joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140026490
Capabilities:
Access peb ldr_data
Get kernel32 base address
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov rax, qword gs:[0x30]
xor r9d, r9d
mov edi, ecx
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx]
mov rbx, qword [rax + 0x30]
movsxd rax, dword [rbx + 0x3c]
mov edx, dword [rax + rbx + 0x88]
add rdx, rbx
mov r14d, dword [rdx + 0x1c]
mov esi, dword [rdx + 0x20]
add r14, rbx
mov r11d, dword [rdx + 0x24]
add rsi, rbx
mov r15d, dword [rdx + 0x14]
add r11, rbx
mov r12d, dword [rdx + 0x18]
test r15, r15
je 0x140026563
mov qword [rsp + 0x20], rbp
nop word [rax + rax]
mov eax, dword [r14 + r9*4]
test eax, eax
je 0x14002654f
xor r8d, r8d
mov ebp, eax
test r12d, r12d
je 0x14002654f
movzx eax, word [r11 + r8*2]
cmp rax, r9
jne 0x140026547
mov edx, dword [rsi + r8*4]
xor eax, eax
add rdx, rbx
movzx ecx, byte [rdx]
test cl, cl
je 0x140026543
nop dword [rax]
ror eax, 7
lea rdx, [rdx + 1]
movsx ecx, cl
add eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x140026530
cmp edi, eax
je 0x140026559
inc r8
cmp r8, r12
jb 0x140026512
inc r9
cmp r9, r15
jb 0x140026500
jmp 0x14002655e
movzx eax, byte [rbx + rbp + 4]
mov rbp, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret

Function at 0x140027ff1
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [section..data]
syscall
ret

Function at 0x14005e990
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14005e718
Function at 0x14006fafc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14006fb2c
xor eax, eax
jmp 0x14006fbef
mov rbp, rbx
cmp word [rax], si
je 0x14006fb51
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14006fb38
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14006fb34
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14006f97c
movsxd r14, eax
test eax, eax
jne 0x14006fb8f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14006fb25
mov rcx, r14
call fcn.140069560
mov rdi, rax
test rax, rax
jne 0x14006fba8
xor ecx, ecx
call fcn.140066e14
jmp 0x14006fb84
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14006f97c
test eax, eax
jne 0x14006fbd9
mov rcx, rdi
call fcn.140066e14
jmp 0x14006fbe3
xor ecx, ecx
call fcn.140066e14
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14007b3b4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14007b3ca
mov al, 1
jmp 0x14007b42a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14007b3db
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14007b428
mov ecx, dword [rcx + 0x18]
nop
call fcn.140071bb4
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14007b428
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14007b428
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14007b428
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14007b42a
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14007c858
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140065b2c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14007c8e2
cmp byte [rbp - 0x21], r15b
je 0x14007c8dd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14007c918
call fcn.140067b48
test eax, eax
jne 0x14007c904
cmp byte [rbp - 0x21], r15b
je 0x14007c8fc
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14007c918
cmp byte [rbp - 0x21], r15b
je 0x14007c915
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14006c6bc
test eax, eax
jne 0x14007c9b8
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140065b2c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14007c957
cmp byte [rbp - 0x21], r15b
je 0x14007c98c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14007c98c
call fcn.140067b48
test eax, eax
jne 0x14007c978
cmp byte [rbp - 0x21], r15b
je 0x14007c971
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14007c98c
cmp byte [rbp - 0x21], r15b
je 0x14007c989
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14006c6bc
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14007c9b8
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14007c9bb
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14007c9c9
mov rcx, rdi
call fcn.140066e14
cmp byte [rbp + 0x3f], r15b
je 0x14007c9d8
mov rcx, qword [rbp + 0x27]
call fcn.140066e14
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1414ea120
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1414ea12d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1414ea13d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1414ea125
lea eax, [rcx + 1]
jmp 0x1414ea14b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1414ea15e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1414ea144
sub eax, 3
jb 0x1414ea17e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1414ea1cd
sar eax, 1
movsxd rbp, eax
jb 0x1414ea1b4
jmp 0x1414ea18c
add ebx, ebx
jne 0x1414ea18a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1414ea1b4
inc ecx
add ebx, ebx
jne 0x1414ea19a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1414ea1b4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1414ea1ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1414ea19c
add ecx, 2
jmp 0x1414ea1b9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1414ea0e2
jmp 0x1414ea12d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x9600
mov dl, 6
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1414ea219
cmp rsi, rcx
jae 0x1414ea221
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1414ea200
cmp al, 0x8f
ja 0x1414ea200
cmp byte [rsi - 2], 0xf
je 0x1414ea206
sub al, 0xe8
cmp al, 1
ja 0x1414ea1ea
cmp rsi, rcx
jae 0x1414ea221
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1414ea1f0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1414ea221
lodsb al, byte [rsi]
jmp 0x1414ea200
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x14e8000]
mov eax, dword [rdi]
or eax, eax
je 0x1414ea27e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x14ea3e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1414ea22e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1414ea278
mov qword [rbx], rax
add rbx, 8
jmp 0x1414ea24e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1414ea2b8
cmp al, 0xef
ja 0x1414ea2aa
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1414ea28a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1414ea299
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.1414ea337], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.1414ea337
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1414ea327
sub rsp, 0xffffffffffffff80
jmp 0x140001125
Function at 0x140001120
Capabilities:
Get common file path

Disassembly:
sub rsp, 0xd8
lea r8, str.GlobalAmdlogServiceMutex
xor edx, edx
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
test rax, rax
je 0x140001153
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0xd8
ret
lea rdx, [rsp + 0x68]
mov qword [rsp + 0xd0], rbx
lea rcx, [rsp + 0xa8]
call fcn.140008d90
lea r8, str.GlobalAmdlogServiceMutex
xor edx, edx
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
test rax, rax
je 0x1400012c7
mov ecx, 0x58
call fcn.140012d68
test rax, rax
je 0x1400011a4
mov rcx, rax
call fcn.1400012e0
mov qword [0x140077e10], rax
test rax, rax
jne 0x1400011cb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0xd0]
xor eax, eax
add rsp, 0xd8
ret
call fcn.140008df0
test eax, eax
je 0x1400012a3
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x80]
call fcn.140008d90
xor r9d, r9d
lea rcx, [rsp + 0x30]
xor r8d, r8d
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x140077e00], rax
test rax, rax
je 0x1400012a3
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x80]
call fcn.140008d90
xor r9d, r9d
lea rcx, [rsp + 0x30]
xor r8d, r8d
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x140077e18], rax
test rax, rax
je 0x1400012a3
xorps xmm0, xmm0
lea rcx, [rsp + 0x48]
mov edx, SQLGetDiagRec
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov r9, qword [0x140077e10]
lea r8, [0x1400010f0]
mov edx, 8
mov qword [rsp + 0x28], 0
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140077e08], rax
test rax, rax
je 0x1400012a3
mov rcx, qword [0x140077e10]
call fcn.140001a90
call section..text
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140077e10]
test rcx, rcx
je 0x1400012c7
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rbx, qword [rsp + 0xd0]
xor eax, eax
add rsp, 0xd8
ret
Function at 0x1400014a0
Capabilities:
Get session information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x140077e18]
xor r14d, r14d
mov qword [rsp + 0x30], rax
mov rbp, rcx
mov rax, qword [0x140077e00]
mov edi, r14d
mov qword [rsp + 0x38], rax
call fcn.1400015b0
mov ebx, eax
lea esi, [r14 + 0x32]
nop
cmp ebx, 2
jne 0x14000158b
mov r9d, esi
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0x102
jne 0x14000158b
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
je 0x14000157a
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x68]
xor ecx, ecx
lea r8d, [rbx + 6]
mov edx, eax
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x14000157a
mov rcx, qword [rsp + 0x68]
mov eax, dword [rcx]
test eax, eax
jne 0x14000154e
call sub.WTSAPI32.dll_WTSFreeMemory
mov ebx, 1
jmp 0x14000157d
cmp eax, 1
jne 0x14000155f
call sub.WTSAPI32.dll_WTSFreeMemory
mov ebx, 1
jmp 0x14000157d
cmp eax, 2
jne 0x140001575
call sub.WTSAPI32.dll_WTSFreeMemory
mov ebx, 2
mov esi, 0xfa
jmp 0x14000157d
call sub.WTSAPI32.dll_WTSFreeMemory
mov ebx, r14d
inc edi
cmp edi, 0xc8
jb 0x1400014e0
mov rcx, qword [rbp + 0x50]
mov dword [rbp + 0x10], ebx
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x1400015b0
Capabilities:
Get session information

Disassembly:
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
je 0x140001622
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x50]
xor ecx, ecx
mov r8d, 8
mov edx, eax
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x140001622
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx]
test eax, eax
je 0x1400015fa
cmp eax, 1
jne 0x140001609
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, 1
add rsp, 0x38
ret
cmp eax, 2
jne 0x14000161d
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, 2
add rsp, 0x38
ret
call sub.WTSAPI32.dll_WTSFreeMemory
xor eax, eax
add rsp, 0x38
ret
Function at 0x140002300
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbp, r8
mov rsi, rdx
mov edi, 1
test r9d, r9d
je 0x140002358
sub r9d, edi
je 0x140002351
sub r9d, edi
je 0x14000234a
sub r9d, edi
je 0x140002343
cmp r9d, edi
je 0x14000233c
mov ebx, edi
jmp 0x14000235d
mov ebx, 0xffff
jmp 0x14000235d
mov ebx, 0x40
jmp 0x14000235d
mov ebx, 2
jmp 0x14000235d
mov ebx, 8
jmp 0x14000235d
mov ebx, SQLPrepare
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000238d
mov rdx, rsi
lea rcx, str.ReadRegKey_RegOpenKeyEx_failed_for_pcPath___s.
call fcn.140002990
xor eax, eax
jmp 0x1400023ee
mov rax, qword [rsp + 0x88]
mov r9d, ebx
mov rcx, qword [rsp + 0x40]
mov r8, rbp
mov qword [rsp + 0x30], rax
xor edx, edx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x78], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x1400023e1
mov rdx, rbp
lea rcx, str.ReadRegKey_RegGetValue_failed_for_value___s.
call fcn.140002990
xor edi, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1400027b0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rbp, r8
mov rsi, rdx
mov edi, 1
test r9d, r9d
je 0x1400027f9
sub r9d, edi
je 0x1400027f2
sub r9d, edi
je 0x1400027ee
cmp r9d, edi
je 0x1400027e7
xor ebx, ebx
jmp 0x1400027fe
mov ebx, SQLFetch
jmp 0x1400027fe
mov ebx, edi
jmp 0x1400027fe
mov ebx, 3
jmp 0x1400027fe
mov ebx, 4
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14000284d
mov rdx, rsi
lea rcx, str.WriteRegKey_RegCreateKeyEx_failed_for_pcPath___s.
call fcn.140002990
xor eax, eax
jmp 0x14000289b
mov eax, dword [rsp + 0x98]
mov r9d, ebx
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rbp
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14000288e
mov rdx, rbp
lea rcx, str.WriteRegKey_RegSetValueEx_failed_for_value___s.
call fcn.140002990
xor edi, edi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140002990
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rdi
sub rsp, 0x248
mov rbx, rcx
lea rdi, [rax + 0x10]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x200
call fcn.140013e40
call fcn.140002a30
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rbx
mov ebx, 0x1ff
mov rcx, qword [rax]
mov r9d, ebx
lea r8d, [rbx + 1]
call fcn.140038ed4
test eax, eax
mov ecx, 0xffffffff
cmovs eax, ecx
cmp eax, ecx
lea rcx, [rsp + 0x40]
cmove eax, ebx
cdqe
mov byte [rsp + rax + 0x40], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x248
pop rdi
pop rbx
ret

Function at 0x140003250
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
test rdx, rdx
je 0x14000328e
movups xmm0, xmmword [rdx]
xor eax, eax
lea r8, [0x1400032a0]
mov r9, rcx
mov qword [rsp + 0x28], rax
movups xmmword [rcx + 0x18], xmm0
xor ecx, ecx
mov dword [rsp + 0x20], eax
lea edx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
ret
Function at 0x1400034b0
Capabilities:
Get common file path

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
test byte [rcx + 0x40], 1
mov rdi, rdx
mov rbx, rcx
je 0x1400034dc
mov al, 1
add rsp, 0x2c0
pop rdi
pop rbx
pop rbp
ret
xorps xmm0, xmm0
mov qword [rsp + 0x2f8], r14
xor eax, eax
lea rcx, [rbp - 0x70]
xor edx, edx
mov dword [rbp - 0x78], eax
mov r8d, 0x100
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x58], xmm0
xor r14b, r14b
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x40], xmm0
call fcn.140013e40
mov dword [rbp + 0x1f0], 0x100
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
test rdi, rdi
jne 0x140003534
lea rdi, [rbx + 8]
lea rax, [rbp + 0x1f0]
mov r9d, 4
mov qword [rsp + 0x28], rax
lea r8, str.DumpFile
lea rax, [rbp - 0x70]
mov rcx, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetControlCrashControl
mov qword [rsp + 0x20], rax
call fcn.140002300
test eax, eax
jne 0x1400035a3
mov edx, dword [rbp + 0x1f0]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rbp - 0x70]
dec rcx
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140003584
movsd xmm0, qword [str.MEMORY.DMP]
mov eax, dword [0x140060c20]
movsd qword [rcx], xmm0
mov dword [rcx + 8], eax
lea rdx, [rsp + 0x30]
mov byte [rbp + 0x1e0], r14b
lea rcx, [rbp - 0x70]
call fcn.1400093b0
test al, al
je 0x1400036cb
mov qword [rsp + 0x2e8], rsi
lea rdx, [rsp + 0x30]
lea rsi, [rbx + 0x44]
mov rcx, rsi
call fcn.140009c60
test al, al
je 0x1400036c3
cmp word [rdi], 0
je 0x1400035fc
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140009c60
test al, al
je 0x1400036c3
mov r8d, dword [rbp + 0x1f0]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x90]
call fcn.140008f20
lea r9, [rbp + 0x1e0]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x90]
call fcn.1400090d0
lea rcx, [rbp + 0x90]
movzx r14d, al
call fcn.140009080
test r14b, r14b
je 0x1400036c3
cmp byte [rbp + 0x1e0], 0
je 0x1400036c3
cmp dword [rbx + 0x40], 0
jne 0x14000367d
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140008340
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.140007960
mov ecx, 3
call fcn.14000ad30
or dword [rbx + 0x40], 1
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140009c60
test al, al
je 0x1400036c3
movups xmm0, xmmword [rsp + 0x30]
mov dword [rsp + 0x28], SQLPrepare
lea r8, str.Last_AmdlogSr_LastBsodWt
mov r9d, 1
mov qword [rsp + 0x20], rsi
lea rdx, str.SoftwareAMDLOG
mov rcx, 0xffffffff80000002
movups xmmword [rsi], xmm0
call fcn.1400027b0
mov rsi, qword [rsp + 0x2e8]
movzx eax, r14b
mov r14, qword [rsp + 0x2f8]
add rsp, 0x2c0
pop rdi
pop rbx
pop rbp
ret
Function at 0x1400053c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, rcx
mov ebp, r9d
mov ecx, 0xa8
mov rdi, r8
mov rsi, rdx
call fcn.140012d68
mov rbx, rax
test rax, rax
je 0x140005539
xorps xmm0, xmm0
lea r8, [0x140004530]
xor r15d, r15d
mov r9, rbx
mov qword [rax + 0x68], r15
xor ecx, ecx
mov dword [rax + 0x70], r15d
movups xmmword [rax], xmm0
xor eax, eax
mov qword [rsp + 0x28], r15
mov qword [rbx + 0x30], rax
lea edx, [r15 + 8]
movups xmmword [rbx + 0x40], xmm0
mov dword [rsp + 0x20], r15d
movups xmmword [rbx + 0x50], xmm0
movups xmmword [rbx + 0x60], xmm0
movups xmmword [rbx + 0x70], xmm0
movups xmmword [rbx + 0x80], xmm0
movups xmmword [rbx + 0x90], xmm0
mov qword [rbx + 0xa0], rax
mov rax, qword [rsp + 0x78]
mov qword [rbx + 0x10], rax
mov eax, dword [rsp + 0x70]
mov dword [rbx + 0x3c], eax
mov qword [rbx + 0x28], rdi
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x18], r14
mov dword [rbx + 0x38], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x50], rax
test rax, rax
je 0x14000552c
test rdi, rdi
je 0x1400054db
cmp qword [rdi + 0x1c8], r15
jne 0x1400054b2
mov qword [rdi + 0x1c0], rbx
mov al, 1
mov qword [rdi + 0x1c8], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
inc dword [rdi + 0x1d0]
jmp 0x14000553b
mov qword [rbx], r15
mov al, 1
mov rcx, qword [rdi + 0x1c8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 0x1c8]
mov qword [rcx], rbx
inc dword [rdi + 0x1d0]
mov qword [rdi + 0x1c8], rbx
jmp 0x14000553b
cmp qword [rsi + 0x3a0], r15
jne 0x140005503
mov qword [rsi + 0x398], rbx
mov al, 1
mov qword [rsi + 0x3a0], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
inc dword [rsi + 0x3a8]
jmp 0x14000553b
mov qword [rbx], r15
mov rax, qword [rsi + 0x3a0]
mov qword [rbx + 8], rax
mov rax, qword [rsi + 0x3a0]
mov qword [rax], rbx
mov al, 1
inc dword [rsi + 0x3a8]
mov qword [rsi + 0x3a0], rbx
jmp 0x14000553b
mov edx, 0xa8
mov rcx, rbx
call fcn.140012da4
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140006550
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
xor edi, edi
mov rbx, rcx
mov qword [rcx + 0x2370], rdi
cmp dword [0x140077e20], edi
je 0x140006593
mov r9, rcx
mov qword [rsp + 0x28], rdi
xor ecx, ecx
mov dword [rsp + 0x20], edi
lea r8, [0x140004db0]
lea edx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x2370], rax
mov rax, qword [rbx + 0x2360]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov rax, qword [0x140077e00]
mov r9d, 0xffffffff
mov qword [rsp + 0x38], rax
mov rax, qword [0x140077e18]
lea ecx, [r8 + 3]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x14000661b
mov rcx, rbx
call fcn.140005690
mov rax, qword [rbx + 0x2360]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov rax, qword [0x140077e00]
mov r9d, 0xffffffff
mov qword [rsp + 0x38], rax
mov rax, qword [0x140077e18]
lea ecx, [r8 + 3]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x1400065d3
mov rcx, rbx
call fcn.140006470
mov rcx, qword [rbx + 0x2370]
test rcx, rcx
je 0x14000664e
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x2370]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x2370], rdi
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret