joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004d328
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1800d7110]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.18002e9ac
xor ebx, ebx
cmp qword [0x1800f02b0], rbx
mov rdi, rax
jne 0x18004d43b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x18004d512
lea rdx, [0x1800af078]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18004d512
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1800f02b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1800f02b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1800af030]
mov rcx, rsi
mov qword [0x1800f02c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1800f02d0], rax
test rax, rax
je 0x18004d432
lea rdx, [0x1800af018]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1800f02c8], rax
jmp 0x18004d442
mov rax, qword [0x1800f02c8]
jmp 0x18004d449
mov rax, qword [0x1800f02c8]
mov r11, qword [0x1800f02d0]
cmp rax, rdi
je 0x18004d4b0
cmp r11, rdi
je 0x18004d4b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1800f02d0]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x18004d4b0
test rax, rax
je 0x18004d4b0
call rsi
test rax, rax
je 0x18004d4aa
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18004d4aa
test byte [rsp + 0x40], 1
jne 0x18004d4b0
bts ebp, 0x15
jmp 0x18004d4f0
mov rcx, qword [0x1800f02b8]
cmp rcx, rdi
je 0x18004d4f0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18004d4f0
call rax
mov rbx, rax
test rax, rax
je 0x18004d4f0
mov rcx, qword [0x1800f02c0]
cmp rcx, rdi
je 0x18004d4f0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18004d4f0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1800f02b0]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18004d512
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x18004d514
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180029600
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180055370
Capabilities:
Create process on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x2f0
mov rax, qword [0x1800d7110]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rdi, qword [rsp + 0x350]
mov rbp, rcx
mov r12, r8
mov r13, rdx
xor r14d, r14d
lea rcx, [rsp + 0xe1]
mov ebx, r14d
mov r8d, 0x1f3
xor edx, edx
mov byte [rsp + 0xe0], bl
mov rsi, r9
call fcn.180029630
test r12, r12
je 0x1800553f5
lea r8, [rsp + 0xe0]
mov r9d, 0x1f3
or edx, 0xffffffff
mov rcx, r12
mov dword [rsp + 0x20], r14d
call fcn.180016650
lea rbx, [rsp + 0xe0]
xor edx, edx
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x70], 0x68
lea r8d, [rdx + 0x60]
call fcn.180029630
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov rdx, rbx
mov rcx, r13
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov qword [rsp + 0x50], r14
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, eax
test eax, eax
je 0x180055496
test rsi, rsi
je 0x180055469
mov ecx, dword [rsp + 0x60]
mov dword [rsi], ecx
mov rcx, qword [rsp + 0x50]
test rdi, rdi
je 0x180055483
mov qword [rdi], rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18005549f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18005549f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 8], eax
mov eax, ebx
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.180029600
add rsp, 0x2f0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800564b0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x808]
sub rsp, 0x908
mov rax, qword [0x1800d7110]
xor rax, rsp
mov qword [rbp + 0x7f0], rax
mov rsi, qword [rbp + 0x870]
mov rdi, qword [rbp + 0x878]
xor eax, eax
mov rbx, r8
mov r15, rcx
mov qword [rsp + 0x68], rdx
lea r8d, [rax + 0x60]
lea rcx, [rsp + 0x78]
xor edx, edx
mov r12, r9
mov r14d, eax
mov r13d, eax
mov dword [rsp + 0x70], 0x68
call fcn.180029630
xor ecx, ecx
xor eax, eax
mov qword [rsp + 0x50], rcx
mov word [rbp + 0x1f0], cx
lea rcx, [rbp + 0x1f2]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.180029630
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x180056575
lea r8, [rbp + 0x1f0]
mov r9d, 0x104
or edx, 0xffffffff
mov rcx, rax
mov dword [rsp + 0x20], r13d
call fcn.1800163a0
lea r14, [rbp + 0x1f0]
xor eax, eax
lea rcx, [rbp + 0x402]
xor edx, edx
mov r8d, 0x3e6
mov word [rbp + 0x400], ax
call fcn.180029630
test rbx, rbx
je 0x1800565bc
xor eax, eax
lea r8, [rbp + 0x400]
mov r9d, 0x1f4
or edx, 0xffffffff
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.180016630
lea r13, [rbp + 0x400]
lea rcx, [rbp - 0x1e]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rbp - 0x20], bx
call fcn.180029630
test r12, r12
je 0x1800565f9
lea r8, [rbp - 0x20]
mov r9d, 0x104
or edx, 0xffffffff
mov rcx, r12
mov dword [rsp + 0x20], ebx
call fcn.180016630
lea r11, [rbp - 0x20]
mov qword [rbp - 0x80], r11
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rdx, r13
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov rcx, r14
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
test eax, eax
je 0x18005666f
test rsi, rsi
je 0x180056642
mov ecx, dword [rsp + 0x60]
mov dword [rsi], ecx
mov rcx, qword [rsp + 0x50]
test rdi, rdi
je 0x18005665c
mov qword [rdi], rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180056679
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180056679
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r15 + 8], eax
mov eax, ebx
mov rcx, qword [rbp + 0x7f0]
xor rcx, rsp
call fcn.180029600
add rsp, 0x908
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1800577c0
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x1f90
call fcn.18002cb70
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1800d7110]
xor rax, rsp
mov qword [rsp + 0x1f80], rax
mov esi, r9d
mov r14, r8
mov r13, rdx
mov rdi, rcx
or r8d, 0xffffffff
xor edx, edx
mov rcx, r13
call fcn.1800186e0
or r8d, 0xffffffff
xor edx, edx
mov rcx, r14
call fcn.180014f90
call fcn.1800687e0
mov rbx, qword [0x1800f0cc8]
test rbx, rbx
je 0x18005792f
cmp esi, 0xffffffff
jne 0x18005784f
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov rcx, rdi
call qword [rbx + 0x70]
mov esi, eax
mov rbx, qword [0x1800f0cc8]
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x40], ebp
xor edx, edx
mov r8d, 0x1f3c
lea rcx, [rsp + 0x44]
call fcn.180029630
lea r8, [rsp + 0x20]
mov edx, 0x1f40
lea rcx, [rsp + 0x40]
call rbx
test eax, eax
je 0x180057926
mov eax, dword [rsp + 0x20]
shr eax, 2
test eax, eax
je 0x18005791f
lea rbx, [rsp + 0x40]
mov r12d, eax
nop dword [rax + rax]
cmp esi, 0xfffffffe
je 0x1800578b4
mov rax, qword [rdi]
mov edx, dword [rbx]
mov rcx, rdi
call qword [rax + 0x70]
cmp esi, eax
jne 0x180057916
test ebp, ebp
jne 0x1800578d5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea r8d, [rbp + 1]
lea rdx, str.SeDebugPrivilege
call fcn.180063c20
mov ebp, 1
mov r8d, dword [rbx]
mov edx, dword [r13 + 8]
mov rcx, r13
call fcn.180018940
mov r11, qword [rdi]
mov r8d, dword [rbx]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call qword [r11 + 0x80]
nop
lea r8, [rsp + 0x28]
mov edx, dword [r14 + 8]
mov rcx, r14
call fcn.1800151e0
nop
lea rcx, [rsp + 0x28]
call fcn.18000fef0
add rbx, 4
dec r12
jne 0x1800578a0
mov eax, 1
jmp 0x180057931
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 8], eax
xor eax, eax
mov rcx, qword [rsp + 0x1f80]
xor rcx, rsp
call fcn.180029600
add rsp, 0x1f90
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180058720
Capabilities:
Acquire debug privileges

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x210
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x250], rbx
mov rax, qword [0x1800d7110]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov r12, r9
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rcx, rdx
call fcn.1800561b0
lea rcx, [rsp + 0x28]
call fcn.180056e00
nop
xor r9d, r9d
mov r8d, ebx
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.180058190
test eax, eax
je 0x1800588b3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
mov r8d, 1
lea rdx, str.SeDebugPrivilege
call fcn.180063c20
xor r13d, r13d
mov ebx, r13d
lea rcx, [rsp + 0x28]
call fcn.180056e10
mov ebp, eax
test eax, eax
jle 0x180058896
mov dword [rsp + 0x50], r13d
xor edx, edx
mov r8d, 0x1a4
lea rcx, [rsp + 0x54]
call fcn.180029630
mov edx, ebx
lea rcx, [rsp + 0x28]
call fcn.180057ed0
mov rdx, rax
lea rcx, [rsp + 0x50]
mov r8d, 0xa0
call fcn.18002a1e0
mov r11, qword [rdi]
mov r8d, dword [rsp + 0x50]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [r11 + 0x80]
nop
mov rax, qword [rsp + 0x20]
cmp dword [rax - 8], 0
jne 0x180058845
mov eax, dword [rsp + 0x50]
test eax, eax
jne 0x18005882a
lea rdx, str.System_Idle_Process
jmp 0x18005883b
cmp eax, 4
je 0x180058834
cmp eax, 8
jne 0x180058845
lea rdx, [0x1800aa6e0]
lea rcx, [rsp + 0x20]
call fcn.180010070
mov r8d, 0x103
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0xf4]
call fcn.180028a88
mov r8, r12
lea rdx, [rsp + 0xf4]
mov rcx, rdi
call fcn.180059580
test eax, eax
je 0x180058882
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1800561c0
nop
lea rcx, [rsp + 0x20]
call fcn.18000fef0
inc ebx
cmp ebx, ebp
jl 0x1800587c0
mov rdx, rsi
mov rcx, rdi
call fcn.180058400
nop
lea rcx, [rsp + 0x28]
call fcn.180057ee0
mov eax, 1
jmp 0x1800588bf
lea rcx, [rsp + 0x28]
call fcn.180057ee0
xor eax, eax
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.180029600
mov rbx, qword [rsp + 0x250]
add rsp, 0x210
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180058d60
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, rdx
mov rbx, rcx
test rdx, rdx
jne 0x180058d7e
mov dword [rcx + 8], 0x57
add rsp, 0x20
pop rbx
ret
mov edx, r8d
mov rcx, rax
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, eax
test eax, eax
jne 0x180058d9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x180058db0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
call fcn.180066c80
mov r11, qword [0x1800f0968]
test r11, r11
jne 0x180058ddd
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x30], rsi
lea ecx, [rdx + 2]
call r11
mov rsi, rax
test rax, rax
jne 0x180058e10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [rsp + 0x30]
mov dword [rbx + 8], eax
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov edi, eax
cmp eax, 0xffffffff
jne 0x180058e29
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
xor eax, eax
cmp edi, 0xffffffff
setne al
add rsp, 0x20
pop rdi
ret

Function at 0x180058e50
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
call fcn.180066c80
mov r11, qword [0x1800f0968]
test r11, r11
jne 0x180058e7d
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x30], rsi
lea ecx, [rdx + 2]
call r11
mov rsi, rax
test rax, rax
jne 0x180058eb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [rsp + 0x30]
mov dword [rbx + 8], eax
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, eax
cmp eax, 0xffffffff
jne 0x180058ec9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
xor eax, eax
cmp edi, 0xffffffff
setne al
add rsp, 0x20
pop rdi
ret
Function at 0x180058ef0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov esi, edx
mov rbx, rcx
call fcn.180066c80
mov r11, qword [0x1800f0968]
test r11, r11
je 0x180058f34
xor edx, edx
mov r8d, esi
lea ecx, [rdx + 1]
call r11
mov rsi, rax
test rax, rax
jne 0x180058f46
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, eax
test eax, eax
jne 0x180058f60
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, edi
add rsp, 0x20
pop rdi
ret

Function at 0x1800591c0
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x1800d7110]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rdx
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.180029630
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180013640
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180029600
add rsp, 0x150
pop rbx
ret

Function at 0x180059600
Capabilities:
Suspend thread

Disassembly:
push r12
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov ebx, edx
mov r12, rcx
call fcn.180066c80
cmp qword [0x1800f0968], 0
je 0x180059666
lea rcx, [rsp + 0x28]
call fcn.1800186c0
nop
mov rax, qword [r12]
lea r8, [rsp + 0x28]
mov edx, ebx
mov rcx, r12
call qword [rax + 0xd0]
mov ebp, eax
test eax, eax
jne 0x18005966a
lea rcx, [rsp + 0x28]
call fcn.1800186d0
xor eax, eax
jmp 0x1800596d9
xor edi, edi
xor esi, esi
cmp dword [rsp + 0x30], esi
jle 0x1800596cd
nop word [rax + rax]
mov rax, qword [rsp + 0x28]
mov r8d, dword [rax + rsi*4]
xor edx, edx
lea ecx, [rdx + 2]
call qword [0x1800f0968]
mov rbx, rax
test rsi, rsi
jne 0x1800596a1
test rax, rax
je 0x1800596c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
inc rsi
cmp edi, dword [rsp + 0x30]
jge 0x1800596cd
jmp 0x180059680
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r12 + 8], eax
xor ebp, ebp
lea rcx, [rsp + 0x28]
call fcn.1800186d0
mov eax, ebp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x180059700
Capabilities:
Resume thread

Disassembly:
push r12
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov ebx, edx
mov r12, rcx
call fcn.180066c80
cmp qword [0x1800f0968], 0
je 0x180059766
lea rcx, [rsp + 0x28]
call fcn.1800186c0
nop
mov rax, qword [r12]
lea r8, [rsp + 0x28]
mov edx, ebx
mov rcx, r12
call qword [rax + 0xd0]
mov ebp, eax
test eax, eax
jne 0x18005976a
lea rcx, [rsp + 0x28]
call fcn.1800186d0
xor eax, eax
jmp 0x1800597d9
xor edi, edi
xor esi, esi
cmp dword [rsp + 0x30], esi
jle 0x1800597cd
nop word [rax + rax]
mov rax, qword [rsp + 0x28]
mov r8d, dword [rax + rsi*4]
xor edx, edx
lea ecx, [rdx + 2]
call qword [0x1800f0968]
mov rbx, rax
test rsi, rsi
jne 0x1800597a1
test rax, rax
je 0x1800597c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
inc rsi
cmp edi, dword [rsp + 0x30]
jge 0x1800597cd
jmp 0x180059780
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r12 + 8], eax
xor ebp, ebp
lea rcx, [rsp + 0x28]
call fcn.1800186d0
mov eax, ebp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret

Function at 0x180059800
Capabilities:
Acquire debug privileges

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov ebx, r9d
mov r13, r8
mov rbp, rdx
mov r12, rcx
lea rcx, [rsp + 0x28]
call fcn.1800186c0
nop
mov rax, qword [r12]
mov r8d, ebx
lea rdx, [rsp + 0x28]
mov rcx, r12
call qword [rax + 0xb0]
test eax, eax
jne 0x180059863
lea rcx, [rsp + 0x28]
call fcn.1800186d0
xor eax, eax
jmp 0x1800598ff
xor esi, esi
mov ebx, esi
cmp dword [rsp + 0x30], ebx
jle 0x1800598f0
mov edi, esi
test esi, esi
jne 0x180059894
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea r8d, [rsi + 1]
lea rdx, str.SeDebugPrivilege
call fcn.180063c20
mov esi, 1
mov rax, qword [rsp + 0x28]
mov r9, qword [r12]
mov r8d, dword [rdi + rax]
lea rdx, [rsp + 0x60]
mov rcx, r12
call qword [r9 + 0x80]
nop
mov r8, r13
mov rdx, qword [rsp + 0x60]
mov rcx, r12
call fcn.180059580
test eax, eax
je 0x1800598da
mov rax, qword [rsp + 0x28]
mov r8d, dword [rdi + rax]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.180018940
nop
lea rcx, [rsp + 0x60]
call fcn.18000fef0
inc ebx
add rdi, 4
cmp ebx, dword [rsp + 0x30]
jl 0x180059873
lea rcx, [rsp + 0x28]
call fcn.1800186d0
mov eax, 1
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret

Function at 0x18005c080
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1800f0350]
test eax, eax
jne 0x18005c0ae
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.SeDebugPrivilege
mov r8d, 1
mov ecx, eax
call fcn.180063c20
mov dword [0x1800f0350], eax
add rsp, 0x28
ret
Function at 0x18005c4d0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1800d7110]
xor rax, rsp
mov qword [rsp + 0x130], rax
test rdx, rdx
jne 0x18005c50b
mov eax, 0xf0000001
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180029600
add rsp, 0x148
ret
lea rcx, [0x1800a8828]
mov qword [rsp + 0x150], rbx
mov qword [rsp + 0x140], rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.comctl32.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rdi, rdi
je 0x18005c5e9
test rax, rax
je 0x18005c5e9
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.180029630
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.18005bf30
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x47
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x49
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b00b8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b0090]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b0080]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b00a0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.RemoteLoadDll9x_____Can_not_get_function_address
call fcn.180099040
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x150]
mov rdi, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180029600
add rsp, 0x148
ret

Function at 0x18005db80
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x1800d7110]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rdi, rcx
lea rcx, [0x1800b0254]
mov rsi, rdx
call fcn.18005d630
mov rbx, rax
test rax, rax
jne 0x18005dbc5
xor eax, eax
jmp 0x18005dc72
xor eax, eax
lea r8, [rsp + 0x30]
mov rdx, rsi
lea r9d, [rax + 0x40]
mov rcx, rdi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], rax
call rbx
test eax, eax
je 0x18005dbbe
mov eax, 0x5a4d
cmp word [rsp + 0x30], ax
jne 0x18005dbbe
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, pe_nt_image_headers64
call fcn.180029630
movsxd rdx, dword [rsp + 0x6c]
lea r8, [rsp + 0x70]
add rdx, rsi
mov r9d, pe_nt_image_headers64
mov rcx, rdi
mov qword [rsp + 0x20], 0
call rbx
test eax, eax
je 0x18005dbbe
cmp dword [rsp + 0x70], 0x4550
jne 0x18005dbbe
movzx eax, word [rsp + 0x86]
not ax
movzx eax, ax
shr eax, 0xd
and eax, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180029600
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret