joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000cf50
Capabilities:
Check if file exists
Create directory
Delete directory
Get common file path
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x40
mov rax, qword [0x1400461e0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
lea rcx, [0x14004c4d0]
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, [0x14004bcd0]
mov r8d, 0x400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor esi, esi
lea rax, [rsp + 0x20]
mov dword [rsp + 0x20], 0x18
mov dword [rsp + 0x30], esi
test rax, rax
je 0x14000d0cb
lea r8, [rsp + 0x28]
lea edx, [rsi + 1]
lea rcx, str.D:_A_OICIID_FA___BA__A_OICIID_FA___SY__A_OICIID_0x1200a9___BU__D__ID__0x1301bf____AU__A__OICIIOID__SDGXGWGR____AU_
xor r9d, r9d
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
je 0x14000d0cb
lea edx, [rsi + 0x5c]
lea rcx, [0x14004bcd0]
mov qword [rsp + 0x50], rdi
call fcn.1400186f0
test rax, rax
je 0x14000cfea
mov word [rax], si
lea rdi, [0x14004ccd0]
lea r8, [0x14004c4d0]
mov edx, 0x400
mov rcx, rdi
call fcn.140017600
mov edx, 0x5c
mov rcx, rdi
call fcn.140018664
test rax, rax
je 0x14000d0a0
sub rax, rdi
sar rax, 1
inc eax
add rax, rax
cmp rax, 0x800
jae 0x14000d0c5
lea r8, str.Intel
mov edx, 0x400
mov rcx, rdi
mov word [rax + rdi], si
call fcn.140017578
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, str.GfxCPLBatchFiles
mov edx, 0x400
mov rcx, rdi
call fcn.140017578
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000d084
test al, 0x10
je 0x14000d084
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, 6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
call fcn.140010c30
mov rdi, qword [rsp + 0x50]
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140016790
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
ret
call fcn.140016e90
int3
mov ecx, 1
call fcn.140018658
int3

Function at 0x14000da00
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1400461e0]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
lea rax, [rsp + 0x58]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionControl_PanelCplsigfxcpl.cpl
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000da9f
mov dword [rsp + 0x58], ebx
lea r9d, [rbx + 4]
mov rbx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
lea rdx, str.RunLevel
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x14000da9f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140016790
add rsp, 0x70
pop rbx
ret
Function at 0x140010210
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xf0
mov rax, qword [0x1400461e0]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor eax, eax
xor ebx, ebx
lea rcx, [rsp + 0x78]
lea r8d, [rbx + 0x60]
xor edx, edx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.1400167c0
lea rax, [rsp + 0x50]
lea rdx, [0x14004abf0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400102af
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140016790
add rsp, 0xf0
pop rbx
ret
Function at 0x1400102d0
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x160
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1400461e0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov ebx, ecx
lea r8, [0x14004ccd0]
mov edx, 0x432
lea rcx, [0x14004dd40]
call fcn.140017600
lea r8, [0x140032bf0]
mov edx, 0x432
lea rcx, [0x14004dd40]
call fcn.140017578
lea rcx, [0x14004dd40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x140010344
lea rcx, [0x14004dd40]
call fcn.1400190d4
lea rcx, [0x14004dd40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140010598
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x40]
call fcn.1400167c0
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x3e]
lea rdx, [0x14004dd40]
lea rcx, [rsp + 0x40]
call fcn.14000cc90
nop
lea rdx, str._echo_off
lea rcx, [rsp + 0x40]
call fcn.14000c3c0
mov rcx, rax
call fcn.14000c890
cmp ebx, 1
jne 0x1400103eb
lea rdx, str.sc_stop_igfxCUIService1.0.0.0
lea rcx, [rsp + 0x40]
call fcn.14000c3c0
mov rcx, rax
call fcn.14000c890
lea rdx, str.TIMEOUT_1__NOBREAK
lea rcx, [rsp + 0x40]
call fcn.14000c3c0
mov rcx, rax
call fcn.14000c890
lea rdx, str.sc_delete_igfxCUIService1.0.0.0
jmp 0x1400104c3
cmp ebx, 2
jne 0x1400104d5
lea rdx, str.sc_stop_igfxCUIService2.0.0.0
lea rcx, [rsp + 0x40]
call fcn.14000c3c0
mov rcx, rax
call fcn.14000c890
lea rdx, str.TIMEOUT_1__NOBREAK
lea rcx, [rsp + 0x40]
call fcn.14000c3c0
mov rcx, rax
call fcn.14000c890
lea rdx, str.sc_delete_igfxCUIService2.0.0.0
lea rcx, [rsp + 0x40]
call fcn.14000c3c0
mov rcx, rax
call fcn.14000c890
lea rdx, str.TIMEOUT_5__NOBREAK
lea rcx, [rsp + 0x40]
call fcn.14000c3c0
mov rcx, rax
call fcn.14000c890
lea rdx, [0x140032e64]
lea rcx, [rsp + 0x40]
call fcn.14000c3c0
mov rcx, rax
lea rdx, [0x14004bcd0]
call fcn.14000c3c0
mov rcx, rax
lea rdx, [0x140032860]
call fcn.14000c3c0
mov rcx, rax
lea rdx, [0x140032e68]
call fcn.14000c3c0
mov rcx, rax
lea rdx, [0x140032e64]
call fcn.14000c3c0
mov rcx, rax
lea rdx, str.__service
call fcn.14000bfd0
mov rcx, rax
call fcn.14000c890
lea rdx, str.sc_start_igfxCUIService1.0.0.0
lea rcx, [rsp + 0x40]
call fcn.14000c3c0
mov rcx, rax
call fcn.14000c890
lea rdx, [0x140032f28]
lea rcx, [rsp + 0x40]
call fcn.14000c3c0
mov rcx, rax
lea rdx, [0x140032e64]
call fcn.14000c3c0
mov rcx, rax
lea rdx, [0x14004ccd0]
call fcn.14000c3c0
mov rcx, rax
lea rdx, [0x140032860]
call fcn.14000c3c0
mov rcx, rax
lea rdx, str.8A694AF2_286D_429D_867A_3F95898EE308.bat
call fcn.14000c3c0
mov rcx, rax
lea rdx, [0x140032e64]
call fcn.14000c3c0
mov rcx, rax
call fcn.14000c890
lea rcx, [rsp + 0x48]
call fcn.140012030
test rax, rax
jne 0x14001056f
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rcx, [rsp + rcx + 0x40]
mov edx, dword [rcx + 0x10]
or edx, 2
cmp qword [rcx + 0x48], 0
jne 0x140010566
or edx, 4
xor r8d, r8d
call fcn.140011f40
nop
lea rcx, [rsp + 0xe8]
call fcn.14000d550
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0xe8], rax
lea rcx, [rsp + 0xe8]
call fcn.14002bb3c
mov al, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140016790
add rsp, 0x160
pop rbx
ret
Function at 0x1400109c0
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x48
xor eax, eax
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionControl_PanelCpls
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov r9d, 0xf003f
mov rdx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x30], rax
call fcn.1400063a0
test eax, eax
jne 0x140010ac0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rbx
test rcx, rcx
je 0x140010a2e
mov rbx, qword [rsp + 0x20]
lea r8, str.igfxcpl.cpl
mov rdx, rbx
call fcn.140007c10
jmp 0x140010aa6
cmp byte [0x14004a320], 0
jne 0x140010a79
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140010a69
lea rdx, [0x140031090]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x14004a320], 1
mov qword [0x14004a318], rax
jmp 0x140010a80
mov rax, qword [0x14004a318]
mov byte [0x14004a320], 1
jmp 0x140010a80
mov rax, qword [0x14004a318]
mov rbx, qword [rsp + 0x20]
lea rdx, str.igfxcpl.cpl
mov rcx, rbx
test rax, rax
je 0x140010aa0
mov r8d, dword [rsp + 0x28]
xor r9d, r9d
call rax
jmp 0x140010aa6
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test rbx, rbx
je 0x140010ab4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140010ad0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add rsp, 0x48
ret

Function at 0x140010ae0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xf0
mov rax, qword [0x1400461e0]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor eax, eax
xor ebx, ebx
lea rcx, [rsp + 0x78]
lea r8d, [rbx + 0x60]
xor edx, edx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.1400167c0
lea rax, [rsp + 0x50]
lea rdx, [0x14004b460]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140010b7f
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140016790
add rsp, 0xf0
pop rbx
ret

Function at 0x140010ba0
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x8a0
mov rax, qword [0x1400461e0]
xor rax, rsp
mov qword [rsp + 0x890], rax
mov rbx, rcx
lea r8, [0x14004c4d0]
lea rcx, [rsp + 0x20]
mov edx, 0x432
call fcn.140017600
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x432
call fcn.140017578
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x140010c07
lea rcx, [rsp + 0x20]
call fcn.1400190d4
mov eax, 1
jmp 0x140010c09
xor eax, eax
mov rcx, qword [rsp + 0x890]
xor rcx, rsp
call fcn.140016790
add rsp, 0x8a0
pop rbx
ret
Function at 0x140010c30
Capabilities:
Check if file exists

Disassembly:
push rbp
lea rbp, [rsp - 0x7a0]
sub rsp, 0x8a0
mov rax, qword [0x1400461e0]
xor rax, rsp
mov qword [rbp + 0x790], rax
lea r8, [0x14004c4d0]
lea rcx, [rsp + 0x20]
mov edx, 0x432
call fcn.140017600
lea r8, [0x140033930]
lea rcx, [rsp + 0x20]
mov edx, 0x432
call fcn.140017578
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x140010c98
lea rcx, [rsp + 0x20]
call fcn.1400190d4
lea r8, [0x14004c4d0]
lea rcx, [rsp + 0x20]
mov edx, 0x432
call fcn.140017600
lea r8, [0x140033590]
lea rcx, [rsp + 0x20]
mov edx, 0x432
call fcn.140017578
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x140010cde
lea rcx, [rsp + 0x20]
call fcn.1400190d4
lea r8, [0x14004c4d0]
lea rcx, [rsp + 0x20]
mov edx, 0x432
call fcn.140017600
lea r8, [0x140033870]
lea rcx, [rsp + 0x20]
mov edx, 0x432
call fcn.140017578
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x140010d24
lea rcx, [rsp + 0x20]
call fcn.1400190d4
lea r8, [0x14004c4d0]
lea rcx, [rsp + 0x20]
mov edx, 0x432
call fcn.140017600
lea r8, [0x140033990]
lea rcx, [rsp + 0x20]
mov edx, 0x432
call fcn.140017578
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x140010d6a
lea rcx, [rsp + 0x20]
call fcn.1400190d4
lea r8, [0x14004c4d0]
lea rcx, [rsp + 0x20]
mov edx, 0x432
call fcn.140017600
lea r8, [0x140033110]
lea rcx, [rsp + 0x20]
mov edx, 0x432
call fcn.140017578
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x140010db0
lea rcx, [rsp + 0x20]
call fcn.1400190d4
lea r8, [0x14004c4d0]
lea rcx, [rsp + 0x20]
mov edx, 0x432
call fcn.140017600
lea r8, [0x140032bf0]
lea rcx, [rsp + 0x20]
mov edx, 0x432
call fcn.140017578
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x140010df6
lea rcx, [rsp + 0x20]
call fcn.1400190d4
lea r8, [0x14004c4d0]
lea rcx, [rsp + 0x20]
mov edx, 0x432
call fcn.140017600
lea r8, [0x140033780]
lea rcx, [rsp + 0x20]
mov edx, 0x432
call fcn.140017578
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x140010e3c
lea rcx, [rsp + 0x20]
call fcn.1400190d4
mov rcx, qword [rbp + 0x790]
xor rcx, rsp
call fcn.140016790
add rsp, 0x8a0
pop rbp
ret
Function at 0x140010f30
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xf0
mov rax, qword [0x1400461e0]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor eax, eax
xor ebx, ebx
lea rcx, [rsp + 0x78]
lea r8d, [rbx + 0x60]
xor edx, edx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.1400167c0
lea rax, [rsp + 0x50]
lea rdx, [0x14004d4d0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140010fcf
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140016790
add rsp, 0xf0
pop rbx
ret

Function at 0x140011120
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400461e0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rcx
cmp qword [rcx + 0x78], 0
je 0x140011285
cmp byte [rcx + 0x82], 0
je 0x140011285
mov rax, qword [rcx]
mov ebx, 0xffff
mov edx, ebx
call qword [rax + 0x18]
cmp bx, ax
jne 0x14001117b
xor al, al
jmp 0x140011287
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x40], 0
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rsp + 0x40]
call fcn.140011ba0
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x40]
cmovae r8, qword [rsp + 0x40]
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
mov r9, qword [rsp + 0x50]
add r9, rdx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x84]
call qword [r10 + 0x40]
test eax, eax
je 0x1400111ee
dec eax
jne 0x140011263
jmp 0x1400111f5
mov byte [rdi + 0x82], 0
lea rax, [rsp + 0x40]
mov r9, qword [rsp + 0x40]
mov r10, qword [rsp + 0x58]
cmp r10, 0x10
cmovae rax, r9
mov rbx, qword [rsp + 0x38]
sub rbx, rax
je 0x14001123c
lea rcx, [rsp + 0x40]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rdi + 0x90]
mov r8, rbx
mov edx, 1
call fcn.140019824
cmp rbx, rax
jne 0x140011268
cmp byte [rdi + 0x82], 0
je 0x14001126c
test rbx, rbx
jne 0x1400111a4
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rsp + 0x40]
call fcn.140011a80
jmp 0x1400111a4
sub eax, 2
je 0x14001126c
xor bl, bl
jmp 0x14001126e
mov bl, 1
cmp qword [rsp + 0x58], 0x10
jb 0x140011280
mov rcx, qword [rsp + 0x40]
call fcn.140015c6c
movzx eax, bl
jmp 0x140011287
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140016790
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140012d60
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rsp + 0xd0], rbx
mov rax, qword [0x1400461e0]
xor rax, rsp
mov qword [rbp + 0x27], rax
movzx r14d, dx
mov rbx, rcx
mov esi, 0xffff
cmp si, dx
jne 0x140012daa
xor eax, eax
jmp 0x140012f78
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140012de7
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x140012de7
lea ecx, [r9 - 1]
mov dword [rax], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], r14w
movzx eax, r14w
jmp 0x140012f78
cmp qword [rcx + 0x90], 0
je 0x140012f75
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x80]
cmp qword [r8], rax
jne 0x140012e23
mov rdx, qword [rcx + 0x70]
mov rcx, qword [rcx + 0x68]
mov qword [r8], rcx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
sub rdx, rcx
sar rdx, 1
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp qword [rbx + 0x78], 0
jne 0x140012e4c
mov rdx, qword [rbx + 0x90]
movzx ecx, r14w
call fcn.140018e04
cmp ax, si
je 0x140012f75
movzx esi, r14w
jmp 0x140012f75
mov word [rbp - 1], r14w
mov qword [rbp + 0x1f], 0xf
xor eax, eax
mov qword [rbp + 0x17], rax
mov byte [rbp + 7], al
xor r8d, r8d
lea edx, [rax + 8]
lea rcx, [rbp + 7]
call fcn.140011ba0
nop
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rdx, qword [rbp + 7]
lea r8, [rbp + 7]
cmovae r8, qword [rbp + 7]
mov rcx, qword [rbx + 0x78]
mov r10, qword [rcx]
add rdx, qword [rbp + 0x17]
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 1]
lea r8, [rbp - 1]
lea rdx, [rbx + 0x84]
call qword [r10 + 0x38]
test eax, eax
js 0x140012f65
cmp eax, 1
jg 0x140012f47
lea rax, [rbp + 7]
mov r9, qword [rbp + 7]
mov r10, qword [rbp + 0x1f]
cmp r10, 0x10
cmovae rax, r9
mov rdi, qword [rbp - 9]
sub rdi, rax
je 0x140012f12
lea rcx, [rbp + 7]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rbx + 0x90]
mov r8, rdi
mov edx, 1
call fcn.140019824
cmp rdi, rax
jne 0x140012f65
mov byte [rbx + 0x82], 1
lea rax, [rbp - 1]
cmp qword [rbp - 0x11], rax
jne 0x140012f61
test rdi, rdi
jne 0x140012e72
cmp qword [rbp + 0x17], 0x20
jae 0x140012f65
xor r8d, r8d
lea edx, [rdi + 8]
lea rcx, [rbp + 7]
call fcn.140011a80
jmp 0x140012e72
cmp eax, 3
jne 0x140012f65
mov rdx, qword [rbx + 0x90]
movzx ecx, word [rbp - 1]
call fcn.140018e04
cmp ax, si
je 0x140012f65
movzx esi, r14w
cmp qword [rbp + 0x1f], 0x10
jb 0x140012f75
mov rcx, qword [rbp + 7]
call fcn.140015c6c
movzx eax, si
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140016790
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140014e00
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400461e0]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
mov rbx, rcx
mov rsi, rdx
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov dword [rsp + 0x38], eax
lea r8, str.SOFTWAREIntelDisplayigfxcuiMISC
lea rcx, [r11 - 0x38]
mov r9d, 0x2001f
mov rdx, 0xffffffff80000002
mov qword [r11 - 0x28], rax
xor dil, dil
call fcn.1400063a0
test eax, eax
jne 0x140014ea8
mov rdx, rbx
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test rbx, rbx
je 0x140014ea3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dil, 1
jmp 0x140014ead
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x140014ebb
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, dil
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140016790
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140015500
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400461e0]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
mov rbx, rcx
mov esi, edx
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov dword [rsp + 0x38], eax
lea r8, str.SOFTWAREIntelDisplayigfxcuiMISC
lea rcx, [r11 - 0x38]
mov r9d, 0x2001f
mov rdx, 0xffffffff80000002
mov qword [r11 - 0x28], rax
xor dil, dil
call fcn.1400063a0
test eax, eax
jne 0x1400155a7
mov rdx, rbx
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
mov r9d, 4
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x1400155a2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dil, 1
jmp 0x1400155ac
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1400155ba
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, dil
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140016790
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400157a0
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rax, qword [0x1400461e0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edi, r8d
lea rdx, str.Received_Post_Shell_Event__ld_n
lea rcx, [0x140049000]
call fcn.1400060b0
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x40], rsi
mov r9d, 0x2001f
lea r8, str.SOFTWAREIntelDisplayigfxcuiMISC
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x30]
call fcn.1400063a0
mov rbx, qword [rsp + 0x30]
test eax, eax
jne 0x140015870
mov dword [rsp + 0x50], 2
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 4]
xor r8d, r8d
lea rdx, str.InstallStage
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x14001586c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, esi
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], esi
call fcn.14000fcb0
xor edx, edx
mov ecx, edi
call fcn.14000fcc0
mov byte [0x14004ee48], 1
test rbx, rbx
je 0x140015893
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140016790
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x140018658
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400184c0

Function at 0x1400190d4
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400190ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400190ec
xor eax, eax
test eax, eax
je 0x1400190fc
mov ecx, eax
call fcn.14001b8dc
or eax, 0xffffffff
jmp 0x1400190fe
xor eax, eax
add rsp, 0x28
ret
Function at 0x140001290
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x14016f560
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x20]
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1405dc580]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rcx, [0x1405e90f0]
call fcn.140019ec0
lea rcx, [0x1405e3ed0]
call qword [sym.imp.ntdll.dll_RtlInitializeSListHead]
mov r8d, 0x200
mov edx, 0xd0
lea rcx, [0x1405e3ee0]
call sym.ProcessHacker.exe_PhInitializeFreeList
mov r8d, 0x40
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400139e0
lea rax, [rsp + 0x30]
mov qword [0x1405e3eb0], rax
mov eax, 8
imul rax, rax, 0
lea rcx, [0x1405e8740]
lea rdx, [rsp + 0x30]
mov qword [rcx + rax], rdx
xor r8d, r8d
xor edx, edx
lea rcx, str.Type
call sym.ProcessHacker.exe_PhCreateObjectType
mov qword [0x1405e3eb0], rax
mov rax, qword [0x1405e3eb0]
movzx eax, byte [rax + 2]
mov rcx, qword [0x1405e3eb0]
mov word [rcx - 0xa0], ax
mov rax, qword [0x1405e3eb0]
mov dword [rax + 4], 1
xor r8d, r8d
xor edx, edx
lea rcx, str.Alloc
call sym.ProcessHacker.exe_PhCreateObjectType
mov qword [0x1405e3eb8], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1405e3f04], eax
cmp dword [0x1405e3f04], 0xffffffff
jne 0x14016f663
xor al, al
jmp 0x14016f665
mov al, 1
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1404dbeb0]
call fcn.140015750
mov rax, rdi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000d430
add rsp, 0x90
pop rdi
ret