joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b1aa0
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
lea rdi, [rsp + 0x20]
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
cmp dword [rsp + 0x58], 0
je 0x1400b1ad5
mov dword [rsp + 0x34], 1
jmp 0x1400b1add
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x24], eax
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.1400d050c
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x1400c2f60
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400c2f96
mov eax, 0x1b
jmp 0x1400c2fe6
mov rax, qword [rsp + 0x40]
add rax, 8
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1400c2fe4
xor edx, edx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov eax, 2
jmp 0x1400c2fe6
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x1400c3000
Capabilities:
Hash data via wincrypt

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
nop
add rsp, 0x20
pop rdi
ret

Function at 0x1400c3110
Capabilities:
Get hostname
Query environment variable

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
lea rcx, str.CURL_GETHOSTNAME
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400c315b
mov eax, dword [rsp + 0x58]
dec eax
cdqe
mov r8, rax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_strncpy
mov dword [rsp + 0x20], 0
jmp 0x1400c3180
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x50]
mov byte [rcx + rax], 0
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_gethostname]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x58]
dec eax
cdqe
mov rcx, qword [rsp + 0x50]
mov byte [rcx + rax], 0
cmp dword [rsp + 0x20], 0
je 0x1400c319e
mov eax, dword [rsp + 0x20]
jmp 0x1400c31c4
mov edx, 0x2e
mov rcx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_strchr
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400c31c2
mov rax, qword [rsp + 0x28]
mov byte [rax], 0
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x1400c3950
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xe0
lea rdi, [rsp + 0x40]
mov ecx, 0x28
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xf0]
mov rax, qword [0x14013be00]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0xb4], 8
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400c39c6
xor al, al
jmp 0x1400c3ad8
mov r8d, reloc.WS2_32.dll_sendto
xor edx, edx
lea rcx, [rsp + 0x88]
call sub.VCRUNTIME140.dll_memset
mov byte [rsp + 0x88], 8
mov byte [rsp + 0x89], 2
mov dword [rsp + 0x8c], 0x6601
mov dword [rsp + 0x90], 8
lea rdx, [rsp + 0x94]
mov rcx, qword [rsp + 0x100]
call fcn.1400c3760
mov edx, 8
lea rcx, [rsp + 0x94]
call fcn.1400c8a70
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x1400c3a6b
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
jmp 0x1400c3ad8
mov r8d, 8
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xf8]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0xb4]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_connect
call fcn.1400d050c
mov rax, rdi
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400d0280
add rsp, 0xe0
pop rdi
ret

Function at 0x1400c6e50
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400c6e86
mov eax, 0x1b
jmp 0x1400c6ed6
mov rax, qword [rsp + 0x40]
add rax, 8
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1400c6ed4
xor edx, edx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov eax, 2
jmp 0x1400c6ed6
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1400c6ef0
Capabilities:
Hash data via wincrypt

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
nop
add rsp, 0x20
pop rdi
ret

Function at 0x1400c8c50
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov rax, qword [rsp + 0x40]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400c8c9c
xor eax, eax
jmp 0x1400c8cec
mov rax, qword [rsp + 0x40]
add rax, 8
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8002
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1400c8ce7
xor edx, edx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
xor eax, eax
jmp 0x1400c8cec
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x1400c8d00
Capabilities:
Hash data via wincrypt

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
nop
add rsp, 0x20
pop rdi
ret
Function at 0x1400ceaa0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x10
mov dword [rsp], 0x80000000
mov dword [rsp + 4], 0
mov eax, dword [rsp]
mov ecx, dword [rsp + 0x20]
and ecx, eax
mov eax, ecx
test eax, eax
je 0x1400ceaee
mov eax, dword [rsp + 0x28]
mov ecx, dword [rsp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 4], eax
mov eax, dword [rsp]
dec eax
mov ecx, dword [rsp + 0x20]
and ecx, eax
mov eax, ecx
test eax, eax
jne 0x1400ceaee
jmp 0x1400ceb26
mov eax, dword [rsp]
shr eax, 1
mov dword [rsp], eax
mov eax, dword [rsp + 0x28]
and eax, 1
test eax, eax
je 0x1400ceb12
mov eax, dword [rsp + 0x28]
shr eax, 1
xor eax, 0xedb88320
mov dword [rsp + 8], eax
jmp 0x1400ceb1c
mov eax, dword [rsp + 0x28]
shr eax, 1
mov dword [rsp + 8], eax
mov eax, dword [rsp + 8]
mov dword [rsp + 0x28], eax
jmp 0x1400ceabc
mov eax, dword [rsp + 4]
add rsp, 0x10
pop rdi
ret

Function at 0x1400cebc0
Capabilities:
Encrypt data using rc4 prga
Hash data with crc32

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x10
mov dword [rsp], 0
jmp 0x1400cebda
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
cmp dword [rsp], 4
jge 0x1400cec03
mov eax, dword [rsp + 0x20]
shr eax, 8
mov ecx, dword [rsp + 0x20]
and ecx, 0xff
mov ecx, ecx
lea rdx, [0x1400eb450]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 0x20], eax
jmp 0x1400cebd2
mov eax, dword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret

Function at 0x1400cec20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x10
mov dword [rsp], 0
jmp 0x1400cec3a
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
cmp dword [rsp], 4
jge 0x1400cec66
mov eax, dword [rsp + 0x20]
shl eax, 8
mov ecx, dword [rsp + 0x20]
shr ecx, 0x18
and ecx, 0xff
mov ecx, ecx
lea rdx, [0x1400eb850]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 0x20], eax
jmp 0x1400cec32
mov eax, dword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x1400d0de4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400d0e2e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400d0e2e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400d0e2e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400d0e2e
cmp dword [rcx + 0x84], 0xe
jbe 0x1400d0e2e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400d0e30
xor al, al
add rsp, 0x28
ret
Function at 0x140002380
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ebx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
mov rcx, qword [rdi + 0x288]
movabs rax, 0x20c49ba5e353f7cf
imul rcx, rbx
imul rcx
mov rbx, rdx
sar rbx, 7
mov rax, rbx
shr rax, 0x3f
add rbx, rax
add rbx, qword [rsp + 0x30]
nop dword [rax + rax]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
cmp qword [rsp + 0x40], rbx
jle 0x1400023d0
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400059e0
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x290
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov edi, 0x80004005
lea rcx, [rsp + 0x30]
call fcn.140002a20
nop
xor esi, esi
mov ebx, esi
cmp qword [rsp + 0x30], rbx
je 0x140005a75
mov ecx, 0xd0
call fcn.14001b9a0
mov qword [rsp + 0x2a0], rax
test rax, rax
je 0x140005a3b
mov rcx, rax
call fcn.140004ef0
mov rbx, rax
jmp 0x140005a3e
mov rbx, rsi
test rbx, rbx
je 0x140005a75
mov rcx, rbx
call fcn.140005540
mov edi, eax
test eax, eax
js 0x140005a75
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x140005bf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [rbx + 0xb8], rax
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140005a8c
lock inc dword [rax + 8]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140002b90
test edi, edi
jns 0x140005b88
test rbx, rbx
je 0x140005b88
mov dword [rbx], 1
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140005ac7
call qword [sym.imp.KERNEL32.DLL_SetEvent]
mov rdi, qword [rbx + 0x28]
test rdi, rdi
je 0x140005b70
xor eax, eax
mov qword [rsp + 0x64], rax
mov dword [rsp + 0x7c], eax
xor edx, edx
mov r8d, 0x1fb
lea rcx, [rsp + 0x94]
call fcn.14003a210
mov dword [rsp + 0x60], 7
mov dword [rsp + 0x6c], esi
mov rax, qword [rbx + 8]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x3000
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x80], rax
mov rax, qword [rbx + 0x38]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x90], 0x1000
mov dword [rsp + 0x28], reloc.OLEAUT32.dll_SafeArrayAccessData
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, 0x22f
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.1400030e0
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x40], rsi
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140005b70
call fcn.14003d5c4
mov qword [rbx + 0x20], rsi
mov rcx, rbx
call fcn.1400050f0
mov edx, 0xd0
mov rcx, rbx
call fcn.14001b9dc
mov rbx, rsi
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x140005bcc
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140005bcc
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax]
call qword [case.0x140024dda.0]
lock xadd dword [rdi + 0xc], esi
cmp esi, 1
jne 0x140005bcc
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [case.0x140024dda.0]
mov rax, rbx
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140005e60
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x14006d0d8]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rdx
mov edi, ecx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call fcn.14003a210
lea rsi, [rsp + 0x180]
call fcn.1400060c0
mov qword [rsp + 0x28], rsi
lea rdx, [rsp + 0x30]
xor esi, esi
mov r9, rbx
mov r8d, 0x104
mov qword [rsp + 0x20], rsi
mov rcx, qword [rax]
call fcn.14003eb04
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
test dword [0x14006fd44], 0x20000
je 0x140005f10
mov rcx, qword [0x14006fd50]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], esi
lea r9d, [rsi + 1]
mov r8d, edi
mov qword [rsp + 0x20], rax
lea rdx, [0x14004e070]
call fcn.1400027a0
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14001ba70
add rsp, 0x150
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000abb0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x10]
mov rbx, rcx
mov edi, 0x80008003
cmp dword [rcx + 0x30], eax
jbe 0x14000abe5
lea rdx, str.Length_of_Message_write_to_MEI_should_be_shorter_than_m_MTU
xor ecx, ecx
call fcn.140005e60
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp qword [rcx + 0x40], 0xffffffffffffffff
jne 0x14000ac07
lea rdx, str.Invalid_Device_Handle
xor ecx, ecx
call fcn.140005e60
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rcx + 0x38]
mov edx, 0x4e20
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000ac38
lea rdx, str.HECI_lock_timeout
xor ecx, ecx
call fcn.140005e60
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test eax, eax
je 0x14000ac60
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rdx, str.Failed_to_attain_global_heci_mutex__last_error__d
xor ecx, ecx
mov r8d, eax
call fcn.140005e60
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8d, dword [rbx + 0x30]
lea r9, [rsp + 0x40]
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x14000acde
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
je 0x14000acde
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rdx, str.Write_file_error__last_error__d
xor ecx, ecx
mov r8d, eax
call fcn.140005e60
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
test eax, eax
jns 0x14000ada8
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rdx, str.Failed_to_release_global_heci_mutex__last_error__d
xor ecx, ecx
mov r8d, eax
call fcn.140005e60
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8d, dword [rsp + 0x40]
lea rdx, str.message_size_write_to_MEI_is__d
xor ecx, ecx
call fcn.140005e60
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x40]
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x14000ad5e
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rdx, str.Read_file_error__last_error__d
xor ecx, ecx
mov r8d, eax
call fcn.140005e60
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
test eax, eax
jns 0x14000ada8
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rdx, str.Failed_to_release_global_heci_mutex__last_error__d
xor ecx, ecx
mov r8d, eax
call fcn.140005e60
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
test eax, eax
js 0x14000acba
mov r8d, dword [rsp + 0x40]
xor ecx, ecx
mov dword [rbx + 0x30], r8d
cmp r8d, dword [rbx + 0x10]
jbe 0x14000ad9a
lea rdx, str.Length_of_Message_read_from_MEI_should_be_shorter_than_m_MTU
call fcn.140005e60
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rdx, str.message_size_read_from_MEI_is__d
call fcn.140005e60
xor edi, edi
mov rbx, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x14000b4a0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx], 0x50564150
mov rdi, rdx
mov rbx, rcx
je 0x14000b4c6
lea rdx, str.Unexpected_packet_Sig
xor ecx, ecx
call fcn.140005e60
mov eax, 0x100
cmp word [rbx + 4], ax
je 0x14000b4df
lea rdx, str.Unexpected_packet_Ver
xor ecx, ecx
call fcn.140005e60
mov ecx, dword [rbx + 0x10]
lea rax, [rdi - 0x14]
cmp rcx, rax
je 0x14000b4f9
lea rdx, str.Unexpected_packet_DataLen
xor ecx, ecx
call fcn.140005e60
mov r8d, dword [rbx + 0xc]
cmp r8d, 6
ja case.default.0x14000b519
lea rdx, [0x140000000]
mov ecx, dword [rdx + r8*4 + 0xb5c4]
add rcx, rdx
jmp rcx
lea rdx, str.Invalid_packet_status:_CHS_STATUS_MAX_MESSAGE_LENGTH_EXCEEDED
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140005e60
lea rdx, str.Invalid_packet_status:_CHS_STATUS_UNSPEC_ERROR
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140005e60
lea rdx, str.Invalid_packet_status:_CHS_STATUS_CONN_FAILED
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140005e60
lea rdx, str.Invalid_packet_status:_CHS_STATUS_COMM_FAILED
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140005e60
lea rdx, str.Invalid_packet_status:_CHS_STATUS_NOT_CONNECTED
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140005e60
lea rdx, str.Invalid_packet_status:_CHS_STATUS_HECI_NOT_READY
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140005e60
lea rdx, str.Unsupported_packet_status___d
xor ecx, ecx
call fcn.140005e60
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b6e0
Capabilities:
Accept command line arguments

Disassembly:
push rdi
sub rsp, 0x30
cmp byte [0x14006fd58], 0
mov edi, r9d
je 0x14000b6fd
mov eax, 0xffffffff
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov rdx, rax
lea r8, [rsp + 0x20]
lea rcx, [0x14006fe10]
call fcn.14000bb60
cmp al, 1
jne 0x14000b75a
lea rdx, str.Start__
xor ecx, ecx
call fcn.140005e60
lea rcx, [0x14006fe10]
call fcn.14000c6f0
mov ebx, eax
test eax, eax
js 0x14000b75e
mov edx, edi
lea rcx, [0x14006fe10]
call fcn.140012070
mov ebx, eax
jmp 0x14000b75e
mov ebx, dword [rsp + 0x20]
cmp dword [0x14007009c], 0
jne 0x14000b776
cmp byte [0x14006fe72], 0
je 0x14000b776
call qword [sym.imp.OLE32.DLL_CoUninitialize]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14000b7e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
mov rcx, rdx
call qword [sym.imp.ADVAPI32.DLL_GetSecurityDescriptorLength]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], 0
lea rdx, str.LaunchPermission
mov rcx, rdi
mov esi, eax
call qword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
cmp eax, 2
jne 0x14000b863
mov dword [rsp + 0x28], esi
lea r9d, [rax + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.LaunchPermission
mov rcx, rdi
call qword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
test eax, eax
je 0x14000b863
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14000f170
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x14000f229
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x14000f1f5
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test rax, rax
je case.default.0x14000f20d
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je case.default.0x14000f20d
mov rdx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call qword [case.0x140024dda.0]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp dword [rdi + 8], 0
je case.default.0x14000f20d
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp qword [sym.imp.ADVAPI32.DLL_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp byte [0x14006fe00], 0
jne 0x14000f274
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test rax, rax
je 0x14000f264
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x14006fdf8], rax
mov byte [0x14006fe00], 1
jmp 0x14000f27b
mov rax, qword [0x14006fdf8]
mov byte [0x14006fe00], 1
jmp 0x14000f27b
mov rax, qword [0x14006fdf8]
mov rcx, qword [rbx]
mov rdx, rsi
test rax, rax
je 0x14000f1fe
mov r8d, dword [rbx + 8]
xor r9d, r9d
call qword [case.0x140024dda.0]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
pop rdx
jmp 0x16a7ab3ed