joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400065a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [0x140038098], rax
cmp qword [0x140039818], 0
je 0x1400065da
mov rax, qword [0x140039818]
add rax, 0x28dcc
mov qword [rsp + 0x58], rax
jmp 0x1400065e6
lea rax, [0x1400380a4]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
mov eax, dword [rsp + 0x88]
mov dword [rcx], eax
mov dword [0x140039814], 1
lea r8, str.trace.txt
mov edx, 0x104
lea rcx, [0x140039710]
call fcn.140012860
lea r8, [rsp + 0x38]
lea rdx, [0x140028c68]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x140006726
mov dword [rsp + 0x40], 4
cmp qword [0x140039818], 0
je 0x140006667
mov rax, qword [0x140039818]
add rax, 0x28dc8
mov qword [rsp + 0x60], rax
jmp 0x140006673
lea rax, [0x1400380a0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.DebugLevel
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140039814]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.DebugFlags
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x40], 0x104
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140039710]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.DebugLogFile
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x80]
call fcn.140005280
add rsp, 0x78
ret
Function at 0x14000c050
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
lea rdx, [0x14002d678]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000c0e7
xor eax, eax
test eax, eax
jne 0x14000c0e2
lea rcx, [0x14002d690]
call fcn.140005070
test eax, eax
je 0x14000c0e0
lea rax, [0x14002d6b0]
mov qword [rsp + 0x20], rax
mov r9d, 0x58f
lea r8, [0x14002d6b8]
lea rdx, [0x14002d6c8]
lea rcx, [0x14002d6e8]
call fcn.140004c80
xor eax, eax
jmp 0x14000c1a9
cmp dword [rsp + 0x3c], 4
jne 0x14000c165
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
cmp dword [0x140038018], 0
jne 0x14000c109
mov dword [rsp + 0x44], 0
jmp 0x14000c147
lea rcx, [0x14002d708]
call fcn.140005070
test eax, eax
je 0x14000c137
mov edx, dword [rsp + 0x30]
lea rcx, str.Restoring_SPI_SETMOUSEBUTTONSWAP___d
call fcn.140004d20
test eax, eax
je 0x14000c137
mov dword [rsp + 0x48], 1
jmp 0x14000c13f
mov dword [rsp + 0x48], 0
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x44], eax
mov r9d, 1
xor r8d, r8d
mov edx, dword [rsp + 0x30]
mov ecx, 0x21
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
mov dword [rsp + 0x38], eax
jmp 0x14000c1a9
xor eax, eax
test eax, eax
jne 0x14000c1a9
lea rcx, [0x14002d750]
call fcn.140005070
test eax, eax
je 0x14000c1a7
lea rax, [0x14002d770]
mov qword [rsp + 0x20], rax
mov r9d, 0x59b
lea r8, [0x14002d778]
lea rdx, str.WndRestoreMouseButtonsSwitch
lea rcx, [0x14002d7a8]
call fcn.140004c80
xor eax, eax
mov eax, dword [rsp + 0x38]
add rsp, 0x58
ret
Function at 0x14000c1c0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0xa8
mov dword [rsp + 0x50], 1
cmp dword [0x140038018], 0
jne 0x14000c1e9
mov dword [rsp + 0x90], 0
jmp 0x14000c236
lea rcx, [0x14002d7c8]
call fcn.140005070
test eax, eax
je 0x14000c21d
mov edx, dword [rsp + 0xb0]
lea rcx, str.entry___bForceAndDontSave:_d
call fcn.140004d20
test eax, eax
je 0x14000c21d
mov dword [rsp + 0x94], 1
jmp 0x14000c228
mov dword [rsp + 0x94], 0
mov eax, dword [rsp + 0x94]
mov dword [rsp + 0x90], eax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14002d800]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14000c2b2
lea rcx, [0x14002d818]
call fcn.140005070
test eax, eax
je 0x14000c2a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.RegCreateKeyEx__LD_REG_KHAL_PATH___failed._Reason:_d
call fcn.140004c80
mov dword [rsp + 0x50], 0
jmp 0x14000c3cd
cmp dword [rsp + 0x50], 0
je 0x14000c3c2
lea rcx, [rsp + 0x58]
call fcn.14000c440
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x14000c2e0
cmp dword [rsp + 0xb0], 0
je 0x14000c3c2
cmp dword [rsp + 0x60], 0
jne 0x14000c326
cmp dword [rsp + 0xb0], 0
jne 0x14000c326
lea rcx, [rsp + 0x70]
call fcn.14000cd80
mov r11d, eax
mov eax, dword [rsp + 0x50]
and eax, r11d
mov dword [rsp + 0x50], eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.14000c8a0
mov r11d, eax
mov eax, dword [rsp + 0x50]
and eax, r11d
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x58]
call fcn.14000b600
mov r11d, eax
mov eax, dword [rsp + 0x50]
and eax, r11d
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x58]
call fcn.14000b890
mov r11d, eax
mov eax, dword [rsp + 0x50]
and eax, r11d
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x68], 4
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
xor r8d, r8d
lea rdx, [0x14002d868]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14000c3c2
lea rcx, [0x14002d880]
call fcn.140005070
test eax, eax
je 0x14000c3ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.RegSetValueEx__LD_REG_MOUSE_SETTINGS_CLEARED___failed._Reason:_d
call fcn.140004c80
mov dword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x140038018], 0
jne 0x14000c3e3
mov dword [rsp + 0x98], 0
jmp 0x14000c42d
lea rcx, str.WndClearCursorSettings
call fcn.140005070
test eax, eax
je 0x14000c414
mov edx, dword [rsp + 0x50]
lea rcx, str.exit__bStatus:_d_
call fcn.140004d20
test eax, eax
je 0x14000c414
mov dword [rsp + 0x9c], 1
jmp 0x14000c41f
mov dword [rsp + 0x9c], 0
mov eax, dword [rsp + 0x9c]
mov dword [rsp + 0x98], eax
mov eax, dword [rsp + 0x50]
add rsp, 0xa8
ret
Function at 0x14000c440
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [0x14002d918]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000c4af
cmp dword [rsp + 0x38], 0
je 0x14000c49f
mov dword [rsp + 0x40], 1
jmp 0x14000c4a7
mov dword [rsp + 0x40], 0
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
add rsp, 0x58
ret
Function at 0x14000d970
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x88
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x54], 1
cmp dword [0x140038018], 0
jne 0x14000d99e
mov dword [rsp + 0x6c], 0
jmp 0x14000d9d8
lea rcx, [0x14002e8f8]
call fcn.140005070
test eax, eax
je 0x14000d9c8
lea rcx, str.Entry
call fcn.140004d20
test eax, eax
je 0x14000d9c8
mov dword [rsp + 0x70], 1
jmp 0x14000d9d0
mov dword [rsp + 0x70], 0
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x6c], eax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14002e918]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14000da74
mov dword [rsp + 0x54], 0
xor eax, eax
test eax, eax
jne 0x14000da6f
lea rcx, [0x14002e930]
call fcn.140005070
test eax, eax
je 0x14000da6d
lea rax, [0x14002e944]
mov qword [rsp + 0x20], rax
mov r9d, 0x807
lea r8, [0x14002e950]
lea rdx, [0x14002e960]
lea rcx, [0x14002e978]
call fcn.140004c80
xor eax, eax
jmp 0x14000db4a
cmp dword [rsp + 0x90], 0
jl 0x14000da88
cmp dword [rsp + 0x90], 3
jle 0x14000dad4
mov dword [rsp + 0x54], 0
xor eax, eax
test eax, eax
jne 0x14000dad4
lea rcx, [0x14002e998]
call fcn.140005070
test eax, eax
je 0x14000dad2
lea rax, [0x14002e9ac]
mov qword [rsp + 0x20], rax
mov r9d, 0x80e
lea r8, [0x14002e9b8]
lea rdx, [0x14002e9c8]
lea rcx, [0x14002e9e0]
call fcn.140004c80
xor eax, eax
cmp dword [rsp + 0x54], 0
je 0x14000db3f
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x68], 4
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DriverType
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000db29
mov dword [rsp + 0x74], 1
jmp 0x14000db31
mov dword [rsp + 0x74], 0
mov ecx, dword [rsp + 0x74]
mov eax, dword [rsp + 0x54]
and eax, ecx
mov dword [rsp + 0x54], eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x140038018], 0
jne 0x14000db5d
mov dword [rsp + 0x78], 0
jmp 0x14000db97
lea rcx, str.WndSetDriverType
call fcn.140005070
test eax, eax
je 0x14000db87
lea rcx, str.Exit
call fcn.140004d20
test eax, eax
je 0x14000db87
mov dword [rsp + 0x7c], 1
jmp 0x14000db8f
mov dword [rsp + 0x7c], 0
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x54]
add rsp, 0x88
ret
Function at 0x14000e020
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x168
mov rax, qword [0x1400380d0]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov dword [rsp + 0x20], 0
mov r8, qword [rsp + 0x170]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.140012860
mov edx, 0x5c
lea rcx, [rsp + 0x40]
call fcn.14000e920
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14000e08c
mov rax, qword [rsp + 0x28]
add rax, 1
mov qword [rsp + 0x28], rax
mov edx, 0x5c
mov rcx, qword [rsp + 0x28]
call fcn.14000e920
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14000e0b0
mov rax, qword [rsp + 0x28]
mov byte [rax], 0
mov rdx, qword [rsp + 0x178]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x14000e0e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000e0e1
mov dword [rsp + 0x150], 0
jmp 0x14000e0ec
mov dword [rsp + 0x150], 1
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x20], eax
cmp qword [rsp + 0x28], 0
je 0x14000e115
mov rax, qword [rsp + 0x28]
mov byte [rax], 0x5c
mov rax, qword [rsp + 0x28]
add rax, 1
mov qword [rsp + 0x28], rax
cmp dword [rsp + 0x20], 0
je 0x14000e128
cmp qword [rsp + 0x28], 0
jne 0x14000e08c
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.140012840
add rsp, 0x168
ret
Function at 0x14000e150
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x168
mov rax, qword [0x1400380d0]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov r9d, 1
mov r8d, 0x23
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x14000e1d0
lea rcx, [0x14002ee60]
call fcn.140005070
test eax, eax
je 0x14000e1ce
lea rax, [0x14002ee80]
mov qword [rsp + 0x20], rax
mov r9d, 0x8ec
lea r8, [0x14002ee88]
lea rdx, [0x14002ee98]
lea rcx, [0x14002eeb8]
call fcn.140004c80
xor eax, eax
lea r8, [0x14002eed8]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.140012748
mov rdx, qword [rsp + 0x170]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x150], eax
cmp dword [rsp + 0x30], 0
jne 0x14000e222
cmp dword [rsp + 0x150], 0xb7
jne 0x14000e2d1
lea r8, [0x14002eee4]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.140012748
mov rdx, qword [rsp + 0x170]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x14000e263
cmp dword [rsp + 0x150], 0xb7
jne 0x14000e2d1
lea r8, str.Battery
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.140012748
mov rdx, qword [rsp + 0x170]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x150], eax
cmp dword [rsp + 0x30], 0
je 0x14000e2d1
lea rcx, [0x14002ef00]
call fcn.140005070
test eax, eax
je 0x14000e2ca
lea r8, [rsp + 0x40]
lea rdx, str.WndCreateBatteryLogFolder___Directory__s_was_created._n
mov ecx, 0x10
call fcn.1400048a0
mov eax, 1
jmp 0x14000e34c
cmp dword [rsp + 0x150], 0xb7
je 0x14000e31c
lea rcx, [0x14002ef60]
call fcn.140005070
test eax, eax
je 0x14000e31a
lea rax, str.dwLastError__ERROR_ALREADY_EXISTS
mov qword [rsp + 0x20], rax
mov r9d, 0x903
lea r8, [0x14002efa8]
lea rdx, [0x14002efb8]
lea rcx, [0x14002efd8]
call fcn.140004c80
xor eax, eax
lea rcx, str.WndCreateBatteryLogFolder
call fcn.140005070
test eax, eax
je 0x14000e34a
mov r9d, dword [rsp + 0x150]
lea r8, [rsp + 0x40]
lea rdx, str.WndCreateBatteryLogFolder___CreateDirectory__s_Failed_or_Exists._n
mov ecx, 0x10
call fcn.1400048a0
xor eax, eax
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.140012840
add rsp, 0x168
ret
Function at 0x14000e370
Capabilities:
Get common file path

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x168
mov rax, qword [0x1400380d0]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov r9d, 1
mov r8d, 0x23
mov rdx, qword [rsp + 0x178]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x14000e3fd
lea rcx, [0x14002f068]
call fcn.140005070
test eax, eax
je 0x14000e3fb
lea rax, [0x14002f088]
mov qword [rsp + 0x20], rax
mov r9d, 0x919
lea r8, str..WndMgr.cpp
lea rdx, str.WndGetBatteryLogFileName
lea rcx, [0x14002f0c0]
call fcn.140004c80
xor eax, eax
cmp dword [rsp + 0x30], 0
je 0x14000e56e
mov edx, dword [rsp + 0x180]
lea r8, str.LogitechKHALBattery_
mov rcx, qword [rsp + 0x178]
call fcn.140012748
mov rax, qword [rsp + 0x170]
add rax, 0x78
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x170]
mov r9d, dword [rax + 0x4c]
lea r8, str._08X__s.log
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.140013094
mov dword [rsp + 0x150], 0
jmp 0x14000e474
mov eax, dword [rsp + 0x150]
add eax, 1
mov dword [rsp + 0x150], eax
movsxd rax, dword [rsp + 0x150]
movsx eax, byte [rsp + rax + 0x40]
test eax, eax
je 0x14000e555
movsxd rax, dword [rsp + 0x150]
cmp rax, 0x104
jae 0x14000e555
movsxd rax, dword [rsp + 0x150]
movsx eax, byte [rsp + rax + 0x40]
cmp eax, 0x2f
je 0x14000e543
movsxd rax, dword [rsp + 0x150]
movsx eax, byte [rsp + rax + 0x40]
cmp eax, 0x5c
je 0x14000e543
movsxd rax, dword [rsp + 0x150]
movsx eax, byte [rsp + rax + 0x40]
cmp eax, 0x3a
je 0x14000e543
movsxd rax, dword [rsp + 0x150]
movsx eax, byte [rsp + rax + 0x40]
cmp eax, 0x2a
je 0x14000e543
movsxd rax, dword [rsp + 0x150]
movsx eax, byte [rsp + rax + 0x40]
cmp eax, 0x3f
je 0x14000e543
movsxd rax, dword [rsp + 0x150]
movsx eax, byte [rsp + rax + 0x40]
cmp eax, 0x22
je 0x14000e543
movsxd rax, dword [rsp + 0x150]
movsx eax, byte [rsp + rax + 0x40]
cmp eax, 0x3c
je 0x14000e543
movsxd rax, dword [rsp + 0x150]
movsx eax, byte [rsp + rax + 0x40]
cmp eax, 0x3e
je 0x14000e543
movsxd rax, dword [rsp + 0x150]
movsx eax, byte [rsp + rax + 0x40]
cmp eax, 0x7c
jne 0x14000e550
movsxd rax, dword [rsp + 0x150]
mov byte [rsp + rax + 0x40], 0x23
jmp 0x14000e463
mov edx, dword [rsp + 0x180]
lea r8, [rsp + 0x40]
mov rcx, qword [rsp + 0x178]
call fcn.140012748
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.140012840
add rsp, 0x168
ret
Function at 0x140014063
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400380d0]
jne 0x14001285a
rol rcx, 0x10
test cx, 0xffff
jne 0x140012856
repz ret
ror rcx, 0x10
jmp 0x140013fbc
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140039c80]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140039d78]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140014041
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140039c80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140014063
mov rax, qword [rsp + 0x88]
mov qword [0x140039d78], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140039d18], rax
mov rax, qword [0x140039d78]
mov qword [0x140039bf0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140039d00], rax
mov dword [0x140039be0], 0xc0000409
mov dword [0x140039be4], 1
mov rax, qword [0x1400380d0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400380d8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140039c78], eax
mov ecx, 1
call fcn.140019024
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140032418]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140039c78], 0
jne 0x1400140ea
mov ecx, 1
call fcn.140019024
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x140014580
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r8d, r8d
xor edx, edx
jmp 0x1400143f4

Function at 0x14001458c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400143f4
Function at 0x14001a0b8
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.1400156c8
xor ebx, ebx
mov rdi, rax
cmp qword [0x14003a870], rbx
jne 0x14001a1be
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14001a293
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001a293
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14003a870], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14003a878], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14003a880], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14003a890], rax
test rax, rax
je 0x14001a1b5
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14003a888], rax
jmp 0x14001a1c5
mov rax, qword [0x14003a888]
jmp 0x14001a1cc
mov rax, qword [0x14003a888]
mov r11, qword [0x14003a890]
cmp rax, rdi
je 0x14001a234
cmp r11, rdi
je 0x14001a234
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14003a890]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14001a234
test rax, rax
je 0x14001a234
call rsi
test rax, rax
je 0x14001a22e
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14001a22e
test byte [rsp + 0x38], 1
jne 0x14001a234
bts ebp, 0x15
jmp 0x14001a272
mov rcx, qword [0x14003a878]
cmp rcx, rdi
je 0x14001a272
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14001a272
call rax
mov rbx, rax
test rax, rax
je 0x14001a272
mov rcx, qword [0x14003a880]
cmp rcx, rdi
je 0x14001a272
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14001a272
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14003a870]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14001a293
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14001a295
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140005290
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x1400052c0
mov eax, 0
cmp word [rcx], 0x5a4d
jne 0x1400052bf
mov eax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x1400052c5
cdqe
add rax, rcx
cmp dword [rax], 0x4550
mov edx, 0
cmovne rax, rdx
ret
mov rax, rcx
jmp 0x1400052bf
mov eax, 0
jmp 0x1400052bf

Function at 0x140005940
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.1400058f0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x14000fb30
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14058c250]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x14000fb9f
mov rcx, r9
call fcn.14000fa00
test eax, eax
je 0x14000fb9f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x14000fb9d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x14000fb94
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x14000fb9f
add rdx, 0x28
cmp rdx, r9
jne 0x14000fb80
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret