joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001160
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov rsi, qword [0x140003048]
xor eax, eax
lock cmpxchg qword [rsi], rdi
sete bl
je 0x1400011b9
cmp rdi, rax
je 0x1400011b9
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
nop word [rax + rax]
mov ecx, 0x3e8
call r14
xor eax, eax
lock cmpxchg qword [rsi], rdi
sete bl
je 0x1400011b9
cmp rdi, rax
jne 0x1400011a0
mov rdi, qword [0x140003050]
mov eax, dword [rdi]
cmp eax, 1
jne 0x1400011d3
mov ecx, 0x1f
call dbg._amsg_exit
jmp 0x1400011fa
cmp dword [rdi], 0
je 0x1400011e1
mov byte [0x1400060f8], 1
jmp 0x1400011fa
mov dword [rdi], 1
mov rcx, qword [0x140003068]
mov rdx, qword [0x140003070]
call sym._initterm
mov eax, dword [rdi]
cmp eax, 1
jne 0x14000121a
mov rcx, qword [0x140003058]
mov rdx, qword [0x140003060]
call sym._initterm
mov dword [rdi], 2
test bl, bl
je 0x140001223
xor eax, eax
xchg qword [rsi], rax
mov rax, qword [0x140003010]
mov rax, qword [rax]
test rax, rax
je 0x140001242
xor ecx, ecx
mov edx, 2
xor r8d, r8d
call qword [0x140008008]
call dbg._pei386_runtime_relocator
lea rcx, [dbg._gnu_exception_handler]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [0x140003040]
mov qword [rcx], rax
lea rcx, [dbg.__mingw_invalidParameterHandler]
call sym._set_invalid_parameter_handler
call dbg._fpreset
movsxd rdi, dword [0x1400060e4]
lea rcx, [rdi*8 + 8]
call sym.malloc
mov rsi, rax
test rdi, rdi
jle 0x1400012d2
mov ebx, edi
mov r14, qword [0x1400060e8]
xor r15d, r15d
nop word [rax + rax]
mov rcx, qword [r14 + r15*8]
call sym.strlen
lea rdi, [rax + 1]
mov rcx, rdi
call sym.malloc
mov qword [rsi + r15*8], rax
mov rdx, qword [r14 + r15*8]
mov rcx, rax
mov r8, rdi
call sym.memcpy
inc r15
cmp rbx, r15
jne 0x1400012a0
jmp 0x1400012d4
xor ebx, ebx
mov qword [rsi + rbx*8], 0
mov qword [0x1400060e8], rsi
call dbg.__main
mov rax, qword [0x1400060f0]
mov rcx, qword [0x140003018]
mov rcx, qword [rcx]
mov qword [rcx], rax
mov ecx, dword [0x1400060e4]
mov rdx, qword [0x1400060e8]
mov r8, qword [0x1400060f0]
call dbg.main
mov dword [0x1400060fc], eax
cmp dword [0x1400060dc], 0
je 0x140001344
cmp byte [0x1400060f8], 0
jne 0x140001338
call sym._cexit
mov eax, dword [0x1400060fc]
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, eax
call sym.exit
int3
Function at 0x1400013a0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x34], 0
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x48]
xor eax, eax
mov edx, eax
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rcx, rax
mov rax, qword [rsp + 0x40]
mov qword [rax], rcx
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x140001426
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._n_t____VirtualAllocEx_Failed_With_Error_:__d__n
call dbg.printf
mov dword [rsp + 0x64], 0
jmp 0x140001506
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax]
lea rcx, str._n_i__Allocated_Memory_At_:_0x_p__n
call dbg.printf
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax]
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp eax, 0
je 0x14000147a
mov rax, qword [rsp + 0x38]
cmp rax, qword [rsp + 0x48]
je 0x14000149b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._n____WriteProcessMemory_Failed_With_Error_:__d__n
call dbg.printf
mov dword [rsp + 0x64], 0
jmp 0x140001506
mov rdx, qword [rsp + 0x38]
lea rcx, str._i__Successfully_Written__d_Bytes_n
call dbg.printf
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax]
mov r8, qword [rsp + 0x48]
mov r9d, 0x40
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp eax, 0
jne 0x1400014fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._n_t____VirtualProtectEx_Failed_With_Error_:__d__n
call dbg.printf
mov dword [rsp + 0x64], 0
jmp 0x140001506
mov dword [rsp + 0x64], 1
mov eax, dword [rsp + 0x64]
add rsp, 0x68
ret
Function at 0x140001510
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rdi
sub rsp, 0x470
mov qword [rsp + 0x400], rcx
mov qword [rsp + 0x3f8], rdx
mov qword [rsp + 0x3f0], r8
mov qword [rsp + 0x3e8], r9
lea rcx, [rsp + 0x68]
xor edx, edx
mov r8d, 0x68
call sym.memset
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x18
call sym.memset
lea rax, [rsp + 0x68]
mov qword [rsp + 0x438], rax
mov qword [rsp + 0x430], 0x68
mov rax, qword [rsp + 0x438]
mov qword [rsp + 0x428], rax
mov rcx, qword [rsp + 0x428]
mov rax, qword [rsp + 0x430]
mov qword [rsp + 0x450], rcx
mov byte [rsp + 0x44f], 0
mov qword [rsp + 0x440], rax
mov rdi, qword [rsp + 0x450]
mov rcx, qword [rsp + 0x440]
mov al, byte [rsp + 0x44f]
rep stosb byte [rdi], al
mov qword [rsp + 0x450], rdi
mov qword [rsp + 0x440], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x420], rax
mov qword [rsp + 0x418], 0x18
mov rax, qword [rsp + 0x420]
mov qword [rsp + 0x410], rax
mov rcx, qword [rsp + 0x410]
mov rax, qword [rsp + 0x418]
mov qword [rsp + 0x468], rcx
mov byte [rsp + 0x467], 0
mov qword [rsp + 0x458], rax
mov rdi, qword [rsp + 0x468]
mov rcx, qword [rsp + 0x458]
mov al, byte [rsp + 0x467]
rep stosb byte [rdi], al
mov qword [rsp + 0x468], rdi
mov qword [rsp + 0x458], rcx
mov dword [rsp + 0x68], 0x68
lea rdx, [rsp + 0xd0]
lea rcx, str.WINDIR
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, 0
jne 0x1400016a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetEnvironmentVariableA_Failed_With_Error_:__d__n
call dbg.printf
mov dword [rsp + 0x40c], 0
jmp 0x1400017e3
lea rcx, [rsp + 0x1e0]
lea r8, [rsp + 0xd0]
mov r9, qword [rsp + 0x400]
lea rdx, str._sSystem32_s
call dbg.sprintf
lea rdx, [rsp + 0x1e0]
lea rcx, str._n_i__Running_:___s__...
call dbg.printf
lea rdx, [rsp + 0x1e0]
xor eax, eax
mov r9d, eax
xor eax, eax
lea r10, [rsp + 0x68]
lea rax, [rsp + 0x50]
mov rcx, r9
mov r8, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, 0
jne 0x140001756
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateProcessA_Failed_with_Error_:__d__n
call dbg.printf
mov dword [rsp + 0x40c], 0
jmp 0x1400017e3
lea rcx, str.___DONE__n
call dbg.printf
mov ecx, dword [rsp + 0x60]
mov rax, qword [rsp + 0x3f8]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x3f0]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x3e8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x3f8]
mov eax, dword [rax]
cmp rax, 0
je 0x1400017d8
mov rax, qword [rsp + 0x3f0]
cmp qword [rax], 0
je 0x1400017d8
mov rax, qword [rsp + 0x3e8]
cmp qword [rax], 0
je 0x1400017d8
mov dword [rsp + 0x40c], 1
jmp 0x1400017e3
mov dword [rsp + 0x40c], 0
mov eax, dword [rsp + 0x40c]
add rsp, 0x470
pop rdi
ret
Function at 0x140002050
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call sym.__acrt_iob_func
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sym.fwrite
mov ecx, 2
call sym.__acrt_iob_func
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call dbg.vfprintf
call sym.abort
int3

Function at 0x1400028d0
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
xor edi, edi
cmp rax, 8
ja 0x14000294f
mov rax, qword [0x140003008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14000294f
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14000294d
add rax, rcx
movzx ecx, word [rax + 0x18]
cmp ecx, 0x20b
jne 0x14000294d
movzx ebx, word [rax + 6]
test ebx, ebx
je 0x14000294d
movzx ecx, word [rax + 0x14]
lea rdi, [rcx + rax]
add rdi, 0x18
nop dword [rax]
mov r8d, 8
mov rcx, rdi
mov rdx, rsi
call sym.strncmp
test eax, eax
je 0x14000294f
add rdi, 0x28
dec ebx
jne 0x140002930
xor edi, edi
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x140002960
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x140003008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x1400029cc
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x1400029cc
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x1400029cc
movzx edx, word [rax + 6]
test edx, edx
je 0x1400029cc
sub rcx, qword [0x140003008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x1400029b8
add rax, 0x28
dec edx
je 0x1400029cc
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x1400029b0
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x1400029b0
jmp 0x1400029ce
xor eax, eax
ret

Function at 0x1400029d0
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x140003008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002a05
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002a05
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002a05
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x140002a80
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140003008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140002aac
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140002aac
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x140002aae
xor eax, eax
ret
Function at 0x140002b40
Capabilities:
Parse pe header

Disassembly:
push rsi
mov rdx, qword [0x140003008]
movzx eax, word [rdx]
cmp eax, 0x5a4d
jne 0x140002bdd
movsxd rax, dword [rdx + 0x3c]
cmp dword [rdx + rax], 0x4550
jne 0x140002bdd
add rax, rdx
movzx r8d, word [rax + 0x18]
cmp r8d, 0x20b
jne 0x140002bdd
mov r8d, dword [rax + 0x90]
test r8, r8
je 0x140002bdd
movzx r9d, word [rax + 6]
test r9, r9
je 0x140002bdd
movzx r10d, word [rax + 0x14]
shl r9, 3
lea r9, [r9 + r9*4]
add r10, rax
add r10, 0x24
xor eax, eax
xor r11d, r11d
jmp 0x140002bb9
add r11, 0x28
cmp r9d, r11d
je 0x140002bdf
mov esi, dword [r10 + r11]
cmp esi, r8d
ja 0x140002bb0
add esi, dword [r10 + r11 - 4]
cmp esi, r8d
jbe 0x140002bb0
add rdx, r8
add rdx, 0xc
xor eax, eax
cmp dword [rdx - 8], 0
jne 0x140002c01
jmp 0x140002bfc
xor eax, eax
pop rsi
ret
dec ecx
add rdx, 0x14
cmp dword [rdx - 8], 0
jne 0x140002c01
cmp dword [rdx], 0
je 0x140002bdf
test ecx, ecx
jg 0x140002bf0
mov eax, dword [rdx]
add rax, qword [0x140003008]
jmp 0x140002bdf
Function at 0x401120
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x401160
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
test r8, r8
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x30], r12
mov rsi, r8
mov rbp, rdx
mov r12, rcx
jne 0x40118c
mov ecx, 0x80004005
call fcn.00401020
int3
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x58], rdi
xor edi, edi
mov rbx, r8
nop
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 1
lea rbx, [rbx + rax*2]
lea edi, [rdi + rax*2]
jne 0x4011a0
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
add rsp, 0x38
ret
Function at 0x401740
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov r11, rsp
sub rsp, 0x288
mov rax, qword [0x006443a8]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 - 8], rsi
mov qword [r11 - 0x10], rdi
mov rdi, rcx
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
xor ebp, ebp
mov r9d, 0x2001f
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov ebx, eax
jne 0x40187f
mov rcx, qword [rsp + 0x40]
mov ebx, ebp
test rcx, rcx
je 0x4017b8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
test ebx, ebx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x40], rcx
jne 0x401884
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x48], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x401852
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.00401740
test eax, eax
mov ebx, eax
jne 0x401875
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x48], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x401801
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x401867
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
mov rcx, qword [rdi]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jmp 0x401887
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x40188f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x278]
mov rsi, qword [rsp + 0x280]
mov rbp, qword [rsp + 0x2a8]
mov eax, ebx
mov rbx, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.00568fb0
add rsp, 0x288
ret
Function at 0x404d40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
sub rsp, 0x4b8
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax - 8], rbx
mov qword [rax - 0x10], rsi
mov qword [rax - 0x18], rdi
mov qword [rax - 0x20], r12
mov qword [rax - 0x28], r13
mov rax, qword [0x006443a8]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r13, r9
mov r12, r8
mov rdi, rdx
mov rbx, rcx
call qword [0x006436c0]
xor r11d, r11d
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x70], r11
xor edx, edx
lea r8d, [r11 + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x404dca
call fcn.004010f0
mov ebx, eax
jmp 0x404f13
mov r8, r13
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x404ded
call fcn.004010f0
mov ebx, eax
jmp 0x404f09
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x404e12
call fcn.004010f0
mov ebx, eax
jmp 0x404f09
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
add eax, 1
cmp eax, edi
jae 0x404e4c
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x404e42
lea rcx, [rsp + 0x70]
call fcn.00401660
nop
mov eax, 0x8007000e
jmp 0x404f2c
mov ecx, eax
test eax, eax
je 0x404e8c
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x404e82
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x404e8c
lea rcx, [rsp + 0x70]
call fcn.00401670
mov rbx, qword [rsp + 0x70]
jmp 0x404e96
mov ecx, 0x80070057
call fcn.00401020
lea rbx, [rsp + 0x78]
mov qword [rsp + 0x70], rbx
jmp 0x404eab
test rbx, rbx
jne 0x404eb7
mov ebx, 0x8007000e
jmp 0x404f09
call qword [0x006436c0]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
mov r9d, edi
mov r8, r12
xor edx, edx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x404ee3
call fcn.004010f0
mov ebx, eax
jmp 0x404f09
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], 0
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.004040d0
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x404f2a
lea rcx, [rsp + 0x70]
call fcn.00401660
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.00568fb0
mov rbx, qword [rsp + 0x4b0]
mov rsi, qword [rsp + 0x4a8]
mov rdi, qword [rsp + 0x4a0]
mov r12, qword [rsp + 0x498]
mov r13, qword [rsp + 0x490]
add rsp, 0x4b8
ret
Function at 0x41ec00
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
sub rsp, 0x78
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov rbx, rdx
mov rbp, rcx
mov dword [rsp + 0x28], 0
cmp qword [rdx + 0x20], 8
jb 0x41ec42
lea rdi, [rdx + 8]
mov rcx, qword [rdi]
jmp 0x41ec49
lea rdi, [rdx + 8]
mov rcx, rdi
lea rdx, [rsp + 0x3c]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov r12d, eax
test eax, eax
jne 0x41ec76
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rdx, [0x0063ae50]
lea rcx, [rsp + 0x28]
