joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002680
Capabilities:
Get token membership

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov rax, qword [0x140029090]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x14002b874]
mov ecx, dword [0x14002b870]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rbp - 1]
cmp ecx, 0xa
setl byte [rbp - 2]
mov eax, 0x76eb7c2d
mov r14, qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov r13, qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov r12, qword [sym.imp.ADVAPI32.dll_FreeSid]
mov ebx, 0x7b9bfc26
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x76eb7c2c
jg 0x1400027d0
cmp eax, 0xc6f91351
je 0x1400028e9
cmp eax, 0x5ee8c7
jne 0x1400026f0
mov eax, 0x10
call fcn.14000d850
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.14000d850
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call fcn.14000d850
sub rsp, rax
mov rcx, rsp
mov dword [rsi], 0
movzx eax, word [0x14001d3a4]
mov word [rcx + 4], ax
mov eax, dword [0x14001d3a0]
mov dword [rcx], eax
sub rsp, 0x60
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov dl, 2
mov r8d, 0x20
mov r9d, 0x220
call r14
add rsp, 0x60
mov rdx, qword [rdi]
sub rsp, 0x20
xor ecx, ecx
mov r8, rsi
call r13
add rsp, 0x20
mov rcx, qword [rdi]
sub rsp, 0x20
call r12
add rsp, 0x20
mov eax, 0x7b9bfc26
jmp 0x1400026f0
cmp eax, 0x7b9bfc26
je 0x1400027fc
cmp eax, 0x76eb7c2d
jne 0x1400026f0
movzx ecx, byte [rbp - 1]
cmp byte [rbp - 2], 0
mov eax, 0x5ee8c7
cmovne eax, ebx
test cl, cl
cmovne eax, ebx
jmp 0x1400026f0
mov eax, 0x10
call fcn.14000d850
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.14000d850
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.14000d850
sub rsp, rax
mov rcx, rsp
mov dword [rsi], 0
movzx eax, word [0x14001d3a4]
mov word [rcx + 4], ax
mov eax, dword [0x14001d3a0]
mov dword [rcx], eax
sub rsp, 0x60
mov qword [rsp + 0x50], r15
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov dl, 2
mov r8d, 0x20
mov r9d, 0x220
call r14
add rsp, 0x60
mov rdx, qword [r15]
sub rsp, 0x20
xor ecx, ecx
mov r8, rsi
call r13
add rsp, 0x20
mov rcx, qword [r15]
sub rsp, 0x20
call r12
add rsp, 0x20
mov eax, dword [rsi]
mov dword [rbp - 8], eax
mov eax, dword [0x14002b874]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc6f91351
mov ecx, 0x5ee8c7
cmovne eax, ecx
cmp dword [0x14002b870], 9
mov ecx, 0xc6f91351
cmovle eax, ecx
jmp 0x1400026f0
mov esi, dword [rbp - 8]
mov rcx, qword [rbp]
xor rcx, rbp
sub rsp, 0x20
call fcn.14000d8c0
add rsp, 0x20
mov eax, esi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140002920
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, qword [0x140029090]
xor rax, rbp
mov qword [rbp - 8], rax
mov eax, dword [0x14002b86c]
mov ecx, dword [0x14002b868]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rbp - 9]
cmp ecx, 0xa
setl byte [rbp - 0xa]
mov eax, 0xefb71d69
mov r15d, 0xcac9a9d0
mov r14d, 0xdd92f7ec
mov r12d, 0xd4eaf2b1
mov edi, 0xd204e89c
mov esi, 0xab54536c
mov ebx, 0x452607f
jmp 0x1400029b0
mov eax, dword [0x14002b86c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xce890a0e
cmove eax, edi
cmp dword [0x14002b868], 0xa
cmovl eax, edi
nop word [rax + rax]
cmp eax, 0xd4eaf2b0
jle 0x1400029f0
cmp eax, 0x452607e
jg 0x140002a20
cmp eax, 0xdd92f7ec
je 0x140002989
cmp eax, 0xefb71d69
jne 0x140002b0d
movzx ecx, byte [rbp - 9]
cmp byte [rbp - 0xa], 0
mov eax, 0x5b473c35
cmovne eax, esi
test cl, cl
cmovne eax, esi
jmp 0x1400029b0
cmp eax, 0xce890a0d
jg 0x140002a50
cmp eax, 0xab54536c
je 0x140002a8e
cmp eax, 0xcac9a9d0
jne 0x140002b1a
cmp byte [rbp - 0xb], 0
mov eax, 0x4b290972
cmovne eax, r14d
jmp 0x1400029b0
cmp eax, 0x4b290972
je 0x140002add
cmp eax, 0x5b473c35
jne 0x140002b27
sub rsp, 0x20
call fcn.140002680
add rsp, 0x20
mov eax, 0xab54536c
jmp 0x1400029b0
cmp eax, 0xce890a0e
je 0x140002b03
cmp eax, 0xd204e89c
jne 0x1400029b0
mov eax, dword [0x14002b86c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xce890a0e
cmove eax, r12d
cmp dword [0x14002b868], 0xa
cmovl eax, r12d
jmp 0x1400029b0
mov eax, 0x110
call fcn.14000d850
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
sub rsp, 0x20
call fcn.140002680
add rsp, 0x20
test eax, eax
setne byte [rbp - 0xb]
mov eax, dword [0x14002b86c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5b473c35
cmove eax, r15d
cmp dword [0x14002b868], 0xa
cmovl eax, r15d
jmp 0x1400029b0
mov eax, dword [0x14002b86c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xca087621
cmove eax, ebx
cmp dword [0x14002b868], 0xa
cmovl eax, ebx
jmp 0x1400029b0
mov eax, 0xd204e89c
jmp 0x1400029b0
cmp eax, 0xd4eaf2b1
jne 0x1400029b0
jmp 0x140002b84
cmp eax, 0xca087621
jne 0x1400029b0
jmp 0x140002b32
cmp eax, 0x452607f
jne 0x1400029b0
mov rax, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x18]
sub rsp, 0x20
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub rsp, 0x10
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea rdx, [0x14002906d]
xor ecx, ecx
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
add rsp, 0x10
xor ecx, ecx
call fcn.1400126f0
mov rcx, qword [rbp - 8]
xor rcx, rbp
sub rsp, 0x20
call fcn.14000d8c0
nop
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
Function at 0x1400126f0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140012583
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140012583
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140012583
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140012583
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140012583
cmp dword [rcx + 0x84], 0xe
jbe 0x140012583
cmp dword [rcx + 0xf8], 0
je 0x140012583
mov ecx, ebx
call fcn.140012624
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140012414
cmp dword [rbp + 0x20], 0
je 0x1400125d0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400125d8
int3
xor r8d, r8d
xor edx, edx
jmp 0x14001251c
Function at 0x180001060
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x18001d008]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
lea ecx, [rbx + 2]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800010f1
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x12c
call fcn.180002c70
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1800010e8
cmp dword [rsp + 0x28], esi
je 0x1800010e4
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x1800010ca
mov ebx, dword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180001b40
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x180001118
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x18001d008]
xor rax, rsp
mov qword [rsp + 0x160], rax
and qword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
lea rdx, [fcn.180001060]
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.180001060
mov r8d, eax
mov edx, 1
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rcx, [rsp + 0x50]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
movsxd rbx, eax
xor edx, edx
mov r8, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x50]
mov rdx, rax
mov r9, rbx
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.LoadLibraryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
and qword [rsp + 0x30], 0
xor r8d, r8d
and dword [rsp + 0x28], 0
mov r9, rax
xor edx, edx
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
or edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180001b40
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1800012b4
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov r8d, 0x20
lea rdx, [0x18001ef20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor edx, edx
test eax, eax
je 0x1800012df
lea rcx, [0x18001ef20]
call fcn.1800053b4
mov edx, eax
mov eax, edx
add rsp, 0x28
ret
Function at 0x1800012e8
Capabilities:
Log keystrokes via polling
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
lea r12, [0x180000000]
xor esi, esi
xor ebx, ebx
lea r15d, [rbp + 1]
movzx r14d, r15w
lea edi, [rbp + 3]
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx ecx, ax
mov al, byte [rbx + r12 + 0x1ecd3]
test al, al
jne 0x180001359
bt ecx, 0xf
jae 0x180001355
cmp byte [rbx + r12 + 0x1a7a3], 0xff
je 0x180001355
mov byte [rbx + r12 + 0x1ecd3], r15b
mov esi, r15d
mov al, r15b
jmp 0x180001359
test al, al
je 0x18000137a
test ecx, ecx
jne 0x18000137a
lea rax, [rbx + 3]
cmp rax, 0x100
jae 0x18000143b
mov byte [rbx + r12 + 0x1ecd3], cl
mov esi, r15d
xor al, al
movzx eax, al
add edi, r15d
or ebp, eax
add rbx, r15
cmp edi, 0x100
jl 0x18000131d
test esi, esi
je 0x18000141c
test ebp, ebp
jne 0x18000139d
xor edx, edx
jmp 0x18000140f
xor edx, edx
lea rcx, [0x18001ef41]
mov r8d, 0x1a0
call fcn.180002c70
xor ebx, ebx
mov byte [0x18001ef40], 0x2d
xor edi, edi
lea rsi, [0x18001ef40]
cmp byte [rdi + r12 + 0x1ecd0], 0
je 0x1800013fe
movzx r8d, byte [rdi + r12 + 0x1a7a0]
test r8b, r8b
cmove r8d, ebx
cmp r8d, 0xff
je 0x1800013fe
movzx ecx, r14w
lea rdx, [0x18001a5fc]
add rcx, rsi
call fcn.180001008
add r14w, ax
add ebx, r15d
add rdi, r15
cmp ebx, 0x100
jl 0x1800013c3
mov rdx, rsi
lea rcx, str.keyspressed
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
call fcn.180001c68
int3
Function at 0x180001444
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x70
vmovaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x18001d008]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor r14d, r14d
lea r15, [0x18001edf0]
mov bpl, r14b
vmovaps xmm6, xmm0
vpxor xmm1, xmm1, xmm1
movzx ecx, bpl
lea rdx, [rsp + 0x40]
vmovups xmmword [rsp + 0x40], xmm1
call qword [sym.imp.XINPUT9_1_0.dll_XInputGetState]
lea ecx, [rbp + 0x31]
mov byte [0x18001daf2], cl
test eax, eax
jne 0x1800015ae
xor edx, edx
mov r8d, 0x100
mov rcx, r15
call fcn.180002c70
movzx eax, word [rsp + 0x44]
lea rbx, str.dpad_up
mov esi, r14d
mov edi, 0xe
test word [rbx - 8], ax
je 0x1800014fd
test esi, esi
je 0x1800014e2
mov eax, esi
inc esi
mov byte [rax + r15], 0x2c
mov r8, qword [rbx]
lea rdx, [0x18001a694]
mov ecx, esi
add rcx, r15
call fcn.180001008
add esi, eax
movzx eax, word [rsp + 0x44]
add rbx, 0x10
sub rdi, 1
jne 0x1800014cf
test ax, ax
je 0x180001515
mov eax, esi
inc esi
mov byte [rax + r15], 0x7c
movsx edx, word [rsp + 0x4c]
mov r11d, r14d
movsx ecx, word [rsp + 0x4e]
mov r10d, r14d
movsx r8d, word [rsp + 0x4a]
mov ebx, r14d
movsx edi, word [rsp + 0x48]
vmulss xmm0, xmm6, dword [0x18001a8a4]
vcvttss2si eax, xmm0
movsx r9d, ax
mov eax, ecx
imul eax, ecx
imul r9d, r9d
cmp eax, r9d
mov eax, edx
cmovge ebx, ecx
imul eax, edx
mov dword [rsp + 0x38], ebx
mov ecx, esi
cmp eax, r9d
mov eax, r8d
cmovge r11d, edx
imul eax, r8d
mov dword [rsp + 0x30], r11d
mov edx, r14d
cmp eax, r9d
mov eax, edi
cmovge r10d, r8d
movzx r8d, byte [rsp + 0x46]
imul eax, edi
mov dword [rsp + 0x28], r10d
cmp eax, r9d
movzx r9d, byte [rsp + 0x47]
cmovge edx, edi
add rcx, r15
mov dword [rsp + 0x20], edx
lea rdx, str.ltrig_d_rtrig_d_lthumbx_d_lthumby_d_rthumbx_d_rthumby_d
call fcn.180001008
mov rdx, r15
jmp 0x1800015b0
xor edx, edx
lea rcx, str.controller
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
inc bpl
cmp bpl, 4
jl 0x180001481
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180001b40
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
vmovaps xmm6, xmmword [rsp + 0x60]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x180001a80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x18001d008]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov ebx, edx
mov rdi, rcx
lea rdx, [rsp + 0x30]
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd r8, eax
lea rcx, str.rundll32.exe
lea rdx, [rsp + r8 + 0x24]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x180001b08
cmp ebx, 1
jne 0x180001b08
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
and qword [rsp + 0x28], 0
lea r8, [0x180001788]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180001b40
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x140003b18
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x1400e5470]
xor rax, rsp
mov qword [rbp + 0x140], rax
and qword [r8], 0
mov r14, r8
mov r8, rcx
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1400020dc
lea r8, [0x1400ae760]
lea rcx, [rsp + 0x30]
call fcn.140002160
mov ebx, 0x1f0003
lea r8, [rsp + 0x30]
mov ecx, ebx
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov rdi, rax
test rax, rax
jne 0x140003bba
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x140003c87
mov edx, 0xc8
mov rcx, qword [rbp + 0x168]
lea r8, [0x1400ae6e8]
call fcn.140003778
mov esi, eax
jmp 0x140003c89
and dword [rsp + 0x24], 0
lea rdx, [rsp + 0x24]
and dword [rsp + 0x20], 0
mov rcx, rdi
call fcn.1400039cc
mov esi, eax
test eax, eax
jns 0x140003bf7
mov rcx, qword [rbp + 0x168]
lea r8, [0x1400ae6e8]
mov r9d, eax
mov edx, 0xce
call fcn.140003748
jmp 0x140003c89
lea r8, [0x1400ae768]
lea rcx, [rsp + 0x30]
call fcn.140002160
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov rbx, rax
test rax, rax
jne 0x140003c29
mov edx, 0xd4
jmp 0x140003ba0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400039cc
mov esi, eax
test eax, eax
jns 0x140003c66
mov rcx, qword [rbp + 0x168]
lea r8, [0x1400ae6e8]
mov r9d, eax
mov edx, 0xd6
call fcn.140003748
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x140003cc4
jmp 0x140003c89
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x140003cdd
movsxd rcx, dword [rsp + 0x20]
movsxd rax, dword [rsp + 0x24]
shl rcx, 0x1f
or rax, rcx
mov qword [r14], rax
xor esi, esi
test rdi, rdi
je 0x140003c9b
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x140003cf6
mov eax, esi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.14009ae70
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov rcx, qword [rbp + 0x168]
lea r8, [0x1400ae740]
mov edx, 0x879
call fcn.140003790
int3
mov rcx, qword [rbp + 0x168]
lea r8, [0x1400ae740]
mov edx, 0x879
call fcn.140003790
int3
mov rcx, qword [rbp + 0x168]
lea r8, [0x1400ae740]
mov edx, 0x879
call fcn.140003790
int3
Function at 0x1400059a4
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edx, edx
mov rsi, rcx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
xor edi, edi
test eax, eax
jne 0x140005bb8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 3
jne 0x140005b92
lea rdx, [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchSkipRoot]
test eax, eax
js 0x140005b6b
mov rax, qword [rsp + 0x48]
cmp word [rax], di
je 0x140005b6b
or rbp, 0xffffffffffffffff
mov rax, rbp
inc rax
cmp word [rsi + rax*2], di
jne 0x140005a07
lea rbx, [rax + rax]
test rax, rax
je 0x140005a24
cmp word [rbx + rsi - 2], 0x5c
jne 0x140005a24
dec rax
mov dword [rsp + 0x28], 1
lea r9, [0x1400ae520]
mov r8d, eax
mov dword [rsp + 0x20], 1
mov rdx, rsi
mov ecx, 0x800000
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FindStringOrdinal]
cmp eax, ebp
jne 0x140005a56
lea rbp, [rbx + rsi]
jmp 0x140005a60
movsxd rbp, eax
inc rbp
lea rbp, [rsi + rbp*2]
sub rbp, rsi
sar rbp, 1
je 0x140005b6b
lea rcx, [rbp + 1]
mov eax, 2
mul rcx
mov qword [rsp + 0x48], rcx
lea rdx, [0x1400e63f8]
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14009b448
xor r9d, r9d
mov rbx, rax
test rax, rax
jne 0x140005aaf
mov edi, 0x8007000e
lea edx, [rax + 0x7d]
jmp 0x140005b3b
mov rcx, qword [rsp + 0x48]
mov r8d, 0x7ffffffe
mov edx, 0x80070057
lea rax, [rcx - 1]
cmp rax, r8
cmova edi, edx
test edi, edi
js 0x140005b29
cmp rbp, r8
jbe 0x140005ada
mov edi, edx
mov word [rbx], r9w
jmp 0x140005b36
mov rdx, rbx
test rcx, rcx
je 0x140005b0b
sub rbp, rcx
mov r8, rsi
sub r8, rbx
lea rax, [rcx + rbp]
test rax, rax
je 0x140005b0b
movzx eax, word [r8 + rdx]
test ax, ax
je 0x140005b0b
mov word [rdx], ax
add rdx, 2
sub rcx, 1
jne 0x140005aeb
test rcx, rcx
lea rax, [rdx - 2]
cmovne rax, rdx
neg rcx
sbb edi, edi
not edi
and edi, 0x8007007a
mov word [rax], r9w
jmp 0x140005b32
test rcx, rcx
je 0x140005b32
mov word [rbx], r9w
test edi, edi
jns 0x140005b5b
mov edx, 0x7e
mov rcx, qword [rsp + 0x38]
lea r8, str.internal_sdkincwil_filesystem.h
mov r9d, edi
call fcn.140003748
mov rcx, rbx
call fcn.14009b418
mov eax, edi
jmp 0x140005bba
mov rcx, rbx
call fcn.1400059a4
mov rcx, rbx
call fcn.14009b418
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x140005bb8
mov rcx, qword [rsp + 0x38]
lea r8, str.internal_sdkincwil_filesystem.h
mov edx, 0x81
call fcn.140003778
jmp 0x140005bba
cmp eax, 0xb7
je 0x140005bb8
test eax, eax
je 0x140005bb8
mov rcx, qword [rsp + 0x38]
lea r8, str.internal_sdkincwil_filesystem.h
mov r9d, eax
mov edx, 0x85
call fcn.140008ee8
jmp 0x140005bba
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14000ca5c
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x98
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x1400e5470]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov r12, r9
movsxd rdi, r8d
mov esi, edx
mov r14, rcx
mov r15d, 3
mov byte [rsp + 0x50], 0
lea r9, [rsp + 0x50]
mov r8d, edi
call fcn.14000cc7c
mov ebx, eax
test eax, eax
jns 0x14000cad4
mov rcx, qword [rsp + 0xc8]
mov r9d, eax
lea r8, str.analoginput_spectrumcomponentscapabilityhandler.cpp
mov edx, 0xf1
call fcn.140003748
mov eax, ebx
jmp 0x14000cc57
cmp byte [rsp + 0x50], 0
je 0x14000cc01
mov edx, esi
mov rcx, r14
call fcn.14000c1cc
mov rbx, rax
mov r15d, 1
mov dword [rax + rdi*4 + 0xc], r15d
and qword [rsp + 0x58], 0
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionSpectrumCapabilities
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
je 0x14000cb73
mov rcx, qword [rsp + 0xc8]
mov r9d, eax
lea r8, str.analoginput_spectrumcomponentscapabilityhandler.cpp
mov edx, 0xfb
call fcn.140008ee8
mov ebx, eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000cb6c
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
jmp 0x14000cc57
mov edx, esi
lea rcx, [rsp + 0x68]
call fcn.14000e140
cmp qword [rax + 0x18], 8
jb 0x14000cb89
mov rax, qword [rax]
mov dword [rsp + 0x28], 0x18
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ebx, eax
lea rcx, [rsp + 0x68]
call fcn.140004584
test ebx, ebx
je 0x14000cbef
mov rcx, qword [rsp + 0xc8]
mov r9d, ebx
lea r8, str.analoginput_spectrumcomponentscapabilityhandler.cpp
mov edx, 0xfc
call fcn.140008ee8
mov ebx, eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000cbeb
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
jmp 0x14000cc57
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000cc4b
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x14000cc4b
test edi, edi
je 0x14000cc1f
lea eax, [rdi - 1]
lea rbx, str.spatialPerception
lea rcx, str.Unknown
cmp eax, 1
cmova rbx, rcx
jmp 0x14000cc26
lea rbx, str.perceptionSystem
call fcn.140008200
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14000cc4b
cmp dword [rcx], 0
jbe 0x14000cc4b
call fcn.140008200
mov r9d, esi
mov r8, rbx
xor edx, edx
call fcn.14000dee8
mov dword [r12], r15d
xor eax, eax
jmp 0x14000cc57
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14009ae70
add rsp, 0x98
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140011110
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
lea rsi, [rcx + 8]
mov rbx, rcx
mov rcx, rsi
mov rdi, rdx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockShared]
lea r8, [rbx + 0x28]
cmp qword [r8 + 0x18], 8
jb 0x140011140
mov r8, qword [r8]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 0xc
mov qword [rsp + 0x30], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionSpectrum
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rdi
mov r9d, 0xffff
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test edx, edx
jns 0x14001119e
mov eax, dword [rbx + 0x1c]
mov dword [rdi], eax
mov eax, dword [rbx + 0x20]
mov dword [rdi + 4], eax
mov eax, dword [rbx + 0x24]
mov dword [rdi + 8], eax
test rsi, rsi
je 0x1400111ac
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockShared]
mov rbx, qword [rsp + 0x60]
mov rax, rdi
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret