
jmp 0x1403f6913
mov byte [rsp + 0x78], 0
movzx eax, byte [rsp + 0x78]
test eax, eax
jne 0x1403f6926
mov dword [rsp + 0x7c], 1
jmp 0x1403f692e
mov dword [rsp + 0x7c], 0
mov rax, qword [rsp + 0x98]
movzx ecx, byte [rsp + 0x7c]
mov byte [rax], cl
mov eax, dword [rsp + 0x30]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x14079eec0]
call fcn.1402124fd
mov rax, rdi
add rsp, 0x80
pop rdi
ret
Function at 0x14020e402
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1403c5b30
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
lea rdi, [rsp + 0x20]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x90]
mov rax, qword [0x140961e80]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x28]
call sym.SystemInformer.exe_PhQueryPerformanceCounter
nop
mov dword [rsp + 0x64], 0
jmp 0x1403c5b84
mov eax, dword [rsp + 0x64]
inc eax
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 6
jae 0x1403c5ba0
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntdll.dll_RtlRandomEx]
mov ecx, dword [rsp + 0x64]
mov dword [rsp + rcx*4 + 0x48], eax
jmp 0x1403c5b7a
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x90]
movzx eax, word [rsp + rax + 0x48]
mov word [rcx], ax
mov eax, 4
imul rax, rax, 0
mov eax, dword [rsp + rax + 0x48]
shr eax, 0x10
mov ecx, 4
imul rcx, rcx, 1
mov ecx, dword [rsp + rcx + 0x48]
and ecx, 0xff
or eax, ecx
mov rcx, qword [rsp + 0x90]
mov word [rcx + 2], ax
mov eax, 4
imul rax, rax, 1
mov eax, dword [rsp + rax + 0x48]
shr eax, 8
mov rcx, qword [rsp + 0x90]
mov word [rcx + 4], ax
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x90]
movzx eax, word [rsp + rax + 0x48]
mov word [rcx + 6], ax
mov eax, 4
imul rax, rax, 2
mov eax, dword [rsp + rax + 0x48]
shr eax, 0x10
mov ecx, 4
imul rcx, rcx, 3
mov ecx, dword [rsp + rcx + 0x48]
and ecx, 0xff
or eax, ecx
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x90]
mov word [rdx + rcx + 8], ax
mov eax, 4
imul rax, rax, 3
mov eax, dword [rsp + rax + 0x48]
shr eax, 8
mov ecx, 1
imul rcx, rcx, 2
mov rdx, qword [rsp + 0x90]
mov word [rdx + rcx + 8], ax
mov eax, 4
imul rax, rax, 4
mov ecx, 1
imul rcx, rcx, 4
mov rdx, qword [rsp + 0x90]
movzx eax, word [rsp + rax + 0x48]
mov word [rdx + rcx + 8], ax
mov eax, 4
imul rax, rax, 4
mov eax, dword [rsp + rax + 0x48]
shr eax, 0x10
mov ecx, 4
imul rcx, rcx, 5
mov ecx, dword [rsp + rcx + 0x48]
and ecx, 0xff
or eax, ecx
mov ecx, 1
imul rcx, rcx, 6
mov rdx, qword [rsp + 0x90]
mov word [rdx + rcx + 8], ax
mov rax, qword [rsp + 0x90]
movzx eax, byte [rax + 7]
and al, 0xf
or al, 0x40
mov rcx, qword [rsp + 0x90]
mov byte [rcx + 7], al
mov rax, qword [rsp + 0x90]
movzx eax, byte [rax + 8]
and eax, 0xffffff3f
mov rcx, qword [rsp + 0x90]
mov byte [rcx + 8], al
mov rax, qword [rsp + 0x90]
movzx eax, byte [rax + 8]
bts eax, 7
mov rcx, qword [rsp + 0x90]
mov byte [rcx + 8], al
mov rcx, rsp
lea rdx, [0x14078c090]
call fcn.1402124fd
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14020ee98
add rsp, 0x80
pop rdi
ret
Function at 0x14020e565
Capabilities:
Get file attributes

Disassembly:
jmp 0x1403e95c0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x30]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 8]
and eax, 0xc
test eax, eax
jne 0x1403e9656
mov dword [rsp + 0x20], 0xe
mov r9d, 8
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x68]
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x1403e9637
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
nop
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x48]
cmp qword [rax + 0x10], rcx
je 0x1403e9656
mov ecx, 0xc00000e5
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
nop
mov rcx, rsp
lea rdx, [0x140799c80]
call fcn.1402124fd
add rsp, 0x90
pop rdi
ret
Function at 0x14020e8a8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14063c070
mov rax, rcx
neg rcx
test rax, 7
je 0x14063c08d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x14063c0e8
test al, 7
jne 0x14063c080
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x14063c0a1
mov rdx, qword [rax - 8]
test dl, dl
je 0x14063c112
test dh, dh
je 0x14063c10c
shr rdx, 0x10
test dl, dl
je 0x14063c106
test dh, dh
je 0x14063c100
shr rdx, 0x10
test dl, dl
je 0x14063c0fa
test dh, dh
je 0x14063c0f4
shr edx, 0x10
test dl, dl
je 0x14063c0ee
test dh, dh
jne 0x14063c0a1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x14020e8bc
Capabilities:
Get file attributes

Disassembly:
jmp 0x1403ff430
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
lea rdi, [rsp + 0x60]
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xc0]
mov byte [rsp + 0x94], 1
mov dword [rsp + 0x98], 0x2000
mov eax, dword [rsp + 0x98]
mov ecx, eax
call sym.SystemInformer.exe_PhAllocate
mov qword [rsp + 0xa0], rax
xor eax, eax
cmp eax, 1
je 0x1403ff594
movzx eax, byte [rsp + 0x94]
mov byte [rsp + 0x50], al
mov qword [rsp + 0x48], 0
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x21
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0x103
jne 0x1403ff522
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jl 0x1403ff522
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0x80000006
jne 0x1403ff536
mov dword [rsp + 0x60], 0
jmp 0x1403ff594
cmp dword [rsp + 0x60], 0
jge 0x1403ff53f
jmp 0x1403ff594
mov r9, qword [rsp + 0xd0]
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xc0]
call qword [rsp + 0xc8]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0x80000006
jne 0x1403ff57e
mov dword [rsp + 0x60], 0
jmp 0x1403ff594
cmp dword [rsp + 0x60], 0
jge 0x1403ff587
jmp 0x1403ff594
mov byte [rsp + 0x94], 0
jmp 0x1403ff489
mov rcx, qword [rsp + 0xa0]
call sym.SystemInformer.exe_PhFree
mov eax, dword [rsp + 0x60]
mov edi, eax
mov rcx, rsp
lea rdx, [0x1407a3790]
call fcn.1402124fd
mov eax, edi
add rsp, 0xb0
pop rdi
ret
Function at 0x14020eace
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x1403efcf0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x120
lea rdi, [rsp + 0x30]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x130]
mov rax, qword [rsp + 0x140]
cmp qword [rax + 8], 0
jne 0x1403efd3e
mov eax, 0xc000000d
jmp 0x1403efe9b
mov dword [rsp + 0x20], 0
lea r9, [0x14095f908]
mov r8, 0xfffffffffffffffd
mov edx, 0x20019
lea rcx, [rsp + 0x48]
call sym.SystemInformer.exe_PhOpenKey
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x1403efd77
mov eax, dword [rsp + 0x30]
jmp 0x1403efe9b
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
mov rdx, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_NtClose]
cmp dword [rsp + 0x30], 0xc0000034
jne 0x1403efdf3
lea rdx, [rsp + 0xf8]
mov rcx, qword [rsp + 0x140]
call fcn.140211c0b
xor edx, edx
lea rcx, [rsp + 0xf8]
call sym.SystemInformer.exe_PhVerifyFileIsChainedToMicrosoft
movzx eax, al
test eax, eax
jne 0x1403efdf3
mov eax, 0xc0000361
jmp 0x1403efe9b
lea r9, [rsp + 0x88]
mov r8, qword [rsp + 0x140]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_LdrLoadDll]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x1403efe1e
mov eax, dword [rsp + 0x30]
jmp 0x1403efe9b
lea rdx, str.OutOfProcessFunctionTableCallback
lea rcx, [rsp + 0xa8]
call fcn.14020da25
lea r9, [rsp + 0xd8]
xor r8d, r8d
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x1403efe89
mov r9, qword [rsp + 0x148]
mov r8, qword [rsp + 0x150]
mov rdx, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x130]
call qword [rsp + 0xd8]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntdll.dll_LdrUnloadDll]
mov eax, dword [rsp + 0x30]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x14079c2c0]
call fcn.1402124fd
mov rax, rdi
add rsp, 0x120
pop rdi
ret
Function at 0x14020ee34
Capabilities:
Create thread

Disassembly:
jmp 0x1403ad9f0
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x168
lea rdi, [rsp + 0x60]
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x180]
mov rax, qword [0x140961e80]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rax, [rsp + 0xe8]
mov rdi, rax
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x118], rax
lea rax, [rsp + 0x128]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov dword [rsp + 0x98], 0x30
mov qword [rsp + 0xa0], 0
mov dword [rsp + 0xb0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x118]
mov qword [rax], 0x28
mov eax, 0x20
imul rax, rax, 0
mov rcx, qword [rsp + 0x118]
mov qword [rcx + rax + 8], 0x10003
mov eax, 0x20
imul rax, rax, 0
mov rcx, qword [rsp + 0x118]
mov qword [rcx + rax + 0x10], 0x10
mov eax, 0x20
imul rax, rax, 0
mov rcx, qword [rsp + 0x118]
lea rdx, [rsp + 0x128]
mov qword [rcx + rax + 0x18], rdx
mov eax, 0x20
imul rax, rax, 0
mov rcx, qword [rsp + 0x118]
mov qword [rcx + rax + 0x20], 0
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x180]
lea r8, [rsp + 0x98]
mov edx, 0x1fffff
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtCreateThreadEx]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jl 0x1403adc1b
cmp qword [rsp + 0x1c0], 0
je 0x1403adbe2
mov rax, qword [rsp + 0x1c0]
mov rcx, qword [rsp + 0x78]
mov qword [rax], rcx
jmp 0x1403adbf6
cmp qword [rsp + 0x78], 0
je 0x1403adbf6
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtClose]
nop
cmp qword [rsp + 0x1c8], 0
je 0x1403adc1b
lea rax, [rsp + 0x128]
mov rdi, qword [rsp + 0x1c8]
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0x60]
mov edi, eax
mov rcx, rsp
lea rdx, [0x140788d00]
call fcn.1402124fd
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14020ee98
add rsp, 0x168
pop rdi
pop rsi
ret
Function at 0x14020f118
Capabilities:
Start service

Disassembly:
jmp 0x1404298d0
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov r8, qword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x140429905
mov dword [rsp + 0x20], 0
jmp 0x14042990e
call fcn.1402107d9
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
Function at 0x14020f307
Capabilities:
Create service

Disassembly:
jmp 0x140429160
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
lea rdi, [rsp + 0x70]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xb0]
mov r8d, 2
xor edx, edx
lea rcx, [rsp + 0x88]
call fcn.14020aded
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
jl 0x140429289
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xd0]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xc8]
mov r8, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
je 0x140429272
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x98]
mov qword [rax], rcx
mov dword [rsp + 0x70], 0
jmp 0x14042927b
call fcn.1402107d9
mov dword [rsp + 0x70], eax
mov rcx, qword [rsp + 0x88]
call sym.SystemInformer.exe_PhCloseServiceHandle
nop
mov eax, dword [rsp + 0x70]
mov edi, eax
mov rcx, rsp
lea rdx, [0x1407b7c10]
call fcn.1402124fd
mov eax, edi
add rsp, 0xa0
pop rdi
ret

Function at 0x14020f31b
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1405631c0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140562b40
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1405631ff
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1409a0020]
jmp 0x140563209
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x14020f3a7
Capabilities:
Get graphical window text

Disassembly:
jmp 0x1403d82c0
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
lea rdi, [rsp + 0x20]
mov ecx, 0x20
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xb0]
mov rax, qword [0x140961e80]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov eax, dword [rsp + 0xb8]
and eax, 1
test eax, eax
je 0x1403d83e2
mov eax, dword [rsp + 0xb8]
and eax, 2
test eax, eax
je 0x1403d835a
mov r8d, 0x20
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_InternalGetWindowText]
mov dword [rsp + 0x28], eax
cmp qword [rsp + 0xc0], 0
je 0x1403d8358
mov rax, qword [rsp + 0xc0]
mov qword [rax], 0
jmp 0x1403d83d4
mov edx, 0x200
xor ecx, ecx
call sym.SystemInformer.exe_PhCreateStringEx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax]
xor edx, edx
mov ecx, 2
div rcx
inc rax
mov r8d, eax
mov rax, qword [rsp + 0x20]
mov rdx, qword [rax + 8]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_InternalGetWindowText]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
shl rax, 1
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
cmp qword [rsp + 0xc0], 0
je 0x1403d83c9
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
jmp 0x1403d83d4
mov rcx, qword [rsp + 0x20]
call sym.SystemInformer.exe_PhDereferenceObject
nop
mov eax, dword [rsp + 0x28]
jmp 0x1403d84cc
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1403d8409
mov eax, dword [rsp + 0xb8]
and eax, 2
test eax, eax
je 0x1403d842d
cmp qword [rsp + 0xc0], 0
je 0x1403d8424
call sym.SystemInformer.exe_PhReferenceEmptyString
mov rcx, qword [rsp + 0xc0]
mov qword [rcx], rax
mov eax, dword [rsp + 0x28]
jmp 0x1403d84cc
mov eax, dword [rsp + 0x28]
shl rax, 1
mov rdx, rax
xor ecx, ecx
call sym.SystemInformer.exe_PhCreateStringEx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax]
xor edx, edx
mov ecx, 2
div rcx
inc rax
mov r8d, eax
mov rax, qword [rsp + 0x20]
mov rdx, qword [rax + 8]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x1403d84a5
cmp qword [rsp + 0xc0], 0
je 0x1403d8492
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
jmp 0x1403d849d
mov rcx, qword [rsp + 0x20]
call sym.SystemInformer.exe_PhDereferenceObject
nop
mov eax, dword [rsp + 0x28]
jmp 0x1403d84cc
cmp qword [rsp + 0xc0], 0
je 0x1403d84c0
call sym.SystemInformer.exe_PhReferenceEmptyString
mov rcx, qword [rsp + 0xc0]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x20]
call sym.SystemInformer.exe_PhDereferenceObject
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140793a50]
call fcn.1402124fd
mov rax, rdi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14020ee98
add rsp, 0xa0
pop rdi
ret
Function at 0x14020f3e3
Capabilities:
Enumerate gui resources

Disassembly:
jmp 0x1403da0c0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_EnumWindows]
nop
add rsp, 0x20
pop rdi
ret