call fcn.00568cd0
int3
mov byte [rsp + 0x20], 0
mov rdx, r12
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.0041e050
nop
mov rsi, qword [rsp + 0x50]
test rsi, rsi
je 0x41eca2
mov rax, qword [rsp + 0x58]
sub rax, rsi
jne 0x41eca7
call fcn.0056a700
cmp qword [rbx + 0x20], 8
jb 0x41ecb1
mov rdi, qword [rdi]
mov r9, rsi
mov r8d, r12d
xor edx, edx
mov rcx, rdi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x41ece1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rdx, [0x0063ae50]
lea rcx, [rsp + 0x28]
call fcn.00568cd0
int3
mov qword [rsp + 0x30], 0
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x30]
lea rdx, str.StringFileInfo040904B0FileVersion
mov rcx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x41ed23
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rdx, [0x0063ae50]
lea rcx, [rsp + 0x28]
call fcn.00568cd0
int3
mov rdx, qword [rsp + 0x30]
mov qword [rbp + 0x20], 7
mov qword [rbp + 0x18], 0
mov word [rbp + 8], 0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbp
call fcn.00404ad0
nop
test rsi, rsi
je 0x41ed6a
mov rcx, rsi
call fcn.00568830
mov rax, rbp
mov rbx, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov r12, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x421380
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
sub rsp, 0x58
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rbp, rcx
mov dword [rsp + 0x20], 0
mov word [rax - 0x38], 0
lea r8, [rax - 0x38]
mov edx, 0x400
lea rcx, [rax - 0x28]
call fcn.0040e4d0
nop
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
test rbx, rbx
jne 0x4213d7
xor esi, esi
jmp 0x4213e2
mov rsi, rdi
sub rsi, rbx
sar rsi, 1
jne 0x4213e7
call fcn.0056a700
mov edx, esi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, eax
test rbx, rbx
je 0x421407
mov rax, rdi
sub rax, rbx
sar rax, 1
cmp rsi, rax
jb 0x42140c
call fcn.0056a700
mov word [rbx + rsi*2], 0
test rbx, rbx
je 0x42141f
sub rdi, rbx
sar rdi, 1
jne 0x421424
call fcn.0056a700
mov qword [rbp + 0x20], 7
mov qword [rbp + 0x18], 0
mov word [rbp + 8], 0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
mov rcx, rbp
call fcn.00404ad0
nop
test rbx, rbx
je 0x42146e
mov rcx, rbx
call fcn.00568830
mov rax, rbp
jmp 0x421471
mov rax, rbp
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x58
ret
Function at 0x43b380
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x270
mov rax, qword [0x006443a8]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r9, rdx
mov edx, 0x100
mov rbx, rcx
lea rax, [rsp + 0x290]
lea rcx, [rsp + 0x60]
lea r8d, [rdx - 1]
mov qword [rsp + 0x20], rax
call fcn.0056b300
cmp dword [rbx + 0x28c], 0
lea rax, [rsp + 0x60]
mov word [rsp + 0x25e], 0
mov qword [rsp + 0x50], rax
jne 0x43b3f6
lea rcx, [rsp + 0x60]
call fcn.0056aed0
lea rdx, [rbx + 0x68]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
mov rbx, rax
je 0x43b447
xor ecx, ecx
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], 1
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rbx
mov dx, 4
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.00568fb0
add rsp, 0x270
pop rbx
ret
Function at 0x43c580
Capabilities:
Modify service

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x40], rbx
mov rbx, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov qword [rsp + 0x58], rdi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp qword [rbx + 0x20], 8
mov rdi, rax
jb 0x43c5b6
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x20], rcx
jmp 0x43c5bf
lea rax, [rbx + 8]
mov qword [rsp + 0x20], rax
mov ecx, 8
mov qword [rsp + 0x30], r12
call fcn.00568bc0
mov ecx, reloc.OLEAUT32.dll_SafeArrayAllocDescriptorEx
mov r12, rax
call fcn.00568bc0
mov rbx, rax
xor eax, eax
test rdi, rdi
mov qword [rbx], rax
mov qword [rbx + 0x18], rax
mov dword [r12], 1
mov dword [r12 + 4], 0xea60
mov dword [rbx], eax
lea rax, [0x005b13b8]
mov dword [rbx + 0x18], 1
mov qword [rbx + 0x20], r12
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
je 0x43c6ab
mov rcx, rdi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
test rax, rax
mov rsi, rax
je 0x43c69d
lea rdx, [0x006461d8]
mov r8d, 0xf01ff
mov rcx, rdi
mov qword [rsp + 0x48], rbp
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rbp, rax
je 0x43c698
mov r8, rbx
mov edx, 2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x50]
mov rcx, r12
call fcn.00568c90
mov rcx, rbx
call fcn.00568c90
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret