joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001a15f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1800393f8]
jne 0x18001834a
rol rcx, 0x10
test cx, 0xffff
jne 0x180018346
repz ret
ror rcx, 0x10
jmp 0x18001a0b8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18003ac10]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x18003ad08]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18001a13d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18003ac10]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18001a15f
mov rax, qword [rsp + 0x88]
mov qword [0x18003ad08], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18003aca8], rax
mov rax, qword [0x18003ad08]
mov qword [0x18003ab80], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18003ac90], rax
mov dword [0x18003ab70], 0xc0000409
mov dword [0x18003ab74], 1
mov rax, qword [0x1800393f8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180039400]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18003ac08], eax
mov ecx, 1
call fcn.1800215b8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18002c740]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18003ac08], 0
jne 0x18001a1e6
mov ecx, 1
call fcn.1800215b8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x18001b5d4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x18001b448
Function at 0x180021ff8
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.18001c7a4
xor ebx, ebx
mov rdi, rax
cmp qword [0x18003b948], rbx
jne 0x1800220fe
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1800221d3
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800221d3
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18003b948], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18003b950], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x18003b958], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x18003b968], rax
test rax, rax
je 0x1800220f5
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x18003b960], rax
jmp 0x180022105
mov rax, qword [0x18003b960]
jmp 0x18002210c
mov rax, qword [0x18003b960]
mov r11, qword [0x18003b968]
cmp rax, rdi
je 0x180022174
cmp r11, rdi
je 0x180022174
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x18003b968]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x180022174
test rax, rax
je 0x180022174
call rsi
test rax, rax
je 0x18002216e
lea rcx, [rsp + 0x88]
mov r9d, reloc.WS2_32.dll_inet_ntoa
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18002216e
test byte [rsp + 0x38], 1
jne 0x180022174
bts ebp, 0x15
jmp 0x1800221b2
mov rcx, qword [0x18003b950]
cmp rcx, rdi
je 0x1800221b2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800221b2
call rax
mov rbx, rax
test rax, rax
je 0x1800221b2
mov rcx, qword [0x18003b958]
cmp rcx, rdi
je 0x1800221b2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800221b2
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18003b948]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800221d3
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1800221d5
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400292ab
Capabilities:
Set thread local storage value

Disassembly:
push rax
pushf
mov eax, 0x71fd688f
pushf
not eax
add eax, 0x94f50bdc
xor eax, 0xd5b3b305
rol eax, 0x71
popf
pushf
not eax
add eax, 0x8877be06
xor eax, 0xa54e5fd8
rol eax, 0xf6
popf
pushf
not eax
add eax, 0xc3fcef50
xor eax, 0xb757b300
rol eax, 0x24
popf
pushf
not eax
add eax, 0xaf01fb74
xor eax, 0xd142ecc1
rol eax, 0xd4
popf
cmp eax, 2
jne 0x14002930e
popf
pop rax
jmp 0x14002947c
cmp eax, 0
jne 0x14002931d
popf
pop rax
jmp 0x14002933b
cmp eax, 3
jne 0x14002932c
popf
pop rax
jmp 0x1400294c8
cmp eax, 1
jne 0x14002933b
popf
pop rax
jmp 0x140029473
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x18b767bcf]
pushf
sub r9, 0x4b75395f
popf
mov edi, ecx
lea rdx, [0x1bbf0071a]
pushf
sub rdx, 0x7beec4aa
popf
mov ecx, 0x2ac086b0
pushf
not ecx
add ecx, 0x9a80088a
xor ecx, 0xb6f18801
rol ecx, 0xcd
popf
pushf
not ecx
add ecx, 0x8e401669
xor ecx, 0xc981cfa4
rol ecx, 0xc
popf
pushf
not ecx
add ecx, 0xe9b6225c
xor ecx, 0x966c7215
rol ecx, 0x9f
popf
lea r8, [0x1b1dfdb29]
pushf
sub r8, 0x71de98c1
popf
call fcn.1400042a4
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x14002942c
push rax
pushf
mov eax, 0x9634d08
pushf
not eax
add eax, 0xc8b7bf68
xor eax, 0xda954242
rol eax, 0x42
popf
pushf
not eax
add eax, 0xf0ab5e71
xor eax, 0xf4de3f7e
rol eax, 0x80
popf
pushf
not eax
add eax, 0xb8d52012
xor eax, 0xd955f0db
rol eax, 0x4f
popf
pushf
not eax
add eax, 0x80517633
xor eax, 0xb8a58d2e
rol eax, 0xa8
popf
jmp 0x1400292ff
push rax
pushf
mov eax, 0x2845e5c8
pushf
not eax
add eax, 0xa5241445
xor eax, 0xf7eade75
rol eax, 0x34
popf
pushf
not eax
add eax, 0x81dded32
xor eax, 0xcb7b555e
rol eax, 0x88
popf
pushf
not eax
add eax, 0xfa4bf771
xor eax, 0xbfdf3b26
rol eax, 0xe7
popf
jmp 0x1400292ff
call qword [0x1400132a8]
jmp 0x1400294c8
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
push rax
pushf
mov eax, 0xad0b5ffc
pushf
not eax
add eax, 0xfcc47e76
xor eax, 0x888026c4
rol eax, 0x58
popf
pushf
not eax
add eax, 0x9e85e823
xor eax, 0xb45a9298
rol eax, 0x8f
popf
pushf
not eax
add eax, 0xaac34e81
xor eax, 0x8c8a3c0e
rol eax, 0x75
popf
jmp 0x1400292ff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140039553
Capabilities:
Get thread local storage value

Disassembly:
push rax
pushf
mov eax, 0xd25e4a37
pushf
not eax
add eax, 0xbf116ada
xor eax, 0x87de4c1c
rol eax, 0x68
popf
pushf
not eax
add eax, 0xbe6cc91c
xor eax, 0xe0c30f1f
rol eax, 0x96
popf
pushf
not eax
add eax, 0xcc13ceae
xor eax, 0x93714296
rol eax, 0x15
popf
pushf
not eax
add eax, 0xccc9f11e
xor eax, 0xdd6b865a
rol eax, 0xe7
popf
cmp eax, 2
jne 0x1400395b6
popf
pop rax
jmp 0x1400396fa
cmp eax, 0
jne 0x1400395c5
popf
pop rax
jmp 0x1400395d4
cmp eax, 1
jne 0x1400395d4
popf
pop rax
jmp 0x1400396ee
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x185377a9e]
pushf
sub r9, 0x45363846
popf
mov ecx, 0x8ceb9f70
pushf
not ecx
add ecx, 0xdd5d7514
xor ecx, 0xc83dcc20
rol ecx, 0x44
popf
pushf
not ecx
add ecx, 0xecc6ba95
xor ecx, 0xc8276271
rol ecx, 0x88
popf
pushf
not ecx
add ecx, 0xf81ed6a9
xor ecx, 0xd5de8c08
rol ecx, 0x94
popf
lea r8, [0x1a6c9e3b7]
pushf
sub r8, 0x66c8a167
popf
lea rdx, [0x191f7559a]
pushf
sub rdx, 0x51f61342
popf
call fcn.1400042a4
mov ecx, ebx
test rax, rax
je 0x140039695
push rax
pushf
mov eax, 0xdfd3aff7
pushf
not eax
add eax, 0xc74a6698
xor eax, 0xc266dfdf
rol eax, 0x94
popf
pushf
not eax
add eax, 0x8c66e7d6
xor eax, 0xf57496cf
rol eax, 0x68
popf
jmp 0x1400395a7
push rax
pushf
mov eax, 0xb8259479
pushf
not eax
add eax, 0xe253632c
xor eax, 0x8d733625
rol eax, 0xb0
popf
pushf
not eax
add eax, 0xc89b7048
xor eax, 0xea2235b5
rol eax, 0xe9
popf
pushf
not eax
add eax, 0xfb67d891
xor eax, 0xa38ebacc
rol eax, 0xcb
popf
pushf
not eax
add eax, 0xf22c458b
xor eax, 0xd545c4e3
rol eax, 0xad
popf
jmp 0x1400395a7
add rsp, 0x20
pop rbx
jmp qword [0x1400132a8]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x14003d165
Capabilities:
Allocate thread local storage

Disassembly:
push rax
pushf
mov eax, 0xe6c34eca
pushf
not eax
add eax, 0xf28a7819
xor eax, 0xadbdfac0
rol eax, 0x71
popf
pushf
not eax
add eax, 0x8e866abc
xor eax, 0xc3dac085
rol eax, 0x51
popf
pushf
not eax
add eax, 0xe3d441ca
xor eax, 0xe197e257
rol eax, 0x85
popf
pushf
not eax
add eax, 0xbcbbdf4f
xor eax, 0xa1789895
rol eax, 0x27
popf
cmp eax, 2
jne 0x14003d1c8
popf
pop rax
jmp 0x14003d2df
cmp eax, 0
jne 0x14003d1d7
popf
pop rax
jmp 0x14003d1e6
cmp eax, 1
jne 0x14003d1e6
popf
pop rax
jmp 0x14003d2d0
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1bcbf1d33]
pushf
sub r9, 0x7cbddb03
popf
xor ecx, ecx
lea r8, [0x18f28345d]
pushf
sub r8, 0x4f26f235
popf
lea rdx, [0x185b5db35]
pushf
sub rdx, 0x45b49905
popf
call fcn.1400042a4
test rax, rax
je 0x14003d28a
push rax
pushf
mov eax, 0x8614438d
pushf
not eax
add eax, 0x86f9191f
xor eax, 0xa79be6e3
rol eax, 0xd5
popf
pushf
not eax
add eax, 0xadcfb39b
xor eax, 0xc37171ed
rol eax, 5
popf
pushf
not eax
add eax, 0xba8b2104
xor eax, 0xf01d933d
rol eax, 0x53
popf
pushf
not eax
add eax, 0xd571c4fc
xor eax, 0x9ca37cb1
rol eax, 0x48
popf
jmp 0x14003d1b9
push rax
pushf
mov eax, 0xfcab53a6
pushf
not eax
add eax, 0xa5003a53
xor eax, 0x98510616
rol eax, 0xd4
popf
pushf
not eax
add eax, 0xf691734d
xor eax, 0x8360d4ed
rol eax, 0xc5
popf
pushf
not eax
add eax, 0xd5e73349
xor eax, 0xa412f2db
rol eax, 0x72
popf
jmp 0x14003d1b9
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x1400132a8]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x14004b97a
Capabilities:
Terminate process

Disassembly:
push rax
pushf
mov eax, 0x3218e1f4
pushf
not eax
add eax, 0xc9f05b74
xor eax, 0xf790d518
rol eax, 0x1a
popf
pushf
not eax
add eax, 0x974033c1
xor eax, 0x9be1e177
rol eax, 0x65
popf
pushf
not eax
add eax, 0xd6b426df
xor eax, 0xa24da7d8
rol eax, 0x98
popf
pushf
not eax
add eax, 0xfc6a64b5
xor eax, 0xf241cc84
rol eax, 0x6e
popf
cmp eax, 2
jne 0x14004b9dd
popf
pop rax
jmp 0x14004ba98
cmp eax, 0
jne 0x14004b9ec
popf
pop rax
jmp 0x14004b9fb
cmp eax, 1
jne 0x14004b9fb
popf
pop rax
jmp 0x14004ba86
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.1400631e9
test al, al
je 0x14004ba52
push rax
pushf
mov eax, 0xf123684d
pushf
not eax
add eax, 0xa5664148
xor eax, 0xafe13ff2
rol eax, 0x85
popf
pushf
not eax
add eax, 0xe713fd59
xor eax, 0xd3351575
rol eax, 0xb1
popf
pushf
not eax
add eax, 0xd0a9ff29
xor eax, 0xbe689be4
rol eax, 0xd3
popf
jmp 0x14004b9ce
push rax
pushf
mov eax, 0xcc7a58e7
pushf
not eax
add eax, 0xac4b87aa
xor eax, 0xa801f05a
rol eax, 0x2c
popf
pushf
not eax
add eax, 0xab595b55
xor eax, 0x9d6f93d7
rol eax, 0x73
popf
jmp 0x14004b9ce
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
jmp 0x14004ba92
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.140046c1e
mov ecx, ebx
jmp 0x14004baa2
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x14008fe17
Capabilities:
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0x95d4c2a
pushf
not eax
add eax, 0xb271521e
xor eax, 0xd305acf0
rol eax, 0xf
popf
pushf
not eax
add eax, 0xd95a5e61
xor eax, 0x814d1e0d
rol eax, 0xad
popf
pushf
not eax
add eax, 0xa4168531
xor eax, 0xec2bd47e
rol eax, 0x20
popf
cmp eax, 4
jne 0x14008fe67
popf
pop rax
jmp 0x14009003b
cmp eax, 0
jne 0x14008fe76
popf
pop rax
jmp 0x14008feb2
cmp eax, 3
jne 0x14008fe85
popf
pop rax
jmp 0x14008ffd4
cmp eax, 1
jne 0x14008fe94
popf
pop rax
jmp 0x14008ff3b
cmp eax, 5
jne 0x14008fea3
popf
pop rax
jmp 0x14009009d
cmp eax, 2
jne 0x14008feb2
popf
pop rax
jmp 0x14008ffcf
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x30
mov rdi, r9
mov ecx, dword [rdx]
call fcn.14002d45c
nop
lea rbx, [0x19b2ea60f]
pushf
sub rbx, 0x5b2cb9a7
popf
lea rsi, [0x18bf0a3f9]
pushf
sub rsi, 0x4beeccf9
popf
push rax
pushf
mov eax, 0xf7111536
pushf
not eax
add eax, 0xe0c720ed
xor eax, 0xf6579590
rol eax, 0xb9
popf
pushf
not eax
add eax, 0xdb59819a
xor eax, 0x8f9418ef
rol eax, 0xe3
popf
pushf
not eax
add eax, 0xd063932f
xor eax, 0xcbf6599e
rol eax, 0x16
popf
jmp 0x14008fe58
mov qword [rsp + 0x20], rbx
lea rax, [0x18c9d4f0b]
pushf
sub rax, 0x4c9b629b
popf
cmp rbx, rax
je 0x14008ff89
push rax
pushf
mov eax, 0xb0c5d0f1
pushf
not eax
add eax, 0x93cb1915
xor eax, 0xd31706a3
rol eax, 0x5d
popf
pushf
not eax
add eax, 0xf6d86893
xor eax, 0xf0c61ec2
rol eax, 0xed
popf
jmp 0x14008fe58
push rax
pushf
mov eax, 0x895ea301
pushf
not eax
add eax, 0xc3a5d68b
xor eax, 0xbc190a5a
rol eax, 0xde
popf
pushf
not eax
add eax, 0x9be4e6a9
xor eax, 0xce63a8c5
rol eax, 0xd
popf
pushf
not eax
add eax, 0xb84f0b2c
xor eax, 0xda3adca6
rol eax, 0x4f
popf
jmp 0x14008fe58
cmp qword [rbx], rsi
je 0x14009003b
mov rdx, rsi
mov rcx, rbx
call fcn.140053ed4
mov qword [rbx], rax
push rax
pushf
mov eax, 0xfa6f08db
pushf
not eax
add eax, 0xeb54e584
xor eax, 0xeffdad04
rol eax, 0x44
popf
pushf
not eax
add eax, 0xe92ed5bb
xor eax, 0xcf636b69
rol eax, 0xa1
popf
pushf
not eax
add eax, 0xf8446a7e
xor eax, 0xa6b9b2be
rol eax, 0xea
popf
pushf
not eax
add eax, 0xf25775dc
xor eax, 0xe45fe95b
rol eax, 0x8d
popf
jmp 0x14008fe58
add rbx, 8
jmp 0x14008ff3b
mov ecx, dword [rdi]
call fcn.140080624
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140003380
Capabilities:
Create pipe
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rbx, rcx
xor ebp, ebp
mov qword [rcx], rbp
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], rbp
mov qword [rcx + 0x20], rbp
lea ecx, [rbp + 0x10]
call qword [sym.imp.MSVCR110.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
test rax, rax
jne 0x1400033d1
call qword [sym.imp.MSVCP110.dll_void___cdecl_std::_Xbad_alloc_void_]
int3
mov qword [rbx], rax
mov qword [rax], rbp
mov qword [rax + 8], rbp
mov rax, qword [rbx]
mov qword [rax], rbx
lea r15, [rbx + 0xb0]
lea rax, [0x1400035e0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400035c0]
mov edx, 0x50
lea r8d, [rdx - 0x40]
mov rcx, r15
call fcn.1400cc360
nop
mov eax, ebp
xchg dword [rbx + 0x5b8], eax
lea r8, [0x1400e1128]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rbx + 0x28], rax
test rax, rax
jne 0x140003447
lea r8d, [rax + 0x23]
lea rdx, str.src_namedpipeserver.cpp
lea rcx, str.mutex___nullptr
call qword [sym.imp.MSVCR110.dll__wassert]
mov esi, ebp
lea r14, [rbx + 0x30]
lea rdi, [rbx + 0xe0]
nop word [rax + rax]
xor eax, eax
mov qword [rdi - 0x28], rax
mov qword [rdi - 0x20], rax
mov qword [rdi - 0x18], rax
mov qword [rdi - 0x10], rax
xor r9d, r9d
mov edx, 1
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [r14], rax
test rax, rax
jne 0x1400034a5
lea r8d, [rax + 0x2b]
lea rdx, str.src_namedpipeserver.cpp
lea rcx, str.events_i____nullptr
call qword [sym.imp.MSVCR110.dll__wassert]
mov rax, qword [r14]
mov qword [r15 + 0x20], rax
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], 0x3e8
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], ebp
mov r9d, 0x10
xor r8d, r8d
mov edx, 0x40000001
lea rcx, str..pipe_steelseriessentryoverlay
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov qword [r15], rax
cmp rax, 0xffffffffffffffff
jne 0x140003501
lea r8d, [rax + 0x30]
lea rdx, str.src_namedpipeserver.cpp
lea rcx, str.pipes_i_.pipe___INVALID_HANDLE_VALUE
call qword [sym.imp.MSVCR110.dll__wassert]
mov edx, 0x400
mov rcx, rdi
call fcn.140004860
mov edx, esi
mov rcx, rbx
call fcn.1400036e0
inc esi
add rdi, 0x50
add r14, 8
add r15, 0x50
cmp esi, 0x10
jl 0x140003460
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
mov r9, rbx
lea r8, [0x140003370]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x5b0], rax
test rax, rax
jne 0x140003571
lea r8d, [rax + 0x37]
lea rdx, str.src_namedpipeserver.cpp
lea rcx, str.thread___nullptr
call qword [sym.imp.MSVCR110.dll__wassert]
nop
mov rax, rbx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14000a9b0
Capabilities:
Get process image filename

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x170
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x1a8], rbx
mov rax, qword [0x1400fde48]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, r8
mov rsi, rdx
mov r14, rcx
mov r8d, 0x104
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameA]
test eax, eax
je 0x14000aacc
mov qword [rsp + 0x40], 0xf
xor edi, edi
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x28], dil
mov r8d, eax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.140002640
nop
or rbx, 0xffffffffffffffff
cmp byte [rsi], dil
je 0x14000aa49
mov rdi, rbx
nop dword [rax + rax]
inc rdi
cmp byte [rsi + rdi], 0
jne 0x14000aa40
mov r9, rdi
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.140005100
test rax, rax
je 0x14000aa62
xor bl, bl
jmp 0x14000aab4
inc rbx
cmp byte [rsi + rbx], 0
jne 0x14000aa62
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.140002aa0
cmp qword [r14 + 0x18], 0x10
jb 0x14000aa84
mov r14, qword [r14]
lea rbx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rbx, qword [rsp + 0x28]
mov edx, 0x5c
mov rcx, r14
call qword [sym.imp.MSVCR110.dll_strchr]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.MSVCR110.dll__stricmp]
test eax, eax
sete bl
cmp qword [rsp + 0x40], 0x10
jb 0x14000aac7
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_]
movzx eax, bl
jmp 0x14000aace
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400cc100
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x170
pop r14
pop rdi
pop rsi
ret

Function at 0x14000ac10
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400fde48]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x20]
lea rcx, [0x14000aba0]
mov qword [rsp + 0x28], 0
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x14000ac61
or eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400cc100
add rsp, 0x48
ret
mov qword [0x1401018f0], rax
call fcn.14000ae90
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400cc100
add rsp, 0x48
ret
Function at 0x14000ac90
Capabilities:
Enumerate process modules
Get disk information

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x1400fde48]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
lea rcx, [0x1400fdfc8]
or r14, 0xffffffffffffffff
cmp rcx, rdi
je 0x14000accf
mov r9, r14
xor r8d, r8d
mov rdx, rdi
call fcn.1400028a0
mov rsi, qword [rdi + 0x10]
mov qword [0x1401018f0], 0
test rsi, rsi
jne 0x14000acea
xor eax, eax
jmp 0x14000ae6f
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x1ff
mov qword [rsp + 0x278], rbx
mov byte [rsp + 0x40], 0
mov ebx, 0x64
call sub.MSVCR110.dll_memset
xor eax, eax
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x29], rax
mov byte [rsp + 0x31], al
mov eax, 9
cmp rsi, rax
cmova rsi, rax
cmp qword [rdi + 0x18], 0x10
jb 0x14000ad36
mov rdx, qword [rdi]
jmp 0x14000ad39
mov rdx, rdi
lea rcx, [rsp + 0x28]
mov r8, rsi
call fcn.140040a50
lea rcx, [rsp + 0x28]
mov edx, 0x5c
call qword [sym.imp.MSVCR110.dll_strchr]
test rax, rax
je 0x14000ad6e
lea rcx, [rsp + 0x28]
mov edx, 0x5c
call qword [sym.imp.MSVCR110.dll_strchr]
mov byte [rax], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x14000ad8f
cmp byte [rsp + 0x40], 0
jne 0x14000ad97
mov eax, r14d
jmp 0x14000ae67
mov qword [rsp + 0x280], rbp
nop
movsxd rcx, ebx
mov eax, 4
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.1400cc094
lea ebp, [rbx*4]
lea r8, [rsp + 0x20]
mov edx, ebp
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x14000ae53
mov ecx, dword [rsp + 0x20]
cmp ebp, ecx
ja 0x14000ade1
add ebx, ebx
jmp 0x14000ada0
shr ecx, 2
mov rbx, rsi
lea eax, [rcx - 1]
cdqe
lea rbp, [rsi + rax*4]
cmp rsi, rbp
ja 0x14000ae32
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x14000ae29
lea rdx, [rsp + 0x40]
mov r8, rax
mov rcx, rdi
call fcn.14000a9b0
test al, al
jne 0x14000ae3f
add rbx, 4
cmp rbx, rbp
jbe 0x14000ae00
mov rcx, rsi
call qword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete___void____ptr64_]
xor eax, eax
jmp 0x14000ae5f
mov ebx, dword [rbx]
mov rcx, rsi
call qword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete___void____ptr64_]
mov ecx, ebx
call fcn.14000ac10
jmp 0x14000ae5f
mov rcx, rsi
call qword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete___void____ptr64_]
mov eax, r14d
mov rbp, qword [rsp + 0x280]
mov rbx, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400cc100
add rsp, 0x250
pop r14
pop rdi
pop rsi
ret