joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009a2f0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x140113980]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x30], 0xc15730e2
mov dword [rsp + 0x34], 0x7f0725e3
mov byte [rsp + 0x38], 0
and qword [rsp + 0x40], 0
mov byte [rsp + 0x48], 0
mov eax, dword [0x140114d30]
cmp eax, dword [rsp + 0x30]
je 0x14009a45e
mov ecx, dword [rsp + 0x34]
xor eax, eax
lock cmpxchg dword [0x140114d30], ecx
jne 0x14009a496
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jne 0x14009a3a9
cmp byte [rsp + 0x48], bl
jne 0x14009a369
lea rcx, [rsp + 0x48]
call fcn.14009a1c0
lea r8, [rsp + 0x48]
xor edx, edx
mov ecx, 0x100002
call qword [sym.imp.KERNEL32.dll_OpenEventA]
nop dword [rax + rax]
mov rbx, rax
mov rcx, qword [rsp + 0x40]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14009a39f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov qword [rsp + 0x40], rbx
test rbx, rbx
je 0x14009a3b9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
nop dword [rax + rax]
nop
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
nop dword [rax + rax]
mov dword [0x140113b00], eax
cmp byte [rsp + 0x38], 0
jne 0x14009a3de
lock inc dword [0x140114d34]
mov byte [rsp + 0x38], 1
mov eax, dword [rsp + 0x30]
xchg dword [0x140114d30], eax
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jne 0x14009a44f
mov eax, dword [0x140114d34]
cmp eax, 1
jle 0x14009a45e
cmp byte [rsp + 0x48], bl
jne 0x14009a40d
lea rcx, [rsp + 0x48]
call fcn.14009a1c0
lea r9, [rsp + 0x48]
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
nop dword [rax + rax]
mov rbx, rax
mov rcx, qword [rsp + 0x40]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14009a445
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov qword [rsp + 0x40], rbx
test rbx, rbx
je 0x14009a463
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x40]
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14009a47c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400c4a70
add rsp, 0xb0
pop rbx
ret
cmp byte [rsp + 0x38], 0
jne 0x14009a511
lock inc dword [0x140114d34]
mov byte [rsp + 0x38], 1
mov eax, dword [0x140114d30]
cmp eax, dword [rsp + 0x30]
je 0x14009a45e
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x14009a516
cmp byte [rsp + 0x48], cl
jne 0x14009a4cf
lea rcx, [rsp + 0x48]
call fcn.14009a1c0
lea r9, [rsp + 0x48]
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
nop dword [rax + rax]
mov rbx, rax
mov rcx, qword [rsp + 0x40]
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x14009a507
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov qword [rsp + 0x40], rbx
jmp 0x14009a32b
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
nop dword [rax + rax]
jmp 0x14009a32b
Function at 0x1400a10b0
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, r9
mov rcx, rdi
mov rdx, r8
call qword [sym.imp.ADVAPI32.dll_EqualSid]
nop dword [rax + rax]
xor ebx, ebx
test eax, eax
jne 0x1400a10f3
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x1400a10f5
mov bl, 1
mov rsi, qword [rsp + 0x38]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400c1404
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x20
and dword [rsp + 0x30], 0
mov ecx, 5
call fcn.1400a5f10
mov ebx, 2
lea r8, [rsp + 0x30]
mov rcx, rax
mov r9d, ebx
lea edx, [rbx + 0x20]
call sub.KERNEL32.dll_GetLocaleInfoW
mov eax, dword [rsp + 0x30]
cmp ax, 0x30
je 0x1400c1454
cmp ax, 0x31
jne 0x1400c1448
mov ebx, 1
jmp 0x1400c1454
xor ebx, ebx
cmp ax, 0x32
lea ecx, [rbx + 3]
cmove ebx, ecx
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1400c2a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
mov ebp, 0x7ff
movzx ecx, word [rcx + 6]
mov esi, edx
shr cx, 4
and cx, bp
cmp cx, bp
jne 0x1400c2ac1
test byte [rbx + 6], 0xf
jne 0x1400c2ab4
xor edi, edi
cmp word [rbx + 4], di
jne 0x1400c2ab4
cmp word [rbx + 2], di
jne 0x1400c2ab4
cmp word [rbx], di
jne 0x1400c2ab4
lea esi, [rdi + 1]
jmp 0x1400c2ab9
mov esi, 2
movzx eax, si
jmp 0x1400c2cb9
xor edi, edi
test cx, cx
jne 0x1400c2adc
mov rcx, rbx
call fcn.1400c4348
movzx ecx, ax
cmp di, ax
jl 0x1400c2cb6
movsx edx, cx
test esi, esi
jle 0x1400c2b0c
sub ebp, edx
cmp ebp, esi
jg 0x1400c2b0c
movsd xmm0, qword [0x140113940]
cmp word [rbx + 6], di
jge 0x1400c2afe
xorps xmm0, xmmword [0x1400ed4c0]
movsd qword [rbx], xmm0
mov eax, 1
jmp 0x1400c2cb9
movzx r11d, word [rbx + 6]
mov eax, edx
neg eax
cmp eax, esi
jge 0x1400c2b39
add si, cx
mov eax, 0x800f
shl si, 4
and r11w, ax
or si, r11w
mov word [rbx + 6], si
or eax, 0xffffffff
jmp 0x1400c2cb9
movzx r15d, r11w
lea ebp, [rsi - 1]
and r11w, 0xf
mov r13d, 0x8000
mov r12d, 0x10
and r15w, r13w
or r11w, r12w
add ebp, edx
cmp ebp, 0xffffffcb
jl 0x1400c2cab
test ebp, ebp
jns 0x1400c2cab
lea esi, [r12 - 0xf]
movzx r14d, di
cmp bp, 0xfff0
jg 0x1400c2bce
movzx edx, word [rbx + 4]
mov eax, 0xfff0
movzx r8d, word [rbx + 2]
sub ax, bp
shr ax, 4
add ax, si
movzx ecx, ax
movzx eax, cx
shl ax, 4
add bp, ax
test r14w, r14w
mov eax, edi
setne al
movzx r14d, ax
or r14w, word [rbx]
mov word [rbx], r8w
movzx r8d, dx
movzx edx, r11w
mov r11d, edi
sub rcx, rsi
jne 0x1400c2ba0
mov word [rbx + 4], dx
mov word [rbx + 2], r8w
neg bp
je 0x1400c2c4d
movzx r8d, word [rbx]
mov eax, edi
movzx r9d, word [rbx + 2]
movzx edx, r8w
movsx r10d, bp
sub r12d, r10d
mov ecx, r12d
shl dx, cl
test r14w, r14w
movzx r14d, dx
movzx edx, word [rbx + 4]
setne al
or r14w, ax
movzx eax, r9w
shl ax, cl
movzx ecx, bp
shr r8w, cl
mov ecx, r12d
or ax, r8w
mov word [rbx], ax
movzx eax, dx
shl ax, cl
movzx ecx, bp
shr r9w, cl
mov ecx, r12d
or ax, r9w
mov word [rbx + 2], ax
movzx eax, r11w
shl ax, cl
movzx ecx, bp
shr dx, cl
mov ecx, r10d
or ax, dx
mov word [rbx + 4], ax
shr r11w, cl
or r11w, r15w
mov word [rbx + 6], r11w
cmp r13w, r14w
jb 0x1400c2c63
jne 0x1400c2c82
test byte [rbx], sil
je 0x1400c2c82
add word [rbx], si
jne 0x1400c2c82
add word [rbx + 2], si
jne 0x1400c2c82
add word [rbx + 4], si
jne 0x1400c2c82
add r11w, si
mov word [rbx + 6], r11w
jmp 0x1400c2b31
cmp r11w, r15w
jne 0x1400c2b31
cmp word [rbx + 4], di
jne 0x1400c2b31
cmp word [rbx + 2], di
jne 0x1400c2b31
movzx eax, word [rbx]
neg ax
sbb ax, ax
jmp 0x1400c2cb9
mov word [rbx + 6], r15w
mov dword [rbx + 2], edi
mov word [rbx], di
movzx eax, di
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400c4850
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x1401156d0], rbx
je 0x1400c489c
cmp rax, rbx
jne 0x1400c488f
mov ebx, 1
mov esi, ebx
jmp 0x1400c48a1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400c4874
mov ebx, 1
mov eax, dword [0x1401156d8]
cmp eax, ebx
jne 0x1400c48b7
mov ecx, 0x1f
call fcn.1401ae000
jmp 0x1400c4926
mov eax, dword [0x1401156d8]
test eax, eax
jne 0x1400c4920
mov dword [0x1401156d8], ebx
lea r15, [0x1400d77f8]
lea rdi, [0x1400d77e0]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x1400c4912
test eax, eax
jne 0x1400c4916
cmp qword [rdi], 0
je 0x1400c4907
movabs r10, 0xd30527475e523070
mov rax, qword [rdi]
mov rcx, qword [0x1400d71e8]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x1400c48de
test eax, eax
je 0x1400c4926
mov eax, 0xff
jmp 0x1400c4a0c
mov dword [0x140114358], ebx
mov eax, dword [0x1401156d8]
cmp eax, ebx
jne 0x1400c494d
lea rdx, [0x1400d77d8]
lea rcx, [0x1400d7200]
call sub.msvcrt.dll__initterm
mov dword [0x1401156d8], 2
test esi, esi
jne 0x1400c495a
xor eax, eax
xchg qword [0x1401156d0], rax
cmp qword [0x1401156f0], 0
je 0x1400c4998
lea rcx, [0x1401156f0]
call fcn.1400c5080
test eax, eax
je 0x1400c4998
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1401156f0]
mov r9, qword [0x1400d71e8]
call r9
mov r8, qword [0x140114370]
mov rdx, qword [0x140114368]
mov ecx, dword [0x140114360]
call fcn.140003a80
mov dword [0x140114354], eax
cmp dword [0x140114378], 0
jne 0x1400c49c8
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140114358], 0
jne 0x1400c49dd
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140114354]
jmp 0x1400c4a0c
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400c5114
add rsp, 0x28
jmp 0x1400c4850

Function at 0x1400c4f6c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400c4fb8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400c4fb0
cmp dword [rcx + 0x3c], edx
jl 0x1400c4fb0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400c4fb0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400c4fb8
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1400c50e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400c5108
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400c5108
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001380
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, rcx
mov qword [rsp + 0x48], rcx
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
mov r8d, 3
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
xorps xmm0, xmm0
cmp rax, 0xffffffffffffffff
jne 0x140001402
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 0xf
mov byte [rsi], r15b
jmp 0x140001543
movups xmmword [rsp + 0x60], xmm0
lea rax, [0x140001570]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x54], r15
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x44], r15d
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
lea r8, [rsp + 0x50]
mov edx, 0x2d1400
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140001483
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 0xf
mov byte [rsi], al
jmp 0x140001534
mov edi, dword [rsp + 0x4c]
mov ecx, edi
call fcn.140002894
mov r14, rax
mov r8d, edi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r14
mov r9d, 0xc
lea r8, [rsp + 0x50]
mov edx, 0x2d1400
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400014f7
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 0xf
mov byte [rsi], al
mov rcx, r14
call fcn.140002850
nop
jmp 0x140001534
mov eax, dword [r14 + 0x18]
test eax, eax
jne 0x14000151e
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 0xf
mov byte [rsi], al
mov rcx, r14
call fcn.140002850
nop
jmp 0x140001534
lea rdx, [r14 + rax]
mov rcx, rsi
call fcn.140001610
nop
mov rcx, r14
call fcn.140002850
nop
test rbp, rbp
je 0x140001543
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, rsi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140002830
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400031b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400031fa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400031fa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400031fa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400031fa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400031fa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400031fc
xor al, al
add rsp, 0x28
ret
Function at 0x14001943c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x1400306f8], rbx
je 0x1400194a3
cmp rax, rbx
jne 0x140019496
mov ebx, 1
mov esi, ebx
jmp 0x1400194a8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14001947b
mov ebx, 1
mov eax, dword [0x140030700]
cmp eax, ebx
jne 0x1400194c0
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14001952c
mov eax, dword [0x140030700]
test eax, eax
jne 0x140019521
mov dword [0x140030700], ebx
lea r15, [0x14001dcb8]
lea rdi, [0x14001dca0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x140019513
test eax, eax
jne 0x140019517
cmp qword [rdi], r14
je 0x140019508
mov rax, qword [rdi]
mov rcx, qword [0x14001dc18]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1400194ea
test eax, eax
je 0x140019527
mov eax, 0xff
jmp 0x140019682
mov dword [0x14002ffb4], ebx
mov edi, 0x1f
mov eax, dword [0x140030700]
cmp eax, ebx
jne 0x140019553
lea rdx, [0x14001dc98]
lea rcx, [0x14001dc20]
call sub.msvcrt.dll__initterm
mov dword [0x140030700], 2
test esi, esi
jne 0x140019561
mov rax, r14
xchg qword [0x1400306f8], rax
cmp qword [0x140030718], r14
je 0x140019594
lea rcx, [0x140030718]
call fcn.140019a50
test eax, eax
je 0x140019594
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140030718]
mov r9, qword [0x14001dc18]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x1400195ad
mov eax, 0xff
jmp 0x140019682
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x140019633
test ax, ax
je 0x1400195c8
test edx, edx
jne 0x140019633
sub ax, bx
cmp ax, di
ja 0x1400195de
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x1400195c8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140003e4c
mov dword [0x14002ffb0], eax
cmp dword [0x14002ffd0], r14d
jne 0x14001961c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14002ffb4], r14d
jne 0x140019631
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14002ffb0]
jmp 0x140019682
cmp ax, 0x22
jne 0x140019647
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400195b6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140148000
add rsp, 0x28
jmp 0x14001943c
Function at 0x140003a00
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [0x1400b84e0], 0
je 0x14001aa16
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call sym.spoolsv.exe_PrvRevertToPrinterSelf
xor edx, edx
lea r8, str.RouterPreInitEvent
mov rdi, rax
lea ecx, [rdx + 2]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenEventW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14001aaac
mov rax, qword [0x1400b62f8]
lea rcx, [0x1400b62f8]
cmp rax, rcx
je 0x14001aa80
test byte [rax + 0x44], 0x20
je 0x14001aa80
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x1400b62f8]
lea edx, [rbx + 0x15]
mov r9d, eax
lea r8, [0x14009bad0]
mov rcx, qword [rcx + 0x38]
call fcn.14002f358
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
xor r8d, r8d
lea rcx, [0x14009a6b8]
mov edx, eax
call fcn.140051f08
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
test rdi, rdi
je 0x14001aaf3
mov rcx, rdi
call sym.spoolsv.exe_PrvImpersonatePrinterClient
test eax, eax
jne 0x14001aaf3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edx, eax
mov ecx, 0x69
call fcn.140051b00
or edx, 0xffffffff
call fcn.1400570ec
nop
jmp 0x140003a17
Function at 0x140009ff0
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140028c3f
cmp dword [rcx], 0x6060
jne 0x140028c3f
mov rax, qword [0x1400b84d8]
cmp qword [rcx + 8], rax
jne 0x140028bb6
mov rcx, qword [rcx + 0x10]
mov rax, qword [rax + 0x2b0]
call qword [0x140097d68]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rcx + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x140028c35
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
or qword [rbx + 0x38], 0xffffffffffffffff
cmp qword [rbx + 0x40], 0
je 0x140028c35
call sym.spoolsv.exe_PrvRevertToPrinterSelf
mov rcx, qword [rbx + 0x40]
mov rdi, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x140028c0a
mov rcx, qword [rbx + 0x40]
lea r8d, [rax + 4]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
nop dword [rax + rax]
test rdi, rdi
je 0x140028c17
mov rcx, rdi
call sym.spoolsv.exe_PrvImpersonatePrinterClient
mov r8, qword [rbx + 0x40]
xor edx, edx
mov rcx, qword [0x1400b8478]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
and qword [rbx + 0x40], 0
mov eax, 1
jmp 0x14000a034
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
jmp 0x14000a034
Function at 0x14000bf48
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1400b67a8]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor ebp, ebp
mov rsi, rcx
mov qword [rsp + 0x38], rbp
mov ebx, ebp
test rcx, rcx
je 0x14000c0b4
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bp
jne 0x14000bf8a
inc rax
cmp rax, 0x207
jae 0x14000c0b4
mov ecx, 0x438
call sym.spoolsv.exe_PrvDllAllocSplMem
mov rdi, rax
test rax, rax
je 0x14000c0b4
lea rcx, [rsp + 0x40]
call fcn.14000c218
lea r8, str.PrintersConnections
mov edx, 0x21c
mov rcx, rdi
call fcn.14000c1d0
mov eax, 0x5c
lea rdx, [rdi + 0x2a]
mov r8d, 0x207
mov word [rdi + 0x28], ax
mov rcx, rsi
call sym.spoolsv.exe_PrvFormatPrinterForRegistryKey
mov ecx, 0x20019
call sym.spoolsv.exe_PrvSplGetClientUserHandle
mov rsi, rax
test rax, rax
je 0x14000c092
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000c083
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x140099970]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140028e96
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [0x1400b8478]
mov r8, rdi
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
lea rcx, [rsp + 0x40]
call fcn.14000c0e8
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140013380
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rbx, qword [0x1400b84d8]
jmp 0x140028ebf
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x14000c072
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140028e9f
jmp 0x14000c072

Function at 0x14000c0e8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, qword [rcx]
mov rbx, rcx
cmp rdx, 0xffffffffffffffff
je 0x14000c115
test rdx, rdx
je 0x14000c115
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetThreadToken]
nop dword [rax + rax]
test eax, eax
je 0x140028eca
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14000c580
mov ecx, 1
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
Function at 0x14000cdac
Capabilities:
Delete file
Move file

Disassembly:
test rcx, rcx
je 0x14000ce46
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x1400b81b8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rax, qword [rbx + 0x20]
test rax, rax
jne 0x140029bca
or edx, 0xffffffff
mov rcx, rbx
call fcn.14000ce6c
lea rcx, [rbx + 0x18]
cmp qword [rcx], 0
jne 0x14000ce5f
lea rcx, [0x1400b81b8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x38]
cmp rcx, 0xffffffffffffffff
jne 0x140029bd8
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x140029bea
mov r8, qword [rbx + 0x48]
test r8, r8
jne 0x14000ce48
mov rcx, qword [0x1400b8478]
mov r8, rbx
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
add rsp, 0x20
pop rbx
ret
mov rcx, qword [0x1400b8478]
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
jmp 0x14000ce29
call fcn.140009024
jmp 0x14000cdf2
and qword [rax + 8], 0
mov rax, qword [rax + 0x10]
jmp 0x14000cdd4
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
nop
jmp 0x14000ce13
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x140029c10
mov rcx, qword [rbx + 0x40]
lea r8d, [rax + 4]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
nop dword [rax + rax]
mov r8, qword [rbx + 0x40]
xor edx, edx
mov rcx, qword [0x1400b8478]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
and qword [rbx + 0x40], 0
jmp 0x14000ce20