joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14016b1c0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x68
movdqa xmm2, xmmword [0x1404b94c0]
mov r10, rcx
movdqa xmm3, xmmword [0x1404b9470]
mov rax, rcx
movdqa xmm4, xmmword [0x1404b94e0]
mov r11, r8
movdqa xmm5, xmmword [0x1404b93e0]
lea r8, [rcx + 0x1c00]
movdqu xmm0, xmmword [r9]
lea rcx, [rdx - 0x1c00]
movdqu xmm1, xmmword [r9 + 0x10]
add rcx, rax
movaps xmmword [rsp + 0x50], xmm6
mov edx, 2
movdqu xmm6, xmmword [r9 + 0x20]
movaps xmmword [rsp + 0x40], xmm7
movdqu xmm7, xmmword [r9 + 0x30]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x1404b9490]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x1404b9340]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x1404b9380]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x1404b93a0]
nop
cmp rax, rcx
jae 0x14016b313
nop dword [rax]
aesenc xmm2, xmmword [rax]
aesdec xmm3, xmmword [rax + 0x10]
aesenc xmm4, xmmword [rax + 0x20]
aesdec xmm5, xmmword [rax + 0x30]
aesenc xmm2, xmmword [rax + 0x40]
aesdec xmm3, xmmword [rax + 0x50]
aesenc xmm4, xmmword [rax + 0x60]
aesdec xmm5, xmmword [rax + 0x70]
aesdec xmm0, xmm8
movdqu xmmword [rax], xmm0
aesenc xmm1, xmm9
movdqu xmmword [rax + 0x10], xmm1
aesdec xmm6, xmm10
movdqu xmmword [rax + 0x20], xmm6
aesenc xmm7, xmm11
movdqu xmmword [rax + 0x30], xmm7
aesdec xmm0, xmm8
movdqu xmmword [rax + 0x40], xmm0
aesenc xmm1, xmm9
movdqu xmmword [rax + 0x50], xmm1
aesdec xmm6, xmm10
aesenc xmm7, xmm11
movdqu xmmword [rax + 0x60], xmm6
movdqu xmmword [rax + 0x70], xmm7
prefetcht0 byte [r8]
prefetcht0 byte [r8 + 0x40]
sub rax, 0xffffffffffffff80
lea r8, [r8 + 0x80]
cmp rax, rcx
jb 0x14016b270
add rcx, 0x1c00
mov r8, r10
sub rdx, 1
jne 0x14016b260
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
movdqu xmmword [r9], xmm0
movdqa xmm0, xmmword [0x1404b9310]
movdqu xmmword [r9 + 0x10], xmm1
movdqa xmm1, xmmword [0x1404b94f0]
movdqu xmmword [r9 + 0x20], xmm6
movaps xmm6, xmmword [rsp + 0x50]
movdqu xmmword [r9 + 0x30], xmm7
movaps xmm7, xmmword [rsp + 0x40]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm4, xmm0
aesdec xmm5, xmm0
aesenc xmm2, xmm1
aesdec xmm3, xmm1
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [r11], xmm2
movdqu xmmword [r11 + 0x10], xmm3
movdqu xmmword [r11 + 0x20], xmm4
movdqu xmmword [r11 + 0x30], xmm5
add rsp, 0x68
ret
Function at 0x140173b80
Capabilities:
Create thread

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r12, r8
mov rbx, rdx
mov r14, rcx
mov rdx, qword [rcx]
mov rdi, rbx
sub rdi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x140173d7c
lea r8, [rax + 1]
mov qword [rsp + 0xa8], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
jbe 0x140173cbe
mov rsi, r9
mov qword [rsp + 0x98], r9
mov rcx, rsi
shl rcx, 4
call fcn.140004180
mov r15, rax
mov qword [rsp + 0x38], rax
and rdi, 0xfffffffffffffff0
lea r13, [rdi + rax]
lea rdi, [r13 + 0x10]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x90], rdi
mov ecx, 0x30
call fcn.140346ce0
movups xmm0, xmmword [r12]
movups xmmword [rax], xmm0
movups xmm1, xmmword [r12 + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [r12 + 0x20]
movups xmmword [rax + 0x20], xmm0
mov qword [rsp + 0x40], rax
lea r12, [r13 + 8]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140173e60]
xor edx, edx
xor ecx, ecx
call fcn.1403573d8
mov qword [r13], rax
test rax, rax
je 0x140173d69
mov qword [rsp + 0x90], r13
mov rcx, qword [r14 + 8]
mov rax, qword [r14]
mov rdx, r15
cmp rbx, rcx
jne 0x140173ce2
cmp rax, rcx
je 0x140173d40
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x140173ca0
jmp 0x140173d40
lea rax, [rdx + rcx]
mov rsi, r8
cmp rax, r8
cmovae rsi, rax
mov qword [rsp + 0x98], rsi
cmp rsi, r9
ja 0x140173d82
jmp 0x140173bf7
cmp rax, rbx
je 0x140173d0d
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x140173cf0
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x90], r15
cmp rbx, rcx
je 0x140173d40
sub rdi, rbx
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rdi + rbx], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x140173d20
nop word [rax + rax]
mov r9, rsi
mov r8, qword [rsp + 0xa8]
mov rdx, r15
mov rcx, r14
call fcn.140173d90
mov rax, r13
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r12], 0
mov ecx, 6
call fcn.140345504
nop
call fcn.140014330
int3
call fcn.140003f70
int3
Function at 0x1401740d0
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1404f3628]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1401741c3
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x1401741aa
xorps xmm0, xmm0
mov byte [rsp + 0x20], dil
xor edx, edx
mov word [rsp + 0x21], 0x100
mov r8d, 0xf0
mov byte [rsp + 0x23], 1
movups xmmword [rsp + 0x32], xmm0
mov dword [rsp + 0x24], 0
movups xmmword [rsp + 0x42], xmm0
mov word [rsp + 0x30], 0
call fcn.140349a00
movaps xmm0, xmmword [0x14045dd00]
mov rax, qword [rsp + 0x20]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x14045dd10]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x14045dd20]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x14045dd30]
movups xmmword [rbx + 0x30], xmm1
xor qword [rbx], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x38]
xor qword [rbx + 0x18], rax
mov rax, qword [rsp + 0x40]
xor qword [rbx + 0x20], rax
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x28], rax
xor qword [rbx + 8], 0
movzx eax, dil
mov dword [rbx + 0xe4], eax
xor eax, eax
jmp 0x1401741c8
cmp byte [rcx + 0xe8], 0
je 0x1401741bb
mov qword [rcx + 0x58], 0xffffffffffffffff
mov qword [rcx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140346cc0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x140178720
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0xab0]
mov ecx, dword [0x140790758]
movdqa xmm4, xmmword [0x1404b9490]
add rcx, rax
movdqa xmm5, xmmword [0x1404b9340]
movdqu xmm0, xmmword [rdx]
movdqu xmm1, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm3, xmmword [rdx + 0x30]
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm6, xmmword [0x1404b9380]
movaps xmmword [rsp], xmm7
movdqa xmm7, xmmword [0x1404b93a0]
cmp rax, rcx
jae 0x1401787b0
nop word [rax + rax]
aesdec xmm0, xmm4
aesenc xmm1, xmm5
aesdec xmm2, xmm6
aesenc xmm3, xmm7
movdqu xmmword [rax], xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmmword [rax + 0x20], xmm2
movdqu xmmword [rax + 0x30], xmm3
add rax, 0x40
cmp rax, rcx
jb 0x140178780
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp]
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
add rsp, 0x28
ret
Function at 0x14017bc70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, r9
mov rbx, rdx
mov r14, rcx
mov rdx, qword [rcx]
mov rdi, rbx
sub rdi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x14017bea9
lea r8, [rax + 1]
mov qword [rsp + 0x30], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
jbe 0x14017bdee
mov rsi, r9
mov qword [rsp + 0x98], r9
mov rcx, rsi
shl rcx, 4
call fcn.140004180
mov r15, rax
mov qword [rsp + 0x40], rax
and rdi, 0xfffffffffffffff0
lea r12, [rdi + rax]
lea rdi, [r12 + 0x10]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x90], rdi
mov ecx, 0x28
call fcn.140346ce0
mov r9, rax
mov rax, qword [rsp + 0xc8]
mov ecx, dword [rax]
mov dword [r9], ecx
mov rax, qword [rsp + 0xc0]
mov ecx, dword [rax]
mov dword [r9 + 4], ecx
mov rax, qword [rsp + 0xb8]
mov ecx, dword [rax]
mov dword [r9 + 8], ecx
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax]
mov qword [r9 + 0x10], rcx
mov rax, qword [r13]
mov qword [r9 + 0x18], rax
mov rax, qword [rsp + 0xa0]
mov qword [r9 + 0x20], rax
mov qword [rsp + 0x48], r9
lea r13, [r12 + 8]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0
lea r8, [0x14017bee0]
xor edx, edx
xor ecx, ecx
call fcn.1403573d8
mov qword [r12], rax
test rax, rax
je 0x14017be96
mov qword [rsp + 0x90], r12
mov rcx, qword [r14 + 8]
mov rax, qword [r14]
mov rdx, r15
cmp rbx, rcx
jne 0x14017be12
cmp rax, rcx
je 0x14017be70
nop dword [rax]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x14017bdd0
jmp 0x14017be70
lea rax, [rdx + rcx]
mov rsi, r8
cmp rax, r8
cmovae rsi, rax
mov qword [rsp + 0x98], rsi
cmp rsi, r9
ja 0x14017beaf
jmp 0x14017bce8
cmp rax, rbx
je 0x14017be3d
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x14017be20
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x90], r15
cmp rbx, rcx
je 0x14017be70
sub rdi, rbx
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rbx + rdi], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x14017be50
nop word [rax + rax]
mov r9, rsi
mov r8, qword [rsp + 0x30]
mov rdx, r15
mov rcx, r14
call fcn.140173d90
mov rax, r12
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r13], 0
mov ecx, 6
call fcn.140345504
nop
call fcn.140014330
int3
call fcn.140003f70
int3
Function at 0x14017c140
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
lea rax, vtable.xmrig::RxQueue.0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
xor ebp, ebp
mov qword [rcx + 0x10], rbp
mov dword [rcx + 0x18], ebp
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
mov qword [rcx + 0x30], rbp
mov dword [rcx + 0x38], ebp
add rcx, 0x40
call fcn.14034614c
nop
lea rcx, [rsi + 0x88]
lea edx, [rbp + 2]
call fcn.1403457a4
nop
mov qword [rsi + 0xd8], rbp
mov qword [rsi + 0xe0], rbp
xorps xmm0, xmm0
movups xmmword [rsi + 0xe8], xmm0
mov qword [rsi + 0xf8], rbp
mov qword [rsi + 0x100], rbp
mov qword [rsi + 0x108], rbp
lea ecx, [rbp + 0x18]
call fcn.140346ce0
mov rdi, rax
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_obj2_class_xmrig::Async_.0
mov qword [rdi], rax
lea rbx, [rdi + 0x10]
mov rdx, rsi
mov rcx, rbx
call fcn.140015e90
nop
mov qword [rsi + 0xd8], rbx
mov rbx, qword [rsi + 0xe0]
mov qword [rsi + 0xe0], rdi
test rbx, rbx
je 0x14017c245
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14017c245
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14017c245
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov ecx, reloc.WS2_32.dll_recv
call fcn.140346ce0
mov qword [rax], rsi
lea rcx, [0x14017c760]
mov qword [rax + 8], rcx
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x140070590]
xor edx, edx
xor ecx, ecx
call fcn.1403573d8
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14017c2b8
cmp dword [rsi + 0xf0], 0
jne 0x14017c2b2
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi + 0xe8], xmm0
mov rax, rsi
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
call fcn.140353fbc
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call fcn.140345504
int3
Function at 0x1401812b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov r13, rcx
call fcn.140030600
mov rbp, rax
xor r12d, r12d
mov r9, qword [r13 + 0x30]
mov r9, qword [r9]
cmp byte [r9 + 0x19], r12b
jne 0x140181343
mov rcx, qword [r9 + 0x28]
cmp qword [rcx + 0x10], 0
je 0x1401812f3
mov r12d, dword [r9 + 0x20]
mov rax, qword [r9 + 0x10]
cmp byte [rax + 0x19], 0
je 0x14018131f
mov rax, qword [r9 + 8]
cmp byte [rax + 0x19], 0
jne 0x14018131a
cmp r9, qword [rax + 0x10]
jne 0x14018131a
mov r9, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140181307
mov r9, rax
jmp 0x14018133c
mov r9, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x14018133c
nop dword [rax + rax]
mov r9, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140181330
cmp byte [r9 + 0x19], 0
je 0x1401812e4
mov edx, r12d
mov rcx, r13
call fcn.140180de0
mov rdi, rax
mov qword [rsp + 0x70], rax
lea rdx, [r13 + 0x18]
mov r9d, ebx
mov r8d, esi
mov rcx, rax
call fcn.14017b7b0
call fcn.140030600
sub rax, rbp
mov qword [rsp + 0x20], rax
mov r9d, r12d
lea r8, str.e_44me_1_37m_randomx_e_0m
lea rdx, str._se_1_36m_u_e_0me_1_32mdataset_readye_0me_1_30m___llu_ms_e_0m
mov ecx, 6
call fcn.1400265b0
cmp qword [r13 + 0x38], 1
jbe 0x1401814ce
mov rbx, qword [r13 + 0x30]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x1401814c6
lea rdx, [0x140181a30]
lea rsi, [rbx + 0x20]
cmp dword [rsi], r12d
je 0x140181472
mov rcx, rdi
call fcn.14017bbc0
mov rbp, rax
mov qword [rsp + 0x88], rax
mov r14, qword [r13 + 0x48]
cmp r14, qword [r13 + 0x50]
je 0x140181441
mov ecx, 0x20
call fcn.140346ce0
mov qword [rax], rbp
mov ecx, dword [rsi]
mov dword [rax + 8], ecx
mov rcx, qword [rsi + 8]
mov qword [rax + 0x10], rcx
lea rcx, [0x140181a30]
mov qword [rax + 0x18], rcx
mov qword [rsp + 0x88], rax
lea rcx, [r14 + 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140182500]
xor edx, edx
xor ecx, ecx
call fcn.1403573d8
mov qword [r14], rax
test rax, rax
je 0x1401814e8
add qword [r13 + 0x48], 0x10
jmp 0x140181466
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsi + 8]
mov r8, rdx
mov rdx, r14
lea rcx, [r13 + 0x40]
call fcn.140182210
lea rdx, [0x140181a30]
mov rdi, qword [rsp + 0x70]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x14018149e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140181499
cmp rbx, qword [rax + 0x10]
jne 0x140181499
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140181486
mov rbx, rax
jmp 0x1401814bc
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401814bc
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401814b0
cmp byte [rbx + 0x19], 0
je 0x1401813b3
mov rcx, r13
call fcn.140181ac0
mov byte [r13 + 1], 1
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [r14 + 8], 0
mov ecx, 6
call fcn.140345504
int3
Function at 0x140181ed0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, r9
mov rbx, rdx
mov r14, rcx
mov rdx, qword [rcx]
mov rdi, rbx
sub rdi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x1401820f9
lea r8, [rax + 1]
mov qword [rsp + 0x30], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
jbe 0x14018203e
mov rsi, r9
mov qword [rsp + 0x98], r9
mov rcx, rsi
shl rcx, 4
call fcn.140004180
mov r15, rax
mov qword [rsp + 0x40], rax
and rdi, 0xfffffffffffffff0
lea r12, [rdi + rax]
lea rdi, [r12 + 0x10]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x90], rdi
mov ecx, 0x18
call fcn.140346ce0
mov r9, rax
mov rax, qword [rsp + 0xc0]
movzx ecx, byte [rax]
mov byte [r9], cl
mov rax, qword [rsp + 0xb8]
movzx ecx, byte [rax]
mov byte [r9 + 1], cl
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rax]
mov dword [r9 + 4], ecx
mov rax, qword [r13]
mov qword [r9 + 8], rax
mov rax, qword [rsp + 0xa0]
mov qword [r9 + 0x10], rax
mov qword [rsp + 0x48], r9
lea r13, [r12 + 8]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0
lea r8, [0x1401824c0]
xor edx, edx
xor ecx, ecx
call fcn.1403573d8
mov qword [r12], rax
test rax, rax
je 0x1401820e6
mov qword [rsp + 0x90], r12
mov rcx, qword [r14 + 8]
mov rax, qword [r14]
mov rdx, r15
cmp rbx, rcx
jne 0x140182062
cmp rax, rcx
je 0x1401820c0
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x140182020
jmp 0x1401820c0
lea rax, [rdx + rcx]
mov rsi, r8
cmp rax, r8
cmovae rsi, rax
mov qword [rsp + 0x98], rsi
cmp rsi, r9
ja 0x1401820ff
jmp 0x140181f48
cmp rax, rbx
je 0x14018208d
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x140182070
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x90], r15
cmp rbx, rcx
je 0x1401820c0
sub rdi, rbx
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rbx + rdi], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x1401820a0
nop word [rax + rax]
mov r9, rsi
mov r8, qword [rsp + 0x30]
mov rdx, r15
mov rcx, r14
call fcn.140173d90
mov rax, r12
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r13], 0
mov ecx, 6
call fcn.140345504
nop
call fcn.140014330
int3
call fcn.140003f70
int3
Function at 0x140182210
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, r9
mov rbx, rdx
mov r14, rcx
mov rdx, qword [rcx]
mov rdi, rbx
sub rdi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x140182429
lea r8, [rax + 1]
mov qword [rsp + 0x30], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
jbe 0x14018236e
mov rsi, r9
mov qword [rsp + 0x98], r9
mov rcx, rsi
shl rcx, 4
call fcn.140004180
mov r15, rax
mov qword [rsp + 0x40], rax
and rdi, 0xfffffffffffffff0
lea r12, [rdi + rax]
lea rdi, [r12 + 0x10]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x90], rdi
mov ecx, 0x20
call fcn.140346ce0
mov r9, rax
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rax]
mov qword [r9], rcx
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rax]
mov dword [r9 + 8], ecx
mov rax, qword [r13]
mov qword [r9 + 0x10], rax
mov rax, qword [rsp + 0xa0]
mov qword [r9 + 0x18], rax
mov qword [rsp + 0x48], r9
lea r13, [r12 + 8]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0
lea r8, [0x140182500]
xor edx, edx
xor ecx, ecx
call fcn.1403573d8
mov qword [r12], rax
test rax, rax
je 0x140182416
mov qword [rsp + 0x90], r12
mov rcx, qword [r14 + 8]
mov rax, qword [r14]
mov rdx, r15
cmp rbx, rcx
jne 0x140182392
cmp rax, rcx
je 0x1401823f0
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x140182350
jmp 0x1401823f0
lea rax, [rdx + rcx]
mov rsi, r8
cmp rax, r8
cmovae rsi, rax
mov qword [rsp + 0x98], rsi
cmp rsi, r9
ja 0x14018242f
jmp 0x140182288
cmp rax, rbx
je 0x1401823bd
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x1401823a0
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x90], r15
cmp rbx, rcx
je 0x1401823f0
sub rdi, rbx
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rbx + rdi], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x1401823d0
nop word [rax + rax]
mov r9, rsi
mov r8, qword [rsp + 0x30]
mov rdx, r15
mov rcx, r14
call fcn.140173d90
mov rax, r12
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r13], 0
mov ecx, 6
call fcn.140345504
nop
call fcn.140014330
int3
call fcn.140003f70
int3
Function at 0x140182660
Capabilities:
Delete service
Stop service

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1404f3628]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x140182688
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jne 0x1401826a6
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140346cc0
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor esi, esi
mov qword [rsp + 0x70], rdi
mov dil, 1
cmp byte [rbx], sil
jne 0x140182701
lea r8, [rsp + 0x20]
lea edx, [rsi + 1]
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rbx + 0x18]
test eax, eax
movzx edi, dil
cmove edi, esi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140182701
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.e_43_1me_1_37m_msr_____e_0m
lea rdx, str._s_e_0_31mfailed_to_remove_WinRing0_driver__error__ue_0m
lea ecx, [rsi + 3]
call fcn.1400265b0
xor dil, dil
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, dil
mov qword [rbx + 0x18], rsi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140346cc0
add rsp, 0x50
pop rbx
ret