joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000adb0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
mov r14d, r9d
mov rcx, qword [rcx + 0x38]
mov ebp, r8d
mov r15d, edx
mov esi, 1
test rcx, rcx
je 0x14000adef
lea rdx, str.04874F40_A61B_405c_8206_7116B598FD8A
call qword [sym.imp.USER32.dll_GetPropA]
test rax, rax
jne 0x14000ae06
xor edx, edx
mov qword [rdi + 0x38], 0
lea rcx, [0x14000a190]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rdi + 0x38], 0
jne 0x14000ae20
xor edx, edx
lea rcx, str.9EDE85BB_30B3_4FDF_94C6_267ACB7EB43B
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [rdi + 0x38], rax
cmp qword [rdi + 0x38], 0
mov qword [rsp + 0x40], rbx
mov rbx, qword [0x1400a1fb0]
jne 0x14000ae55
test rbx, rbx
je 0x14000ae53
lea r8, str.FindCCCWindow_EnumWindows_failed.
mov edx, 0x40000
mov rcx, rbx
call fcn.1400260c0
mov rbx, qword [0x1400a1fb0]
xor esi, esi
test esi, esi
je 0x14000aed5
xor eax, eax
cmp r15d, 0x8486
jne 0x14000ae9b
test r14d, r14d
je 0x14000ae75
mov edx, ebp
mov rcx, rdi
call fcn.14000b510
jmp 0x14000ae77
mov eax, ebp
test eax, eax
jne 0x14000ae9b
test rbx, rbx
je 0x14000ae97
mov r9d, ebp
lea r8, str.PostMessageToCCC_invalid_message_code_for_ulMessage___x.
mov edx, 0x40000
mov rcx, rbx
call fcn.1400260c0
xor eax, eax
jmp 0x14000aed7
mov r8d, dword [rsp + 0x60]
mov edx, r15d
mov rcx, qword [rdi + 0x38]
mov r9d, eax
call qword [sym.imp.USER32.dll_PostMessageA]
test eax, eax
jne 0x14000aed5
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x14000ae97
lea r8, str.PostMessageToCCC_Post_message_failed.
mov edx, 0x40000
call fcn.1400260c0
xor eax, eax
jmp 0x14000aed7
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14000b1f0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x14000b21b
lea rdx, str.04874F40_A61B_405c_8206_7116B598FD8A
call qword [sym.imp.USER32.dll_GetPropA]
test rax, rax
jne 0x14000b232
xor edx, edx
mov qword [rbx + 0x38], 0
lea rcx, [0x14000a190]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rbx + 0x38], 0
jne 0x14000b27b
xor edx, edx
lea rcx, str.9EDE85BB_30B3_4FDF_94C6_267ACB7EB43B
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [rbx + 0x38], rax
test rax, rax
jne 0x14000b27b
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x14000b26e
lea r8, str.FindCCCWindow_EnumWindows_failed.
mov edx, 0x40000
call fcn.1400260c0
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rdi + 0x10]
or rax, 0xffffffffffffffff
mov qword [rsp + 0x30], rcx
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000b290
add eax, eax
cmp dword [rdi + 8], 0
mov dword [rsp + 0x28], eax
je 0x14000b2b3
mov edx, dword [rdi + 4]
mov rcx, rbx
call fcn.14000b510
jmp 0x14000b2b6
mov eax, dword [rdi + 4]
mov rcx, qword [rbx + 0x38]
lea r9, [rsp + 0x20]
mov edx, eax
mov r8d, 0x404
mov qword [rsp + 0x20], rdx
mov edx, 0x4a
call qword [sym.imp.USER32.dll_SendMessageA]
mov rbx, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x40
pop rdi
ret

Function at 0x14000b3f0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x150
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 0xf]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
test rax, rax
je 0x14000b4ff
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14000b4f6
mov qword [rsp + 0x168], rbp
lea rbp, str.CCC.exe
mov qword [rsp + 0x170], r14
xor r14d, r14d
mov qword [rsp + 0x160], rbx
nop word [rax + rax]
mov rax, r14
lea rdx, [rsp + 0x4c]
nop dword [rax + rax]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [rax + rbp - 1]
jne 0x14000b485
cmp rax, 8
jne 0x14000b470
jmp 0x14000b49a
lea rdx, str.RadeonSettings.exe
lea rcx, [rsp + 0x4c]
call fcn.140051970
test eax, eax
jne 0x14000b4cd
mov r8d, dword [rsp + 0x28]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000b4cd
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsi + 0x40], r14d
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14000b460
mov r14, qword [rsp + 0x170]
mov rbp, qword [rsp + 0x168]
mov rbx, qword [rsp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x178]
add rsp, 0x150
pop rdi
ret
Function at 0x14000c850
Capabilities:
Print debug messages

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
push r12
push r14
sub rsp, 0x30
xor ebx, ebx
movsxd r12, r8d
cmp qword [0x1400a2030], rbx
mov r14d, ebx
jne 0x14000c899
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x14000ca07
lea r8, str.DisableForcedDisplays__pInterfaceWin7_not_initialized.
mov edx, 0x800000
add rsp, 0x30
pop r14
pop r12
pop rbx
jmp fcn.1400260c0
mov qword [rsp + 0x58], rsi
mov rcx, r12
test r8d, r8d
jle 0x14000ca7b
lea rsi, [rdx + 0xc]
mov rax, rsi
cmp dword [rax + 4], ebx
je 0x14000c8bd
cmp dword [rax], ebx
jne 0x14000c8bd
inc r14d
add rax, 0x14
sub rcx, 1
jne 0x14000c8b1
test r14d, r14d
je 0x14000ca7b
mov qword [rsp + 0x50], rbp
mov rcx, 0xffffffffffffffff
movsxd rbp, r14d
mov eax, 8
mul rbp
mov qword [rsp + 0x68], rdi
cmovo rax, rcx
mov rcx, rax
call fcn.14002c6a4
mov rdi, rax
test rax, rax
jne 0x14000c926
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x14000c9f8
lea r8, str.array_of_string_allocated_failed.
mov edx, 0x800000
call fcn.1400260c0
jmp 0x14000c9f8
mov qword [rsp + 0x28], r13
mov r13d, ebx
mov qword [rsp + 0x20], r15
mov r15d, ebx
test r12d, r12d
jle 0x14000c993
mov eax, dword [rsp + 0x60]
mov r12, rdi
cmp dword [rsi + 4], ebx
je 0x14000c987
cmp dword [rsi], ebx
jne 0x14000c987
mov ecx, 0x100
call fcn.14002c6a4
mov qword [r12], rax
test rax, rax
je 0x14000ca37
mov rcx, qword [0x1400a20e8]
mov r8, rax
mov edx, r15d
call fcn.140013ab0
test eax, eax
je 0x14000ca11
mov eax, dword [rsp + 0x60]
inc r13d
add r12, 8
inc r15d
add rsi, 0x14
cmp r15d, eax
jl 0x14000c942
cmp r13d, r14d
jne 0x14000c9cb
mov rcx, qword [0x1400a2030]
mov r8d, r14d
mov rdx, rdi
call fcn.14002a5b0
test eax, eax
jne 0x14000c9cb
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x14000c9cb
lea r8, str.DisableForcedDisplays_ClearForcedDisplays_failed.
mov edx, 0x800000
call fcn.1400260c0
test r14d, r14d
jle 0x14000c9e6
mov rcx, qword [rdi + rbx*8]
test rcx, rcx
je 0x14000c9de
call fcn.14002c6ac
inc rbx
cmp rbx, rbp
jl 0x14000c9d0
mov rcx, rdi
call fcn.14002c6ac
mov r13, qword [rsp + 0x28]
mov r15, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop r12
pop rbx
ret
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x14000c993
lea r8, str.DisableForcedDisplays_GetDisplayNameByAdapterIndex_failed.
mov edx, 0x800000
call fcn.1400260c0
jmp 0x14000c993
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x14000ca54
lea r8, str.array_of_string_allocated_failed.
mov edx, 0x800000
call fcn.1400260c0
test r14d, r14d
jle 0x14000c9e6
nop dword [rax]
mov rcx, qword [rdi + rbx*8]
test rcx, rcx
je 0x14000ca6e
call fcn.14002c6ac
inc rbx
cmp rbx, rbp
jl 0x14000ca60
jmp 0x14000c9e6
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x14000ca02
lea r8, str.DisableForcedDisplays_no_FireStream_Display_found.
mov edx, 0x800000
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop r12
pop rbx
jmp fcn.1400260c0
Function at 0x140012f60
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov dword [rsp + 0x68], 4
mov rsi, rdx
lea rax, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareATIACESettingsADLMaxCofuncPaths_
mov r9d, 0x20019
mov rcx, 0xffffffff80000001
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140012fe4
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov ecx, 1
cmove ebx, ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400136b0
Capabilities:
Set registry value

Disassembly:
mov r9d, r8d
mov r8, rdx
lea rdx, str.SoftwareATIACESettingsADLMaxCofuncPaths_
jmp 0x1400137d0
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
push rdi
sub rsp, 0x60
xor ebx, ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rbx
mov rdi, r8
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14001385a
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x88]
mov dword [rsp + 0x28], 4
lea r9d, [rbx + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov ecx, 1
cmove ebx, ecx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x1400137d0
Capabilities:
Set registry value

Disassembly:
mov r9d, r8d
mov r8, rdx
lea rdx, str.SoftwareATIACESettingsADLMaxCofuncPaths_
jmp 0x1400137d0
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
push rdi
sub rsp, 0x60
xor ebx, ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rbx
mov rdi, r8
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14001385a
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x88]
mov dword [rsp + 0x28], 4
lea r9d, [rbx + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov ecx, 1
cmove ebx, ecx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140015640
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rdi
sub rsp, 0x60
lea rax, [rsp + 0x50]
mov dword [rsp + 0x80], 4
xor edi, edi
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov dword [rsp + 0x78], edi
xor r8d, r8d
lea rdx, str.SoftwareATIACESettingsADLAppProfiles
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400156e0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x88]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.AplReloadCounter
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, 1
mov ebx, edi
test eax, eax
cmove ebx, ecx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 1
mov rbx, qword [rsp + 0x70]
je 0x14001576d
mov eax, dword [rsp + 0x78]
lea rdx, str.SoftwareATIACESettingsADLAppProfiles
mov qword [rsp + 0x40], rdi
xor r9d, r9d
mov dword [rsp + 0x80], eax
xor r8d, r8d
lea rax, [rsp + 0x88]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14001576d
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x80]
mov dword [rsp + 0x28], 4
lea rdx, str.AplReloadCounter
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x140015780
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x58
call fcn.140015640
xor ecx, ecx
lea rdx, str.SoftwareATIACESettingsADLAppProfiles
mov qword [rsp + 0x40], rcx
inc eax
mov dword [rsp + 0x68], eax
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140015807
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 4
lea rdx, str.AplReloadCounter
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x58
ret
Function at 0x140015910
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rdx
mov qword [rsp + 0x40], 0
xor edx, edx
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rcx, [0x140089378]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x1400159c8
mov rax, qword [rsp + 0x40]
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x30], rbx
mov rbx, rcx
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140015951
add rbx, 0x16
mov eax, 2
mul rbx
cmovo rax, rcx
mov rcx, rax
call fcn.14002c6a4
mov qword [rdi], rax
test rax, rax
je 0x1400159bd
mov r8, qword [rsp + 0x40]
mov rdx, rbx
mov rcx, rax
call fcn.140051a44
mov rcx, qword [rdi]
lea r8, str.ATIACEAPLUser.blb
mov rdx, rbx
call fcn.1400541c4
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400159ad
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x140016780
Capabilities:
Print debug messages

Disassembly:
test rdx, rdx
jne 0x1400167a2
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400167b2
lea r8, str.ConvertPNPIDToEEUAdapterLocation_pstAdapterLocation_is_NULL_
mov edx, 0x80000
jmp fcn.1400260c0
mov eax, dword [rcx]
mov dword [rdx], eax
mov eax, dword [rcx + 4]
mov dword [rdx + 4], eax
mov eax, dword [rcx + 8]
mov dword [rdx + 8], eax
ret

Function at 0x140019510
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x2e8
xor eax, eax
lea rcx, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x68]
call fcn.14002e170
xor edx, edx
mov dword [rsp + 0x70], 0x68
mov r8d, 0x200
lea rcx, [rsp + 0xe0]
call fcn.14002e170
mov r8d, 0x200
lea rdx, [rsp + 0xe0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x140019598
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140019610
lea r8, str.GPUInstallation___GetModuleFileName_failed.
mov edx, 0x80000
call fcn.1400260c0
add rsp, 0x2e8
ret
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, str.PopUpReboot
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0xe0]
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400195fc
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400195fc
lea r8, str.GPUInstallation___CreateProcess_failed_to_creating_process_for_pop_up.
mov edx, 0x80000
call fcn.1400260c0
lea rcx, [rsp + 0x50]
call fcn.140026290
lea rcx, [rsp + 0x58]
call fcn.140026290
add rsp, 0x2e8
ret
Function at 0x14001f8e0
Capabilities:
Check if file exists
Copy file
Create directory
Get common file path
Get file attributes
Query environment variable
Set file attributes

Disassembly:
test rcx, rcx
je 0x14001faea
push rbp
push rsi
push r14
sub rsp, 0x250
mov r14, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x14001fadf
test r8, r8
je 0x14001fadf
xor edx, edx
mov qword [rsp + 0x280], rdi
mov r8d, 0x104
lea rcx, [rsp + 0x140]
call fcn.14002e170
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call fcn.14002e170
xor edi, edi
lea r9, [rsp + 0x270]
xor r8d, r8d
mov qword [rsp + 0x270], rdi
mov edx, 0x2000
lea rcx, [0x140089378]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x14001f9cc
mov r9, qword [rsp + 0x270]
mov qword [rsp + 0x278], rbx
or rbx, 0xffffffffffffffff
mov qword [rsp + 0x288], rdi
inc rbx
cmp word [r9 + rbx*2], di
jne 0x14001f984
mov r8d, 0x104
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x288]
call fcn.14005411c
mov rcx, qword [rsp + 0x270]
test eax, eax
cmove rdi, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rbx, qword [rsp + 0x278]
test rdi, rdi
jne 0x14001f9df
mov r8, rsi
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov rdi, rsi
call fcn.140030130
movzx eax, word [0x14008504c]
lea rcx, [rsp + 0x30]
mov byte [rsp + rdi + 0x30], 0x5c
xor edx, edx
mov word [rsp + rdi + 0x31], ax
movzx eax, byte [0x14008504e]
mov byte [rsp + rdi + 0x33], al
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x14001fa3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14001fa3f
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x14001fad7
lea r8, str.CopyEEUClientToUninstallFolder:_failed_to_create_AMD_directory_for_uninstall.
mov edx, 2
call fcn.1400260c0
jmp 0x14001fad7
movsd xmm0, qword [str.atieclxx.exe]
lea r8, [rdi + 0x11]
mov eax, dword [0x140085148]
lea rdx, [rsp + 0x30]
mov byte [rsp + rdi + 0x34], 0x5c
mov rcx, r14
movsd qword [rsp + rdi + 0x35], xmm0
mov dword [rsp + rdi + 0x3d], eax
call fcn.140030130
mov r8d, 0x104
lea rdx, [rsp + 0x140]
lea rcx, str._SYSTEMROOT_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea r8, str.System32_atieclxx.exe
mov edx, 0x104
lea rcx, [rsp + 0x140]
call fcn.140051bf0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001fac1
and eax, 0xfffffffc
lea rcx, [rsp + 0x30]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdi, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rsi
pop rbp
ret
Function at 0x14001fee0
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x150
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x40]
xor ebp, ebp
call fcn.14002e170
lea rax, [rsp + 0x40]
mov r10d, 0x104
sub rbx, rax
lea r9, [rsp + 0x40]
nop word [rax + rax]
lea rax, [r10 + 0x7ffffefa]
test rax, rax
je 0x14001ff51
movzx eax, byte [rbx + r9]
test al, al
je 0x14001ff51
mov byte [r9], al
inc r9
sub r10, 1
jne 0x14001ff30
test r10, r10
lea rax, [r9 - 1]
mov r8, rdi
lea rcx, [rsp + 0x40]
cmovne rax, r9
mov edx, 0x104
mov byte [rax], bpl
call fcn.140022c70
lea r9, [rsp + 0x178]
mov qword [rsp + 0x178], rbp
xor r8d, r8d
lea rcx, [0x1400892e8]
mov edx, 0x2000
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x140020044
mov r9, qword [rsp + 0x178]
or rdi, 0xffffffffffffffff
mov rbx, rdi
mov qword [rsp + 0x30], rbp
inc rbx
cmp word [r9 + rbx*2], bp
jne 0x14001ffb1
mov r8d, 0x200
mov qword [rsp + 0x20], rbx
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.14005411c
mov rcx, qword [rsp + 0x178]
test eax, eax
cmovne rbx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test rbx, rbx
je 0x1400200c1
mov byte [rbx + rsi], 0x5c
xor edx, edx
movzx eax, word [0x14008504c]
mov rcx, rsi
mov word [rbx + rsi + 1], ax
movzx eax, byte [0x14008504e]
mov byte [rbx + rsi + 3], al
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x140020060
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140020060
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140020044
lea r8, str.CreateInstallPackage:_failed_to_create_AMD_directory_for_uninstall.
mov edx, 2
call fcn.1400260c0
mov rax, rbp
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov byte [rbx + rsi + 4], 0x5c
lea rax, [rsp + 0x40]
add rbx, 5
nop
inc rdi
cmp byte [rax + rdi], bpl
jne 0x140020070
lea rcx, [rbx + rsi]
mov r8, rdi
lea rdx, [rsp + 0x40]
call fcn.140030130
xor edx, edx
mov rcx, rsi
add rbx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1400200c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400200c1
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140020044
lea r8, str.CreateInstallPackage:_failed_to_create_amdkmpfd_un_directory_for_uninstall.
jmp 0x14002003a
mov rax, rbx
jmp 0x140020047
Function at 0x1400200d0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x2e8
lea rcx, str.EeuPciFilterPackageInstallFolder
call fcn.140020230
lea rcx, str.EeuAudioFilterPackageInstallFolder
call fcn.140020230
xor eax, eax
lea rcx, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x68]
call fcn.14002e170
xor edx, edx
lea rcx, [rsp + 0xe0]
mov r8d, 0x200
call fcn.14002e170
lea rax, [rsp + 0x2f0]
mov dword [rsp + 0x2f0], 0x200
mov qword [rsp + 0x28], rax
lea r8, str.EeuClientPathForPciFilterUnInstall
lea rax, [rsp + 0xe0]
mov r9d, 2
lea rdx, str.SoftwareAMDEEU
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call fcn.140028bc0
cmp eax, 1
jne 0x140020205
lea r8, str.EeuClientPathForPciFilterUnInstall
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareAMDEEU
call fcn.140028720
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, str.UninstallPciFilter
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0xe0]
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400201f1
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400201f1
lea r8, str.GPUInstallation___CreateProcess_failed_to_creating_process_for_PCI_filter_uninstall.
mov edx, 0x80000
call fcn.1400260c0
lea rcx, [rsp + 0x50]
call fcn.140026290
lea rcx, [rsp + 0x58]
call fcn.140026290
add rsp, 0x2e8
ret
Function at 0x140020620
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x230
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x200
call fcn.14002e170
mov rcx, qword [0x1400a20e8]
xor esi, esi
mov ebx, esi
call fcn.140014260
test eax, eax
je 0x140020688
nop
mov rcx, qword [0x1400a20e8]
mov edx, ebx
call fcn.140013d60
test eax, eax
jne 0x140020686
mov rcx, qword [0x1400a20e8]
inc ebx
call fcn.140014260
cmp ebx, eax
jb 0x140020660
jmp 0x140020688
mov esi, ebx
mov rcx, qword [0x1400a20e8]
lea r8, [rsp + 0x30]
mov edx, esi
call fcn.140014580
test eax, eax
je 0x1400206da
lea rax, [rsp + 0x248]
mov r9d, 2
mov qword [rsp + 0x28], rax
lea r8, str.amdkmafd
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
mov rcx, 0xffffffff80000002
call fcn.140028bc0
cmp eax, 1
jne 0x1400206da
cmp byte [rdi + 1], 0x3a
je 0x14002073d
movups xmm0, xmmword [str.c:program_filesAMD_amdkmafd]
mov edx, 0x200
lea rcx, [rsp + 0x30]
movups xmmword [rdi], xmm0
movsd xmm1, qword [0x140085758]
movsd qword [rdi + 0x10], xmm1
mov eax, dword [0x140085760]
mov dword [rdi + 0x18], eax
movzx eax, word [0x140085764]
mov word [rdi + 0x1c], ax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x140020720
movzx eax, byte [rsp + 0x30]
mov byte [rdi], al
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x14002073d
lea r8, str.InstallFilterDriver:_The_path_from_the_registry_is_not_correct._Use_default_instead.
mov edx, 2
call fcn.1400260c0
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret