joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140068468
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov r12d, 1
cmp qword [0x1400cedc0], r15
jne 0x1400685c9
xor ecx, ecx
call fcn.14006e2b4
mov rcx, rax
mov rdi, rax
call fcn.1400690b4
test al, al
jne 0x1400684b9
mov eax, r12d
jmp 0x140068632
mov eax, 0x5a4d
cmp word [rdi], ax
je 0x1400684cd
mov eax, 2
jmp 0x140068632
cmp dword [rdi + 0x3c], 0x400
jl 0x1400684e0
mov eax, 3
jmp 0x140068632
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
cmp dword [rbx], 0x4550
je 0x1400684f9
mov eax, 4
jmp 0x140068632
mov qword [0x1400cedc0], r15
movzx r14d, r15w
movzx esi, word [rbx + 0x14]
add rsi, rbx
cmp r15w, word [rbx + 6]
jae 0x1400685e7
movsx rax, r14w
lea rbp, [rax + rax*4]
mov eax, dword [rsi + rbp*8 + 0x3c]
test eax, 0x22000020
jne 0x140068551
and eax, 0xc0000000
cmp eax, 0xc0000000
jne 0x140068551
cmp dword [rsi + rbp*8 + 0x20], 0x10
jb 0x140068551
mov eax, dword [rsi + rbp*8 + 0x24]
test eax, eax
je 0x140068551
lea rcx, [rdi + rax]
call fcn.1400690b4
test al, al
jne 0x140068580
movzx ecx, word [rbx + 6]
add r14w, r12w
movsx eax, r14w
cmp eax, ecx
jl 0x140068516
mov rcx, qword [0x1400cedc0]
test rcx, rcx
je 0x1400685e7
call fcn.1400690b4
test al, al
jne 0x14006859b
mov eax, 6
jmp 0x140068632
mov eax, dword [rsi + rbp*8 + 0x24]
mov ecx, dword [rsi + rbp*8 + 0x20]
add rax, rdi
add rcx, 0xfffffffffffffff0
add rcx, rax
mov qword [0x1400cedc0], rcx
jmp 0x140068568
mov rdx, qword [0x1400cedc0]
lea rcx, [0x1400cedb0]
mov r8d, 0x10
call sub.ntdll.dll_memcpy
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov dword [0x1400cedc8], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x4000
call fcn.140068694
test eax, eax
jne 0x1400685ee
mov eax, 7
jmp 0x140068632
mov eax, 5
jmp 0x140068632
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, r12d
call fcn.1400686e4
test eax, eax
jne 0x14006860a
mov eax, 8
jmp 0x140068632
mov rax, qword [0x1400cedc0]
movabs rcx, 0xcc873400686c02df
mov qword [rax], rcx
lea rcx, [0x1400ced40]
mov rax, qword [0x1400cedc0]
mov qword [rax + 8], rcx
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14006a45c
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x250
lea rdx, [rsp + 0x40]
mov rbx, rcx
call fcn.14000cc34
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call fcn.1400548cc
mov rdx, rax
lea rdi, [rsp + 0x40]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
cmp rdx, 0xffffffffffffffff
jne 0x14006a4de
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14006a4da
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x14006a4da
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x15
jne 0x14006a4f9
xor al, al
jmp 0x14006a4e8
mov rcx, rdx
call fcn.14000a158
mov al, 1
mov rbx, qword [rsp + 0x260]
add rsp, 0x250
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
lea rcx, [0x1400b711c]
mov r8d, eax
call fcn.14006b984
call fcn.14006f388
int3

Function at 0x14006e4ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov rbx, rdx
mov rdi, rcx
mov edx, dword [rax + rcx + 0x88]
test edx, edx
je 0x14006e5b0
cmp dword [rax + rcx + 0x8c], 0
je 0x14006e5b0
call fcn.14006faa0
mov esi, eax
mov rcx, rdi
add rsi, rdi
mov edx, dword [rsi + 0x20]
call fcn.14006faa0
mov edx, dword [rsi + 0x24]
mov rcx, rdi
mov r13d, eax
add r13, rdi
call fcn.14006faa0
mov edx, dword [rsi + 0x1c]
mov rcx, rdi
mov r12d, eax
add r12, rdi
call fcn.14006faa0
mov r14d, eax
add r14, rdi
cmp rbx, 0x10000
jae 0x14006e56f
mov edx, dword [rsi + 0x10]
cmp rbx, rdx
jb 0x14006e5c2
mov ecx, dword [rsi + 0x14]
add ecx, edx
cmp rbx, rcx
jae 0x14006e5c2
sub rbx, rdx
mov eax, dword [r14 + rbx*4]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor ebp, ebp
cmp dword [rsi + 0x18], ebp
jbe 0x14006e5c2
mov edx, dword [r13 + rbp*4]
mov rcx, rdi
call fcn.14006faa0
mov edx, eax
mov rcx, rbx
add rdx, rdi
call fcn.14000c780
test al, al
jne 0x14006e59d
inc ebp
cmp ebp, dword [rsi + 0x18]
jae 0x14006e5c2
jmp 0x14006e576
movzx edx, word [r12 + rbp*2]
mov rcx, rdi
mov edx, dword [r14 + rdx*4]
call fcn.14006faa0
jmp 0x14006e552
lea rcx, [0x1400b735a]
call fcn.14006b984
call fcn.14006f388
int3
mov rdx, rbx
lea rcx, [0x1400b73d0]
call fcn.14006b984
call fcn.14006f388
int3
Function at 0x14006e5d8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov rdi, rdx
lea rdx, [rsp + 0x20]
call fcn.14000cc5c
lea rcx, [rsp + 0x20]
call fcn.14006e344
mov rsi, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x14006e6bc
cmp dword [rax + rsi + 0x8c], 0
je 0x14006e6bc
lea rbx, [rsi + rcx]
mov r15d, dword [rbx + 0x24]
mov r14d, dword [rbx + 0x1c]
add r15, rsi
add r14, rsi
cmp rdi, 0x10000
jae 0x14006e687
mov edx, dword [rbx + 0x10]
cmp rdi, rdx
jb 0x14006e6ce
mov ecx, dword [rbx + 0x14]
add ecx, edx
cmp rdi, rcx
jae 0x14006e6ce
sub rdi, rdx
mov eax, dword [r14 + rdi*4]
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r12d, dword [rbx + 0x20]
xor ebp, ebp
add r12, rsi
cmp dword [rbx + 0x18], ebp
jbe 0x14006e6ce
mov edx, dword [r12 + rbp*4]
mov rcx, rdi
add rdx, rsi
call sub.ntdll.dll_strcmp
test eax, eax
je 0x14006e6b1
inc ebp
cmp ebp, dword [rbx + 0x18]
jae 0x14006e6ce
jmp 0x14006e695
movzx eax, word [r15 + rbp*2]
mov eax, dword [r14 + rax*4]
jmp 0x14006e666
lea rcx, [0x1400b7436]
call fcn.14006b984
call fcn.14006f388
int3
lea rcx, [0x1400b74b2]
call fcn.14006b984
call fcn.14006f388
int3

Function at 0x14006e7f4
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x150
and dword [rcx], 0
xor edx, edx
mov r15, rcx
mov dword [rsp + 0x20], 0x130
xor r14d, r14d
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14006e8ee
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14006e908
lea rdx, [rsp + 0x20]
mov rcx, rbx
inc r14d
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14006e851
mov eax, r14d
imul rcx, rax, 0x130
call fcn.14006b298
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r12, rax
xor ebp, ebp
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14006e922
mov eax, ebp
lea rsi, [rsp + 0x20]
imul rdi, rax, 0x130
inc ebp
mov ecx, 0x130
add rdi, r12
rep movsb byte [rdi], byte [rsi]
cmp ebp, r14d
jae 0x14006e8be
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14006e88e
mov rcx, rbx
call fcn.14000a158
lea r11, [rsp + 0x150]
mov dword [r15], ebp
mov rbx, qword [r11 + 0x20]
mov rax, r12
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400b725a]
call fcn.14006b984
call fcn.14006f388
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400b729c]
call fcn.14006b984
call fcn.14006f388
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400b72de]
call fcn.14006b984
call fcn.14006f388
int3
Function at 0x140001000
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movdqa xmm1, xmmword [str.BCY_nCY_n_EXACDM]
xor r12d, r12d
movdqu xmmword [rbp - 0x40], xmm1
mov al, 0x6e
mov byte [rbp - 0x13], r12b
xor al, 0x3e
mov byte [rbp - 0x20], 0x3e
mov r8b, 0x7f
mov byte [rbp - 0x1f], al
xor r8b, 0x3e
mov dl, 0x7b
movzx r10d, dl
mov byte [rbp - 0x1c], r8b
movd r8d, xmm1
xor dl, 0x3e
xor r10b, 0x3e
mov byte [rbp - 0x1d], dl
movdqa xmm0, xmm1
mov byte [rbp - 0x1a], r10b
xor byte [rbp - 0x3e], r8b
mov cl, 0x72
xor byte [rbp - 0x3d], r8b
xor cl, 0x3e
xor byte [rbp - 0x3c], r8b
mov r9b, 0x6d
xor byte [rbp - 0x3b], r8b
xor r9b, 0x3e
xor byte [rbp - 0x3a], r8b
mov r14b, 0x75
xor byte [rbp - 0x39], r8b
xor r14b, 0x3e
xor byte [rbp - 0x38], r8b
mov dil, 0x71
xor byte [rbp - 0x37], r8b
xor dil, 0x3e
xor byte [rbp - 0x36], r8b
mov r11b, 0x1e
xor byte [rbp - 0x35], r8b
xor r11b, 0x3e
xor byte [rbp - 0x34], r8b
mov bl, 0x69
xor byte [rbp - 0x33], r8b
xor bl, 0x3e
xor byte [rbp - 0x32], r8b
mov sil, 0x6c
xor byte [rbp - 0x31], r8b
xor sil, 0x3e
mov byte [rbp - 0x1e], cl
mov r15b, 0x1f
mov cl, 0xa
mov byte [rbp - 0x1b], r9b
xor r15b, 0x3e
psrldq xmm0, 1
movzx r9d, cl
movd eax, xmm0
mov byte [rbp - 0x15], r14b
mov dl, 0x43
xor dl, r8b
mov byte [rbp - 0x17], dil
xor al, r8b
mov byte [rbp - 0x19], r11b
movzx r14d, cl
mov byte [rbp - 0x18], bl
xor cl, r8b
mov byte [rbp - 0x16], sil
mov dil, 0x59
mov byte [rbp - 0x14], r15b
mov byte [rbp - 0x3f], al
xor r9b, r8b
mov r10b, 0x4d
mov byte [rbp - 0x30], cl
mov r11b, 0x5f
mov byte [rbp - 0x2f], dl
mov bl, 0x4f
movzx esi, dil
mov r15b, 0x10
mov r12b, 3
xor r10b, r8b
mov byte [rbp - 0x2e], r9b
xor r11b, r8b
mov byte [rbp - 0x2d], r10b
xor bl, r8b
mov byte [rbp - 0x2c], r11b
xor dil, r8b
mov byte [rbp - 0x2b], bl
xor sil, r8b
mov byte [rbp - 0x2a], dil
xor r14b, r8b
mov byte [rbp - 0x29], sil
xor r15b, r8b
mov byte [rbp - 0x28], r14b
xor r12b, r8b
mov byte [rbp - 0x27], r15b
xor r9d, r9d
mov byte [rbp - 0x26], r12b
lea r8, [rbp - 0x1f]
mov byte [rbp - 0x25], 0
lea rdx, [rbp - 0x3f]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140001260
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140001b28
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b72
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b72
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b72
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b72
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b72
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b74
xor al, al
add rsp, 0x28
ret
Function at 0x14000efa0
Capabilities:
Capture network configuration via ipconfig

Disassembly:
sub rsp, 0x28
lea rcx, str.net_stop_w32time
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.w32tm__unregister
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.w32tm__register
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.w32tm__config__syncfromflags:manual__manualpeerlist:_0.pool.ntp.org_1.pool.ntp.org_2.pool.ntp.org_3.pool.ntp.org___reliable:YES
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_start_w32time
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.w32tm__config__update
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.w32tm__resync__rediscover
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x28
jmp fcn.14000ba70
Function at 0x14000f020
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x28
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__ActiveWindowTracking___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__Beep___t_REG_SZ__d__No___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__DoubleClickHeight___t_REG_SZ__d__4___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__DoubleClickSpeed___t_REG_SZ__d__620___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__DoubleClickWidth___t_REG_SZ__d__4___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__ExtendedSounds___t_REG_SZ__d__No___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__MouseHoverHeight___t_REG_SZ__d__4___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__MouseHoverTime___t_REG_SZ__d__100___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__MouseHoverWidth___t_REG_SZ__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__MouseSensitivity___t_REG_SZ__d__10___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__MouseSpeed___t_REG_SZ__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__MouseThreshold1___t_REG_SZ__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__MouseThreshold2___t_REG_SZ__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__MouseTrails___t_REG_SZ__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__SmoothMouseXCurve___t_REG_BINARY__d__0000000000000000c0cc0c0000000000809919000000000040662600000000000033330000000000___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__SmoothMouseYCurve___t_REG_BINARY__d__0000000000000000000038000000000000007000000000000000a800000000000000e00000000000___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__SnapToDefaultButton___t_REG_SZ__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__SwapMouseButtons___t_REG_SZ__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x28
jmp fcn.14000ceb0
Function at 0x140012c40
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x28
lea rcx, str.Reg.exe_add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPrivacy___v__TailoredExperiencesWithDiagnosticDataEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionDiagnosticsDiagTrack___v__ShowedToastAtLevel___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKEY_CURRENT_USERSoftwareMicrosoftInputTIPC___v__Enabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsSystem___v__UploadUserActivities___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsSystem___v__PublishUserActivities___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKEY_CURRENT_USERControl_PanelInternationalUser_Profile___v__HttpAcceptLanguageOptOut___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesAttachments___v__SaveZoneInformation___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKEY_LOCAL_MACHINESystemCurrentControlSetControlDiagnosticsPerformance___v__DisableDiagnosticTracing___t_REG_DWORD__d__1___f__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsWDI9c5a40da_b965_4fc3_8781_88dd50a6299d___v__ScenarioExecutionEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x28
jmp fcn.140009250
Function at 0x140013760
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x28
lea rcx, str.Reg_add__HKCUSOFTWAREMicrosoftGames___v__FpsAll___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg_add__HKCUSOFTWAREMicrosoftGames___v__FpsStatusGames___t_REG_DWORD__d__10___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg_add__HKCUSOFTWAREMicrosoftGames___v__FpsStatusGamesAll___t_REG_DWORD__d__4___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg_add__HKCUSOFTWAREMicrosoftGames___v__GameFluidity___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfile___v__NetworkThrottlingIndex___t_REG_DWORD__d__00000010___f__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfile___v__SystemResponsiveness___t_REG_DWORD__d__00000000___f__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipServiceProvider___v__DnsPriority___t_REG_DWORD__d__00000006___f__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipServiceProvider___v__HostsPriority___t_REG_DWORD__d__00000005___f__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipServiceProvider___v__LocalPriority___t_REG_DWORD__d__00000004___f__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipServiceProvider___v__NetbtPriority___t_REG_DWORD__d__00000007___f__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet_Settings___v__MaxConnectionsPerServer___t_REG_DWORD__d__00000016___f__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet_Settings___v__MaxConnectionsPer1_0Server___t_REG_DWORD__d__00000016___f__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x28
jmp fcn.140008660
Function at 0x140019030
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x28
lea rcx, str.bcdedit__set_allowedinmemorysettings_0x0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.bcdedit__set_isolatedcontext_No
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_Managerkernel___v__DistributeTimers___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_Managerkernel___v__DisableTsx___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlPowerPowerThrottling___v__PowerThrottlingOff___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerPower___v__CoalescingTimerInterval___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlPower___v__EnergyEstimationEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlPower___v__EventProcessorEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x28
jmp fcn.140005d20
Function at 0x14001aa60
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x28
lea rcx, str.Reg.exe_add__HKLMSOFTWARENVIDIA_CorporationNvControlPanel2Client___v__OptInOrOutPreference___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWARENVIDIA_CorporationGlobalFTS___v__EnableRID66610___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWARENVIDIA_CorporationGlobalFTS___v__EnableRID64640___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWARENVIDIA_CorporationGlobalFTS___v__EnableRID44231___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__change__disable__tn__NvTmRep_CrashReport1_B2FE1952_0186_46C3_BAEC_A80AA35AC5B8_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__change__disable__tn__NvTmRep_CrashReport2_B2FE1952_0186_46C3_BAEC_A80AA35AC5B8_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__change__disable__tn__NvTmRep_CrashReport3_B2FE1952_0186_46C3_BAEC_A80AA35AC5B8_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__change__disable__tn__NvTmRep_CrashReport4_B2FE1952_0186_46C3_BAEC_A80AA35AC5B8_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__change__disable__tn__NvDriverUpdateCheckDaily_B2FE1952_0186_46C3_BAEC_A80AA35AC5B8_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__change__disable__tn__NVIDIA_GeForce_Experience_SelfUpdate_B2FE1952_0186_46C3_BAEC_A80AA35AC5B8_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__change__disable__tn__NvTmMon_B2FE1952_0186_46C3_BAEC_A80AA35AC5B8_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x28
jmp fcn.140019740