joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002f380
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x18003f390]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.18001797c
xor ebx, ebx
cmp qword [0x180041c38], rbx
mov rdi, rax
jne 0x18002f493
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x18002f56a
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18002f56a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180041c38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180041c40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x180041c48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x180041c58], rax
test rax, rax
je 0x18002f48a
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x180041c50], rax
jmp 0x18002f49a
mov rax, qword [0x180041c50]
jmp 0x18002f4a1
mov rax, qword [0x180041c50]
mov r11, qword [0x180041c58]
cmp rax, rdi
je 0x18002f508
cmp r11, rdi
je 0x18002f508
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x180041c58]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x18002f508
test rax, rax
je 0x18002f508
call rsi
test rax, rax
je 0x18002f502
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18002f502
test byte [rsp + 0x40], 1
jne 0x18002f508
bts ebp, 0x15
jmp 0x18002f548
mov rcx, qword [0x180041c40]
cmp rcx, rdi
je 0x18002f548
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18002f548
call rax
mov rbx, rax
test rax, rax
je 0x18002f548
mov rcx, qword [0x180041c48]
cmp rcx, rdi
je 0x18002f548
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18002f548
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180041c38]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18002f56a
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x18002f56c
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180014930
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140004350
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14000438a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14000438f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400043d8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140006390]
cmp byte [rcx + rax], 0
je 0x1400043d8
dec r8
sub rdx, 1
jne 0x1400043be
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140005538
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005582
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005582
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005582
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005582
cmp dword [rcx + 0x84], 0xe
jbe 0x140005582
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005584
xor al, al
add rsp, 0x28
ret
Function at 0x140001980
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400019ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400019ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400019ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400019ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1400019ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400019cc
xor al, al
add rsp, 0x28
ret

Function at 0x146792290
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14679229d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1467922ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x146792295
lea eax, [rcx + 1]
jmp 0x1467922bb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1467922ce
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1467922b4
sub eax, 3
jb 0x1467922ee
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14679233d
sar eax, 1
movsxd rbp, eax
jb 0x146792324
jmp 0x1467922fc
add ebx, ebx
jne 0x1467922fa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x146792324
inc ecx
add ebx, ebx
jne 0x14679230a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x146792324
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14679231d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14679230c
add ecx, 2
jmp 0x146792329
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.146792252
jmp 0x14679229d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x678e000]
mov eax, dword [rdi]
or eax, eax
je 0x14679239d
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x679249c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14679234d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x146792397
mov qword [rbx], rax
add rbx, 8
jmp 0x14679236d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1467923e1
cmp al, 0xef
ja 0x1467923c9
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1467923a9
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1467923b8
mov eax, dword [rdi]
add rdi, 4
jmp 0x1467923b8
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.146792460], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.146792460
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x146792450
sub rsp, 0xffffffffffffff80
jmp 0x140001125
Function at 0x140001040
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov edx, 0x47
lea rcx, [entry0]
mov al, byte [rcx + rdx]
xor al, 0xf2
add al, 0xda
xor al, 0x8c
mov byte [rcx + rdx], al
inc rdx
cmp rdx, 0x2d9
jl 0x140001068
sbb byte [rax - 0x4053a1cb], ch
jrcxz 0x1400010ff
xor byte [rbx + 0x19], 0xa4
movsb byte [rdi], byte [rsi]
loope 0x140001092
lea ebx, [rbx - 0x425956c1]
sbb cl, bl
sbb eax, 0xd2a51983
out 0x5a, eax
jno 0x1400010c4
invalid
test edx, esp
pop rbx
sti
sbb eax, 0x5ea81883
std
nop
wait
or dword [rcx - 0x26e7426c], ebp
sbb eax, 0x37a81853
out 0xe6, eax
jno 0x1400010c8
invalid
fprem1
mov ebx, dword [rbx - 0xd]
sbb eax, 0x1dd91873
invalid

Function at 0x18107c5f8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x18107c602
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x18107c62b
pop rbp
sub rbp, 0x33
sub rbp, 0x107c5f8
cmp edx, 1
je 0x18107c66e
ldmxcsr dword [rsp]
add rsp, 8
popfq
pop r15
pop r14
pop r13
pop r12
pop r11
pop r10
pop r9
pop r8
pop rdi
pop rsi
pop rbp
pop rbx
pop rdx
pop rcx
pop rax
xor rax, rax
ret
sub rsp, 0x20
jmp 0x18107c67e
mov rax, 0x107c5f8
add rax, rbp
add rax, 0xb8
mov rcx, 0x60b
mov rdx, 0x165bf76b
xor byte [rax], dl
inc rax
dec rcx
jne 0x18107c69d
jmp 0x18107c6b4
and esp, edx
invalid
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140005450]
mov dword [rax], 1
mov rax, qword [0x140005460]
mov dword [rax], 1
mov rax, qword [0x140005470]
mov dword [rax], 1
mov rax, qword [0x140005400]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x1400015e0
Capabilities:
Copy file

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rdx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x10]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
nop
add rsp, 0x20
pop rbp
ret
Function at 0x140001611
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push rbp
push rdi
sub rsp, 0x268
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x1dc], 0
lea rax, [rbp + 0xd0]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
mov dword [rbp + 0x1dc], eax
cmp dword [rbp + 0x1dc], 0
jne 0x140001663
mov eax, 0xffffffff
jmp 0x1400017f9
movabs rax, 0x73726573555c3a43
movabs rdx, 0x414e52455355255c
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
movabs rax, 0x447070415c25454d
movabs rdx, 0x6d616f525c617461
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
movabs rax, 0x7263694d5c676e69
movabs rdx, 0x69575c74666f736f
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
movabs rax, 0x74535c73776f646e
movabs rdx, 0x756e654d20747261
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
movabs rax, 0x6d6172676f72505c
movabs rdx, 0x7574726174535c73
mov qword [rbp], rax
mov qword [rbp + 8], rdx
movabs rax, 0x736f7263694d5c70
movabs rdx, 0x697672655374666f
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
movabs rax, 0x6578652e6563
mov edx, 0
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rdx
lea rdx, [rbp + 0x30]
mov eax, 0
mov ecx, 0x12
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rdx, [rbp - 0x40]
lea rax, [rbp + 0xd0]
mov rcx, rax
call dbg.copyToStartup
lea rax, [rbp - 0x48]
mov r8, rax
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
call rax
test eax, eax
je 0x14000177e
mov eax, 0xffffffff
jmp 0x1400017f9
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.strlen
add eax, 1
mov dword [rbp + 0x1d8], eax
mov rax, qword [rbp - 0x48]
mov edx, dword [rbp + 0x1d8]
mov dword [rsp + 0x28], edx
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.Microsoft_Service
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
test eax, eax
je 0x1400017e4
mov rax, qword [rbp - 0x48]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 0xffffffff
jmp 0x1400017f9
mov rax, qword [rbp - 0x48]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 0
add rsp, 0x268
pop rdi
pop rbp
ret

Function at 0x140001d00
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop
Function at 0x1400029d2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140008108]
test eax, eax
je 0x140002a6a
lea rax, [0x1400080e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140008110]
mov qword [rbp - 8], rax
jmp 0x140002a4e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140002a42
cmp qword [rbp - 0x10], 0
je 0x140002a42
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140002a08
lea rax, [0x1400080e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140002a6b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140002b70
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140002b98
mov eax, 0
jmp 0x140002be6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140002bc1
mov eax, 0
jmp 0x140002be6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140002be1
mov eax, 0
jmp 0x140002be6
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x140002bec
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140002c6a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140002c61
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140002c61
mov rax, qword [rbp - 8]
jmp 0x140002c7f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140002c34
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001480
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x14000a010]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
mov dword [rsp + 0x40], esi
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x58], 0x104
mov qword [rsp + 0x50], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
lea rdx, str.SoftwareOculus_VR__LLCOculus
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000153f
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov r9d, 0x20000002
lea r8, str.Base
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
lea rax, [rsp + 0x60]
mov r9, 0xffffffffffffffff
mov rbx, r9
nop dword [rax]
inc rbx
cmp byte [rax + rbx], sil
jne 0x140001560
movabs rbp, 0x7fffffffffffffff
cmp rbx, rbp
ja 0x1400016e3
mov qword [rdi + 0x18], 0xf
cmp rbx, 0x10
jae 0x1400015a7
mov qword [rdi + 0x10], rbx
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], sil
jmp 0x140001645
mov r8, qword [rdi + 0x18]
mov rcx, rbx
or rcx, 0xf
cmp rcx, rbp
ja 0x1400015d6
mov rdx, r8
shr rdx, 1
mov rax, rbp
sub rax, rdx
cmp r8, rax
ja 0x1400015d6
lea rax, [r8 + rdx]
mov rbp, rcx
cmp rcx, rax
cmovb rbp, rax
mov rcx, rbp
add rcx, 1
cmovb rcx, r9
cmp rcx, 0x1000
jb 0x140001619
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400016dd
mov rcx, rax
call fcn.140005b50
test rax, rax
je 0x140001612
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001626
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001626
call fcn.140005b50
mov rsi, rax
mov qword [rdi], rsi
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbp
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
mov dword [rsp + 0x40], 1
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x27
jb 0x140001694
lea rax, [rcx + 0x27]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x140001675
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, 0x27
lea rdx, str.Supportoculus_runtimeLibOVRRT64_1.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x27], 0
jmp 0x1400016b1
mov qword [rsp + 0x20], 0x27
lea r9, str.Supportoculus_runtimeLibOVRRT64_1.dll
mov edx, 0x27
mov rcx, rdi
call fcn.1400050d0
mov rax, rdi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140005b30
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1400011d0
int3
call fcn.140001270
int3
Function at 0x140005a20
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x78
mov rax, qword [0x14000a010]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x38]
mov dword [rsp + 0x30], 0x10
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140005afe
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x54], rax
mov r9d, 0x10
lea rax, [rsp + 0x30]
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rsp + 0x40]
mov dword [rsp + 0x5c], 0
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140005afe
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov r9d, dword [rsp + 0x30]
xor edx, edx
and dword [rsp + 0x4c], 0xfffffffd
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x44], rax
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140005b30
add rsp, 0x78
ret
xor al, al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140005b30
add rsp, 0x78
ret

Function at 0x14000663c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006686
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006686
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006686
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006686
cmp dword [rcx + 0x84], 0xe
jbe 0x140006686
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140006688
xor al, al
add rsp, 0x28
ret
Function at 0x14001132a
Capabilities:
Terminate process

Disassembly:
jmp 0x140016960
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400113fc
Capabilities:
Parse pe header

Disassembly:
jmp 0x140017cb0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140017cd0
xor al, al
jmp 0x140017d51
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140017ce3
xor al, al
jmp 0x140017d51
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140017d0d
xor al, al
jmp 0x140017d51
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140017d21
xor al, al
jmp 0x140017d51
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140017d33
xor al, al
jmp 0x140017d51
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140017d4f
xor al, al
jmp 0x140017d51
mov al, 1
add rsp, 0x38
ret