joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012d30
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1400710e0]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor edi, edi
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
cmp qword [rcx + 0x10], rdi
jne 0x140012da4
mov rax, qword [rcx + 8]
mov qword [r11 - 0x38], rdi
lea rdx, [r11 - 0x20]
mov dword [rsp + 0x38], edi
add rcx, 8
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 0x84000000
mov qword [r11 - 0x58], rdx
lea r9, str.ChangeNotify
lea rdx, str.WavesNotifications
xor r8d, r8d
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x18], rdi
call qword [rax + VariantCopy]
mov qword [rbx + 0xdc0], rbp
mov qword [rbx + 0xdc8], rsi
cmp qword [rbx + 0xdb8], rdi
jne 0x140012deb
lea rax, [rsp + 0x50]
lea r8, [0x14000e450]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0xdb8], rax
cmp rax, rdi
setne al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140023ca0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400132d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, r9
test edx, edx
jns 0x1400132e3
mov edx, dword [rcx + 0xda8]
test r8d, r8d
jns 0x1400132ef
mov r8d, dword [rcx + 0xdac]
xor r9d, r9d
call fcn.140013b20
test rbx, rbx
je 0x140013350
test rax, rax
je 0x140013350
xor ecx, ecx
lea r9, [rsp + 0x58]
lea rdx, str.Type
mov dword [rbx], ecx
mov dword [rsp + 0x48], ecx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax + 8]
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140013348
mov eax, dword [rsp + 0x48]
mov dword [rbx], eax
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x140013700
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x158
mov rax, qword [0x1400710e0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov esi, dword [rsp + 0x1b0]
mov edi, dword [rsp + 0x1b8]
mov r13d, r9d
mov r12, r8
mov ebp, edx
mov rbx, rcx
call fcn.140010350
test esi, esi
jns 0x14001374a
mov esi, dword [rbx + 0xda8]
test edi, edi
jns 0x140013754
mov edi, dword [rbx + 0xdac]
xor r9d, r9d
mov r8d, edi
mov edx, esi
mov rcx, rbx
call fcn.140013b20
mov rbx, rax
test rax, rax
je 0x1400137a7
lea rdx, str.Property_u
lea rcx, [rsp + 0x30]
mov r8d, ebp
call fcn.14000c2c0
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x30]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140023ca0
add rsp, 0x158
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400137d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x160
mov rax, qword [0x1400710e0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rsi, qword [rsp + 0x1b0]
mov ebp, dword [rsp + 0x1b8]
mov edi, dword [rsp + 0x1c0]
mov r12, r8
mov r13d, edx
mov rbx, rcx
call fcn.140010350
test ebp, ebp
jns 0x140013823
mov ebp, dword [rbx + 0xda8]
test edi, edi
jns 0x14001382d
mov edi, dword [rbx + 0xdac]
xor r9d, r9d
mov r8d, edi
mov edx, ebp
mov rcx, rbx
call fcn.140013b20
mov rbx, rax
test rax, rax
je 0x1400138d9
lea rdx, str.Property_u
lea rcx, [rsp + 0x40]
mov r8d, r13d
call fcn.14000c2c0
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x30]
xor edi, edi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x30], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r11d, dword [rsp + 0x30]
test r11d, r11d
je 0x1400138d9
test r12, r12
je 0x1400138cd
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete dil
test edi, edi
je 0x1400138d9
mov r11d, dword [rsp + 0x30]
test rsi, rsi
je 0x1400138d5
mov dword [rsi], r11d
mov al, 1
jmp 0x1400138db
xor al, al
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140023ca0
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x160
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140013910
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x80], rbp
mov ebx, r8d
mov r12, rdx
mov rbp, rcx
xor sil, sil
test rdx, rdx
je 0x1400139f7
call fcn.140010350
test ebx, ebx
jns 0x140013953
mov ebx, dword [rbp + 0xda8]
xor edi, edi
mov dword [rsp + 0x78], edi
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov r8d, ebx
lea rdx, str.SoundModeOnOutput_d
lea rcx, [rsp + 0x38]
call fcn.140016a40
mov dword [rsp + 0x88], 4
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
mov rcx, qword [rbp + 0xc18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete dil
test edi, edi
je 0x1400139db
mov eax, dword [rsp + 0x78]
mov dword [r12], eax
mov sil, 1
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400139f7
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rVariantCopy + 8]
movzx eax, sil
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret
Function at 0x140013a20
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov ebx, r8d
mov esi, edx
mov rdi, rcx
xor bpl, bpl
call fcn.140010350
test ebx, ebx
jns 0x140013a50
mov ebx, dword [rdi + 0xda8]
mov rcx, rdi
call fcn.140013ce0
lea rcx, [rdi + 0xcb8]
xor r9d, r9d
mov r8d, esi
mov edx, ebx
call fcn.14001c2a0
test rax, rax
je 0x140013b07
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
mov r8d, ebx
lea rdx, str.SoundModeOnOutput_d
lea rcx, [rsp + 0x60]
call fcn.140016a40
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, qword [rdi + 0xc18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
movzx edi, bpl
mov ecx, 1
test eax, eax
cmove edi, ecx
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140013b01
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rVariantCopy + 8]
movzx eax, dil
jmp 0x140013b0b
movzx eax, bpl
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001a540
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rbx, rcx
xor esi, esi
mov dword [rsp + 0x80], esi
lea rdx, [0x14005bb8c]
call fcn.140009120
mov edi, 1
mov dword [rsp + 0x80], edi
mov qword [rsp + 0x30], rsi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001a69f
mov dword [rsp + 0x78], esi
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str.CurrentBuildNumber
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [rsp + 0x78]
test edx, edx
je 0x14001a694
jns 0x14001a5f8
mov ecx, 0x80070057
call fcn.1400050a0
int3
mov rax, qword [rbx]
sub edi, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edx
or eax, edi
jge 0x14001a60f
mov rcx, rbx
call fcn.140009710
mov rbp, qword [rbx]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str.CurrentBuildNumber
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x14001a65b
mov eax, dword [rsp + 0x78]
dec eax
mov byte [rax + rbp], 0
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001a672
movsxd rdx, dword [rcx - 0xc]
call fcn.1400259d4
mov esi, eax
test eax, eax
js 0x14001a689
mov rax, qword [rbx]
cmp esi, dword [rax - 0xc]
jg 0x14001a689
mov dword [rax - 0x10], esi
movsxd rcx, esi
mov rax, qword [rbx]
mov byte [rcx + rax], 0
jmp 0x14001a694
mov ecx, 0x80070057
call fcn.1400050a0
int3
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14001a6b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
xor eax, eax
lea rdx, str.SOFTWAREWaves_AudioMaxxAudioGeneral
mov r9d, 0x20019
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14001a72c
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x50]
lea rdx, str.MaxxAudioOptions
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x14001fda0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [0x1400710e0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
mov r8d, edx
lea rdx, str.Param_u
lea rcx, [rsp + 0x38]
movapd xmm6, xmm2
call fcn.14001de80
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x30]
movsd qword [rsp + 0x30], xmm6
lea rdx, [rsp + 0x38]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140023ca0
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
ret

Function at 0x14001fe30
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400710e0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbp, r8
mov esi, edx
mov rdi, rcx
mov r8d, edx
lea rcx, [rsp + 0x38]
lea rdx, str.Param_u
xor ebx, ebx
call fcn.14001de80
mov rcx, qword [rdi + 8]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rsp + 0x30], 8
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001fea0
lea eax, [rbx + 1]
jmp 0x14001feba
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14001feb8
mov r8, rbp
mov edx, esi
call fcn.14001ae20
test al, al
setne bl
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140023ca0
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x14001fee0
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400710e0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, r8
mov rsi, rcx
mov r8d, edx
lea rdx, str.Chunk_u
lea rcx, [rsp + 0x30]
mov edi, r9d
call fcn.14001de80
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x30]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140023ca0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x14001ff60
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x90
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1400710e0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, r9
mov r12, r8
mov ebp, edx
mov rdi, rcx
xor ebx, ebx
test r9, r9
je 0x140020062
mov r8d, edx
lea rdx, str.Chunk_u
lea rcx, [rsp + 0x60]
call fcn.14001de80
mov dword [rsi], ebx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [rsi], ebx
je 0x14002000b
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, ebx
test eax, eax
sete cl
test ecx, ecx
je 0x14002000b
lea eax, [rbx + 1]
jmp 0x140020064
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x140020062
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
lea r8, [rsp + 0x38]
mov edx, ebp
call fcn.14001aea0
mov rdi, qword [rsp + 0x38]
test al, al
je 0x140020055
mov eax, dword [rsp + 0x40]
sub eax, edi
mov ebx, eax
mov r8d, eax
mov rdx, rdi
mov rcx, r12
call fcn.140023e70
mov dword [rsi], ebx
mov ebx, 1
test rdi, rdi
je 0x140020062
mov rcx, rdi
call fcn.140023c7c
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140023ca0
add rsp, 0x90
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140020090
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x38
ret
Function at 0x1400203c0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
cmp qword [rcx + 0x918], 0
mov r12d, r9d
mov rdi, r8
mov r13d, edx
mov rsi, rcx
je 0x1400204d6
mov r10, qword [rcx + 0x920]
test r10, r10
je 0x1400204d6
mov ecx, dword [r8]
dec ecx
je 0x1400204bb
dec ecx
je 0x1400204a1
dec ecx
je 0x140020466
dec ecx
jne 0x1400204d6
xor ebx, ebx
cmp dword [r8 + 8], ebx
jbe 0x1400204d6
lea rbp, [r8 + 0x10]
mov rcx, qword [rsi + 0x920]
test rcx, rcx
je 0x140020459
mov r9, qword [rsi + 0xa50]
test r9, r9
je 0x140020459
mov edx, dword [rbp]
mov eax, ebx
add rax, rax
lea r8, [rdi + rax*8 + 0x18]
call r9
inc ebx
add rbp, 0x10
cmp ebx, dword [rdi + 8]
jb 0x140020431
jmp 0x1400204d6
xor ebx, ebx
cmp dword [r8 + 8], ebx
jbe 0x1400204d6
lea rbp, [r8 + 0x10]
mov rcx, qword [rsi + 0x920]
test rcx, rcx
je 0x140020494
mov rax, qword [rsi + 0xa48]
test rax, rax
je 0x140020494
mov edx, dword [rbp]
movsd xmm2, qword [rbp + 8]
call rax
inc ebx
add rbp, 0x10
cmp ebx, dword [rdi + 8]
jb 0x140020472
jmp 0x1400204d6
mov rax, qword [rsi + 0xa50]
test rax, rax
je 0x1400204d6
mov edx, dword [rdi + 8]
add r8, 0x10
mov rcx, r10
call rax
jmp 0x1400204d6
mov rax, qword [rsi + 0xa48]
test rax, rax
je 0x1400204d6
mov edx, dword [r8 + 8]
movsd xmm2, qword [r8 + 0x10]
mov rcx, r10
call rax
mov r9d, r12d
mov r8, rdi
mov edx, r13d
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
jmp 0x140057ac0
Function at 0x140024e48
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140024cb8

Function at 0x140026d57
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400710e0]
jne 0x140023cba
rol rcx, 0x10
test cx, 0xffff
jne 0x140023cb6
repz ret
ror rcx, 0x10
jmp 0x140026cb0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140073840]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140073938]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140026d35
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140073840]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140026d57
mov rax, qword [rsp + 0x88]
mov qword [0x140073938], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400738d8], rax
mov rax, qword [0x140073938]
mov qword [0x1400737b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400738c0], rax
mov dword [0x1400737a0], 0xc0000409
mov dword [0x1400737a4], 1
mov rax, qword [0x1400710e0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400710e8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140073838], eax
mov ecx, 1
call fcn.14002febc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140059790]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140073838], 0
jne 0x140026dde
mov ecx, 1
call fcn.14002febc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140030d4c
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1400710e0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1400298d4
xor ebx, ebx
cmp qword [0x1400748a8], rbx
mov rdi, rax
jne 0x140030e5f
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140030f36
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140030f36
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1400748a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1400748b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1400748b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1400748c8], rax
test rax, rax
je 0x140030e56
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1400748c0], rax
jmp 0x140030e66
mov rax, qword [0x1400748c0]
jmp 0x140030e6d
mov rax, qword [0x1400748c0]
mov r11, qword [0x1400748c8]
cmp rax, rdi
je 0x140030ed4
cmp r11, rdi
je 0x140030ed4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1400748c8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140030ed4
test rax, rax
je 0x140030ed4
call rsi
test rax, rax
je 0x140030ece
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140030ece
test byte [rsp + 0x40], 1
jne 0x140030ed4
bts ebp, 0x15
jmp 0x140030f14
mov rcx, qword [0x1400748b0]
cmp rcx, rdi
je 0x140030f14
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140030f14
call rax
mov rbx, rax
test rax, rax
je 0x140030f14
mov rcx, qword [0x1400748b8]
cmp rcx, rdi
je 0x140030f14
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140030f14
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400748a8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140030f36
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140030f38
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140023ca0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002a6dc
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
xor ebx, ebx
mov qword [rbp - 0x10], rbx
mov edx, 0x104
lea rcx, [rbp - 0x20]
call fcn.140036b80
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
sub rdx, rcx
sar rdx, 1
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
mov r8d, eax
test eax, eax
je 0x14002a795
mov rcx, qword [rbp - 0x18]
mov rax, rcx
mov rdx, qword [rbp - 0x20]
sub rax, rdx
sar rax, 1
cmp r8, rax
jbe 0x14002a775
mov edx, r8d
lea rcx, [rbp - 0x20]
call fcn.140036b80
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
sub rdx, rcx
sar rdx, 1
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
mov r8d, eax
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x20]
test r8d, r8d
je 0x14002a795
sub rcx, rdx
sar rcx, 1
mov eax, r8d
cmp rax, rcx
ja 0x14002a795
mov rcx, rdi
call fcn.140003904
nop
mov bl, 1
jmp 0x14002a795
lea rcx, [rbp - 0x20]
call fcn.14001e804
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x14006470c
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rbx, rdx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
xor esi, esi
mov qword [rbp - 0x10], rsi
mov dword [rbp + 0x30], esi
lea r8, [rbp + 0x30]
xor edx, edx
lea ecx, [rsi + 3]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
nop dword [rax + rax]
test eax, eax
je 0x140064754
lea edi, [rsi + 0xd]
jmp 0x14006480f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
cmp eax, 0xea
jne 0x14006480f
mov word [rbp + 0x20], si
mov edx, dword [rbp + 0x30]
mov r8, qword [rbp - 0x18]
mov rcx, r8
mov rdi, qword [rbp - 0x20]
sub rcx, rdi
sar rcx, 1
cmp rdx, rcx
jae 0x140064794
lea rax, [rdi + rdx*2]
mov qword [rbp - 0x18], rax
jmp 0x1400647d5
jbe 0x1400647d5
mov rax, qword [rbp - 0x10]
sub rax, rdi
sar rax, 1
cmp rdx, rax
jbe 0x1400647b8
lea r8, [rbp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.140040dd4
mov rdi, qword [rbp - 0x20]
jmp 0x1400647d5
sub rdx, rcx
je 0x1400647d1
movzx eax, si
mov rdi, r8
mov rcx, rdx
rep stosw word [rdi], ax
lea r8, [r8 + rdx*2]
mov rdi, qword [rbp - 0x20]
mov qword [rbp - 0x18], r8
lea r8, [rbp + 0x30]
mov rdx, rdi
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
nop dword [rax + rax]
test eax, eax
jne 0x140064801
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
jmp 0x14006480f
mov rdx, qword [rbp - 0x20]
mov rcx, rbx
call fcn.140003904
mov edi, esi
lea rcx, [rbp - 0x20]
call fcn.14001e804
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x140065270
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400b1340], eax
call fcn.140065710
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400b1340], 0
jne case.default.0x1400652c6
mov ecx, 1
call fcn.140065710
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]