joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400eda90
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0xa0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rsi, r8
mov rbx, rdx
mov r14, rcx
mov qword [rcx + 0x28], 7
xor ebp, ebp
mov qword [rcx + 0x20], rbp
mov word [rcx + 0x10], bp
add rcx, 0x438
lea rdx, str.SynCom.PointingDevice
call fcn.140007930
lea rax, vtable.CDummySynDevice.0
mov qword [r14 + 0x450], rax
mov dword [r14 + 0x458], ebp
mov qword [r14 + 0x448], rbp
lea rax, vtable.SynDeviceEx.0
mov qword [r14 + 0x430], rax
lea rax, vtable.SynDeviceEx.1.0
mov qword [r14 + 0x440], rax
mov dword [r14 + 0x460], 0xffffffff
mov dword [r14 + 0x464], ebp
lea rcx, [r14 + 0x480]
call fcn.140107d50
nop
mov qword [r14], rbx
mov qword [r14 + 8], rsi
mov dword [r14 + 0x470], 0x800
mov qword [r14 + 0x468], rbp
mov qword [r14 + 0x478], rbp
mov dword [r14 + 0x474], 1
lea rbx, [r14 + 0x6a8]
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rsi, [r14 + 0x8b0]
mov word [rsi], bp
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor edx, edx
lea r8d, [rbp + 5]
lea rcx, [r14 + 0x480]
call fcn.140107df0
test eax, eax
jns 0x1400edcf0
lea rdx, str.Windows
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x1400edbd6
lea rdx, str.Program_Files
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x1400edccf
lea rcx, [rsp + 0x78]
call fcn.140101700
nop
lea r8, str.SynapticsSynTP
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140090f90
nop
cmp qword [rsp + 0x90], 8
jb 0x1400edc0b
mov rcx, qword [rsp + 0x78]
call fcn.14010a7dc
mov qword [rsp + 0x90], 7
mov qword [rsp + 0x88], rbp
mov word [rsp + 0x78], bp
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbp
mov word [rsp + 0x38], bp
cmp word [rdx], 0
je 0x1400edc5c
or rbp, 0xffffffffffffffff
inc rbp
cmp word [rdx + rbp*2], 0
jne 0x1400edc52
mov r8, rbp
lea rcx, [rsp + 0x38]
call fcn.140009080
nop
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.140100220
mov edi, eax
cmp qword [rsp + 0x50], 8
jb 0x1400edc8d
mov rcx, qword [rsp + 0x38]
call fcn.14010a7dc
mov r9, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
test edi, edi
je 0x1400edcc4
lea rdx, [rsp + 0x58]
cmp r9, 8
cmovae rdx, rcx
mov r8, rsi
nop dword [rax + rax]
movzx eax, word [rdx]
mov word [r8], ax
lea rdx, [rdx + 2]
lea r8, [r8 + 2]
test ax, ax
jne 0x1400edcb0
cmp r9, 8
jb 0x1400edccf
call fcn.14010a7dc
cmp word [rsi], 0
jne 0x1400edcf0
sub rsi, rbx
nop dword [rax + rax]
movzx eax, word [rbx]
mov word [rsi + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x1400edce0
mov rax, r14
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400f1bc0
Capabilities:
Get file version info

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
mov qword [r11 - 0x80], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov word [r11 - 0x78], r15w
xor eax, eax
mov qword [r11 - 0x76], rax
mov qword [r11 - 0x6e], rax
mov qword [r11 - 0x66], rax
mov qword [r11 - 0x5e], rax
mov qword [r11 - 0x56], rax
mov qword [r11 - 0x4e], rax
mov qword [r11 - 0x46], rax
mov word [rsp + 0x7a], ax
cmp qword [rdx + 0x18], 8
jb 0x1400f1c20
mov rcx, qword [rdx]
jmp 0x1400f1c23
mov rcx, rdx
lea rdx, [rsp + 0xc0]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
or rbx, 0xffffffffffffffff
test eax, eax
je 0x1400f1ce0
mov eax, 2
mul rbp
cmovo rax, rbx
mov rcx, rax
call fcn.1401098fc
mov r14, rax
cmp qword [rdi + 0x18], 8
jb 0x1400f1c61
mov rcx, qword [rdi]
jmp 0x1400f1c64
mov rcx, rdi
mov r9, rax
mov r8d, ebp
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400f1cd8
mov qword [rsp + 0xd8], r15
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0xd8]
lea rdx, [0x140150658]
mov rcx, r14
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400f1cd8
mov rdx, qword [rsp + 0xd8]
test rdx, rdx
je 0x1400f1cd8
movzx eax, word [rdx + 0xc]
movzx ecx, word [rdx + 0xe]
movzx r9d, word [rdx + 8]
movzx r8d, word [rdx + 0xa]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str.v_d._d._d._d
lea rcx, [rsp + 0x40]
call fcn.14010d300
mov rcx, r14
call fcn.14010e850
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], r15
mov word [rsi], r15w
cmp word [rsp + 0x40], 0
jne 0x1400f1cfd
mov rbx, r15
jmp 0x1400f1d0c
lea rax, [rsp + 0x40]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400f1d02
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140009080
nop
cmp qword [rdi + 0x18], 8
jb 0x1400f1d2c
mov rcx, qword [rdi]
call fcn.14010a7dc
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r15
mov word [rdi], r15w
mov rax, rsi
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400f3080
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rsi, rax
test rax, rax
je 0x1400f3157
movzx r8d, word [rax]
mov qword [rsp + 0x30], rbx
mov rbx, rax
test r8w, r8w
je 0x1400f3100
nop dword [rax]
lea rdx, [0x140172bb0]
movzx r8d, r8w
mov rcx, rdi
call fcn.140112ee4
movzx r8d, word [rbx + 2]
add rbx, 2
test r8w, r8w
jne 0x1400f30c0
lea rdx, [0x140161f34]
mov rcx, rdi
call fcn.140112ee4
movzx r8d, word [rbx + 2]
add rbx, 2
test r8w, r8w
jne 0x1400f30c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rcx, qword [rbp + 0x438]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov dword [rsp + 0x40], eax
test rcx, rcx
je 0x1400f3134
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
mov edx, 0x100001d2
call qword [rax + 0x18]
mov eax, dword [rsp + 0x40]
lea rcx, [0x140171df0]
test eax, eax
lea r8, [0x140171df8]
cmovne r8, rcx
lea rdx, str.IsUserAdmin_s_n
mov rcx, rdi
call fcn.140112ee4
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1400f3460
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2020
call fcn.14010cf70
sub rsp, rax
mov rbp, r8
mov rsi, rdx
xor edi, edi
nop word [rax + rax]
lea rdx, [0x1401510fc]
mov rcx, rbp
call fcn.14010c834
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400f34c4
test rbx, rbx
jne 0x1400f34df
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x3c
jl 0x1400f3490
xor eax, eax
lea r11, [rsp + 0x2020]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rcx, rbx
call fcn.14010ca58
test eax, eax
jne 0x1400f352c
nop dword [rax + rax]
mov rcx, rbx
call fcn.14010ca80
test eax, eax
jne 0x1400f352c
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x1000
call fcn.140112d68
test rax, rax
je 0x1400f352c
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.140112e30
mov rcx, rbx
call fcn.14010ca58
test eax, eax
je 0x1400f34f0
mov rcx, rsi
call fcn.14010d4bc
mov rcx, rbx
call fcn.14010c9f0
mov eax, 1
jmp 0x1400f34c6
Function at 0x1400fbeb0
Capabilities:
Delete registry key

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
xor r14d, r14d
mov ebp, r14d
lea rsi, str.HKLM_SoftwareSynapticsSynTP
nop dword [rax]
mov rdi, qword [rsi]
call fcn.140004e20
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x1400fc0b8
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
test rdi, rdi
je 0x1400fbf4c
test rdi, 0xffffffffffff0000
jne 0x1400fbf3c
movzx edi, di
xor edx, edx
mov ecx, edi
call fcn.140007c90
test rax, rax
je 0x1400fbf64
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140008550
jmp 0x1400fbf5f
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], 0
jne 0x1400fbf40
jmp 0x1400fbf4f
mov eax, r14d
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140008830
mov rbx, qword [rsp + 0x50]
movsxd rdi, dword [rbx - 0x10]
test edi, edi
js 0x1400fc0ad
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400fbf92
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140008630
mov rbx, qword [rsp + 0x50]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.14010d2ac
cmp edi, dword [rbx - 0xc]
jg 0x1400fc0a2
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], r14w
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x1400fbfd4
cmp rax, qword [rbx - 0x18]
jne 0x1400fbfd4
lea rdi, [rbx - 0x18]
lock inc dword [rbx - 8]
jmp 0x1400fc00f
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rdi, rax
test rax, rax
je 0x1400fc09c
mov ecx, dword [rbx - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rbx - 0x10]
inc ecx
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.14010bc38
lea rax, [rdi + 0x18]
mov qword [rsp + 0x58], rax
lock add dword [rbx - 8], 0xffffffff
jg 0x1400fc02d
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x58]
cmp dword [rbx - 0x10], 0
jl 0x1400fc05f
lea rdx, str.hkcu_software
mov rcx, rbx
call fcn.14010e42c
test rax, rax
je 0x1400fc05f
sub rax, rbx
sar rax, 1
test eax, eax
jne 0x1400fc05f
mov rcx, qword [rsi]
call fcn.1400f87e0
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400fc073
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc ebp
add rsi, 8
movsxd rax, ebp
cmp rax, 0xb
jb 0x1400fbee0
lea rdx, [0x1401610b0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyW]
jmp 0x1400fc0c3
call fcn.140008920
int3
mov ecx, 0x80070057
call fcn.140007d40
int3
mov ecx, 0x80070057
call fcn.140007d40
nop
mov ecx, 0x80004005
call fcn.140007d40
int3
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400fd030
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x270
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x290], rbx
cmp dword [0x1402b0b48], 0
jne 0x1400fd221
mov dword [0x1402b0b48], 1
call fcn.140104020
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
test eax, eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea edx, [rcx + 0x2a]
jne 0x1400fd082
lea edx, [rcx + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call fcn.140004e20
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1400fd0a7
mov ecx, 0x80004005
call fcn.140007d40
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x280], rax
lea rcx, [rsp + 0x60]
lea rax, [rsp + 0x60]
or rbx, 0xffffffffffffffff
test rax, 0xffffffffffff0000
jne 0x1400fd0f8
movzx edi, cx
xor edx, edx
mov ecx, edi
call fcn.140007c90
test rax, rax
je 0x1400fd120
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.140008550
jmp 0x1400fd120
lea rcx, [rsp + 0x60]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400fd100
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x280]
call fcn.140008830
nop
lea r8, str.LenovoMetricCollectionSDKMFCLenovo.MetricCollectionMFC.dll
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x288]
call fcn.14008d4c0
nop
mov rdx, qword [rsp + 0x280]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400fd159
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1402b0b18], rax
test rax, rax
je 0x1400fd205
lea rdx, str.GetMetricCollectionCollector
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1400fd205
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.140105fd0
mov byte [rsp + 0x48], 1
lea rax, str.SynapticsAppsCollectionReport
mov qword [rsp + 0x40], rax
lea rax, str.Local_Todo
mov qword [rsp + 0x38], rax
lea rax, str.Countyr_Todo
mov qword [rsp + 0x30], rax
lea rax, str.Family_Todo
mov qword [rsp + 0x28], rax
lea rax, str.SubBrand_Todo
mov qword [rsp + 0x20], rax
lea r9, str.Brand_Todo
lea r8, str.MTM_Todo
lea rdx, str.19.6.1.18
lea rcx, [rsp + 0x60]
call rdi
mov qword [0x1402b0b10], rax
mov rdx, qword [rsp + 0x288]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400fd221
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [0x1402b0b10]
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret
Function at 0x1400fd850
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x670
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x698], rbx
mov rdi, rcx
lea rax, vtable.CSynDeviceGestureActionService.0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
lea rbx, [rcx + 0x18]
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov rcx, rbx
call fcn.1400fe440
mov qword [rbx], rax
mov dword [rsp + 0x688], 0x101
lea rdx, [rsp + 0x688]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rax, qword [rdi + 8]
mov rcx, qword [rax + 0x58]
test rcx, rcx
jne 0x1400fd8c6
lea rcx, [rax + 0x70]
mov rax, qword [rcx]
lea r8, [rsp + 0x690]
mov edx, 0x10000101
call qword [rax + 0x18]
or ecx, 0xffffffff
test eax, eax
cmove ecx, dword [rsp + 0x690]
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x60]
lea r8, str..pipe_sC01BC476_A852_4dfd_B33F_E308F3497BF4_li
mov edx, 0x200
lea rcx, [rsp + 0x270]
call fcn.14010d3c4
lea r9, [0x140150658]
lea r8, [0x14016191c]
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1401037f0
cmp qword [rax + 0x10], 0
setne bl
cmp qword [rsp + 0x48], 8
jb 0x1400fd93c
mov rcx, qword [rsp + 0x30]
call fcn.14010a7dc
test bl, bl
je 0x1400fd99c
lea r9, [0x140150658]
lea r8, [0x14016191c]
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1401037f0
cmp qword [rax + 0x18], 8
jb 0x1400fd964
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x270]
lea r8, str._s_s
mov edx, 0x200
lea rcx, [rsp + 0x270]
call fcn.14010d3c4
cmp qword [rsp + 0x48], 8
jb 0x1400fd99c
mov rcx, qword [rsp + 0x30]
call fcn.14010a7dc
mov edx, 0x3d
lea rcx, [rsp + 0x270]
call fcn.1400029d0
mov qword [rdi + 0x10], rax
test rax, rax
je 0x1400fd9c3
mov rdx, rdi
mov rcx, rax
call fcn.140002780
nop
mov rax, rdi
mov rbx, qword [rsp + 0x698]
add rsp, 0x670
pop rdi
ret
Function at 0x1400ffdd0
Capabilities:
Query service status

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x2c0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.1400ec950
nop
mov ebp, 1
mov dword [rsp + 0x2d0], ebp
xor ebx, ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPInstall
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x78]
call fcn.1400ecac0
test eax, eax
je 0x1400fff4f
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x2d0]
lea r8, [rsp + 0x2d0]
lea rdx, str.EnhancementLaunchMode
lea rcx, [rsp + 0x80]
call fcn.1401069b0
test byte [rsp + 0x2d0], bpl
je 0x1400fff4f
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], eax
mov r8d, ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x1400fff4f
lea r9, [0x140150658]
lea r8, [0x14016191c]
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.1401037f0
cmp qword [rax + 0x18], 8
jb 0x1400ffebf
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, str.SynTPEnhService
lea r8, str._s_s
mov edx, 0x104
lea rcx, [rsp + 0xb0]
call fcn.14010d3c4
cmp qword [rsp + 0x70], 8
jb 0x1400ffef6
mov rcx, qword [rsp + 0x58]
call fcn.14010a7dc
mov r8d, 4
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x1400fff1d
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400fff37
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400fff37
cmp dword [rsp + 0x34], 4
cmove ebx, ebp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x1400fff4f
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
lea rcx, [rsp + 0x78]
call fcn.1400eca60
mov eax, ebx
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140101670
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, 1
mov edx, eax
mov ecx, ebp
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test rdi, rdi
je 0x1401016cd
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetFocus]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov ecx, ebp
mov edx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140101700
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x240
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x250], rbx
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov eax, dword [0x1402b0bc8]
test al, 1
jne 0x140101772
or eax, 1
mov dword [0x1402b0bc8], eax
mov qword [0x1402b0bc0], 7
mov qword [0x1402b0bb8], rdi
mov word [0x1402b0ba8], di
xor r8d, r8d
lea rdx, [0x140150af4]
lea rcx, [0x1402b0ba8]
call fcn.140009080
lea rcx, [0x14014e9b0]
call fcn.14010bb08
nop
cmp dword [0x1402b0ba4], 0
jne 0x1401017d6
mov r9d, 1
lea r8d, [r9 + 0x22]
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [rsp + 0x30], 0
jne 0x14010179f
mov r8, rdi
jmp 0x1401017bb
lea rax, [rsp + 0x30]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1401017b0
lea rdx, [rsp + 0x30]
lea rcx, [0x1402b0ba8]
call fcn.140009080
mov dword [0x1402b0ba4], 1
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
mov word [rbx], di
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [0x1402b0ba8]
mov rcx, rbx
call fcn.140008f30
mov rax, rbx
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x140101e40
Capabilities:
Get session user name

Disassembly:
push rbx
push rsi
sub rsp, 0x258
mov rsi, rcx
mov dword [rcx], 1
lea rcx, [rsp + 0x42]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], bx
call fcn.14010a9a0
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x270], 0x104
mov qword [rsp + 0x278], rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140101f73
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x250], rdi
call fcn.140065540
cmp qword [rax + 0x18], 8
jb 0x140101ebb
mov rax, qword [rax]
lea r9, [rsp + 0x278]
mov r8d, 1
mov rdx, rax
xor ecx, ecx
call sub.NETAPI32.dll_NetUserGetInfo
cmp qword [rsp + 0x38], 8
mov edi, eax
jb 0x140101ee7
mov rcx, qword [rsp + 0x20]
call fcn.14010a7dc
test edi, edi
je 0x140101f4f
lea r8, [rsp + 0x280]
mov edx, 1
xor ecx, ecx
mov qword [rsp + 0x280], rbx
call sub.NETAPI32.dll_NetWkstaUserGetInfo
mov edi, eax
test eax, eax
jne 0x140101f2f
mov rcx, qword [rsp + 0x280]
lea r9, [rsp + 0x278]
lea r8d, [rax + 1]
mov rdx, qword [rcx]
mov rcx, qword [rcx + 0x18]
call sub.NETAPI32.dll_NetUserGetInfo
mov edi, eax
mov rcx, qword [rsp + 0x280]
test rcx, rcx
je 0x140101f41
call sub.NETAPI32.dll_NetApiBufferFree
test edi, edi
je 0x140101f4f
mov rcx, qword [rsp + 0x278]
jmp 0x140101f61
mov rcx, qword [rsp + 0x278]
mov ebx, 1
mov eax, dword [rcx + 0x14]
mov dword [rsi], eax
mov rdi, qword [rsp + 0x250]
test rcx, rcx
je 0x140101f73
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, ebx
add rsp, 0x258
pop rsi
pop rbx
ret

Function at 0x140101fc0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x260
mov edi, ecx
mov r14, rdx
xor esi, esi
lea ecx, [rsi + 2]
xor edx, edx
mov ebp, r8d
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [rsp + 0x20], 0x238
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14010204a
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140102041
cmp dword [rsp + 0x28], edi
je 0x14010202c
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140102013
jmp 0x140102041
lea r8, [rsp + 0x4c]
mov rdx, rbp
mov rcx, r14
call fcn.14010cfc0
mov esi, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x260]
mov eax, esi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140103c50
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x430
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rdi, rdx
mov rbx, rcx
xor esi, esi
mov dword [rsp + 0x20], esi
mov eax, dword [0x1402b0c30]
test al, 1
jne 0x140103cc7
or eax, 1
mov dword [0x1402b0c30], eax
mov qword [0x1402b0c28], 7
mov qword [0x1402b0c20], rsi
mov word [0x1402b0c10], si
xor r8d, r8d
lea rdx, [0x140150af4]
lea rcx, [0x1402b0c10]
call fcn.140009080
lea rcx, [0x14014ea90]
call fcn.14010bb08
nop
mov r8d, 0x200
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [rsp + 0x30], 0
jne 0x140103ce8
mov r8, rsi
jmp 0x140103cfc
lea rax, [rsp + 0x30]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140103cf1
lea rdx, [rsp + 0x30]
lea rcx, [0x1402b0c10]
call fcn.140009080
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
mov word [rbx], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [0x1402b0c10]
mov rcx, rbx
call fcn.140008f30
mov rax, rbx
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1401040c0
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
sub rsp, 0x468
cmp dword [0x1402b0b9c], 0
jne 0x1401041ee
mov qword [rax - 8], rbx
xor ebx, ebx
mov word [rax + 0x14], 0x500
mov qword [rax + 0x20], rbx
mov qword [rax + 0x18], rbx
mov dword [rax + 0x10], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x488]
lea edx, [rbx + 8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1401041e6
mov rcx, qword [rsp + 0x488]
lea rax, [rsp + 0x470]
lea r8, [rsp + 0x60]
lea edx, [rbx + 2]
mov r9d, 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1401041d8
lea rax, [rsp + 0x480]
lea r8d, [rbx + 0x20]
lea rcx, [rsp + 0x478]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov r9d, 0x220
mov dl, 2
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1401041d8
cmp dword [rsp + 0x60], ebx
jbe 0x1401041c0
nop word [rax + rax]
mov rcx, qword [rsp + 0x480]
mov edx, ebx
add rdx, rdx
mov rdx, qword [rsp + rdx*8 + 0x68]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1401041b6
inc ebx
cmp ebx, dword [rsp + 0x60]
jb 0x140104190
jmp 0x1401041c0
mov dword [0x1402b0ba0], 1
mov rcx, qword [rsp + 0x480]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [0x1402b0b9c], 1
mov rcx, qword [rsp + 0x488]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x460]
mov eax, dword [0x1402b0ba0]
add rsp, 0x468
ret