joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405370
Capabilities:
Modify service
Query service configuration

Disassembly:
mov r11, rsp
sub rsp, 0x1a8
mov rax, qword [0x0045f6c0]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rbp, rcx
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
mov rbx, rax
jne 0x4053c2
lea rcx, str.error:_OpenSCManager_fail...
call fcn.00404a90
xor eax, eax
jmp 0x4054ee
lea rdx, [0x00440f8c]
mov r8d, 0xf01ff
mov rcx, rax
mov qword [rsp + 0x1c8], rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
test rax, rax
mov rsi, rax
jne 0x405404
lea rcx, str.error:_OpenService_fail...
call fcn.00404a90
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x4054e6
mov qword [rsp + 0x1a0], rdi
lea r9, [rsp + 0x60]
xor edi, edi
mov r8d, 0x3e8
mov rdx, rbp
mov rcx, rax
mov dword [rsp + 0x60], edi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x40543c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.QueryServiceConfig___d
jmp 0x4054ad
cmp eax, 1
jne 0x4054ca
lea r8, [rsp + 0x68]
mov edx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x40545f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rbp]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov r9d, 0xffffffff
mov r8d, 4
mov rcx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
mov edi, eax
jne 0x4054ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.ChangeServiceConfig___d
lea rcx, [rsp + 0x90]
mov r8d, eax
call fcn.00427fd0
lea rcx, [rsp + 0x90]
call fcn.00404a90
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
mov rdi, qword [rsp + 0x1a0]
mov rsi, qword [rsp + 0x1c8]
mov rbp, qword [rsp + 0x1c0]
mov rbx, qword [rsp + 0x1b8]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.00425570
add rsp, 0x1a8
ret
Function at 0x405770
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
mov rax, rsp
sub rsp, 0xf8
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov rax, qword [0x0045f6c0]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0x30], 0x80
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40592e
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.Identifier
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test eax, eax
je 0x40586f
call fcn.00418c7c
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x405827
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov edx, edi
lea rcx, str.IsVista64_RegQueryValueEx_errorcode:__d_n
call fcn.00404a90
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x405917
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x405917
call fcn.00418c7c
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x40588e
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x60]
lea rcx, str.Identifier:__s_n
call fcn.00404a90
lea rdx, [0x004413ec]
lea rcx, [rsp + 0x60]
call fcn.00424e10
test rax, rax
je 0x4058f9
lea rcx, str.Find_substring_64__So_this_is_a_64bit_OS_n
call fcn.00404a90
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x4058f2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
jmp 0x405930
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x405917
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, str.Cant_find_substring_64__So_this_isnt_a_64bit_OS_n
call fcn.00404a90
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.00425570
mov rbx, qword [rsp + 0x110]
mov rdi, qword [rsp + 0x118]
add rsp, 0xf8
ret
Function at 0x405c70
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x40
lea rcx, str._MySystemShutdown____Install_hot_fix_ok_and_restar_system_n
call fcn.00404a90
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov rcx, rax
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x405ca7
xor eax, eax
add rsp, 0x40
pop rbx
ret
lea r8, [rsp + 0x34]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x50]
xor ebx, ebx
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x405c9f
lea edx, [rbx + 0xd]
lea ecx, [rbx + 2]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
setne bl
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x40a430
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x168
mov rax, qword [0x0045f6c0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x178], rbx
mov rbx, rcx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x12c
call fcn.004255a0
lea rcx, [rsp + 0x20]
mov edx, 0x12c
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x40a48d
lea rcx, str.Error_:_GetWindowsDirectory_fail._n
call fcn.00404a90
xor al, al
jmp 0x40a598
mov rdx, qword [rbx + 0x20]
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x188], rdi
xor eax, eax
lea rdi, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
cmp rdx, 0x10
not rcx
lea rsi, [rcx - 1]
jb 0x40a4c8
mov rax, qword [rbx + 8]
lea rdi, [rbx + 8]
jmp 0x40a4cf
lea rdi, [rbx + 8]
mov rax, rdi
lea rcx, [rsp + 0x20]
cmp rcx, rax
jb 0x40a516
cmp rdx, 0x10
jb 0x40a4e4
mov rcx, qword [rdi]
jmp 0x40a4e7
mov rcx, rdi
add rcx, qword [rbx + 0x18]
lea rax, [rsp + 0x20]
cmp rcx, rax
jbe 0x40a516
cmp rdx, 0x10
jb 0x40a4fe
mov rdi, qword [rdi]
lea r8, [rsp + 0x20]
mov r9, rsi
mov rdx, rbx
sub r8, rdi
mov rcx, rbx
call fcn.00403070
jmp 0x40a586
cmp rsi, 0xfffffffffffffffe
jbe 0x40a521
call fcn.0043e3e0
mov rax, qword [rbx + 0x20]
cmp rax, rsi
jae 0x40a54d
mov r8, qword [rbx + 0x18]
mov rdx, rsi
mov rcx, rbx
call fcn.00402120
test rsi, rsi
je 0x40a586
mov rdx, qword [rbx + 0x20]
cmp rdx, 0x10
jb 0x40a564
mov rcx, qword [rdi]
jmp 0x40a567
test rsi, rsi
jne 0x40a539
cmp rax, 0x10
mov qword [rbx + 0x18], rsi
jb 0x40a55f
mov rdi, qword [rdi]
mov byte [rdi], 0
jmp 0x40a586
mov rcx, rdi
lea r8, [rsp + 0x20]
mov r9, rsi
call fcn.00426220
cmp qword [rbx + 0x20], 0x10
mov qword [rbx + 0x18], rsi
jb 0x40a582
mov rdi, qword [rdi]
mov byte [rdi + rsi], 0
mov rdi, qword [rsp + 0x188]
mov rsi, qword [rsp + 0x180]
mov al, 1
mov rbx, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.00425570
add rsp, 0x168
ret

Function at 0x40a5c0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbx
mov rbx, rcx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov rdi, rdx
lea rcx, [0x0049ed80]
xor edx, edx
mov r8d, 0x801
call fcn.004255a0
lea rdx, [0x0044241c]
mov rcx, rbx
call fcn.004279c0
test rax, rax
mov rsi, rax
je 0x40a66e
lea rcx, [0x0049ed80]
mov r9, rax
mov edx, 1
mov r8d, 0x800
call fcn.00428a70
mov rcx, rsi
call fcn.004275a0
lea rcx, [0x0049ed80]
call fcn.00425420
lea rcx, [0x0049ed80]
mov rdx, rdi
call fcn.00424e10
test rax, rax
je 0x40a66e
lea rcx, str.IsDriverInfFiles:find__s__in___s__n
mov r8, rbx
mov rdx, rdi
call fcn.00404a90
mov al, 1
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
add rsp, 0x28
ret
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
xor al, al
add rsp, 0x28
ret
Function at 0x40aed0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
sub rsp, 0x2a8
mov rax, qword [0x0045f6c0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov eax, dword [rcx + 0x20]
xor edx, edx
mov r8d, 0x104
mov dword [rsp + 0x6c], eax
mov eax, dword [rcx + 0x24]
mov qword [rsp + 0x2c8], rdi
mov dword [rsp + 0x58], eax
mov eax, dword [rcx + 0x28]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x54], 0x104
mov dword [rsp + 0x50], 4
mov dword [rsp + 0x5c], eax
call fcn.004255a0
lea r11, [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], rax
xor edi, edi
mov qword [rsp + 0x30], rdi
lea rdx, str.SOFTWAREHuawei_technologiesCurrentHandSetProductLineDriver
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40af7e
lea rcx, str.INFO:_DriverInfo_Open_Key_error._n
call fcn.00404a90
jmp 0x40b0f3
cmp dword [rsp + 0x68], 2
jne 0x40b0d4
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
lea r8, [rsp + 0x180]
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rsp + 0x2c0], rbx
mov qword [rsp + 0x28], rdi
mov ebx, edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x40b0cc
nop
nop
nop
nop
lea rdx, str.MajorVersion
lea rcx, [rsp + 0x180]
add ebx, 1
call fcn.00424e10
test rax, rax
je 0x40b010
mov r8d, dword [rsp + 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x6c]
call fcn.00425980
lea rdx, str.MinorVersion
lea rcx, [rsp + 0x180]
call fcn.00424e10
test rax, rax
je 0x40b03d
mov r8d, dword [rsp + 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.00425980
lea rdx, str.Customization
lea rcx, [rsp + 0x180]
call fcn.00424e10
test rax, rax
je 0x40b06a
mov r8d, dword [rsp + 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x5c]
call fcn.00425980
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x104
mov dword [rsp + 0x54], 0x104
mov dword [rsp + 0x50], 4
call fcn.004255a0
mov rcx, qword [rsp + 0x60]
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x54]
lea r8, [rsp + 0x180]
mov edx, ebx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x40afe0
mov rbx, qword [rsp + 0x2c0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.SOFTWAREHuawei_technologiesCurrentHandSetProductLineDriver
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
xor eax, eax
mov rdi, qword [rsp + 0x2c8]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.00425570
add rsp, 0x2a8
ret
Function at 0x40b120
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
sub rsp, 0x128
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x0045f6c0]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov dword [rsp + 0x60], 0x80
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlCOM_Name_Arbiter
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea r11, [rsp + 0x60]
mov qword [rsp + 0x28], r11
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
xor r8d, r8d
lea rdx, str.ComDB
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
xor ebx, ebx
lea ebp, [rbx - 1]
test eax, eax
je 0x40b22c
call fcn.00418c7c
mov r11, rax
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x40b1e5
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov r8d, edi
lea rdx, str.RegQueryValueEx_errorcode:__d
lea rcx, [rsp + 0x70]
call fcn.004038f0
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x40b22c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.00418c7c
mov rcx, rax
test rax, rax
setne bl
test ebx, ebx
jne 0x40b249
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
movzx eax, byte [rsp + 0x99]
movzx ecx, byte [rsp + 0x98]
movzx edx, byte [rsp + 0x97]
movzx r10d, byte [rsp + 0x96]
movzx r11d, byte [rsp + 0x95]
movzx ebx, byte [rsp + 0x94]
movzx edi, byte [rsp + 0x93]
movzx esi, byte [rsp + 0x92]
movzx r9d, byte [rsp + 0x91]
movzx r8d, byte [rsp + 0x90]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x40], r10d
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
lea rdx, str.HWHandsetComDB_before_install:__d__d__d__d__d__d__d__d__d__d_n
lea rcx, [rsp + 0x68]
call fcn.004038f0
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
call fcn.00404a90
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x40b306
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.00425570
mov rbx, qword [rsp + 0x130]
mov rbp, qword [rsp + 0x138]
mov rsi, qword [rsp + 0x140]
mov rdi, qword [rsp + 0x148]
add rsp, 0x128
ret
Function at 0x40b380
Capabilities:
Check if file exists

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
mov rax, qword [0x0045f6c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov qword [r11 - 0x20], 0xf
mov qword [r11 - 0x28], 0
mov byte [rsp + 0x30], 0
lea rcx, [r11 - 0x40]
call fcn.00404500
test al, al
jne 0x40b3e8
cmp qword [rsp + 0x48], 0x10
jb 0x40b3de
mov rcx, qword [rsp + 0x30]
call fcn.0041873c
mov eax, 0x4e24
jmp 0x40b4d8
xor edx, edx
mov r8d, 0x104
mov rcx, rbx
call fcn.004255a0
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rdx, qword [rsp + 0x30]
mov rcx, rbx
nop
movzx eax, byte [rdx]
mov byte [rcx], al
add rdx, 1
add rcx, 1
test al, al
jne 0x40b410
call fcn.00405770
test eax, eax
je 0x40b44e
mov rdi, rbx
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.DriverX64]
mov qword [rdi - 1], rax
mov eax, dword [0x004426e0]
mov dword [rdi + 7], eax
jmp 0x40b470
mov rdi, rbx
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.DriverX86]
mov qword [rdi - 1], rax
mov eax, dword [0x004426d0]
mov dword [rdi + 7], eax
lea rcx, str.Info____:_Driver_path:
call fcn.00404a90
mov rcx, rbx
call fcn.00404a90
lea rcx, [0x004426a8]
call fcn.00404a90
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
jne 0x40b4b4
cmp qword [rsp + 0x48], 0x10
jb 0x40b4b0
mov rcx, qword [rsp + 0x30]
call fcn.0041873c
xor eax, eax
jmp 0x40b4d8
lea rcx, str.Error_:_Driver_path_is_not_founded._n
call fcn.00404a90
nop
cmp qword [rsp + 0x48], 0x10
jb 0x40b4d3
mov rcx, qword [rsp + 0x30]
call fcn.0041873c
mov eax, 0x4e24
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.00425570
mov rbx, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
add rsp, 0x68
ret
Function at 0x4185a0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rbx
mov rax, rdx
mov qword [rsp + 0x58], rbp
mov rbp, rcx
lea rdx, [0x00443c04]
mov rcx, rax
mov qword [rsp + 0x68], rdi
xor bl, bl
mov qword [rsp + 0x40], r12
call fcn.004279c0
test rax, rax
mov rdi, rax
je 0x418663
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call fcn.00429730
mov rcx, rdi
call fcn.004295c0
xor r8d, r8d
xor edx, edx
mov rcx, rdi
movsxd r12, eax
call fcn.00429730
lea r11d, [r12 + 1]
test r11d, r11d
movsxd rcx, r11d
jne 0x418688
xor ecx, ecx
mov qword [rsp + 0x60], rsi
call fcn.00418700
mov r9, rdi
mov r8d, 1
mov rdx, r12
mov rcx, rax
mov rsi, rax
call fcn.00428a70
cmp rax, 1
jne 0x41864a
mov rdx, rsi
mov rcx, rbp
mov byte [r12 + rsi], 0
call fcn.004182d0
movzx ebx, al
mov rcx, rdi
call fcn.004275a0
mov rcx, rsi
call fcn.0041873c
test bl, bl
mov rsi, qword [rsp + 0x60]
jne 0x41866d
xor edx, edx
mov rcx, rbp
call fcn.004182d0
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
mov al, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jae 0x418610
xor ecx, ecx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x28]
call fcn.00425f50
lea r11, [0x00440f70]
lea rdx, [0x00451228]
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x28], r11
call fcn.004268e0
int3

Function at 0x42ce97
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x0045f6c0]
jne 0x42558a
rol rcx, 0x10
test cx, 0xffff
jne 0x425586
repz ret
ror rcx, 0x10
jmp 0x42cdf0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x004b1a90]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x004b1b88]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x42ce75
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x004b1a90]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x42ce97
mov rax, qword [rsp + 0x88]
mov qword [0x004b1b88], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x004b1b28], rax
mov rax, qword [0x004b1b88]
mov qword [0x004b1a00], rax
mov rax, qword [rsp + 0x90]
mov qword [0x004b1b10], rax
mov dword [0x004b19f0], 0xc0000409
mov dword [0x004b19f4], 1
mov rax, qword [0x0045f6c0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x0045f6c8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x004b1a88], eax
mov ecx, 1
call fcn.0042e0b0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x00446610]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x004b1a88], 0
jne 0x42cf1e
mov ecx, 1
call fcn.0042e0b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x436be0
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.0042c190
xor ebx, ebx
cmp qword [0x004b2398], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x436d11
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x436c43
xor eax, eax
jmp 0x436df1
lea rdx, [0x00447140]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x436c3c
mov rcx, rax
call fcn.0042c120
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x004b2398], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0042c120
lea rdx, [0x00447118]
mov rcx, rbp
mov qword [0x004b23a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0042c120
lea rcx, [rsp + 0x30]
mov qword [0x004b23a8], rax
call fcn.0042a920
test eax, eax
je 0x436cc7
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00426490
cmp dword [rsp + 0x30], 2
jne 0x436d11
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0042c120
test rax, rax
mov qword [0x004b23b8], rax
je 0x436d11
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0042c120
mov qword [0x004b23b0], rax
mov rcx, qword [0x004b23b0]
cmp rcx, rsi
je 0x436da3
cmp qword [0x004b23b8], rsi
je 0x436da3
call fcn.0042c1f0
call rax
test rax, rax
mov rbp, rax
je 0x436d6e
mov rcx, qword [0x004b23b8]
call fcn.0042c1f0
lea rcx, [rsp + 0x38]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x436d6e
test byte [rsp + 0x48], 1
jne 0x436da3
lea rcx, [rsp + 0x34]
call fcn.0042a970
test eax, eax
je 0x436d90
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00426490
cmp dword [rsp + 0x34], 4
jb 0x436d9d
bts edi, 0x15
jmp 0x436dd7
bts edi, 0x12
jmp 0x436dd7
mov rcx, qword [0x004b23a0]
cmp rcx, rsi
je 0x436dd7
call fcn.0042c1f0
call rax
test rax, rax
mov rbx, rax
je 0x436dd7
mov rcx, qword [0x004b23a8]
cmp rcx, rsi
je 0x436dd7
call fcn.0042c1f0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x004b2398]
call fcn.0042c1f0
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x180001000
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x28
cmp edx, 1
jne 0x180001031
xor r9d, r9d
lea r8, [0x1800021b0]
lea rdx, str.hey_gay
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
lea rcx, str.powershell.exe_Add_MpPreference__Force__ExclusionPath_C:_
call qword [sym.imp.KERNEL32.dll_WinExec]
mov eax, 1
add rsp, 0x28
ret