joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400eff80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rdi, r8
mov rbx, rdx
mov rdx, rcx
lea r12, [0x14016d280]
mov r10, qword [0x14016d280]
cmp r10, r12
je 0x1400effef
test byte [r10 + 0x1c], 4
je 0x1400effef
mov rax, qword [r8 + 8]
add rax, qword [r8]
mov r9, qword [rbx + 8]
add r9, qword [rbx]
mov edx, 0xf
mov qword [rsp + 0x20], rax
lea r8, [0x140148870]
mov rcx, qword [r10 + 0x10]
call fcn.14004482c
mov r10, qword [0x14016d280]
mov rdx, qword [rsp + 0xc0]
mov rsi, qword [rdi + 8]
add rsi, qword [rdi]
mov qword [rsp + 0xd0], rsi
mov rbp, qword [rbx + 8]
add rbp, qword [rbx]
mov qword [rsp + 0xd8], rbp
cmp rsi, rbp
je 0x1400f0042
xor r14d, r14d
cmp rsi, rbp
jge 0x1400f0055
cmp r10, r12
je 0x1400f0042
test byte [r10 + 0x1c], 1
je 0x1400f0042
lea edx, [r14 + 0x10]
mov qword [rsp + 0x20], rsi
mov r9, rbp
lea r8, [0x140148870]
mov rcx, qword [r10 + 0x10]
call fcn.14004482c
xor eax, eax
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
add rdx, 0x10
mov r8, rbx
lea rcx, [rsp + 0x48]
call fcn.1400f0a5c
nop
mov r15d, 0x400
mov ecx, r15d
call fcn.140030f88
mov rbx, rax
mov qword [rsp + 0x30], rax
lea rdi, [rax + 0x400]
mov qword [rsp + 0x40], rdi
mov r8d, r15d
xor edx, edx
mov rcx, rax
call fcn.140032e00
mov qword [rsp + 0x38], rdi
mov rax, rsi
sub rax, rbp
mov r15d, 0
je 0x1400f016b
mov r12, rdi
sub r12, rbx
mov rsi, rax
mov rbp, qword [rsp + 0xc0]
mov r13, rsi
sub r13, r15
cmp r13, r12
cmovae r13, r12
mov r8, r13
mov rdx, rbx
mov rcx, rbp
call fcn.1400f0614
xor edx, edx
mov r9, r12
cmp r13, r12
cmovbe r9, r13
mov rcx, r9
shr rcx, 2
and r9d, 3
xor eax, eax
test rcx, rcx
je 0x1400f0104
xor edx, dword [rax + rbx]
add rax, 4
sub rcx, 1
jne 0x1400f00f7
test r9, r9
je 0x1400f0145
and dword [rsp + 0xc8], 0
xor r8d, r8d
lea rcx, [rsp + 0xc8]
sub rax, rcx
lea r10, [rax + rbx]
cmp r8, r9
jae 0x1400f013e
lea rcx, [rsp + 0xc8]
add rcx, r8
mov al, byte [rcx + r10]
mov byte [rcx], al
inc r8
jmp 0x1400f0123
xor edx, dword [rsp + 0xc8]
xor r14d, edx
add r15, r13
cmp r15, rsi
jb 0x1400f00be
mov rsi, qword [rsp + 0xd0]
mov rbp, qword [rsp + 0xd8]
lea r12, [0x14016d280]
test rbx, rbx
je 0x1400f01a0
sub rdi, rbx
cmp rdi, 0x1000
jb 0x1400f0194
add rdi, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x1400f01e8
mov rbx, rcx
mov rdx, rdi
mov rcx, rbx
call fcn.140030ba0
nop
mov rdx, qword [rsp + 0x50]
add rdx, qword [rsp + 0x58]
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
call fcn.1400f06f4
nop
mov rcx, qword [0x14016d280]
cmp rcx, r12
je 0x1400f01e0
test byte [rcx + 0x1c], 4
je 0x1400f01e0
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
mov r9, rbp
mov rcx, qword [rcx + 0x10]
call fcn.1400c82ac
mov eax, r14d
jmp 0x1400f0044
call fcn.140006074
int3
Function at 0x1400f3988
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140173950]
xor rax, rsp
mov qword [rsp + 0x18], rax
mov rax, qword [rcx + 0x148]
xor r9d, r9d
shr rcx, 4
mov r8d, r9d
mov qword [rsp], rcx
mov ecx, r9d
mov rdx, qword [rax + 8]
movups xmm0, xmmword [rdx - 0x10]
movdqu xmmword [rsp + 8], xmm0
movzx eax, byte [rsp + rcx + 8]
inc rcx
add eax, r8d
imul r8d, eax, 0x401
mov eax, r8d
shr eax, 6
xor r8d, eax
cmp rcx, 0x10
jb 0x1400f39c1
movzx eax, byte [rsp + r9]
inc r9
add eax, r8d
imul r8d, eax, 0x401
mov eax, r8d
shr eax, 6
xor r8d, eax
cmp r9, 8
jb 0x1400f39e2
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, 0x6fd91d85
imul r8d, ecx, 0x8001
mul r8d
shr edx, 0x12
imul ecx, edx, 0x927c0
sub r8d, ecx
lea eax, [r8 + 0x927c0]
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.140030b80
add rsp, 0x28
ret

Function at 0x1400f516c
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rbx, rdx
cmp qword [0x140176978], 0
jne 0x1400f528d
mov edi, 0x48
mov ecx, edi
call fcn.140030f88
mov qword [rsp + 0x50], rax
mov r9b, 1
mov r8, rbx
mov rcx, rax
call fcn.1400f4930
nop
mov rbx, qword [0x140176978]
mov qword [0x140176978], rax
test rbx, rbx
je 0x1400f51d7
mov rcx, rbx
call fcn.1400f4a54
mov edx, edi
mov rcx, rbx
call fcn.140030ba0
nop
jmp 0x1400f51e1
and qword [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
call fcn.1400f4fd4
lea rdx, str._n_n______________________________________________________________________________________n
lea rcx, [0x14014abd8]
call fcn.1400f5500
lea rdi, [0x14013b3d0]
mov rbx, qword [rsp + 0x50]
test rbx, rbx
cmovne rdi, rbx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r9, rdi
mov r8, rax
lea rdx, [0x1401204c8]
lea rcx, str._s:_Command_Line:__s_n_Start_Time:__s_n_n
call fcn.1400f5500
test rbx, rbx
je 0x1400f528d
mov rcx, rbx
call qword [sym.imp.mpclient.dll_MpFreeMemory]
jmp 0x1400f528d
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400f5748
Capabilities:
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
and qword [rax + 0x10], 0
mov r8, rcx
lea rdx, str._ls.bak
lea rcx, [rax + 0x10]
call fcn.1400fb304
mov ebx, eax
test eax, eax
jns 0x1400f578f
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400f5788
call fcn.140030ba0
mov eax, ebx
jmp 0x1400f5868
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.1400f6dd0
mov edi, eax
cmp eax, 0x80070001
jle 0x1400f5815
lea ecx, [rax + 0x7ff8fffc]
cmp ecx, 0x7ff8fffb
jbe 0x1400f5815
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1400f5804
call fcn.1400fb4fc
mov edi, eax
test eax, eax
jns 0x1400f5804
lea rax, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rax
je 0x1400f5859
test byte [rcx + 0x1c], 1
je 0x1400f5859
mov edx, 0x1d
mov r9d, edi
lea r8, [0x14014adc8]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
jmp 0x1400f5859
test rbx, rbx
je 0x1400f5811
mov rcx, rbx
call fcn.140030ba0
xor eax, eax
jmp 0x1400f5868
lea rax, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rax
je 0x1400f584b
test byte [rcx + 0x1c], 1
je 0x1400f584b
mov edx, 0x1c
mov qword [rsp + 0x20], rbx
mov r9d, edi
lea r8, [0x14014adc8]
mov rcx, qword [rcx + 0x10]
call fcn.1400443f8
mov edx, edi
lea rcx, str.ERROR:_UtilDeletePathSafe___failed___X__n
call fcn.1400f5500
test rbx, rbx
je 0x1400f5866
mov rcx, rbx
call fcn.140030ba0
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400f7000
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, edi
mov rcx, rbp
mov ebx, eax
call fcn.1400faddc
test al, al
je 0x1400f7081
lea esi, [rdi + 0x3a98]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, ebx
cmp esi, ecx
ja 0x1400f7049
sub ebx, eax
cmp esi, ebx
jbe 0x1400f706b
mov edx, edi
lea rcx, str.ERROR:_Process_Hand___timeout__lu_n
call fcn.1400f5500
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x5b4
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, edi
mov rcx, rbp
mov ebx, eax
call fcn.1400faddc
test al, al
jne 0x1400f7035
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400fa108
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400fa123
xor eax, eax
jmp 0x1400fa16c
call fcn.1400fb4fc
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x1400fa16a
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x1400fa16a
test byte [rcx + 0x1c], 1
je 0x1400fa16a
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014be40]
mov edx, 0x28
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.140044694
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400fa178
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, dword [rdx]
mov rdi, r8
mov rsi, rdx
mov r8d, ebx
mov rdx, rdi
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
mov r9d, eax
test eax, eax
jne 0x1400fa1ec
call fcn.1400fb4fc
mov ebx, eax
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x1400fa1e8
test byte [rcx + 0x1c], 1
je 0x1400fa1e8
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014be40]
mov edx, 0x2a
mov dword [rsp + 0x20], ebx
mov r9, rbp
call fcn.140044694
mov eax, ebx
jmp 0x1400fa20e
cmp r9d, ebx
ja 0x1400fa202
lea eax, [r9 - 1]
cmp word [rdi + rax*2], dx
je 0x1400fa209
mov eax, 0x8000ffff
jmp 0x1400fa20e
test ebx, ebx
je 0x1400fa209
mov word [rdi], dx
mov qword [rsi], r9
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400fa27c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400fa2e5
call fcn.1400fb4fc
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x1400fa2e1
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x1400fa2e1
test byte [rcx + 0x1c], 1
je 0x1400fa2e1
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014be40]
mov edx, 0x22
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.140044694
mov eax, ebx
jmp 0x1400fa2e9
mov dword [rbx], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400fa2f4
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edx, 0x80
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1400fa351
call fcn.1400fb4fc
mov ebx, eax
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x1400fa34d
test byte [rcx + 0x1c], 1
je 0x1400fa34d
mov rcx, qword [rcx + 0x10]
mov edx, 0x29
mov dword [rsp + 0x28], ebx
mov r9, rdi
mov dword [rsp + 0x20], 0x80
call fcn.1400faf18
mov eax, ebx
jmp 0x1400fa353
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400fa360
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor edx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400fa37d
xor eax, eax
jmp 0x1400fa3dc
call fcn.1400fb4fc
mov ebx, eax
cmp eax, 0x800700b7
je 0x1400fa3c8
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x1400fa3c4
mov edx, 1
test byte [rcx + 0x1c], dl
je 0x1400fa3c4
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014be40]
mov edx, 0x25
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.140044694
mov eax, ebx
jmp 0x1400fa3dc
mov rcx, rdi
call fcn.1400fa80c
test eax, eax
mov edx, 1
cmovs edx, eax
mov eax, edx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400fa598
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1400fa108
lea edx, [rax + 0x7ff8fffe]
cmp edx, 1
jbe 0x1400fa5d1
cmp eax, 0x80070005
jne 0x1400fa5d6
mov rcx, rbx
call fcn.1400fa2f4
test eax, eax
js 0x1400fa5d6
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400fa108
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1400fa79c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rax, rdx
mov rbx, rcx
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1400fa7fc
call fcn.1400fb4fc
mov ebx, eax
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x1400fa7f8
test byte [rcx + 0x1c], 1
je 0x1400fa7f8
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014be40]
mov edx, 0x19
mov r9d, ebx
call fcn.140044380
mov eax, ebx
jmp 0x1400fa806
mov rax, qword [rsp + 0x40]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400fabe0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edi, dword [rdx]
mov r10, r8
mov rbx, rdx
cmp rdi, qword [rdx]
je 0x1400fac01
mov eax, 0x80070057
jmp 0x1400fac84
and qword [rdx], 0
lea r9, [rsp + 0x48]
and dword [rsp + 0x48], 0
mov rdx, r10
and qword [rsp + 0x20], 0
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400fac6e
call fcn.1400fb4fc
mov edi, eax
cmp eax, 0x80070026
jne 0x1400fac39
and qword [rbx], 0
jmp 0x1400fac82
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x1400fac6a
test byte [rcx + 0x1c], 1
je 0x1400fac6a
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014be40]
mov edx, 0x1a
mov r9d, edi
call fcn.140044380
mov eax, edi
jmp 0x1400fac84
cmp dword [rsp + 0x48], edi
jbe 0x1400fac7b
mov eax, 0x8000ffff
jmp 0x1400fac84
mov eax, dword [rsp + 0x48]
mov qword [rbx], rax
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400fae58
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, edx
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp rax, rdx
je 0x1400fae81
mov eax, 0x80070057
jmp 0x1400faf07
mov r8d, edx
jmp 0x1400faea1
mov eax, dword [rsp + 0x48]
cmp eax, ebx
je 0x1400faf05
test eax, eax
je 0x1400faefe
cmp eax, ebx
ja 0x1400faefe
sub ebx, eax
mov rcx, rsi
add rdi, rax
mov r8d, ebx
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
and dword [rsp + 0x48], 0
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400fae86
call fcn.1400fb4fc
mov ebx, eax
test eax, eax
jns 0x1400faf05
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x1400faefa
test byte [rcx + 0x1c], 1
je 0x1400faefa
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014be40]
mov edx, 0x17
mov r9d, ebx
call fcn.140044380
mov eax, ebx
jmp 0x1400faf07
mov ebx, 0x8000ffff
jmp 0x1400faec9
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400fb524
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140173950]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0x2b8]
mov edi, edx
or edx, 0xffffffff
mov rsi, rcx
cmp edi, edx
jne 0x1400fb565
test rax, rax
je 0x1400fb630
and qword [rsp + 0x50], 0
mov r9d, edx
and qword [rsp + 0x48], 0
mov r8d, edi
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x1400fb630
call fcn.1400fb4fc
mov ebx, eax
mov rax, qword [0x14016d280]
lea rcx, [0x14016d280]
cmp rax, rcx
je 0x1400fb62c
test byte [rax + 0x1c], 1
je 0x1400fb62c
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x200
call fcn.140032e00
and dword [rsp + 0x60], 0
lea r9, [rsp + 0x60]
mov r8d, 0x200
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x1400fb60c
call fcn.1400fb4fc
lea r9, str._unknown_
mov qword [rsp + 0xa8], r9
jmp 0x1400fb614
mov r9, qword [rsp + 0xa8]
mov rcx, qword [0x14016d280]
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x28], edi
mov rcx, qword [rcx + 0x10]
call fcn.1400fc314
mov eax, ebx
jmp 0x1400fb632
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140030b80
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400fb9b4
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140173950]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rdx
mov rdx, rcx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1400fba7a
call fcn.1400fb4fc
mov ebx, eax
mov rax, qword [0x14016d280]
lea rcx, [0x14016d280]
cmp rax, rcx
je 0x1400fba76
test byte [rax + 0x1c], 1
je 0x1400fba76
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x200
call fcn.140032e00
and dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x200
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x1400fba51
call fcn.1400fb4fc
lea r9, str._unknown_
mov qword [rsp + 0x78], r9
jmp 0x1400fba56
mov r9, qword [rsp + 0x78]
mov rcx, qword [0x14016d280]
lea r8, [0x14014c0d0]
mov edx, 0xe
mov dword [rsp + 0x20], ebx
mov rcx, qword [rcx + 0x10]
call fcn.140044694
mov eax, ebx
jmp 0x1400fba7c
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140030b80
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
Function at 0x1400fbaa0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140173950]
xor rax, rsp
mov qword [rsp + 0x240], rax
and dword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov rdi, rdx
mov qword [rsp + 0x20], rax
mov r8, rcx
mov r9d, 0x24
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1400fbb7d
call fcn.1400fb4fc
mov ebx, eax
mov rax, qword [0x14016d280]
lea rcx, [0x14016d280]
cmp rax, rcx
je 0x1400fbb79
test byte [rax + 0x1c], 1
je 0x1400fbb79
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x200
call fcn.140032e00
and dword [rsp + 0x34], 0
lea r9, [rsp + 0x34]
mov r8d, 0x200
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x1400fbb54
call fcn.1400fb4fc
lea r9, str._unknown_
mov qword [rsp + 0x78], r9
jmp 0x1400fbb59
mov r9, qword [rsp + 0x78]
mov rcx, qword [0x14016d280]
lea r8, [0x14014c0d0]
mov edx, 0xd
mov dword [rsp + 0x20], ebx
mov rcx, qword [rcx + 0x10]
call fcn.140044694
mov eax, ebx
jmp 0x1400fbb7f
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140030b80
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret

Function at 0x1400fbba0
Capabilities:
Start service

Disassembly:
push rbp
push rbx
push rsi
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x140173950]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov rsi, rcx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1400fbc79
