joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d8b9630
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d8b9640
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d8b9650
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d8b9691
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d8b9688
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d8b9693
add rax, 0x28
cmp rax, r9
jne 0x6d8b9674
xor eax, eax
ret

Function at 0x6d8b9730
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8d61f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d8b979d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8b979d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8b979d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8b9794
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8b979f
add rax, 0x28
cmp rax, r9
jne 0x6d8b9780
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d8b98a0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8d61f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d8b98c0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8b98b8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8b991d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8b9914
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8b9924
add rax, 0x28
cmp rax, r9
jne 0x6d8b9900
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d8b9940
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d8d61f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d8b99ae
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8b99ae
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d8b99ae
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d8b99ae
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d8b99a5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d8b99b5
add rcx, 0x28
cmp rcx, rax
jne 0x6d8b9990
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d8b99c8
jmp 0x6d8b99ae
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d8b99d6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d8b99ae
test r9d, r9d
jg 0x6d8b99c0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d8b9d40
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x14000194c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001996
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001996
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001996
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001996
cmp dword [rcx + 0x84], 0xe
jbe 0x140001996
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001998
xor al, al
add rsp, 0x28
ret
Function at 0x4017a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x00407054]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x4018ba
mov rax, qword [0x00407058]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x4017ee
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x4018a0
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x4017d2
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x4018f2
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x00407058]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x00407058]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4018d5
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x401899
sub eax, 0x40
and eax, 0xffffffbf
je 0x401899
mov r9, rbp
add r9, qword [0x00407058]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4018c1
add dword [0x00407054], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebp, ebp
jmp 0x4017fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x00407058]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call dbg.__report_error
nop
nop word cs:[rax + rax]

Function at 0x4024d0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x4024e0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x4024f0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402531
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x402528
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x402533
add rax, 0x28
cmp rax, r9
jne 0x402514
xor eax, eax
repz ret

Function at 0x4025e0
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x00404300]
cmp word [rbx], 0x5a4d
je 0x402600
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call sym._ValidateImageBase.part.0
test eax, eax
je 0x4025f4
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp dbg._FindPESection
Function at 0x140002690
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002723
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000271a
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140002704
add rax, 2
test ecx, ecx
jne 0x1400026f0
mov rcx, rbx
test edx, edx
je 0x140002746
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400026e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140003a60
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140002725
Function at 0x140004514
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000455e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000455e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000455e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000455e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000455e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004560
xor al, al
add rsp, 0x28
ret
Function at 0x14001a95c
Capabilities:
Hide graphical window

Disassembly:
mov r11, rsp
sub rsp, 0x68
and qword [r11 - 0x10], 0
mov rax, qword [0x1400e44b8]
lea rdx, str.348326_v3
mov qword [r11 - 0x18], rax
and qword [r11 - 0x20], 0
and qword [r11 - 0x28], 0
mov eax, 0x80000000
mov dword [rsp + 0x38], 0x64
mov dword [rsp + 0x30], 0x12c
mov dword [rsp + 0x28], eax
mov r9d, 0xcf0000
mov r8, rdx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
and qword [rsp + 0x58], 0
mov rcx, qword [0x1400e44b8]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x40], rax
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [0x1400ab2e0]
mov r9d, 0x50b008c4
xor r8d, r8d
xor ecx, ecx
mov qword [0x1400e4510], rax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, qword [0x1400e4510]
xor edx, edx
mov qword [0x1400e4508], rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400e4510]
xor edx, edx
add rsp, 0x68
jmp qword [sym.imp.USER32.dll_ShowWindow]
Function at 0x14001ab60
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x1ff70]
mov eax, 0x20070
call fcn.140038c40
sub rsp, rax
lea rcx, [rsp + 0x50]
mov rsi, rdx
call fcn.14001e640
lea rdx, [rsp + 0x70]
xor bl, bl
mov ecx, 0x7fff
mov byte [rbp + 0x1ffa0], bl
xor dil, dil
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea r8, [rbp + 0x1ffb0]
mov rdx, rsi
call fcn.14001a624
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14004f0da
mov eax, dword [0x1400e4570]
test eax, eax
je 0x14001acf2
mov r15d, 1
lea rcx, [0x1400e6320]
cmp eax, r15d
je 0x14004f0fc
lea rax, [rbp + 0x1ffa0]
lea r8, [0x1400e4570]
lea rdx, [0x1400e4598]
mov qword [rsp + 0x20], rax
call fcn.14001cb64
test al, al
je 0x14001acfb
mov al, byte [0x1400e6320]
mov rcx, qword [0x1400e4598]
mov dil, byte [0x1400e6321]
lea r9, [rbp + 0x1ffb8]
lea r8, [rbp + 0xff70]
mov edx, 0x7fff
mov byte [0x1400e4574], al
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov rdx, qword [rbp + 0x1ffb8]
lea rcx, [0x1400e4550]
call fcn.14001edf8
mov bl, byte [rbp + 0x1ffa0]
mov r8d, dword [0x1400e4570]
lea rdx, [0x1400e4598]
call fcn.14000bdc0
test eax, eax
jne 0x14004f120
cmp dil, r15b
je 0x14004f143
call fcn.14001aa30
call fcn.14001a95c
cmp byte [0x1400e4574], 0
jne 0x14001ac9f
lea rcx, [0x1400e4f50]
call fcn.14000175c
lea rcx, [0x1400e45c0]
mov edx, r15d
call fcn.14000bea0
cmp byte [0x1400e4574], 0
jne 0x14001acc3
lea rcx, [0x1400e4f50]
call fcn.1400018ac
lea rcx, [0x1400e6320]
call fcn.14001cbfc
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [rsp + 0x50]
call fcn.14001c29c
add rsp, 0x20070
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
or dword [0x1400e44c0], 0xffffffff
jmp 0x14001accf
mov dword [0x1400e44c0], r15d
jmp 0x14001accf
lea r8, [0x1400cf2a4]
lea rdx, str.This_is_a_third_party_compiled_348326_script.
mov r9d, reloc.WSOCK32.dll_recv
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
jmp 0x14001acda
mov r8, qword [0x1400e4578]
or r9d, 0xffffffff
mov edx, r15d
call fcn.14001cab8
mov al, byte [0x1400e44c8]
mov byte [0x1400e6322], al
jmp 0x14001ac5c
lea rcx, [0x1400e6320]
call fcn.14001cbfc
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x1400e44c0], r15d
jmp 0x14001acda
call fcn.1400749b0
test al, al
jne 0x14001ac80
cmp byte [rbp + 0x1ffb0], al
jne 0x14001ac80
lea rcx, [rsp + 0x50]
call fcn.14001a3c8
lea rdx, [0x1400cb8a0]
lea rcx, [rsp + 0x30]
call fcn.14001f0bc
lea rcx, [rsp + 0x30]
test bl, bl
je 0x14004f1ab
lea rdx, [0x1400cf2d8]
call fcn.14001ef20
lea rdx, [0x1400e4598]
lea rcx, [rsp + 0x30]
call fcn.14001ec60
lea rdx, [0x1400cf2d8]
lea rcx, [rsp + 0x30]
jmp 0x14004f1ae
mov rdx, rsi
call fcn.14001ef20
mov rbx, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x70]
lea rdx, str.runas
mov r9, rbx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x30]
call fcn.14001c29c
nop
jmp 0x14001acc3
Function at 0x140002860
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
lea rax, vtable.IPCService.0
mov rbx, rcx
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
xor ebp, ebp
mov dword [rbx + 0x40], 0xffffffff
lea rdx, [rsp + 0x30]
mov qword [rbx + 0x48], rbp
lea rcx, [rsp + 0x48]
mov qword [rbx + 0x50], rbp
mov esi, eax
mov dword [rbx + 0x44], ebp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
mov dword [rbx + 0x20], ebp
call fcn.140007870
lea rcx, [rbx + 0x38]
mov dword [rbx + 0x58], ebp
lea rdx, str.GlobalEEU_Memory_Map_Mutex
call fcn.1400092d0
test eax, eax
jne 0x1400028fe
mov rcx, qword [0x140086ce0]
test rcx, rcx
je 0x140002a14
lea r9, str.CreateMutex_failed.
mov edx, 0x60004008
mov r8d, 1
call fcn.140006660
jmp 0x140002a14
xor r9d, r9d
lea rax, str.GlobalEEU_Memory_Map
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
xor ecx, ecx
mov dword [rsp + 0x20], 0x17c
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rbx + 0x28], rax
test rax, rax
jne 0x140002948
mov rcx, qword [0x140086ce0]
test rcx, rcx
je 0x140002a14
lea r9, str.CreateFileMapping_failed.
jmp 0x1400028e9
xor r9d, r9d
mov qword [rsp + 0x20], 0x17c
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x140002989
mov rcx, qword [0x140086ce0]
test rcx, rcx
je 0x140002a14
lea r9, str.MapViewOfFile_failed.
jmp 0x1400028e9
xor edx, edx
mov r8d, 0x17c
mov rcx, rax
call fcn.14000d320
mov rax, qword [rbx + 0x30]
mov edx, esi
mov rcx, rbx
mov dword [rax], 8
call fcn.140003040
lea rdx, [rsp + 0x80]
lea rcx, str.ClientStatusMonitoring
call fcn.140007100
test eax, eax
je 0x140002a0d
cmp dword [rsp + 0x80], ebp
je 0x140002a0d
mov r9, rbx
lea r8, [0x140003710]
mov edx, 8
lea rcx, [rbx + 0x50]
call fcn.140009450
test eax, eax
jne 0x140002a0d
mov rcx, qword [0x140086ce0]
test rcx, rcx
je 0x140002a14
lea r9, str.CreateTheThread_for_GetClientStatusThread_failed.
mov edx, 0x60004002
lea r8d, [rax + 1]
call fcn.140006660
jmp 0x140002a14
mov dword [rbx + 0x48], 1
lea r11, [rsp + 0x70]
mov rax, rbx
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400034d0
Capabilities:
Get session information

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x260
cmp dword [rcx + 0x58], 0
mov rbx, rcx
jne 0x1400036f9
mov qword [rax + 0x18], rbp
xor ebp, ebp
mov qword [rax - 0x10], rsi
mov qword [rax - 0x18], rdi
nop word [rax + rax]
mov edx, 0x3a98
lea rcx, [0x140086cf0]
call fcn.140009430
cmp eax, 0x102
jne 0x1400036e1
cmp dword [rbx + 0x58], ebp
jne 0x1400036e1
cmp dword [rbx + 0x40], 0xffffffff
je 0x1400036d8
cmp dword [rbx + 0x4c], ebp
je 0x14000353c
mov dword [rbx + 0x4c], ebp
jmp 0x1400036d8
lea rcx, [rbx + 0x38]
call fcn.140009290
test eax, eax
jne 0x140003573
mov rcx, qword [0x140086ce0]
test rcx, rcx
je 0x1400036d8
lea r9, str.IPCService::GetClientStatusLoop_AcquireTheMutex_failed.
mov edx, 0x60004008
lea r8d, [rax + 1]
call fcn.140006660
jmp 0x1400036d8
mov rdx, qword [rbx + 0x30]
lea rcx, [rbx + 0x38]
mov edi, dword [rdx + 4]
mov eax, edi
and eax, 0xfffffffe
mov dword [rdx + 4], eax
call fcn.140009350
test dil, 5
jne 0x1400036d8
mov edx, dword [rbx + 0x40]
lea rax, [rsp + 0x270]
lea r9, [rsp + 0x278]
mov qword [rsp + 0x20], rax
mov r8d, 8
mov qword [rsp + 0x278], rbp
xor ecx, ecx
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x1400036d8
mov rcx, qword [rsp + 0x278]
cmp dword [rcx], 2
jb 0x1400035e1
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x1400036d8
call sub.WTSAPI32.dll_WTSFreeMemory
mov edi, dword [rbx + 0x40]
lea r8, str.GlobalAMDClient
mov r9d, edi
lea rdx, str._s__u
lea rcx, [rsp + 0x30]
call fcn.140002800
mov r9d, edi
lea r8, str.GlobalAMDClientAck
lea rdx, str._s__u
lea rcx, [rsp + 0x140]
call fcn.140002800
mov rcx, qword [rbx + 8]
lea rdi, [rdi*8]
add rcx, rdi
lea rdx, [rsp + 0x30]
xor r8d, r8d
call fcn.140009370
test eax, eax
je 0x1400036ae
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x140]
add rcx, rdi
xor r8d, r8d
call fcn.140009370
test eax, eax
je 0x1400036ae
mov ecx, dword [rbx + 0x40]
call fcn.140004bc0
mov rcx, qword [0x140086ce0]
test eax, eax
je 0x14000368c
test rcx, rcx
je 0x1400036d8
mov r9d, dword [rbx + 0x40]
lea r8, str.Client_started_for_session_id__u__because_status_was_not_running_
mov edx, 4
call fcn.140006880
jmp 0x1400036d8
test rcx, rcx
je 0x1400036d8
mov eax, dword [rbx + 0x40]
lea r9, str.Client_for_session_id__u_has_to_be_relaunched.
xor r8d, r8d
mov dword [rsp + 0x20], eax
mov edx, 0x40004003
call fcn.140006660
jmp 0x1400036d8
mov rcx, qword [0x140086ce0]
test rcx, rcx
je 0x1400036d8
mov eax, dword [rbx + 0x40]
lea r9, str.Create_client_event_failed_for_session_id_u.
mov edx, 0x60004003
mov dword [rsp + 0x20], eax
mov r8d, 1
call fcn.140006660
cmp dword [rbx + 0x58], ebp
je 0x140003500
mov rsi, qword [rsp + 0x258]
mov rdi, qword [rsp + 0x250]
mov rbp, qword [rsp + 0x280]
add rsp, 0x260
pop rbx
ret
Function at 0x140003cd0
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push rbx
sub rsp, 0x250
mov ebx, ecx
call fcn.140004060
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call fcn.14000d320
xor edx, edx
lea rcx, [rsp + 0x140]
mov r8d, 0x104
call fcn.14000d320
mov r8d, 0x104
lea rdx, [rsp + 0x140]
lea rcx, str.COMMONPROGRAMFILES
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140003d83
lea rax, str.ATI_TechnologiesDSEManager.exe
mov qword [rsp + 0x28], 0
lea r9, [rsp + 0x140]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.14003febc
test eax, eax
jne 0x140003d6e
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140003d83
cmp eax, 0x10
je 0x140003d83
lea rdx, [rsp + 0x30]
mov ecx, ebx
call fcn.140003da0
add rsp, 0x250
pop rbx
ret
lea rcx, str.Unable_to_create_path_for_DSE_Manager._n
call fcn.140004360
add rsp, 0x250
pop rbx
ret
Function at 0x140004060
Capabilities:
Check if file exists
Enumerate processes
Query environment variable
Terminate process

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0x4b8]
sub rsp, 0x5b8
xor edx, edx
lea rcx, [rbp + 0x190]
mov r8d, 0x104
call fcn.14000d320
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.14000d320
mov r8d, 0x104
lea rdx, [rsp + 0x50]
lea rcx, str.COMMONPROGRAMFILES
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1400042f1
lea rax, str.ATI_TechnologiesDSEManager.exe
xor r14d, r14d
mov qword [rsp + 0x28], r14
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rbp + 0x190]
call fcn.14003febc
test eax, eax
jne 0x140004109
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400042f1
cmp eax, 0x10
je 0x1400042f1
xor edx, edx
mov qword [rsp + 0x5e0], rsi
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140004143
lea rcx, str.Unable_to_get_snapshot_of_all_processes._n
call fcn.140004360
mov rsi, qword [rsp + 0x5e0]
add rsp, 0x5b8
pop r14
pop rbp
ret
mov qword [rsp + 0x5b0], rdi
mov edi, r14d
mov qword [rsp + 0x5d8], rbx
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x64]
mov r8d, 0x12c
call fcn.14000d320
mov dword [rbp + 0x60], 0x130
test edi, edi
jne 0x14000418a
lea rdx, [rbp + 0x60]
mov rcx, rsi
call sub.KERNEL32.dll_Process32First
jmp 0x140004198
jle 0x1400041a0
lea rdx, [rbp + 0x60]
mov rcx, rsi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x1400042c5
xor edx, edx
lea rcx, [rbp + 0x2a0]
mov r8d, 0x100
call fcn.14000d320
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x100
call fcn.14000d320
mov qword [rsp + 0x40], 0x100
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rcx, [rbp + 0x8c]
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x30], 0x100
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
call fcn.140040edc
test eax, eax
jne 0x1400042be
lea rdx, str.DSEManager
lea rcx, [rbp + 0x2a0]
call fcn.14003f908
test eax, eax
jne 0x1400042be
lea rdx, str..exe
lea rcx, [rsp + 0x50]
call fcn.14003f908
test eax, eax
jne 0x1400042be
mov r8d, dword [rbp + 0x68]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400042be
xor edx, edx
lea rcx, [rbp + 0x3a0]
mov r8d, 0x104
call fcn.14000d320
lea r9, [rbp + 0x4d0]
mov dword [rbp + 0x4d0], 0x104
lea r8, [rbp + 0x3a0]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
test eax, eax
je 0x1400042b5
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x3a0]
call fcn.14003f908
test eax, eax
jne 0x1400042b5
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
jmp 0x140004160
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x5b0]
mov rbx, qword [rsp + 0x5d8]
mov rsi, qword [rsp + 0x5e0]
add rsp, 0x5b8
pop r14
pop rbp
ret
lea rcx, str.Unable_to_create_path_for_DSE_Manager._n
call fcn.140004360
add rsp, 0x5b8
pop r14
pop rbp
ret