joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e6d0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x68]
sub rsp, 0x160
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x140194020]
xor rax, rsp
mov qword [rbp + 0x50], rax
lea r8, str._asus_framework.exe
lea rdx, [0x140194448]
lea rcx, [rbp - 0x48]
call fcn.140013560
nop
lea rbx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rbx, qword [rbp - 0x48]
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x20], Ordinal_110
mov dword [rbp + 0x1c], 1
xor edi, edi
mov word [rbp + 0x20], di
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000e853
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp - 0x80]
call fcn.14000a630
nop
lea r9d, [rdi + 0x2d]
lea r8, str.Create_framework_process_failed._Error_code:
xor edx, edx
mov rcx, rax
call fcn.140014710
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], dil
lea rdi, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdi, qword [rsp + 0x50]
mov rbx, qword [0x1401a4e50]
test rbx, rbx
jne 0x14000e82c
lea ecx, [rbx + 4]
call fcn.1400ace1c
mov rbx, rax
mov qword [rsp + 0x78], rax
call fcn.14002cc80
mov dword [rbx], eax
test eax, eax
je 0x14000e825
call fcn.14002cd70
nop
mov qword [0x1401a4e50], rbx
mov r8b, 1
mov rdx, rdi
mov rcx, rbx
call fcn.14002d1d0
nop
lea rcx, [rsp + 0x50]
call fcn.140004bd0
nop
lea rcx, [rbp - 0x80]
call fcn.140004bd0
xor bl, bl
jmp 0x14000e869
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
lea rcx, [rbp - 0x48]
call fcn.1400049f0
movzx eax, bl
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1400acdf0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140011950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov rsi, qword [rsp + 0x48]
xor ebp, ebp
mov rax, qword [rsp + 0x50]
mov r12, r9
mov r11, qword [rsp + 0x60]
mov r13, r8
mov r14, rdx
mov qword [rsi], r8
mov qword [r11], rax
mov rax, qword [rsi]
cmp rax, r9
je 0x140011ae4
mov r15, qword [rsp + 0x58]
lea r8d, [rbp + 1]
mov rbx, qword [r11]
mov r9d, 0x3ff
mov r10d, 0x2400
cmp rbx, r15
je 0x140011ae4
movzx edx, word [r14]
xor dil, dil
movzx ecx, word [rax]
cmp r8w, dx
jae 0x1400119ea
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x140011b0a
movzx eax, dx
movzx ecx, cx
shl eax, 0xa
sub ecx, 0xdc00
or eax, ecx
jmp 0x140011a06
mov edx, 0x2800
movzx eax, cx
add cx, dx
cmp cx, r9w
ja 0x140011a06
shl eax, 0xa
mov dil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140011a19
movzx r9d, al
mov r10d, ebp
mov r8d, ebp
jmp 0x140011a63
mov r9d, eax
cmp eax, 0x800
jae 0x140011a30
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
jmp 0x140011a63
cmp eax, 0x10000
jae 0x140011a4a
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov r8d, r10d
jmp 0x140011a63
shr r9d, 0x12
mov r10d, 3
movzx r8d, dil
or r9b, 0xf0
xor r8d, 1
add r8d, r8d
inc r8d
mov rdx, r15
sub rdx, rbx
mov ecx, r8d
cmp rdx, rcx
jl 0x140011ae4
add qword [rsi], 2
test dil, dil
jne 0x140011a83
cmp r10d, 3
jae 0x140011a8f
mov rcx, qword [r11]
mov byte [rcx], r9b
inc qword [r11]
dec r8d
test r8d, r8d
jle 0x140011ac1
lea r9d, [r10 + r10*2]
add r9d, r9d
nop dword [rax + rax]
sub r9d, 6
mov edx, eax
mov ecx, r9d
dec r8d
shr edx, cl
mov rcx, qword [r11]
and dl, 0x3f
or dl, 0x80
mov byte [rcx], dl
inc qword [r11]
test r8d, r8d
jg 0x140011aa0
mov r8d, 1
test dil, dil
je 0x140011ad1
shr eax, 0xa
jmp 0x140011ad4
mov eax, r8d
mov word [r14], ax
mov rax, qword [rsi]
cmp rax, r12
jne 0x1400119a1
cmp r13, qword [rsi]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
mov eax, 2
jmp 0x140011aed

Function at 0x140011f90
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1e0
mov rax, qword [0x140194020]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
movzx edi, dl
mov rbx, rcx
mov eax, 1
lock xadd dword [0x1401a5728], eax
inc eax
cmp eax, 1
jne 0x140011fdd
lea ecx, [rax + 1]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x1401a572c], eax
test dil, dil
je 0x140011ff0
xor eax, eax
lock xadd dword [0x1401a572c], eax
test eax, eax
jne 0x140012014
mov rax, rbx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400acdf0
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1e0
pop rdi
ret
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x20], eax
call fcn.1400e5a00
lea rdx, str.winsock
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
call fcn.14000af10
int3
Function at 0x140017070
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x100
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x140], rbx
mov rax, qword [0x140194020]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov r15, rdx
mov rdi, rcx
xor ebp, ebp
mov dword [rsp + 0x50], ebp
xor edx, edx
lea r8d, [rbp + 0x64]
lea rcx, [rsp + 0x84]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x80], WSAGetLastError
lea rsi, [rdi + 0x40]
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
lea rbx, [rdi + 0x20]
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], bp
mov dword [rsp + 0x50], 1
lea r14, [rbx + 0x10]
mov rdx, qword [r14]
add rdx, 0x2e
lea rcx, [rsp + 0x58]
call fcn.140014540
cmp qword [rbx + 0x18], 8
jb 0x14001711b
mov rbx, qword [rbx]
mov r8, qword [r14]
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140012db0
mov r8d, reloc.WLDAP32.dll_Ordinal_46
lea rdx, str.dllArmourySocketServerArmouryWebBrowser.exe
lea rcx, [rsp + 0x58]
call fcn.140012db0
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14001714f
mov rdx, qword [rdi]
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
mov qword [rsp + 0x48], rsi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x8000004
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
lea rcx, [rsp + 0x58]
call fcn.1400049f0
test ebx, ebx
jne 0x1400171ee
mov rbx, qword [0x1401a4e50]
test rbx, rbx
jne 0x1400171d8
lea ecx, [rbx + 4]
call fcn.1400ace1c
mov rbx, rax
mov qword [rsp + 0x50], rax
call fcn.14002cc80
mov dword [rbx], eax
test eax, eax
je 0x1400171d1
call fcn.14002cd70
nop
mov qword [0x1401a4e50], rbx
mov r8b, 1
lea rdx, str.CreateProcess_failed
mov rcx, rbx
call fcn.14002d1d0
xor eax, eax
jmp 0x140017216
mov edx, 2
mov rcx, rdi
call fcn.1400172a0
mov rdx, qword [rsi]
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rdi + 0x48]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400acdf0
mov rbx, qword [rsp + 0x140]
add rsp, 0x100
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140020750
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140194020]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14002077d
xor eax, eax
jmp 0x1400208d2
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x1400207a8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x1400207a8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1400208d2
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400208c5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400207eb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140020816
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400208ca
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
js 0x1400208c5
cmp eax, 1
jle 0x140020885
cmp eax, 3
jne 0x1400208c5
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400208ca
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400208b3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400208c5
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x1400208ca
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400acdf0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140021600
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140194020]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400216ac
cmp byte [rcx + 0x71], 0
je 0x1400216ac
mov rax, qword [rcx]
mov edx, 0xffffffff
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14002166d
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140021671
sub eax, 1
je 0x140021675
sub eax, 2
je 0x1400216ac
xor al, al
jmp 0x1400216ae
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400216a3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14002166d
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400216ae
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400acdf0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400230c0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xa0
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140194020]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
mov rdi, qword [rcx + 0x20]
xor esi, esi
mov qword [rcx + 0x20], rsi
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x140023110
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
mov byte [rbx + 0x18], 1
mov rcx, qword [rbx + 8]
call qword [sym.imp.MSVCP140.dll__Cnd_signal]
test eax, eax
je 0x14002312a
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
test eax, eax
je 0x140023140
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
mov qword [rsp + 0x88], rsi
lea r9, [rsp + 0x88]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1401291a0]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x14002323f
movdqa xmm0, xmmword [0x140147820]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], si
lea r8d, [rax + 0x1e]
lea rdx, str.C:ProgramDataASUSArmourySDK
lea rcx, [rsp + 0x48]
call fcn.140004a60
movdqa xmm0, xmmword [0x140147820]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], si
mov rdx, qword [rsp + 0x88]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], si
jne 0x1400231b4
lea rcx, [rsp + 0x20]
call fcn.140004a60
mov r8d, Ordinal_84
lea rdx, str.PackagesB9ECED6F.ArmouryCrate_qmba6cd70vzyyLocalStateAccessoryArmourySDK.zip
lea rcx, [rsp + 0x20]
call fcn.140012db0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x68]
call fcn.1400ab8d0
movzx ebx, al
lea rcx, [rsp + 0x20]
call fcn.1400049f0
test bl, bl
je 0x14002323f
call fcn.14002cc30
mov rcx, rax
mov r8b, 1
lea rdx, str.DeviceProfileRestore_done_
call fcn.14002d1d0
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
call qword [sym.imp.MSVCP140.dll__Cnd_do_broadcast_at_thread_exit]
test rdi, rdi
je 0x140023266
mov edx, 8
mov rcx, rdi
call fcn.1400ace14
nop
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400acdf0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140023360
Capabilities:
Get common file path

Disassembly:
jmp 0x140023360
mov rax, rsp
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140194020]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov rbx, rcx
mov rdi, qword [rcx + 0x20]
xor esi, esi
mov qword [rcx + 0x20], rsi
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
nop
test eax, eax
je 0x1400233b3
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov byte [rbx + 0x18], 1
mov rcx, qword [rbx + 8]
call qword [sym.imp.MSVCP140.dll__Cnd_signal]
nop
test eax, eax
je 0x1400233cf
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
nop
test eax, eax
je 0x1400233e7
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov qword [rsp + 0xa8], rsi
lea r9, [rsp + 0xa8]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1401291a0]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
nop
test eax, eax
jne 0x14002353a
movdqa xmm0, xmmword [0x140147820]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], si
lea r8d, [rax + 0x1e]
lea rdx, str.C:ProgramDataASUSArmourySDK
lea rcx, [rsp + 0x48]
call fcn.140004a60
nop
movdqa xmm0, xmmword [0x140147820]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], si
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, str.ArmourySDK.zip
lea rcx, [rsp + 0x68]
call fcn.140004a60
nop
movdqa xmm0, xmmword [0x140147820]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], si
mov rdx, qword [rsp + 0xa8]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], si
jne 0x140023490
lea rcx, [rsp + 0x20]
call fcn.140004a60
nop
mov r8d, reloc.zlibwapi.dll_Ordinal_66
lea rdx, str.PackagesB9ECED6F.ArmouryCrate_qmba6cd70vzyyLocalStateAccessory
lea rcx, [rsp + 0x20]
call fcn.140012db0
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x98], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x98], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0xb0]
call fcn.1400aa870
nop
movzx ebx, al
lea rcx, [rsp + 0x20]
call fcn.1400049f0
nop
test bl, bl
je 0x14002353a
call fcn.14002cc30
nop
mov rcx, rax
mov r8b, 1
lea rdx, str.DeviceProfileBackup_done_
call fcn.14002d1d0
nop
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop
call qword [sym.imp.MSVCP140.dll__Cnd_do_broadcast_at_thread_exit]
nop
test rdi, rdi
je 0x140023563
mov edx, 8
mov rcx, rdi
call fcn.1400ace14
nop
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1400acdf0
nop
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14002cc80
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x140194020]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor ebx, ebx
lea rcx, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov r8d, 0x400
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0x200
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x14013eec0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14002cd30
lea rax, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, str.debug
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x14002cd2a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx edx, word [rsp + 0x40]
movzx ecx, word [0x14013ef2c]
sub edx, ecx
jne 0x14002cd4e
movzx edx, word [rsp + 0x42]
movzx ecx, word [0x14013ef2e]
sub edx, ecx
test edx, edx
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400acdf0
add rsp, 0x450
pop rbx
ret
Function at 0x14002d360
Capabilities:
Create directory
Print debug messages

Disassembly:
push rdi
sub rsp, 0x80
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x98], rbx
mov rax, qword [0x140194020]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov qword [rsp + 0x68], rcx
cmp qword [rcx + 0x18], 8
jb 0x14002d39b
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
setne dil
test eax, eax
jne 0x14002d44f
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14002d3bc
mov rdx, qword [rbx]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
sete dil
test eax, eax
je 0x14002d44f
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.140017750
nop
mov r9d, Ordinal_62
lea r8, str._ArmourySocketServer___Logger__IsFolderExisted___errCode_
xor edx, edx
mov rcx, rax
call fcn.140014710
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x20]
call fcn.140004bd0
nop
lea rcx, [rsp + 0x48]
call fcn.140004bd0
nop
mov rcx, rbx
call fcn.1400049f0
movzx eax, dil
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400acdf0
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
Function at 0x14002dd20
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140194020]
xor rax, rsp
mov qword [rbp + 0x37], rax
movzx esi, r8b
mov rdi, rdx
lea r14, [0x1401a5390]
mov qword [rbp - 0x31], r14
mov rcx, r14
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x14002dd78
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
movdqa xmm0, xmmword [0x140147830]
movdqu xmmword [rbp - 0x49], xmm0
mov byte [rbp - 0x59], 0
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rdi + r8], 0
jne 0x14002dd93
mov rdx, rdi
lea rcx, [rbp - 0x59]
call fcn.140004c30
nop
lea rdx, [rbp - 0x29]
call fcn.14002ef30
mov rcx, rax
mov rdx, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rax, rdx
sub rax, r9
mov r10, qword [rbp - 0x41]
mov r8, qword [rbp - 0x49]
cmp r8, rax
jbe 0x14002ddf5
mov rax, r10
sub rax, r8
cmp rax, r9
jb 0x14002ddf5
cmp rdx, 0x10
jb 0x14002dde5
mov rcx, qword [rcx]
mov r8, rcx
xor edx, edx
lea rcx, [rbp - 0x59]
call fcn.140014710
jmp 0x14002de07
lea rdx, [rbp - 0x59]
cmp r10, 0x10
cmovae rdx, qword [rbp - 0x59]
call fcn.140004d90
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
movups xmmword [rbp + 7], xmm1
movups xmmword [rbp - 9], xmm0
lea rcx, [rbp - 0x29]
call fcn.140004bd0
nop
lea rcx, [rbp - 0x59]
call fcn.140004bd0
test sil, sil
je 0x14002dea5
lea rdi, [rbp - 9]
cmp qword [rbp + 0xf], 0x10
cmovae rdi, qword [rbp - 9]
call fcn.14002e110
cmp dword [reloc.WS2_32.dll_closesocket], 3
jl 0x14002dea5
movdqa xmm0, xmmword [0x140147830]
movdqu xmmword [rbp + 0x27], xmm0
mov byte [rbp + 0x17], 0
nop
inc rbx
cmp byte [rdi + rbx], 0
jne 0x14002de70
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp + 0x17]
call fcn.140004c30
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0x10
cmovae rcx, qword [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rbp + 0x17]
call fcn.140004bd0
lea rbx, [rbp - 9]
cmp qword [rbp + 0xf], 0x10
cmovae rbx, qword [rbp - 9]
call fcn.14002e110
mov rdx, rbx
call fcn.14002f300
nop
lea rcx, [rbp - 9]
call fcn.140004bd0
nop
mov rcx, r14
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
test eax, eax
je 0x14002dee1
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400acdf0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret