joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c71c0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400c7202
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400c7249
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400c72a2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400c7260
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400c72e3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400db4a2]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400db4a3]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400c72b0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400c72fc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400c7380
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1400c7380
dec r8
sub rdx, 1
jne 0x1400c7366
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400c8ba8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400c8bf2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400c8bf2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400c8bf2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400c8bf2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400c8bf2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400c8bf4
xor al, al
add rsp, 0x28
ret

Function at 0x141643058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1416431df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141643089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14164306f
add dl, dl
jne 0x141643096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1416430f6
xor eax, eax
add dl, dl
jne 0x1416430a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1416431ad
add dl, dl
jne 0x1416430b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416430c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416430d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416430dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1416430ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14164307e
mov eax, 1
add dl, dl
jne 0x141643106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141643113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1416430fb
sub eax, ebx
mov ebx, 1
jne 0x14164314c
mov ecx, 1
add dl, dl
jne 0x14164312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14164313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141643123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14164307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141643168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141643175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14164315d
cmp eax, 0x7d00
jae 0x14164319b
cmp eax, 0x500
jb 0x141643196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14164307e
cmp eax, 0x7f
ja 0x14164319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14164307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1416431d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14164307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140003240
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, edx
mov edi, r8d
mov rbx, rcx
sub eax, 1
je 0x140003362
sub eax, 1
je 0x14000332f
sub eax, 4
je 0x140003320
sub eax, 0x17
je 0x1400032eb
cmp eax, 0x1d
je 0x14000329f
mov eax, dword [rcx + 0x214]
test dword [0x1400dd138], eax
je 0x1400033c7
lea rcx, str.OnSessionTaskNotify:__ulRequestType___d__is_invalid
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14000cbb0
cmp dword [0x1400df34c], 8
jb 0x1400033c7
mov eax, dword [0x1400dd144]
cmp eax, 0xffffffff
jae 0x1400033c7
xor cl, cl
test eax, eax
jne 0x1400032d2
mov cl, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14000eab0
mov dword [0x1400dd144], 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14000eab0
mov eax, dword [rcx + 0x214]
test dword [0x1400dd138], eax
je 0x140003308
lea rcx, str.OnSessionTaskNotify:_Got_OVERDRIVE_subTask_d_n
mov edx, r8d
call fcn.14000cbb0
mov rcx, qword [0x1400dd148]
mov edx, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400461a0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14002df20
mov eax, dword [rcx + 0x214]
test dword [0x1400dd138], eax
je 0x14000334c
lea rcx, str.OnSessionTaskNotify:_Got_MOUSE_ROTATION_subTask_d_n
mov edx, r8d
call fcn.14000cbb0
mov rcx, qword [rbx + 0x208]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140019540
mov eax, dword [0x1400dd138]
test dword [rcx + 0x214], eax
je 0x140003396
mov eax, dword [0x1400df304]
lea rcx, str.OnSessionTaskNotify:_Got_DRIVER_MESSAGE_subTask_d_n._Count_d
mov edx, edi
mov r8d, eax
add eax, 1
mov dword [0x1400df304], eax
call fcn.14000cbb0
mov eax, dword [0x1400dd138]
mov rcx, qword [rbx + 0x200]
test rcx, rcx
je 0x1400033b3
mov edx, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14004d3c0
test dword [rbx + 0x214], eax
je 0x1400033c7
lea rcx, str.CATIExtEvent::OnSessionTaskNotify:_ERROR_m_pDriverMessage_is_NULL
call fcn.14000cbb0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140003540
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x200]
test rax, rax
je 0x14000355c
mov rcx, rax
add rsp, 0x28
jmp 0x14004ced0
mov eax, dword [rcx + 0x214]
test dword [0x1400dd138], eax
je 0x140003576
lea rcx, str.CATIExtEvent::TerminateAllMsgThreads:_ERROR_m_pDriverMessage_is_NULL
call fcn.14000cbb0
add rsp, 0x28
ret
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rcx, qword [0x1400e3e78]
xor esi, esi
test rcx, rcx
je 0x14004cf05
lea edx, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x1400e3e78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1400e3e78], rsi
movsxd rdi, dword [0x1400e3e70]
test edi, edi
mov rax, rdi
je 0x14004cf57
lea rcx, [0x1400e3da0]
add rax, rax
mov qword [rsp + 0x30], rbx
lea rbx, [rcx + rax*8 - 0x10]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14004cf49
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rsi
mov dword [rbx + 8], esi
sub rbx, 0x10
add edi, 0xffffffff
jne 0x14004cf27
mov rbx, qword [rsp + 0x30]
mov dword [0x1400e3e70], esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140003580
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x200]
test rax, rax
je 0x14000359c
mov rcx, rax
add rsp, 0x28
jmp 0x14004c640
mov eax, dword [rcx + 0x214]
test dword [0x1400dd138], eax
je 0x1400035b6
lea rcx, str.CATIExtEvent::TerminateMsgThread:_ERROR_m_pDriverMessage_is_NULL
call fcn.14000cbb0
add rsp, 0x28
ret
sub rsp, 0x28
cmp dword [0x1400e3e70], 0
je 0x14004c691
xor ecx, ecx
lea rax, [0x1400e3da8]
mov r8d, dword [rax]
test r8d, r8d
je 0x14004c66a
cmp r8d, edx
jne 0x14004c66a
cmp qword [rax - 8], 0
jne 0x14004c678
add ecx, 1
add rax, 0x10
cmp ecx, 0xa
jae 0x14004c691
jmp 0x14004c656
lea rax, [0x1400e3da0]
add rcx, rcx
mov edx, 1
mov rcx, qword [rax + rcx*8]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140004030
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x550
cmp qword [0x1400df388], 0
mov rdi, rcx
je 0x1400041c6
mov qword [rsp + 0x560], rbx
mov ebx, 0xfa
call fcn.14000cbc0
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov rcx, rax
call fcn.1400660a0
cmp eax, 1
jne 0x140004111
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x44]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x570], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x568], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140004111
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x568]
lea r9, [rsp + 0x570]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x578]
lea rdx, str.ATIPOLLINTERVAL
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140004106
mov eax, dword [rsp + 0x578]
cmp eax, ebx
jb 0x140004106
mov ecx, 0x1388
mov ebx, eax
cmp eax, ecx
cmova ebx, ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r8d, r8d
lea r9, str.HKeyPollerTimerEvent
xor ecx, ecx
lea edx, [r8 + 1]
mov dword [0x1400df384], ebx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [rdi + 0x28], rax
jne 0x14000414d
mov eax, dword [rdi + 0x44]
test dword [0x1400dd138], eax
je 0x14000414d
lea rcx, str.FAILURE:_Failed_to_create_event_for_HKeyPollerTimerEvent
call fcn.14000cbb0
mov rcx, qword [0x1400df388]
xor r9d, r9d
mov r8d, ebx
mov edx, 0x4d2
call qword [sym.imp.USER32.dll_SetTimer]
test rax, rax
mov qword [rdi + 0x30], rax
jne 0x140004189
mov eax, dword [rdi + 0x44]
test dword [0x1400dd138], eax
je 0x1400041a2
lea rcx, str.FAILURE:_Failed_to_SetTimer__tick_u
mov edx, ebx
call fcn.14000cbb0
jmp 0x1400041a2
mov ecx, dword [rdi + 0x44]
test dword [0x1400dd138], ecx
je 0x1400041a2
lea rcx, str.Timer_for_hotkey_poller_setup_ok__tick_u
mov edx, ebx
call fcn.14000cbb0
cmp qword [rdi + 0x30], 0
mov rbx, qword [rsp + 0x560]
je 0x1400041c6
cmp qword [rdi + 0x28], 0
je 0x1400041c6
mov eax, 1
add rsp, 0x550
pop rdi
ret
xor eax, eax
add rsp, 0x550
pop rdi
ret
Function at 0x14000bc70
Capabilities:
Delete registry value

Disassembly:
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
cmp dword [0x1400df34c], 8
jae 0x14000bdbe
test byte [0x1400df4d4], 2
jne 0x14000bdbe
lea rcx, [0x1400e0890]
call fcn.14003a7d0
cmp eax, dword [0x1400e1a88]
jae 0x14000bdbe
mov edx, eax
lea rcx, [0x1400e0890]
call fcn.14003e420
mov rbx, rax
test rax, rax
je 0x14000bdbe
mov edx, 3
mov rcx, rax
call fcn.1400471a0
test al, 4
je 0x14000bdbe
mov qword [rsp + 0x50], 0
mov rcx, rbx
call fcn.140046f50
mov rdi, rax
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov r12, rcx
je 0x14000bdbe
add rcx, 1
call fcn.14007de00
mov rdi, rax
test rax, rax
je 0x14000bd9d
lea r8, [r12 + 1]
xor edx, edx
mov rcx, rax
call fcn.14007cd30
mov rcx, rbx
call fcn.140046f50
mov rdx, rax
mov r8, r12
mov rcx, rdi
call fcn.14007cf10
lea r11, [rsp + 0x50]
mov qword [rsp + 0x20], r11
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000bd95
lea rdx, str.ExtEvent_SetDefault32BppOn2ndDrv
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.14007ddf8
xor r9d, r9d
mov edx, 0x14d0
mov r8d, 0x7d0
mov rcx, qword [0x1400df388]
call qword [sym.imp.USER32.dll_SetTimer]
mov dword [0x1400df3a0], eax
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x14000c5b0
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
sub rsp, 0x698
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x620
call fcn.14007cd30
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x2c]
mov dword [rsp + 0x78], 0x35
mov dword [rsp + 0x7c], 0xffffffff
mov dword [rsp + 0x70], 0x8001
mov dword [rsp + 0x74], 0x620
call fcn.14007cd30
lea rax, [rsp + 0x6a0]
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x70]
lea rcx, str..pipeExtEventPipe_Service
mov r8d, 0x620
mov dword [rsp + 0x20], 0x2c
call qword [sym.imp.KERNEL32.dll_CallNamedPipeA]
test eax, eax
je 0x14000c63d
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x698
ret

Function at 0x14000cd30
Capabilities:
Query service status

Disassembly:
push rbx
sub rsp, 0x240
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x200
call fcn.14007cd30
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
mov rbx, rax
jne 0x14000cd90
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.bGlobalServiceAlive._failed_to_open_SCM._err_d
lea rcx, [rsp + 0x40]
mov r8d, eax
call fcn.14007dc1c
lea rcx, [rsp + 0x40]
call fcn.140014620
xor eax, eax
add rsp, 0x240
pop rbx
ret
cmp dword [0x1400df34c], 7
lea rax, str.Ati_HotKey_Poller
lea rdx, str.Ati_External_Event_Utility
mov r8d, 4
mov rcx, rbx
cmovbe rdx, rax
mov qword [rsp + 0x250], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
test rax, rax
mov rdi, rax
jne 0x14000ce08
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.bGlobalServiceAlive._failed_to_OpenService._err_d
lea rcx, [rsp + 0x40]
mov r8d, eax
call fcn.14007dc1c
lea rcx, [rsp + 0x40]
call fcn.140014620
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x250]
xor eax, eax
add rsp, 0x240
pop rbx
ret
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], eax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14000ce81
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.bGlobalServiceAlive._failed_to_QueryServiceStatus._err_d
lea rcx, [rsp + 0x40]
mov r8d, eax
call fcn.14007dc1c
lea rcx, [rsp + 0x40]
call fcn.140014620
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x250]
xor eax, eax
add rsp, 0x240
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x250]
xor eax, eax
cmp dword [rsp + 0x24], 4
sete al
add rsp, 0x240
pop rbx
ret
Function at 0x14000d140
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x430
mov r8, rcx
mov ebx, 0x400
lea r9, [rax + 0x10]
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14007e1ec
test eax, eax
jns 0x14000d194
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x420], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x430
pop rbx
ret
sub ebx, eax
lea rdx, [0x1400a6894]
lea rcx, [rsp + 0x20]
movsxd r8, ebx
call fcn.14007dfa0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x430
pop rbx
ret

Function at 0x14000d650
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x180
xor edi, edi
lea rcx, [rsp + 0x34]
xor edx, edx
lea r8d, [rdi + 0x34]
mov qword [rsp + 0x1b0], rdi
mov esi, edi
mov dword [rsp + 0x30], edi
call fcn.14007cd30
mov ecx, dword [0x1400df4cc]
xor edx, edx
call fcn.14002ec00
test rax, rax
mov rbx, rax
je 0x14000d6d2
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1400311f0
test eax, eax
jne 0x14000d6d2
xor eax, eax
mov rcx, rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, rdi
mov rax, qword [rsp + 0x60]
mov rcx, 0xffffffff80000001
lea rdx, str.Control_PanelDesktop_
test rax, rax
mov r9d, 0x2001f
cmovne rcx, rax
lea rax, [rsp + 0x1b0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000d789
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x104
mov dword [rsp + 0x1a8], 1
call fcn.14007cd30
mov rcx, qword [rsp + 0x1b0]
lea rax, [rsp + 0x1a0]
lea r9, [rsp + 0x1a8]
lea rdx, str.ScreenSaverIsSecure
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x1a0], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000d77b
lea rcx, [rsp + 0x70]
call fcn.14007e238
mov esi, eax
mov rcx, qword [rsp + 0x1b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x14000d7a4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140031330
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
setne dil
mov eax, edi
add rsp, 0x180
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000ebe0
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x690
mov edx, dword [0x1400e1a8c]
lea rcx, [0x1400e0890]
call fcn.14003e420
xor edi, edi
test rax, rax
je 0x14000ec14
xor edx, edx
mov rcx, rax
call fcn.1400471a0
mov esi, eax
jmp 0x14000ec16
mov esi, edi
and esi, 2
cmp dword [0x1400df3cc], edi
mov dword [0x1400e3e54], edi
je 0x14000ecc3
test byte [0x1400df4d4], 2
je 0x14000ecc3
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x620
call fcn.14007cd30
mov eax, dword [0x1400df4cc]
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x2c]
mov dword [rsp + 0x78], 0x17
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x70], 0x8001
mov dword [rsp + 0x74], 0x620
call fcn.14007cd30
lea rax, [rsp + 0x6a0]
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x70]
lea rcx, str..pipeExtEventPipe_Service
mov r8d, 0x620
mov dword [rsp + 0x20], 0x2c
call qword [sym.imp.KERNEL32.dll_CallNamedPipeA]
test eax, eax
je 0x14000ecc3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400df3c0]
test rcx, rcx
je 0x14000ed49
mov edx, 1
mov qword [rsp + 0x6a8], rbx
call fcn.14001de50
lea rcx, [0x1400e0890]
mov ebx, edi
call fcn.14003a290
test eax, eax
je 0x14000ed34
nop
nop
nop
nop
lea rcx, [0x1400e0890]
mov edx, ebx
call fcn.14003a760
test rax, rax
je 0x14000ed21
mov rcx, qword [0x1400df3c0]
mov edx, ebx
call fcn.14001f480
lea rcx, [0x1400e0890]
add ebx, 1
call fcn.14003a290
cmp ebx, eax
jb 0x14000ed00
cmp qword [0x1400df3c0], rdi
mov rbx, qword [rsp + 0x6a8]
je 0x14000ed49
test esi, esi
jne 0x14000ed82
mov edx, dword [0x1400e1a8c]
lea rcx, [0x1400e0890]
call fcn.14003e420
test rax, rax
je 0x14000ed6a
mov rcx, rax
call fcn.140047180
mov edi, eax
bt edi, 0xd
jae 0x14000ed82
mov rcx, qword [0x1400df388]
mov edx, 0x4d4
call qword [sym.imp.USER32.dll_KillTimer]
mov rsi, qword [rsp + 0x6b0]
add rsp, 0x690
pop rdi
ret

Function at 0x14000eda0
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
sub rsp, 0x698
cmp dword [0x1400df3cc], 0
mov dword [0x1400e3e54], 0
je 0x14000ee56
test byte [0x1400df4d4], 2
je 0x14000ee56
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x620
call fcn.14007cd30
mov eax, dword [0x1400df4cc]
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x2c]
mov dword [rsp + 0x78], 0x17
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x70], 0x8001
mov dword [rsp + 0x74], 0x620
call fcn.14007cd30
lea rax, [rsp + 0x6a0]
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x70]
lea rcx, str..pipeExtEventPipe_Service
mov r8d, 0x620
mov dword [rsp + 0x20], 0x2c
call qword [sym.imp.KERNEL32.dll_CallNamedPipeA]
test eax, eax
je 0x14000ee56
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400df3c0]
test rcx, rcx
je 0x14000ee6c
mov edx, 1
call fcn.14001de50
add rsp, 0x698
ret
Function at 0x14000ee80
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
sub rsp, 0x698
cmp dword [0x1400df3cc], 0
je 0x14000ef2c
test byte [0x1400df4d4], 2
je 0x14000ef2c
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x620
call fcn.14007cd30
mov eax, dword [0x1400df4cc]
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x2c]
mov dword [rsp + 0x78], 0x18
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x70], 0x8001
mov dword [rsp + 0x74], 0x620
call fcn.14007cd30
lea rax, [rsp + 0x6a0]
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x70]
lea rcx, str..pipeExtEventPipe_Service
mov r8d, 0x620
mov dword [rsp + 0x20], 0x2c
call qword [sym.imp.KERNEL32.dll_CallNamedPipeA]
test eax, eax
je 0x14000ef2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400df3c0]
test rcx, rcx
je 0x14000ef3f
xor edx, edx
call fcn.14001de50
add rsp, 0x698
ret