joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458e90
Capabilities:
Check internet connectivity via wininet

Disassembly:
sub rsp, 0x68
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 1
mov edx, 0x80
lea rcx, [0x004c92a0]
call fcn.004036d0
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceRPCALU_RPCServer.cpp
lea rax, [rcx + rax*2]
lea rcx, str.CheckInternet
mov qword [rsp + 0x20], rcx
lea r9, str._s_In
mov r8d, 0xa4
mov rdx, rax
mov ecx, 1
call fcn.0044b390
nop
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x34]
dec eax
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x3c], 0
jle 0x459024
call fcn.00458b20
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x458f6e
xor r8d, r8d
mov edx, 1
lea rcx, str.http:__liveupdate01.asus.com
call qword [sym.imp.WININET.dll_InternetCheckConnectionW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x458f49
jmp 0x459024
xor r8d, r8d
mov edx, 1
lea rcx, str.http:__www.google.com
call qword [sym.imp.WININET.dll_InternetCheckConnectionW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x458f6e
jmp 0x459024
cmp dword [rsp + 0x34], 0
jne 0x458fc8
mov edx, 0x80
lea rcx, [0x004c92a0]
call fcn.004036d0
mov qword [rsp + 0x48], rax
lea rax, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceRPCALU_RPCServer.cpp
mov rcx, qword [rsp + 0x48]
lea rax, [rax + rcx*2]
lea rcx, str.CheckInternet
mov qword [rsp + 0x20], rcx
lea r9, str._s_Out_Not_online_
mov r8d, 0xba
mov rdx, rax
mov ecx, 1
call fcn.0044b390
xor eax, eax
jmp 0x459074
mov edx, 0x80
lea rcx, [0x004c92a0]
call fcn.004036d0
mov qword [rsp + 0x50], rax
lea rax, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceRPCALU_RPCServer.cpp
mov rcx, qword [rsp + 0x50]
lea rax, [rax + rcx*2]
lea rcx, str.CheckInternet
mov qword [rsp + 0x20], rcx
lea r9, str._s:_Not_online__retry_after_5_minutes
mov r8d, 0xbe
mov rdx, rax
mov ecx, 1
call fcn.0044b390
mov ecx, 0x493e0
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x458eef
jmp 0x459026
mov edx, 0x80
lea rcx, [0x004c92a0]
call fcn.004036d0
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceRPCALU_RPCServer.cpp
lea rax, [rcx + rax*2]
mov ecx, dword [rsp + 0x30]
mov dword [rsp + 0x28], ecx
lea rcx, str.CheckInternet
mov qword [rsp + 0x20], rcx
lea r9, str._s_Out__d_
mov r8d, 0xc7
mov rdx, rax
mov ecx, 1
call fcn.0044b390
mov eax, dword [rsp + 0x30]
add rsp, 0x68
ret
Function at 0x45daa0
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x38
mov edx, 0x80
lea rcx, [0x004c92a0]
call fcn.004036d0
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceRPCALU_RPCServer.cpp
lea rax, [rcx + rax*2]
lea r9, str.GetALUInitialListsSize___In
mov r8d, 0x5a7
mov rdx, rax
mov ecx, 1
call fcn.0044b390
nop
lea r9, str.C:ProgramDataASUSASUS_System_Control_InterfaceAsusSoftwareManagerAsusLiveUpdate_alulist.txt
xor r8d, r8d
lea rdx, str.Count
lea rcx, str.ItemsCount
call qword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x20], eax
mov edx, 0x80
lea rcx, [0x004c92a0]
call fcn.004036d0
mov qword [rsp + 0x28], rax
lea rax, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceRPCALU_RPCServer.cpp
mov rcx, qword [rsp + 0x28]
lea rax, [rax + rcx*2]
lea r9, str.GetALUInitialListsSize___Out
mov r8d, 0x5ac
mov rdx, rax
mov ecx, 4
call fcn.0044b390
mov eax, dword [rsp + 0x20]
jmp 0x45db7d
add rsp, 0x38
ret
Function at 0x460eb0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov edx, 0x7f
lea rcx, [0x004c92a0]
call fcn.004036d0
lea rdi, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceRPCALU_RPCServer.cpp
lea rdx, [rdi + rax*2]
lea rsi, str.ALU_RpcServerDisconnect
mov qword [rsp + 0x20], rsi
lea r9, str._s______In
mov ecx, 1
mov r8d, 0x970
call fcn.0044b390
lea rbp, [0x00503180]
mov qword [rsp + 0x40], rbp
mov rcx, rbp
call fcn.0048121c
test eax, eax
jne 0x4610c0
lea rcx, str.C:ProgramDataASUSASUS_System_Control_InterfaceAsusSoftwareManagerAsusLiveUpdatewinlist.txt
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
mov edx, 0x7f
lea rcx, [0x004c92a0]
call fcn.004036d0
lea rdx, [rdi + rax*2]
mov qword [rsp + 0x20], rsi
lea r9, str._s______Delete_winlist.txt
mov ecx, 4
mov r8d, 0x979
call fcn.0044b390
cmp dword [0x005031f8], 0
je 0x460fb9
xor r8d, r8d
xor edx, edx
lea rcx, [0x004b7050]
call qword [sym.imp.RPCRT4.dll_RpcServerUnregisterIf]
mov ebx, eax
mov dword [0x005031f8], 0
mov edx, 0x7f
lea rcx, [0x004c92a0]
call fcn.004036d0
lea rdx, [rdi + rax*2]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
lea r9, str._s______RpcServerUnregisterIf__0x_08x_
mov ecx, 1
mov r8d, 0x983
call fcn.0044b390
mov rdx, qword [0x005031f0]
test rdx, rdx
je 0x461072
cmp dword [0x005031fc], 0
je 0x461023
xor r8d, r8d
lea rcx, [0x004b7050]
call qword [sym.imp.RPCRT4.dll_RpcEpUnregister]
mov ebx, eax
mov dword [0x005031fc], 0
mov edx, 0x7f
lea rcx, [0x004c92a0]
call fcn.004036d0
lea rdx, [rdi + rax*2]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
lea r9, str._s______RpcEpUnregister__0x_08x_
mov ecx, 1
mov r8d, 0x990
call fcn.0044b390
lea rcx, [0x005031f0]
call qword [sym.imp.RPCRT4.dll_RpcBindingVectorFree]
mov ebx, eax
mov qword [0x005031f0], 0
mov edx, 0x7f
lea rcx, [0x004c92a0]
call fcn.004036d0
lea rdx, [rdi + rax*2]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
lea r9, str._s______RpcBindingVectorFree__0x_08x_
mov ecx, 1
mov r8d, 0x996
call fcn.0044b390
mov edx, 0x7f
lea rcx, [0x004c92a0]
call fcn.004036d0
lea rdx, [rdi + rax*2]
mov qword [rsp + 0x20], rsi
lea r9, str._s______Out
mov ecx, 1
mov r8d, 0x999
call fcn.0044b390
nop
mov rcx, rbp
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
jmp fcn.00481240
mov ecx, eax
call fcn.00480f30
int3
Function at 0x4756d0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x004fb010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov rdx, qword [rcx + 8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x475758
mov rcx, qword [rdi + 8]
lea rax, [rsp + 0x50]
mov r9d, 2
mov qword [rsp + 0x50], rcx
xor ecx, ecx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
lea edx, [r9 - 1]
mov word [rsp + 0x28], r9w
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.00479310
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x475780
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x004fb010]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
mov dword [rsp + 0x20], r8d
mov r9, rdx
lea r8, str._s_failed_w_err_0x_08lx
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.00405d00
mov rdx, qword [rdi + 8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x475829
mov rcx, qword [rdi + 8]
lea rax, [rsp + 0x60]
mov r9d, 2
mov qword [rsp + 0x50], rcx
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], ecx
lea edx, [r9 - 1]
mov word [rsp + 0x28], r9w
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.00479310
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x280
pop rdi
ret
Function at 0x475f30
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x980]
sub rsp, 0xa80
mov rax, qword [0x004fb010]
xor rax, rsp
mov qword [rbp + 0x970], rax
mov rsi, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x170]
call fcn.004a2370
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.004a2370
call fcn.004377a0
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.00456040
nop
mov r8d, 0x2f
lea rdx, str._system32WindowsPowerShell_v1.0PowerShell.exe
mov rcx, rax
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x476022
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x47601d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x47601d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], bx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x476065
lea r8d, [rax + 0xe]
lea rdx, str.PowerShell.exe
lea rcx, [rsp + 0x40]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
mov r9, rsi
mov r8, rdi
lea rdx, str.New_NetFirewallRule__Displayname__s__Program__s
lea rcx, [rsp + 0x60]
call fcn.00456b90
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea r8, [rbp + 0x170]
lea rdx, [rsp + 0x60]
call fcn.0043c440
test eax, eax
sete bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x4760e8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x4760e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x4760e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov eax, ebx
mov rcx, qword [rbp + 0x970]
xor rcx, rsp
call fcn.00479310
mov rbx, qword [rsp + 0xab0]
add rsp, 0xa80
pop rdi
pop rsi
pop rbp
ret
Function at 0x476110
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x980]
sub rsp, 0xa80
mov rax, qword [0x004fb010]
xor rax, rsp
mov qword [rbp + 0x970], rax
mov rdi, rcx
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x170]
call fcn.004a2370
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.004a2370
call fcn.004377a0
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.00456040
nop
mov r8d, 0x2f
lea rdx, str._system32WindowsPowerShell_v1.0PowerShell.exe
mov rcx, rax
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x476202
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x4761fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x4761fd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], bx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x476245
lea r8d, [rax + 0xe]
lea rdx, str.PowerShell.exe
lea rcx, [rsp + 0x40]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
mov r8, rdi
lea rdx, str.Remove_NetFirewallRule__Displayname__s
lea rcx, [rsp + 0x60]
call fcn.00456b90
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea r8, [rbp + 0x170]
lea rdx, [rsp + 0x60]
call fcn.0043c440
test eax, eax
sete bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x4762c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x4762c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x4762c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov eax, ebx
mov rcx, qword [rbp + 0x970]
xor rcx, rsp
call fcn.00479310
lea r11, [rsp + 0xa80]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140027d34
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001bc0c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001bc0c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140027e84
cmp rax, 0xffffffffffffffff
je 0x140027e84
xor edi, edi
test rbp, rbp
jle 0x140027e2f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001e248
mov rbx, rax
test rax, rax
jne 0x140027dbc
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140027e25
mov edx, 0x8000
mov ecx, r14d
call fcn.1400156f0
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001c90c
cmp eax, 0xffffffff
je 0x140027e05
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140027dcc
mov edx, r15d
mov ecx, r14d
call fcn.1400156f0
jmp 0x140027e25
cmp byte [rsi + 0x38], dil
je 0x140027e1c
cmp dword [rsi + 0x34], 5
jne 0x140027e1c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140027e25
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001a2b8
jmp 0x140027e98
jns 0x140027e98
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001bc0c
cmp rax, 0xffffffffffffffff
jne 0x140027e50
cmp byte [rsi + 0x30], dil
je 0x140027e98
mov edi, dword [rsi + 0x2c]
jmp 0x140027e98
mov ecx, r14d
call fcn.140016ddc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140027e98
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140027e98
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140027e91
mov eax, dword [rsi + 0x2c]
jmp 0x140027e96
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001bc0c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140001160
Capabilities:
Encode data using xor

Disassembly:
mov rcx, qword [rsp + 0x30]
add rcx, 0x28
cmp rax, 5
add eax, 0x244c8948
invalid

Function at 0x140001c2c
Capabilities:
Get disk information

Disassembly:
loopne 0x140001c51
add byte [rax], al
mov ebx, 0x1390b125
wait
mov dword [rdx + 0x36], esi
jb sym.DUI70.dll_public:_void___cdecl_DirectUI::ClassInfoBase::constructor_void____ptr64
Function at 0x140001530
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x140001543
xor eax, eax
test eax, eax
jne 0x140001543
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x140001597
mov eax, dword [rsp + 0x38]
jmp 0x1400015a7
cmp dword [rsp + 0x30], 4
je 0x1400015a5
mov eax, 0xd
jmp 0x1400015a7
xor eax, eax
add rsp, 0x48
ret

Function at 0x1400015b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x1400015c8
xor eax, eax
test eax, eax
jne 0x1400015c8
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
shl rax, 1
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x68]
mov dword [rax], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x140001630
mov eax, dword [rsp + 0x38]
jmp 0x1400016b3
cmp dword [rsp + 0x30], 1
je 0x140001645
cmp dword [rsp + 0x30], 2
je 0x140001645
mov eax, 0xd
jmp 0x1400016b3
cmp qword [rsp + 0x60], 0
je 0x140001699
cmp dword [rsp + 0x34], 0
je 0x14000168f
mov eax, dword [rsp + 0x34]
xor edx, edx
mov ecx, 2
div rcx
test rdx, rdx
jne 0x140001686
mov eax, dword [rsp + 0x34]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, rax
mov rax, qword [rsp + 0x60]
movzx eax, word [rax + rcx*2 - 2]
test eax, eax
je 0x14000168d
mov eax, 0xd
jmp 0x1400016b3
jmp 0x140001699
xor ecx, ecx
mov rax, qword [rsp + 0x60]
mov word [rax], cx
mov eax, dword [rsp + 0x34]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
mov dword [rax], ecx
xor eax, eax
add rsp, 0x48
ret

Function at 0x140002fe0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x140002ff8
xor eax, eax
test eax, eax
jne 0x140002ff8
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x140003044
mov eax, dword [rsp + 0x34]
jmp 0x140003054
cmp dword [rsp + 0x30], 3
je 0x140003052
mov eax, 0xd
jmp 0x140003054
xor eax, eax
add rsp, 0x48
ret
Function at 0x1400092eb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400430e0]
jne 0x140006dea
rol rcx, 0x10
test cx, 0xffff
jne 0x140006de6
repz ret
ror rcx, 0x10
jmp 0x140009244
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140044f90]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140045088]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400092c9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140044f90]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400092eb
mov rax, qword [rsp + 0x88]
mov qword [0x140045088], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140045028], rax
mov rax, qword [0x140045088]
mov qword [0x140044f00], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140045010], rax
mov dword [0x140044ef0], 0xc0000409
mov dword [0x140044ef4], 1
mov rax, qword [0x1400430e0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400430e8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140044f88], eax
mov ecx, 1
call fcn.14000f534
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14002d000]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140044f88], 0
jne 0x140009372
mov ecx, 1
call fcn.14000f534
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14000cb44
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.14000f21c
nop
cmp dword [0x140045528], 1
je 0x14000caf0
mov dword [0x140045524], 1
mov byte [0x140045520], r12b
test ebx, ebx
jne 0x14000cadc
mov rcx, qword [0x140047910]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000cac9
mov rcx, qword [0x140047908]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x14000ca68
call fcn.14000a348
cmp qword [rdi], rax
jne 0x14000ca68
jmp 0x14000ca4e
cmp rdi, rsi
jb 0x14000cac9
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.14000a348
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140047910]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140047908]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x14000caa7
cmp r13, rax
je 0x14000cac7
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14000ca4e
lea rdx, [0x14002c5a0]
lea rcx, [0x14002c588]
call fcn.14000c898
lea rdx, [0x14002c5b0]
lea rcx, [0x14002c5a8]
call fcn.14000c898
nop
test r12d, r12d
je 0x14000caff
mov ecx, 8
call fcn.14000f11c
test r12d, r12d
jne 0x14000cb2a
mov dword [0x140045528], 1
lea ecx, [r12 + 8]
call fcn.14000f11c
mov ecx, r15d
call fcn.14000c82c
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x14000c9b8

Function at 0x14000cb50
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14000c9b8