call fcn.1400fb4fc
mov ebx, eax
cmp eax, 0x80070420
jne 0x1400fbbed
mov eax, 1
jmp 0x1400fbcfc
mov rdx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rdx, rax
je 0x1400fbc72
test byte [rdx + 0x1c], 1
je 0x1400fbc72
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x200
call fcn.140032e00
and dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x200
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x1400fbc4d
call fcn.1400fb4fc
lea r9, str._unknown_
mov qword [rsp + 0x78], r9
jmp 0x1400fbc52
mov r9, qword [rsp + 0x78]
mov rcx, qword [0x14016d280]
lea r8, [0x14014c0d0]
mov edx, 0x12
mov dword [rsp + 0x20], ebx
mov rcx, qword [rcx + 0x10]
call fcn.140044694
mov eax, ebx
jmp 0x1400fbcfc
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x1400fbcfa
test byte [rcx + 0x1c], 4
je 0x1400fbcfa
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x200
call fcn.140032e00
and dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x200
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x1400fbcd9
call fcn.1400fb4fc
lea r9, str._unknown_
mov qword [rsp + 0x78], r9
jmp 0x1400fbcde
mov r9, qword [rsp + 0x78]
mov rcx, qword [0x14016d280]
lea r8, [0x14014c0d0]
mov edx, 0x13
mov rcx, qword [rcx + 0x10]
call fcn.140044638
xor eax, eax
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.140030b80
add rsp, 0x250
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400fc8d0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
cmp qword [rcx + 0x20], 0
mov r12, rdx
mov rdi, rcx
jne 0x1400fc903
mov eax, 0x80070057
jmp 0x1400fcac0
mov rsi, qword [rdi + 0x28]
mov r15, qword [rdi + 0x20]
mov r13, rsi
mov r14, qword [rdi + 0x18]
mov eax, esi
mov dword [rbp + 0x40], esi
cmp rax, rsi
je 0x1400fc926
mov ebx, 0x80070057
jmp 0x1400fca32
mov eax, r14d
cmp rax, r14
jne 0x1400fc91c
mov rcx, qword [rdi + 0x10]
lea r9, [rbp + 0x40]
mov qword [rsp + 0x38], r8
mov edx, r14d
and qword [rsp + 0x30], 0
mov r8, r15
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
test eax, eax
jle 0x1400fc968
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x1400fc9c2
mov ecx, dword [rbp + 0x40]
mov edx, 0x800700ea
inc ecx
mov dword [rbp + 0x40], ecx
test r15, r15
je 0x1400fc986
mov eax, ecx
cmp rax, rsi
cmova ebx, edx
mov esi, ecx
mov eax, ebx
mov qword [rbp - 0x10], rsi
cmp ebx, edx
je 0x1400fca28
cmp ebx, 0x80070103
je 0x1400fca28
test ebx, ebx
js 0x1400fca32
mov r9, r15
lea r8, [rbp - 0x10]
mov rdx, r13
mov rcx, r14
call fcn.1400fd51c
mov rsi, qword [rbp - 0x10]
jmp 0x1400fca28
cmp ebx, 0x80070103
jne 0x1400fc9ce
mov eax, ebx
jmp 0x1400fca28
mov edx, 0x800700ea
cmp ebx, edx
je 0x1400fca0e
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x1400fca32
test byte [rcx + 0x1c], 1
je 0x1400fca32
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014c0e0]
mov edx, 0x1a
mov dword [rsp + 0x20], ebx
mov r9d, r14d
call fcn.1400443b4
jmp 0x1400fca32
mov ecx, dword [rbp + 0x40]
inc ecx
mov eax, ecx
mov dword [rbp + 0x40], ecx
cmp rsi, rax
jb 0x1400fca24
mov ebx, 0x8000ffff
jmp 0x1400fca32
mov esi, ecx
mov eax, edx
mov ebx, eax
test eax, eax
jns 0x1400fcab2
cmp ebx, 0x80070103
je 0x1400fcaab
xor eax, eax
mov ecx, 0x800700ea
cmp ebx, ecx
cmovne eax, ebx
cmp eax, 0x8007139f
jne 0x1400fca5a
inc qword [rdi + 0x18]
mov r8, qword [rbp + 0x50]
jmp 0x1400fc903
test eax, eax
js 0x1400fcac0
and qword [rbp + 0x40], 0
lea rcx, [rbp + 0x40]
mov rdx, rsi
call fcn.1400c98bc
mov ebx, eax
test eax, eax
js 0x1400fca99
mov rcx, qword [rdi + 0x20]
mov rax, qword [rbp + 0x40]
mov r8, qword [rbp + 0x50]
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x28], rsi
test rcx, rcx
je 0x1400fc903
call fcn.140030ba0
jmp 0x1400fca51
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x1400fcaa7
call fcn.140030ba0
mov eax, ebx
jmp 0x1400fcac0
and qword [r12], 0
jmp 0x1400fcabe
mov rax, qword [rdi + 0x20]
inc qword [rdi + 0x18]
mov qword [r12], rax
xor eax, eax
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret