joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400024eb
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140096690
mov rax, rcx
neg rcx
test rax, 7
je 0x1400966ad
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140096708
test al, 7
jne 0x1400966a0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1400966c1
mov rdx, qword [rax - 8]
test dl, dl
je 0x140096732
test dh, dh
je 0x14009672c
shr rdx, 0x10
test dl, dl
je 0x140096726
test dh, dh
je 0x140096720
shr rdx, 0x10
test dl, dl
je 0x14009671a
test dh, dh
je 0x140096714
shr edx, 0x10
test dl, dl
je 0x14009670e
test dh, dh
jne 0x1400966c1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400027d4
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140021a30
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400213b0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140021a6f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14012c020]
jmp 0x140021a79
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x140002923
Capabilities:
Query environment variable

Disassembly:
jmp 0x1400a7760
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400a7590
lea rcx, [rsp + 0x40]
call fcn.1400a7710
movzx eax, al
test eax, eax
jne 0x1400a77a8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1400a75c0
mov rax, qword [rsp + 0x70]
jmp 0x1400a7979
lea rcx, [rsp + 0x40]
call fcn.1400a76e0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1400a7680
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.1400a76e0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1400032e7
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1400a784e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1400a75c0
mov rax, qword [rsp + 0x80]
jmp 0x1400a7979
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400026f3
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400025e5
lea rcx, [rsp + 0x48]
call fcn.1400022e3
movzx eax, al
test eax, eax
jne 0x1400a78b5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.140001730
lea rcx, [rsp + 0x40]
call fcn.1400a75c0
mov rax, qword [rsp + 0x88]
jmp 0x1400a7979
lea rcx, [rsp + 0x48]
call fcn.140002bc1
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.1400a76e0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1400032e7
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1400a794b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.140001730
lea rcx, [rsp + 0x40]
call fcn.1400a75c0
mov rax, qword [rsp + 0xa0]
jmp 0x1400a7979
lea rcx, [rsp + 0x48]
call fcn.1400025c2
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.140001730
lea rcx, [rsp + 0x40]
call fcn.1400a75c0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x14000292d
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140021960
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.140021330
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400219a1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14012c020]
jmp 0x1400219a7
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x1400029af
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400b53d0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.1400b4300
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400b5437
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x14012c030]
jmp 0x1400b5459
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.140002293
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1400029be
Capabilities:
Terminate process

Disassembly:
jmp 0x14000ad90
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140002b71
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400c1b20
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x14011c040]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x1400c1b46
jmp 0x1400c1bc3
mov rcx, qword [rbp + 0x30]
call fcn.1400024eb
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x1400c1b5f
jmp 0x1400c1bc3
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x1400c1b7c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140001870
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.140001c17
test eax, eax
jne 0x1400c1bc3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.140002685
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x140002c8e
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400de9f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov rax, qword [rsp]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400dea14
xor eax, eax
jmp 0x1400dea62
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
je 0x1400dea3c
xor eax, eax
jmp 0x1400dea62
mov rax, qword [rsp + 8]
add rax, 0x18
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
movzx eax, word [rax]
cmp eax, 0x20b
je 0x1400dea5d
xor eax, eax
jmp 0x1400dea62
mov eax, 1
add rsp, 0x28
ret

Function at 0x140002fc7
Capabilities:
Parse pe header

Disassembly:
jmp 0x140008aa0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140008ac0
xor al, al
jmp 0x140008b41
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140008ad3
xor al, al
jmp 0x140008b41
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140008afd
xor al, al
jmp 0x140008b41
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140008b11
xor al, al
jmp 0x140008b41
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140008b23
xor al, al
jmp 0x140008b41
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140008b3f
xor al, al
jmp 0x140008b41
mov al, 1
add rsp, 0x38
ret
Function at 0x140003260
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x1400de860
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x10], rax
mov dword [rsp], 0
mov rax, qword [rsp + 0x10]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x10]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 8], rax
jmp 0x1400de8be
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 8]
add rax, 0x28
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x10]
movzx eax, word [rax + 6]
cmp dword [rsp], eax
jae 0x1400de8fd
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0xc]
cmp qword [rsp + 0x38], rax
jb 0x1400de8fb
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 8]
add eax, dword [rcx + 8]
mov eax, eax
cmp qword [rsp + 0x38], rax
jae 0x1400de8fb
mov rax, qword [rsp + 8]
jmp 0x1400de8ff
jmp 0x1400de8a8
xor eax, eax
add rsp, 0x28
ret

Function at 0x140003459
Capabilities:
Terminate process

Disassembly:
jmp 0x140097080
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1400970ae
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.140003b0c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140003b6b
Capabilities:
Print debug messages

Disassembly:
jmp 0x14009e110
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x140003c0b
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x140021aa0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400213f0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140021ae9
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14012c020]
jmp 0x140021af8
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x140003ca6
Capabilities:
Set environment variable

Disassembly:
jmp 0x1400c49d0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.140002180
lea rcx, [rsp + 0x48]
call fcn.140002180
call fcn.1400028d3
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.140001fcd
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1400c4a3f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.140002428
lea rcx, [rsp + 0x78]
call fcn.140002428
mov eax, dword [rsp + 0x24]
jmp 0x1400c4ad0
call fcn.1400028d3
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.140001fcd
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1400c4a86
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.140002428
lea rcx, [rsp + 0x78]
call fcn.140002428
mov eax, dword [rsp + 0x2c]
jmp 0x1400c4ad0
lea rcx, [rsp + 0x48]
call fcn.140002112
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.140002112
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.140002428
lea rcx, [rsp + 0x78]
call fcn.140002428
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret

Function at 0x140021a30
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140021a30
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400213b0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140021a6f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14012c020]
jmp 0x140021a79
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x1400d26f0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.140001870
sub rsp, rax
mov rax, qword [0x14011c040]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14011eb60]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1400d28e2
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x1400d2836
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1400d2836
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x1400d281b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x1400d27b8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400d28a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400d2901
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x1400d28dd
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400d2901
jmp 0x1400d278e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140002685
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1400d29b0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.140001870
sub rsp, rax
mov rax, qword [0x14011c040]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14011eb60]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1400d2bbd
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x1400d2b09
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1400d2b09
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x1400d2ae9
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x1400d2a78
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400d2b7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400d2bdc
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x1400d2bb8
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400d2bdc
jmp 0x1400d2a4e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140002685
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140002260
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x60
mov rdi, rcx
dec edx
je 0x140002283
cmp edx, 3
jne 0x1400023d5
call fcn.140002120
xor eax, eax
add rsp, 0x60
pop rdi
ret
mov rcx, qword [rcx + 0x18]
mov qword [rsp + 0x58], rbx
xor ebx, ebx
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x80], ebx
mov esi, ebx
test rcx, rcx
je 0x1400022bb
mov rax, qword [rcx]
lea r8, [rsp + 0x80]
mov edx, 0x10000171
call qword [rax + 0x18]
mov esi, dword [rsp + 0x80]
lea rax, [rsp + 0x88]
lea rdx, str.SOFTWARESynapticsUltraNav
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x78], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 2
jne 0x14000232b
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x88]
lea rdx, str.SOFTWARESynapticsUltraNav
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [rsp + 0x88]
mov eax, ebx
test esi, esi
sete al
lea rdx, str.TrackPad
mov r9d, 4
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x78]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rdi + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov dword [rsp + 0x80], ebx
test rcx, rcx
je 0x140002397
mov rax, qword [rcx]
lea r8, [rsp + 0x80]
mov edx, 0x10000171
call qword [rax + 0x18]
mov eax, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
test eax, eax
lea rax, [rsp + 0x78]
sete bl
lea rdx, str.TrackPoint
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x78], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x60
pop rdi
ret
Function at 0x140002440
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x14001d008]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
mov rdi, rcx
or rbx, 0xffffffffffffffff
mov qword [rcx], rax
mov qword [rsp + 0x30], rax
call fcn.1400018d0
cmp word [rax], 0
je 0x1400024d4
xor eax, eax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x38], 0x38
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
call fcn.1400018d0
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400024d4
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov eax, dword [0x140020254]
test al, 1
jne 0x1400024f5
or eax, 1
mov dword [0x140020254], eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x14002024c], eax
jmp 0x1400024fb
mov eax, dword [0x14002024c]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140002521
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov ecx, dword [0x14002024c]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rdx, [rsp + 0x70]
lea rcx, str.SynCom.SynAPI
call qword [sym.imp.ole32.dll_CLSIDFromProgID]
xor edx, edx
lea r9, str.c_a2A
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x15]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140002562
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
cmp rbx, 0xffffffffffffffff
je 0x140002571
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov rax, rdi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140003200
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x1400025a0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x14001d008]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
mov rdi, rcx
or rbx, 0xffffffffffffffff
mov qword [rcx], rax
mov qword [rsp + 0x30], rax
call fcn.1400018d0
cmp word [rax], 0
je 0x140002634
xor eax, eax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x38], 0x38
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
call fcn.1400018d0
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002634
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov eax, dword [0x140020250]
test al, 1
jne 0x140002655
or eax, 1
mov dword [0x140020250], eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140020248], eax
jmp 0x14000265b
mov eax, dword [0x140020248]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140002681
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov ecx, dword [0x140020248]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rdx, [rsp + 0x70]
lea rcx, str.SynCom.PointingDevice
call qword [sym.imp.ole32.dll_CLSIDFromProgID]
xor edx, edx
lea r9, [0x140019918]
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x15]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x1400026c2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
cmp rbx, 0xffffffffffffffff
je 0x1400026d1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov rax, rdi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140003200
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret

Function at 0x140004e94
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140004cfc