joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007b8a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rcx
mov rdi, rdx
mov ebx, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov qword [rbp - 0x4c], rcx
mov rdx, rdi
mov qword [rbp - 0x54], rdx
mov r8d, ebx
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.140003130
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_WriteFile
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.140003180
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.140001be0
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140096590
Capabilities:
Get geographical location

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov edi, edx
lea rbx, [0x1401101e0]
cmp qword [rbx - 8], 0
jne 0x140096606
cmp byte [rbx], 0
je 0x1400965bb
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
lea rbp, [0x14010ffa0]
cmp qword [rbp - 8], 0
jne 0x14009660d
cmp byte [rbp], 0
jne 0x1400965e1
mov rcx, rsi
mov edx, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
jmp 0x140096cf0
mov edx, edi
mov ecx, edx
or ecx, 0x80000000
cmp byte [rsi + 0x1b8], 0
cmove edx, ecx
mov rcx, qword [rsi + 8]
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
jmp fcn.140097310
call fcn.14000120a
jmp 0x1400965ab
call fcn.1400010cb
jmp 0x1400965c9
sub rsp, 0x28
cmp edx, 0x1009
jne 0x140096d03
xor eax, eax
add rsp, 0x28
ret
xor r8d, r8d
mov dword [rsp + 0x20], r8d
mov rcx, qword [rcx + 0x10]
lea r8, [rsp + 0x20]
call fcn.1400cad20
mov eax, dword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x140096620
Capabilities:
Get geographical location

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov edi, edx
lea rbx, [0x1401101e0]
cmp qword [rbx - 8], 0
jne 0x1400966a1
cmp byte [rbx], 0
je 0x14009664b
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
lea rbp, [0x14010ffa0]
cmp qword [rbp - 8], 0
jne 0x1400966a8
cmp byte [rbp], 0
jne 0x14009667c
movzx ecx, byte [rsi + 0x1b8]
test ecx, ecx
jne 0x14009667c
mov rcx, rsi
mov edx, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
jmp 0x140096cf0
mov edx, edi
mov ecx, edx
or ecx, 0x80000000
cmp byte [rsi + 0x1b8], 0
cmove edx, ecx
mov rcx, qword [rsi + 8]
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
jmp fcn.140097310
call fcn.14000120a
jmp 0x14009663b
call fcn.1400010cb
jmp 0x140096659
Function at 0x140097240
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x50], rax
mov rax, qword [0x1401c9858]
mov qword [rbp + 0x48], rax
test dword [rsp], esp
sub rsp, 0x430
lea rsi, [rsp + 0x20]
test rcx, rcx
je 0x140097280
add rcx, 0xc
jmp 0x140097282
xor ecx, ecx
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x38], rcx
mov dword [rbp + 0x44], edx
mov r8, rsi
mov qword [rbp + 0x30], r8
mov r9d, 0x212
mov dword [rbp + 0x40], r9d
lea rcx, [rbp + 8]
call fcn.140003130
mov rcx, qword [rbp + 0x38]
mov edx, dword [rbp + 0x44]
mov r8, qword [rbp + 0x30]
mov r9d, dword [rbp + 0x40]
call sub.KERNEL32.dll_GetLocaleInfoEx
mov edi, eax
lea rcx, [rbp + 8]
call fcn.140003180
xor ecx, ecx
mov qword [rbp + 0x50], rcx
test edi, edi
jle 0x1400972da
mov rcx, rsi
call fcn.140081fa0
jmp 0x1400972dc
xor eax, eax
lea rcx, [0x1401c9858]
mov rcx, qword [rcx]
cmp qword [rbp + 0x48], rcx
je 0x1400972f1
call fcn.140003500
nop
lea rsp, [rbp + 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140097310
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
or edx, 0x20000000
xor r8d, r8d
mov dword [rbp - 0x40], r8d
test rcx, rcx
je 0x140097346
add rcx, 0xc
jmp 0x140097348
xor ecx, ecx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x58], rcx
lea r8, [rbp - 0x40]
mov qword [rbp - 0x60], r8
mov dword [rbp - 0x4c], edx
mov r9d, 4
mov dword [rbp - 0x50], r9d
lea rcx, [rbp - 0x88]
call fcn.140003130
mov rcx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov edx, dword [rbp - 0x4c]
mov r9d, dword [rbp - 0x50]
call sub.KERNEL32.dll_GetLocaleInfoEx
lea rcx, [rbp - 0x88]
call fcn.140003180
xor eax, eax
mov qword [rbp - 0x48], rax
mov eax, dword [rbp - 0x40]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400c87c0
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x90]
xor eax, eax
mov qword [rbp - 0x40], rax
test rcx, rcx
je 0x1400c87ec
add rcx, 0xc
mov rsi, rcx
jmp 0x1400c87ee
xor esi, esi
mov qword [rbp - 0x40], rsi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rsi
mov qword [rbp - 0x48], rcx
lea rcx, [rbp - 0x70]
call fcn.140003130
mov rcx, qword [rbp - 0x48]
call sub.KERNEL32.dll_DeleteFileW
mov esi, eax
lea rcx, [rbp - 0x70]
call fcn.140003180
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
test esi, esi
setne sil
movzx esi, sil
call fcn.140001be0
mov dword [rax + 8], edi
movzx eax, sil
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1400c9970
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rcx
mov rdi, rdx
mov ebx, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov qword [rbp - 0x4c], rcx
mov rdx, rdi
mov qword [rbp - 0x54], rdx
mov r8d, ebx
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.140003130
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_WriteFile
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.140003180
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.140001be0
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400ef920
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x38
cmp r8d, 8
jge 0x1400ef9bd
xor eax, eax
cmp r8d, 4
jl 0x1400ef971
add r8d, 0xfffffffc
movsx r9, word [rcx + rax*2]
movsx r10, dx
cmp r9d, r10d
je 0x1400ef9b8
nop dword [rax]
movsx r9, word [rcx + rax*2 + 2]
cmp r9d, r10d
je 0x1400ef9b1
movsx r9, word [rcx + rax*2 + 4]
cmp r9d, r10d
je 0x1400ef9a9
movsx r9, word [rcx + rax*2 + 6]
cmp r9d, r10d
je 0x1400ef9a1
add rax, 4
test r8d, r8d
jle 0x1400efb9a
movsx r10, dx
nop
dec r8d
movsx rdx, word [rcx + rax*2]
cmp edx, r10d
je 0x1400ef9b8
inc rax
test r8d, r8d
jg 0x1400ef980
jmp 0x1400efb9a
add eax, 3
jmp 0x1400efb95
add eax, 2
jmp 0x1400efb95
inc eax
jmp 0x1400efb95
jmp 0x1400efb95
movsx r10, dx
movd xmm0, r10d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov rax, rcx
lea edx, [r8 - 8]
movsxd rdx, edx
add rdx, rdx
lea r9, [rax + rdx]
movups xmm1, xmmword [rax]
pcmpeqw xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
xorps xmm2, xmm2
pcmpeqw xmm1, xmm2
pmovmskb r10d, xmm1
cmp r10d, 0xffff
jne 0x1400efad6
add rax, 0x10
cmp rax, r9
jbe 0x1400ef9e0
mov eax, r8d
test al, 7
je 0x1400efb9a
movups xmm1, xmmword [r9]
pcmpeqw xmm0, xmm1
movaps xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
pcmpeqw xmm0, xmm1
pmovmskb ecx, xmm0
cmp ecx, 0xffff
je 0x1400efb9a
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or ecx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, ecx
mov ecx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, ecx
mov ecx, r8d
shl ecx, 4
or eax, ecx
jne 0x1400efb8c
mov ecx, 0x20
jmp 0x1400efb8f
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx edx, word [rsp + 0x18]
shr edx, 0xf
movzx r8d, word [rsp + 0x1a]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x1c]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x1e]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r9d, word [rsp + 0x12]
shr r9d, 0xf
add r9d, r9d
or r8d, r9d
movzx r9d, word [rsp + 0x14]
shr r9d, 0xf
shl r9d, 2
or r9d, r8d
mov r8d, r9d
movzx r9d, word [rsp + 0x16]
shr r9d, 0xf
shl r9d, 3
or r9d, r8d
mov r8d, r9d
shl r8d, 4
or edx, r8d
jne 0x1400efb7d
mov r8d, 0x20
jmp 0x1400efb81
bsf r8d, edx
sub rax, rcx
shr rax, 1
add eax, r8d
jmp 0x1400efb95
bsf ecx, eax
shr rdx, 1
lea eax, [rdx + rcx]
add rsp, 0x38
ret
mov eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x1400f5e20
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
cmp r9d, 8
jge 0x1400f5e71
movzx r10d, dx
sub r8d, r10d
movzx eax, r8w
xor edx, edx
test r9d, r9d
jle 0x1400f609b
movsxd r8, edx
movzx r8d, word [rcx + r8*2]
sub r8d, r10d
movzx r8d, r8w
cmp r8d, eax
jle 0x1400f5e65
inc edx
cmp edx, r9d
jl 0x1400f5e45
jmp 0x1400f609b
mov eax, edx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
movzx r10d, dx
movd xmm0, r10d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov eax, r8d
sub eax, r10d
movzx eax, ax
movd xmm1, eax
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
mov rax, rcx
add r9d, 0xfffffff8
mov edx, r9d
add rdx, rdx
lea r8, [rax + rdx]
movups xmm2, xmmword [0x14017b150]
movaps xmm3, xmm1
psubw xmm3, xmm2
movups xmm4, xmmword [rax]
psubw xmm4, xmm0
movaps xmm5, xmm4
psubw xmm5, xmm2
movaps xmm6, xmm3
pcmpgtw xmm6, xmm5
pcmpeqw xmm4, xmm1
por xmm4, xmm6
movaps xmmword [rsp + 0x20], xmm4
xorps xmm5, xmm5
pcmpeqw xmm4, xmm5
pmovmskb r9d, xmm4
cmp r9d, 0xffff
jne 0x1400f5fdb
add rax, 0x10
cmp rax, r8
jb 0x1400f5eb8
movups xmm4, xmmword [r8]
psubw xmm4, xmm0
movaps xmm0, xmm4
psubw xmm0, xmm2
pcmpgtw xmm3, xmm0
pcmpeqw xmm1, xmm4
por xmm1, xmm3
movaps xmmword [rsp + 0x20], xmm1
xorps xmm0, xmm0
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x1400f609b
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or ecx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, ecx
mov ecx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, ecx
mov ecx, r8d
shl ecx, 4
or eax, ecx
bsf ecx, eax
mov r8d, 0x20
test eax, eax
cmove ecx, r8d
mov eax, ecx
shr rdx, 1
add eax, edx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx edx, word [rsp + 0x18]
shr edx, 0xf
movzx r8d, word [rsp + 0x1a]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x1c]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x1e]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r9d, word [rsp + 0x12]
shr r9d, 0xf
add r9d, r9d
or r8d, r9d
movzx r9d, word [rsp + 0x14]
shr r9d, 0xf
shl r9d, 2
or r9d, r8d
mov r8d, r9d
movzx r9d, word [rsp + 0x16]
shr r9d, 0xf
shl r9d, 3
or r9d, r8d
mov r8d, r9d
shl r8d, 4
or edx, r8d
bsf r8d, edx
mov r9d, 0x20
test edx, edx
cmove r8d, r9d
sub rax, rcx
shr rax, 1
add eax, r8d
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov eax, 0xffffffff
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x140001000
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x288
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareAlpsApointUSBMouseExceptions
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001129
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0x298], rbp
mov qword [rsp + 0x2a0], rsi
mov qword [rsp + 0x2a8], rdi
xor ebp, ebp
mov qword [rsp + 0x280], r12
lea r12, [0x140017400]
mov esi, ebp
mov ebx, ebp
mov rdi, r12
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x4c]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x44]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov edx, esi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x48], 0x208
mov dword [rsp + 0x4c], 4
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1400010f0
cmp dword [rsp + 0x40], 4
jne 0x1400010e3
mov eax, dword [rsp + 0x44]
add ebx, 1
add rdi, 4
mov dword [rdi - 4], eax
add esi, 1
cmp ebx, 0x100
jb 0x140001080
jmp 0x1400010f6
mov eax, ebx
mov dword [r12 + rax*4], ebp
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, qword [rsp + 0x280]
mov rdi, qword [rsp + 0x2a8]
mov rsi, qword [rsp + 0x2a0]
mov rbp, qword [rsp + 0x298]
mov rbx, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140003e00
add rsp, 0x288
ret

Function at 0x140001a20
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x288
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareAlpsApointUSBMouse
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001b3f
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0x298], rbp
xor ebp, ebp
mov qword [rsp + 0x2a0], rsi
mov qword [rsp + 0x280], rdi
mov dword [0x140017800], ebp
mov ebx, ebp
nop
nop
nop
nop
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov edx, ebx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x48], 0x208
mov dword [rsp + 0x44], 4
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea rsi, str.BluetoothMouseEnable
lea rdi, [rsp + 0x60]
mov ecx, 0x15
repe cmpsw word [rsi], word [rdi]
je 0x140001b0a
add ebx, 1
cmp ebx, 7
jb 0x140001aa0
jmp 0x140001b14
mov eax, dword [rsp + 0x40]
mov dword [0x140017800], eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x280]
mov rsi, qword [rsp + 0x2a0]
mov rbp, qword [rsp + 0x298]
mov rbx, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140003e00
add rsp, 0x288
ret
Function at 0x140001ba0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0x30]
xor edi, edi
mov edx, 0x104
mov rbx, rdi
mov dword [rsp + 0x20], 0x5c
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r11, [rsp + 0x30]
test r11, r11
je 0x140001c1e
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x208
call fcn.1400045f0
lea r8, str.kernel32.dll
lea rcx, [rsp + 0x30]
mov edx, 0x208
call fcn.1400045f0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rbx, rbx
mov qword [0x140017988], rbx
jne 0x140001c2e
xor eax, eax
jmp 0x140001c4e
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400179a8], rax
setne dil
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140003e00
mov rbx, qword [rsp + 0x260]
add rsp, 0x250
pop rdi
ret

Function at 0x140001f80
Capabilities:
Get session information
Get session user name

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
call qword [0x1400179a8]
lea r9, [rsp + 0x58]
mov edi, eax
lea rax, [rsp + 0x50]
lea r8d, [rbx + 8]
mov edx, edi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
lea r9, [rsp + 0x60]
lea r8d, [rbx + 5]
mov esi, eax
lea rax, [rsp + 0x50]
mov edx, edi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x140002005
test esi, esi
mov r8, qword [rsp + 0x60]
je 0x140001ffd
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x140001ffd
mov rdx, qword [rsp + 0x58]
mov eax, 1
cmp dword [rdx], ebx
cmove ebx, eax
mov rcx, r8
call sub.WTSAPI32.dll_WTSFreeMemory
test esi, esi
je 0x140002013
mov rcx, qword [rsp + 0x58]
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x140002020
Capabilities:
Get session information

Disassembly:
sub rsp, 0x48
cmp dword [0x1400164a8], 0
jne 0x140002034
xor eax, eax
add rsp, 0x48
ret
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x40], rbp
xor ebp, ebp
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
mov ebx, ebp
call qword [0x1400179a8]
lea r9, [rsp + 0x58]
lea r8d, [rbp + 8]
mov edi, eax
lea rax, [rsp + 0x50]
xor ecx, ecx
mov edx, edi
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
lea r9, [rsp + 0x60]
lea r8d, [rbp + 5]
mov esi, eax
lea rax, [rsp + 0x50]
mov edx, edi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x1400020c7
test esi, esi
mov rdx, qword [rsp + 0x60]
je 0x1400020bf
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x1400020bf
mov rax, qword [rsp + 0x58]
mov ecx, 1
cmp dword [rax], ebx
cmove ebx, ecx
mov rcx, rdx
call sub.WTSAPI32.dll_WTSFreeMemory
mov rdi, qword [rsp + 0x30]
test esi, esi
mov rsi, qword [rsp + 0x38]
je 0x1400020df
mov rcx, qword [rsp + 0x58]
call sub.WTSAPI32.dll_WTSFreeMemory
mov ecx, dword [0x1400164a8]
cmp ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x68]
cmove ecx, ebp
mov rbp, qword [rsp + 0x40]
mov dword [0x1400164a8], ecx
add rsp, 0x48
ret
Function at 0x140002fd0
Capabilities:
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor esi, esi
lea rcx, [rsp + 0x60]
mov edx, 0x104
mov ebx, esi
mov rdi, rsi
mov dword [rsp + 0x30], 0x5c
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r11, [rsp + 0x60]
test r11, r11
je 0x140003055
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x60]
mov edx, 0x208
call fcn.1400045f0
lea r8, str.VXDIF.DLL
lea rcx, [rsp + 0x60]
mov edx, 0x208
call fcn.1400045f0
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rdi, rdi
mov qword [0x140017980], rdi
je 0x14000320c
lea rdx, str.IOCTL_SetTouchPadDisable
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140017980]
lea rdx, str.Alps_DisableTouchpad
mov qword [0x1400179b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140017980]
lea rdx, str.Alps_MouseGetInitStatus
mov qword [0x1400179b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1400179b8], rbx
mov qword [0x1400179c0], rax
je 0x1400030cf
cmp qword [0x1400179b0], rbx
je 0x1400030cf
mov ecx, 1
test rax, rax
cmovne ebx, ecx
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREAlpsApoint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140003194
lea rax, [rsp + 0x48]
lea rdx, str.SOFTWAREAlpsApoint
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000316d
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
lea rdx, str.SupportI2CToPS2Switch
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREAlpsApoint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x50]
lea rdx, str.SupportI2CToPS2Switch
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x1400031d4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, esi
jmp 0x1400031df
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, dword [rsp + 0x40]
test r11d, r11d
mov dword [0x140017998], r11d
je 0x14000320c
mov rcx, qword [0x140017980]
lea rdx, str.IOCTL_SetPS2Mode
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400179c8], rax
cmove ebx, esi
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140003e00
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140003560
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rsp + 0x440], rax
lea r8, str.HomeDirectory
lea rdx, str.SOFTWAREAlpsApoint
mov rcx, 0xffffffff80000002
call fcn.140003c90
mov ebx, 0x104
lea rcx, [rsp + 0x230]
mov r8, rbx
movzx edx, word [rax]
test dx, dx
je 0x1400035c0
mov word [rcx], dx
add rcx, 2
add rax, 2
sub r8, 1
jne 0x1400035a5
jmp 0x1400035c5
test r8, r8
jne 0x1400035c9
sub rcx, 2
mov word [rcx], 0
lea r8, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov rdx, rbx
lea rax, [rsp + 0x20]
sub r8, rcx
movzx ecx, word [r8 + rax]
test cx, cx
je 0x1400035ff
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x1400035e6
jmp 0x140003604
test rdx, rdx
jne 0x140003608
sub rax, 2
mov word [rax], 0
mov rcx, rbx
lea rax, [rsp + 0x20]
cmp word [rax], 0
je 0x140003627
add rax, 2
sub rcx, 1
jne 0x140003615
jmp 0x140003677
test rcx, rcx
je 0x140003677
mov rax, rbx
mov rdx, rbx
sub rax, rcx
sub rdx, rax
lea rcx, [rsp + rax*2 + 0x20]
je 0x140003677
lea r8, str.ApClose.exe
sub r8, rcx
nop
nop
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140003669
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140003650
jmp 0x14000366e
test rdx, rdx
jne 0x140003672
sub rcx, 2
mov word [rcx], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140003716
lea r8, str.C:Program_FilesApoint2K
lea rcx, [rsp + 0x230]
mov rdx, rbx
sub r8, rcx
lea rax, [rsp + 0x230]
nop
nop
nop
movzx ecx, word [r8 + rax]
test cx, cx
je 0x1400036c9
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x1400036b0
jmp 0x1400036ce
test rdx, rdx
jne 0x1400036d2
sub rax, 2
lea rdx, str.C:Program_FilesApoint2KApClose.exe
lea rcx, [rsp + 0x20]
mov word [rax], 0
sub rdx, rcx
lea rax, [rsp + 0x20]
nop
nop
movzx ecx, word [rdx + rax]
test cx, cx
je 0x140003708
mov word [rax], cx
add rax, 2
sub rbx, 1
jne 0x1400036f0
jmp 0x14000370d
test rbx, rbx
jne 0x140003711
sub rax, 2
mov word [rax], 0
lea r8, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r9d, 1
xor edx, edx
call fcn.140003950
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140003e00
add rsp, 0x450
pop rbx
ret