joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180018950
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180018980
xor eax, eax
jmp 0x180018a43
mov rbp, rbx
cmp word [rax], si
je 0x1800189a5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18001898c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180018988
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800171f4
movsxd r14, eax
test eax, eax
jne 0x1800189e3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180018979
mov rcx, r14
call fcn.180015d14
mov rdi, rax
test rax, rax
jne 0x1800189fc
xor ecx, ecx
call fcn.180014dbc
jmp 0x1800189d8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800171f4
test eax, eax
jne 0x180018a2d
mov rcx, rdi
call fcn.180014dbc
jmp 0x180018a37
xor ecx, ecx
call fcn.180014dbc
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18001c8c4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x180031dc0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x18001c91b
cmp word [rdx], r13w
jne 0x18001c91b
or byte [rax + rdi*8 + 0x38], cl
jmp 0x18001c920
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x18001ca45
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x18001ca66
lea r9, [rdx + 2]
cmp cx, r11w
je 0x18001c959
mov rdx, r9
mov word [rbx], cx
jmp 0x18001c980
cmp r9, r8
jae 0x18001c990
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x18001c93a
jmp 0x18001ca45
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18001ca3a
cmp dword [rsp + 0x80], esi
je 0x18001ca3a
lea r8, [0x180031dc0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x18001ca12
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x18001c9e2
mov word [rbx], r13w
jmp 0x18001ca42
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x18001c9ef
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x18001ca42
cmp word [rsp + 0x70], r13w
jne 0x18001ca1f
cmp rbx, r14
je 0x18001c9dc
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.18001c7e4
cmp word [rsp + 0x70], r13w
je 0x18001ca45
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x180031dc0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x18001ca3f
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x18001ca45
Function at 0x18001db00
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.18001c7e4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.18001c7e4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x18001dc50
cmp rax, 0xffffffffffffffff
je 0x18001dc50
xor edi, edi
test rbp, rbp
jle 0x18001dbfb
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.18001439c
mov rbx, rax
test rax, rax
jne 0x18001db88
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x18001dbf1
mov edx, 0x8000
mov ecx, r14d
call fcn.18001d984
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.180019eac
cmp eax, 0xffffffff
je 0x18001dbd1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x18001db98
mov edx, r15d
mov ecx, r14d
call fcn.18001d984
jmp 0x18001dbf1
cmp byte [rsi + 0x38], dil
je 0x18001dbe8
cmp dword [rsi + 0x34], 5
jne 0x18001dbe8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x18001dbf1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.180014dbc
jmp 0x18001dc64
jns 0x18001dc64
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.18001c7e4
cmp rax, 0xffffffffffffffff
jne 0x18001dc1c
cmp byte [rsi + 0x30], dil
je 0x18001dc64
mov edi, dword [rsi + 0x2c]
jmp 0x18001dc64
mov ecx, r14d
call fcn.18001a660
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x18001dc64
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x18001dc64
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x18001dc5d
mov eax, dword [rsi + 0x2c]
jmp 0x18001dc62
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.18001c7e4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140001102
Capabilities:
Execute syscall

Disassembly:
mov eax, dword [rcx]
mov r10, rdx
syscall
ret

Function at 0x14000110a
Capabilities:
Access peb ldr_data
Get kernel32 base address
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x838
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
mov rdi, qword [rax + 0x30]
movsxd rax, dword [rdi + 0x3c]
mov ebx, dword [rdi + rax + 0x88]
mov ebp, dword [rdi + rbx + 0x18]
dec ebp
call fcn.1400012b3
cmp dword [rax], 0
je 0x140001196
mov rsi, rax
mov r14d, ebp
lea r15, [rdi + r14*4]
mov eax, dword [rdi + rbx + 0x20]
mov ecx, dword [r15 + rax]
add rcx, rdi
call fcn.1400012bb
cmp eax, dword [rsi]
je 0x14000117a
cmp dword [rsi + 4], 0
lea rsi, [rsi + 4]
jne 0x14000115a
jmp 0x140001196
mov eax, dword [rdi + rbx + 0x1c]
mov ecx, dword [rdi + rbx + 0x24]
add rax, rdi
add rcx, rdi
movzx ecx, word [rcx + r14*2]
mov eax, dword [rax + rcx*4]
mov eax, dword [rdi + rax + 4]
mov dword [rsi], eax
test ebp, ebp
jne 0x140001144
lea rsi, [rsp + 0x28]
mov qword [rsi], 0
mov edx, dword [0x14005e008]
lea rdi, [rsp + 0x30]
mov rcx, rdi
call fcn.1400010fc
mov dword [rsp + 0x20], 8
mov rcx, rdi
mov rdx, 0xffffffffffffffff
mov r8d, 0x28
mov r9, rsi
call fcn.140001266
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
movzx esi, word [rax + 0x60]
mov ebp, 1
test esi, esi
je 0x140001253
mov rbx, qword [rax + 0x68]
call fcn.140001ce2
mov edi, eax
test eax, eax
je 0x14000120f
call fcn.140001c41
test eax, eax
je 0x140001253
lea r14, [rsp + 0x30]
mov r8d, 0x800
mov rcx, r14
xor edx, edx
call fcn.1400107c0
mov rcx, r14
mov rdx, rbx
mov r8d, esi
call fcn.1400012dc
mov r8d, esi
add r8, 2
movsxd rax, edi
lea rcx, section..data
mov ecx, dword [rcx + rax*4]
mov rdx, r14
call section..text
mov ebp, eax
xor ebp, 1
mov eax, ebp
add rsp, 0x838
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140001266
Capabilities:
Execute syscall

Disassembly:
mov r11, r9
mov r9d, dword [rsp + 0x28]
mov eax, dword [rcx]
mov r10, rdx
mov edx, r8d
mov r8, r11
syscall
ret

Function at 0x1400012bb
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
add rcx, 2
mov edx, 0x811c9dc5
mov eax, edx
movsx r8d, byte [rcx]
inc rcx
xor edx, r8d
imul edx, edx, 0x1000193
test r8d, r8d
jne 0x1400012c4
ret
Function at 0x14000133c
Capabilities:
Encode data using xor
Get memory capacity

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
xor ebp, ebp
test rcx, rcx
je 0x1400013b1
mov rsi, rdx
test rdx, rdx
je 0x1400013b1
mov rdi, rcx
xor r15d, r15d
mov r12, qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea r14, [rsp + 0x20]
mov r13, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbx, qword [sym.imp.KERNEL32.dll_Sleep]
mov ebp, 1
mov dword [rsp + 0x28], 0x40
lea rcx, [rsp + 0x28]
call r12
mov rcx, r14
call r13
mov eax, dword [rsp + 0x38]
xor eax, dword [rsp + 0x20]
mov byte [rdi + r15], al
mov ecx, 1
call rbx
inc r15
cmp rsi, r15
jne 0x140001380
mov eax, ebp
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400015f8
Capabilities:
Execute syscall

Disassembly:
push rsi
push rdi
mov r11d, r9d
mov esi, dword [rsp + 0x40]
mov edi, dword [rsp + 0x48]
mov r9, qword [rsp + 0x38]
mov eax, dword [rcx]
mov r10, rdx
mov rdx, r8
mov r8d, r11d
sub rsp, 0x40
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rdi
syscall
add rsp, 0x40
pop rdi
pop rsi
ret

Function at 0x14000162c
Capabilities:
Execute syscall

Disassembly:
push rsi
mov r11, r9
mov r9d, dword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, dword [rcx]
mov r10, rdx
mov rdx, r8
mov r8, r11
sub rsp, 0x30
mov qword [rsp + 0x28], rsi
syscall
add rsp, 0x30
pop rsi
ret

Function at 0x140001656
Capabilities:
Execute syscall

Disassembly:
mov r11, r9
mov r9d, dword [rsp + 0x28]
mov eax, dword [rcx]
mov r10, rdx
mov rdx, r8
mov r8, r11
syscall
ret
Function at 0x14000166c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa0
xor r15d, r15d
test rcx, rcx
je 0x1400018ae
mov r12, r8
test r8, r8
je 0x1400018ae
mov r14, r9
test r9, r9
je 0x1400018ae
mov ebx, edx
mov rsi, rcx
mov rcx, qword [sym.imp.ntdll.dll_NtClose]
mov edx, 0x48
call fcn.1400026e8
test rax, rax
je 0x1400018ab
mov rdi, rax
lea rax, [rsp + 0x98]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x6b]
mov rcx, rsi
mov rdx, rdi
mov r9d, 1
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
js 0x1400018ab
cmp byte [rsp + 0x6b], 0xc3
jne 0x1400018ab
mov rax, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x100]
xor r15d, r15d
lea rdx, [rsp + 0x70]
mov qword [rdx], r15
test rcx, rcx
setne r8b
test rax, rax
setne r9b
test r8b, r9b
cmove rcx, r15
cmove rax, r15
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov r8, r12
mov r9, r14
call fcn.1400013c4
test al, al
je 0x1400018ae
cmp ebx, 1
je 0x1400017cb
test ebx, ebx
jne 0x1400018ab
xor r14d, r14d
lea rdi, [rsp + 0x80]
mov qword [rdi], r14
mov edx, dword [0x14005e018]
lea rbx, [rsp + 0x78]
mov rcx, rbx
call fcn.1400010fc
mov eax, 0x100
add rax, qword [rsp + 0x70]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x38], 0
mov rcx, rbx
mov rdx, rdi
mov r8d, 0x1fffff
xor r9d, r9d
call fcn.1400018c4
jmp 0x1400018a3
mov r8d, 0x100
add r8, qword [rsp + 0x70]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
mov rdx, qword [rax + 0x30]
mov rcx, rsi
call fcn.140002790
test rax, rax
je 0x1400018ab
lea r13, [rsp + 0x8c]
mov dword [r13], 0
lea r14, [rsp + 0x80]
mov qword [r14], 0x1000
lea r15, [rsp + 0x78]
mov qword [r15], rdi
lea rbx, [rsp + 0x93]
mov byte [rbx], 0xe9
sub eax, edi
add eax, 0xfffffffb
mov dword [rbx + 1], eax
mov edx, dword [0x14005e01c]
lea r12, [rsp + 0x6c]
mov rcx, r12
call fcn.1400010fc
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x40
mov rcx, r12
mov rdx, rsi
mov r8, r15
mov r9, r14
call fcn.14000162c
mov edx, dword [0x14005e010]
lea r14, [rsp + 0x6c]
mov rcx, r14
call fcn.1400010fc
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 5
mov rcx, r14
mov rdx, rsi
mov r8, rdi
mov r9, rbx
call fcn.14000162c
test eax, eax
setns r15b
jmp 0x1400018ae
xor r15d, r15d
mov eax, r15d
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400018c4
Capabilities:
Execute syscall

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov r11, r9
mov esi, dword [rsp + 0x78]
mov r9, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x80]
mov r15, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
mov r13, qword [rsp + 0x98]
mov eax, dword [rcx]
mov r10, rdx
mov edx, r8d
mov r8, r11
sub rsp, 0x60
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r13
syscall
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140001a62
Capabilities:
Execute syscall

Disassembly:
mov r11, r9
mov r9, qword [rsp + 0x28]
mov eax, dword [rcx]
mov r10, rdx
mov edx, r8d
mov r8, r11
syscall
ret

Function at 0x140001c41
Capabilities:
Acquire debug privileges

Disassembly:
push rsi
push rdi
sub rsp, 0x38
lea rsi, [rsp + 0x28]
mov qword [rsi], 0
mov edx, dword [0x14005e024]
lea rdi, [rsp + 0x34]
mov rcx, rdi
call fcn.1400010fc
mov rcx, rdi
mov rdx, 0xffffffffffffffff
mov r8d, 0x20
mov r9, rsi
call fcn.140001cd4
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x140001ccb
mov rcx, qword [rsp + 0x28]
lea rdx, str.SeDebugPrivilege
mov r8d, 1
call fcn.140001bc0
mov rcx, qword [rsp + 0x28]
lea rdx, str.SeImpersonatePrivilege
mov r8d, 1
call fcn.140001bc0
mov rcx, qword [rsp + 0x28]
lea rdx, str.SeTakeOwnershipPrivilege
mov r8d, 1
call fcn.140001bc0
nop
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x140001cd4
Capabilities:
Execute syscall

Disassembly:
mov eax, dword [rcx]
mov r10, rdx
mov edx, r8d
mov r8, r9
syscall
ret

Function at 0x140001d96
Capabilities:
Execute syscall

Disassembly:
push rsi
mov r11, r9
mov r9d, dword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, dword [rcx]
mov r10, rdx
mov edx, r8d
mov r8, r11
sub rsp, 0x30
mov qword [rsp + 0x28], rsi
syscall
add rsp, 0x30
pop rsi
ret
Function at 0x140001dc0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x100
test rcx, rcx
je 0x140001eb1
test rdx, rdx
je 0x140001eb1
test r8d, r8d
je 0x140001eb1
test r9, r9
je 0x140001eb1
mov eax, dword [rsp + 0x150]
test eax, eax
je 0x140001eb1
movdqa xmm0, xmmword [0x140012020]
xor r10d, r10d
movdqa xmm1, xmmword [0x140012030]
movdqa xmmword [rsp + r10], xmm0
add r10, 0x10
paddb xmm0, xmm1
cmp r10, 0x100
jne 0x140001e13
xor r10d, r10d
xor r11d, r11d
xor edi, edi
xor esi, esi
movzx edi, dil
mov bl, byte [rsp + r11]
add sil, byte [r9 + rdi]
add sil, bl
movzx r14d, sil
mov bpl, byte [rsp + r14]
mov byte [rsp + r11], bpl
mov byte [rsp + r14], bl
inc dil
movzx edi, dil
cmp edi, eax
cmove edi, r10d
inc r11
cmp r11, 0x100
jne 0x140001e34
mov eax, r8d
xor r8d, r8d
xor r9d, r9d
xor r10d, r10d
inc r10d
movzx r10d, r10b
mov r11b, byte [rsp + r10]
add r9b, r11b
movzx esi, r9b
mov bl, byte [rsp + rsi]
mov byte [rsp + r10], bl
mov byte [rsp + rsi], r11b
add r11b, byte [rsp + r10]
movzx r11d, r11b
mov r11b, byte [rsp + r11]
xor r11b, byte [rcx + r8]
mov byte [rdx + r8], r11b
inc r8
cmp rax, r8
jne 0x140001e78
add rsp, 0x100
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1400026d0
Capabilities:
Execute syscall

Disassembly:
mov r11d, r9d
mov r9, qword [rsp + 0x28]
mov eax, dword [rcx]
mov r10d, edx
mov rdx, r8
mov r8d, r11d
syscall
ret

Function at 0x140002744
Capabilities:
Check for software breakpoints

Disassembly:
mov rax, rcx
movsxd rcx, dword [rcx + 0x3c]
mov ecx, dword [rax + rcx + 0x50]
inc rax
inc ecx
xor r8d, r8d
movzx r10d, byte [rax - 1]
cmp r10d, 0xcc
je 0x140002770
mov r9d, 0
test r10d, r10d
jne 0x140002779
lea r9d, [r8 + 1]
cmp r9d, edx
je 0x140002786
inc rax
mov r8d, r9d
dec ecx
jne 0x140002757
xor eax, eax
ret
not r8d
movsxd rcx, r8d
add rax, rcx
ret

Function at 0x140003048
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003092
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003092
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003092
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003092
cmp dword [rcx + 0x84], 0xe
jbe 0x140003092
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003094
xor al, al
add rsp, 0x28
ret

Function at 0x140003bbc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140003d10
Function at 0x140003d10
Capabilities:
Parse pe header

Disassembly:
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140003d10
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140003d7f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003d7f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003d7f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003d7f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003d7f
cmp dword [rcx + 0x84], 0xe
jbe 0x140003d7f
cmp dword [rcx + 0xf8], 0
je 0x140003d7f
mov ecx, ebx
call fcn.140003c3c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140003ea4
nop
cmp dword [rbp + 0x20], 0
je 0x140003dcd
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140003cdc
int3

Function at 0x140004d70
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140004d98
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140004d98
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140009cd0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140009d00
xor eax, eax
jmp 0x140009dc3
mov rbp, rbx
cmp word [rax], si
je 0x140009d25
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140009d0c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140009d08
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140009c20
movsxd r14, eax
test eax, eax
jne 0x140009d63
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140009cf9
mov rcx, r14
call fcn.140008738
mov rdi, rax
test rax, rax
jne 0x140009d7c
xor ecx, ecx
call fcn.140006ca4
jmp 0x140009d58
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140009c20
test eax, eax
jne 0x140009dad
mov rcx, rdi
call fcn.140006ca4
jmp 0x140009db7
xor ecx, ecx
call fcn.140006ca4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140003080
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xe0
mov rsi, r8
mov rbp, rcx
lea r8, str.SynTPLprInstanceMutex
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
test rax, rax
je 0x140003121
mov edx, 0x2710
mov rcx, rax
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xf8], r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1400030fd
cmp eax, 0xffffffff
je 0x1400030fd
lea r14, [0x140018520]
xor edx, edx
mov rcx, r14
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140003136
mov rdx, rsi
mov rcx, rax
call fcn.140003990
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xf8]
lea r11, [rsp + 0xe0]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea rax, [0x140003ac0]
xorps xmm0, xmm0
xorps xmm1, xmm1
xor ebx, ebx
lea rcx, [rsp + 0x90]
mov qword [rsp + 0xa8], rbp
movdqa xmmword [rsp + 0xb0], xmm0
movdqa xmmword [rsp + 0xc0], xmm1
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xd0], r14
mov dword [rsp + 0x90], ebx
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
je 0x1400030fd
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
lea r8, str.Touchpad_driver_helper_window
mov r9d, 0x80000000
mov rdx, r14
mov ecx, 0x80
mov dword [rsp + 0x28], 0xfffffe70
mov dword [rsp + 0x20], 0xfffffe70
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.140003990
mov qword [0x140025f90], rbp
call fcn.140003a10
lea rcx, [0x140025f48]
mov rdx, rbx
call fcn.140004680
test eax, eax
je 0x1400030fd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x14000326d
nop word [rax + rax]
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140003240
mov eax, dword [rsp + 0x70]
jmp 0x140003111