joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400da740
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x40
mov eax, dword [rcx + 0x60]
mov edi, r9d
movzx r12d, r8b
cdq
mov rsi, rcx
xor eax, edx
cmp eax, edx
jne 0x1400da768
xor eax, eax
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], r13
mov ecx, 0x11
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor r14d, r14d
mov ecx, 0x10
test ax, ax
sets r14b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor r15d, r15d
test ax, ax
mov eax, dword [rsp + 0x80]
mov r9d, edi
sets r15b
mov edx, r14d
mov rcx, rsi
mov r8d, r15d
mov dword [rsp + 0x20], eax
call fcn.1400da950
mov r13d, 1
mov ebx, eax
mov eax, 0x5dc
cmp ebx, eax
cmovg ebx, eax
mov eax, 0xfffffa24
cmp ebx, eax
cmovl ebx, eax
test edi, edi
jne 0x1400da7f8
mov eax, dword [rsi + 0x3c]
test al, 2
jne 0x1400da7f8
bt eax, 0x13
jb 0x1400da7f8
xor ebp, ebp
jmp 0x1400da7fb
mov ebp, r13d
test r14d, r14d
mov r14, qword [rsp + 0x38]
jne 0x1400da80a
test r15d, r15d
je 0x1400da84d
test edi, edi
jne 0x1400da84d
test dword [rsi + 0x3c], 0x80000
jne 0x1400da84d
xor ebp, ebp
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x78
jl 0x1400da86c
mov eax, 0x88888889
imul ebx
add ebx, edx
sar ebx, 6
mov eax, ebx
shr eax, 0x1f
add ebx, eax
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7f
jl 0x1400da8a9
test ebx, ebx
jns 0x1400da89f
or eax, 0xffffffff
jmp 0x1400da8a6
test ebp, ebp
je 0x1400da819
test edi, edi
je 0x1400da873
xor edx, edx
mov rcx, rsi
call fcn.1400dc9b0
mov ecx, eax
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jge 0x1400da8a9
xor eax, eax
jmp 0x1400da91e
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x168
jle 0x1400da8a9
test ebx, ebx
jns 0x1400da890
or eax, 0xffffffff
imul ebx, eax, 0x168
jmp 0x1400da8a9
xor eax, eax
test ebx, ebx
setg al
imul ebx, eax, 0x168
jmp 0x1400da8a9
xor eax, eax
test ebx, ebx
setg al
imul ebx, eax, 0x7f
mov eax, dword [rsi + 0x60]
neg ebx
cdq
mov edi, eax
mov rax, qword [0x140296e90]
xor edi, edx
sub edi, edx
test rax, rax
je 0x1400da912
mov rax, qword [rax]
test rax, rax
je 0x1400da912
xor ecx, ecx
test r12b, r12b
cmove ecx, r13d
test ebp, ebp
je 0x1400da8d9
or ecx, 2
mov r10, qword [rax + 0x58]
test r10, r10
jne 0x1400da8e6
lea r10, [rax + 0x70]
mov rax, qword [r10]
mov dword [rsp + 0x28], ecx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r10
mov dword [rsp + 0x20], ebx
call qword [rax + 0xe0]
mov eax, dword [rsi + 0x60]
test eax, eax
jle 0x1400da90d
sub eax, edi
jmp 0x1400da90f
add eax, edi
mov dword [rsi + 0x60], eax
mov dword [rsi + 0x9c], 0
mov eax, edi
mov r13, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x30]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x1400dd130
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x2030
call fcn.1400fbbd0
sub rsp, rax
mov r10d, dword [rsp + 0x2060]
mov rdi, r9
mov ebp, r8d
mov r14, rdx
mov rsi, rcx
sub r10d, 2
je 0x1400dd26f
dec r10d
jne 0x1400dd2cb
cmp r8d, 0xc
jne 0x1400dd2cb
mov rcx, rdx
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov rbx, qword [rsp + 0x2068]
mov r8d, eax
test rbx, rbx
je 0x1400dd2cb
test rdi, rdi
je 0x1400dd2cb
test eax, eax
je 0x1400dd2cb
mov ecx, dword [rdi]
xor esi, esi
mov r10d, esi
mov edx, esi
test ecx, ecx
je 0x1400dd1df
mov eax, esi
cmp ecx, r8d
je 0x1400dd1d7
mov ecx, dword [rdi + rax*4 + 8]
add rax, 2
add edx, 2
test ecx, ecx
jne 0x1400dd1c1
jmp 0x1400dd1df
movsxd rax, edx
mov r10d, dword [rdi + rax*4 + 4]
lea r8, [rsp + 0x30]
mov r9d, 0x1000
mov edx, r10d
mov rcx, rbx
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1400dd254
lea r9, [0x1400dd2f0]
mov r8, r14
mov edx, 0xaa
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [0x1402988b0], rax
call fcn.1400c4300
test eax, eax
je 0x1400dd233
mov rcx, qword [0x1402988b0]
call fcn.1400c4610
mov r9, qword [rsp + 0x2070]
mov rcx, qword [0x1402988b0]
lea r8, [rsp + 0x30]
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400dd2cb
mov rcx, qword [0x1402988b0]
test rcx, rcx
je 0x1400dd2cb
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [0x1402988b0], rsi
jmp 0x1400dd2cb
add rcx, 0x418
or rbx, 0xffffffffffffffff
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400dd280
test rax, rax
je 0x1400dd295
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsi + 0x620]
nop dword [rax]
inc rbx
cmp word [rcx + rbx*2], 0
jne 0x1400dd2a0
test rbx, rbx
je 0x1400dd2b5
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str.Mouse.hlp
mov r9, rdi
mov r8d, ebp
mov rcx, r14
call qword [sym.imp.USER32.dll_WinHelpW]
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400debf0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov qword [rcx + 0x28], 7
xor r14d, r14d
mov qword [rcx + 0x20], r14
mov word [rcx + 0x10], r14w
add rcx, 0x438
lea rdx, str.SynCom.PointingDevice
call fcn.140037860
lea rax, vtable.CDummySynDevice.0
mov qword [rsi + 0x450], rax
mov dword [rsi + 0x458], r14d
mov qword [rsi + 0x448], r14
lea rax, vtable.SynDeviceEx.0
mov qword [rsi + 0x430], rax
lea rax, vtable.SynDeviceEx.1.0
mov qword [rsi + 0x440], rax
mov dword [rsi + 0x460], 0xffffffff
mov dword [rsi + 0x464], r14d
lea rcx, [rsi + 0x480]
call fcn.1400f7290
nop
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov dword [rsi + 0x470], 0x800
mov qword [rsi + 0x468], r14
mov qword [rsi + 0x478], r14
mov dword [rsi + 0x474], 1
lea rdi, [rsi + 0x4a0]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor edx, edx
lea r8d, [r14 + 0x26]
lea rcx, [rsi + 0x480]
call fcn.1400f7380
test eax, eax
jns 0x1400ded44
lea rcx, str.ProgramFiles
call fcn.140103af8
test rax, rax
je 0x1400ded22
lea rcx, str.ProgramFiles
call fcn.140103af8
mov rdx, rdi
sub rdx, rax
nop dword [rax]
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x1400ded10
jmp 0x1400ded44
lea rcx, str.C:Program_Files
mov rdx, rsi
sub rdx, rcx
nop
movzx eax, word [rcx]
mov word [rdx + rcx + 0x4a0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400ded30
lea rbx, [rsi + 0x6a8]
mov r8, rdi
lea rdx, str._sSynapticsSynTP
mov rcx, rbx
call fcn.1400fc05c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400ded79
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ecx, ecx
call fcn.1400f1590
cmp eax, 9
jl 0x1400dedaf
lea rax, [rsi + 0x8b0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 5]
lea rcx, [rsi + 0x480]
call fcn.1400f7380
test eax, eax
jns 0x1400dedd0
lea rcx, [rsi + 0x8b0]
sub rcx, rbx
nop dword [rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x1400dedc0
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400e2990
Capabilities:
Get file version info

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
mov qword [r11 - 0x80], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov word [r11 - 0x78], r15w
xor eax, eax
mov qword [r11 - 0x76], rax
mov qword [r11 - 0x6e], rax
mov qword [r11 - 0x66], rax
mov qword [r11 - 0x5e], rax
mov qword [r11 - 0x56], rax
mov qword [r11 - 0x4e], rax
mov qword [r11 - 0x46], rax
mov word [rsp + 0x7a], ax
cmp qword [rdx + 0x18], 8
jb 0x1400e29f0
mov rcx, qword [rdx]
jmp 0x1400e29f3
mov rcx, rdx
lea rdx, [rsp + 0xc0]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
or rbx, 0xffffffffffffffff
test eax, eax
je 0x1400e2ab0
mov eax, 2
mul rbp
cmovo rax, rbx
mov rcx, rax
call fcn.1400f9438
mov r14, rax
cmp qword [rdi + 0x18], 8
jb 0x1400e2a31
mov rcx, qword [rdi]
jmp 0x1400e2a34
mov rcx, rdi
mov r9, rax
mov r8d, ebp
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400e2aa8
mov qword [rsp + 0xd8], r15
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0xd8]
lea rdx, [0x140140710]
mov rcx, r14
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400e2aa8
mov rdx, qword [rsp + 0xd8]
test rdx, rdx
je 0x1400e2aa8
movzx eax, word [rdx + 0xc]
movzx ecx, word [rdx + 0xe]
movzx r9d, word [rdx + 8]
movzx r8d, word [rdx + 0xa]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str.v_d._d._d._d
lea rcx, [rsp + 0x40]
call fcn.1400fc05c
mov rcx, r14
call fcn.1400fa318
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], r15
mov word [rsi], r15w
cmp word [rsp + 0x40], 0
jne 0x1400e2acd
mov rbx, r15
jmp 0x1400e2adc
lea rax, [rsp + 0x40]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400e2ad2
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14000b9c0
nop
cmp qword [rdi + 0x18], 8
jb 0x1400e2afc
mov rcx, qword [rdi]
call fcn.1400fa318
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r15
mov word [rdi], r15w
mov rax, rsi
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400e3c60
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rsi, rax
test rax, rax
je 0x1400e3d37
movzx r8d, word [rax]
mov qword [rsp + 0x30], rbx
mov rbx, rax
test r8w, r8w
je 0x1400e3ce0
nop dword [rax]
lea rdx, [0x14015e750]
movzx r8d, r8w
mov rcx, rdi
call fcn.140101fac
movzx r8d, word [rbx + 2]
add rbx, 2
test r8w, r8w
jne 0x1400e3ca0
lea rdx, [0x140151414]
mov rcx, rdi
call fcn.140101fac
movzx r8d, word [rbx + 2]
add rbx, 2
test r8w, r8w
jne 0x1400e3ca0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rcx, qword [rbp + 0x438]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov dword [rsp + 0x40], eax
test rcx, rcx
je 0x1400e3d14
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
mov edx, 0x100001d2
call qword [rax + 0x18]
mov eax, dword [rsp + 0x40]
lea rcx, [0x14015da00]
test eax, eax
lea r8, [0x14015da08]
cmovne r8, rcx
lea rdx, str.IsUserAdmin_s_n
mov rcx, rdi
call fcn.140101fac
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1400e3d50
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2020
call fcn.1400fbbd0
sub rsp, rax
mov rbp, r8
mov rsi, rdx
xor edi, edi
nop word [rax + rax]
lea rdx, [0x140159608]
mov rcx, rbp
call fcn.140102040
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400e3db4
test rbx, rbx
jne 0x1400e3dcf
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x3c
jl 0x1400e3d80
xor eax, eax
lea r11, [rsp + 0x2020]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rcx, rbx
call fcn.140101930
test eax, eax
jne 0x1400e3e1c
nop dword [rax + rax]
mov rcx, rbx
call fcn.140101958
test eax, eax
jne 0x1400e3e1c
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x1000
call fcn.140101e30
test rax, rax
je 0x1400e3e1c
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.140101ef8
mov rcx, rbx
call fcn.140101930
test eax, eax
je 0x1400e3de0
mov rcx, rsi
call fcn.1400fc3e4
mov rcx, rbx
call fcn.1400fc2a8
mov eax, 1
jmp 0x1400e3db6
Function at 0x1400e6310
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x270
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x290], rbx
cmp dword [0x1402988f0], 0
jne 0x1400e6501
mov dword [0x1402988f0], 1
call fcn.1400f2f50
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
test eax, eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea edx, [rcx + 0x2a]
jne 0x1400e6362
lea edx, [rcx + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call fcn.140004d50
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1400e6387
mov ecx, 0x80004005
call fcn.140004d00
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x280], rax
lea rcx, [rsp + 0x60]
lea rax, [rsp + 0x60]
or rbx, 0xffffffffffffffff
test rax, 0xffffffffffff0000
jne 0x1400e63d8
movzx edi, cx
xor edx, edx
mov ecx, edi
call fcn.14000f670
test rax, rax
je 0x1400e6400
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.14000fa20
jmp 0x1400e6400
lea rcx, [rsp + 0x60]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400e63e0
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x280]
call fcn.14000fc20
nop
lea r8, str.LenovoMetricCollectionSDKMFCLenovo.MetricCollectionMFC.dll
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x288]
call fcn.14006fc40
nop
mov rdx, qword [rsp + 0x280]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400e6439
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1402988c0], rax
test rax, rax
je 0x1400e64e5
lea rdx, str.GetMetricCollectionCollector
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1400e64e5
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.1400f4ee0
mov byte [rsp + 0x48], 1
lea rax, str.SynapticsAppsCollectionReport
mov qword [rsp + 0x40], rax
lea rax, str.Local_Todo
mov qword [rsp + 0x38], rax
lea rax, str.Countyr_Todo
mov qword [rsp + 0x30], rax
lea rax, str.Family_Todo
mov qword [rsp + 0x28], rax
lea rax, str.SubBrand_Todo
mov qword [rsp + 0x20], rax
lea r9, str.Brand_Todo
lea r8, str.MTM_Todo
lea rdx, str.19.3.4.228
lea rcx, [rsp + 0x60]
call rdi
mov qword [0x1402988b8], rax
mov rdx, qword [rsp + 0x288]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400e6501
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [0x1402988b8]
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret
Function at 0x1400ec140
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x670
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x698], rbx
mov rdi, rcx
lea rax, vtable.CSynDeviceGestureActionService.0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
lea rbx, [rcx + 0x18]
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov rcx, rbx
call fcn.1400ecd30
mov qword [rbx], rax
mov dword [rsp + 0x688], 0x101
lea rdx, [rsp + 0x688]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rax, qword [rdi + 8]
mov rcx, qword [rax + 0x58]
test rcx, rcx
jne 0x1400ec1b6
lea rcx, [rax + 0x70]
mov rax, qword [rcx]
lea r8, [rsp + 0x690]
mov edx, 0x10000101
call qword [rax + 0x18]
or ecx, 0xffffffff
test eax, eax
cmove ecx, dword [rsp + 0x690]
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x60]
lea r8, str..pipe_sC01BC476_A852_4dfd_B33F_E308F3497BF4_li
mov edx, 0x200
lea rcx, [rsp + 0x270]
call fcn.1400fc120
lea r9, [0x140140710]
lea r8, [0x140150e78]
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400f2890
cmp qword [rax + 0x10], 0
setne bl
cmp qword [rsp + 0x48], 8
jb 0x1400ec22c
mov rcx, qword [rsp + 0x30]
call fcn.1400fa318
test bl, bl
je 0x1400ec28c
lea r9, [0x140140710]
lea r8, [0x140150e78]
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400f2890
cmp qword [rax + 0x18], 8
jb 0x1400ec254
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x270]
lea r8, str._s_s
mov edx, 0x200
lea rcx, [rsp + 0x270]
call fcn.1400fc120
cmp qword [rsp + 0x48], 8
jb 0x1400ec28c
mov rcx, qword [rsp + 0x30]
call fcn.1400fa318
mov edx, 0x3d
lea rcx, [rsp + 0x270]
call fcn.1400029c0
mov qword [rdi + 0x10], rax
test rax, rax
je 0x1400ec2b3
mov rdx, rdi
mov rcx, rax
call fcn.140002770
nop
mov rax, rdi
mov rbx, qword [rsp + 0x698]
add rsp, 0x670
pop rdi
ret
Function at 0x1400ef700
Capabilities:
Query service status

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x2c0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.1400ddab0
nop
mov ebp, 1
mov dword [rsp + 0x2d0], ebp
xor ebx, ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPInstall
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x78]
call fcn.1400ddc20
test eax, eax
je 0x1400ef87f
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x2d0]
lea r8, [rsp + 0x2d0]
lea rdx, str.EnhancementLaunchMode
lea rcx, [rsp + 0x80]
call fcn.1400f5bd0
test byte [rsp + 0x2d0], bpl
je 0x1400ef87f
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], eax
mov r8d, ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x1400ef87f
lea r9, [0x140140710]
lea r8, [0x140150e78]
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.1400f2890
cmp qword [rax + 0x18], 8
jb 0x1400ef7ef
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, str.SynTPEnhService
lea r8, str._s_s
mov edx, 0x104
lea rcx, [rsp + 0xb0]
call fcn.1400fc120
cmp qword [rsp + 0x70], 8
jb 0x1400ef826
mov rcx, qword [rsp + 0x58]
call fcn.1400fa318
mov r8d, 4
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x1400ef84d
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400ef867
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400ef867
cmp dword [rsp + 0x34], 4
cmove ebx, ebp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x1400ef87f
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
lea rcx, [rsp + 0x78]
call fcn.1400ddbc0
mov eax, ebx
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400f0e20
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, 1
mov edx, eax
mov ecx, ebp
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test rdi, rdi
je 0x1400f0e7d
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetFocus]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov ecx, ebp
mov edx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400f0eb0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x240
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x250], rbx
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov eax, dword [0x140298998]
test al, 1
jne 0x1400f0f22
or eax, 1
mov dword [0x140298998], eax
mov qword [0x140298990], 7
mov qword [0x140298988], rdi
mov word [0x140298978], di
xor r8d, r8d
lea rdx, [0x14013f6e0]
lea rcx, [0x140298978]
call fcn.14000b9c0
lea rcx, [0x14013cfe0]
call fcn.1400fb570
nop
cmp dword [0x140298974], 0
jne 0x1400f0f86
mov r9d, 1
lea r8d, [r9 + 0x22]
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [rsp + 0x30], 0
jne 0x1400f0f4f
mov r8, rdi
jmp 0x1400f0f6b
lea rax, [rsp + 0x30]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400f0f60
lea rdx, [rsp + 0x30]
lea rcx, [0x140298978]
call fcn.14000b9c0
mov dword [0x140298974], 1
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
mov word [rbx], di
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [0x140298978]
mov rcx, rbx
call fcn.14000b870
mov rax, rbx
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x1400f1240
Capabilities:
Get session user name

Disassembly:
push rbx
push rsi
sub rsp, 0x258
mov rsi, rcx
mov dword [rcx], 1
lea rcx, [rsp + 0x42]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], bx
call fcn.1400fa4e0
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x270], 0x104
mov qword [rsp + 0x278], rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1400f1373
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x250], rdi
call fcn.14005bcf0
cmp qword [rax + 0x18], 8
jb 0x1400f12bb
mov rax, qword [rax]
lea r9, [rsp + 0x278]
mov r8d, 1
mov rdx, rax
xor ecx, ecx
call sub.NETAPI32.dll_NetUserGetInfo
cmp qword [rsp + 0x38], 8
mov edi, eax
jb 0x1400f12e7
mov rcx, qword [rsp + 0x20]
call fcn.1400fa318
test edi, edi
je 0x1400f134f
lea r8, [rsp + 0x280]
mov edx, 1
xor ecx, ecx
mov qword [rsp + 0x280], rbx
call sub.NETAPI32.dll_NetWkstaUserGetInfo
mov edi, eax
test eax, eax
jne 0x1400f132f
mov rcx, qword [rsp + 0x280]
lea r9, [rsp + 0x278]
lea r8d, [rax + 1]
mov rdx, qword [rcx]
mov rcx, qword [rcx + 0x18]
call sub.NETAPI32.dll_NetUserGetInfo
mov edi, eax
mov rcx, qword [rsp + 0x280]
test rcx, rcx
je 0x1400f1341
call sub.NETAPI32.dll_NetApiBufferFree
test edi, edi
je 0x1400f134f
mov rcx, qword [rsp + 0x278]
jmp 0x1400f1361
mov rcx, qword [rsp + 0x278]
mov ebx, 1
mov eax, dword [rcx + 0x14]
mov dword [rsi], eax
mov rdi, qword [rsp + 0x250]
test rcx, rcx
je 0x1400f1373
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, ebx
add rsp, 0x258
pop rsi
pop rbx
ret

Function at 0x1400f13c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x260
mov edi, ecx
mov r14, rdx
xor esi, esi
lea ecx, [rsi + 2]
xor edx, edx
mov ebp, r8d
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [rsp + 0x20], 0x238
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400f144a
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400f1441
cmp dword [rsp + 0x28], edi
je 0x1400f142c
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400f1413
jmp 0x1400f1441
lea r8, [rsp + 0x4c]
mov rdx, rbp
mov rcx, r14
call fcn.1400fbc74
mov esi, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x260]
mov eax, esi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret