joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012cd0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x140086de8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, qword [rsp + 0xc0]
lea rax, [r11 - 0x48]
and dword [rsp + 0x50], 0
mov rbp, r9
mov dword [rsp + 0x48], 1
mov rsi, rcx
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [r11 - 0x58], rax
mov r15d, r8d
and dword [rsp + 0x38], 0
mov r14, rdx
and qword [r11 - 0x68], 0
mov ebx, 0x80004005
and dword [rsp + 0x28], 0
and qword [r11 - 0x78], 0
call sub.bcrypt.dll_BCryptEncrypt
test eax, eax
jne 0x140012e24
mov eax, dword [rsp + 0x50]
mov ecx, dword [rdi]
add eax, 0x114
mov dword [rsp + 0x50], eax
cmp ecx, eax
jb 0x140012e20
mov dword [rsp + 0x48], 1
xor r9d, r9d
mov qword [rsp + 0x40], rdi
mov r8d, r15d
mov dword [rsp + 0x38], ecx
mov rdx, r14
mov rcx, qword [rsi]
mov qword [rsp + 0x30], rbp
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call sub.bcrypt.dll_BCryptEncrypt
test eax, eax
jne 0x140012e24
mov r8d, dword [rdi]
mov rdx, rbp
mov rcx, rsi
call fcn.140012ae0
test eax, eax
js 0x140012e24
lfence
mov ebx, dword [rdi]
xor edx, edx
add rbx, rbp
mov ebp, VarUI4FromDisp
mov r8d, ebp
mov rcx, rbx
call fcn.14002d0a0
cmp dword [rsi + 0x38], 1
jne 0x140012dcf
mov dword [rbx + 4], 1
jmp 0x140012ddc
cmp dword [rsi + 0x38], 2
jne 0x140012ddc
mov dword [rbx + 4], 3
mov r8d, dword [rsi + 0x34]
lea rcx, [rbx + 0x14]
mov rdx, qword [rsi + 0x28]
test r8, r8
je 0x140012e16
test rcx, rcx
je 0x140012e06
lfence
test rdx, rdx
je 0x140012e01
call fcn.14002e010
jmp 0x140012e16
call fcn.14002d0a0
call fcn.140032788
mov dword [rax], 0x16
call fcn.14003261c
mov eax, dword [rsi + 0x34]
mov dword [rbx + 0x10], eax
add dword [rdi], ebp
jmp 0x140012e22
mov dword [rdi], eax
xor ebx, ebx
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400293b0
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400182ec
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140086de8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
xor eax, eax
mov qword [rbp - 0x10], rax
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
and qword [rbp - 0x10], rax
lea rdx, [rbp - 0x20]
call fcn.140018020
mov rbx, qword [rbp - 0x20]
or r14d, 0xffffffff
mov rdi, qword [rbp - 0x18]
cmp rbx, rdi
je 0x140018499
mov rcx, qword [rbx]
sub rcx, 0x18
call fcn.140013474
add rax, 0x18
mov qword [rbp - 0x50], rax
and qword [rbp - 0x28], 0
lea rdx, [rbp - 0x38]
mov rcx, rsi
call fcn.1400181a4
nop
lea r8, [0x140066c60]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140013268
nop
lea r8, [rbp - 0x50]
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140017518
nop
lea r8, [0x14008a680]
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140017518
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1400183cc
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400629f0]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1400183f7
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400629f0]
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x140018421
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400629f0]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x140018456
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400629f0]
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x140018480
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400629f0]
add rbx, 8
mov rdi, qword [rbp - 0x18]
mov qword [rbp - 0x30], rdi
cmp rbx, rdi
jne 0x140018342
mov rbx, qword [rbp - 0x20]
test rbx, rbx
je 0x1400184ec
cmp rbx, rdi
je 0x1400184d9
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1400184cc
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400629f0]
add rbx, 8
cmp rbx, rdi
jne 0x1400184a3
mov rbx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x10]
sub rdx, rbx
and rdx, 0xfffffffffffffff8
mov rcx, rbx
call fcn.140013898
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400293b0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140018510
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140086de8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
call fcn.140018294
test eax, eax
je 0x1400185c8
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_SetEvent]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [rsp + 0x30], 0
mov edi, eax
jmp 0x1400185a5
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x30], 0
je 0x1400185c0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001859a
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0xffffffff
jb 0x140018552
cmp dword [rsp + 0x30], 0
je 0x1400185c0
mov eax, 1
jmp 0x1400185ca
mov rcx, rbx
call fcn.1400175d4
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400293b0
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x14001c9b4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x140086de8]
xor rax, rsp
mov qword [rbp + 0x160], rax
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareIntelDisplayigfxcui
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001cae9
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001cae9
and dword [rsp + 0x40], eax
lea r9, [rsp + 0x3c]
mov eax, 4
lea rdx, str.AGSDevMode
mov dword [rsp + 0x38], eax
xor r8d, r8d
mov dword [rsp + 0x3c], eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001ca6c
cmp dword [rsp + 0x40], 1
jne 0x14001ca6c
mov dword [rbx + 0x7c], 1
cmp dword [rbx + 0x7c], 0
je 0x14001cade
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.14002d0a0
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x38], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.AGSDevModePlatform
mov dword [rsp + 0x3c], 1
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001cade
lea rcx, [rbx + 0x80]
lea r8, [rsp + 0x50]
lea rdx, [0x140067184]
call fcn.14001c7b4
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1400293b0
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rbp
ret

Function at 0x14001cb0c
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140086de8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
lea rdx, str.SoftwareIntelDisplayigfxcui
xor ecx, ecx
call fcn.14001cbe8
mov dword [rsp + 0x30], 0x400
mov dword [rsp + 0x34], 1
test rax, rax
je 0x14001cb6e
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x34]
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea rdx, str.InstPath
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, [0x140065a34]
mov rcx, rbx
call fcn.14003efcc
test eax, eax
jne 0x14001cb8f
mov edx, 0x400
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400293b0
add rsp, 0x40
pop rbx
ret
Function at 0x14001cbe8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140086de8]
xor rax, rsp
mov qword [rbp - 8], rax
and qword [rbp - 0x50], 0
mov edi, 0x20019
cmp ecx, 1
mov r14, rdx
lea eax, [rdi + 6]
cmove edi, eax
call fcn.14001d1cc
test al, al
je 0x14001cc36
movups xmm0, xmmword [0x140066ca8]
jmp 0x14001cc3d
movups xmm0, xmmword [str.23LM4_H]
mov r9d, 2
lea rcx, [rbp - 0x38]
xor r8d, r8d
xor edx, edx
movdqu xmmword [rbp - 0x38], xmm0
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001cd0d
xor esi, esi
mov dword [rbp - 0x28], 0x20
xor edx, edx
jmp 0x14001ccef
xor r9d, r9d
mov dword [rsp + 0x28], edi
lea rdx, [rbp - 0x28]
mov dword [rsp + 0x20], 2
mov rcx, rbx
lea r8d, [r9 + 1]
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov qword [rbp - 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x14001cce6
and dword [rbp - 0x40], 0
lea rcx, [rbp - 0x44]
and dword [rbp - 0x48], 0
lea r9, [rbp - 0x40]
mov qword [rsp + 0x28], rcx
lea rdx, str.Inst
lea rcx, [rbp - 0x48]
mov dword [rbp - 0x44], 4
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001ccdc
cmp dword [rbp - 0x48], eax
jne 0x14001cd04
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x50], 0
inc esi
mov edx, esi
lea r8, [rbp - 0x28]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x14001cc71
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov rax, qword [rbp - 0x50]
test rax, rax
jne 0x14001cd3e
test r14, r14
je 0x14001cd3e
lea rax, [rbp - 0x50]
mov r9d, edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rax, qword [rbp - 0x50]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400293b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14001cd64
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x140086de8]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rdx
mov qword [rbp - 0x11], rdx
and dword [rbp - 0x21], 0
call fcn.14000c190
mov rcx, rax
test rax, rax
je 0x14001cf95
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [0x1400629f0]
add rax, 0x18
mov qword [rbp - 0x39], rax
lea rcx, [rbp - 0x39]
call fcn.14000b730
nop
mov ecx, 0x400
call fcn.140029410
mov rdi, rax
lea r13, [fcn.140006e80]
mov qword [rsp + 0x20], r13
lea r9, [0x140013ee0]
mov r12d, 8
mov r8d, r12d
mov edx, r12d
lea rcx, [rbp - 9]
call fcn.140028e7c
nop
test rdi, rdi
je 0x14001cf13
mov r8d, 0x200
mov rdx, rdi
lea rcx, str._USERPROFILE_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rdi
call fcn.140032cb4
mov r8d, eax
mov rdx, rdi
lea rcx, [rbp - 0x39]
call fcn.140010b94
mov rax, qword [rbp - 0x39]
cmp dword [rax - 0x10], 0
jle 0x14001cf0b
and dword [rbp - 0x31], 0
xor esi, esi
and qword [rbp - 0x29], rsi
lea r9, [rbp - 0x31]
lea r8, [0x140066c60]
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x39]
call fcn.140016020
nop
lea rdx, [0x140065a34]
mov rcx, qword [rbp - 0x29]
call fcn.14003efcc
test eax, eax
je 0x14001cee3
movsxd rax, esi
lea rcx, [rbp - 9]
lea rcx, [rcx + rax*8]
inc esi
lea rdx, [rbp - 0x29]
call fcn.1400131e0
lea r9, [rbp - 0x31]
lea r8, [0x140066c60]
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x39]
call fcn.140016020
nop
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.1400131e0
nop
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001ce69
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400629f0]
jmp 0x14001ce69
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001cf0b
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400629f0]
mov rcx, rdi
call fcn.140028974
mov rcx, qword [rbp + 7]
add rcx, 0xffffffffffffffe8
call fcn.140013474
add rax, 0x18
mov qword [rbx], rax
mov dword [rbp - 0x21], 1
mov r9, r13
mov r8, r12
mov rdx, r12
lea rcx, [rbp - 9]
call fcn.1400288a4
nop
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14001cf69
lfence
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [0x1400629f0]
mov rax, rbx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400293b0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400099e0
int3
Function at 0x14001cfa0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rdx
and dword [rsp + 0x20], 0
xor eax, eax
mov qword [rdx], rax
call fcn.14000c190
mov rcx, rax
test rax, rax
je 0x14001d042
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [0x1400629f0]
add rax, 0x18
mov qword [rbx], rax
mov rcx, rbx
call fcn.14000b730
nop
mov dword [rsp + 0x20], 1
mov ecx, 0x400
call fcn.140029410
mov rdi, rax
test rax, rax
je 0x14001d034
mov r8d, 0x200
mov rdx, rax
lea rcx, str._USERPROFILE_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rdi
call fcn.140032cb4
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
call fcn.140010b94
mov rcx, rdi
call fcn.140028974
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x80004005
call fcn.1400099e0
int3

Function at 0x14001d1cc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140086de8]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
lea rcx, [0x140066ca8]
xor r8d, r8d
xor edx, edx
lea esi, [rbx + 2]
mov r9d, esi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14001d2bf
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], 0x20
xor edx, edx
mov rcx, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x14001d2b6
lea ebp, [rbx + 1]
mov dword [rsp + 0x28], 0x20019
mov r8d, ebp
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov rsi, rax
test rax, rax
je 0x14001d2b6
lea rax, [rsp + 0x34]
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x34], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Inst
mov dword [rsp + 0x30], ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d2ad
cmp dword [rsp + 0x30], ebx
movzx eax, bl
cmovne eax, ebp
mov bl, al
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov al, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400293b0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14001e390
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140086de8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
call fcn.14001d188
test eax, eax
je 0x14001e448
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEvent]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [rsp + 0x30], 0
mov edi, eax
jmp 0x14001e425
mov rcx, qword [rbx + 0x38]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x30], 0
je 0x14001e440
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001e41a
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0xffffffff
jb 0x14001e3d2
cmp dword [rsp + 0x30], 0
je 0x14001e440
mov eax, 1
jmp 0x14001e44a
mov rcx, rbx
call fcn.14001b018
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400293b0
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x14001f9c4
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x2a0
mov rax, qword [0x140086de8]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbx, r8
mov rsi, rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rbx
lea r8, [0x140067100]
lea rcx, [rsp + 0x20]
call fcn.140013268
lea rdx, [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or rbp, 0xffffffffffffffff
mov ecx, ebp
lock xadd dword [rdx + 0x10], ecx
add ecx, ebp
test ecx, ecx
jg 0x14001fa44
lfence
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [0x1400629f0]
cmp rdi, rbp
je 0x14001fa79
mov rax, qword [rbx]
cmp dword [rax - 0x10], 0
jle 0x14001fa79
lea rdx, [rsp + 0x6c]
mov rcx, qword [rbx]
call fcn.14003f0c8
test eax, eax
je 0x14001faf7
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14001fa52
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, ebp
test eax, eax
jg 0x14001faab
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400629f0]
nop
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, ebp
test eax, eax
jg 0x14001fad2
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400629f0]
xor eax, eax
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400293b0
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x2a0
pop rdi
pop rsi
pop rbp
ret
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, ebp
test eax, eax
jg 0x14001fb1f
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400629f0]
nop
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, ebp
test eax, eax
jg 0x14001fb46
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400629f0]
mov eax, 1
jmp 0x14001fad4
Function at 0x140020c30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x140086de8]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140020c64
xor eax, eax
jmp 0x140020d74
cmp qword [rcx + 0x68], 0
je 0x140020c78
lfence
call fcn.140020da0
jmp 0x140020d74
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov qword [rsp + 0x20], rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x140020c94
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140020c96
xor ecx, ecx
movsxd rax, ecx
mov rbx, rdi
test ecx, ecx
je 0x140020cd0
cmp rax, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.14002e010
mov rax, qword [rsi + 0x50]
sub rbp, rbx
add r14, rbx
mov qword [rsp + 0x20], rbp
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
mov rbx, rbp
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140020d69
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140020d0b
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
cmp rbx, r15
jbe 0x140020d45
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call fcn.14003f6d8
sub rbp, rax
add r14, rax
mov qword [rsp + 0x20], rbp
mov rbx, rbp
cmp rax, r15
jne 0x140020d69
cmp rbp, r15
ja 0x140020d16
test rbx, rbx
je 0x140020d69
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.14003f6d8
sub rbx, rax
mov qword [rsp + 0x20], rbx
lfence
sub rdi, qword [rsp + 0x20]
mov rax, rdi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400293b0
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140021ab4
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x140086de8]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rsi, rdx
mov rbx, rcx
cmp qword [rcx + 0x78], 0
je 0x140021cc4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
and qword [rsp + 0x40], rax
and dword [rsp + 0x48], eax
and qword [rsp + 0x50], rax
and dword [rsp + 0x58], eax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.SoftwareIntelDisplayigfxcuiHotKeys
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x40]
call fcn.14000a480
test eax, eax
jne 0x140021cb1
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x70]
call fcn.14002d0a0
mov dword [rsp + 0x58], 0x104
lea r9, [rsp + 0x58]
lea r8, [rbp - 0x70]
lea rdx, str.ProfileCMDLineArgs
lea rcx, [rsp + 0x40]
call fcn.140027728
mov edi, eax
test eax, eax
jne 0x140021c8e
lea rdx, [0x140065a34]
lea rcx, [rbp - 0x70]
call fcn.14003efcc
test eax, eax
je 0x140021c8e
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x140021ce6
mov rax, qword [rcx]
lea r8d, [rdi + 1]
lea rdx, [rbp - 0x70]
mov rax, qword [rax + 0x370]
call qword [0x1400629f0]
mov ebx, eax
and qword [rsp + 0x58], 0
lea rcx, [rsp + 0x60]
call fcn.1400424ac
lea r8, [rsp + 0x60]
lea edx, [rdi + 0x1a]
lea rcx, [rsp + 0x68]
call fcn.1400432cc
lea r8, [0x140067c18]
lea rdx, str.C:IntelLogsIntelProfileLog.txt
lea rcx, [rsp + 0x58]
call fcn.14003f420
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140021c51
lea r8, [rsp + 0x68]
lea rdx, [0x140067c44]
call fcn.140027eb4
lea rdx, str._s__n
mov rcx, qword [rsp + 0x58]
test ebx, ebx
lea r8, str.Profile_Apply_operation_is_SUCCEESS
je 0x140021c3d
lea r8, str.Profile_Apply_operation_is_FAILED
call fcn.1400185fc
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140021c51
call fcn.14003f8c0
mov r9d, 0xf003f
lea r8, str.SoftwareIntelDisplayigfxcuiHotKeys
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x40]
call fcn.14000e21c
mov edi, eax
test eax, eax
jne 0x140021c8e
lea rdx, str.ProfileCMDLineArgs
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
jmp 0x140021c93
mov rbx, qword [rsp + 0x40]
test rsi, rsi
je 0x140021c9f
test edi, edi
sete al
mov byte [rsi], al
test rbx, rbx
je 0x140021cb6
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
jmp 0x140021cb6
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x140021cc4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1400293b0
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2b0
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004003
call fcn.140029a30
int3