joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020760
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x230
mov r14, r8
mov ebx, edx
mov rsi, rcx
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x30]
mov rbp, r9
call fcn.14002e170
mov r15, qword [rsp + 0x270]
xor edi, edi
mov r8, rbp
mov dword [rsp + 0x258], ebx
mov edx, ebx
mov rcx, rsi
mov dword [r15], edi
call fcn.140020f40
test eax, eax
je 0x1400207c9
mov dword [r15], 1
jmp 0x14002091f
test r14, r14
je 0x1400207d3
cmp byte [r14], dil
jne 0x1400207e6
test rbp, rbp
je 0x140020869
cmp byte [rbp], dil
je 0x140020869
test rbp, rbp
je 0x140020828
cmp byte [rbp], dil
je 0x140020828
lea rax, [rsp + 0x258]
mov r9d, 2
mov qword [rsp + 0x28], rax
lea r8, str.amdkmpfd
mov rdx, rbp
mov qword [rsp + 0x20], rsi
mov rcx, 0xffffffff80000002
call fcn.140028bc0
cmp eax, 1
je 0x14002091f
test r14, r14
je 0x140020869
cmp byte [r14], dil
je 0x140020869
lea rax, [rsp + 0x258]
mov r9d, 2
mov qword [rsp + 0x28], rax
lea r8, str.amdkmpfd
mov rdx, r14
mov qword [rsp + 0x20], rsi
mov rcx, 0xffffffff80000002
call fcn.140028bc0
cmp eax, 1
je 0x14002091f
mov rcx, qword [0x1400a20e8]
test rcx, rcx
je 0x14002092a
lea rdx, [rsp + 0x270]
call fcn.1400143d0
test eax, eax
je 0x14002092a
mov rcx, qword [0x1400a20e8]
mov ebp, edi
mov ebx, edi
call fcn.140014260
test eax, eax
je 0x1400208d3
mov rcx, qword [0x1400a20e8]
mov edx, ebx
call fcn.140013d60
test eax, eax
je 0x1400208bd
cmp ebx, dword [rsp + 0x270]
jne 0x1400208d1
mov rcx, qword [0x1400a20e8]
inc ebx
call fcn.140014260
cmp ebx, eax
jb 0x1400208a2
jmp 0x1400208d3
mov ebp, ebx
mov rcx, qword [0x1400a20e8]
lea r8, [rsp + 0x30]
mov edx, ebp
call fcn.140014580
test eax, eax
je 0x14002092a
lea rax, [rsp + 0x258]
mov r9d, 2
mov qword [rsp + 0x28], rax
lea r8, str.amdkmpfd
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rsi
mov rcx, 0xffffffff80000002
call fcn.140028bc0
cmp eax, 1
jne 0x14002092a
cmp byte [rsi + 1], 0x3a
mov edi, 1
je 0x140020992
movups xmm0, xmmword [str.c:program_filesAMD_amdkmpfd]
mov edx, 0x200
lea rcx, [rsp + 0x30]
movups xmmword [rsi], xmm0
movsd xmm1, qword [0x1400856d8]
movsd qword [rsi + 0x10], xmm1
mov eax, dword [0x1400856e0]
mov dword [rsi + 0x18], eax
movzx eax, word [0x1400856e4]
mov word [rsi + 0x1c], ax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x140020975
movzx eax, byte [rsp + 0x30]
mov edi, 1
mov byte [rsi], al
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140020992
lea r8, str.InstallFilterDriver:_The_path_from_the_registry_is_not_correct._Use_default_instead.
mov edx, 2
call fcn.1400260c0
lea r11, [rsp + 0x230]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140020e00
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
mov eax, 0x1130
call fcn.14002c740
sub rsp, rax
movsd xmm0, qword [str._unknown_]
mov r15, rcx
movzx eax, word [0x1400851b8]
lea rcx, [rsp + 0x2a]
xor edx, edx
movsd qword [rsp + 0x20], xmm0
mov r8d, 0xfa
mov word [rsp + 0x28], ax
call fcn.14002e170
lea r8, [rsp + 0x1158]
mov edx, 0x1000
lea rcx, [rsp + 0x130]
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x140020f05
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [r15 + rbx], 0
jne 0x140020e76
mov r14d, dword [rsp + 0x1158]
xor edi, edi
shr r14d, 2
test r14d, r14d
je 0x140020f05
lea rsi, [rsp + 0x130]
nop dword [rax + rax]
mov r8d, dword [rsi]
test r8d, r8d
je 0x140020efa
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x140020efa
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_K32GetProcessImageFileNameA
mov dword [rsp + 0x1158], eax
cmp eax, ebx
jb 0x140020ef1
sub eax, ebx
lea rcx, [rsp + 0x20]
add rcx, rax
mov rdx, r15
call fcn.1400546a8
test eax, eax
je 0x140020f24
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
add rsi, 4
cmp edi, r14d
jb 0x140020ea0
xor eax, eax
lea r11, [rsp + 0x1130]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + rdi*4 + 0x130]
jmp 0x140020f07
Function at 0x140020f40
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
sub rsp, 0x430
mov rbx, r8
mov esi, edx
mov rdi, rcx
mov dword [rax + 0x10], 0
xor edx, edx
mov dword [rax + 0x18], 4
mov r8d, 0x200
lea rcx, [rsp + 0x30]
call fcn.14002e170
mov dword [rsp + 0x468], esi
test rbx, rbx
je 0x140020fb0
cmp byte [rbx], 0
je 0x140020fb0
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x140020f90
cmp r8, rsi
lea rcx, [rsp + 0x30]
mov rdx, rbx
cmova r8, rsi
call fcn.140030130
jmp 0x140020fe0
xor ebx, ebx
mov rcx, qword [0x1400a20e8]
mov edx, ebx
call fcn.140013d60
test eax, eax
jne 0x140020fcd
inc ebx
cmp ebx, 0x10
jb 0x140020fb2
jmp 0x140020fe0
mov rcx, qword [0x1400a20e8]
lea r8, [rsp + 0x30]
mov edx, ebx
call fcn.140014580
lea rax, [rsp + 0x460]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, str.KMD_InstallUncertifiedPFD
lea rax, [rsp + 0x458]
mov rcx, 0xffffffff80000002
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140028bc0
test eax, eax
jne 0x140021083
mov dword [rsp + 0x458], eax
lea r8, str.KMD_InstallUncertifiedPFD
lea rax, [rsp + 0x460]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwareAMDEEU
lea rax, [rsp + 0x458]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.140028bc0
test eax, eax
jne 0x140021083
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140021076
lea r8, str.GetUncertFilterInstallPath:_registry_key_not_present_in_both_GPU_and_EEU_registry_path_
lea edx, [rax + 2]
call fcn.1400260c0
xor eax, eax
add rsp, 0x430
pop rdi
pop rsi
pop rbx
ret
cmp dword [rsp + 0x458], 1
jne 0x140021076
lea rax, [rsp + 0x468]
mov r9d, 2
mov qword [rsp + 0x28], rax
lea r8, str.amdpfdun
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
mov rcx, 0xffffffff80000002
call fcn.140028bc0
cmp eax, 1
je 0x140021127
xor edx, edx
lea rcx, [rsp + 0x230]
mov r8d, 0x200
call fcn.14002e170
movups xmm0, xmmword [str.c:program_filesAMD_amdpfdun]
mov edx, 0x200
lea rcx, [rsp + 0x230]
movups xmmword [rdi], xmm0
movsd xmm1, qword [0x1400856b8]
movsd qword [rdi + 0x10], xmm1
mov eax, dword [0x1400856c0]
mov dword [rdi + 0x18], eax
movzx eax, word [0x1400856c4]
mov word [rdi + 0x1c], ax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x140021076
movzx eax, byte [rsp + 0x230]
mov byte [rdi], al
mov eax, 1
add rsp, 0x430
pop rdi
pop rsi
pop rbx
ret
Function at 0x140021d20
Capabilities:
Get file version info
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x430
mov rsi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x230]
mov r8d, 0x200
xor dil, dil
call fcn.14002e170
lea rcx, [rsp + 0x230]
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x140021d60
lea rdx, str..inf
lea rcx, [rsp + 0x230]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x140021d92
mov word [rax + 1], 0x7973
mov byte [rax + 3], 0x73
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x200
call fcn.14002e170
mov r8d, 0x104
lea rdx, [rsp + 0x30]
lea rcx, str._SYSTEMROOT_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea rcx, [rsp + 0x30]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140021dc4
movzx eax, word [0x140085190]
movups xmm0, xmmword [str.System32drivers_]
movups xmmword [rcx], xmm0
mov word [rcx + 0x10], ax
movzx eax, byte [0x140085192]
mov byte [rcx + 0x12], al
lea rcx, [rsp + 0x30]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140021df5
xor edx, edx
movzx eax, byte [rsi + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140021e01
lea rcx, [rsp + 0x30]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140021e20
mov eax, dword [str..sys]
xor edx, edx
mov dword [rcx], eax
movzx eax, byte [0x140085198]
mov byte [rcx + 4], al
xor eax, eax
lea rcx, [rsp + 0x230]
mov qword [rsp + 0x478], rax
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x460], eax
mov dword [rsp + 0x470], eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
xor edx, edx
mov r14d, eax
lea rcx, [rsp + 0x30]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebp, eax
test r14d, r14d
je 0x140021f6f
test eax, eax
je 0x140021f6f
mov ecx, r14d
call fcn.14002c6a4
mov ecx, ebp
mov rsi, rax
call fcn.14002c6a4
mov rbx, rax
test rsi, rsi
je 0x140021f62
test rax, rax
je 0x140021f5a
mov r9, rsi
lea rcx, [rsp + 0x230]
mov r8d, r14d
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x140021f5a
mov r9, rbx
lea rcx, [rsp + 0x30]
mov r8d, ebp
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x140021f5a
lea r9, [rsp + 0x460]
mov rcx, rsi
lea r8, [rsp + 0x478]
lea rdx, [0x14007d45c]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x140021f5a
lea r9, [rsp + 0x470]
mov rcx, rbx
lea r8, [rsp + 0x20]
lea rdx, [0x14007d45c]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x140021f5a
mov rcx, qword [rsp + 0x478]
test rcx, rcx
je 0x140021f5a
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x140021f5a
mov eax, dword [rdx + 0x10]
cmp dword [rcx + 0x10], eax
jne 0x140021f5a
mov eax, dword [rdx + 0x14]
mov r8d, 1
cmp dword [rcx + 0x14], eax
movzx edi, dil
cmove edi, r8d
mov rcx, rsi
call fcn.14002c6ac
test rbx, rbx
je 0x140021f6f
mov rcx, rbx
call fcn.14002c6ac
movzx eax, dil
add rsp, 0x430
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140022300
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov esi, edx
movsxd r15, r9d
xor r12d, r12d
and esi, 0xf
mov edi, r12d
mov r14, r8
mov ebx, edx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
shr ebx, 4
lea edx, [r12 + 6]
inc bx
movzx r9d, ax
movzx r8d, bx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceExA]
mov r8, r15
xor edx, edx
add r8, r8
mov rcx, r14
mov rbx, rax
call fcn.14002e170
test rbx, rbx
je 0x1400223d8
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x1400223d8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rax
mov eax, r12d
cmp eax, esi
je 0x1400223a9
movzx ecx, word [rdx]
inc eax
lea rdx, [rdx + rcx*2]
add rdx, 2
cmp eax, 0x10
jb 0x140022391
jmp 0x1400223cf
movzx eax, word [rdx]
test ax, ax
je 0x1400223cf
movzx ebx, ax
cmp ebx, r15d
jge 0x1400223cf
mov r8d, ebx
add rdx, 2
mov rcx, r14
mov edi, ebx
call fcn.140051458
mov word [r14 + rbx*2], r12w
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140023360
Capabilities:
Enumerate process modules
Enumerate processes on remote desktop session host

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x250
xor ebp, ebp
mov rdi, rdx
mov dword [rax + 0x18], ebp
lea rax, [rax + 0x18]
mov esi, ecx
mov qword [rsp + 0x38], rbp
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8d, [rbp + 1]
xor edx, edx
xor ecx, ecx
call sub.WTSAPI32.dll_WTSEnumerateProcessesA
test eax, eax
jne 0x1400233cb
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400234f6
lea r9, str.WTSEnumerateProcesses_failed.
mov edx, 0x60004002
lea r8d, [rbp + 1]
call fcn.140025e10
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x270], rbx
mov ebx, ebp
cmp dword [rsp + 0x280], ebx
jbe 0x1400234e4
cmp qword [rdi], rbp
jne 0x1400234e4
mov eax, ebx
lea rcx, [rax + rax*2]
mov rax, qword [rsp + 0x38]
cmp dword [rax + rcx*8], esi
jne 0x1400234d5
mov r8d, dword [rax + rcx*8 + 4]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400234d5
lea r9, [rsp + 0x288]
mov qword [rsp + 0x40], rbp
mov r8d, 8
mov dword [rsp + 0x288], ebp
lea rdx, [rsp + 0x40]
mov rcx, rax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x1400234cb
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x200
call fcn.14002e170
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov r9d, 0x200
call sub.KERNEL32.dll_K32GetModuleBaseNameA
mov r8d, 0xc
lea rdx, str.winlogon.exe
lea rcx, [rsp + 0x50]
call fcn.140054800
test eax, eax
jne 0x1400234cb
mov rcx, qword [rsp + 0x30]
lea edx, [rax + 0xf]
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400234cb
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400234cb
lea r9, str.OpenProcessToken_failed.
mov edx, 0x60004002
lea r8d, [rax + 1]
call fcn.140025e10
lea rcx, [rsp + 0x30]
call fcn.140026290
inc ebx
cmp ebx, dword [rsp + 0x280]
jb 0x1400233e2
mov rcx, qword [rsp + 0x38]
call sub.WTSAPI32.dll_WTSFreeMemory
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret
Function at 0x140023510
Capabilities:
Create process on windows
Get file attributes
Query environment variable

Disassembly:
push rbx
sub rsp, 0x300
call fcn.140023890
xor edx, edx
lea rcx, [rsp + 0xe0]
mov r8d, 0x104
call fcn.14002e170
xor edx, edx
lea rcx, [rsp + 0x1f0]
mov r8d, 0x104
call fcn.14002e170
mov r8d, 0x104
lea rdx, [rsp + 0x1f0]
lea rcx, str.COMMONPROGRAMFILES
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140023648
lea rax, str.ATI_TechnologiesDSEManager.exe
xor ebx, ebx
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x1f0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0xe0]
call fcn.140055b4c
test eax, eax
jne 0x1400235bf
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
je 0x140023648
cmp eax, 0xffffffff
je 0x140023648
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.14002e170
lea rax, str.WinSta0Default
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0xe0]
xor eax, eax
mov word [rsp + 0xb0], bx
mov qword [rsp + 0x58], rax
xor r9d, r9d
mov qword [rsp + 0x60], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rax
xor edx, edx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
add rsp, 0x300
pop rbx
ret
lea rcx, str.Unable_to_create_path_for_DSE_Manager._n
call fcn.140023b90
add rsp, 0x300
pop rbx
ret
Function at 0x140023730
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0xf0
xor r14d, r14d
mov rbp, rdx
lea rdx, [rax + 0x18]
mov qword [rax + 0x18], r14
mov edi, ecx
lea ebx, [r14 + 1]
call fcn.140023360
cmp qword [rsp + 0x110], r14
jne 0x140023796
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x14002378f
lea r9, str.GetSystemToken_failed_to_get_a_token.__Session_id__u
mov dword [rsp + 0x20], edi
xor r8d, r8d
mov edx, 0x60004002
call fcn.140025e10
xor eax, eax
jmp 0x140023874
xor eax, eax
lea rcx, [rsp + 0x80]
xor edx, edx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
lea r8d, [rax + 0x68]
call fcn.14002e170
mov rcx, qword [rsp + 0x110]
lea rax, str.WinSta0Default
mov qword [rsp + 0x90], rax
xor r9d, r9d
lea rax, [rsp + 0x60]
mov dword [rsp + 0x80], 0x68
mov qword [rsp + 0x50], rax
mov r8, rbp
lea rax, [rsp + 0x80]
mov word [rsp + 0xc0], r14w
mov qword [rsp + 0x48], rax
xor edx, edx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x20
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x140023851
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x14002384e
lea r9, str.CreateProcessAsUser_failed.__Session_id__u
mov dword [rsp + 0x20], edi
mov r8d, ebx
mov edx, 0x60004002
call fcn.140025e10
mov ebx, r14d
lea rcx, [rsp + 0x60]
call fcn.140026290
lea rcx, [rsp + 0x110]
call fcn.140026290
lea rcx, [rsp + 0x68]
call fcn.140026290
mov eax, ebx
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140023890
Capabilities:
Enumerate processes
Get file attributes
Query environment variable
Terminate process

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0x4b8]
sub rsp, 0x5b8
xor edx, edx
lea rcx, [rbp + 0x190]
mov r8d, 0x104
call fcn.14002e170
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.14002e170
mov r8d, 0x104
lea rdx, [rsp + 0x50]
lea rcx, str.COMMONPROGRAMFILES
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140023b21
lea rax, str.ATI_TechnologiesDSEManager.exe
xor r14d, r14d
mov qword [rsp + 0x28], r14
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rbp + 0x190]
call fcn.140055b4c
test eax, eax
jne 0x140023939
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
je 0x140023b21
cmp eax, 0xffffffff
je 0x140023b21
xor edx, edx
mov qword [rsp + 0x5e0], rsi
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140023973
lea rcx, str.Unable_to_get_snapshot_of_all_processes._n
call fcn.140023b90
mov rsi, qword [rsp + 0x5e0]
add rsp, 0x5b8
pop r14
pop rbp
ret
mov qword [rsp + 0x5b0], rdi
mov edi, r14d
mov qword [rsp + 0x5d8], rbx
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x60]
mov r8d, 0x130
call fcn.14002e170
mov dword [rbp + 0x60], 0x130
test edi, edi
jne 0x1400239ba
lea rdx, [rbp + 0x60]
mov rcx, rsi
call sub.KERNEL32.dll_Process32First
jmp 0x1400239c8
jle 0x1400239d0
lea rdx, [rbp + 0x60]
mov rcx, rsi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x140023af5
xor edx, edx
lea rcx, [rbp + 0x2a0]
mov r8d, 0x100
call fcn.14002e170
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x100
call fcn.14002e170
mov qword [rsp + 0x40], 0x100
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rcx, [rbp + 0x8c]
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x30], 0x100
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
call fcn.140056b5c
test eax, eax
jne 0x140023aee
lea rdx, str.DSEManager
lea rcx, [rbp + 0x2a0]
call fcn.1400546a8
test eax, eax
jne 0x140023aee
lea rdx, str..exe
lea rcx, [rsp + 0x50]
call fcn.1400546a8
test eax, eax
jne 0x140023aee
mov r8d, dword [rbp + 0x68]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140023aee
xor edx, edx
lea rcx, [rbp + 0x3a0]
mov r8d, 0x104
call fcn.14002e170
lea r9, [rbp + 0x4d0]
mov dword [rbp + 0x4d0], 0x104
lea r8, [rbp + 0x3a0]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
test eax, eax
je 0x140023ae5
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x3a0]
call fcn.1400546a8
test eax, eax
jne 0x140023ae5
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
jmp 0x140023990
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x5b0]
mov rbx, qword [rsp + 0x5d8]
mov rsi, qword [rsp + 0x5e0]
add rsp, 0x5b8
pop r14
pop rbp
ret
lea rcx, str.Unable_to_create_path_for_DSE_Manager._n
call fcn.140023b90
add rsp, 0x5b8
pop r14
pop rbp
ret
Function at 0x140024330
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x140
mov rbx, qword [rsp + 0x180]
mov r12, rdx
mov rdx, rbx
mov r14, r9
mov r15, r8
mov rdi, rcx
xor esi, esi
call fcn.1400244b0
mov ebp, eax
test eax, eax
je 0x140024444
lea rdx, str.explorer.exe
mov rcx, rbx
call fcn.1400514a0
test eax, eax
je 0x140024439
lea rdx, str.MicrosoftEdgeCP.exe
mov rcx, rbx
call fcn.1400514a0
test eax, eax
je 0x140024439
lea rdx, str.ApplicationFrameHost.exe
mov rcx, rbx
call fcn.1400514a0
test eax, eax
jne 0x14002441f
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call fcn.14002e170
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jle 0x14002441f
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_FindWindowExA]
test rax, rax
je 0x14002440e
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.1400244b0
mov ebp, eax
jmp 0x14002441f
xor r8d, r8d
mov edx, 0xbb8
lea ecx, [r8 + 7]
call fcn.140025c40
movups xmm0, xmmword [r12 + 4]
lea rdx, [rsp + 0x20]
mov rcx, rdi
movaps xmmword [rsp + 0x20], xmm0
call fcn.140024700
mov esi, eax
mov dword [r15], esi
mov eax, 1
mov dword [r14], ebp
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140024d00
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
test rcx, rcx
je 0x140024d35
cmp qword [rcx], 0
je 0x140024d35
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140024d35
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov qword [rbx + 8], rax
mov qword [rbx], rax
xor eax, eax
lea r8, [rsp + 0x38]
mov qword [rsp + 0x30], rax
lea rcx, str.D:P_A_OICI_GA___SY__A_OICI_GA___BA__A_OICI_GA___IU_
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
lea edx, [rax + 1]
mov dword [rsp + 0x30], 0x18
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorA
test eax, eax
je 0x140024e31
cmp qword [rsp + 0x38], 0
je 0x140024e31
xor r9d, r9d
mov qword [rsp + 0x60], rdi
lea rax, str.beb53fa0_d9e9_11e6_bf26_cec0c932ce01
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x400
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rcx, qword [rsp + 0x38]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
jne 0x140024dd5
lea rcx, str.RawInputListener:_Could_not_create_file_mapping_object.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov rdi, qword [rsp + 0x60]
add rsp, 0x50
pop rbx
ret
xor r9d, r9d
mov qword [rsp + 0x20], 0x400
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
jne 0x140024e1a
lea rcx, str.RawInputListener:_Could_not_map_view_of_file.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x50
pop rbx
ret
test rbx, rbx
je 0x140024dca
mov qword [rbx], rdi
mov rdi, qword [rsp + 0x60]
mov qword [rbx + 8], rax
add rsp, 0x50
pop rbx
ret
lea rcx, str.RawInputListener:_Could_not_create_security_descriptor.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add rsp, 0x50
pop rbx
ret

Function at 0x140024e50
Capabilities:
Create thread
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
lea r8, [0x140024eb0]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x140024e9f
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x140024e9c
lea rcx, str.RawInputListener:_could_not_elevate_listener_thread_priority...
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rax, rbx
add rsp, 0x30
pop rbx
ret