joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800b7b70
Capabilities:
Acquire debug privileges

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x210
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x250], rbx
mov rax, qword [0x1801580d0]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov r12, r9
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rcx, rdx
call fcn.1800b5600
lea rcx, [rsp + 0x28]
call fcn.1800b6250
nop
xor r9d, r9d
mov r8d, ebx
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.1800b75e0
test eax, eax
je 0x1800b7d03
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
mov r8d, 1
lea rdx, str.SeDebugPrivilege
call fcn.1800b1aa0
xor r13d, r13d
mov ebx, r13d
lea rcx, [rsp + 0x28]
call fcn.1800b6260
mov ebp, eax
test eax, eax
jle 0x1800b7ce6
mov dword [rsp + 0x50], r13d
xor edx, edx
mov r8d, 0x1a4
lea rcx, [rsp + 0x54]
call fcn.18006a0a0
mov edx, ebx
lea rcx, [rsp + 0x28]
call fcn.1800b7320
mov rdx, rax
lea rcx, [rsp + 0x50]
mov r8d, 0xa0
call fcn.18006b1c0
mov r11, qword [rdi]
mov r8d, dword [rsp + 0x50]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [r11 + 0x80]
nop
mov rax, qword [rsp + 0x20]
cmp dword [rax - 8], 0
jne 0x1800b7c95
mov eax, dword [rsp + 0x50]
test eax, eax
jne 0x1800b7c7a
lea rdx, str.System_Idle_Process
jmp 0x1800b7c8b
cmp eax, 4
je 0x1800b7c84
cmp eax, 8
jne 0x1800b7c95
lea rdx, [0x18011fa70]
lea rcx, [rsp + 0x20]
call fcn.180056330
mov r8d, 0x103
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0xf4]
call fcn.18006bde8
mov r8, r12
lea rdx, [rsp + 0xf4]
mov rcx, rdi
call fcn.1800b89c0
test eax, eax
je 0x1800b7cd2
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1800b5610
nop
lea rcx, [rsp + 0x20]
call fcn.1800561b0
inc ebx
cmp ebx, ebp
jl 0x1800b7c10
mov rdx, rsi
mov rcx, rdi
call fcn.1800b7850
nop
lea rcx, [rsp + 0x28]
call fcn.1800b7330
mov eax, 1
jmp 0x1800b7d0f
lea rcx, [rsp + 0x28]
call fcn.1800b7330
xor eax, eax
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.18006b190
mov rbx, qword [rsp + 0x250]
add rsp, 0x210
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800b81b0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, rdx
mov rbx, rcx
test rdx, rdx
jne 0x1800b81ce
mov dword [rcx + 8], 0x57
add rsp, 0x20
pop rbx
ret
mov edx, r8d
mov rcx, rax
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, eax
test eax, eax
jne 0x1800b81ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x1800b8200
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
call fcn.1800bc1f0
mov r11, qword [0x180173c88]
test r11, r11
jne 0x1800b822d
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x30], rsi
lea ecx, [rdx + 2]
call r11
mov rsi, rax
test rax, rax
jne 0x1800b8260
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [rsp + 0x30]
mov dword [rbx + 8], eax
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov edi, eax
cmp eax, 0xffffffff
jne 0x1800b8279
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
xor eax, eax
cmp edi, 0xffffffff
setne al
add rsp, 0x20
pop rdi
ret

Function at 0x1800b82a0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
call fcn.1800bc1f0
mov r11, qword [0x180173c88]
test r11, r11
jne 0x1800b82cd
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x30], rsi
lea ecx, [rdx + 2]
call r11
mov rsi, rax
test rax, rax
jne 0x1800b8300
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [rsp + 0x30]
mov dword [rbx + 8], eax
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, eax
cmp eax, 0xffffffff
jne 0x1800b8319
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
xor eax, eax
cmp edi, 0xffffffff
setne al
add rsp, 0x20
pop rdi
ret
Function at 0x1800b8340
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov esi, edx
mov rbx, rcx
call fcn.1800bc1f0
mov r11, qword [0x180173c88]
test r11, r11
je 0x1800b8384
xor edx, edx
mov r8d, esi
lea ecx, [rdx + 1]
call r11
mov rsi, rax
test rax, rax
jne 0x1800b8396
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, eax
test eax, eax
jne 0x1800b83b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, edi
add rsp, 0x20
pop rdi
ret

Function at 0x1800b8610
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x1801580d0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rdx
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.18006a0a0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1800598d0
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18006b190
add rsp, 0x150
pop rbx
ret

Function at 0x1800b8a40
Capabilities:
Suspend thread

Disassembly:
push r12
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov ebx, edx
mov r12, rcx
call fcn.1800bc1f0
cmp qword [0x180173c88], 0
je 0x1800b8aa6
lea rcx, [rsp + 0x28]
call fcn.18005fb20
nop
mov rax, qword [r12]
lea r8, [rsp + 0x28]
mov edx, ebx
mov rcx, r12
call qword [rax + 0xd0]
mov ebp, eax
test eax, eax
jne 0x1800b8aaa
lea rcx, [rsp + 0x28]
call fcn.18005fb30
xor eax, eax
jmp 0x1800b8b19
xor edi, edi
xor esi, esi
cmp dword [rsp + 0x30], esi
jle 0x1800b8b0d
nop word [rax + rax]
mov rax, qword [rsp + 0x28]
mov r8d, dword [rax + rsi*4]
xor edx, edx
lea ecx, [rdx + 2]
call qword [0x180173c88]
mov rbx, rax
test rsi, rsi
jne 0x1800b8ae1
test rax, rax
je 0x1800b8b00
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
inc rsi
cmp edi, dword [rsp + 0x30]
jge 0x1800b8b0d
jmp 0x1800b8ac0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r12 + 8], eax
xor ebp, ebp
lea rcx, [rsp + 0x28]
call fcn.18005fb30
mov eax, ebp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x1800b8b40
Capabilities:
Resume thread

Disassembly:
push r12
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov ebx, edx
mov r12, rcx
call fcn.1800bc1f0
cmp qword [0x180173c88], 0
je 0x1800b8ba6
lea rcx, [rsp + 0x28]
call fcn.18005fb20
nop
mov rax, qword [r12]
lea r8, [rsp + 0x28]
mov edx, ebx
mov rcx, r12
call qword [rax + 0xd0]
mov ebp, eax
test eax, eax
jne 0x1800b8baa
lea rcx, [rsp + 0x28]
call fcn.18005fb30
xor eax, eax
jmp 0x1800b8c19
xor edi, edi
xor esi, esi
cmp dword [rsp + 0x30], esi
jle 0x1800b8c0d
nop word [rax + rax]
mov rax, qword [rsp + 0x28]
mov r8d, dword [rax + rsi*4]
xor edx, edx
lea ecx, [rdx + 2]
call qword [0x180173c88]
mov rbx, rax
test rsi, rsi
jne 0x1800b8be1
test rax, rax
je 0x1800b8c00
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
inc rsi
cmp edi, dword [rsp + 0x30]
jge 0x1800b8c0d
jmp 0x1800b8bc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r12 + 8], eax
xor ebp, ebp
lea rcx, [rsp + 0x28]
call fcn.18005fb30
mov eax, ebp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret

Function at 0x1800b8c40
Capabilities:
Acquire debug privileges

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov ebx, r9d
mov r13, r8
mov rbp, rdx
mov r12, rcx
lea rcx, [rsp + 0x28]
call fcn.18005fb20
nop
mov rax, qword [r12]
mov r8d, ebx
lea rdx, [rsp + 0x28]
mov rcx, r12
call qword [rax + 0xb0]
test eax, eax
jne 0x1800b8ca3
lea rcx, [rsp + 0x28]
call fcn.18005fb30
xor eax, eax
jmp 0x1800b8d3f
xor esi, esi
mov ebx, esi
cmp dword [rsp + 0x30], ebx
jle 0x1800b8d30
mov edi, esi
test esi, esi
jne 0x1800b8cd4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea r8d, [rsi + 1]
lea rdx, str.SeDebugPrivilege
call fcn.1800b1aa0
mov esi, 1
mov rax, qword [rsp + 0x28]
mov r9, qword [r12]
mov r8d, dword [rdi + rax]
lea rdx, [rsp + 0x60]
mov rcx, r12
call qword [r9 + 0x80]
nop
mov r8, r13
mov rdx, qword [rsp + 0x60]
mov rcx, r12
call fcn.1800b89c0
test eax, eax
je 0x1800b8d1a
mov rax, qword [rsp + 0x28]
mov r8d, dword [rdi + rax]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.18005fda0
nop
lea rcx, [rsp + 0x60]
call fcn.1800561b0
inc ebx
add rdi, 4
cmp ebx, dword [rsp + 0x30]
jl 0x1800b8cb3
lea rcx, [rsp + 0x28]
call fcn.18005fb30
mov eax, 1
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x1800b95a0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x180173674]
test ecx, ecx
jne 0x1800b96bf
mov eax, dword [0x180173670]
cmp eax, 3
ja 0x1800b96bf
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x180173670], eax
call fcn.1800a3710
test eax, eax
je 0x1800b95e6
lea rcx, str.Userenv.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x1800b95f3
lea rcx, [0x180121f28]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1800b9605
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.CreateEnvironmentBlock
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DestroyEnvironmentBlock
mov rcx, rbx
mov qword [0x180173638], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ExpandEnvironmentStringsForUserA
mov rcx, rbx
mov qword [0x180173640], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ExpandEnvironmentStringsForUserW
mov rcx, rbx
mov qword [0x180173648], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LoadUserProfileA
mov rcx, rbx
mov qword [0x180173650], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LoadUserProfileW
mov rcx, rbx
mov qword [0x180173658], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnloadUserProfile
mov rcx, rbx
mov qword [0x180173660], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x180173674], 1
mov qword [0x180173668], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1800bb9d0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1801739e4]
test ecx, ecx
jne 0x1800bbbf5
mov eax, dword [0x1801739e0]
cmp eax, 3
ja 0x1800bbbf5
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x1801739e0], eax
call fcn.1800a3710
test eax, eax
je 0x1800bba16
lea rcx, str.iphlpapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x1800bba23
lea rcx, [0x180122788]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1800bba35
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.GetAdapterIndex
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetAdaptersInfo
mov rcx, rbx
mov qword [0x180173950], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180173958], rax
call fcn.1800a38a0
test eax, eax
je 0x1800bba83
lea rdx, str.GetAdaptersAddresses
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180173960], rax
lea rdx, str.GetIfTable
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetIpForwardTable
mov rcx, rbx
mov qword [0x180173968], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateIpForwardEntry
mov rcx, rbx
mov qword [0x180173970], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DeleteIpForwardEntry
mov rcx, rbx
mov qword [0x180173978], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetIpNetTable
mov rcx, rbx
mov qword [0x180173980], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SendARP
mov rcx, rbx
mov qword [0x180173988], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetTcpTable
mov rcx, rbx
mov qword [0x180173990], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetUdpTable
mov rcx, rbx
mov qword [0x180173998], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetNetworkParams
mov rcx, rbx
mov qword [0x1801739a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPerAdapterInfo
mov rcx, rbx
mov qword [0x1801739a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.AddIPAddress
mov rcx, rbx
mov qword [0x1801739b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DeleteIPAddress
mov rcx, rbx
mov qword [0x1801739b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NotifyAddrChange
mov rcx, rbx
mov qword [0x1801739c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NotifyRouteChange
mov rcx, rbx
mov qword [0x1801739c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetAdapterIpAddress
mov rcx, rbx
mov qword [0x1801739d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x1801739e4], 1
mov qword [0x1801739d8], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1800bd330
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, r9
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
call fcn.1800bc1f0
mov r11, qword [0x180173b48]
mov rdx, rbx
mov rcx, rdi
test r11, r11
je 0x1800bd37a
mov eax, dword [rsp + 0x60]
mov r9, rsi
mov r8, rbp
mov dword [rsp + 0x20], eax
call r11
jmp 0x1800bd380
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800bdcb0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x18017400c]
test ecx, ecx
jne 0x1800bde14
mov eax, dword [0x180174008]
cmp eax, 3
ja 0x1800bde14
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x180174008], eax
call fcn.1800a3710
test eax, eax
je 0x1800bdcf6
lea rcx, str.psapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x1800bdd03
lea rcx, [0x180123828]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1800bdd15
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.EnumProcesses
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EnumProcessModules
mov rcx, rbx
mov qword [0x180173fb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessMemoryInfo
mov rcx, rbx
mov qword [0x180173fc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleFileNameExA
mov rcx, rbx
mov qword [0x180173fc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleFileNameExW
mov rcx, rbx
mov qword [0x180173fd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleInformation
mov rcx, rbx
mov qword [0x180173fd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x180173fe0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x180173fe8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetMappedFileNameA
mov rcx, rbx
mov qword [0x180173ff0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetMappedFileNameW
mov rcx, rbx
mov qword [0x180173ff8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov qword [0x180174000], rax
mov dword [0x18017400c], 1
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1800bf120
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
mov qword [rsp + 0x38], rbp
mov rbp, rcx
lea r8, [rsp + 0x68]
lea rdx, str.SystemCurrentControlSetControlProductOptions
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x58], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1800bf23f
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.ProductSuite
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1800bf23f
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x1800bf23f
lea ecx, [rdi + 0x40]
mov edx, eax
mov qword [rsp + 0x30], rsi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x1800bf23a
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.ProductSuite
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1800bf231
cmp dword [rsp + 0x60], 7
jne 0x1800bf231
mov qword [rsp + 0x50], rbx
mov rbx, rsi
cmp byte [rsi], dil
je 0x1800bf22c
nop dword [rax + rax]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1800bf227
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cdqe
add rbx, rax
cmp byte [rbx], dil
jne 0x1800bf200
jmp 0x1800bf22c
mov edi, 1
mov rbx, qword [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x38]
test rcx, rcx
je 0x1800bf254
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
add rsp, 0x40
pop rdi
ret
Function at 0x1800bf260
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1801580d0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
call fcn.1800a3710
test eax, eax
je 0x1800bf337
call fcn.1800a3770
test eax, eax
je 0x1800bf329
xor edx, edx
xor ecx, ecx
mov r8d, 0x20000
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x1800bf2d7
lea r8d, [rbx + 4]
lea rdx, str.TermService
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x1800bf2db
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x1800bf339
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1800bf315
mov eax, dword [rsp + 0x24]
cmp eax, 4
je 0x1800bf310
cmp eax, 2
jne 0x1800bf315
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1800bf337
lea rcx, str.Terminal_Server
call fcn.1800bf120
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18006b190
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
jmp 0x1800bf260

Function at 0x1800bf5e0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1801580d0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
call fcn.1800a3710
test eax, eax
je 0x1800bf337
call fcn.1800a3770
test eax, eax
je 0x1800bf329
xor edx, edx
xor ecx, ecx
mov r8d, 0x20000
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x1800bf2d7
lea r8d, [rbx + 4]
lea rdx, str.TermService
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x1800bf2db
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x1800bf339
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1800bf315
mov eax, dword [rsp + 0x24]
cmp eax, 4
je 0x1800bf310
cmp eax, 2
jne 0x1800bf315
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1800bf337
lea rcx, str.Terminal_Server
call fcn.1800bf120
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18006b190
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
jmp 0x1800bf260