joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f5950
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x280
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x2b0], rbx
mov rax, qword [0x1401dd1d8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rdx
mov rbp, rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
xor dil, dil
call sub.mfc140u.dll_AfxFieldText
mov rdx, qword [rax + 8]
add rdx, 0x250
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
mov rcx, rbp
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov rdx, 0xffffffff80000001
mov r9d, 0x20019
lea rcx, [rsp + 0x48]
call fcn.1400f0180
mov rbx, qword [rsp + 0x48]
test eax, eax
jne 0x1400f5a62
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov dword [rsp + 0x30], 0x400
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400f5a65
mov eax, dword [rsp + 0x38]
dec eax
cmp eax, 1
ja 0x1400f5a65
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400f5a5d
test al, 1
jne 0x1400f5a65
shr rax, 1
cmp word [rsp + rax*2 + 0x6e], 0
jne 0x1400f5a65
mov dil, 1
jmp 0x1400f5a65
xor dil, dil
test rbx, rbx
je 0x1400f5a75
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
test rbx, rbx
je 0x1400f5a90
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, rbp
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
movzx eax, dil
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14010f260
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400f7cf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
cmp ebx, 0xffffffff
jne 0x1400f7d2f
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400f97e0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x270
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x290], rbx
mov rax, qword [0x1401dd1d8]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x30], 0
call qword [sym.imp.mfc140u.dll_Ordinal_296]
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1c]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400f9861
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
nop
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14010f260
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret

Function at 0x1400fa4c0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x280
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x1401dd1d8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r14, rcx
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x30], 0
call qword [sym.imp.mfc140u.dll_Ordinal_296]
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400fa5e1
lea rdx, [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
lea rdx, str.AnakageCommon_
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rbp, rax
mov dword [rsp + 0x30], 3
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rax, r14
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14010f260
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400fa850
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x280
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x1401dd1d8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r14, rcx
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x30], 0
call qword [sym.imp.mfc140u.dll_Ordinal_296]
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400fa971
lea rdx, [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
lea rdx, [0x14017ba60]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rbp, rax
mov dword [rsp + 0x30], 3
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rax, r14
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14010f260
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400fb9d0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0xfe0
mov rax, qword [0x1401dd1d8]
xor rax, rsp
mov qword [rsp + 0xfd0], rax
mov r10, rdx
mov qword [rsp + 0x20], rcx
mov rbx, rcx
lea r9, [rsp + 0x30]
mov rcx, r10
xor r8d, r8d
xor edx, edx
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rdx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
mov rax, rbx
mov rcx, qword [rsp + 0xfd0]
xor rcx, rsp
call fcn.14010f260
add rsp, 0xfe0
pop rbx
ret

Function at 0x1400fba40
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1401dd1d8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x20]
mov rbx, rcx
mov dword [rsp + 0x20], 0x101
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14010f260
add rsp, 0x250
pop rbx
ret
Function at 0x1400fcb10
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x290
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x1401dd1d8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, r9
mov rsi, r8
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], r8
xor r15d, r15d
mov qword [rsp + 0x50], r15
mov dword [rsp + 0x58], r15d
mov qword [rsp + 0x60], r15
mov rcx, rdx
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov r9d, 0x20019
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.1400f0180
test eax, eax
jne 0x1400fcc42
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov dword [rsp + 0x38], 0x400
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rax
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400fcbee
mov eax, dword [rsp + 0x30]
dec eax
cmp eax, 1
ja 0x1400fcbee
cmp dword [rsp + 0x38], r15d
jne 0x1400fcbee
mov word [rsp + 0x80], r15w
test rdi, rdi
je 0x1400fcc04
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r15
mov qword [rsp + 0x50], r15
mov dword [rsp + 0x58], r15d
lea rdx, [rsp + 0x80]
mov rcx, r14
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
nop
test rdi, rdi
je 0x1400fcc2a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rax, r14
jmp 0x1400fcc72
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400fcc53
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x1400fcc5f
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14010f260
add rsp, 0x290
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400fcca0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x280
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x1401dd1d8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r14, rcx
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
mov dword [rsp + 0x30], 1
lea rdx, [0x14017ba60]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rbp, rax
mov dword [rsp + 0x30], 3
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rax, r14
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14010f260
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x1400fd440
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0xa8
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1401dd1d8]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x50], 0x40
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x1400fd4a6
mov rax, qword [rsp + 0x58]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
test rax, rax
jns 0x1400fd493
addss xmm0, dword [0x140185710]
mulss xmm0, dword [0x140185708]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
cvttss2si eax, xmm0
jmp 0x1400fd4ad
mov eax, 4
jmp 0x1400fd4ad
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14010f260
add rsp, 0xa8
ret
Function at 0x1400fe720
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400fe752
test al, 0x10
je 0x1400fe752
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov al, 1
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400fe770
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x290
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1401dd1d8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov ebx, edx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor ebp, ebp
xor edx, edx
lea ecx, [rbp + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
xor edx, edx
mov r8d, CMenuHash::CMenuHash
lea rcx, [rsp + 0x44]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], CMenuHash::CMenuHash
lea rdx, [rsp + 0x40]
mov rcx, rsi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400fe848
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
xor r8d, r8d
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ecx, dword [rsp + 0x48]
test eax, eax
jns 0x1400fe83b
cmp ebx, 0xffffffff
je 0x1400fe821
cmp ebx, ecx
je 0x1400fe83b
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
jmp 0x1400fe7e2
mov ebp, ecx
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebp, ebp
je 0x1400fe863
mov al, 1
jmp 0x1400fe865
xor al, al
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14010f260
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400fe890
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x290
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1401dd1d8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov ebx, edx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor ebp, ebp
xor edx, edx
lea ecx, [rbp + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
xor edx, edx
mov r8d, CMenuHash::CMenuHash
lea rcx, [rsp + 0x44]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], CMenuHash::CMenuHash
lea rdx, [rsp + 0x40]
mov rcx, rsi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400fe968
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
xor r8d, r8d
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ecx, dword [rsp + 0x48]
test eax, eax
jns 0x1400fe95b
cmp ebx, 0xffffffff
je 0x1400fe941
cmp ebx, ecx
je 0x1400fe95b
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
jmp 0x1400fe902
mov ebp, ecx
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebp, ebp
je 0x1400fe983
mov al, 1
jmp 0x1400fe985
xor al, al
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14010f260
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400ff5a0
Capabilities:
Query service status

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x2a0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1401dd1d8]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rsi, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0x80000000
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x1400ff63d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x40], rax
lea rdx, [0x1401497d8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rdi, rax
lea rdx, str.OpenSCManager_failed
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
call fcn.140105fe0
xor eax, eax
jmp 0x1400ff774
mov r8d, 0x80000000
lea rdx, str.HealITService
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x1400ff6b9
lea rax, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea rdx, [0x1401497d8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov r14, rax
lea rdx, str.OpenService_failed___d__n
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, r14
mov rcx, rdi
call fcn.140105fe0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [rsi], 0
xor eax, eax
jmp 0x1400ff774
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1400ff73b
lea rax, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea rdx, [0x1401497d8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov r14, rax
lea rdx, str.QueryServiceStatusEx_failed___d__n
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, r14
mov rcx, rsi
call fcn.140105fe0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x1400ff774
mov eax, dword [rsp + 0x6c]
dec eax
mov rcx, rdi
test eax, 0xfffffffd
je 0x1400ff761
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x1400ff774
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x1400ff774
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.14010f260
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret