joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001b5a0
Capabilities:
Create thread
Get system information on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
movzx esi, r8b
mov rdi, rdx
mov rbp, rcx
test rdx, rdx
je 0x14001b727
cmp r8b, 1
jne 0x14001b694
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp byte [0x14017ac3e], 0
jne 0x14001b62f
lea rcx, str.kernel32.dll
mov byte [0x14017ac3e], sil
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x14001b62f
lea rdx, str.GetProcessInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetProcessInformation
mov rcx, rbx
mov qword [0x14017ae00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14017adf8], rax
mov r8d, dword [rdi + 0x544]
xor edx, edx
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x14001b657
mov ebx, 1
mov eax, ebx
jmp 0x14001b729
mov edx, 9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor esi, esi
mov rcx, rdi
test eax, eax
setne sil
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, 1
mov rcx, rdi
test eax, eax
cmove esi, ebx
mov ebx, esi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x14001b729
mov ecx, InitCommonControls
call fcn.1400ff088
mov ecx, dword [rdi + 0x544]
lea r8, [0x140013a40]
mov rbx, rax
xor edx, edx
mov r9, rbx
mov dword [rax], ecx
mov dword [rax + 4], 9
mov ecx, dword [rbp + 0x3f60]
mov dword [rax + 8], ecx
xor ecx, ecx
mov byte [rax + 0xc], sil
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
xor esi, esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r8d, dword [rbx]
xor edx, edx
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14001b727
mov r8, qword [0x14017ad28]
lea r9, [0x140069bc0]
mov rcx, qword [0x14017ae30]
mov edx, 0x13b9
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14001d1c0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor r9d, r9d
mov dword [rsp + 0x40], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14017ac68], rax
xor r9d, r9d
lea r8, [0x14001d210]
xor edx, edx
lea rax, [rsp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x38
ret

Function at 0x14001d300
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor r9d, r9d
mov dword [rsp + 0x40], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14017abf0], rax
xor r9d, r9d
lea r8, [0x14001d350]
xor edx, edx
lea rax, [rsp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x38
ret

Function at 0x14001d3c0
Capabilities:
Terminate thread

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, qword [0x14017cbb0]
mov rcx, qword [rdi + 0x48a8]
test rcx, rcx
je 0x14001d44f
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, 0x7d0
lea rcx, [0x14001d460]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14001d40c
mov rcx, qword [rdi + 0x4898]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rdi + 0x4898]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x48a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x48a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov qword [rdi + 0x4898], rax
mov qword [rdi + 0x48a8], rax
mov qword [rdi + 0x48a0], rax
add rsp, 0x20
pop rdi
ret

Function at 0x140025680
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0xd90], 0
mov rbx, rcx
je 0x140025710
lea r9, str.Localcd03b843_b5ea_4c0e_a089_1fd6bf3e4c24
mov qword [rsp + 0x30], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0xd90]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400256e0
mov rcx, qword [rbx + 0xd90]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
test rdi, rdi
je 0x1400256ee
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0xd90]
mov rdi, qword [rsp + 0x30]
test rcx, rcx
je 0x140025705
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0xd90], 0
add rsp, 0x20
pop rbx
ret
Function at 0x140026970
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x68
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x20], 0x40
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x1400269db
mov rcx, qword [rsp + 0x28]
xorps xmm0, xmm0
test rcx, rcx
js 0x1400269b6
cvtsi2sd xmm0, rcx
jmp 0x1400269cb
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mulsd xmm0, qword [0x140153300]
movsd qword [0x14017abd8], xmm0
add rsp, 0x68
ret
Function at 0x1400379b0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x310
cmp byte [0x140173ca7], 0
xorps xmm0, xmm0
xorps xmm1, xmm1
mov qword [rsp + 0x84], 0
movdqu xmmword [rsp + 0x54], xmm0
mov rbx, rcx
mov dword [rsp + 0x50], 0x3c
movdqu xmmword [rsp + 0x64], xmm1
movdqu xmmword [rsp + 0x74], xmm0
jne 0x140037a32
mov rcx, qword [rcx + 0x728]
lea rdx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetWindowInfo]
test eax, eax
je 0x140037a32
mov eax, dword [rsp + 0x74]
lea r9, str.WindowState
and eax, 0x1000000
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff80000001
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x20], eax
call fcn.140088930
lea rax, [rsp + 0x328]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SoftwareProcessLasso
lea rax, [rsp + 0x330]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140037b7f
mov rcx, qword [rbx + 0x728]
lea rdx, [rsp + 0x90]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rbx + 0x868]
mov edx, 4
lea rax, [rsp + 0xa0]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x140037ab0
movups xmm0, xmmword [rcx]
lea r9d, [rdx + 3]
mov dword [rsp + 0x28], 0x274
movups xmm1, xmmword [rcx + 0x10]
xor r8d, r8d
lea rdx, str.windowdata
movups xmmword [rax], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
mov rcx, qword [rsp + 0x330]
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm1
lea rax, [rsp + 0x90]
mov dword [rsp + 0x300], 0x9e39
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x330]
test eax, eax
je 0x140037b8a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
add rsp, 0x310
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add rsp, 0x310
pop rbx
ret
Function at 0x140038270
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xa00
mov rbp, qword [0x14017ae30]
movzx edi, r8b
movzx esi, dl
mov rbx, rcx
call fcn.1400379b0
mov rcx, rbx
call fcn.14003b720
call fcn.1400bcce0
test al, al
je 0x140038306
test sil, sil
jne 0x140038306
test dil, dil
jne 0x1400382fc
mov r9d, 0x2ff
lea r8, [rsp + 0x400]
mov edx, 0x6c
mov rcx, rbp
call fcn.140085d00
mov rdx, rax
lea r8, str.Process_Lasso
lea rax, [0x140174690]
mov r9d, 0x1001024
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.1400c17c0
cmp ax, 6
jne 0x140038306
call fcn.1400351e0
call fcn.14000f980
cmp byte [rbx + 0x3f20], 0
je 0x140038314
call fcn.140009a00
cmp byte [0x14017ab18], 1
jne 0x140038372
cmp dword [0x14017ab48], 1
jb 0x140038372
mov rax, qword [rbx + 0x458]
lea r9, str.KeepRunningEndTime
lea r8, str.SoftwareProcessLasso
mov qword [rsp + 0x20], rax
mov rdx, 0xffffffff80000001
call fcn.140088f60
mov eax, dword [0x14017ab48]
lea r9, str.KeepRunningInitialMinutes
lea r8, str.SoftwareProcessLasso
mov dword [rsp + 0x20], eax
mov rdx, 0xffffffff80000001
call fcn.140088930
jmp 0x1400383a6
lea r9, str.KeepRunningEndTime
mov rdx, 0xffffffff80000001
lea r8, str.SoftwareProcessLasso
call fcn.140088840
lea r9, str.KeepRunningInitialMinutes
mov rdx, 0xffffffff80000001
lea r8, str.SoftwareProcessLasso
call fcn.140088840
call fcn.14000bfd0
cmp al, 1
jne 0x1400383d1
call fcn.14000c0e0
cmp al, 1
jne 0x1400383d1
movzx r8d, al
lea rdx, str.PerformanceModeState
lea rcx, [0x14017c4f0]
call fcn.140073e30
jmp 0x1400383e4
lea rdx, str.PerformanceModeState
lea rcx, [0x14017c4f0]
call fcn.140074480
mov rcx, qword [rbx + 0x770]
call fcn.140072c10
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x3d0
call fcn.14012ce40
mov rax, qword [0x14017ad68]
lea rdx, [rsp + 0x30]
mov ecx, 2
