joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f6d0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
cmp qword [rcx], 0
je 0x14000f765
mov rax, qword [0x140887040]
mov dword [rbp], 0
lea rbx, [rsi + 0x10]
mov r8, rbp
push rbx
nop
pop rcx
sub edx, edx
sub r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rbp - 4], eax
cmp eax, 1
jne 0x14000f7a4
cmp dword [rbp], 0
je 0x14000f788
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x14000f7b9
mov edi, eax
mov rax, qword [0x1408850c0]
nop word cs:[rax + rax]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1408850c0], rsi
jne 0x14000f740
mov eax, edi
inc eax
mov dword [rsi + 0x18], eax
push rbx
nop
pop rcx
sub edx, edx
sub r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x14000f799
call sub.KERNEL32.dll_TlsAlloc
mov dword [rbp + 4], eax
cmp eax, 0xffffffff
je 0x14000f7fb
mov ecx, eax
inc ecx
sub eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x14000f78d
mov edi, dword [rbp + 4]
jmp 0x14000f799
mov edi, dword [rsi + 0x18]
jmp 0x14000f797
mov edi, eax
mov ecx, dword [rbp + 4]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 0x38], 0
lea rcx, [rbp - 4]
lea rdx, [rbp - 0x38]
call fcn.1400105e0
mov rcx, rbx
mov edx, 4
sub r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rdx, str.library_std_src_syspalwindows_thread_local_key.rs
lea rcx, [rbp - 0x38]
call fcn.140002c50
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 4]
lea rdx, [rbp - 0x38]
call fcn.140010630
int3
Function at 0x140011580
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ecx, dword [0x1400330a8]
or ecx, ecx
je 0x140011652
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x1400115b1
add rax, 8
jmp 0x140011649
je 0x140011647
movzx eax, byte [0x140885030]
mov ecx, 0x10
call fcn.14002d520
or rax, rax
je 0x140011685
push rax
nop
pop rbx
mov rsi, rax
lea rax, [0x140033090]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1400330a8]
or ecx, ecx
je 0x140011665
dec ecx
call sub.KERNEL32.dll_TlsGetValue
push rax
nop
pop rdi
mov ecx, dword [0x1400330a8]
or ecx, ecx
je 0x140011675
dec ecx
add rbx, 8
push rsi
nop
pop rdx
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140011642
mov rax, qword [rdi + 8]
or rax, rax
je 0x140011635
lock dec qword [rax]
jne 0x140011635
push rdi
pop rcx
nop
add rcx, 8
call fcn.140010ee0
mov edx, 8
nop
push rdi
pop rcx
call fcn.1400066e0
push rbx
nop
pop rax
jmp 0x140011649
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x140033090]
call fcn.14000f6d0
mov ecx, eax
jmp 0x14001159d
lea rcx, [0x140033090]
call fcn.14000f6d0
mov ecx, eax
jmp 0x1400115f5
lea rcx, [0x140033090]
call fcn.14000f6d0
mov ecx, eax
jmp 0x140011609
mov ecx, 8
mov edx, 0x10
call fcn.1400028d0
int3

Function at 0x140011b10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ecx, dword [0x140033088]
or ecx, ecx
je 0x140011bbc
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140011b3e
add rax, 8
jmp 0x140011bb3
je 0x140011bb1
movzx eax, byte [0x140885030]
mov ecx, 0x10
call fcn.14002d520
or rax, rax
je 0x140011bef
push rax
nop
pop rbx
push rax
pop rsi
nop
lea rax, [0x140033070]
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov ecx, dword [0x140033088]
test ecx, ecx
je 0x140011bcf
dec ecx
call sub.KERNEL32.dll_TlsGetValue
push rax
nop
pop rdi
mov ecx, dword [0x140033088]
test ecx, ecx
je 0x140011bdf
dec ecx
add rbx, 8
push rsi
pop rdx
nop
call sub.KERNEL32.dll_TlsSetValue
or rdi, rdi
je 0x140011bac
mov edx, 8
nop
push rdi
pop rcx
call fcn.1400066e0
push rbx
pop rax
nop
jmp 0x140011bb3
sub eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x140033070]
call fcn.14000f6d0
mov ecx, eax
jmp 0x140011b2d
lea rcx, [0x140033070]
call fcn.14000f6d0
mov ecx, eax
jmp 0x140011b7a
lea rcx, [0x140033070]
call fcn.14000f6d0
mov ecx, eax
jmp 0x140011b8e
mov ecx, 8
mov edx, 0x10
call fcn.1400028d0
int3
Function at 0x140011fe0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ecx, dword [0x140033068]
or ecx, ecx
je 0x140012094
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14001200e
add rax, 8
jmp 0x14001208b
je 0x140012089
movzx eax, byte [0x140885030]
mov ecx, 0x18
call fcn.14002d520
test rax, rax
je 0x1400120c7
nop
push rax
pop rbx
mov rsi, rax
lea rax, [0x140033050]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov byte [rsi + 0x10], 0
mov ecx, dword [0x140033068]
or ecx, ecx
je 0x1400120a7
dec ecx
call sub.KERNEL32.dll_TlsGetValue
push rax
pop rdi
nop
mov ecx, dword [0x140033068]
test ecx, ecx
je 0x1400120b7
dec ecx
add rbx, 8
nop
push rsi
pop rdx
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140012084
mov edx, 8
mov rcx, rdi
call fcn.1400066e0
push rbx
pop rax
nop
jmp 0x14001208b
sub eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x140033050]
call fcn.14000f6d0
mov ecx, eax
jmp 0x140011ffd
lea rcx, [0x140033050]
call fcn.14000f6d0
mov ecx, eax
jmp 0x140012052
lea rcx, [0x140033050]
call fcn.14000f6d0
mov ecx, eax
jmp 0x140012066
mov ecx, 8
mov edx, 0x18
call fcn.1400028d0
int3
Function at 0x1400320a0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140032eb0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.140032eb0
mov rdx, r12
push rax
nop
pop rcx
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x140032110
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x140885154]
mov r12, rcx
push rdx
pop rsi
nop
mov rbx, r8
or edi, edi
jle 0x1400322c0
mov rax, qword [0x140885158]
sub ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14003215c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x1400321e7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x140032140
mov rcx, r12
call fcn.140032bc0
push rax
pop rbp
nop
or rax, rax
je 0x14003231d
mov rax, qword [0x140885158]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.140032cf0
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x140885158]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
or rax, rax
je 0x140032302
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400321e0
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140032270
add dword [0x140885154], 1
cmp ebx, 8
jae 0x140032218
test bl, 4
jne 0x1400322d0
or ebx, ebx
je 0x140032209
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x1400322f0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x140032209
and ebx, 0xfffffff8
sub eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x14003224a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x140885158]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
or eax, eax
jne 0x1400321e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400320a0
xor edi, edi
jmp 0x140032167
mov eax, dword [rsi]
push rsi
pop rsi
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x140032209
push rdx
pop rdx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x140032209
mov rax, qword [0x140885158]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.1400320a0
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1400320a0
nop
nop dword [rax]
Function at 0x140032830
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1408851c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1408851a0]
or rbx, rbx
je 0x140032884
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
or eax, eax
jne 0x14003287b
or r12, r12
je 0x14003287b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140032860
lea rcx, [0x1408851c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140032bc0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x14087f900]
sub r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x140032c39
mov rcx, r10
call fcn.140032a90
test eax, eax
je 0x140032c39
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
or eax, eax
je 0x140032c36
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
nop
push rdx
pop rax
cmp rcx, rdx
jb 0x140032c2d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x140032c39
add r8, 0x28
cmp r8, r9
jne 0x140032c18
sub r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x140002b70
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
lea rax, vtable.IPCService.0
mov rbx, rcx
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
xor ebp, ebp
mov dword [rbx + 0x40], 0xffffffff
lea rdx, [rsp + 0x30]
mov qword [rbx + 0x48], rbp
lea rcx, [rsp + 0x48]
mov qword [rbx + 0x50], rbp
mov esi, eax
mov dword [rbx + 0x44], ebp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
mov dword [rbx + 0x20], ebp
call fcn.1400081a0
lea rcx, [rbx + 0x38]
mov dword [rbx + 0x58], ebp
lea rdx, str.GlobalEEU_Memory_Map_Mutex
call fcn.140009e70
test eax, eax
jne 0x140002c0e
mov rcx, qword [0x140090dc0]
test rcx, rcx
je 0x140002d24
lea r9, str.CreateMutex_failed.
mov edx, 0x60004008
mov r8d, 1
call fcn.140006ad0
jmp 0x140002d24
xor r9d, r9d
lea rax, str.GlobalEEU_Memory_Map
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
xor ecx, ecx
mov dword [rsp + 0x20], 0x17c
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rbx + 0x28], rax
test rax, rax
jne 0x140002c58
mov rcx, qword [0x140090dc0]
test rcx, rcx
je 0x140002d24
lea r9, str.CreateFileMapping_failed.
jmp 0x140002bf9
xor r9d, r9d
mov qword [rsp + 0x20], 0x17c
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x140002c99
mov rcx, qword [0x140090dc0]
test rcx, rcx
je 0x140002d24
lea r9, str.MapViewOfFile_failed.
jmp 0x140002bf9
xor edx, edx
mov r8d, 0x17c
mov rcx, rax
call fcn.1400144d0
mov rax, qword [rbx + 0x30]
mov edx, esi
mov rcx, rbx
mov dword [rax], 8
call fcn.140003350
lea rdx, [rsp + 0x80]
lea rcx, str.ClientStatusMonitoring
call fcn.1400079a0
test eax, eax
je 0x140002d1d
cmp dword [rsp + 0x80], ebp
je 0x140002d1d
mov r9, rbx
lea r8, [0x140003a70]
mov edx, 8
lea rcx, [rbx + 0x50]
call fcn.140009ff0
test eax, eax
jne 0x140002d1d
mov rcx, qword [0x140090dc0]
test rcx, rcx
je 0x140002d24
lea r9, str.CreateTheThread_for_GetClientStatusThread_failed.
mov edx, 0x60004002
lea r8d, [rax + 1]
call fcn.140006ad0
jmp 0x140002d24
mov dword [rbx + 0x48], 1
lea r11, [rsp + 0x70]
mov rax, rbx
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140003830
Capabilities:
Get session information

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x260
cmp dword [rcx + 0x58], 0
mov rbx, rcx
jne 0x140003a59
mov qword [rax + 0x18], rbp
xor ebp, ebp
mov qword [rax - 0x10], rsi
mov qword [rax - 0x18], rdi
nop word [rax + rax]
mov edx, 0x3a98
lea rcx, [0x140090dd0]
call fcn.140009fd0
cmp eax, 0x102
jne 0x140003a41
cmp dword [rbx + 0x58], ebp
jne 0x140003a41
cmp dword [rbx + 0x40], 0xffffffff
je 0x140003a38
cmp dword [rbx + 0x4c], ebp
je 0x14000389c
mov dword [rbx + 0x4c], ebp
jmp 0x140003a38
lea rcx, [rbx + 0x38]
call fcn.140009e30
test eax, eax
jne 0x1400038d3
mov rcx, qword [0x140090dc0]
test rcx, rcx
je 0x140003a38
lea r9, str.IPCService::GetClientStatusLoop_AcquireTheMutex_failed.
mov edx, 0x60004008
lea r8d, [rax + 1]
call fcn.140006ad0
jmp 0x140003a38
mov rdx, qword [rbx + 0x30]
lea rcx, [rbx + 0x38]
mov edi, dword [rdx + 4]
mov eax, edi
and eax, 0xfffffffe
mov dword [rdx + 4], eax
call fcn.140009ef0
test dil, 5
jne 0x140003a38
mov edx, dword [rbx + 0x40]
lea rax, [rsp + 0x270]
lea r9, [rsp + 0x278]
mov qword [rsp + 0x20], rax
mov r8d, 8
mov qword [rsp + 0x278], rbp
xor ecx, ecx
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x140003a38
mov rcx, qword [rsp + 0x278]
cmp dword [rcx], 2
jb 0x140003941
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x140003a38
call sub.WTSAPI32.dll_WTSFreeMemory
mov edi, dword [rbx + 0x40]
lea r8, str.GlobalAMDClient
mov r9d, edi
lea rdx, str._s__u
lea rcx, [rsp + 0x30]
call fcn.140002b10
mov r9d, edi
lea r8, str.GlobalAMDClientAck
lea rdx, str._s__u
lea rcx, [rsp + 0x140]
call fcn.140002b10
mov rcx, qword [rbx + 8]
lea rdi, [rdi*8]
add rcx, rdi
lea rdx, [rsp + 0x30]
xor r8d, r8d
call fcn.140009f10
test eax, eax
je 0x140003a0e
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x140]
add rcx, rdi
xor r8d, r8d
call fcn.140009f10
test eax, eax
je 0x140003a0e
mov ecx, dword [rbx + 0x40]
call fcn.140004f40
mov rcx, qword [0x140090dc0]
test eax, eax
je 0x1400039ec
test rcx, rcx
je 0x140003a38
mov r9d, dword [rbx + 0x40]
lea r8, str.Client_started_for_session_id__u__because_status_was_not_running_
mov edx, 4
call fcn.140006d90
jmp 0x140003a38
test rcx, rcx
je 0x140003a38
mov eax, dword [rbx + 0x40]
lea r9, str.Client_for_session_id__u_has_to_be_relaunched.
xor r8d, r8d
mov dword [rsp + 0x20], eax
mov edx, 0x40004003
call fcn.140006ad0
jmp 0x140003a38
mov rcx, qword [0x140090dc0]
test rcx, rcx
je 0x140003a38
mov eax, dword [rbx + 0x40]
lea r9, str.Create_client_event_failed_for_session_id_u.
mov edx, 0x60004003
mov dword [rsp + 0x20], eax
mov r8d, 1
call fcn.140006ad0
cmp dword [rbx + 0x58], ebp
je 0x140003860
mov rsi, qword [rsp + 0x258]
mov rdi, qword [rsp + 0x250]
mov rbp, qword [rsp + 0x280]
add rsp, 0x260
pop rbx
ret
Function at 0x140004040
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push rbx
sub rsp, 0x250
mov ebx, ecx
call fcn.1400043d0
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call fcn.1400144d0
xor edx, edx
lea rcx, [rsp + 0x140]
mov r8d, 0x104
call fcn.1400144d0
mov r8d, 0x104
lea rdx, [rsp + 0x140]
lea rcx, str.COMMONPROGRAMFILES
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1400040f3
lea rax, str.ATI_TechnologiesDSEManager.exe
mov qword [rsp + 0x28], 0
lea r9, [rsp + 0x140]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.140047e88
test eax, eax
jne 0x1400040de
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400040f3
cmp eax, 0x10
je 0x1400040f3
lea rdx, [rsp + 0x30]
mov ecx, ebx
call fcn.140004110
add rsp, 0x250
pop rbx
ret
lea rcx, str.Unable_to_create_path_for_DSE_Manager._n
call fcn.1400046d0
add rsp, 0x250
pop rbx
ret
Function at 0x1400043d0
Capabilities:
Check if file exists
Enumerate processes
Query environment variable
Terminate process

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0x4b8]
sub rsp, 0x5b8
xor edx, edx
lea rcx, [rbp + 0x190]
mov r8d, 0x104
call fcn.1400144d0
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.1400144d0
mov r8d, 0x104
lea rdx, [rsp + 0x50]
lea rcx, str.COMMONPROGRAMFILES
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140004661
lea rax, str.ATI_TechnologiesDSEManager.exe
xor r14d, r14d
mov qword [rsp + 0x28], r14
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rbp + 0x190]
call fcn.140047e88
test eax, eax
jne 0x140004479
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140004661
cmp eax, 0x10
je 0x140004661
xor edx, edx
mov qword [rsp + 0x5e0], rsi
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400044b3
lea rcx, str.Unable_to_get_snapshot_of_all_processes._n
call fcn.1400046d0
mov rsi, qword [rsp + 0x5e0]
add rsp, 0x5b8
pop r14
pop rbp
ret
mov qword [rsp + 0x5b0], rdi
mov edi, r14d
mov qword [rsp + 0x5d8], rbx
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x64]
mov r8d, 0x12c
call fcn.1400144d0
mov dword [rbp + 0x60], 0x130
test edi, edi
jne 0x1400044fa
lea rdx, [rbp + 0x60]
mov rcx, rsi
call sub.KERNEL32.dll_Process32First
jmp 0x140004508
jle 0x140004510
lea rdx, [rbp + 0x60]
mov rcx, rsi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x140004635
xor edx, edx
lea rcx, [rbp + 0x2a0]
mov r8d, 0x100
call fcn.1400144d0
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x100
call fcn.1400144d0
mov qword [rsp + 0x40], 0x100
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rcx, [rbp + 0x8c]
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x30], 0x100
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
call fcn.140048e8c
test eax, eax
jne 0x14000462e
lea rdx, str.DSEManager
lea rcx, [rbp + 0x2a0]
call fcn.1400478f0
test eax, eax
jne 0x14000462e
lea rdx, str..exe
lea rcx, [rsp + 0x50]
call fcn.1400478f0
test eax, eax
jne 0x14000462e
mov r8d, dword [rbp + 0x68]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000462e
xor edx, edx
lea rcx, [rbp + 0x3a0]
mov r8d, 0x104
call fcn.1400144d0
lea r9, [rbp + 0x4d0]
mov dword [rbp + 0x4d0], 0x104
lea r8, [rbp + 0x3a0]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
test eax, eax
je 0x140004625
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x3a0]
call fcn.1400478f0
test eax, eax
jne 0x140004625
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
jmp 0x1400044d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x5b0]
mov rbx, qword [rsp + 0x5d8]
mov rsi, qword [rsp + 0x5e0]
add rsp, 0x5b8
pop r14
pop rbp
ret
lea rcx, str.Unable_to_create_path_for_DSE_Manager._n
call fcn.1400046d0
add rsp, 0x5b8
pop r14
pop rbp
ret
Function at 0x140004880
Capabilities:
Create service
Persist via windows service

Disassembly:
push rbx
sub rsp, 0x180
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
jne 0x1400048b6
lea rcx, str.SCM_could_not_be_opened.
call fcn.1400046d0
xor eax, eax
add rsp, 0x180
pop rbx
ret
mov r8d, 0x104
mov qword [rsp + 0x190], rdi
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
lea r8, str.AMD_External_Events_Utility
mov qword [rsp + 0x60], rax
lea rdx, str.AMD_External_Events_Utility
mov qword [rsp + 0x58], rax
mov r9d, 0x10
mov qword [rsp + 0x50], rax
mov rcx, rbx
mov qword [rsp + 0x48], rax
lea rax, str.Event_log
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x110
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rdi, rax
test rax, rax
jne 0x14000496a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Service_could_not_be_created.__GetLastError___i_n
call fcn.1400046d0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x190]
xor eax, eax
add rsp, 0x180
pop rbx
ret
lea rcx, str.Service_has_been_installed_successfully._n
call fcn.1400046d0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x190]
mov eax, 1
add rsp, 0x180
pop rbx
ret

Function at 0x140004be0
Capabilities:
Delete service

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
jne 0x140004c10
lea rcx, str.SCM_could_not_be_opened.
call fcn.1400046d0
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov r8d, 0x10000
mov qword [rsp + 0x30], rdi
lea rdx, str.AMD_External_Events_Utility
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
jne 0x140004c55
lea rcx, str.Service_could_not_be_opened._n
call fcn.1400046d0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140004c8d
lea rcx, str.Service_could_not_be_deleted._n
call fcn.1400046d0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
lea rcx, str.Service_has_been_deleted_successfully._n
call fcn.1400046d0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rbx
ret