joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14140f075
Capabilities:
Encode data using xor

Disassembly:
lea rdi, [0x14140eb38]
lea rsp, [rsp + 8]
mov r11d, 0xdba3411
sar r11w, 0xe1
movzx r11d, byte [r11 + rax - 0xdba1a08]
push 0xffffffff901a7681
xor r11d, ecx
and r11d, 0xff
mov r11d, dword [rdi + r11*4]
sal qword [rsp], 0x7f
shr ecx, 8
xor ecx, r11d
inc rax
xor ecx, 0x791d1532
dec rdx
lea rsp, [rsp + 8]
jne 0x14140f081
pop r11
Function at 0x140002740
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x14004c7f0]
xor esi, esi
lea rax, vtable.CFastCursor.0
mov qword [rcx], rax
mov dword [rcx + 8], esi
mov qword [rcx + 0x10], rsi
mov word [rcx + 0x18], si
lea rax, vtable.mpg::Mutex.0
mov rdi, rcx
mov qword [rcx + 0x20], rax
add rcx, 0x28
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [rdi + 0x58], rsi
mov qword [rdi + 0x60], rsi
lea rax, vtable.mpg::String.0
mov qword [rdi + 0x50], rax
mov eax, 0x4d0
mov dword [rdi + 0x68], esi
mov qword [rdi + 0x78], rbx
mov dword [rdi + 0x80], esi
mov qword [rdi + 0x8c], rsi
mov word [rdi + 0x9c], ax
mov qword [rdi + 0x94], rsi
mov qword [rdi + 0xa0], 1
mov dword [rdi + 0xa8], 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov dword [0x14004c5f0], eax
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x140002ab0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ebx, edx
mov rdi, rcx
call fcn.140002b20
lea rax, [rdi + 0x68]
mov dword [rdi + 0xa4], ebx
lea r8, [0x140003a30]
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov byte [rdi + 0x18], 0
mov dword [rsp + 0x20], ebx
call fcn.14000e5d4
lea r8, [0x140002620]
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x40]
mov qword [rdi + 0x10], rax
add rsp, 0x30
pop rdi
ret
Function at 0x1400037e0
Capabilities:
Send data
Send data on socket

Disassembly:
push rdi
sub rsp, 0xe0
mov rax, qword [0x140049070]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, rdx
test rdx, rdx
jne 0x14000380d
mov eax, 0x80070006
jmp 0x140003930
cmp byte [rdx + 0x68], 0
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0xd8], rbp
mov qword [rsp + 0xd0], rsi
je 0x14000384e
mov eax, dword [rdx + 0x30]
mov r9d, dword [rdx + 0x2c]
lea r8, str.cursor_pos_d:_d
lea rcx, [rsp + 0x40]
mov edx, 0x20
mov dword [rsp + 0x20], eax
call fcn.14000e574
jmp 0x14000388a
mov rax, qword [rcx]
call qword [rax + 0x88]
mov r9d, dword [rdi + 0x34]
lea r8, str.fast_cursor_d:_d:_d:_d:_d
mov dword [rsp + 0x38], eax
mov eax, dword [rdi + 0x30]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x30], eax
mov eax, dword [rdi + 0x2c]
mov edx, 0x80
mov dword [rsp + 0x28], eax
mov eax, dword [rdi + 0x38]
mov dword [rsp + 0x20], eax
call fcn.14000e574
mov esi, eax
xor ebx, ebx
lea rbp, [rdi + 0x3c]
nop word [rax + rax]
mov rcx, qword [rdi + 8]
mov r8d, esi
movsxd rax, ebx
lea rdx, [rsp + 0x40]
xor r9d, r9d
sub r8d, ebx
add rdx, rax
mov dword [rsp + 0x28], sendto
mov qword [rsp + 0x20], rbp
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x1400038d2
add ebx, eax
mov ecx, esi
sub ecx, ebx
test ecx, ecx
jle 0x1400038e1
cmp eax, 0xffffffff
jne 0x1400038a0
jmp 0x1400038e6
cmp eax, 0xffffffff
jne 0x140003916
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r9, str.Error_at_sendTo__:__d
lea r8, str.MCUMS
lea rcx, str...IncludeFastCursor.cpp
mov edx, 0x290
mov dword [rsp + 0x20], eax
call fcn.140004350
mov eax, 0x80004005
jmp 0x140003918
xor eax, eax
mov rbp, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x100]
mov rsi, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14000e2f0
add rsp, 0xe0
pop rdi
ret

Function at 0x140003a50
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rcx
mov rdx, rcx
mov ecx, dword [0x14004c5f0]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140003aa1
lea rax, str.CFastCursor::MouseHookThread___TlsSetValue_failed_
lea r8, str.MCUMS
lea rcx, str...IncludeFastCursor.cpp
mov r9d, 3
mov edx, 0x2d8
mov qword [rsp + 0x20], rax
call fcn.1400044f0
mov eax, 1
add rsp, 0x60
pop rbx
ret
mov r8, qword [rbx + 0x78]
xor r9d, r9d
lea rdx, [0x140003950]
lea ecx, [r9 + 0xe]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rbx + 0x70], rax
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140003b01
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140003ad4
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor eax, eax
add rsp, 0x60
pop rbx
ret
Function at 0x140003de0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x20
lea rsi, [rsp + 0x48]
mov rdx, rsi
call fcn.14000f054
inc eax
movsxd rbx, eax
mov rcx, rbx
call fcn.14000f0fc
mov r8, qword [rsp + 0x40]
mov r9, rsi
mov rcx, rax
mov rdx, rbx
mov rdi, rax
call fcn.14000f474
cmp dword [0x14004ad14], 0
jle 0x140003e3d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call fcn.14000f48c
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x140003f50
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140049070]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x44]
xor ebx, ebx
lea r8, str.LogLevel
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
lea rdx, str.SoftwareIntel_CorporationIntel_WiDi
mov qword [rsp + 0x28], rax
lea r9d, [rbx + 0x18]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x44], 8
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140003fbf
mov rax, qword [rsp + 0x48]
test al, al
je 0x140003fbf
movsx ecx, al
mov dword [0x14004ad10], ecx
jmp 0x140003fc9
mov dword [0x14004ad10], 7
lea rax, [rsp + 0x44]
lea r8, str.LogOutputDebugString
lea rdx, str.SoftwareIntel_CorporationIntel_WiDi
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov r9d, 0x18
mov qword [rsp + 0x28], rax
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
cmove ebx, dword [rsp + 0x40]
mov dword [0x14004c5f4], ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14000e2f0
add rsp, 0x60
pop rbx
ret
Function at 0x140004030
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xd50
mov rax, qword [0x140049070]
xor rax, rsp
mov qword [rsp + 0xd30], rax
mov eax, dword [0x14004ad14]
mov rdi, qword [rsp + 0xda0]
mov r14d, r9d
mov rbp, r8
mov esi, edx
mov rbx, rcx
test eax, eax
jns 0x140004084
mov dword [0x14004ad14], 1
call fcn.140003f50
mov eax, dword [0x14004ad14]
test eax, eax
je 0x140004272
mov qword [rsp + 0xd48], r15
or rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x140004096
add rax, 0xfffffffffffffffc
add rax, rbx
cmp rax, rbx
jbe 0x1400040c3
nop dword [rax + rax]
cmp byte [rax], 0x5c
je 0x1400040bf
dec rax
cmp rax, rbx
ja 0x1400040b0
jmp 0x1400040c3
lea rbx, [rax + 1]
lea rcx, [rsp + 0x58]
xor r15d, r15d
mov dword [rsp + 0x50], r15d
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movzx ecx, word [rsp + 0x66]
movzx edx, word [rsp + 0x64]
movzx r8d, word [rsp + 0x62]
movzx r9d, word [rsp + 0x60]
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r9d
lea rcx, [rsp + 0x70]
lea r9, str._02u:_02u:_02u:_03u__t:0x_x__:__s
or r8, 0xffffffffffffffff
mov edx, 0xbd4
call fcn.14000e4b0
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rbx
mov edi, eax
mov eax, 0xbd3
lea r9, str.__L_d__M_s__F_s:__d__n
cmp edi, 0xffffffff
mov edx, 0xe4
mov qword [rsp + 0x28], rbp
cmove edi, eax
lea rax, [rsp + 0x70]
or r8, 0xffffffffffffffff
movsxd rcx, edi
mov dword [rsp + 0x20], r14d
add rcx, rax
call fcn.14000e4b0
mov bl, 1
add edi, eax
movzx eax, byte [0x14004b0f1]
test al, al
je 0x1400041c5
lea rcx, [0x14004c850]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x14004b0f1], r15b
je 0x1400041b1
cmp dword [0x14004ad14], r15d
je 0x1400041b1
call fcn.140003e50
mov eax, dword [0x14004ad14]
cmp qword [0x14004c5f8], r15
cmove eax, r15d
mov dword [0x14004ad14], eax
lea rcx, [0x14004c850]
mov byte [0x14004b0f1], r15b
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x14004c5f4], r15d
jle 0x1400041d9
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [0x14004c5f8]
test rcx, rcx
je 0x140004253
cmp dword [0x14004c5f4], 1
je 0x14000426a
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x70]
mov r8d, edi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000426a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x14000426a
mov rcx, qword [0x14004c5f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14004c5f8], r15
test bl, bl
je 0x14000426a
cmp dword [0x14004c5f4], r15d
je 0x140004244
lea rcx, str.LogData0_Detected_closed_pipe___trying_to_open_again__Module:_MCUMS_n
call fcn.140003de0
mov al, 1
xor bl, bl
mov byte [0x14004b0f1], al
jmp 0x140004172
mov eax, dword [0x14004ad14]
cmp dword [0x14004c5f4], 1
cmovne eax, r15d
mov dword [0x14004ad14], eax
mov r15, qword [rsp + 0xd48]
mov rcx, qword [rsp + 0xd30]
xor rcx, rsp
call fcn.14000e2f0
add rsp, 0xd50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140006ce0
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x1460
call fcn.1400143e0
sub rsp, rax
mov rax, qword [0x140049070]
xor rax, rsp
mov qword [rsp + 0x1450], rax
lea r8, [rsp + 0x24]
lea rcx, [rsp + 0x30]
mov edx, 0x1000
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
mov eax, dword [rsp + 0x24]
xor edi, edi
shr eax, 2
mov esi, eax
test eax, eax
jle 0x140006e46
mov qword [rsp + 0x1470], rbx
nop word [rax + rax]
mov r8d, dword [rsp + rdi*4 + 0x30]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140006e36
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140006e2d
cmp dword [rsp + 0x20], 0x103
jne 0x140006e2d
lea rdx, [rsp + 0x1030]
mov r8d, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1030]
mov edx, 0x5c
call fcn.14000f790
test rax, rax
je 0x140006de7
lea r8, [rax + 2]
or rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], 0
jne 0x140006dc1
inc eax
cmp eax, 0x104
jg 0x140006de7
lea rcx, [rsp + 0x1240]
mov edx, 0x104
call fcn.14000f944
lea rdx, str.WiDiApp.exe
lea rcx, [rsp + 0x1240]
call fcn.14000e934
test eax, eax
jne 0x140006e36
mov eax, 1
mov rbx, qword [rsp + 0x1470]
mov rcx, qword [rsp + 0x1450]
xor rcx, rsp
call fcn.14000e2f0
mov rsi, qword [rsp + 0x1478]
add rsp, 0x1460
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc rdi
cmp rdi, rsi
jl 0x140006d40
xor eax, eax
jmp 0x140006e04
xor eax, eax
jmp 0x140006e0c
Function at 0x1400075f0
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push r14
mov eax, 0x1160
call fcn.1400143e0
sub rsp, rax
mov rax, qword [0x140049070]
xor rax, rsp
mov qword [rsp + 0x1150], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x40]
mov edx, 0x1000
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x14000777e
mov qword [rsp + 0x1178], rbp
mov ebp, dword [rsp + 0x20]
mov qword [rsp + 0x1180], rsi
shr ebp, 2
xor esi, esi
test ebp, ebp
je 0x14000776e
mov qword [rsp + 0x1170], rbx
mov qword [rsp + 0x1188], rdi
lea rbx, [rsp + 0x40]
nop dword [rax]
mov edi, dword [rbx]
test edi, edi
je 0x14000772a
mov rax, qword [str._unknown_]
lea rcx, [rsp + 0x104a]
xor edx, edx
mov qword [rsp + 0x1040], rax
movzx eax, word [0x140042138]
mov r8d, 0xfa
mov word [rsp + 0x1048], ax
call fcn.140012080
mov r8d, edi
xor edx, edx
mov ecx, 0x411
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14000772a
lea r9, [rsp + 0x28]
lea rdx, [rsp + 0x30]
mov r8d, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1400076fe
mov rdx, qword [rsp + 0x30]
lea r8, [rsp + 0x1040]
mov r9d, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
lea rdx, [rsp + 0x1040]
lea rcx, [0x140042140]
mov r8d, 0xc
call fcn.14000f9c0
test eax, eax
jne 0x140007721
cmp dword [rbx], r14d
jne 0x14000773a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
add rbx, 4
cmp esi, ebp
jb 0x140007670
jmp 0x14000775e
lea rdx, [rsp + 0x24]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [rsp + 0x24]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x1170]
