joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002dfa0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
sub rsp, 0x200
xor r13d, r13d
test r9, r9
mov rbx, r9
mov ebp, r8d
mov rsi, rdx
mov r12, rcx
je 0x14002dfcd
mov qword [r9], r13
test rdx, rdx
je 0x14002e0da
cmp byte [rdx], r13b
je 0x14002e0da
lea rcx, [rsp + 0xf0]
xor edx, edx
mov r8d, 0x104
mov qword [rsp + 0x220], rdi
call fcn.14007cd30
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
mov rdx, rsi
repne scasb al, byte [rdi]
mov eax, 0x103
not rcx
sub rcx, 1
cmp rcx, 0x104
cmova rcx, rax
mov r8, rcx
lea rcx, [rsp + 0xf0]
call fcn.14007cf10
lea rcx, [rsp + 0xf0]
call fcn.14000cbb0
xor edx, edx
lea rcx, [rsp + 0x80]
lea r8d, [rdx + 0x68]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], rdx
call fcn.14007cd30
test r12, r12
mov rdi, qword [rsp + 0x220]
mov dword [rsp + 0x80], 0x68
je 0x14002e0f3
lea rax, [rsp + 0x60]
lea r8, [rsp + 0xf0]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x80]
xor edx, edx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], 0x20
mov rcx, r12
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x14002e13b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.FAILURE:_Failed_to_CreateProcess_for__s
mov rdx, rsi
call fcn.14000cbb0
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rsi
ret
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0xf0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
xor ecx, ecx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14002e0cb
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x14002e159
test rbx, rbx
je 0x14002e159
mov rax, qword [rsp + 0x60]
mov qword [rbx], rax
jmp 0x14002e0da
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002e0da
Function at 0x14002e800
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov eax, 0x3158
call fcn.1400a12b0
sub rsp, rax
mov rdi, r9
mov esi, r8d
mov r14d, edx
mov r15, rcx
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.140067690
xor ebx, ebx
lea rcx, [rsp + 0x41]
cmp eax, 0xffffffff
mov r8d, 0x103
mov qword [rdi], r13
setne bl
xor edx, edx
mov byte [rsp + 0x40], r13b
call fcn.14007cd30
lea r8, [rsp + 0x28]
lea rcx, [rsp + 0x150]
mov edx, 0x1000
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x14002e898
lea rcx, str.g_pfnEnumProcesses:_Failed
call fcn.14000cbb0
xor eax, eax
add rsp, 0x3158
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret
mov edi, dword [rsp + 0x28]
movsxd rax, ebx
mov qword [rsp + 0x3150], r12
shr edi, 2
mov r12d, r13d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x24], edi
je 0x14002ea58
mov qword [rsp + 0x3190], rbp
lea rbp, [rsp + 0x150]
nop
test r13d, r13d
jne 0x14002ea50
test rax, rax
je 0x14002e8f3
mov ecx, dword [rbp]
call fcn.140067690
cmp eax, dword [rsp + 0x31b8]
jne 0x14002ea1a
mov r8d, dword [rbp]
mov edx, esi
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rsi, rax
je 0x14002ea13
lea rcx, [rsp + 0x1158]
xor ebx, ebx
xor edx, edx
mov r8d, 0x1ff8
mov qword [rsp + 0x1150], rbx
call fcn.14007cd30
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x1150]
mov r8d, 0x2000
mov rcx, rsi
mov dword [rsp + 0x20], ebx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x14002e9c6
test dword [rsp + 0x20], 0xfffffff8
jbe 0x14002e9c6
lea rdi, [rsp + 0x1150]
nop
nop
nop
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x104
call fcn.14007cd30
mov rdx, qword [rdi]
lea r8, [rsp + 0x40]
mov r9d, 0x104
mov rcx, rsi
call sub.PSAPI.DLL_GetModuleBaseNameA
test eax, eax
je 0x14002e9b0
lea rcx, [rsp + 0x40]
mov r8, r14
mov rdx, r15
call fcn.14007f2bc
test eax, eax
je 0x14002e9d8
mov eax, dword [rsp + 0x20]
add ebx, 1
add rdi, 8
shr eax, 3
cmp ebx, eax
jb 0x14002e970
mov edi, dword [rsp + 0x24]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rsp + 0x31a0]
jmp 0x14002ea1a
mov rbx, qword [rsp + 0x31a8]
mov edx, dword [rsp + 0x31b0]
mov rcx, rsi
mov r8, rbx
mov r13d, 1
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14002ea31
mov edi, dword [rsp + 0x24]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rsp + 0x31a0]
jmp 0x14002ea1a
mov esi, dword [rsp + 0x31a0]
add r12d, 1
add rbp, 4
cmp r12d, edi
jae 0x14002ea50
mov rax, qword [rsp + 0x30]
jmp 0x14002e8d0
lea rcx, str.OpenProcessToken:_Failed
call fcn.14000cbb0
mov rcx, rsi
mov qword [rbx], 0
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x3190]
mov eax, r13d
mov r12, qword [rsp + 0x3150]
add rsp, 0x3158
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret
Function at 0x14002ea80
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x220
test rcx, rcx
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
je 0x14002ebdb
test rdx, rdx
je 0x14002ebdb
test r8, r8
je 0x14002ebdb
lea rcx, [rsp + 0x120]
xor edx, edx
mov r8d, 0x100
call fcn.14007cd30
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x100
call fcn.14007cd30
mov rcx, qword [rdi]
mov dword [rsp + 0x230], 0x100
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x14002eb3c
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x120]
mov dword [rsp + 0x230], 0x100
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x14002eb26
lea rcx, str.IsSameUserByTokens:_GetUserName_failed
jmp 0x14002ebe2
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x14002eb3c
lea rcx, str.Failed_to_revert_1st.1
call fcn.14000cbb0
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x14002eb81
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x230], 0x100
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x14002eb1a
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x14002eb81
lea rcx, str.Failed_to_revert_1st.2
call fcn.14000cbb0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x120]
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x120]
xor ebx, ebx
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x20]
call fcn.14007f2bc
mov edx, 1
lea rdi, [rsp + 0x20]
test eax, eax
cmove ebx, edx
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x20]
not rcx
lea r8, [rcx - 1]
mov rcx, rsi
call fcn.14007cf10
mov eax, ebx
jmp 0x14002ebe9
lea rcx, str.IsSameUserByTokens:_bad_inout
call fcn.14000cbb0
xor eax, eax
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400311f0
Capabilities:
Get session user name
Impersonate user

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x130
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x104
call fcn.14007cd30
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x140031241
lea rcx, str.ImpersonateCurrentLogontUser:_ImpersonateLoggedOnUser_to_get_username_failed
call fcn.14000cbb0
xor eax, eax
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x150], 0x104
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x140031275
lea rcx, str.ImpersonateCurrentLogontUser:_RevertToSelf_failed_after_get_username
call fcn.14000cbb0
xor eax, eax
mov rdx, rbx
mov rcx, rdi
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rax
lea rax, [rsp + 0x20]
mov dword [rbx], 0x38
mov qword [rbx + 8], rax
call qword [sym.imp.USERENV.dll_LoadUserProfileA]
test eax, eax
jne 0x1400312d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Fail_to_LoadUserProfile___d
mov edx, eax
call fcn.14000cbb0
xor eax, eax
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x14003130d
lea rcx, str.ImpersonateCurrentLogontUser:_ImpersonateLoggedOnUser_to_get_username_failed
call fcn.14000cbb0
mov rdx, qword [rbx + 0x30]
mov rcx, rdi
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
xor eax, eax
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
mov eax, 1
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret

Function at 0x140031e20
Capabilities:
Create thread

Disassembly:
test rcx, rcx
je 0x140031eeb
push rdi
sub rsp, 0x30
mov rdi, rcx
xor ecx, ecx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r8, [0x140031d70]
mov qword [rsp + 0x48], rbx
mov r9, rdi
xor edx, edx
mov qword [rsp + 0x50], rsi
mov esi, dword [0x1400e18dc]
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x40], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov rbx, rax
jne 0x140031e9f
lea rcx, str.FAILURE:_EEUCreateThread:_Failed_to_create_thread.
call fcn.14000cbb0
mov rcx, rdi
call fcn.14007ceec
lea rcx, str.RunSetSelectDevicesOnMobileThread._SetSelectDevicesOnMobileThread_Creation_failed
call fcn.14000cbb0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea rcx, str.EEUCreateThread:_success_to_create_thread_0x_x.
mov rdx, rax
call fcn.14000cbb0
test esi, esi
je 0x140031ed3
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x140031ed3
lea rcx, str.EEUCreateThread__Set_thread__0x_x__to_highest_priority
mov rdx, rbx
call fcn.14000cbb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret 0
Function at 0x1400321d0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rdi
push r13
push r15
mov eax, 0x3148
call fcn.1400a12b0
sub rsp, rax
or rcx, 0xffffffffffffffff
xor eax, eax
xor r15d, r15d
lea rdi, str.ati2evxx.exe
xor edx, edx
mov r8d, 0x1000
repne scasb al, byte [rdi]
mov dword [rsp + 0x3178], r15d
mov ebp, r15d
not rcx
lea r13, [rcx - 1]
lea rcx, [rsp + 0x130]
call fcn.14007cd30
lea r8, [rsp + 0x3178]
lea rcx, [rsp + 0x130]
mov edx, 0x1000
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x1400323a5
mov eax, dword [rsp + 0x3178]
shr eax, 2
je 0x1400323a5
mov qword [rsp + 0x3180], rbx
mov qword [rsp + 0x3140], rsi
mov qword [rsp + 0x3138], r12
mov qword [rsp + 0x3130], r14
lea r12, [rsp + 0x130]
mov r14d, eax
nop
nop
mov r8d, dword [r12]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rsi, rax
je 0x140032367
lea rcx, [rsp + 0x1138]
xor edx, edx
mov r8d, 0x1ff8
mov qword [rsp + 0x1130], r15
call fcn.14007cd30
lea r9, [rsp + 0x3170]
lea rdx, [rsp + 0x1130]
mov r8d, 0x2000
mov rcx, rsi
mov dword [rsp + 0x3170], r15d
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x14003235e
test dword [rsp + 0x3170], 0xfffffff8
mov edi, r15d
jbe 0x14003235e
lea rbx, [rsp + 0x1130]
nop
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x104
call fcn.14007cd30
mov rdx, qword [rbx]
lea r8, [rsp + 0x20]
mov r9d, 0x104
mov rcx, rsi
call sub.PSAPI.DLL_GetModuleBaseNameA
test eax, eax
je 0x140032344
lea rdx, str.ati2evxx.exe
lea rcx, [rsp + 0x20]
mov r8d, r13d
call fcn.14007f2bc
test eax, eax
je 0x14003235b
mov eax, dword [rsp + 0x3170]
add edi, 1
add rbx, 8
shr eax, 3
cmp edi, eax
jb 0x140032300
jmp 0x14003235e
add ebp, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add r12, 4
sub r14, 1
jne 0x140032280
mov r14, qword [rsp + 0x3130]
mov r12, qword [rsp + 0x3138]
mov rsi, qword [rsp + 0x3140]
mov rbx, qword [rsp + 0x3180]
mov eax, ebp
add rsp, 0x3148
pop r15
pop r13
pop rdi
pop rbp
ret
mov eax, r15d
add rsp, 0x3148
pop r15
pop r13
pop rdi
pop rbp
ret
Function at 0x140032490
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub rsp, 0x2e8
xor eax, eax
lea rcx, [rsp + 0x70]
xor edx, edx
lea r8d, [rax + 0x68]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.14007cd30
xor edx, edx
lea r8, str.GlobalAti_VariBrightMonitorEvent
lea ecx, [rdx + 2]
mov dword [rsp + 0x70], 0x68
call qword [sym.imp.KERNEL32.dll_OpenEventA]
test rax, rax
je 0x1400324e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x2e8
ret
lea rcx, [rsp + 0xe0]
xor edx, edx
mov r8d, 0x200
call fcn.14007cd30
lea rcx, [rsp + 0xe0]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1400325fd
mov qword [rsp + 0x2e0], rdi
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xe0]
repne scasb al, byte [rdi]
mov rdi, qword [rsp + 0x2e0]
not rcx
lea rax, [rcx + 0x2f]
cmp rax, 0x200
jae 0x1400325fd
lea rcx, [rsp + rcx + 0xdf]
lea r9, str.GlobalAti_VariBrightMonitorEvent
lea r8, str.atibrtmon.exe
lea rdx, [0x1400b3eb8]
call fcn.14007dc1c
lea rdx, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400325cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.VBMonitorProcessStart:_Failed_to_create_VariBright_Monitor_Process._WinAPI_Error_Code__lu_n
mov edx, eax
call fcn.14000cbb0
add rsp, 0x2e8
ret
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rsp + 0x60]
lea rcx, str.VBMonitorProcessStart:_VariBright_Monitor_Process__ProcessID__lu__created_n
call fcn.14000cbb0
add rsp, 0x2e8
ret
lea rcx, str.VBMonitorProcessStart:_Failed_to_retreive_VBMonitor_Full_Name_n
call fcn.14000cbb0
add rsp, 0x2e8
ret
Function at 0x1400328a0
Capabilities:
Enumerate process modules

Disassembly:
push rdi
push r12
push r13
push r15
mov eax, 0x3148
call fcn.1400a12b0
sub rsp, rax
mov r15, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, str.dwm.exe
xor edx, edx
mov r8d, 0x1000
repne scasb al, byte [rdi]
mov dword [rsp + 0x3178], 0
xor r12d, r12d
not rcx
mov dword [r15], eax
lea r13, [rcx - 1]
lea rcx, [rsp + 0x130]
call fcn.14007cd30
lea r8, [rsp + 0x3178]
lea rcx, [rsp + 0x130]
mov edx, 0x1000
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x140032a7e
mov eax, dword [rsp + 0x3178]
shr eax, 2
je 0x140032a7e
mov qword [rsp + 0x3180], rbx
mov qword [rsp + 0x3140], rbp
mov qword [rsp + 0x3138], rsi
mov qword [rsp + 0x3130], r14
lea rbp, [rsp + 0x130]
mov r14d, eax
mov r8d, dword [rbp]
xor edx, edx
mov ecx, 0x411
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rsi, rax
je 0x140032a50
lea rcx, [rsp + 0x1138]
xor edx, edx
mov r8d, 0x1ff8
mov qword [rsp + 0x1130], 0
call fcn.14007cd30
lea r9, [rsp + 0x3170]
lea rdx, [rsp + 0x1130]
mov r8d, 0x2000
mov rcx, rsi
mov dword [rsp + 0x3170], 0
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x140032a47
xor edi, edi
test dword [rsp + 0x3170], 0xfffffff8
jbe 0x140032a47
lea rbx, [rsp + 0x1130]
nop
nop
nop
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x104
call fcn.14007cd30
mov rdx, qword [rbx]
lea r8, [rsp + 0x20]
mov r9d, 0x104
mov rcx, rsi
call sub.PSAPI.DLL_GetModuleBaseNameA
test eax, eax
je 0x140032a24
lea rdx, str.dwm.exe
lea rcx, [rsp + 0x20]
mov r8d, r13d
call fcn.14007f2bc
test eax, eax
je 0x140032a3b
mov eax, dword [rsp + 0x3170]
add edi, 1
add rbx, 8
shr eax, 3
cmp edi, eax
jb 0x1400329e0
jmp 0x140032a47
mov ecx, dword [rbp]
mov r12d, 1
mov dword [r15], ecx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbp, 4
sub r14, 1
jne 0x140032951
mov r14, qword [rsp + 0x3130]
mov rsi, qword [rsp + 0x3138]
mov rbp, qword [rsp + 0x3140]
mov rbx, qword [rsp + 0x3180]
mov eax, r12d
add rsp, 0x3148
pop r15
pop r13
pop r12
pop rdi
ret
Function at 0x140032a90
Capabilities:
Start service

Disassembly:
sub rsp, 0x228
cmp dword [0x1400df34c], 7
ja 0x140032aaa
xor eax, eax
add rsp, 0x228
ret
mov qword [rsp + 0x238], rbp
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x200
mov qword [rsp + 0x240], rsi
mov ebp, 1
call fcn.14007cd30
lea r8d, [rbp + 3]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
mov rsi, rax
jne 0x140032b12
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.StartDWMService._failed_to_open_SCM._err_d
lea rcx, [rsp + 0x20]
mov r8d, eax
call fcn.14007dc1c
lea rcx, [rsp + 0x20]
call fcn.140014620
xor eax, eax
jmp 0x140032bf3
lea rdx, str.UxSms
mov r8d, 0x10
mov rcx, rax
mov qword [rsp + 0x220], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
test rax, rax
mov rdi, rax
jne 0x140032b6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.StartDWMService._failed_to_OpenService._err_d
lea rcx, [rsp + 0x20]
mov r8d, eax
call fcn.14007dc1c
lea rcx, [rsp + 0x20]
call fcn.140014620
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x140032beb
mov qword [rsp + 0x230], rbx
xor ebx, ebx
nop
nop
nop
xor r8d, r8d
xor edx, edx
mov rcx, rdi
add ebx, ebp
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x140032ba4
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, 0xa
jl 0x140032b80
cmp ebx, 0xa
mov rbx, qword [rsp + 0x230]
jne 0x140032bd7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.StartDWMService._failed_to_StartService._err_d
lea rcx, [rsp + 0x20]
mov r8d, eax
call fcn.14007dc1c
lea rcx, [rsp + 0x20]
call fcn.140014620
xor ebp, ebp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebp
mov rdi, qword [rsp + 0x220]
mov rbp, qword [rsp + 0x238]
mov rsi, qword [rsp + 0x240]
add rsp, 0x228
ret
Function at 0x140032c10
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x240
xor ebx, ebx
cmp dword [0x1400df34c], 7
mov esi, ecx
ja 0x140032c3d
xor eax, eax
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rsi
ret
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x200
mov qword [rsp + 0x258], rdi
call fcn.14007cd30
bt dword [0x1400dd138], 0xa
jae 0x140032c6d
lea rcx, str.StopDWMService_is_called
call fcn.14000cbb0
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
mov rdi, rax
jne 0x140032cac
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.StopDWMService._failed_to_open_SCM._err_d
lea rcx, [rsp + 0x40]
mov r8d, eax
call fcn.14007dc1c
lea rcx, [rsp + 0x40]
call fcn.140014620
jmp 0x140032dba
lea rdx, str.UxSms
mov r8d, 0x34
mov rcx, rax
mov qword [rsp + 0x250], rbp
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
test rax, rax
mov rbp, rax
jne 0x140032cfb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.StopDWMService._failed_to_OpenService._err_d
lea rcx, [rsp + 0x40]
mov r8d, eax
call fcn.14007dc1c
lea rcx, [rsp + 0x40]
call fcn.140014620
jmp 0x140032da9
xor eax, eax
lea r8, [rsp + 0x20]
mov rcx, rbp
lea edx, [rax + 1]
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], eax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140032d54
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.StopDWMService._failed_to_ControlService._err_d
lea rcx, [rsp + 0x40]
mov r8d, eax
call fcn.14007dc1c
lea rcx, [rsp + 0x40]
call fcn.140014620
jmp 0x140032da0
mov r8d, esi
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rsi, rax
jne 0x140032d84
bt dword [0x1400dd138], 0xa
jae 0x140032da0
lea rcx, str.StopDWMService:_open_service_process_fails__n
call fcn.14000cbb0
jmp 0x140032da0
mov edx, 0x3e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
mov ebx, 1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x250]
mov rdi, qword [rsp + 0x258]
mov eax, ebx
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rsi
ret
Function at 0x140033710
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push rdi
push r12
push r14
push r15
mov eax, 0x3148
call fcn.1400a12b0
sub rsp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
or rcx, 0xffffffffffffffff
lea rdi, str.ati2evxx.exe
mov r14d, eax
xor eax, eax
xor r15d, r15d
repne scasb al, byte [rdi]
mov dword [rsp + 0x3178], r15d
not rcx
lea r12, [rcx - 1]
call fcn.140031ef0
test eax, eax
jne 0x14003376e
bt dword [0x1400dd138], 0xa
jae 0x14003376e
lea rcx, str.StopGlobalService_fails
call fcn.14000cbb0
lea rcx, [rsp + 0x130]
xor edx, edx
mov r8d, 0x1000
call fcn.14007cd30
lea r8, [rsp + 0x3178]
lea rcx, [rsp + 0x130]
mov edx, 0x1000
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x140033910
mov eax, dword [rsp + 0x3178]
shr eax, 2
je 0x140033910
mov qword [rsp + 0x3180], rbx
mov qword [rsp + 0x3140], rbp
mov qword [rsp + 0x3138], rsi
mov qword [rsp + 0x3130], r13
lea rbp, [rsp + 0x130]
mov r13d, eax
mov r8d, dword [rbp]
cmp r14d, r8d
je 0x1400338e2
xor edx, edx
mov ecx, 0x411
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rsi, rax
je 0x1400338e2
lea rcx, [rsp + 0x1138]
xor edx, edx
mov r8d, 0x1ff8
mov qword [rsp + 0x1130], r15
call fcn.14007cd30
lea r9, [rsp + 0x3170]
lea rdx, [rsp + 0x1130]
mov r8d, 0x2000
mov rcx, rsi
mov dword [rsp + 0x3170], r15d
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x1400338d9
test dword [rsp + 0x3170], 0xfffffff8
mov edi, r15d
jbe 0x1400338d9
lea rbx, [rsp + 0x1130]
nop
nop
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x104
call fcn.14007cd30
mov rdx, qword [rbx]
lea r8, [rsp + 0x20]
mov r9d, 0x104
mov rcx, rsi
call sub.PSAPI.DLL_GetModuleBaseNameA
test eax, eax
je 0x1400338b4
lea rdx, str.ati2evxx.exe
lea rcx, [rsp + 0x20]
mov r8d, r12d
call fcn.14007f2bc
test eax, eax
je 0x1400338cb
mov eax, dword [rsp + 0x3170]
add edi, 1
add rbx, 8
shr eax, 3
cmp edi, eax
jb 0x140033870
jmp 0x1400338d9
mov edx, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbp, 4
sub r13, 1
jne 0x1400337e0
mov r13, qword [rsp + 0x3130]
mov rsi, qword [rsp + 0x3138]
mov rbp, qword [rsp + 0x3140]
mov rbx, qword [rsp + 0x3180]
add rsp, 0x3148
pop r15
pop r14
pop r12
pop rdi
ret