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x3d0
mov dword [rsp + 0x40], 0x9317
mov dword [rsp + 0x48], 0x401
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140038450
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x58
mov rdi, qword [0x14017cbb0]
movzx ebx, dl
xor edx, edx
mov rcx, qword [rdi + 0x728]
call qword [sym.imp.USER32.dll_ShowWindow]
test bl, bl
je 0x140038480
mov rcx, rdi
call fcn.14003b720
cmp byte [0x14017ab46], 0
jne 0x1400385d4
test bl, bl
je 0x1400385d4
xor ebx, ebx
lea rax, [rsp + 0x88]
xor r8d, r8d
mov dword [rsp + 0x78], ebx
lea rdx, str.SoftwareProcessLasso
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
lea r9d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003851c
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x80]
lea rax, [rsp + 0x78]
mov dword [rsp + 0x70], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SysTrayGreetingDone
mov dword [rsp + 0x80], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x78], ebx
jne 0x1400385cd
mov rcx, qword [rdi + 0x730]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x41b
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [rsp + 0x80]
mov dword [rsp + 0x70], 1
mov qword [rsp + 0x40], rax
lea rdx, str.SoftwareProcessLasso
lea rax, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400385cd
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 4
lea rdx, str.SysTrayGreetingDone
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [0x14017ab46], 1
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x140038780
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
mov eax, 0x1830
call fcn.1400ff8d0
sub rsp, rax
mov rdi, rcx
mov rsi, qword [0x14017ae30]
test dl, dl
jne 0x140038862
xor ebx, ebx
mov word [rsp + 0x30], bx
mov r9d, 0x3ff
lea r8, [rsp + 0x30]
mov edx, 0x20d
mov rcx, rsi
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14003881d
cmp byte [0x1401776f0], bl
je 0x1400387ee
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x1401776f0], bl
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r9d, 0x3ff
lea r8, [rsp + 0x30]
mov edx, 0x20d
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14003881d
mov word [rsp + 0x30], bx
lea rax, [0x140174690]
mov qword [rsp + 0x20], rax
mov r9d, 0x1000024
lea r8, str.Process_Lasso
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 0x728]
call fcn.1400c17c0
cmp ax, 6
je 0x140038862
lea r11, [rsp + 0x1830]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
lea rcx, [rsp + 0x830]
call fcn.14007cdf0
lea rcx, [rsp + 0x1858]
call fcn.1400055e0
nop
lea rcx, [rsp + 0x1850]
call fcn.1400055e0
nop
lea rdx, [rsp + 0x830]
lea rcx, [rsp + 0x1858]
call fcn.140005550
lea rdx, [rsp + 0x1030]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, str._showwindow
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
lea r9, str._restart
lea r8, [rsp + 0x830]
lea rdx, str.__s___s_d__s
lea rcx, [rsp + 0x1850]
call fcn.140005d70
lea rcx, [rsp + 0x1850]
cmp byte [0x14017ac1e], 0
jne 0x140038927
call fcn.1400056b0
mov rbx, rax
lea rcx, [rsp + 0x1858]
call fcn.1400056b0
mov rcx, rax
lea r8, [rsp + 0x1030]
mov rdx, rbx
call fcn.14007e110
jmp 0x140038947
call fcn.1400056b0
mov rdx, rax
lea rcx, [rsp + 0x1858]
call fcn.140005690
mov rcx, rax
xor r8d, r8d
call fcn.14007e250
test rax, rax
jne 0x140038983
mov r9d, 0x3ff
lea r8, [rsp + 0x30]
mov edx, 0x218
mov rcx, rsi
call fcn.140085d00
mov rdx, rax
mov r9d, InitCommonControls
lea r8, str.Process_Lasso
mov rcx, qword [rdi + 0x728]
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x14003898b
mov rcx, rax
call fcn.14007b3d0
mov r8b, 1
xor edx, edx
mov rcx, rdi
call fcn.140038270
int3
Function at 0x1400389a0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x1830
call fcn.1400ff8d0
sub rsp, rax
mov rdi, qword [0x14017ada0]
mov rsi, qword [0x14017ae30]
lea rcx, [rsp + 0x30]
call fcn.14007cdf0
lea rcx, [rsp + 0x1850]
call fcn.1400055e0
nop
lea rcx, [rsp + 0x1840]
call fcn.1400055e0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x1850]
call fcn.140005550
lea rdx, [rsp + 0x830]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, str._showwindow
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
lea r9, str._restart
lea r8, [rsp + 0x30]
lea rdx, str.__s___s_d__s
lea rcx, [rsp + 0x1840]
call fcn.140005d70
lea rcx, [rsp + 0x1840]
cmp byte [0x14017ac1e], 0
jne 0x140038a87
call fcn.1400056b0
mov rbx, rax
lea rcx, [rsp + 0x1850]
call fcn.1400056b0
mov rcx, rax
lea r8, [rsp + 0x830]
mov rdx, rbx
call fcn.14007e110
jmp 0x140038aaa
call fcn.1400056b0
mov rbx, rax
lea rcx, [rsp + 0x1850]
call fcn.1400056b0
mov rcx, rax
xor r8d, r8d
mov rdx, rbx
call fcn.14007e250
test rax, rax
jne 0x140038ae9
mov r9d, 0x3ff
lea r8, [rsp + 0x1030]
mov edx, 0x218
mov rcx, rsi
call fcn.140085d00
mov rdx, rax
mov r9d, InitCommonControls
lea r8, str.Process_Lasso
mov rcx, qword [rdi + 0x728]
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140038af2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov dl, 1
mov rcx, rdi
call fcn.140038270
int3
Function at 0x140039570
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea rax, [rsp + 0x60]
mov dword [rsp + 0x68], edx
mov qword [rsp + 0x40], rax
lea rdx, str.SoftwareProcessLasso
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
xor eax, eax
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400395fa
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 4
lea rdx, str.UpperTabView
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x58
ret
Function at 0x14003b510
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov dword [rsp + 0x40], 0
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003b599
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x48], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.GUIColorScheme
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x58]
test eax, eax
je 0x14003b5a0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x38
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret

Function at 0x14003b720
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
movsxd rdx, dword [0x14017ab58]
lea rdi, [0x140000000]
mov r9d, 9
mov rbx, rcx
movzx eax, byte [rdx + rdi + 0x173c80]
mov byte [rsp + 0x30], al
lea r8d, [r9 + 0x16]
mov dword [rsp + 0x28], edx
lea rax, str.AllProcesses
mov rdx, qword [rcx + 0x740]
mov qword [rsp + 0x20], rax
call fcn.140038bc0
movsxd rcx, dword [0x14017ac18]
mov r9d, 6
mov rdx, qword [rbx + 0x7a0]
movzx eax, byte [rcx + rdi + 0x173e88]
lea r8d, [r9 + 9]
mov byte [rsp + 0x30], al
lea rax, str.ActiveProcesses
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
call fcn.140038bc0
movsxd rcx, dword [0x14017bdb0]
mov r9d, 3
mov rdx, qword [rbx + 0x748]
movzx eax, byte [rcx + rdi + 0x1742e8]
lea r8d, [r9 + 7]
mov byte [rsp + 0x30], al
lea rax, str.LogLV
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
call fcn.140038bc0
movzx r8d, byte [rbx + 0x121]
lea rdx, str.TreeViewMode
lea rcx, [0x14017c4f0]
call fcn.140073e30
mov r8, qword [0x14017ada0]
lea rdx, str.ActiveProcessesSensitivity
lea rcx, [0x14017c4f0]
mov r8d, dword [r8 + 0x4750]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
jmp fcn.140073ea0

Function at 0x14003b850
Capabilities:
Set registry value

Disassembly:
movzx r8d, dl
lea rcx, [0x14017c4f0]
lea rdx, str.HideGraph
jmp fcn.140073e30
Function at 0x14003d5d0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov r10, rdx
mov r9, rcx
movzx r8d, byte [rdx]
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rcx, 0x100000001b3
imul r8, rcx
movzx eax, byte [rdx + 1]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 2]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 3]
xor r8, rax
imul r8, rcx
mov rdx, qword [r9 + 0x30]
and rdx, r8
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov rbx, qword [rdx + 8]
lea rcx, [r9 + 8]
cmp rbx, qword [rcx]
je 0x14003d65b
mov r8, qword [rdx]
mov eax, dword [r10]
cmp eax, dword [rbx + 0x10]
je 0x14003d65d
cmp rbx, r8
je 0x14003d657
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x14003d643
lea rcx, [r9 + 8]
jmp 0x14003d65d
lea rcx, [r9 + 8]
xor ebx, ebx
test rbx, rbx
je 0x14003d6d6
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x14003d686
cmp rax, rbx
jne 0x14003d67c
mov rax, qword [rcx]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x14003d691
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x14003d691
cmp rax, rbx
jne 0x14003d691
mov rax, qword [rbx]
mov qword [rdx], rax
mov rcx, qword [rbx]
dec qword [r9 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
lea rax, [rbx + 0x10]
mov qword [rsp + 0x30], rax
lea rcx, [rax + 8]
mov qword [rsp + 0x40], rcx
call fcn.140025930
mov edx, 0x58
mov rcx, rbx
call fcn.1400ff054
mov eax, 1
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14003d710
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov r10, rdx
mov r9, rcx
movzx r8d, byte [rdx]
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rcx, 0x100000001b3
imul r8, rcx
movzx eax, byte [rdx + 1]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 2]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 3]
xor r8, rax
imul r8, rcx
mov rdx, qword [r9 + 0x30]
and rdx, r8
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov rbx, qword [rdx + 8]
lea rcx, [r9 + 8]
cmp rbx, qword [rcx]
je 0x14003d79b
mov r8, qword [rdx]
mov eax, dword [r10]
cmp eax, dword [rbx + 0x10]
je 0x14003d79d
cmp rbx, r8
je 0x14003d797
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x14003d783
lea rcx, [r9 + 8]
jmp 0x14003d79d
lea rcx, [r9 + 8]
xor ebx, ebx
test rbx, rbx
je 0x14003d816
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x14003d7c6
cmp rax, rbx
jne 0x14003d7bc
mov rax, qword [rcx]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x14003d7d1
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x14003d7d1
cmp rax, rbx
jne 0x14003d7d1
mov rax, qword [rbx]
mov qword [rdx], rax
mov rcx, qword [rbx]
dec qword [r9 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
lea rax, [rbx + 0x10]
mov qword [rsp + 0x30], rax
lea rcx, [rax + 8]
mov qword [rsp + 0x40], rcx
call fcn.140048e20
mov edx, 0x58
mov rcx, rbx
call fcn.1400ff054
mov eax, 1
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14003d920
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov r11, rdx
mov r10, rcx
movzx r8d, byte [rdx]
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rcx, 0x100000001b3
imul r8, rcx
movzx eax, byte [rdx + 1]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 2]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 3]
xor r8, rax
imul r8, rcx
mov rdx, qword [r10 + 0x30]
and rdx, r8
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov rcx, qword [rdx + 8]
lea r8, [r10 + 8]
cmp rcx, qword [r8]
je 0x14003d9a9
mov r9, qword [rdx]
mov eax, dword [r11]
cmp eax, dword [rcx + 0x10]
je 0x14003d9ab
cmp rcx, r9
je 0x14003d9a5
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x14003d991
lea r8, [r10 + 8]
jmp 0x14003d9ab
lea r8, [r10 + 8]
xor ecx, ecx
test rcx, rcx
je 0x14003da09
mov rax, qword [rdx]
cmp qword [rdx + 8], rcx
jne 0x14003d9d4
cmp rax, rcx
jne 0x14003d9ca
mov rax, qword [r8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x14003d9df
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
jmp 0x14003d9df
cmp rax, rcx
jne 0x14003d9df
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
dec qword [r10 + 0x10]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x20
call fcn.1400ff054
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret