joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18006a940
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov ebp, r8d
mov qword [rcx], 0
mov r14d, edx
mov qword [rcx + 8], 0
mov rdi, rcx
call fcn.18006a7d0
test eax, eax
jne 0x18006a987
mov eax, 9
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rdi], 0
je 0x18006a9fe
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [rdi + 0xc], ebx
jbe 0x18006a9e6
mov qword [rsp + 0x38], rsi
nop
mov r8, qword [rdi]
xor edx, edx
mov r8d, dword [r8 + rbx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18006a9da
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.18006a620
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x18006a9a0
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rbp, qword [rsp + 0x40]
xor eax, eax
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x18006aa20
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov eax, ecx
lea r9, [rsp + 0x30]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x1801499d0]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18006aa84
mov eax, 0xa
jmp 0x18006ab17
test esi, esi
je 0x18006aaa6
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x18006aac9
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x18006aac9
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x18006aac2
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x18006aac9
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, sil
shl sil, 2
add cl, cl
xor cl, byte [rbx + 0x20]
and cl, 2
xor cl, byte [rbx + 0x20]
xor sil, cl
and sil, 4
xor sil, cl
mov byte [rbx + 0x20], sil
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x18006ab30
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
mov r8d, dword [0x1801499dc]
mov esi, ecx
xor ecx, ecx
mov ebx, ecx
test r8d, r8d
je 0x18006ab77
mov rax, qword [0x1801499d0]
add rax, 0x20
nop word [rax + rax]
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x18006ab84
inc ebx
add rax, 0x38
cmp ebx, r8d
jb 0x18006ab60
mov eax, ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
cmp ebx, 0xffffffff
je 0x18006ab77
test esi, esi
mov qword [rsp + 0x48], rdi
mov edx, 0xffffffff
setne cl
mov r8d, ecx
lea rcx, [rsp + 0x20]
call fcn.18006a940
mov edi, eax
test eax, eax
jne 0x18006ac6d
mov r9d, dword [0x1801499dc]
cmp ebx, r9d
jae 0x18006abfc
nop dword [rax + rax]
mov ecx, ebx
imul rdx, rcx, 0x38
mov rcx, qword [0x1801499d0]
movzx r8d, byte [rdx + rcx + 0x20]
shr r8d, 1
and r8d, 1
cmp r8d, esi
je 0x18006abf5
mov edx, esi
mov ecx, ebx
call fcn.18006aa20
mov edi, eax
test eax, eax
jne 0x18006abfc
mov r9d, dword [0x1801499dc]
inc ebx
cmp ebx, r9d
jb 0x18006abc0
cmp qword [rsp + 0x20], 0
je 0x18006ac6b
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x18006ac57
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18006ac48
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x18006ac20
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180148790]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
Function at 0x18006b010
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov esi, edx
mov ebx, r15d
xor eax, eax
mov rdi, rcx
mov ebp, 1
lock cmpxchg dword [0x180148584], ebp
je 0x18006b067
cmp rbx, 0x20
jae 0x18006b050
xor ecx, ecx
jmp 0x18006b052
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x180148584], ebp
jne 0x18006b046
cmp qword [0x180148790], r15
je 0x18006b161
test rdi, rdi
jne 0x18006b087
mov ecx, esi
call fcn.18006ab30
mov edi, eax
jmp 0x18006b166
mov ecx, dword [0x1801499dc]
mov ebx, r15d
test ecx, ecx
je 0x18006b0af
mov rdx, qword [0x1801499d0]
mov rax, rdx
nop
cmp rdi, qword [rax]
je 0x18006b0b9
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x18006b0a0
mov edi, 4
jmp 0x18006b166
cmp ebx, 0xffffffff
je 0x18006b0af
mov eax, ebx
imul rcx, rax, 0x38
movzx eax, byte [rcx + rdx + 0x20]
shr eax, 1
and eax, ebp
cmp eax, esi
je 0x18006b158
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.18006a940
mov edi, eax
test eax, eax
jne 0x18006b166
mov edx, esi
mov ecx, ebx
call fcn.18006aa20
mov edi, eax
cmp qword [rsp + 0x20], r15
je 0x18006b166
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x18006b142
mov rbx, qword [rsp + 0x20]
mov ebp, eax
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18006b138
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x18006b110
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180148790]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18006b166
neg esi
sbb edi, edi
add edi, 6
jmp 0x18006b166
mov edi, 2
xchg dword [0x180148584], r15d
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
Function at 0x180095a90
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
sub rsp, 0xe8
mov rax, qword [0x18011e040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov ecx, dword [0x180146028]
cmp dword [0x1801485b8], ecx
cmovg ecx, dword [0x1801485b8]
test ecx, ecx
js 0x180095adb
lea r9, str.GetProcessWindow_calledK...
mov r8d, 0x5f
lea rdx, str.C:UsersTOTOMAN2_source_reposNewColussus_Qols_ModImGuiutilsutils.cpp
xor ecx, ecx
call fcn.1800a9f80
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
lea rcx, [0x180095a10]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x180095c45
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xf8], rbp
movabs rbp, 0x7fffffffffffffff
mov qword [rsp + 0x100], rsi
movabs rsi, 0x431bde82d7b634db
mov qword [rsp + 0x108], rdi
movabs rdi, 0x4e94914effff
mov qword [rsp + 0xe0], r14
movabs r14, 0x7ffffffff4143dfe
lea rdx, [rsp + 0x30]
lea rcx, [0x180095a10]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [0x180146028]
cmp dword [0x1801485b8], ecx
cmovg ecx, dword [0x1801485b8]
test ecx, ecx
js 0x180095b98
lea r9, str.____Waiting_for_window_to_appear._n
mov r8d, 0x65
lea rdx, str.C:UsersTOTOMAN2_source_reposNewColussus_Qols_ModImGuiutilsutils.cpp
xor ecx, ecx
call fcn.1800a9f80
lea rcx, [rsp + 0x38]
call fcn.180009e30
mov rax, qword [rsp + 0x38]
lea rbx, [rax + 0xbebc200]
cmp rax, r14
jle 0x180095bb6
mov rbx, rbp
lea rcx, [rsp + 0x40]
call fcn.180009e30
mov rax, qword [rsp + 0x40]
cmp rbx, rax
je 0x180095c0f
jl 0x180095c0f
mov rcx, rbx
sub rcx, rax
cmp rcx, rdi
jg 0x180095c03
mov rax, rsi
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x180095bfa
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x180095bb6
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x180095bb6
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180095b54
mov r14, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0xf0]
mov r8d, 0x80
lea rdx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [0x180146028]
cmp dword [0x1801485b8], ecx
cmovg ecx, dword [0x1801485b8]
test ecx, ecx
js 0x180095c92
lea rax, [rsp + 0x50]
mov r8d, 0x6b
lea r9, str.Got_window_with_name:__s_n
mov qword [rsp + 0x20], rax
lea rdx, str.C:UsersTOTOMAN2_source_reposNewColussus_Qols_ModImGuiutilsutils.cpp
xor ecx, ecx
call fcn.1800a9f80
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1800ac6b0
add rsp, 0xe8
ret
Function at 0x1800a5420
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x1800a5471
mov qword [0x1801488a8], rcx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov r9, qword [0x1801488a8]
lea r8, [0x1800a4210]
xor eax, eax
mov dword [0x180148ec8], 6
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1800a5471
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret
Function at 0x1800ab970
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x18011e040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, rdx
mov rsi, rcx
mov ecx, 0x104
call fcn.1800ace94
mov rdi, rax
mov qword [rsp + 0x40], rax
mov edx, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rdi + r8], 0
jne 0x1800ab9e0
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.180002d90
nop
mov ecx, 0x104
call fcn.1800ace94
mov r14, rax
mov qword [rsp + 0x48], rax
cmp qword [rsi + 0x18], 0xf
jbe 0x1800aba14
mov rsi, qword [rsi]
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
mov r8, rsi
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathCombineA]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800aba31
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.180005360
nop
mov rcx, r14
call fcn.1800aca84
test rbp, rbp
je 0x1800aba80
lea rax, [rsp + 0x20]
cmp rbp, rax
je 0x1800aba80
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
mov rcx, rbp
call fcn.180005360
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1800abada
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800abad5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800abad5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800aca84
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov rcx, rdi
call fcn.1800aca84
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800ac6b0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x1800abee4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1800abf1e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1800abf23
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800abf6c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1800b40f0]
cmp byte [rcx + rax], 0
je 0x1800abf6c
dec r8
sub rdx, 1
jne 0x1800abf52
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1000033f4
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x10000c168]
xor rax, rsp
mov qword [rsp + 0x270], rax
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
mov rdi, rcx
mov rcx, qword [rcx]
lea rax, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x1000034f8
test rcx, rcx
je 0x10000346e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
test ebx, ebx
mov qword [rsp + 0x48], rcx
jmp 0x100003494
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1000033f4
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x1000034f8
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10000347c
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1000034e6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x48], 0
mov rdx, rsi
mov rcx, rdi
call fcn.100003344
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test rcx, rcx
je 0x100003503
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.100008430
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x100003bd4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x10000c168]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r12, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
cmp rax, rbx
jne 0x100003c48
call fcn.1000032d0
mov ebx, eax
jmp 0x100003d89
mov r8, r12
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
cmp rax, rbx
jne 0x100003c6b
call fcn.1000032d0
mov ebx, eax
jmp 0x100003d7f
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rsp + 0x40], rax
cmp rax, rbx
jne 0x100003c90
call fcn.1000032d0
mov ebx, eax
jmp 0x100003d7f
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jae 0x100003cc9
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x100003cbf
lea rcx, [rsp + 0x70]
call fcn.100006378
nop
mov eax, 0x8007000e
jmp 0x100003da2
mov ecx, eax
cmp rcx, rbx
je 0x100003d07
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x100003cfd
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x100003d07
lea rcx, [rsp + 0x70]
call fcn.100006504
mov rax, qword [rsp + 0x70]
jmp 0x100003d11
mov ecx, 0x80070057
call fcn.100003288
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x100003d28
cmp rax, rbx
jne 0x100003d34
mov ebx, 0x8007000e
jmp 0x100003d7f
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
jne 0x100003d5b
call fcn.1000032d0
mov ebx, eax
jmp 0x100003d7f
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.10000490c
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x100003da0
lea rcx, [rsp + 0x70]
call fcn.100006378
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.100008430
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret
Function at 0x1000066e0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x30
cmp byte [0x10000ca48], 0
mov ebx, r9d
je 0x1000066f7
or eax, 0xffffffff
jmp 0x10000672e
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [rsp + 0x20]
lea rcx, [0x10000c9e0]
mov rdx, rax
call fcn.1000067a8
cmp al, 1
jne 0x10000672a
lea rcx, [0x10000c9e0]
mov edx, ebx
call fcn.100006a08
jmp 0x10000672e
mov eax, dword [rsp + 0x20]
add rsp, 0x30
pop rbx
ret
Function at 0x100007940
Capabilities:
Bypass uac via rpc

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
mov dword [rsp + 0x40], ebx
and qword [rsp + 0x48], rbx
cmp qword [0x10000cac0], rbx
jne 0x100007997
lea r8, [rsp + 0x48]
xor edx, edx
lea rcx, [0x100002f80]
call fcn.100007b04
mov dword [rsp + 0x20], eax
test eax, eax
jne 0x1000079c0
mov rcx, qword [rsp + 0x48]
xor eax, eax
lock cmpxchg qword [0x10000cac0], rcx
je 0x100007997
lea rcx, [rsp + 0x48]
call qword [sym.imp.RPCRT4.dll_RpcBindingFree]
and qword [rsp + 0x48], rbx
nop
mov r9, qword [0x10000cac0]
xor r8d, r8d
lea edx, [r8 + 3]
lea rcx, [0x100002070]
call sub.RPCRT4.dll_NdrClientCall3
mov dword [rsp + 0x20], eax
jmp 0x1000079c0
test eax, eax
je 0x100007a00
cmp eax, 0x6ba
je 0x1000079e0
cmp eax, 0x6ac
je 0x1000079e0
cmp eax, 0x6b5
je 0x1000079e0
cmp eax, 0x6d9
jne 0x100007a00
cmp ebx, 1
ja 0x1000079fb
inc ebx
mov dword [rsp + 0x40], ebx
mov ecx, 0xa
call fcn.100007a0c
test eax, eax
jne 0x1000079c0
jmp 0x100007997
mov eax, 0x425
add rsp, 0x30
pop rbx
ret

Function at 0x100007a0c
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
xor esi, esi
xor edx, edx
xor ecx, ecx
lea r8d, [rsi + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
jne 0x100007a45
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x100007ae6
lea rdx, [0x100002fd0]
mov r8d, 0x14
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x100007ac7
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x100007a84
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x420
jne 0x100007acf
mov ebx, 0x5b4
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x100007ac7
cmp dword [rsp + 0x24], 4
je 0x100007ac3
cmp dword [rsp + 0x24], 1
je 0x100007abd
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
ja 0x100007acf
jmp 0x100007a89
mov ebx, dword [rsp + 0x2c]
jmp 0x100007acf
xor ebx, ebx
jmp 0x100007acf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test rdi, rdi
je 0x100007add
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x100007b04
Capabilities:
Bypass uac via rpc

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x80
and qword [rax - 0x40], 0
and qword [rax - 0x48], 0
and dword [rax - 0x38], 0
xor edx, edx
mov rsi, r8
lea rcx, [rax - 0x34]
lea r8d, [rdx + 0x24]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x48]
lea rdx, [0x100002fe0]
mov qword [rsp + 0x28], rax
lea rcx, [0x100002f80]
xor edi, edi
and qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.RPCRT4.dll_RpcStringBindingComposeW]
mov ebx, eax
test eax, eax
jne 0x100007c35
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x40]
call qword [sym.imp.RPCRT4.dll_RpcBindingFromStringBindingW]
lea rcx, [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
test ebx, ebx
jne 0x100007c35
lea edx, [rdi + 0x44]
lea ecx, [rdi + 0x40]
mov dword [rsp + 0xa8], edx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x100007bb4
lea ebx, [rax + 8]
jmp 0x100007c35
xor edx, edx
lea r9, [rsp + 0xa8]
mov r8, rax
lea ecx, [rdx + 0x16]
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
jne 0x100007bd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x100007c35
mov rcx, qword [rsp + 0x40]
and dword [rsp + 0x58], 0
mov eax, 3
xor edx, edx
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x5c], eax
lea rax, [rsp + 0x50]
lea r9d, [rdx + 0xa]
lea r8d, [rdx + 6]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov dword [rsp + 0x54], 1
mov qword [rsp + 0x70], rdi
call qword [sym.imp.RPCRT4.dll_RpcBindingSetAuthInfoExW]
mov ebx, eax
test eax, eax
jne 0x100007c35
mov rax, qword [rsp + 0x40]
and qword [rsp + 0x40], 0
mov qword [rsi], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x40], 0
je 0x100007c51
lea rcx, [rsp + 0x40]
call qword [sym.imp.RPCRT4.dll_RpcBindingFree]
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret