joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b774
Capabilities:
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x130
mov rax, qword [0x14006bbc0]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rbx, rcx
call fcn.14000b344
test eax, eax
je 0x14000b87d
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
jne 0x14000b7e0
lea r8, [rbx + 0x50]
lea rdx, str.Couldnt_open_service_manager
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x14000b882
lea rbp, [rbx + 0x50]
mov r8d, 0x10
mov rcx, rax
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x14000b813
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r8, rbp
lea rdx, str.Couldnt_open_service
jmp 0x14000b7ce
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
xor ebx, ebx
mov r12d, eax
test eax, eax
jne 0x14000b832
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r12d, r12d
jne 0x14000b87d
cmp ebx, 0x420
je 0x14000b87d
lea r8, str.Service_could_not_be_started__LastError_d
lea rcx, [rsp + 0x20]
mov r9d, ebx
mov edx, 0x100
call fcn.1400253f4
mov r9d, 0x10010
mov r8, rbp
lea rdx, [rsp + 0x20]
jmp 0x14000b7d1
mov eax, 1
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140025570
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret

Function at 0x14000bda4
Capabilities:
Access the windows event log

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
sub rsp, 0x170
mov rax, qword [0x14006bbc0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
mov r8, rdx
lea r9, [r11 + 0x18]
lea rcx, [rsp + 0x60]
mov edx, 0x100
call fcn.140027480
cmp dword [rbx + 0x178], 0
lea r11, [rsp + 0x60]
mov qword [rsp + 0x50], r11
je 0x14000be53
lea rdx, str.S7TraceServiceX.exe
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov rbx, rax
test rax, rax
je 0x14000be5d
xor r8d, r8d
mov ecx, 1
lea rax, [rsp + 0x50]
and qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], r8d
mov word [rsp + 0x28], cx
and qword [rsp + 0x20], r8
lea edx, [rcx + 3]
mov rcx, rbx
mov r9d, 0xc0001024
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x14000be5d
lea rcx, [rsp + 0x60]
call fcn.140027860
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140025570
add rsp, 0x170
pop rbx
ret
Function at 0x14000c828
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
xor edi, edi
mov rbx, r8
mov rbp, rdx
mov r12, rcx
cmp r8, rdi
jne 0x14000c856
lea eax, [rdi + 0xd]
jmp 0x14000c88d
mov rsi, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov ecx, eax
add edi, eax
add rsi, rcx
cmp eax, 1
jne 0x14000c859
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x14000d1e8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x14006bbc0]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rdi, rcx
mov rcx, qword [rcx]
lea rax, [rsp + 0x58]
xor r8d, r8d
or r9d, 0x2001f
mov rsi, rdx
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
cmp eax, ebp
jne 0x14000d2ed
mov ebx, ebp
cmp rcx, rbp
je 0x14000d25e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x50], ebp
cmp ebx, ebp
mov qword [rsp + 0x48], rcx
jmp 0x14000d288
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14000d1e8
mov rcx, qword [rsp + 0x48]
mov ebx, eax
cmp eax, ebp
jne 0x14000d2ed
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, ebp
je 0x14000d270
mov rcx, qword [rsp + 0x48]
cmp rcx, rbp
je 0x14000d2d6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov rcx, qword [rdi]
mov rdx, rsi
mov dword [rsp + 0x50], ebp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
cmp rcx, rbp
je 0x14000d2f8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140025570
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000ee68
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x140097464], eax
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
and qword [rsp + 0x68], 0
and qword [rsp + 0x70], 0
and qword [rsp + 0x78], 0
mov ebp, 1
mov r8d, ebp
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.14000eca4
and qword [rsp + 0x40], 0
and dword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
xor eax, eax
mov rbx, qword [0x140097338]
test rbx, rbx
je 0x14000ef35
cmp qword [rbx], rax
je 0x14000ef35
test eax, eax
jne 0x14000ef49
mov r8d, ebp
lea edx, [rax + 0x14]
mov rcx, rbx
call fcn.14000a85c
add rbx, 0x48
cmp qword [rbx], 0
jne 0x14000ef15
test eax, eax
jne 0x14000ef49
mov r8d, ebp
mov edx, 0x14
lea rcx, [0x140099200]
call fcn.14000ac58
lea r9, str.DISPATCHER_START_SYNC_EVENT
xor r8d, r8d
mov edx, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x1400922b0], rax
lea r9, str.DISPATCHER_STOP_SYNC_EVENT
xor r8d, r8d
mov edx, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x14006ee48], rax
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400099a4]
call fcn.1400260cc
mov dword [0x140097090], eax
mov edx, 2
mov rcx, rdi
call fcn.14000b600
or edx, 0xffffffff
mov rcx, qword [0x1400922b0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, str.Service_started
mov rcx, rdi
call fcn.14000bda4
cmp dword [rdi + 0x178], 0
je 0x14000efd8
mov edx, 4
mov rcx, rdi
call fcn.14000b600
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x14000f01a
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_DispatchMessageA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x14000eff2
lea rcx, [0x1400972f0]
call fcn.14000bc2c
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov rcx, qword [rsp + 0x58]
call fcn.140024990
mov rcx, qword [rsp + 0x60]
call fcn.140025e6c
mov rcx, qword [rsp + 0x68]
call fcn.140025e6c
mov rcx, qword [rsp + 0x70]
call fcn.140025e6c
mov rcx, qword [rsp + 0x78]
call fcn.140025e6c
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140010890
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x60
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov ebp, r8d
mov r12d, edx
mov rsi, rcx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x140010a3f
mov rcx, rsi
call fcn.14000b51c
mov r11, qword [rsi]
xor r9d, r9d
lea edx, [r9 + 0x64]
lea r8d, [r9 + 1]
mov rcx, rsi
call qword [r11 + 0x40]
nop
and qword [rsp + 0x88], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.AppID
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140010921
jmp 0x140010a3f
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.46B003F9_4C3F_46A7_BA61_E8BCE22BFFCD
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test eax, eax
je 0x140010975
cmp qword [rsp + 0x88], 0
je 0x14001096e
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x140010a3f
lea rdx, str.LocalService
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test ebp, ebp
je 0x1400109fe
lea rbp, [0x140058d70]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
mov r9d, 1
xor r8d, r8d
lea rdx, str.LocalService
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rbp, str._Service
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
mov r9d, 1
xor r8d, r8d
lea rdx, str.ServiceParameters
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rsi
call fcn.14000b3b0
xor r8d, r8d
mov edx, r12d
mov rcx, rsi
call fcn.140010714
mov esi, eax
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
test rdi, rdi
je 0x140010a24
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rsp + 0x88], 0
je 0x140010a3d
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r12
ret
Function at 0x140010aa8
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x14006bbc0]
xor rax, rsp
mov qword [rsp + 0x260], rax
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
cmp dword [rcx + 0x178], 0
lea rax, [rcx + 0x50]
mov rbx, rcx
mov qword [rsp + 0x38], rax
lea rax, [0x140010534]
mov qword [rsp + 0x40], rax
je 0x140010b05
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x140010b05
and dword [rbx + 0x178], eax
cmp dword [rbx + 0x178], 0
jne 0x140010b98
mov edx, 2
mov rcx, rbx
call fcn.14000b600
and dword [rbx + 0x164], 0
and dword [rbx + 0x16c], 0
and dword [rbx + 0x170], 0
mov rcx, rbx
call fcn.14000ee68
mov edx, 1
mov rcx, rbx
call fcn.14000b600
lea rdx, str.Service_stopped
mov rcx, rbx
call fcn.14000bda4
lea r8, str.Start:_zur
lea rcx, [rsp + 0x60]
mov edx, 0x200
call fcn.1400253f4
lea rcx, [rsp + 0x60]
call fcn.140025290
mov rcx, qword [0x140097028]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140025570
add rsp, 0x270
pop rbx
ret
Function at 0x140020cfc
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0xb8
mov rax, qword [0x14006bbc0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
lea r8, str.GlobalS7TRACEENGINE_MUTEX
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x1400991e8], rax
test rax, rax
je 0x140020d37
mov eax, 1
jmp 0x140020d63
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.ERROR:_Cant_create_S7TRC_MUTEX__GetLastError___d__n
lea rcx, [rsp + 0x20]
mov r9d, eax
mov edx, 0x80
call fcn.1400253f4
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140025570
add rsp, 0xb8
ret

Function at 0x1400210d4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov dword [r11 + 0x18], r8d
xor ebx, ebx
mov byte [rdx], bl
mov qword [r11 - 0x10], rax
mov qword [r11 - 0x18], rdx
mov rdx, rcx
mov rcx, qword [0x1400991d0]
lea r9, [r11 + 0x10]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x140021119
cmp dword [rsp + 0x50], ebx
je 0x140021119
cmp dword [rsp + 0x48], 1
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140021c48
Capabilities:
Print debug messages
Write file on windows

Disassembly:
sub rsp, 0x28
mov r9, rcx
lea r8, str.E__s
lea rcx, [0x140098350]
mov edx, 0x170
call fcn.1400253f4
lea rdx, [0x140098350]
mov ecx, eax
add rsp, 0x28
jmp fcn.140021800
Function at 0x14002abe8
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14002abfe
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14002ac00
xor eax, eax
test eax, eax
je 0x14002ac10
mov ecx, eax
call fcn.1400287ec
or eax, 0xffffffff
jmp 0x14002ac12
xor eax, eax
add rsp, 0x28
ret

Function at 0x140032db7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14006bbc0]
jne 0x14002558a
rol rcx, 0x10
test cx, 0xffff
jne 0x140025586
repz ret
ror rcx, 0x10
jmp 0x140032d10
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400997b0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1400998a8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140032d95
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400997b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140032db7
mov rax, qword [rsp + 0x88]
mov qword [0x1400998a8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140099848], rax
mov rax, qword [0x1400998a8]
mov qword [0x140099720], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140099830], rax
mov dword [0x140099710], 0xc0000409
mov dword [0x140099714], 1
mov rax, qword [0x14006bbc0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14006bbc8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400997a8], eax
mov ecx, 1
call fcn.140035624
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14005d010]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400997a8], 0
jne 0x140032e3e
mov ecx, 1
call fcn.140035624
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x140034f4c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140034dc0
Function at 0x140034f58
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140040890
nop
cmp dword [0x140099d18], 1
je 0x140034ef8
mov dword [0x140099d14], 1
mov byte [0x140099d10], r12b
test ebx, ebx
jne 0x140034ee4
mov rcx, qword [0x14009b818]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140034ed1
mov rcx, qword [0x14009b810]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140034e70
call fcn.140033744
cmp qword [rdi], rax
jne 0x140034e70
jmp 0x140034e56
cmp rdi, rsi
jb 0x140034ed1
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140033744
mov qword [rdi], rax
call rbx
mov rcx, qword [0x14009b818]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x14009b810]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140034eaf
cmp r13, rax
je 0x140034ecf
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140034e56
lea rdx, [0x1400566f8]
lea rcx, [0x1400566e0]
call fcn.140034c10
lea rdx, [0x140056708]
lea rcx, [0x140056700]
call fcn.140034c10
nop
test r12d, r12d
je 0x140034f07
mov ecx, 8
call fcn.140040770
test r12d, r12d
jne 0x140034f32
mov dword [0x140099d18], 1
lea ecx, [r12 + 8]
call fcn.140040770
mov ecx, r15d
call fcn.140034ba4
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140034dc0
Function at 0x140049438
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140033744
xor ebx, ebx
mov rdi, rax
cmp qword [0x14009a588], rbx
jne 0x14004953e
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140049613
lea rdx, [0x14005f138]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140049613
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14009a588], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14009a590], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14009a598], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14009a5a8], rax
test rax, rax
je 0x140049535
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14009a5a0], rax
jmp 0x140049545
mov rax, qword [0x14009a5a0]
jmp 0x14004954c
mov rax, qword [0x14009a5a0]
mov r11, qword [0x14009a5a8]
cmp rax, rdi
je 0x1400495b4
cmp r11, rdi
je 0x1400495b4
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14009a5a8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1400495b4
test rax, rax
je 0x1400495b4
call rsi
test rax, rax
je 0x1400495ae
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400495ae
test byte [rsp + 0x38], 1
jne 0x1400495b4
bts ebp, 0x15
jmp 0x1400495f2
mov rcx, qword [0x14009a590]
cmp rcx, rdi
je 0x1400495f2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400495f2
call rax
mov rbx, rax
test rax, rax
je 0x1400495f2
mov rcx, qword [0x14009a598]
cmp rcx, rdi
je 0x1400495f2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400495f2
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14009a588]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140049613
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140049615
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140001964
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor esi, esi
mov r14, r8
mov r15, rdx
mov rbx, rcx
test rcx, rcx
je 0x140001a11
mov rax, qword [rcx + 0x78]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140001a11
movzx edi, word [rcx + 0x28]
lea ecx, [rsi + 0x40]
mov edx, edi
call qword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov qword [r15], rax
test rax, rax
je 0x140001a20
mov rcx, qword [rbx + 0x78]
mov r9, r14
and qword [rsp + 0x20], rsi
mov r8d, edi
mov rdx, rax
call qword [sym.imp.KERNEL32.DLL_ReadFile]
mov esi, eax
test eax, eax
je 0x1400019e2
mov edx, dword [r14]
cmp edx, edi
je 0x140001a20
lea rbp, str.ERROR_kull_m_busylight_device_read_raw____device__u___u_byte_s__readed___u_wanted_n
jmp 0x1400019f4
lea rbp, str.ERROR_kull_m_busylight_device_read_raw____device__u__ReadFile__0x_08x__n
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, dword [rbx + 8]
mov edi, eax
mov r8d, edi
mov rcx, rbp
call fcn.14000be84
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.DLL_LocalFree]
and dword [r14], 0
mov qword [r15], rax
jmp 0x140001a20
mov edx, dword [rcx + 8]
lea rcx, str.ERROR_kull_m_busylight_device_read_raw____device__u__Invalid_Device_Busy_Handle_n
call fcn.14000be84
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140001ac0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r14, rdx
mov rsi, rcx
mov edx, Ordinal_69
mov r15d, r9d
mov edi, r8d
lea ecx, [rdx - 1]
call qword [sym.imp.KERNEL32.DLL_LocalAlloc]
xor r12d, r12d
mov rbx, rax
test rax, rax
je 0x140001c75
lea ebp, [r12 + 7]
cmp edi, ebp
jb 0x140001b1f
mov edx, edi
lea rcx, str.ERROR_kull_m_busylight_request_create___count_u__max_is_7__n
call fcn.14000be84
cmp edi, ebp
cmovb ebp, edi
mov r10d, r12d
mov edi, 1
test ebp, ebp
je 0x140001bab
lea r9, [r14 + 2]
movzx edx, byte [r9 - 2]
lea r8d, [r10*8]
lea ecx, [r8 + 2]
mov al, dl
or al, 0x10
movzx eax, al
test dl, 0xf0
cmove edx, eax
lea eax, [r8 + 1]
add r10d, edi
mov byte [rax + rbx], dl
mov al, byte [r9 - 1]
mov byte [rcx + rbx], al
lea ecx, [r8 + 3]
mov al, byte [r9]
lea r9, [r9 + 8]
mov byte [rcx + rbx], al
lea ecx, [r8 + 4]
mov al, byte [r9 - 7]
mov byte [rcx + rbx], al
lea ecx, [r8 + 5]
mov al, byte [r9 - 6]
mov byte [rcx + rbx], al
lea ecx, [r8 + 6]
mov al, byte [r9 - 5]
mov byte [rcx + rbx], al
lea ecx, [r8 + 7]
mov al, byte [r9 - 4]
mov byte [rcx + rbx], al
lea ecx, [r8 + 8]
mov al, byte [r9 - 3]
mov byte [rcx + rbx], al
cmp r10d, ebp
jb 0x140001b32
or word [rbx + 0x3d], 0xffff
lea rdx, [rbx + 1]
mov dword [rbx + 0x39], 0xff550404
movzx ecx, r12w
mov r8d, 0x3e
movzx eax, byte [rdx]
add rdx, rdi
add cx, ax
sub r8, rdi
jne 0x140001bc6
movzx eax, cx
mov byte [rbx + 0x40], cl
shr ax, 8
mov byte [rbx + 0x3f], al
jmp 0x140001c61
mov rcx, qword [rsi + 0x78]
mov ebp, r12d
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001c48
movzx r9d, word [rsi + 0x2a]
mov r8d, Ordinal_69
cmp r9d, r8d
jb 0x140001c37
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r12
mov rdx, rbx
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov ebp, eax
test eax, eax
jne 0x140001c57
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, dword [rsi + 8]
lea rcx, str.ERROR_kull_m_busylight_device_send_raw____device__u__WriteFile__0x_08x__n
mov r8d, eax
call fcn.14000be84
jmp 0x140001c57
mov edx, dword [rsi + 8]
lea rcx, str.ERROR_kull_m_busylight_device_send_raw____device__u__Size_is_not_valide__siz___u__max___u__n
call fcn.14000be84
jmp 0x140001c57
mov edx, dword [rsi + 8]
lea rcx, str.ERROR_kull_m_busylight_device_send_raw____device__u__Invalid_Device_Busy_Handle_n
call fcn.14000be84
and edi, ebp
test r15d, r15d
je 0x140001c6a
mov rsi, qword [rsi]
test rsi, rsi
jne 0x140001be3
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_LocalFree]
jmp 0x140001c78
mov edi, r12d
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r12
ret