joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400115c0
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000b8ac
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14001164a
cmp byte [rbp - 0x21], r15b
je 0x140011645
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140011680
call fcn.14000df34
test eax, eax
jne 0x14001166c
cmp byte [rbp - 0x21], r15b
je 0x140011664
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140011680
cmp byte [rbp - 0x21], r15b
je 0x14001167d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000ae8c
test eax, eax
jne 0x140011720
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000b8ac
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400116bf
cmp byte [rbp - 0x21], r15b
je 0x1400116f4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400116f4
call fcn.14000df34
test eax, eax
jne 0x1400116e0
cmp byte [rbp - 0x21], r15b
je 0x1400116d9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400116f4
cmp byte [rbp - 0x21], r15b
je 0x1400116f1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000ae8c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140011720
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140011723
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140011731
mov rcx, rdi
call fcn.14000ae3c
cmp byte [rbp + 0x3f], r15b
je 0x140011740
mov rcx, qword [rbp + 0x27]
call fcn.14000ae3c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140011cf8
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140009504
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140009504
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140011e48
cmp rax, 0xffffffffffffffff
je 0x140011e48
xor edi, edi
test rbp, rbp
jle 0x140011df3
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14000adc4
mov rbx, rax
test rax, rax
jne 0x140011d80
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140011de9
mov edx, 0x8000
mov ecx, r14d
call fcn.140007dc0
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400102e8
cmp eax, 0xffffffff
je 0x140011dc9
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140011d90
mov edx, r15d
mov ecx, r14d
call fcn.140007dc0
jmp 0x140011de9
cmp byte [rsi + 0x38], dil
je 0x140011de0
cmp dword [rsi + 0x34], 5
jne 0x140011de0
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140011de9
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14000ae3c
jmp 0x140011e5c
jns 0x140011e5c
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140009504
cmp rax, 0xffffffffffffffff
jne 0x140011e14
cmp byte [rsi + 0x30], dil
je 0x140011e5c
mov edi, dword [rsi + 0x2c]
jmp 0x140011e5c
mov ecx, r14d
call fcn.14000d3dc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140011e5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140011e5c
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140011e55
mov eax, dword [rsi + 0x2c]
jmp 0x140011e5a
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140009504
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140013720
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140013748
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140013748
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400011b0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000122e
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000122e
nop
lea rdx, str.ProSoccerOnline_Win64_Shipping.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14000122a
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140001200
jmp 0x14000122e
mov edi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140001db0
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x14000d030
Capabilities:
Access the windows event log

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140028050]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebp, ebp
movzx edi, dx
mov rsi, rcx
lea eax, [rdi - 1]
mov qword [r11 - 0x38], rbp
mov qword [r11 - 0x30], rbp
cmp ax, 1
ja 0x14000d0d9
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], r14
lea r14, str.amdacpusrsvc
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x14000d0c9
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
lea ecx, [rbp + 2]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebp
mov word [rsp + 0x28], cx
mov rcx, rbx
xor r8d, r8d
xor r9d, r9d
movzx edx, di
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rbx, qword [rsp + 0x90]
mov r14, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140011740
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000d100
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x870
mov rax, qword [0x140028050]
xor rax, rsp
mov qword [rsp + 0x860], rax
xor edi, edi
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x7fe
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov word [rsp + 0x60], di
call fcn.140014310
lea rsi, str.amdacpusrsvc
lea rdx, str.__ls_:
lea rcx, [rsp + 0x60]
mov r8, rsi
call fcn.14000d000
lea r8, [rsp + 0x898]
lea rcx, [rsp + 0x60]
or rax, 0xffffffffffffffff
nop
cmp word [rcx + rax*2 + 2], di
lea rax, [rax + 1]
jne 0x14000d180
mov rdx, qword [rsp + 0x890]
lea rcx, [rsp + 0x60]
lea rcx, [rcx + rax*2]
call fcn.140011760
lea rax, [rsp + 0x60]
sub rax, 2
nop word [rax + rax]
cmp word [rax + 2], di
lea rax, [rax + 2]
jne 0x14000d1b0
mov ecx, dword [0x140023a28]
mov rdx, rsi
mov dword [rax], ecx
movzx ecx, word [0x140023a2c]
mov word [rax + 4], cx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x14000d22c
mov qword [rsp + 0x40], rdi
mov ecx, 2
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x50]
lea edx, [rcx - 1]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov word [rsp + 0x28], cx
mov rcx, rbx
xor r8d, r8d
xor r9d, r9d
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.140011740
add rsp, 0x870
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000d250
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x140028050]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x58], r8d
lea rdx, str.SYSTEMControlSet001Services_amdacpusrsvc
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x14000d2d7
xor r8d, r8d
lea rax, [rsp + 0x50]
lea rdx, str.SYSTEMControlSet001Services_amdacpusrsvc
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r8
xor r9d, r9d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r8d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jne 0x14000d306
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
lea rdx, str.OSVersion
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140011740
add rsp, 0x70
pop rbx
ret
Function at 0x14000d330
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x9a0]
sub rsp, 0xaa0
mov rax, qword [0x140028050]
xor rax, rsp
mov qword [rbp + 0x990], rax
movabs rax, 0x31002e0036
lea rcx, [rbp + 0x358]
xor edx, edx
mov r8d, 0x200
mov ebx, 1
mov qword [rbp + 0x350], rax
call fcn.140014310
movabs rax, 0x32002e0036
lea rcx, [rbp + 0x568]
xor edx, edx
mov r8d, 0x200
mov qword [rbp + 0x560], rax
call fcn.140014310
movabs rax, 0x33002e0036
lea rcx, [rbp + 0x148]
xor edx, edx
mov r8d, 0x200
mov qword [rbp + 0x140], rax
call fcn.140014310
movabs rax, 0x34002e0036
lea rcx, [rsp + 0x38]
xor edx, edx
mov r8d, 0x200
mov qword [rsp + 0x30], rax
call fcn.140014310
lea rax, [rbp + 0x770]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000d54d
mov rcx, qword [rbp + 0x770]
lea rax, [rbp + 0x778]
lea r9, [rbp + 0x77c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x780]
lea rdx, str.CurrentVersion
xor r8d, r8d
mov dword [rbp + 0x778], 0xff
mov dword [rbp + 0x77c], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000d540
cmp word [rbp + 0x780], 0x30
je 0x14000d540
lea rax, [rbp + 0x780]
lea r8, [rbp + 0x350]
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000d4a4
add rax, 2
test ecx, ecx
jne 0x14000d490
test edx, edx
jne 0x14000d4b0
lea ebx, [rdx + 0x3d]
jmp 0x14000d540
lea rax, [rbp + 0x780]
lea r8, [rbp + 0x560]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000d4d5
add rax, 2
test ecx, ecx
jne 0x14000d4c1
test edx, edx
jne 0x14000d4de
lea ebx, [rdx + 0x3e]
jmp 0x14000d540
lea rax, [rbp + 0x780]
lea r8, [rbp + 0x140]
sub r8, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000d504
add rax, 2
test ecx, ecx
jne 0x14000d4f0
test edx, edx
jne 0x14000d50d
lea ebx, [rdx + 0x3f]
jmp 0x14000d540
lea rcx, [rbp + 0x780]
lea rax, [rsp + 0x30]
sub rax, rcx
nop dword [rax]
movzx r8d, word [rcx]
movzx edx, word [rcx + rax]
sub r8d, edx
jne 0x14000d535
add rcx, 2
test edx, edx
jne 0x14000d520
mov eax, 0x40
test r8d, r8d
cmove ebx, eax
mov rcx, qword [rbp + 0x770]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x990]
xor rcx, rsp
call fcn.140011740
mov rbx, qword [rsp + 0xab0]
add rsp, 0xaa0
pop rbp
ret
Function at 0x14000ea80
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140028050]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edx, dword [0x14002a814]
xor ebx, ebx
mov r10d, ebx
mov r8d, ebx
test edx, edx
je 0x14000ebcd
lea rax, [0x14002adf4]
mov r9d, edx
lea r11d, [rbx + 1]
nop dword [rax]
mov ecx, dword [rax]
cmp ecx, 0x7d
jne 0x14000eacc
mov r10d, r11d
jmp 0x14000ead6
cmp ecx, 0x87
cmove r8d, r11d
add rax, 0x4174
dec r9
jne 0x14000eac0
cmp r10d, r11d
jne 0x14000eba0
lea rax, [rsp + 0x30]
lea rdx, str.SYSTEMControlSet001Control920DEC42_4CA5_4d1d_9487_67BE645CDDFC
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x38], ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000eb58
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
lea rdx, str.UseEnumeratedDisplay
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, dword [rsp + 0x38]
jmp 0x14000eb5a
mov edi, ebx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 1
mov rdi, qword [rsp + 0x60]
je 0x14000ebcd
mov edx, dword [0x14002a814]
cmp edx, 1
jbe 0x14000ebcd
test edx, edx
je 0x14000ebcd
lea rcx, [0x14002a810]
mov eax, ebx
imul rax, rax, 0x4174
cmp dword [rax + rcx + 0x5e4], 0x7d
je 0x14000ebcd
inc ebx
cmp ebx, edx
jb 0x14000eb85
jmp 0x14000ebcd
cmp r8d, r11d
jne 0x14000ebcd
cmp edx, r11d
jbe 0x14000ebcd
lea rcx, [0x14002a810]
mov eax, ebx
imul rax, rax, 0x4174
cmp dword [rax + rcx + 0x5e4], 0x87
jne 0x14000ebcd
inc ebx
cmp ebx, edx
jb 0x14000ebb1
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140011740
add rsp, 0x50
pop rbx
ret
Function at 0x14000f500
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.gdi32.dll
xor bl, bl
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x14004f120], rax
test rax, rax
je 0x14000f67c
lea rdx, str.D3DKMTCreatePagingQueue
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004f120]
lea rdx, str.D3DKMTCreateContextVirtual
mov qword [0x14004f128], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004f120]
lea rdx, str.D3DKMTMapGpuVirtualAddress
mov qword [0x14004f130], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004f120]
lea rdx, str.D3DKMTMakeResident
mov qword [0x14004f138], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004f120]
lea rdx, str.D3DKMTEvict
mov qword [0x14004f140], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004f120]
lea rdx, str.D3DKMTDestroyPagingQueue
mov qword [0x14004f148], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004f120]
lea rdx, str.D3DKMTSubmitCommand
mov qword [0x14004f150], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004f120]
lea rdx, str.D3DKMTLock2
mov qword [0x14004f158], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004f120]
lea rdx, str.D3DKMTUnlock2
mov qword [0x14004f160], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x14004f120], 0
mov qword [0x14004f168], rax
je 0x14000f67c
cmp qword [0x14004f128], 0
je 0x14000f67c
cmp qword [0x14004f130], 0
je 0x14000f67c
cmp qword [0x14004f138], 0
je 0x14000f67c
cmp qword [0x14004f140], 0
je 0x14000f67c
cmp qword [0x14004f148], 0
je 0x14000f67c
cmp qword [0x14004f150], 0
je 0x14000f67c
cmp qword [0x14004f158], 0
je 0x14000f67c
cmp qword [0x14004f160], 0
je 0x14000f67c
movzx ebx, bl
mov ecx, 1
test rax, rax
cmovne ebx, ecx
movzx eax, bl
add rsp, 0x20
pop rbx
ret
Function at 0x140010690
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
sub rsp, 0x2c8
mov rax, qword [0x140028050]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8d, 0x208
call fcn.140014310
xor r9d, r9d
lea rdx, [rsp + 0xa0]
lea r8d, [r9 + 0x26]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1400107ff
lea r8, str.AMD920DEC42_4CA5_4d1d_9487_67BE645CDDFC_amdacpinstutil.exe
lea rcx, [rsp + 0xa0]
mov edx, 0x104
mov qword [rsp + 0x2c0], rbx
call fcn.140012b28
test eax, eax
jne 0x140010716
lea rdx, [rsp + 0xa0]
lea rcx, str.User_service_path__s__n
call fcn.14000d0f0
xor edx, edx
lea rcx, [rsp + 0x24]
lea r8d, [rdx + 0x6c]
call fcn.140014310
lea rax, str.open
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xa0]
xor ebx, ebx
mov qword [rsp + 0x38], rax
lea rax, str._install
mov dword [rsp + 0x20], 0x70
mov dword [rsp + 0x24], 0x40
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x40], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1400107c8
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140010792
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x88]
mov ebx, eax
test ebx, ebx
jne 0x140010778
xor eax, eax
mov bl, 1
mov dword [rsp + 0x90], eax
test rcx, rcx
je 0x1400107b9
lea rdx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp eax, 1
je 0x1400107dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._executeProc_failed_to_GetExitCodeProcess_with_error__d.
jmp 0x1400107d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._ShellExecute_Fail__d
mov edx, eax
call fcn.14000d100
movzx eax, bl
mov rbx, qword [rsp + 0x2c0]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140011740
add rsp, 0x2c8
ret
xor al, al
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140011740
add rsp, 0x2c8
ret
Function at 0x140010d60
Capabilities:
Access the windows event log

Disassembly:
mov r11, rsp
push rbx
push rsi
sub rsp, 0x98
mov rax, qword [0x140028050]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor eax, eax
xor esi, esi
cmp dword [0x14002a814], eax
mov dword [rsp + 0x50], esi
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov ebx, esi
jbe 0x140010ec2
mov qword [r11 + 8], rbp
mov qword [r11 + 0x18], r12
mov qword [r11 + 0x20], r14
mov qword [r11 - 0x18], r15
lea r12, [0x14002a818]
lea rbp, str.amdacpusrsvc
lea r15d, [rsi + 2]
mov qword [r11 + 0x10], rdi
lea r14, str._EVENT_:_SERVICE_CONTROL_POWEREVENT:_RESUME:_IOCTL_USR_SVC_TO_ACPKSD_POWER_STATE_NOTIFICATION:_FAILED
mov rcx, qword [0x14004f308]
mov qword [rsp + 0x38], rsi
mov eax, ebx
mov eax, dword [r12 + rax*8]
lea r8, [rsp + 0x58]
mov r9d, 0x20
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x50]
mov edx, 0x9c412c04
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x5c], 3
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140010e8c
mov rdx, rbp
xor ecx, ecx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rsi
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
je 0x140010e8c
mov qword [rsp + 0x40], rsi
xor r8d, r8d
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], esi
lea edx, [r8 + 1]
xor r9d, r9d
mov rcx, rdi
mov word [rsp + 0x28], r15w
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
inc ebx
cmp ebx, dword [0x14002a814]
jb 0x140010dd1
mov r15, qword [rsp + 0x90]
mov r14, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xc0]
mov rdi, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140011740
add rsp, 0x98
pop rsi
pop rbx
ret
Function at 0x140011030
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x140
mov rax, qword [0x140028050]
xor rax, rsp
mov qword [rsp + 0x130], rax
xor ecx, ecx
call fcn.140012fe8
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x28], rax
call fcn.140012bb0
lea r8, str.C:FbResumeImgDump__Y__m__d___H__M__S.bin
lea rcx, [rsp + 0x30]
mov edx, 0x100
mov r9, rax
call fcn.1400128ec
lea rdx, [0x1400250fc]
lea rcx, [rsp + 0x30]
call fcn.140012738
mov rsi, rax
test rax, rax
je 0x140011221
mov qword [rsp + 0x158], rdi
xor edi, edi
cmp byte [0x14004f2b1], 1
je 0x140011206
mov ecx, dword [0x14002a8b0]
mov dword [0x14004f270], ecx
mov ecx, dword [0x14004f230]
mov dword [0x14004f274], ecx
mov ecx, dword [0x14004f290]
and ecx, 0xfffffffc
or ecx, 0x10
mov dword [0x14004f290], ecx
lea rcx, [0x14004f270]
call qword [sym.imp.GDI32.dll_D3DKMTLock]
lea rcx, str.GraphicsMemoryService:_Target_LockedVirtualAddress__x_n_n
test eax, eax
cmove rdi, qword [0x14004f288]
mov rdx, rdi
call fcn.14000d0f0
test eax, eax
jne 0x140011206
lea rcx, str.DumpFbResumeImageContent:_Target_Surface_Virtual_Address_0x_x_n
mov qword [rsp + 0x150], rbx
mov byte [0x14004f2b1], 1
call fcn.14000d0f0
lea rbx, [0x14004f310]
mov edx, 0x20000
mov rax, rbx
sub rdi, rbx
nop word [rax + rax]
movzx ecx, byte [rdi + rax + 0x1c40000]
lea rax, [rax + 3]
mov byte [rax - 3], cl
movzx ecx, byte [rdi + rax + 0x1c3fffe]
mov byte [rax - 2], cl
movzx ecx, byte [rdi + rax + 0x1c3ffff]
mov byte [rax - 1], cl
dec rdx
jne 0x140011140
lea edi, [rdx + 6]
nop dword [rax]
mov r9, rsi
mov edx, 1
mov r8d, 0x10000
mov rcx, rbx
call fcn.140012a98
add rbx, 0x10000
dec rdi
jne 0x140011170
mov rcx, rsi
call fcn.140012f80
mov eax, dword [0x14004f230]
lea rcx, [0x14004f2a0]
mov dword [rsp + 0x20], eax
mov eax, dword [0x14002a8b0]
mov dword [0x14004f2a4], 1
mov dword [0x14004f2a0], eax
lea rax, [rsp + 0x20]
mov qword [0x14004f2a8], rax
call qword [sym.imp.GDI32.dll_D3DKMTUnlock]
mov rbx, qword [rsp + 0x150]
test eax, eax
jne 0x1400111e5
mov byte [0x14004f2b1], al
mov rdi, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140011740
add rsp, 0x140
pop rsi
ret
lea rcx, str.acpusrsvc:_DumpFbResumeImageContent:__Acquire_Target_Surface_FAILED
mov edx, 1
call fcn.14000d030
mov rcx, rsi
call fcn.140012f80
jmp 0x1400111e5
lea rcx, str.acpusrsvc:_DumpFbResumeImageContent:__File_Open_FAILED
mov edx, 1
call fcn.14000d030
jmp 0x1400111ed

Function at 0x140015a70
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400158d8