mov rdi, qword [rsp + 0x1188]
mov rbp, qword [rsp + 0x1178]
mov rsi, qword [rsp + 0x1180]
mov rcx, qword [rsp + 0x1150]
xor rcx, rsp
call fcn.14000e2f0
add rsp, 0x1160
pop r14
ret
Function at 0x1400077a0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x1a0
mov rax, qword [0x140049070]
xor rax, rsp
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWAREIntel_CorporationIntel_Miracast
xor ebx, ebx
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007948
mov rcx, qword [rsp + 0x30]
lea rax, [0x14004c668]
lea r9d, [rbx + 4]
lea rdx, str.ShowACursor
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
lea rax, [0x14004c66c]
lea r9d, [rbx + 4]
lea rdx, str.ShowContext
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x12a
mov word [rsp + 0x60], bx
call fcn.140012080
xor eax, eax
mov word [rsp + 0x38], bx
mov qword [rsp + 0x3a], rax
mov qword [rsp + 0x42], rax
mov qword [rsp + 0x4a], rax
mov qword [rsp + 0x52], rax
mov word [rsp + 0x5a], ax
lea rdx, [0x14004c7b8]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], al
jne 0x140007890
lea rcx, [rsp + 0x38]
call fcn.14000fc1c
lea r9, [rsp + 0x38]
lea r8, str.SOFTWAREIntel_CorporationIntel_MiracastWinNextAgentProfiles
lea rdx, str._s_s
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007948
mov rcx, qword [rsp + 0x30]
lea rax, [0x14004c670]
lea rdx, str.OverscanComp
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
lea rax, [0x14004c674]
lea rdx, str.GameModePref
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140007958
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14000e2f0
add rsp, 0x1a0
pop rbx
ret
Function at 0x140008d90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov rbx, qword [0x14004c7e8]
lea rax, [rsp + 0x40]
lea r8, [0x140008ae0]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov r9, rbx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x698], rax
test rax, rax
je 0x140008e01
mov rcx, qword [rbx + 0x238]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140008df4
mov eax, 1
add rsp, 0x30
pop rbx
ret
mov edx, 1
mov rcx, rbx
call fcn.14000a180
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x14000a180
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov dword [rcx + 0x218], edx
mov rcx, qword [rcx + 0x690]
xor edi, edi
test rcx, rcx
je 0x14000a1ef
cmp edx, 1
jne 0x14000a1ef
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000a1db
mov rcx, qword [rbx + 0x690]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, dword [rsp + 0x38]
mov rcx, qword [rbx + 0x690]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x690]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x690], rdi
mov rcx, qword [rbx + 0x698]
test rcx, rcx
je 0x14000a24d
cmp dword [rbx + 0x218], 1
jne 0x14000a24d
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000a239
mov rcx, qword [rbx + 0x698]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, dword [rsp + 0x38]
mov rcx, qword [rbx + 0x698]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x698]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x698], rdi
mov rcx, qword [rbx + 0x6b0]
test rcx, rcx
je 0x14000a265
call fcn.14000f48c
mov qword [rbx + 0x6b0], rdi
mov rcx, qword [rbx + 0x6a0]
test rcx, rcx
je 0x14000a27e
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbx + 0x6a0], rdi
mov rcx, qword [rbx + 0x6a8]
test rcx, rcx
je 0x14000a297
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbx + 0x6a8], rdi
mov rcx, qword [rbx + 0x230]
test rcx, rcx
je 0x14000a2a9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x228]
test rcx, rcx
je 0x14000a2bb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x220]
test rcx, rcx
je 0x14000a2cd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x208]
test rcx, rcx
je 0x14000a2df
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x210]
test rcx, rcx
je 0x14000a2f1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000bee0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140049070]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rcx, str.WiDiApp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rsi, str.C:Program_FilesIntel_CorporationIntel_WiDiWiDiApp.exe
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov rbx, rax
call fcn.140010354
lea r9, str.STR:__s
lea r8, str.MCUMS
lea rcx, str.D:qbworkspace7389p4gengfx_mc_umdmainlineincludeIntelWiDiAttribution.h
mov edx, 0x25
mov qword [rsp + 0x20], rsi
mov edi, eax
call fcn.1400043f0
mov r9d, 6
lea rax, str.OnClick__hMod___lx__n___d
mov dword [rsp + 0x30], edi
lea r8, str.MCUMS
lea edx, [r9 + 0x21]
lea rcx, str.D:qbworkspace7389p4gengfx_mc_umdmainlineincludeIntelWiDiAttribution.h
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.1400044f0
test rbx, rbx
jne 0x14000bfc8
test edi, edi
jne 0x14000bfc8
lea rax, str.OnClick__Attempt_to_launch__s
lea r9d, [rbx + 6]
lea r8, str.MCUMS
lea edx, [rbx + 0x2a]
lea rcx, str.D:qbworkspace7389p4gengfx_mc_umdmainlineincludeIntelWiDiAttribution.h
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.140004580
lea r8, str.WiDiApp
lea ecx, [rbx + 1]
xor r9d, r9d
mov rdx, rsi
call fcn.1400101e8
jmp 0x14000bfed
lea r8, str.http:__www.intel.com_go_wirelessdisplay
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14000e2f0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000c800
Capabilities:
Create process on windows
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x140049070]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor edi, edi
lea rsi, str.D:qbworkspace7389p4gengfx_mc_umdmainlineincludeIntelWiDiAttribution.h
lea r14, str.MCUMS
cmp dword [0x14004ad14], edi
mov qword [rsp + 0x60], rdi
je 0x14000c8b9
lea rax, str.IntelWiDiAttribution
lea r9, [0x1400405f8]
lea rcx, [rbp + 0x40]
or r8, 0xffffffffffffffff
mov edx, pe_nt_image_headers64
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x54], 7
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x68], 0x112
mov qword [rsp + 0x78], r14
call fcn.14000e4b0
lea rax, [rbp + 0x40]
lea r9d, [rdi + 7]
mov r8, r14
mov edx, 0x112
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140004030
jmp 0x14000c8d9
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x54], 6
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x78], rdi
lea r15, str.C:Program_FilesIntel_CorporationIntel_WiDiWiDiToast.exe
lea rdx, [rbp + 0x10]
mov rcx, r15
call fcn.140010354
lea r9, str.TSTAT__s____d
mov r8, r14
mov dword [rsp + 0x28], eax
mov edx, 0x117
mov rcx, rsi
mov qword [rsp + 0x20], r15
mov ebx, eax
call fcn.1400043f0
test ebx, ebx
je 0x14000c975
lea rcx, str.IntelAttributionWindow
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14000c9f4
movsd xmm0, qword [0x140043ce8]
lea rax, [rbp - 0x80]
lea r8, [0x14000c480]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
movsd qword [0x14004c878], xmm0
xor ecx, ecx
mov dword [0x14004c7dc], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14000c9f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000c9f4
xor eax, eax
lea rcx, [rbp - 0x60]
xor edx, edx
lea r8d, [rax + 0x68]
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
call fcn.140012080
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [0x140043570]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor edx, edx
mov rcx, r15
mov dword [rsp + 0x28], 0x20
mov dword [rbp - 0x60], 0x68
mov dword [rsp + 0x20], edi
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x18], rdi
mov word [rbp - 0x1e], di
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x50], rdi
mov dword [rbp - 0x24], 0x40
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
lea rcx, [rsp + 0x50]
call fcn.140004690
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.14000e2f0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret