joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f6ce0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, 0x2050
call fcn.140121190
sub rsp, rax
mov r12, qword [rsp + 0x20a0]
mov r14, qword [rsp + 0x2098]
mov ebx, dword [rsp + 0x2090]
mov rdi, r9
mov r9d, dword [0x1402d741c]
mov ebp, r8d
mov r15, rdx
mov rsi, rcx
test r9b, 1
je 0x1400f6da3
cmp ebx, 2
jne 0x1400f6d45
lea rax, [0x14019b4a0]
jmp 0x1400f6d68
cmp ebx, 3
jne 0x1400f6d53
lea rax, str.resources
jmp 0x1400f6d68
lea rcx, [0x14019b4bc]
lea rax, str.Invalid_
cmp ebx, 4
cmove rax, rcx
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], rax
mov r9, rdx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r8d
lea r8, str.hWnd__0x_X__uiCommand__0x_X__pdwData__0x_X__ehsSource___s__hInst__0x_X__pPTMousePos__0x_X_n
lea rcx, str.CHelp::ShowHelp
mov edx, 1
call fcn.14011a490
mov r9d, dword [0x1402d741c]
sub ebx, 2
je 0x1400f6ee5
dec ebx
jne 0x1400f6f3b
cmp ebp, 0xc
jne 0x1400f6ec5
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov ebx, eax
test r14, r14
je 0x1400f6f3b
test rdi, rdi
je 0x1400f6f3b
test eax, eax
je 0x1400f6f3b
mov ecx, dword [rdi]
xor ebp, ebp
mov esi, ebp
mov edx, ebp
test ecx, ecx
je 0x1400f6e0c
mov eax, ebp
cmp ecx, ebx
je 0x1400f6e05
mov ecx, dword [rdi + rax*4 + 8]
add rax, 2
add edx, 2
test ecx, ecx
jne 0x1400f6df0
jmp 0x1400f6e0c
movsxd rax, edx
mov esi, dword [rdi + rax*4 + 4]
lea r8, [rsp + 0x50]
mov r9d, 0x1000
mov edx, esi
mov rcx, r14
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1400f6e7e
lea r9, [0x1400f6f70]
mov r8, r15
mov edx, 0xaa
mov rcx, r14
mov qword [rsp + 0x20], rbp
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [0x1402dfae0], rax
call fcn.1400dc290
test eax, eax
je 0x1400f6e5f
mov rcx, qword [0x1402dfae0]
call fcn.1400dc5d0
mov rcx, qword [0x1402dfae0]
lea r8, [rsp + 0x50]
mov r9, r12
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400f6f3b
test esi, esi
je 0x1400f6ea6
test byte [0x1402d741c], 1
je 0x1400f6ea6
lea r8, str.Popup_help_text_missing_from_RC_file__Ctrl_ID__d._n
lea rcx, str.CHelp::ShowHelp
mov r9d, ebx
mov edx, 1
call fcn.14011a490
mov rcx, qword [0x1402dfae0]
test rcx, rcx
je 0x1400f6f3b
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [0x1402dfae0], rbp
jmp 0x1400f6f3b
test r9b, 8
je 0x1400f6f3b
lea r8, str.Cannot_locate_help_file__failed_to_service_help_request._n
lea rcx, str.CHelp::ShowHelp
mov edx, 4
call fcn.14011a490
jmp 0x1400f6f3b
or rbx, 0xffffffffffffffff
lea rcx, [rsi + 0x418]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400f6ef3
test rax, rax
je 0x1400f6f08
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsi + 0x620]
nop
inc rbx
cmp word [rcx + rbx*2], 0
jne 0x1400f6f10
test rbx, rbx
je 0x1400f6f25
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str.Mouse.hlp
mov r9, rdi
mov r8d, ebp
mov rcx, r15
call qword [sym.imp.USER32.dll_WinHelpW]
lea r11, [rsp + 0x2050]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x1400f9110
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0xa0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rsi, r8
mov rbx, rdx
mov r14, rcx
mov qword [rcx + 0x28], 7
xor ebp, ebp
mov qword [rcx + 0x20], rbp
mov word [rcx + 0x10], bp
add rcx, 0x438
lea rdx, str.SynCom.PointingDevice
call fcn.14003b460
lea rax, vtable.CDummySynDevice.0
mov qword [r14 + 0x450], rax
mov dword [r14 + 0x458], ebp
mov qword [r14 + 0x448], rbp
lea rax, vtable.SynDeviceEx.0
mov qword [r14 + 0x430], rax
lea rax, vtable.SynDeviceEx.1.0
mov qword [r14 + 0x440], rax
mov dword [r14 + 0x460], 0xffffffff
mov dword [r14 + 0x464], ebp
lea rcx, [r14 + 0x480]
call fcn.14011c750
nop
mov qword [r14], rbx
mov qword [r14 + 8], rsi
mov dword [r14 + 0x470], 0x800
mov qword [r14 + 0x468], rbp
mov qword [r14 + 0x478], rbp
mov dword [r14 + 0x474], 1
lea rbx, [r14 + 0x6a8]
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rsi, [r14 + 0x8b0]
mov word [rsi], bp
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor edx, edx
lea r8d, [rbp + 5]
lea rcx, [r14 + 0x480]
call fcn.14011c840
test eax, eax
jns 0x1400f9370
lea rdx, str.Windows
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x1400f9256
lea rdx, str.Program_Files
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x1400f934f
lea rcx, [rsp + 0x78]
call fcn.1401159f0
nop
lea r8, str.SynapticsSynTP
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400a0020
nop
cmp qword [rsp + 0x90], 8
jb 0x1400f928b
mov rcx, qword [rsp + 0x78]
call fcn.14011f898
mov qword [rsp + 0x90], 7
mov qword [rsp + 0x88], rbp
mov word [rsp + 0x78], bp
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbp
mov word [rsp + 0x38], bp
cmp word [rdx], 0
je 0x1400f92dc
or rbp, 0xffffffffffffffff
inc rbp
cmp word [rdx + rbp*2], 0
jne 0x1400f92d2
mov r8, rbp
lea rcx, [rsp + 0x38]
call fcn.14000d340
nop
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.140114290
mov edi, eax
cmp qword [rsp + 0x50], 8
jb 0x1400f930d
mov rcx, qword [rsp + 0x38]
call fcn.14011f898
mov r9, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
test edi, edi
je 0x1400f9344
lea rdx, [rsp + 0x58]
cmp r9, 8
cmovae rdx, rcx
mov r8, rsi
nop dword [rax + rax]
movzx eax, word [rdx]
mov word [r8], ax
lea rdx, [rdx + 2]
lea r8, [r8 + 2]
test ax, ax
jne 0x1400f9330
cmp r9, 8
jb 0x1400f934f
call fcn.14011f898
cmp word [rsi], 0
jne 0x1400f9370
sub rsi, rbx
nop dword [rax + rax]
movzx eax, word [rbx]
mov word [rsi + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x1400f9360
mov rax, r14
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400fd120
Capabilities:
Get file version info

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
mov qword [r11 - 0x80], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov word [r11 - 0x78], r15w
xor eax, eax
mov qword [r11 - 0x76], rax
mov qword [r11 - 0x6e], rax
mov qword [r11 - 0x66], rax
mov qword [r11 - 0x5e], rax
mov qword [r11 - 0x56], rax
mov qword [r11 - 0x4e], rax
mov qword [r11 - 0x46], rax
mov word [rsp + 0x7a], ax
cmp qword [rdx + 0x18], 8
jb 0x1400fd180
mov rcx, qword [rdx]
jmp 0x1400fd183
mov rcx, rdx
lea rdx, [rsp + 0xc0]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
or rbx, 0xffffffffffffffff
test eax, eax
je 0x1400fd240
mov eax, 2
mul rbp
cmovo rax, rbx
mov rcx, rax
call fcn.14011e9a4
mov r14, rax
cmp qword [rdi + 0x18], 8
jb 0x1400fd1c1
mov rcx, qword [rdi]
jmp 0x1400fd1c4
mov rcx, rdi
mov r9, rax
mov r8d, ebp
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400fd238
mov qword [rsp + 0xd8], r15
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0xd8]
lea rdx, [0x140167e60]
mov rcx, r14
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400fd238
mov rdx, qword [rsp + 0xd8]
test rdx, rdx
je 0x1400fd238
movzx eax, word [rdx + 0xc]
movzx ecx, word [rdx + 0xe]
movzx r9d, word [rdx + 8]
movzx r8d, word [rdx + 0xa]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str.v_d._d._d._d
lea rcx, [rsp + 0x40]
call fcn.14012161c
mov rcx, r14
call fcn.140120c5c
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], r15
mov word [rsi], r15w
cmp word [rsp + 0x40], 0
jne 0x1400fd25d
mov rbx, r15
jmp 0x1400fd26c
lea rax, [rsp + 0x40]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400fd262
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14000d340
nop
cmp qword [rdi + 0x18], 8
jb 0x1400fd28c
mov rcx, qword [rdi]
call fcn.14011f898
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r15
mov word [rdi], r15w
mov rax, rsi
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400fe3f0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rsi, rax
test rax, rax
je 0x1400fe4c7
movzx r8d, word [rax]
mov qword [rsp + 0x30], rbx
mov rbx, rax
test r8w, r8w
je 0x1400fe470
nop dword [rax]
lea rdx, [0x14019eb90]
movzx r8d, r8w
mov rcx, rdi
call fcn.14012755c
movzx r8d, word [rbx + 2]
add rbx, 2
test r8w, r8w
jne 0x1400fe430
lea rdx, [0x1401873a4]
mov rcx, rdi
call fcn.14012755c
movzx r8d, word [rbx + 2]
add rbx, 2
test r8w, r8w
jne 0x1400fe430
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rcx, qword [rbp + 0x438]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov dword [rsp + 0x40], eax
test rcx, rcx
je 0x1400fe4a4
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
mov edx, 0x100001d2
call qword [rax + 0x18]
mov eax, dword [rsp + 0x40]
lea rcx, [0x14019ddd0]
test eax, eax
lea r8, [0x14019ddd8]
cmovne r8, rcx
lea rdx, str.IsUserAdmin_s_n
mov rcx, rdi
call fcn.14012755c
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1400fe4e0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2020
call fcn.140121190
sub rsp, rax
mov rbp, r8
mov rsi, rdx
xor edi, edi
nop word [rax + rax]
lea rdx, [0x14019642c]
mov rcx, rbp
call fcn.1401275f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400fe544
test rbx, rbx
jne 0x1400fe55f
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x3c
jl 0x1400fe510
xor eax, eax
lea r11, [rsp + 0x2020]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rcx, rbx
call fcn.140126ee0
test eax, eax
jne 0x1400fe5ac
nop dword [rax + rax]
mov rcx, rbx
call fcn.140126f08
test eax, eax
jne 0x1400fe5ac
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x1000
call fcn.1401273e0
test rax, rax
je 0x1400fe5ac
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.1401274a8
mov rcx, rbx
call fcn.140126ee0
test eax, eax
je 0x1400fe570
mov rcx, rsi
call fcn.1401219a4
mov rcx, rbx
call fcn.140121868
mov eax, 1
jmp 0x1400fe546
Function at 0x140109020
Capabilities:
Delete registry key

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
xor r14d, r14d
mov ebp, r14d
lea rsi, str.HKLM_SoftwareSynapticsSynTP
nop dword [rax]
mov rdi, qword [rsi]
call fcn.140004fc0
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x140109228
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
test rdi, rdi
je 0x1401090bc
test rdi, 0xffffffffffff0000
jne 0x1401090ac
movzx edi, di
xor edx, edx
mov ecx, edi
call fcn.140011240
test rax, rax
je 0x1401090d4
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140011590
jmp 0x1401090cf
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], 0
jne 0x1401090b0
jmp 0x1401090bf
mov eax, r14d
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140011790
mov rbx, qword [rsp + 0x50]
movsxd rdi, dword [rbx - 0x10]
test edi, edi
js 0x14010921d
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140109102
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.14000f050
mov rbx, qword [rsp + 0x50]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.1401215c8
cmp edi, dword [rbx - 0xc]
jg 0x140109212
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], r14w
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x140109144
cmp rax, qword [rbx - 0x18]
jne 0x140109144
lea rdi, [rbx - 0x18]
lock inc dword [rbx - 8]
jmp 0x14010917f
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rdi, rax
test rax, rax
je 0x14010920c
mov ecx, dword [rbx - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rbx - 0x10]
inc ecx
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.140120d78
lea rax, [rdi + 0x18]
mov qword [rsp + 0x58], rax
lock add dword [rbx - 8], 0xffffffff
jg 0x14010919d
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x58]
cmp dword [rbx - 0x10], 0
jl 0x1401091cf
lea rdx, str.hkcu_software
mov rcx, rbx
call fcn.140122ad0
test rax, rax
je 0x1401091cf
sub rax, rbx
sar rax, 1
test eax, eax
jne 0x1401091cf
mov rcx, qword [rsi]
call fcn.140103e30
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1401091e3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc ebp
add rsi, 8
movsxd rax, ebp
cmp rax, 0xb
jb 0x140109050
lea rdx, [0x140184770]
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyW]
jmp 0x140109233
call fcn.14000f100
int3
mov ecx, 0x80070057
call fcn.140004f70
int3
mov ecx, 0x80070057
call fcn.140004f70
nop
mov ecx, 0x80004005
call fcn.140004f70
int3
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14010a380
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x270
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x290], rbx
cmp dword [0x1402dfb20], 0
jne 0x14010a5af
mov dword [0x1402dfb20], 1
call fcn.140117f10
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
test eax, eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea edx, [rcx + 0x2a]
jne 0x14010a3d2
lea edx, [rcx + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call fcn.140004fc0
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14010a3f7
mov ecx, 0x80004005
call fcn.140004f70
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x280], rax
lea rcx, [rsp + 0x60]
lea rax, [rsp + 0x60]
or rbx, 0xffffffffffffffff
test rax, 0xffffffffffff0000
jne 0x14010a448
movzx edi, cx
xor edx, edx
mov ecx, edi
call fcn.140011240
test rax, rax
je 0x14010a470
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.140011590
jmp 0x14010a470
lea rcx, [rsp + 0x60]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], 0
jne 0x14010a450
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x280]
call fcn.140011790
nop
lea r8, str.LenovoMetricCollectionSDKMFCLenovo.MetricCollectionMFC.dll
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x288]
call fcn.140079570
nop
mov rdx, qword [rsp + 0x280]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14010a4a9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1402dfaf0], rax
test rax, rax
je 0x14010a569
lea rdx, str.GetMetricCollectionCollector
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x14010a557
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14011a140
mov byte [rsp + 0x48], 1
lea rax, str.SynapticsAppsCollectionReport
mov qword [rsp + 0x40], rax
lea rax, str.Local_Todo
mov qword [rsp + 0x38], rax
lea rax, str.Countyr_Todo
mov qword [rsp + 0x30], rax
lea rax, str.Family_Todo
mov qword [rsp + 0x28], rax
lea rax, str.SubBrand_Todo
mov qword [rsp + 0x20], rax
lea r9, str.Brand_Todo
lea r8, str.MTM_Todo
lea rdx, str.19.5.10.75
lea rcx, [rsp + 0x60]
call rdi
mov qword [0x1402dfae8], rax
jmp 0x14010a593
test byte [0x1402d741c], 1
je 0x14010a593
lea r8, str.Fail_to_get_GetProcAddress_of_GetMetricCollectionCollector___in__s_n
jmp 0x14010a579
test byte [0x1402d741c], 1
je 0x14010a593
lea r8, str.Fail_to_load__s_n
mov r9, qword [rsp + 0x288]
mov edx, 1
lea rcx, str.GetLenovoMetricCollectionCollector
call fcn.14011a590
nop
mov rdx, qword [rsp + 0x288]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14010a5af
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [0x1402dfae8]
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret
Function at 0x140110660
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x670
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x698], rbx
mov rdi, rcx
lea rax, vtable.CSynDeviceGestureActionService.0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
lea rbx, [rcx + 0x18]
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov rcx, rbx
call fcn.140111250
mov qword [rbx], rax
mov dword [rsp + 0x688], 0x101
lea rdx, [rsp + 0x688]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rax, qword [rdi + 8]
mov rcx, qword [rax + 0x58]
test rcx, rcx
jne 0x1401106d6
lea rcx, [rax + 0x70]
mov rax, qword [rcx]
lea r8, [rsp + 0x690]
mov edx, 0x10000101
call qword [rax + 0x18]
or ecx, 0xffffffff
test eax, eax
cmove ecx, dword [rsp + 0x690]
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x60]
lea r8, str..pipe_sC01BC476_A852_4dfd_B33F_E308F3497BF4_li
mov edx, 0x200
lea rcx, [rsp + 0x270]
call fcn.1401216e0
lea r9, [0x140167e60]
lea r8, [0x1401853e4]
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140117800
cmp qword [rax + 0x10], 0
setne bl
cmp qword [rsp + 0x48], 8
jb 0x14011074c
mov rcx, qword [rsp + 0x30]
call fcn.14011f898
test bl, bl
je 0x1401107ac
lea r9, [0x140167e60]
lea r8, [0x1401853e4]
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140117800
cmp qword [rax + 0x18], 8
jb 0x140110774
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x270]
lea r8, str._s_s
mov edx, 0x200
lea rcx, [rsp + 0x270]
call fcn.1401216e0
cmp qword [rsp + 0x48], 8
jb 0x1401107ac
mov rcx, qword [rsp + 0x30]
call fcn.14011f898
mov edx, 0x3d
lea rcx, [rsp + 0x270]
call fcn.1400029d0
mov qword [rdi + 0x10], rax
test rax, rax
je 0x1401107d3
mov rdx, rdi
mov rcx, rax
call fcn.140002780
nop
mov rax, rdi
mov rbx, qword [rsp + 0x698]
add rsp, 0x670
pop rdi
ret
Function at 0x140113d70
Capabilities:
Query service status

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x2c0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.1400f7980
nop
mov ebp, 1
mov dword [rsp + 0x2d0], ebp
xor ebx, ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPInstall
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x78]
call fcn.1400f7af0
test eax, eax
je 0x140113f92
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x2d0]
lea r8, [rsp + 0x2d0]
lea rdx, [0x1401a2e08]
lea rcx, [rsp + 0x80]
call fcn.14011b090
test byte [0x1402d741c], 4
je 0x140113e26
mov r9d, dword [rsp + 0x2d0]
lea r8, str.EnhancementLaunchMode__x_n
lea edx, [rbp + 2]
lea rcx, str.CheckEnhancementService
call fcn.14011a490
test byte [rsp + 0x2d0], bpl
je 0x140113f92
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], eax
mov r8d, ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x140113e8f
test byte [0x1402d741c], 2
je 0x140113f92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.OpenSCManager_failed_w_err_0x_08lx_n
lea edx, [rsi + 2]
lea rcx, str.CheckEnhancementService
call fcn.14011a490
jmp 0x140113f92
lea r9, [0x140167e60]
lea r8, [0x1401853e4]
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140117800
cmp qword [rax + 0x18], 8
jb 0x140113eb3
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, str.SynTPEnhService
lea r8, str._s_s
mov edx, 0x104
lea rcx, [rsp + 0xb0]
call fcn.1401216e0
cmp qword [rsp + 0x70], 8
jb 0x140113eea
mov rcx, qword [rsp + 0x58]
call fcn.14011f898
mov r8d, 4
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x140113f3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
je 0x140113f7a
test byte [0x1402d741c], 2
je 0x140113f7a
mov r9d, eax
lea r8, str.OpenService_failed_w_err_0x_08lx_n
lea edx, [rdi + 2]
lea rcx, str.CheckEnhancementService
call fcn.14011a490
jmp 0x140113f7a
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140113f7a
test byte [0x1402d741c], 2
je 0x140113f72
mov r9d, dword [rsp + 0x34]
lea r8, str.Service_Status:__x_n
mov edx, 2
lea rcx, str.CheckEnhancementService
call fcn.14011a490
cmp dword [rsp + 0x34], 4
cmove ebx, ebp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x140113f92
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
lea rcx, [rsp + 0x78]
call fcn.1400f7a90
mov eax, ebx
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140115960
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, 1
mov edx, eax
mov ecx, ebp
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test rdi, rdi
je 0x1401159bd
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetFocus]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov ecx, ebp
mov edx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1401159f0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x240
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x250], rbx
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov eax, dword [0x1402dfbc0]
test al, 1
jne 0x140115a62
or eax, 1
mov dword [0x1402dfbc0], eax
mov qword [0x1402dfbb8], 7
mov qword [0x1402dfbb0], rdi
mov word [0x1402dfba0], di
xor r8d, r8d
lea rdx, [0x140165848]
lea rcx, [0x1402dfba0]
call fcn.14000d340
lea rcx, [0x140163a50]
call fcn.140120af0
nop
cmp dword [0x1402dfb9c], 0
jne 0x140115ac6
mov r9d, 1
lea r8d, [r9 + 0x22]
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [rsp + 0x30], 0
jne 0x140115a8f
mov r8, rdi
jmp 0x140115aab
lea rax, [rsp + 0x30]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140115aa0
lea rdx, [rsp + 0x30]
lea rcx, [0x1402dfba0]
call fcn.14000d340
mov dword [0x1402dfb9c], 1
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
mov word [rbx], di
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [0x1402dfba0]
mov rcx, rbx
call fcn.14000d1f0
mov rax, rbx
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret