joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140113e80
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140156cd8]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
lea rbx, [rsp + 0x30]
mov rbp, rdx
mov word [rsp + 0x30], ax
movzx edx, byte [rcx]
mov rsi, rcx
lea edi, [rax + 0x28]
test dl, dl
je 0x140113f25
nop dword [rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x140113edd
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x140113ed0
cmp rcx, 1
jb 0x140113f56
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x140113ef3
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.140123b04
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x140113ec0
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140114810
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
call fcn.1401187d0
int3

Function at 0x140114130
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140156cd8]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx edx, byte [rcx]
lea rbx, [rsp + 0x30]
xor eax, eax
mov rsi, rcx
mov word [rsp + 0x30], ax
lea edi, [rax + 0x28]
test dl, dl
je 0x1401141d5
nop dword [rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14011418d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x140114180
cmp rcx, 1
jb 0x140114207
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1401141a3
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.140123b04
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x140114170
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140114810
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.1401187d0
int3
Function at 0x14011a014
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140119e73
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140119e73
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140119e73
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140119e73
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140119e73
cmp dword [rcx + 0x84], 0xe
jbe 0x140119e73
cmp dword [rcx + 0xf8], 0
je 0x140119e73
mov ecx, ebx
call fcn.140119f30
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140119d00
nop
cmp dword [rbp + 0x20], 0
je 0x140119ec1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140119ecc
int3
xor r8d, r8d
xor edx, edx
jmp 0x140119e04
Function at 0x14012b904
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14012b98b
mov rsi, rbx
cmp word [rax], bp
je 0x14012b94a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14012b934
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14012b930
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140127000
mov rdi, rax
test rax, rax
je 0x14012b978
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140115630
mov rbp, rdi
xor ecx, ecx
call fcn.140127b20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18000dcf0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
mov qword [rsp + 8], 0
jmp 0x18000dd1f
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 8
jae 0x18000dd63
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp]
xor rcx, rax
mov rax, rcx
mov qword [rsp], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp]
imul rcx, rax
mov rax, rcx
mov qword [rsp], rax
jmp 0x18000dd12
mov rax, qword [rsp]
add rsp, 0x18
ret
Function at 0x18004d4a0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1801171a0]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x18004d52e
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x18004d4d2
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x18004d540
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1801171a0]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x18004d644
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x18004d63f
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x18004d614
cmp qword [rsp + 0x38], 2
jb 0x18004d614
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18004d614
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18004d614
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x18004d587
jmp 0x18004d6d6
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x18004d6d6
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x18004d6ac
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18004d6ac
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18004d6ac
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x18004d644
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x180086e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
movss xmm0, dword [rsp + 0x78]
movss dword [rsp + 0x30], xmm0
movss xmm0, dword [rsp + 0x7c]
movss dword [rsp + 0x34], xmm0
movss xmm0, dword [rsp + 0x80]
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x84]
movss dword [rsp + 0x3c], xmm0
movzx eax, byte [rsp + 0x88]
test eax, eax
je 0x180086eeb
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
mov rdi, rax
lea rsi, [rcx + 0x88]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
movss xmm0, dword [rsp + 0x40]
comiss xmm0, dword [rsp + 0x30]
jbe 0x180086ea0
movss xmm0, dword [rsp + 0x40]
movss dword [rsp + 0x30], xmm0
movss xmm0, dword [rsp + 0x44]
comiss xmm0, dword [rsp + 0x34]
jbe 0x180086eb9
movss xmm0, dword [rsp + 0x44]
movss dword [rsp + 0x34], xmm0
movss xmm0, dword [rsp + 0x38]
comiss xmm0, dword [rsp + 0x48]
jbe 0x180086ed2
movss xmm0, dword [rsp + 0x48]
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x3c]
comiss xmm0, dword [rsp + 0x4c]
jbe 0x180086eeb
movss xmm0, dword [rsp + 0x4c]
movss dword [rsp + 0x3c], xmm0
movss xmm0, dword [rsp + 0x30]
comiss xmm0, dword [rsp + 0x38]
jb 0x180086f06
movss xmm0, dword [rsp + 0x30]
movss dword [rsp + 0x20], xmm0
jmp 0x180086f12
movss xmm0, dword [rsp + 0x38]
movss dword [rsp + 0x20], xmm0
movss xmm0, dword [rsp + 0x20]
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x34]
comiss xmm0, dword [rsp + 0x3c]
jb 0x180086f39
movss xmm0, dword [rsp + 0x34]
movss dword [rsp + 0x24], xmm0
jmp 0x180086f45
movss xmm0, dword [rsp + 0x3c]
movss dword [rsp + 0x24], xmm0
movss xmm0, dword [rsp + 0x24]
movss dword [rsp + 0x3c], xmm0
mov rax, qword [rsp + 0x70]
add rax, 0x58
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call fcn.180095830
mov rax, qword [rsp + 0x70]
lea rcx, [rsp + 0x30]
lea rdi, [rax + 0x88]
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x70]
call fcn.1800917f0
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x18011085c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18011088c
xor eax, eax
jmp 0x18011094f
mov rbp, rbx
cmp word [rax], si
je 0x1801108b1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180110898
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180110894
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18011077c
movsxd r14, eax
test eax, eax
jne 0x1801108ef
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180110885
mov rcx, r14
call fcn.18010e144
mov rdi, rax
test rax, rax
jne 0x180110908
xor ecx, ecx
call fcn.18010cad0
jmp 0x1801108e4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18011077c
test eax, eax
jne 0x180110939
mov rcx, rdi
call fcn.18010cad0
jmp 0x180110943
xor ecx, ecx
call fcn.18010cad0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x180113990
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1801139b8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1801139b8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001000
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x288
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareAlpsApointUSBMouseExceptions
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001129
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0x298], rbp
mov qword [rsp + 0x2a0], rsi
mov qword [rsp + 0x2a8], rdi
xor ebp, ebp
mov qword [rsp + 0x280], r12
lea r12, [0x140017420]
mov esi, ebp
mov ebx, ebp
mov rdi, r12
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x4c]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x44]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov edx, esi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x48], 0x208
mov dword [rsp + 0x4c], 4
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1400010f0
cmp dword [rsp + 0x40], 4
jne 0x1400010e3
mov eax, dword [rsp + 0x44]
add ebx, 1
add rdi, 4
mov dword [rdi - 4], eax
add esi, 1
cmp ebx, 0x100
jb 0x140001080
jmp 0x1400010f6
mov eax, ebx
mov dword [r12 + rax*4], ebp
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, qword [rsp + 0x280]
mov rdi, qword [rsp + 0x2a8]
mov rsi, qword [rsp + 0x2a0]
mov rbp, qword [rsp + 0x298]
mov rbx, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140003f10
add rsp, 0x288
ret

Function at 0x140001a20
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x288
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareAlpsApointUSBMouse
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001b3f
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0x298], rbp
xor ebp, ebp
mov qword [rsp + 0x2a0], rsi
mov qword [rsp + 0x280], rdi
mov dword [0x140017820], ebp
mov ebx, ebp
nop
nop
nop
nop
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov edx, ebx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x48], 0x208
mov dword [rsp + 0x44], 4
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea rsi, str.BluetoothMouseEnable
lea rdi, [rsp + 0x60]
mov ecx, 0x15
repe cmpsw word [rsi], word [rdi]
je 0x140001b0a
add ebx, 1
cmp ebx, 7
jb 0x140001aa0
jmp 0x140001b14
mov eax, dword [rsp + 0x40]
mov dword [0x140017820], eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x280]
mov rsi, qword [rsp + 0x2a0]
mov rbp, qword [rsp + 0x298]
mov rbx, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140003f10
add rsp, 0x288
ret
Function at 0x140001ba0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0x30]
xor edi, edi
mov edx, 0x104
mov rbx, rdi
mov dword [rsp + 0x20], 0x5c
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r11, [rsp + 0x30]
test r11, r11
je 0x140001c1e
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x208
call fcn.140004630
lea r8, str.kernel32.dll
lea rcx, [rsp + 0x30]
mov edx, 0x208
call fcn.140004630
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rbx, rbx
mov qword [0x1400179a8], rbx
jne 0x140001c2e
xor eax, eax
jmp 0x140001c4e
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400179c8], rax
setne dil
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140003f10
mov rbx, qword [rsp + 0x260]
add rsp, 0x250
pop rdi
ret

Function at 0x140001f80
Capabilities:
Get session information
Get session user name

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
call qword [0x1400179c8]
lea r9, [rsp + 0x58]
mov edi, eax
lea rax, [rsp + 0x50]
lea r8d, [rbx + 8]
mov edx, edi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
lea r9, [rsp + 0x60]
lea r8d, [rbx + 5]
mov esi, eax
lea rax, [rsp + 0x50]
mov edx, edi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x140002005
test esi, esi
mov r8, qword [rsp + 0x60]
je 0x140001ffd
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x140001ffd
mov rdx, qword [rsp + 0x58]
mov eax, 1
cmp dword [rdx], ebx
cmove ebx, eax
mov rcx, r8
call sub.WTSAPI32.dll_WTSFreeMemory
test esi, esi
je 0x140002013
mov rcx, qword [rsp + 0x58]
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x140002020
Capabilities:
Get session information

Disassembly:
sub rsp, 0x48
cmp dword [0x1400164b8], 0
jne 0x140002034
xor eax, eax
add rsp, 0x48
ret
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x40], rbp
xor ebp, ebp
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
mov ebx, ebp
call qword [0x1400179c8]
lea r9, [rsp + 0x58]
lea r8d, [rbp + 8]
mov edi, eax
lea rax, [rsp + 0x50]
xor ecx, ecx
mov edx, edi
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
lea r9, [rsp + 0x60]
lea r8d, [rbp + 5]
mov esi, eax
lea rax, [rsp + 0x50]
mov edx, edi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x1400020c7
test esi, esi
mov rdx, qword [rsp + 0x60]
je 0x1400020bf
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x1400020bf
mov rax, qword [rsp + 0x58]
mov ecx, 1
cmp dword [rax], ebx
cmove ebx, ecx
mov rcx, rdx
call sub.WTSAPI32.dll_WTSFreeMemory
mov rdi, qword [rsp + 0x30]
test esi, esi
mov rsi, qword [rsp + 0x38]
je 0x1400020df
mov rcx, qword [rsp + 0x58]
call sub.WTSAPI32.dll_WTSFreeMemory
mov ecx, dword [0x1400164b8]
cmp ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x68]
cmove ecx, ebp
mov rbp, qword [rsp + 0x40]
mov dword [0x1400164b8], ecx
add rsp, 0x48
ret
Function at 0x1400030e0
Capabilities:
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor esi, esi
lea rcx, [rsp + 0x60]
mov edx, 0x104
mov ebx, esi
mov rdi, rsi
mov dword [rsp + 0x30], 0x5c
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r11, [rsp + 0x60]
test r11, r11
je 0x140003165
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x60]
mov edx, 0x208
call fcn.140004630
lea r8, str.VXDIF.DLL
lea rcx, [rsp + 0x60]
mov edx, 0x208
call fcn.140004630
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rdi, rdi
mov qword [0x1400179a0], rdi
je 0x14000331c
lea rdx, str.IOCTL_SetTouchPadDisable
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400179a0]
lea rdx, str.Alps_DisableTouchpad
mov qword [0x1400179d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400179a0]
lea rdx, str.Alps_MouseGetInitStatus
mov qword [0x1400179d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1400179d8], rbx
mov qword [0x1400179e0], rax
je 0x1400031df
cmp qword [0x1400179d0], rbx
je 0x1400031df
mov ecx, 1
test rax, rax
cmovne ebx, ecx
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREAlpsApoint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400032a4
lea rax, [rsp + 0x48]
lea rdx, str.SOFTWAREAlpsApoint
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000327d
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
lea rdx, str.SupportI2CToPS2Switch
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREAlpsApoint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x50]
lea rdx, str.SupportI2CToPS2Switch
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x1400032e4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, esi
jmp 0x1400032ef
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11d, dword [rsp + 0x40]
test r11d, r11d
mov dword [0x1400179b8], r11d
je 0x14000331c
mov rcx, qword [0x1400179a0]
lea rdx, str.IOCTL_SetPS2Mode
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400179e8], rax
cmove ebx, esi
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140003f10
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140003670
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rsp + 0x440], rax
lea r8, str.HomeDirectory
lea rdx, str.SOFTWAREAlpsApoint
mov rcx, 0xffffffff80000002
call fcn.140003da0
mov ebx, 0x104
lea rcx, [rsp + 0x230]
mov r8, rbx
movzx edx, word [rax]
test dx, dx
je 0x1400036d0
mov word [rcx], dx
add rcx, 2
add rax, 2
sub r8, 1
jne 0x1400036b5
jmp 0x1400036d5
test r8, r8
jne 0x1400036d9
sub rcx, 2
mov word [rcx], 0
lea r8, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov rdx, rbx
lea rax, [rsp + 0x20]
sub r8, rcx
movzx ecx, word [r8 + rax]
test cx, cx
je 0x14000370f
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x1400036f6
jmp 0x140003714
test rdx, rdx
jne 0x140003718
sub rax, 2
mov word [rax], 0
mov rcx, rbx
lea rax, [rsp + 0x20]
cmp word [rax], 0
je 0x140003737
add rax, 2
sub rcx, 1
jne 0x140003725
jmp 0x140003787
test rcx, rcx
je 0x140003787
mov rax, rbx
mov rdx, rbx
sub rax, rcx
sub rdx, rax
lea rcx, [rsp + rax*2 + 0x20]
je 0x140003787
lea r8, str.ApClose.exe
sub r8, rcx
nop
nop
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140003779
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140003760
jmp 0x14000377e
test rdx, rdx
jne 0x140003782
sub rcx, 2
mov word [rcx], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140003826
lea r8, str.C:Program_FilesApoint2K
lea rcx, [rsp + 0x230]
mov rdx, rbx
sub r8, rcx
lea rax, [rsp + 0x230]
nop
nop
nop
movzx ecx, word [r8 + rax]
test cx, cx
je 0x1400037d9
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x1400037c0
jmp 0x1400037de
test rdx, rdx
jne 0x1400037e2
sub rax, 2
lea rdx, str.C:Program_FilesApoint2KApClose.exe
lea rcx, [rsp + 0x20]
mov word [rax], 0
sub rdx, rcx
lea rax, [rsp + 0x20]
nop
nop
movzx ecx, word [rdx + rax]
test cx, cx
je 0x140003818
mov word [rax], cx
add rax, 2
sub rbx, 1
jne 0x140003800
jmp 0x14000381d
test rbx, rbx
jne 0x140003821
sub rax, 2
mov word [rax], 0
lea r8, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r9d, 1
xor edx, edx
call fcn.140003a60
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140003f10
add rsp, 0x450
pop rbx
ret