joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013ff0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
xor esi, esi
lea rdx, str.ForceHCResetOnResume
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rsi
mov rbx, rcx
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.Start_to_write_reg_key___2_
cmp eax, 2
mov ecx, 4
sete sil
call fcn.140019330
lea r11, [rsp + 0x30]
lea rdx, str.SOFTWAREATHEROSVistaAddOn
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001414f
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x68]
lea rdx, str.ResetKeyAddded
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.Start_to_write_reg_key___3_
mov ecx, 4
call fcn.140019330
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
lea rdx, str.ResetKeyAddded
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x140014124
mov rcx, qword [rsp + 0x30]
lea rdx, str.ForceResetKey
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
lea rdx, str.ForceHCResetOnResume
mov r9d, 4
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140014c10
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x40], 0xffffffff
mov dword [rsp + 0x48], 4
test rcx, rcx
jne 0x140014c37
or eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
lea rax, [rsp + 0x50]
lea rdx, str.SOFTWAREATHEROSVistaAddOn
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140014ccd
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140014cba
mov r8d, dword [rsp + 0x40]
lea rdx, str.Read__d_from_reg__s__n
lea ecx, [rax + 2]
mov r9, rbx
call fcn.140019330
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x40], 0xffffffff
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret

Function at 0x140014ce0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov r8d, ecx
lea r9, str.ControllerIndex
lea rdx, str.Set_value__d_into_reg__s__n
mov ecx, 2
call fcn.140019330
lea r11, [rsp + 0x48]
lea rdx, str.SOFTWAREAtherosVistaAddOn
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140014d66
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, str.ControllerIndex
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
ret
Function at 0x140014d70
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x140040468]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov ebx, ecx
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x20c
mov dword [rsp + 0x20], 0
call fcn.14001cc90
lea rcx, str.Enter_USBRootHubAndHCReset____n_n
call fcn.14000e580
lea rcx, [rsp + 0x20]
call fcn.140014880
test eax, eax
jne 0x140014dd4
lea rcx, str.USBRootHubAndHCReset__GetBTAdapterStatus_failed____n
call fcn.14000e580
xor eax, eax
jmp 0x140014f25
mov edx, dword [rsp + 0x20]
lea rcx, str.USBRootHubAndHCReset__dongle_status_is__d____n
call fcn.14000e580
lea rcx, str.Enter_Function_DisableRadioHandler__disable___d_n
mov edx, 1
mov dword [0x140043750], 1
call fcn.14000e580
call fcn.1400099f0
cmp eax, 0x1e
jne 0x140014e20
lea rcx, str.DisableRadioHandler__dont_send_check_msg__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [0x140043324], 1
mov ecx, dword [0x140043300]
xor r9d, r9d
mov edx, 0x5e5d
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_PostThreadMessageW]
lea rcx, str.Enter_Function_DisableRadioHandler__disable___d_n
xor edx, edx
call fcn.14000e580
mov ecx, dword [0x140043300]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e5d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
call fcn.140014880
test eax, eax
je 0x140014dc1
mov edx, dword [rsp + 0x20]
lea rcx, str.USBRootHubAndHCReset__after_off_on_radio__dongle_status_is__d_n
call fcn.14000e580
cmp dword [rsp + 0x20], 1
je 0x140014f20
lea rcx, str.USBRootHubAndHCReset__USBRootHubReset__index_is__d____n
mov edx, ebx
call fcn.14000e580
mov ecx, ebx
call fcn.140014670
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
call fcn.140014880
test eax, eax
je 0x140014dc1
mov edx, dword [rsp + 0x20]
lea rcx, str.USBRootHubAndHCReset__after_USBRootHubReset__dongle_status_is__d____n
call fcn.14000e580
cmp dword [rsp + 0x20], 1
je 0x140014f20
lea rcx, str.USBRootHubAndHCReset__USBControllerReset__index_is__d____n
mov edx, ebx
call fcn.14000e580
mov ecx, ebx
call fcn.140013c80
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
call fcn.140014880
test eax, eax
je 0x140014dc1
mov edx, dword [rsp + 0x20]
lea rcx, str.USBRootHubAndHCReset__after_USBControllerReset__dongle_status_is__d___n
call fcn.14000e580
mov eax, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140019650
add rsp, 0x240
pop rbx
ret
Function at 0x140015890
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x58]
lea rdx, str.Software_atherosVistaAddon
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400158c6
xor al, al
add rsp, 0x38
ret
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.HidePBAP
xor r8d, r8d
mov dword [rsp + 0x40], 0xffffffff
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x58]
test eax, eax
je 0x140015922
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add rsp, 0x38
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x40], 1
setne al
add rsp, 0x38
ret
Function at 0x140017bd0
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x140040468]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor esi, esi
cmp qword [rcx + 0x18], 8
mov rbx, rcx
mov qword [rcx + 0x10], rsi
jb 0x140017c09
mov rax, qword [rcx]
jmp 0x140017c0c
mov rax, rcx
lea rcx, [rsp + 0x40]
mov word [rax], si
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx edx, word [rsp + 0x40]
cmp dx, 9
je 0x140017c33
cmp dx, 6
je 0x140017c33
mov edi, dword [0x1400418d8]
jmp 0x140017c3e
mov edi, 0xf013f
mov dword [0x1400418d8], edi
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x70], si
call fcn.14001cc90
mov rcx, qword [0x1400416c8]
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREAtherosVistaAddOn
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140017cfa
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.InstallDir
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x140017cfa
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140017cfa
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x70]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.14000ce60
mov eax, 1
jmp 0x140017cfc
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140019650
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140018c90
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x50
mov rax, qword [0x140040468]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
lea rcx, [0x1400414b0]
xor r8d, r8d
lea r9d, [rbp + 0x10]
xor edx, edx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov rdi, rax
test rax, rax
je 0x140018dcb
xor eax, eax
lea r8, [rsp + 0x28]
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x28], 0x20
mov esi, ebp
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x140018dbb
mov qword [rsp + 0x60], rbx
nop
mov r8d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x24]
xor r9d, r9d
mov dword [rsp + 0x24], 0xff
mov dword [rsp + 0x20], 0xff
call qword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
lea rcx, str.The_status_of_uResult_is__d__n
mov edx, eax
mov ebx, eax
call fcn.14000e580
mov edx, dword [rsp + 0x20]
lea rcx, str.The_status_of_uProblem_is__d__n
call fcn.14000e580
test ebx, ebx
je 0x140018da4
xor eax, eax
inc esi
lea rcx, str.The_MemberIndex_of_SetupDiEnumDeviceInfo_is__d__n
mov qword [rsp + 0x28], rax
mov edx, esi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], 0x20
call fcn.14000e580
lea r8, [rsp + 0x28]
mov edx, esi
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x140018d10
jmp 0x140018db6
lea rcx, str.This_device_is_3002_UART_dongle._n
mov ebp, 1
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rbx, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov rsi, qword [rsp + 0x68]
mov eax, ebp
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140019650
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140018df0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140040468]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rcx, [rsp + 0x22]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], bx
call fcn.14001cc90
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x140018ea4
lea rdx, [rsp + 0x20]
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x20]
lea rcx, str.The_cServPath_is__s__n
call fcn.14000e580
lea rdx, str.system32
lea rcx, [rsp + 0x20]
call fcn.140019c30
test rax, rax
jne 0x140018e89
lea rdx, str.System32
lea rcx, [rsp + 0x20]
call fcn.140019c30
test rax, rax
je 0x140018e9b
lea rcx, str.This_adminservice_is_for_MSFT_WU_or_3002_Intel._n
mov ebx, 1
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140019650
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x140019330
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
mov eax, 0x100f8
call fcn.1400222d0
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x140040468]
xor rax, rsp
mov qword [rsp + 0x100e0], rax
mov eax, dword [0x140041f90]
test eax, eax
je 0x140019502
cmp ecx, eax
jg 0x140019502
test ecx, eax
je 0x140019502
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
cmp dword [0x140041f94], eax
je 0x1400193c5
nop word [rax + rax]
xor eax, eax
lock cmpxchg dword [0x140041f94], edi
cmp dword [0x140041f94], edi
je 0x1400193c5
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x140041f94], edi
jne 0x1400193a0
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov rbx, qword [0x140041f88]
cmp rbx, 0xffffffffffffffff
jne 0x1400193ee
lea rcx, [0x140041f88]
call fcn.140019160
mov rbx, rax
jmp 0x14001943e
movzx eax, word [0x140041fa0]
cmp word [rsp + 0x58], ax
jne 0x140019418
movzx eax, word [0x140041fa2]
cmp word [rsp + 0x5a], ax
jne 0x140019418
movzx eax, word [0x140041fa6]
cmp word [rsp + 0x5e], ax
je 0x14001943e
cmp rbx, 0xffffffffffffffff
je 0x140019427
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140041f88], 0xffffffffffffffff
lea rcx, [0x140041f88]
call fcn.140019160
test rbx, rbx
je 0x1400194ee
movzx ecx, word [rsp + 0x66]
movzx edx, word [rsp + 0x64]
movzx r9d, word [rsp + 0x62]
movzx r8d, word [rsp + 0x60]
mov eax, dword [0x140041f94]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rdx, str._02d:_02d:_02d__03d__X:
lea rcx, [rsp + 0x70]
call fcn.140019670
movsxd rdi, eax
lea r9, [rsp + 0x10120]
mov qword [rsp + 0x48], r9
lea rcx, [rsp + rdi*2 + 0x70]
mov r8, qword [rsp + 0x10118]
mov edx, 0x8000
call fcn.14001b94c
add eax, edi
cdqe
lea rcx, [rsp + rax*2 + 0x70]
lea rdx, [0x140039fdc]
call fcn.140019670
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx + rcx - 2]
xor edi, edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1400194f0
xor edi, edi
jmp 0x1400194f4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lock cmpxchg dword [0x140041f94], edi
mov rcx, qword [rsp + 0x100e0]
xor rcx, rsp
call fcn.140019650
add rsp, 0x100f8
pop rdi
pop rbx
ret
Function at 0x14001bc2b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140040468]
jne 0x14001966a
rol rcx, 0x10
test cx, 0xffff
jne 0x140019666
repz ret
ror rcx, 0x10
jmp 0x14001bb84
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140042150]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140042248]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14001bc09
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140042150]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14001bc2b
mov rax, qword [rsp + 0x88]
mov qword [0x140042248], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400421e8], rax
mov rax, qword [0x140042248]
mov qword [0x1400420c0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400421d0], rax
mov dword [0x1400420b0], 0xc0000409
mov dword [0x1400420b4], 1
mov rax, qword [0x140040468]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140040470]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140042148], eax
mov ecx, 1
call fcn.140023b4c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14002d900]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140042148], 0
jne 0x14001bcb2
mov ecx, 1
call fcn.140023b4c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14001e044
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14001deb4

Function at 0x140022d98
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
jne 0x140022dc2
call fcn.14001cc0c
and dword [rax], 0
call fcn.14001cbec
mov ebx, 0x16
mov dword [rax], ebx
call fcn.14001cb84
mov eax, ebx
jmp 0x140022e12
test edx, 0xfffffff9
jne 0x140022da5
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140022deb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001cc2c
call fcn.14001cbec
mov eax, dword [rax]
jmp 0x140022e12
test al, 0x10
jne 0x140022e10
test al, 1
je 0x140022e10
test bl, 2
je 0x140022e10
call fcn.14001cc0c
mov dword [rax], 5
call fcn.14001cbec
mov dword [rax], 0xd
jmp 0x140022de2
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140025494
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140040468]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14001d940
xor ebx, ebx
cmp qword [0x140043198], rbx
mov rdi, rax
jne 0x1400255a7
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14002567e
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002567e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140043198], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1400431a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1400431a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1400431b8], rax
test rax, rax
je 0x14002559e
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1400431b0], rax
jmp 0x1400255ae
mov rax, qword [0x1400431b0]
jmp 0x1400255b5
mov rax, qword [0x1400431b0]
mov r11, qword [0x1400431b8]
cmp rax, rdi
je 0x14002561c
cmp r11, rdi
je 0x14002561c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1400431b8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14002561c
test rax, rax
je 0x14002561c
call rsi
test rax, rax
je 0x140025616
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140025616
test byte [rsp + 0x40], 1
jne 0x14002561c
bts ebp, 0x15
jmp 0x14002565c
mov rcx, qword [0x1400431a0]
cmp rcx, rdi
je 0x14002565c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14002565c
call rax
mov rbx, rax
test rax, rax
je 0x14002565c
mov rcx, qword [0x1400431a8]
cmp rcx, rdi
je 0x14002565c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14002565c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140043198]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14002567e
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140025680
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140019650
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000b9fc
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b77c
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba52
mov ecx, 1
call fcn.14000b77c
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
invalid
movsd dword [rdi], dword [rsi]
jle 0x140023312
jmp qword [rdi + rdi*8 + 0x423e2a97]
movsb byte [rdi], byte [rsi]
call qword [rdi - 0x4ebdc1d6]
jl 0x140023344
sbb ebx, dword [rsi - 0x58f8857a]
push rsp
mov edx, 0xff661d7b
jg 0x1400232e0
fnsave dword [rbx]
cmp eax, 0x46dbffb2
add al, 0x4b
pop rsi
enter 0x369, 0x54
invalid
rol byte cs:[rbp - 0x16], 0x63
inc ch
add ecx, edi
mov eax, 0x4c7d8e3e
invalid
Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
inc dword [r8 + 0x40]
inc dword [rax + 0x40]
inc dword [rax + 0x40]
inc dword [rax + 0x40]
inc dword [rax + 0x40]
invalid
invalid
cmp bh, byte [rdx]
cmp bh, bh
cmp dword [rcx], edi
cmp edi, edi
cmp byte [rax], bh
cmp bh, bh
invalid
xor eax, 0x343434ff
push qword [rbx]
xor esi, dword [rbx]
push qword [rcx]
xor dword [rcx], esi
jmp [rdi]
sub eax, 0x2bff2d2d
sub ebp, dword [rbx]
jmp [rcx]
and eax, 0x23ff2525
and esp, dword [rbx]
jmp qword [rax]
invalid
and byte [rax], ah
and bh, bh
sbb eax, 0x1aff1d1d
sbb bl, byte [rdx]
call [rcx]
sbb dword [rcx], ebx
call [rcx]
sbb dword [rcx], ebx
call [rcx]
sbb dword [rcx], ebx
sbb edi, edi
sbb dword [rcx], ebx
sbb edi, edi
sbb byte [rax], bl
sbb bh, bh
sbb byte [rax], bl
sbb bh, bh
sbb byte [rax], bl
sbb bh, bh
sbb byte [rax], bl
sbb bh, bh
sbb byte [rax], bl
sbb bh, bh
sbb byte [rax], bl
sbb bh, bh
sbb byte [rax], bl
sbb bh, bh
sbb byte [rax], bl
sbb bh, bh
sbb byte [rax], bl
sbb bh, bh
sbb bl, byte [rdx]
sbb bh, bh
sbb al, 0x1c
sbb edi, edi
sbb dword [rcx], ebx
sbb edi, edi
sbb byte [rax], bl
sbb bh, bh
sbb byte [rax], bl
sbb bh, bh
sbb byte [rax], bl
sbb bh, bh
sbb byte [rax], bl
sbb bh, bh
sbb byte [rax], bl
sbb bh, bh
sbb byte [rax], bl
sbb bh, bh
sbb byte [rax], bl
sbb bh, bh
sbb byte [rax], bl
sbb bh, bh
sbb byte [rax], bl
sbb bh, bh
sbb bl, byte [rdx]
sbb bh, bh
sbb al, 0x1c
invalid
Function at 0x14000d250
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x14012c378]
test rcx, rcx
je 0x14000d292
cmp byte [0x14012c380], 1
jne 0x14000d294
xor ecx, ecx
xor edx, edx
mov r8d, 0x12
xor r9d, r9d
call qword [0x14012c370]
mov rcx, qword [0x14012c378]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [0x14012c378]
jmp 0x14000d294
xor ecx, ecx
call fcn.140043590
mov qword [0x14012c378], 0
mov byte [0x14012c380], 0
add rsp, 0x28
ret