joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009d50
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r14
push r15
sub rsp, 0x40
mov rbp, r9
mov r14, r8
mov rbx, rdx
mov rdi, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
call fcn.140009200
mov rcx, rax
test rax, rax
je 0x140009e59
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbx], rax
mov esi, 1
mov dword [rsp + 0x30], esi
mov rdi, qword [rdi]
mov ecx, esi
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
add eax, 0xffffff80
or ecx, eax
jge 0x140009dc5
lea edx, [rsi + 0x7f]
mov rcx, rbx
call fcn.140009ae0
mov r9, qword [rbx]
cmp dword [r9 - 0xc], 0x80
jl 0x140009e64
mov dword [r9 - 0x10], 0x80
mov rax, qword [rbx]
mov word [rax + 0x100], r15w
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x80
mov r8, qword [rsp + 0x80]
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movsxd rdi, eax
test eax, eax
js 0x140009e64
mov rcx, qword [rbx]
sub esi, dword [rcx - 8]
mov edx, dword [rcx - 0xc]
sub edx, edi
or esi, edx
jge 0x140009e2a
mov edx, edi
mov rcx, rbx
call fcn.140009ae0
mov rax, qword [rbx]
cmp edi, dword [rax - 0xc]
jg 0x140009e64
mov dword [rax - 0x10], edi
mov rax, qword [rbx]
mov word [rax + rdi*2], r15w
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
mov ecx, 0x80004005
call fcn.140008df0
nop
mov ecx, 0x80070057
call fcn.140008df0
int3

Function at 0x14000a2f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000a368
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14000a368
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x14000a355
nop
cmp rbx, rcx
jae 0x14000a368
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x14000a340
cmp rbx, rcx
jae 0x14000a368
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x14000a36a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140013db0
Capabilities:
Hash data using fnv

Disassembly:
movzx r9d, byte [r8]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov r11, rdx
movzx eax, byte [r8 + 1]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 7]
imul r9, rcx
xor r9, rax
imul r9, rcx
and rdx, r9
mov r9, qword [r10 + 8]
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, r9
je 0x140013e6e
mov rcx, qword [r8]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x140013e70
cmp rax, rdx
je 0x140013e6e
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x140013e51
test rax, rax
cmove rax, r9
mov qword [r11], rax
mov rax, r11
ret
xor eax, eax
test rax, rax
cmove rax, r9
mov qword [r11], rax
mov rax, r11
ret

Function at 0x140015bb0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rbx, rdx
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [rax + 1]
test edi, edi
js 0x140015c4f
mov rax, qword [rbx]
mov r9d, 1
mov r8d, dword [rax - 0xc]
sub r9d, dword [rax - 8]
sub r8d, edi
or r9d, r8d
jge 0x140015bf8
mov edx, edi
mov rcx, rbx
call fcn.140009ae0
mov rdx, qword [rbx]
mov r8d, edi
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor esi, esi
mov edi, eax
cmp eax, 0xffffffff
jne 0x140015c25
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140015c1c
mov eax, esi
jmp 0x140015c29
movsxd rdx, dword [rcx - 0xc]
call fcn.1400cdf38
test eax, eax
js 0x140015c4f
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x140015c4f
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x30]
mov word [rax + rcx*2], si
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80070057
call fcn.140008df0
int3
Function at 0x14001b890
Capabilities:
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rdx
push rdi
sub rsp, 0x20
movzx eax, byte [r11 + 0x11]
movabs rbx, 0x100000001b3
mov r10, qword [rcx + 0x40]
movabs rdi, 0xcbf29ce484222325
movzx r8d, dl
mov r9, rcx
xor r8, rdi
imul r8, rbx
xor r8, rax
movzx eax, byte [r11 + 0x12]
imul r8, rbx
xor r8, rax
movzx eax, byte [r11 + 0x13]
imul r8, rbx
xor r8, rax
movzx eax, byte [r11 + 0x14]
imul r8, rbx
xor r8, rax
movzx eax, byte [r11 + 0x15]
imul r8, rbx
xor r8, rax
movzx eax, byte [r11 + 0x16]
imul r8, rbx
xor r8, rax
movzx eax, byte [r11 + 0x17]
mov r11, qword [rcx + 0x28]
imul r8, rbx
xor r8, rax
mov rax, r10
imul r8, rbx
and rax, r8
mov r8, qword [r9 + 0x18]
add rax, rax
mov rcx, qword [r11 + rax*8 + 8]
cmp rcx, r8
je 0x14001b951
mov rax, qword [r11 + rax*8]
cmp rdx, qword [rcx + 0x10]
je 0x14001b953
nop
cmp rcx, rax
je 0x14001b951
mov rcx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
jne 0x14001b940
jmp 0x14001b953
xor ecx, ecx
test rcx, rcx
cmove rcx, r8
cmp rcx, r8
je 0x14001ba20
movzx eax, byte [rcx + 0x11]
movzx edx, byte [rcx + 0x10]
xor rdx, rdi
imul rdx, rbx
xor rdx, rax
movzx eax, byte [rcx + 0x12]
imul rdx, rbx
xor rdx, rax
movzx eax, byte [rcx + 0x13]
imul rdx, rbx
xor rdx, rax
movzx eax, byte [rcx + 0x14]
imul rdx, rbx
xor rdx, rax
movzx eax, byte [rcx + 0x15]
imul rdx, rbx
xor rdx, rax
movzx eax, byte [rcx + 0x16]
imul rdx, rbx
xor rdx, rax
movzx eax, byte [rcx + 0x17]
imul rdx, rbx
xor rdx, rax
imul rdx, rbx
and r10, rdx
add r10, r10
mov rax, qword [r11 + r10*8]
cmp qword [r11 + r10*8 + 8], rcx
jne 0x14001b9e7
cmp rax, rcx
jne 0x14001b9dc
mov qword [r11 + r10*8], r8
mov qword [r11 + r10*8 + 8], r8
jmp 0x14001b9f3
mov r8, qword [rcx + 8]
mov qword [r11 + r10*8 + 8], r8
jmp 0x14001b9f3
cmp rax, rcx
jne 0x14001b9f3
mov rax, qword [rcx]
mov qword [r11 + r10*8], rax
mov rdx, qword [rcx]
dec qword [r9 + 0x20]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400b56bc
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret
Function at 0x14001c6d0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x14001c8af
lea rax, [rdx - 1]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x40], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.14001c590
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x14001c874
mov qword [rsp + 0x30], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rbx
xor r9, rdx
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rdi
jne 0x14001c7ec
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14001c863
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x14001c829
mov r10, qword [rdx]
cmp r10, rax
je 0x14001c823
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14001c863
cmp r9, rdx
je 0x14001c83f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x14001c889
cmp r9, rdx
jne 0x14001c830
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x14001c770
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14001c863
lea rcx, str.invalid_hash_bucket_count
call fcn.1400b74d4
int3
Function at 0x14001c8c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x14001c99b
nop dword [rax]
cmp rbx, qword [0x14013c2b8]
jb 0x14001c90e
cmp rbx, qword [0x14013c2c0]
ja 0x14001c90e
sub rbx, 0x8000000
jmp 0x14001c992
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, gethostbyaddr
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14001c99b
cmp dword [rsp + 0x40], 0x10000
jne 0x14001c976
cmp qword [rsp + 0x38], 0x10000
jb 0x14001c976
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x14001c99d
sub rbx, 0x10000
jmp 0x14001c992
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x14001c8f0
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x14001c9b0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x14001c9d2
sub rbx, rax
add rbx, 0x10000
cmp rbx, rdi
jae 0x14001ca8d
nop dword [rax + rax]
cmp rbx, qword [0x14013c2b8]
jb 0x14001c9fe
cmp rbx, qword [0x14013c2c0]
ja 0x14001c9fe
add rbx, 0x8000000
jmp 0x14001ca84
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, gethostbyaddr
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14001ca8d
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x14001ca69
cmp rcx, 0x10000
jb 0x14001ca69
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x14001ca8f
add rbx, 0x10000
jmp 0x14001ca84
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x14001ca84
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x14001c9e0
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x14001caa0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push rbx
sub rsp, 0x20
lea rbx, [rcx - 0x7ff80000]
mov r9, rcx
cmp rcx, 0x7ff80000
ja 0x14001cabe
mov ebx, 0x80000
mov qword [rsp + 0x30], rdi
lea rdi, [rcx + 0x7ff80000]
cmp r9, 0xffffffff80000000
jb 0x14001cada
mov rdi, 0xfffffffffff80000
movzx eax, byte [rcx]
cmp al, 0xff
jne 0x14001caf1
cmp byte [rcx + 1], 0x25
jne 0x14001cb35
movsxd rcx, dword [rcx + 2]
add rcx, 6
jmp 0x14001cafd
cmp al, 0xe9
jne 0x14001cb35
movsxd rcx, dword [rcx + 1]
add rcx, 5
add rcx, r9
cmp rcx, r9
jae 0x14001cb20
cmp rcx, 0xffffffff80000000
jae 0x14001cb17
lea rdi, [rcx + 0x7ff80000]
jmp 0x14001cb35
mov rdi, 0xfffffffffff80000
jmp 0x14001cb35
lea rbx, [rcx - 0x7ff80000]
cmp rcx, 0x7ff80000
ja 0x14001cb35
mov ebx, 0x80000
mov rax, qword [0x140142018]
mov rcx, qword [0x140142010]
test rax, rax
jne 0x14001cb57
test rcx, rcx
je 0x14001cb6e
mov rax, rcx
mov qword [0x140142018], rcx
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x14001cb6e
cmp rdx, rbx
jb 0x14001cb6e
cmp rdx, rdi
jbe 0x14001cc28
mov qword [0x140142018], rcx
mov rax, rcx
test rcx, rcx
je 0x14001cbb2
mov rdx, rcx
test rcx, rcx
je 0x14001cb9c
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x14001cb9c
cmp rcx, rbx
jb 0x14001cb9c
cmp rcx, rdi
jbe 0x14001cc28
mov rax, qword [rax + 8]
mov qword [0x140142018], rax
mov rdx, rax
mov rcx, rax
test rax, rax
jne 0x14001cb80
movzx eax, r9w
mov r8, rdi
sub r9, rax
mov rdx, rbx
mov rcx, r9
call fcn.14001cc80
test rax, rax
je 0x14001cc6b
mov dword [rax], 0x52727464
lea rdx, [rax + 0xffa8]
xor r8d, r8d
mov qword [0x140142018], rax
mov qword [rax + 0x10], r8
mov r9d, 0x2a7
mov rcx, qword [0x140142010]
mov qword [rax + 8], rcx
lea rcx, [rax + 0xff60]
mov qword [0x140142010], rax
nop word [rax + rax]
mov qword [rdx], r8
lea rdx, [rdx - 0x60]
mov r8, rcx
sub rcx, 0x60
sub r9, 1
jne 0x14001cc10
mov qword [rax + 0x10], r8
mov rdx, qword [rax + 0x10]
cmp rdx, rbx
jb 0x14001cc6b
cmp rdx, rdi
ja 0x14001cc6b
mov rcx, qword [rdx + 0x48]
movdqa xmm0, xmmword [0x1400f71d0]
mov qword [rax + 0x10], rcx
mov rax, rdx
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm0
movups xmmword [rdx + 0x20], xmm0
movups xmmword [rdx + 0x30], xmm0
movups xmmword [rdx + 0x40], xmm0
movups xmmword [rdx + 0x50], xmm0
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14001cf90
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rdx
mov r8d, gethostbyaddr
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x14001cfbe
xor al, al
jmp 0x14001d000
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x14001cfcf
xor al, al
jmp 0x14001d000
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x14001cff6
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x14001cff6
mov al, 1
jmp 0x14001d000
xor al, al
add rsp, 0x50
pop rbx
ret
add rsp, 0x50
pop rbx
ret
Function at 0x14001d4e0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
cmp dword [0x140142028], 0
jne 0x14001d587
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor eax, eax
lock cmpxchg dword [0x140142028], ecx
jne 0x14001d587
mov qword [rsp + 0x38], rbx
mov rbx, qword [0x140142010]
mov qword [rsp + 0x20], rdi
xor edi, edi
mov qword [0x140142040], rdi
mov qword [0x140142038], rdi
mov qword [0x140142030], rdi
test rbx, rbx
je 0x14001d570
nop word [rax + rax]
lea r9, [rsp + 0x30]
mov edx, 0x10000
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14001d568
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x14001d540
jmp 0x14001d570
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov dword [0x14014202c], edi
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
mov eax, 0x10dd
add rsp, 0x28
ret
Function at 0x14001dba0
Capabilities:
Suspend thread

Disassembly:
push rdi
sub rsp, 0x20
mov eax, dword [0x14014202c]
mov rdi, rcx
test eax, eax
jne 0x14001dc43
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rdi, rax
jne 0x14001dbca
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov ecx, reloc.WS2_32.dll_recv
mov qword [rsp + 0x30], rbx
call fcn.1400b5680
mov rbx, rax
test rax, rax
jne 0x14001dbe6
lea edi, [rax + 8]
jmp 0x14001dc09
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x14001dc27
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov edx, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.1400b56bc
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov dword [0x14014202c], edi
mov qword [0x140142030], 0
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x140142038]
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 8], rdi
mov qword [0x140142038], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140020cd0
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x2f0
mov rax, qword [0x14013d0a8]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rdi, rcx
mov rbx, qword [0x1401424f8]
sub rbx, qword [0x1401424f0]
sar rbx, 3
mov r8d, ebx
mov edx, 0x102f
mov r9d, 3
mov rcx, qword [rcx + 0x68]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp ebx, dword [0x140142048]
jbe 0x140020d3c
lea eax, [rbx - 1]
movsxd r8, eax
xor r9d, r9d
mov edx, 0x1013
mov rcx, qword [rdi + 0x68]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x140142048], ebx
mov r8d, dword [0x14014330c]
mov edx, 0x1e
lea rcx, [rsp + 0x90]
call fcn.140073450
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x140143530]
movsd xmm2, qword [0x140143528]
movq r8, xmm2
lea rdx, str.ProcMon_load:__.2f_____p_d___s_bytes_pending_
lea rcx, [rsp + 0xd0]
call fcn.140003120
lea r8, [rsp + 0xd0]
mov edx, 0x419
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov dword [rsp + 0x50], 0x40
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x54], xmm0
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
mov qword [rsp + 0x84], rax
mov dword [rsp + 0x8c], eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rdx, qword [rsp + 0x70]
shr rdx, 0x14
xor r8d, r8d
lea rcx, [rsp + 0x48]
call fcn.140073360
nop
mov r8, rax
lea rdx, [0x1400f760c]
lea rcx, [rsp + 0x40]
call fcn.1400b0220
mov rbx, rax
lea rcx, [0x1400f7610]
call fcn.1400b0640
mov rdx, rax
lea rcx, [0x1400f7610]
call fcn.1400b0780
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.1400b0290
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140020e4e
call fcn.1400b0810
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140020e5e
call fcn.1400b0810
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140020e6e
call fcn.1400b0810
nop
lea rcx, [rsp + 0x38]
call fcn.1400b0200
mov r8, rax
mov edx, 0x459
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140020e9b
call fcn.1400b0810
nop
xor eax, eax
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.1400b5660
mov rbx, qword [rsp + 0x308]
add rsp, 0x2f0
pop rdi
ret
Function at 0x140024100
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rbp, r9
mov r14, rcx
xor r15d, r15d
mov dword [rsp + 0x90], r15d
lea r8, str.DevicePathDialog
mov rdx, qword [0x1401430d8]
mov rcx, qword [rcx + 8]
call fcn.14009c830
lea edx, [r15 + 0x5c]
lea rcx, [rbp + 2]
call fcn.1400ba484
test rax, rax
je 0x140024195
lea edx, [r15 + 0x5c]
lea rcx, [rax + 2]
call fcn.1400ba484
test rax, rax
je 0x140024195
sub rax, rbp
sar rax, 1
mov rcx, rax
neg rcx
sbb r9, r9
and r9d, 2
lea rdx, [rax + rax]
lea r8, [0x1400f6914]
mov rcx, rbp
call fcn.1400b06f0
mov rdi, rax
mov qword [rsp + 0x30], rax
lea esi, [r15 + 1]
mov rbx, qword [rsp + 0x30]
jmp 0x1400241ba
mov rcx, rbp
call fcn.1400b0640
mov rdx, rax
mov rcx, rbp
call fcn.1400b0780
mov rbx, rax
mov qword [rsp + 0x30], rax
mov esi, 2
mov rdi, qword [rsp + 0x30]
mov rcx, rax
mov dword [rsp + 0x90], esi
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x1400241d7
call fcn.1400b04e0
nop
test sil, 2
je 0x1400241f5
and esi, 0xfffffffd
mov dword [rsp + 0x90], esi
test rbx, rbx
je 0x1400241f5
mov rcx, rbx
call fcn.1400b0810
nop
test sil, 1
je 0x140024209
test rdi, rdi
je 0x140024209
mov rcx, rdi
call fcn.1400b0810
nop
mov r8, rbp
mov edx, 0x450
mov rcx, qword [r14 + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea rcx, [rsp + 0xa8]
call fcn.1400b0200
mov r8, rax
mov edx, 0x44f
mov rcx, qword [r14 + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea rcx, [rsp + 0xa8]
call fcn.1400b0200
mov r8, rax
mov edx, 0x403
mov rcx, qword [r14 + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov edx, 0x3f9
mov rcx, qword [r14 + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov qword [r14 + 0x68], rax
mov ebx, 5
cmp word [rbp], 0
cmovne ebx, r15d
mov edx, 0x400
mov rcx, qword [r14 + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rax, str.Device_Path
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0xc8
lea rax, str.User_Path
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0xc8
mov byte [rsp + 0x20], 0
mov r9d, 0x4030
mov r8d, 2
lea rdx, [rsp + 0x38]
mov rcx, qword [r14 + 0x68]
call fcn.14005b480
lea r8, str.DevicePathColumns
mov rdx, qword [0x1401430d8]
mov rcx, qword [r14 + 0x68]
call fcn.14005b740
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8000
mov rcx, qword [r14 + 8]
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, 0x20
call qword [sym.imp.USER32.dll_MessageBeep]
nop
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x140024328
call fcn.1400b0810
nop
xor eax, eax
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400269d0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x14013d0a8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov r8d, 0x104
lea rdx, [rsp + 0x30]
lea rcx, str._SYSTEMROOT_Procmon.Pmb
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400b5680
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x140026a4a
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
lea rcx, [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140026a83
jmp 0x140026a4c
xor ebx, ebx
mov qword [rdi], rbx
test rbx, rbx
je 0x140026a78
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400b5660
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
mov ecx, 0x8007000e
call fcn.1400b6f00
nop
mov ecx, 0x8007000e
call fcn.1400b6f00
int3

Function at 0x140026a90
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x48]
mov dword [rsp + 0x48], reloc.WS2_32.dll_ntohs
lea rdx, str.SupportedFeatures
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r8, [rsp + 0x58]
mov rcx, rbx
lea rdx, str.Instances
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov rcx, qword [rsp + 0x58]
lea rbx, str.Process_Monitor_24_Instance
mov r9d, 1
mov dword [rsp + 0x28], getservbyname
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.DefaultInstance
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test rdi, rdi
lea rcx, str.385200
mov rax, 0xffffffffffffffff
cmovne rcx, rdi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140026b40
add eax, eax
lea rdx, str.Altitude
mov dword [rsp + 0x28], eax
mov r9d, 1
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], 4
lea rdx, str.Flags
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x48], 0
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret