joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140130a9c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r15, rcx
test r8, r8
jne 0x140130acd
call fcn.1400db734
mov rdi, qword [rax + 0x18]
lea r8, [0x140383418]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
jne 0x140130aec
xor eax, eax
jmp 0x140130b38
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x140130ae8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x140130b2d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r14
mov rcx, r15
mov r8d, eax
call fcn.140130b54
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x140133988
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14073b538]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140736d30]
test eax, eax
je 0x1401339d3
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140736d30]
test eax, eax
jne 0x1401339dc
call fcn.1400da564
test eax, eax
je 0x1401339f8
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1407284b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140133a00
xor eax, eax
jmp 0x140133a65
test rbx, rbx
jne 0x140133a20
lea rcx, str.ImageList_GetImageCount
call fcn.1400f3b10
mov rbx, rax
test rax, rax
je 0x140133a33
mov qword [0x14073b538], rax
mov rcx, rbx
call fcn.1402815a8
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140133a48
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140133a4a
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140133a63
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1401c23f0
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1401c25e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x20]
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
test eax, eax
jne 0x1401c2622
mov ecx, dword [rsp + 0x58]
sub ecx, 4
neg ecx
sbb eax, eax
and eax, 0xd
test eax, eax
sete dl
mov eax, edx
add rsp, 0x38
ret

Function at 0x1401c2ad0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x1401c2ba2
test rbx, rbx
je 0x1401c2ba8
test r9, r9
je 0x1401c2bae
and qword [r8], 0
xor r8d, r8d
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rax - 0x10], r9
lea r9, [rax + 0x10]
and qword [rax - 0x18], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401c2b8b
cmp dword [rsp + 0x48], 3
jne 0x1401c2b8b
test eax, eax
jne 0x1401c2b8b
cmp dword [rdi], eax
je 0x1401c2b8b
mov ecx, dword [rdi]
call fcn.1400d7300
mov qword [rbx], rax
lea r9, [rsp + 0x48]
mov rcx, qword [rbp + 8]
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401c2b7f
cmp dword [rsp + 0x48], 3
jne 0x1401c2b7f
test eax, eax
jne 0x1401c2b7f
mov eax, 1
jmp 0x1401c2b8d
mov rcx, qword [rbx]
call fcn.1400d72f0
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.1400da218
int3
call fcn.1400da218
int3
call fcn.1400da218
int3

Function at 0x1401c2f00
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1401c2f11
xor eax, eax
jmp 0x1401c2f3f
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1401c2f50
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1401c2f61
xor eax, eax
jmp 0x1401c2f85
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov r9d, 3
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x1402250e4
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14073f2b8]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140736d30]
test eax, eax
je 0x14022512f
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140736d30]
test eax, eax
jne 0x140225138
call fcn.1400da564
test eax, eax
je 0x140225154
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1407284b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14022515c
xor eax, eax
jmp 0x1402251c1
test rbx, rbx
jne 0x14022517c
lea rcx, str.ChooseColorW
call fcn.1400f6344
mov rbx, rax
test rax, rax
je 0x14022518f
mov qword [0x14073f2b8], rax
mov rcx, rbx
call fcn.1402815a8
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1402251a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1402251a6
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1402251bf
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140229e80
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14073f408]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140736d30]
test eax, eax
je 0x140229ecb
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140736d30]
test eax, eax
jne 0x140229ed4
call fcn.1400da564
test eax, eax
je 0x140229ef0
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1407284b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140229ef8
xor eax, eax
jmp 0x140229f5d
test rbx, rbx
jne 0x140229f18
lea rcx, str.PrintDlgW
call fcn.1400f6344
mov rbx, rax
test rax, rax
je 0x140229f2b
mov qword [0x14073f408], rax
mov rcx, rbx
call fcn.1402815a8
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140229f40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140229f42
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140229f5b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1402a2100
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1402a1ed4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1402a1ed4
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1402a1ed4
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1402a1ed4
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1402a1ed4
cmp dword [rcx + 0x84], 0xe
jbe 0x1402a1ed4
cmp dword [rcx + 0xf8], esi
je 0x1402a1ed4
mov ecx, r14d
call fcn.1402a201c
mov ecx, 2
call fcn.1402a3c38
nop
cmp byte [0x140741b20], 0
jne 0x1402a1f9e
mov r15d, 1
mov eax, r15d
xchg dword [0x140741b14], eax
test ebx, ebx
jne 0x1402a1f47
mov rdi, qword [0x140729900]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140741b18]
cmp rcx, rax
je 0x1402a1f3e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140009df0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140741b30]
jmp 0x1402a1f53
cmp ebx, r15d
jne 0x1402a1f59
lea rcx, [0x140741b48]
call fcn.1402a3974
nop
test ebx, ebx
jne 0x1402a1f70
lea rdx, [0x1403643a8]
lea rcx, [0x140364388]
call fcn.1402a1d94
lea rdx, [0x1403643b8]
lea rcx, [0x1403643b0]
call fcn.1402a1d94
movzx eax, byte [0x140741b20]
test esi, esi
cmove eax, r15d
mov byte [0x140741b20], al
jmp 0x1402a1f9e
mov ecx, 2
call fcn.1402a3c98
test esi, esi
jne 0x1402a1fb5
mov ecx, r14d
call fcn.1402a1fd0
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1402a1e64
Function at 0x1402af4f4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1402af35a
call fcn.14029c0d8
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayAccessData
call fcn.140288a34
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1402af33c
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1402af33c
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x1402af38c
lock or dword [rax + 0x14], 0x10
jmp 0x1402af33c
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1402af3a9
mov rcx, qword [rbp + 0x20]
call fcn.1402b4894
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x1402af3be
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x1402af3c4
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.14029fc50
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1402aebe0
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x1402af417
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x1402af33c
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1402af483
mov rcx, qword [rbp + 0x20]
call fcn.14029fc50
cmp eax, 0xffffffff
je 0x1402af46a
mov rcx, qword [rbp + 0x20]
call fcn.14029fc50
cmp eax, 0xfffffffe
je 0x1402af46a
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.14029fc50
movsxd rdi, eax
lea r15, [0x140741db0]
mov rcx, rbx
sar rdi, 6
call fcn.14029fc50
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x1402af471
lea rax, [0x140729d30]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1402af483
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x1402af4b9
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1402af4b5
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1402af4b5
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x1402af4d7
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x1402af4e2
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x1402af341
jmp 0x1402af308
Function at 0x1402afae8
Capabilities:
Create thread
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r8d
mov r14, rdx
mov rbx, rcx
call fcn.1402ab36c
mov bpl, al
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor edi, edi
test eax, eax
je 0x1402afb3b
test rbx, rbx
je 0x1402afb2c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bpl, bpl
je 0x1402afb3b
mov edi, 4
jmp 0x1402afbe4
call fcn.1402ab144
test al, al
jne 0x1402afb58
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb edi, edi
neg edi
add edi, 3
jmp 0x1402afbe4
test bpl, bpl
je 0x1402afbbb
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
lea r8, [0x1402afac0]
mov dword [rsp + 0x20], edi
xor edx, edx
mov qword [rsp + 0x30], r14
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1402afbe4
xor r8d, r8d
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rcx, rbx
test eax, eax
je 0x1402afbb5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1402afbe4
mov edi, dword [rsp + 0x44]
jmp 0x1402afbad
call fcn.1402ab298
test al, al
jne 0x1402afbcc
bts esi, 0x15
xor ecx, ecx
jmp 0x1402afbd4
call fcn.1402ab1d0
mov rcx, rax
mov r9d, esi
mov r8, r14
mov rdx, rbx
call fcn.1402aafe0
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret
Function at 0x1402b7b60
Capabilities:
Create pipe

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x90]
mov r10d, r9d
mov r9d, dword [rsp + 0x70]
mov r11d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rdx
mov eax, dword [rsp + 0x88]
mov r8d, r10d
mov dword [rsp + 0x30], eax
mov edx, r11d
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
add rsp, 0x40
pop rbx
ret

Function at 0x1402b7be0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [rsp + 0xb0]
mov r10, r9
mov r9, qword [rsp + 0x80]
mov r11, r8
mov qword [rsp + 0x48], rax
mov rcx, rdx
mov rax, qword [rsp + 0xa8]
mov r8, r10
mov qword [rsp + 0x40], rax
mov rdx, r11
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
add rsp, 0x50
pop rbx
ret

Function at 0x1402b7c60
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x70]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov qword [rsp + 0x28], rax
mov rcx, rdx
mov eax, dword [rsp + 0x68]
mov r8, r10
mov rdx, r11
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x30
pop rbx
ret

Function at 0x1402b8600
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x70]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rdx
mov eax, dword [rsp + 0x68]
mov r8, r10
mov edx, r11d
mov dword [rsp + 0x20], eax
call fcn.14029caa0
add rsp, 0x30
pop rbx
ret

Function at 0x1402b8780
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rsp + 0x70]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov dword [rsp + 0x28], eax
mov rcx, rdx
mov rax, qword [rsp + 0x68]
mov r8, r10
mov rdx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
add rsp, 0x30
pop rbx
ret

Function at 0x1402b88e0
Capabilities:
Modify service

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [rsp + 0xc8]
mov r10d, r9d
mov r9d, dword [rsp + 0x90]
mov r11d, r8d
mov qword [rsp + 0x50], rax
mov rcx, rdx
mov rax, qword [rsp + 0xc0]
mov r8d, r10d
mov qword [rsp + 0x48], rax
mov edx, r11d
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
add rsp, 0x60
pop rbx
ret
Function at 0x1402b89b0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [rsp + 0xc8]
mov r10, r9
mov r9, qword [rsp + 0x90]
mov r11, r8
mov qword [rsp + 0x50], rax
mov rcx, rdx
mov rax, qword [rsp + 0xc0]
mov r8, r10
mov qword [rsp + 0x48], rax
mov rdx, r11
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
add rsp, 0x60
pop rbx
ret

Function at 0x1402b8c10
Capabilities:
Query or enumerate registry key

Disassembly:
sub rsp, 0x48
xor ecx, ecx
mov rax, r9
mov r9, qword [rsp + 0x70]
mov r10d, r8d
mov qword [rsp + 0x38], rcx
mov r11, rdx
mov qword [rsp + 0x30], rcx
mov r8, rax
mov qword [rsp + 0x28], rcx
mov edx, r10d
mov qword [rsp + 0x20], rcx
mov rcx, r11
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add rsp, 0x48
ret

Function at 0x1402b8e20
Capabilities:
Get session user name

Disassembly:
sub rsp, 0x28
mov rax, r8
mov ecx, edx
mov rdx, rax
mov r8, r9
call sub.Secur32.dll_GetUserNameExW
movzx eax, al
add rsp, 0x28
ret
Function at 0x14032fbd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x108
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x140729900]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov r15, r9
mov ebx, r8d
mov r14, rdx
mov rbp, rcx
mov byte [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_DispGetParam
lea r9, [0x140413fd0]
lea r8, [0x140744448]
mov rdx, qword [0x140743a90]
lea rcx, [rsp + 0x50]
call fcn.14000a880
nop
movzx edx, bx
lea r8, str.EMFDATA
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14032fd15
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x14032fd06
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14032fcd4
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea rcx, [0x14041bfe0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r15
mov r9d, eax
mov r8, rbx
mov rdx, r14
mov rcx, rbp
call fcn.14032fd70
mov dword [rsp + 0x58], eax
test eax, eax
jns 0x14032fcf7
mov dword [rsp + 0x20], eax
lea r9, str.PrintEMFPage:_SendEMF_failed_with_HR__0x_08X
mov edx, 0x80
lea r8d, [rdx - 0x53]
lea rcx, [rsp + 0x50]
call fcn.14000acc0
jmp 0x14032fcf7
lea r9, str.PrintEMFPage:_Failed_to_lock_EMF_page_resource
mov edx, 0x80
lea r8d, [rdx - 0x4e]
lea rcx, [rsp + 0x50]
call fcn.14000acc0
mov ebx, 0x80004005
mov dword [rsp + 0x58], ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov ebx, dword [rsp + 0x58]
jmp 0x14032fd3a
lea r9, str.PrintEMFPage:_Failed_to_load_EMF_page_resource
mov r8d, 0x3a
jmp 0x14032fd22
lea r9, str.PrintEMFPage:_Failed_to_find_EMF_page_resource
mov r8d, 0x40
mov edx, 0x80
lea rcx, [rsp + 0x50]
call fcn.14000acc0
mov ebx, 0x80004005
mov dword [rsp + 0x58], ebx
lea rcx, [rsp + 0x50]
call fcn.14000a9d0
mov eax, ebx
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1402812e0
add rsp, 0x108
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140335450
Capabilities:
Send icmp echo request

Disassembly:
push rbx
sub rsp, 0x40
mov eax, dword [rsp + 0x90]
mov r10, r9
movzx r9d, word [rsp + 0x70]
mov r11d, r8d
mov dword [rsp + 0x38], eax
mov rcx, rdx
mov eax, dword [rsp + 0x88]
mov r8, r10
mov dword [rsp + 0x30], eax
mov edx, r11d
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call sub.IPHLPAPI.DLL_IcmpSendEcho
add rsp, 0x40
pop rbx
ret

Function at 0x1403355c0
Capabilities:
Connect socket

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x88]
mov r10d, r9d
mov r9, qword [rsp + 0x70]
mov r11, r8
mov qword [rsp + 0x30], rax
mov rcx, rdx
mov rax, qword [rsp + 0x80]
mov r8d, r10d
mov qword [rsp + 0x28], rax
mov rdx, r11
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSAConnect]
add rsp, 0x40
pop rbx
ret
Function at 0x140335ac0
Capabilities:
Encrypt data using dpapi

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x88]
mov r10, r9
mov r9, qword [rsp + 0x70]
mov r11, r8
mov qword [rsp + 0x30], rax
mov rcx, rdx
mov eax, dword [rsp + 0x80]
mov r8, r10
mov dword [rsp + 0x28], eax
mov rdx, r11
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
add rsp, 0x40
pop rbx
ret