joyce8/EMBER2024-capa huggingface dataset:
Function at 0x71d1c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0x90], rcx
mov qword [rbp + 0x98], rdx
mov qword [rbp + 0xa0], r8
mov dword [rbp + 0xa8], r9d
mov rax, qword [rbp + 0xb0]
mov qword [rbp + 0xb0], rax
nop
mov rax, qword [rbp + 0xb0]
movzx rcx, byte [rax]
call fcn.0071a300
mov dword [rbp + 0x6c], eax
mov rcx, qword [rbp + 0x98]
call fcn.004108b0
mov rax, qword [rbp + 0x90]
mov eax, dword [rax + 0x30]
test eax, eax
jne 0x71d257
mov eax, dword [rbp + 0xa8]
mov dword [rbp + 0x68], eax
jmp 0x71d25a
mov dword [rbp + 0x68], eax
lea rcx, [rbp + 0x70]
mov rdx, qword [0x0071d170]
mov r8d, 1
mov r9d, dword [rbp + 0x68]
call fcn.00414ac0
mov rcx, qword [rbp + 0x70]
mov edx, dword [rbp + 0x68]
xor r8, r8
call fcn.0040bfe0
mov rcx, qword [rbp + 0xa0]
call fcn.00411d40
mov rcx, qword [rbp + 0x90]
mov rcx, qword [rcx + 8]
mov rdx, rax
xor r8, r8
lea r9, [rbp + 0x6c]
mov rax, qword [rbp + 0x70]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jne 0x71d2d4
mov rcx, qword [rbp + 0x98]
mov rdx, qword [rbp + 0x70]
call fcn.00411dd0
mov dword [rbp + 0x60], 0
mov rax, qword [rbp + 0x98]
mov rax, qword [rax]
test rax, rax
je 0x71d2f0
mov eax, dword [rax - 4]
mov dword [rbp + 0x60], eax
cmp dword [rbp + 0x60], 0x802
jle 0x71d388
nop
mov qword [rbp + 0x78], 0
lea rcx, [rbp + 0x40]
mov edx, dword [rbp + 0x64]
call fcn.00436670
lea rcx, [rbp + 0x78]
mov edx, 3
lea r8, [0x0071d430]
mov r9, qword [rbp + 0x40]
lea rax, [0x0071d470]
mov qword [rsp + 0x20], rax
call fcn.004122a0
mov dword [rbp + 0x5c], 0
mov rax, qword [rbp + 0x98]
mov rax, qword [rax]
test rax, rax
je 0x71d353
mov eax, dword [rax - 4]
mov dword [rbp + 0x5c], eax
lea rcx, [rbp + 0x30]
mov edx, dword [rbp + 0x5c]
call fcn.00436670
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x78]
mov r8, qword [rbp + 0x30]
call fcn.00412170
mov rcx, qword [rbp + 0x38]
mov dl, 1
xor r8, r8
call fcn.0071a280
nop
lea rcx, [rbp + 0x78]
call fcn.004108b0
mov ecx, dword [rbp + 0x6c]
call fcn.0071a340
mov rcx, qword [rbp + 0xb0]
mov byte [rcx], al
nop
lea rcx, [rbp + 0x30]
mov edx, 3
call fcn.00410990
lea rcx, [rbp + 0x70]
mov rdx, qword [0x0071d170]
call fcn.00414c90
mov rax, qword [rbp + 0x98]
lea rsp, [rbp + 0x80]
pop rbp
ret
Function at 0x71dc50
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
sub rsp, 0x98
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0xb0], rcx
mov qword [rbp + 0xb8], rdx
mov qword [rbp + 0xc0], r8
nop
mov rax, qword [rbp + 0xb0]
mov rax, qword [rax + 0x50]
mov rax, qword [rax + 8]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rax + 0x50]
mov rdx, qword [rbp + 0xb8]
call fcn.0071a8a0
nop
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rax + 0x50]
lea rdx, [rbp + 0x64]
call fcn.0071b240
test al, al
je 0x71ddbe
mov rcx, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0xb8]
mov r8, qword [rbp + 0xc0]
xor r9, r9
call fcn.0071dad0
lea rcx, [rbp + 0x58]
xor edx, edx
mov r8d, dword [rbp + 0x70]
add r8d, 1
call fcn.00410b70
xor eax, eax
mov ebx, dword [rbp + 0x6c]
sub ebx, 1
mov dword [rbp + 0x80], eax
cmp dword [rbp + 0x80], ebx
jg 0x71ddbd
sub ebx, eax
add ebx, 1
mov eax, dword [rbp + 0x70]
add eax, 1
mov dword [rbp + 0x84], eax
mov rcx, qword [rbp + 0x58]
call fcn.00411d40
mov rcx, qword [rbp + 0xb8]
mov edx, dword [rbp + 0x80]
mov r8, rax
lea r9, [rbp + 0x84]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.advapi32.dll_RegEnumValueW
test eax, eax
jne 0x71ddab
mov rcx, qword [rbp + 0x58]
call fcn.00411d40
lea rcx, [rbp + 0x40]
mov rdx, rax
call fcn.00411dd0
mov rcx, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0xb8]
mov r8, qword [rbp + 0xc0]
mov r9, qword [rbp + 0x40]
call fcn.0071dad0
add dword [rbp + 0x80], 1
sub ebx, 1
test ebx, ebx
jne 0x71dd1f
nop
nop
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rax + 0x50]
mov rdx, qword [rbp + 0x88]
call fcn.0071a8a0
nop
lea rcx, [rbp + 0x40]
call fcn.004108b0
lea rcx, [rbp + 0x58]
call fcn.004108b0
lea rsp, [rbp + 0x98]
pop rbx
pop rbp
ret
Function at 0x71de60
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
sub rsp, 0xd0
mov rbp, rsp
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x68], rbp
mov qword [rbp + 0xe0], rcx
mov qword [rbp + 0xe8], rdx
mov qword [rbp + 0xf0], r8
nop
mov rax, qword [rbp + 0xe0]
mov rax, qword [rax + 0x50]
mov rax, qword [rax + 8]
mov qword [rbp + 0xb0], rax
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax + 0x50]
mov rdx, qword [rbp + 0xe8]
call fcn.0071a8a0
nop
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax + 0x50]
lea rdx, [rbp + 0x8c]
call fcn.0071b240
test al, al
je 0x71e0f1
lea rcx, [rbp + 0x80]
xor edx, edx
mov r8d, dword [rbp + 0x90]
add r8d, 1
call fcn.00410b70
xor eax, eax
mov ecx, dword [rbp + 0x8c]
sub ecx, 1
mov dword [rbp + 0x4c], ecx
mov dword [rbp + 0xa8], eax
mov ecx, dword [rbp + 0x4c]
cmp dword [rbp + 0xa8], ecx
jg 0x71e0f0
mov ecx, dword [rbp + 0x4c]
sub ecx, eax
add ecx, 1
mov dword [rbp + 0x4c], ecx
mov eax, dword [rbp + 0x90]
add eax, 1
mov dword [rbp + 0xac], eax
mov rcx, qword [rbp + 0x80]
call fcn.00411d40
mov rcx, qword [rbp + 0xe8]
mov edx, dword [rbp + 0xa8]
mov r8, rax
lea r9, [rbp + 0xac]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x71e0d5
mov rcx, qword [rbp + 0x80]
call fcn.00411d40
lea rcx, [rbp + 0x60]
mov rdx, rax
call fcn.00411dd0
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax + 0x50]
mov rdx, qword [rbp + 0x60]
call fcn.0071d4d0
mov qword [rbp + 0xb8], rax
cmp qword [rbp + 0xb8], 0
je 0x71e0d5
nop
mov rax, qword [rbp + 0xe0]
mov rax, qword [rax + 0x50]
mov rax, qword [rax + 8]
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax + 0x50]
mov rdx, qword [rbp + 0xf0]
call fcn.0071a8a0
nop
mov rcx, qword [rbp + 0x80]
call fcn.00411d40
lea rcx, [rbp + 0x58]
mov rdx, rax
call fcn.00411dd0
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax + 0x50]
mov rdx, qword [rbp + 0x58]
call fcn.0071a8b0
mov rcx, qword [rbp + 0x80]
call fcn.00411d40
lea rcx, [rbp + 0x50]
mov rdx, rax
call fcn.00411dd0
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax + 0x50]
mov rdx, qword [rbp + 0x50]
call fcn.0071d4d0
mov qword [rbp + 0xc8], rax
nop
mov rcx, qword [rbp + 0xe0]
mov rdx, qword [rbp + 0xb8]
mov r8, qword [rbp + 0xc8]
call fcn.0071dc50
mov rcx, qword [rbp + 0xe0]
mov rdx, qword [rbp + 0xb8]
mov r8, qword [rbp + 0xc8]
call fcn.0071de60
nop
mov rcx, qword [rbp + 0xc8]
call sub.advapi32.dll_RegCloseKey
nop
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax + 0x50]
mov rdx, qword [rbp + 0xc0]
call fcn.0071a8a0
nop
mov rcx, qword [rbp + 0xb8]
call sub.advapi32.dll_RegCloseKey
add dword [rbp + 0xa8], 1
mov eax, dword [rbp + 0x4c]
sub eax, 1
mov dword [rbp + 0x4c], eax
mov eax, dword [rbp + 0x4c]
test eax, eax
jne 0x71df3c
nop
nop
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax + 0x50]
mov rdx, qword [rbp + 0xb0]
call fcn.0071a8a0
nop
lea rcx, [rbp + 0x50]
mov edx, 3
call fcn.00410990
lea rcx, [rbp + 0x80]
call fcn.004108b0
lea rsp, [rbp + 0xd0]
pop rbp
ret
Function at 0x71e6a0
Capabilities:
Query service status

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x70], rcx
mov rcx, qword [rbp + 0x70]
call fcn.00410a40
nop
mov dword [rbp + 0x4c], 0
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call sub.advapi32.dll_OpenSCManagerW
mov qword [rbp + 0x50], rax
cmp qword [rbp + 0x50], 0
je 0x71e73e
nop
mov rcx, qword [rbp + 0x70]
call fcn.00411d40
mov rcx, qword [rbp + 0x50]
mov rdx, rax
mov r8d, 4
call sub.advapi32.dll_OpenServiceW
mov qword [rbp + 0x58], rax
cmp qword [rbp + 0x58], 0
je 0x71e730
nop
mov rcx, qword [rbp + 0x58]
lea rdx, [rbp + 0x30]
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x71e71a
mov eax, dword [rbp + 0x34]
mov dword [rbp + 0x4c], eax
nop
mov rcx, qword [rbp + 0x58]
call sub.advapi32.dll_CloseServiceHandle
nop
mov rcx, qword [rbp + 0x50]
call sub.advapi32.dll_CloseServiceHandle
jmp 0x71e73d
xor ecx, ecx
mov rdx, qword [rbp + 0x28]
call fcn.0071e770
jmp 0x71e73e
nop
lea rcx, [rbp + 0x70]
call fcn.004108b0
mov eax, dword [rbp + 0x4c]
lea rsp, [rbp + 0x60]
pop rbp
ret

Function at 0x71e810
Capabilities:
Start service

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x78], rdx
mov byte [rbp + 0x80], r8b
mov rcx, qword [rbp + 0x78]
call fcn.00410a40
nop
lea rcx, [0x0071e9fc]
xor edx, edx
mov r8d, 0xf003f
call sub.advapi32.dll_OpenSCManagerW
mov qword [rbp + 0x50], rax
cmp qword [rbp + 0x50], 0
jne 0x71e895
call sub.kernel32.dll_GetLastError
lea rcx, [rbp + 0x30]
mov edx, eax
call fcn.004366a0
mov rcx, qword [rbp + 0x70]
lea rdx, [0x0071ea0c]
mov r8, qword [rbp + 0x30]
call fcn.00412170
jmp 0x71e962
nop
mov rcx, qword [rbp + 0x78]
call fcn.00411d40
mov rcx, qword [rbp + 0x50]
mov rdx, rax
mov r8d, 0xf003f
call sub.advapi32.dll_OpenServiceW
mov qword [rbp + 0x58], rax
cmp qword [rbp + 0x58], 0
jne 0x71e8e2
call sub.kernel32.dll_GetLastError
lea rcx, [rbp + 0x28]
mov edx, eax
call fcn.004366a0
mov rcx, qword [rbp + 0x70]
lea rdx, [0x0071ea5c]
mov r8, qword [rbp + 0x28]
call fcn.00412170
jmp 0x71e954
nop
cmp byte [rbp + 0x80], 0
je 0x71e8f5
lea rcx, [rbp + 0x58]
call fcn.0071e520
mov rcx, qword [rbp + 0x58]
xor edx, edx
mov r8, qword [rbp + 0x48]
call sub.advapi32.dll_StartServiceW
test eax, eax
je 0x71e91a
mov rcx, qword [rbp + 0x70]
lea rdx, [0x0071eaa8]
call fcn.00410ee0
jmp 0x71e93e
call sub.kernel32.dll_GetLastError
lea rcx, [rbp + 0x20]
mov edx, eax
call fcn.004366a0
mov rcx, qword [rbp + 0x70]
lea rdx, [0x0071ead0]
mov r8, qword [rbp + 0x20]
call fcn.00412170
nop
mov rcx, qword [rbp + 0x58]
call sub.advapi32.dll_CloseServiceHandle
nop
mov rcx, qword [rbp + 0x50]
call sub.advapi32.dll_CloseServiceHandle
jmp 0x71e961
xor ecx, ecx
mov rdx, qword [rbp + 0x38]
call fcn.0071e9b0
jmp 0x71e962
nop
lea rcx, [rbp + 0x20]
mov edx, 3
call fcn.00410990
lea rcx, [rbp + 0x78]
call fcn.004108b0
mov rax, qword [rbp + 0x70]
lea rsp, [rbp + 0x60]
pop rbp
ret
Function at 0x71eb10
Capabilities:
Delete service
Stop service

Disassembly:
push rbp
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0x90], rcx
mov qword [rbp + 0x98], rdx
mov rcx, qword [rbp + 0x98]
call fcn.00410a40
nop
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call sub.advapi32.dll_OpenSCManagerW
mov qword [rbp + 0x70], rax
cmp qword [rbp + 0x70], 0
jne 0x71eb9d
call sub.kernel32.dll_GetLastError
lea rcx, [rbp + 0x40]
mov edx, eax
call fcn.004366a0
mov rcx, qword [rbp + 0x90]
lea rdx, [0x0071ed4c]
mov r8, qword [rbp + 0x40]
call fcn.00412170
jmp 0x71ec9a
nop
mov rcx, qword [rbp + 0x98]
call fcn.00411d40
mov rcx, qword [rbp + 0x70]
mov rdx, rax
mov r8d, 0xf01ff
call sub.advapi32.dll_OpenServiceW
mov qword [rbp + 0x78], rax
cmp qword [rbp + 0x78], 0
jbe 0x71ec68
nop
mov rcx, qword [rbp + 0x78]
mov edx, 1
lea r8, [rbp + 0x54]
call sub.advapi32.dll_ControlService
test eax, eax
setne al
mov byte [rbp + 0x53], al
cmp byte [rbp + 0x53], 0
jne 0x71ec13
call sub.kernel32.dll_GetLastError
lea rcx, [rbp + 0x38]
mov edx, eax
call fcn.004366a0
mov rcx, qword [rbp + 0x90]
lea rdx, [0x0071eda0]
mov r8, qword [rbp + 0x38]
call fcn.00412170
mov rcx, qword [rbp + 0x78]
call sub.advapi32.dll_DeleteService
test eax, eax
je 0x71ec35
mov rcx, qword [rbp + 0x90]
lea rdx, [0x0071eddc]
call fcn.00410ee0
jmp 0x71ec5c
call sub.kernel32.dll_GetLastError
lea rcx, [rbp + 0x30]
mov edx, eax
call fcn.004366a0
mov rcx, qword [rbp + 0x90]
lea rdx, [0x0071ee08]
mov r8, qword [rbp + 0x30]
call fcn.00412170
nop
mov rcx, qword [rbp + 0x78]
call sub.advapi32.dll_CloseServiceHandle
jmp 0x71ec8f
call sub.kernel32.dll_GetLastError
lea rcx, [rbp + 0x28]
mov edx, eax
call fcn.004366a0
mov rcx, qword [rbp + 0x90]
lea rdx, [0x0071ee58]
mov r8, qword [rbp + 0x28]
call fcn.00412170
nop
mov rcx, qword [rbp + 0x70]
call sub.advapi32.dll_CloseServiceHandle
nop
lea rcx, [rbp + 0x28]
mov edx, 4
call fcn.00410990
lea rcx, [rbp + 0x98]
call fcn.004108b0
mov rax, qword [rbp + 0x90]
lea rsp, [rbp + 0x80]
pop rbp
ret
Function at 0x71eea0
Capabilities:
Stop service

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], rdx
mov rcx, qword [rbp + 0x88]
call fcn.00410a40
nop
lea rcx, [0x0071f080]
xor edx, edx
mov r8d, 0xf003f
call sub.advapi32.dll_OpenSCManagerW
mov qword [rbp + 0x60], rax
cmp qword [rbp + 0x60], 0
jne 0x71ef2a
call sub.kernel32.dll_GetLastError
lea rcx, [rbp + 0x30]
mov edx, eax
call fcn.004366a0
mov rcx, qword [rbp + 0x80]
lea rdx, [0x0071f090]
mov r8, qword [rbp + 0x30]
call fcn.00412170
jmp 0x71efe5
nop
mov rcx, qword [rbp + 0x88]
call fcn.00411d40
mov rcx, qword [rbp + 0x60]
mov rdx, rax
mov r8d, 0xf01ff
call sub.advapi32.dll_OpenServiceW
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jbe 0x71efb3
nop
mov rcx, qword [rbp + 0x68]
mov edx, 1
lea r8, [rbp + 0x44]
call sub.advapi32.dll_ControlService
test eax, eax
je 0x71ef80
mov rcx, qword [rbp + 0x80]
lea rdx, [0x0071f0e4]
call fcn.00410ee0
jmp 0x71efa7
call sub.kernel32.dll_GetLastError
lea rcx, [rbp + 0x28]
mov edx, eax
call fcn.004366a0
mov rcx, qword [rbp + 0x80]
lea rdx, [0x0071f10c]
mov r8, qword [rbp + 0x28]
call fcn.00412170
nop
mov rcx, qword [rbp + 0x68]
call sub.advapi32.dll_CloseServiceHandle
jmp 0x71efda
call sub.kernel32.dll_GetLastError
lea rcx, [rbp + 0x20]
mov edx, eax
call fcn.004366a0
mov rcx, qword [rbp + 0x80]
lea rdx, [0x0071f158]
mov r8, qword [rbp + 0x20]
call fcn.00412170
nop
mov rcx, qword [rbp + 0x60]
call sub.advapi32.dll_CloseServiceHandle
nop
lea rcx, [rbp + 0x20]
mov edx, 3
call fcn.00410990
lea rcx, [rbp + 0x88]
call fcn.004108b0
mov rax, qword [rbp + 0x80]
lea rsp, [rbp + 0x70]
pop rbp
ret
Function at 0x71f1a0
Capabilities:
Create service

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x88], 0
nop
mov rax, qword [rbp + 0x70]
mov rcx, qword [rax + 0x88]
call fcn.00411d40
mov rbx, rax
mov rax, qword [rbp + 0x70]
mov rcx, qword [rax + 0x90]
call fcn.00411d40
mov rsi, rax
lea rcx, [rbp + 0x88]
mov edx, 3
lea r8, [0x0071f338]
mov rax, qword [rbp + 0x70]
mov r9, qword [rax + 0x98]
lea rax, [0x0071f338]
mov qword [rsp + 0x20], rax
call fcn.004122a0
mov rcx, qword [rbp + 0x88]
call fcn.00411d40
mov rcx, qword [rbp + 0x70]
mov rcx, qword [rcx + 0x68]
mov rdx, rbx
mov r8, rsi
mov r9d, 0xf003f
mov dword [rsp + 0x20], 0x10
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
call sub.advapi32.dll_CreateServiceW
mov rcx, qword [rbp + 0x70]
mov qword [rcx + 0x60], rax
mov rax, qword [rbp + 0x70]
cmp qword [rax + 0x60], 0
je 0x71f2b7
lea rcx, [0x0071f348]
xor edx, edx
call fcn.007121e0
jmp 0x71f2ec
call sub.kernel32.dll_GetLastError
lea rcx, [rbp + 0x78]
mov edx, eax
call fcn.004366a0
lea rcx, [rbp + 0x80]
lea rdx, [0x0071f374]
mov r8, qword [rbp + 0x78]
call fcn.00412170
mov rcx, qword [rbp + 0x80]
xor edx, edx
call fcn.007121e0
nop
lea rcx, [rbp + 0x78]
mov edx, 3
call fcn.00410990
lea rsp, [rbp + 0x90]
pop rbx
pop rsi
pop rbp
ret

Function at 0x71f3c0
Capabilities:
Create process on windows

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x38], 0
nop
lea rcx, [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax + 0x88]
xor r8, r8
call fcn.00411940
lea rcx, [rbp + 0x38]
lea rdx, [0x0071f474]
mov r8, qword [rbp + 0x28]
call fcn.00411640
mov rcx, qword [rbp + 0x38]
call fcn.00411860
mov rcx, rax
xor edx, edx
call sub.kernel32.dll_WinExec
nop
lea rcx, [rbp + 0x28]
call fcn.00410900
lea rcx, [rbp + 0x38]
call fcn.00410900
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x180001a83
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [section..data]
jne 0x18000135a
rol rcx, 0x10
test cx, 0xffff
jne 0x180001356
repz ret
ror rcx, 0x10
jmp 0x1800019dc
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18000afa0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x18000b098]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180001a61
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18000afa0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180001a83
mov rax, qword [rsp + 0x88]
mov qword [0x18000b098], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18000b038], rax
mov rax, qword [0x18000b098]
mov qword [0x18000af10], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18000b020], rax
mov dword [0x18000af00], 0xc0000409
mov dword [0x18000af04], 1
mov rax, qword [section..data]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18000a008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18000af98], eax
mov ecx, 1
call fcn.180004564
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800072c8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18000af98], 0
jne 0x180001b0a
mov ecx, 1
call fcn.180004564
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x180006570
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1800026ec
xor ebx, ebx
cmp qword [0x18000bed0], rbx
mov rdi, rax
jne 0x180006683
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x18000675a
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000675a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18000bed0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18000bed8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x18000bee0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x18000bef0], rax
test rax, rax
je 0x18000667a
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x18000bee8], rax
jmp 0x18000668a
mov rax, qword [0x18000bee8]
jmp 0x180006691
mov rax, qword [0x18000bee8]
mov r11, qword [0x18000bef0]
cmp rax, rdi
je 0x1800066f8
cmp r11, rdi
je 0x1800066f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x18000bef0]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1800066f8
test rax, rax
je 0x1800066f8
call rsi
test rax, rax
je 0x1800066f2
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1800066f2
test byte [rsp + 0x40], 1
jne 0x1800066f8
bts ebp, 0x15
jmp 0x180006738
mov rcx, qword [0x18000bed8]
cmp rcx, rdi
je 0x180006738
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180006738
call rax
mov rbx, rax
test rax, rax
je 0x180006738
mov rcx, qword [0x18000bee0]
cmp rcx, rdi
je 0x180006738
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180006738
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18000bed0]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18000675a
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x18000675c
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180001340
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140007e6c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140007cff
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140007cff
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140007cff
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140007cff
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140007cff
cmp dword [rcx + 0x84], 0xe
jbe 0x140007cff
cmp dword [rcx + 0xf8], 0
je 0x140007cff
mov ecx, ebx
call fcn.140007da0
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140007b90
cmp dword [rbp + 0x20], 0
je 0x140007d4c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140007d54
int3
xor r8d, r8d
xor edx, edx
jmp 0x140007c98