joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016c50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, r9
mov dword [rsp + 0x30], 0x100
mov rdi, r8
lea rax, [rsp + 0x38]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140016ccc
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rbx, qword [rsp + 0x50]
mov eax, 0xffffffff
add rsp, 0x40
pop rdi
ret

Function at 0x140016d10
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
xor ebx, ebx
mov dword [rsp + 0x70], r8d
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov qword [rsp + 0x30], rbx
lea rdx, str.SoftwareATIACESettingsADLMaxCofuncPaths_
mov dword [rsp + 0x28], 0xf003f
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140016d9e
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 4
lea r9d, [rbx + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov ecx, 1
cmove ebx, ecx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140019c60
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
sub rsp, 0x78
mov qword [rax - 8], rdi
xor edi, edi
mov dword [rax + 0x10], edi
mov r9d, 0x20019
mov dword [rax + 0x18], 4
lea rax, [rax - 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareATIACESettingsADLAppProfiles
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140019d05
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x80], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.AplReloadCounter
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, 1
mov ebx, edi
test eax, eax
cmove ebx, ecx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 1
mov rbx, qword [rsp + 0x80]
je 0x140019d8c
mov eax, dword [rsp + 0x88]
lea rdx, str.SoftwareATIACESettingsADLAppProfiles
mov qword [rsp + 0x40], rdi
xor r9d, r9d
mov dword [rsp + 0x98], eax
xor r8d, r8d
lea rax, [rsp + 0x60]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140019d8c
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x98]
mov dword [rsp + 0x28], 4
lea rdx, str.AplReloadCounter
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [rsp + 0x88]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rdi
lea rdx, str.SoftwareATIACESettingsADLAppProfiles
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rdi, qword [rsp + 0x70]
test eax, eax
jne 0x140019e1a
mov rcx, qword [rsp + 0x90]
lea rax, [rsp + 0x88]
mov dword [rsp + 0x28], 4
lea rdx, str.AplReloadCounter
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x78
ret
Function at 0x14001a320
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov ebx, edx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
xor r14d, r14d
call fcn.14003aa80
mov rdi, 0xffffffffffffffff
mov qword [rbp + 0x188], r14
lea rdx, [rbp + 0x180]
mov dword [rbp + 0x180], edi
mov rcx, rsi
call fcn.140017700
test eax, eax
je 0x14001a532
cmp ebx, 2
jbe 0x14001a3af
cmp ebx, 3
jne 0x14001a532
mov edx, dword [rbp + 0x180]
mov rcx, rsi
call fcn.140014a00
mov rcx, rsi
mov ebx, eax
call fcn.140019c60
mov eax, ebx
jmp 0x14001a535
mov ebx, dword [rbp + 0x180]
mov r9d, 1
mov edx, ebx
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea r8d, [r9 + 1]
call fcn.1400132e0
mov r9d, 1
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov edx, ebx
mov rcx, rsi
call fcn.1400132e0
lea r9, [rbp + 0x188]
xor r8d, r8d
mov edx, 0x2000
lea rcx, [0x14009e8b8]
mov ebx, eax
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x14001a526
mov r8, qword [rbp + 0x188]
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.14005fd68
lea rax, [rsp + 0x40]
inc rdi
cmp word [rax + rdi*2], r14w
jne 0x14001a426
add rdi, 0x16
je 0x14001a495
lea r8, str.ATIACEAPLUser.blb
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.14006066c
lea r8, [0x140092ae0]
mov qword [rsp + 0x30], r14
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140060cdc
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001a495
call fcn.140060e30
mov edx, dword [rbp + 0x180]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov rcx, rsi
lea r8d, [r9 + 1]
call fcn.1400132e0
or ebx, eax
mov r8, qword [rbp + 0x188]
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.14005fd68
mov r8d, dword [rbp + 0x180]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov rcx, rsi
call fcn.140019f20
cmp eax, 1
jne 0x14001a512
lea r8, [0x140092ae0]
mov qword [rsp + 0x30], r14
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140060cdc
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001a512
call fcn.140060e30
mov edx, dword [rbp + 0x180]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov rcx, rsi
lea r8d, [r9 + 1]
call fcn.1400132e0
or ebx, eax
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbp + 0x188], r14
mov rcx, rsi
call fcn.140019c60
mov eax, ebx
jmp 0x14001a535
mov eax, r14d
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14001e330
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x2e8
xor eax, eax
lea rcx, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x68]
call fcn.14003aa80
xor edx, edx
mov dword [rsp + 0x70], 0x68
mov r8d, 0x200
lea rcx, [rsp + 0xe0]
call fcn.14003aa80
mov r8d, 0x200
lea rdx, [rsp + 0xe0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x14001e3b8
mov rcx, qword [0x1400b80b8]
test rcx, rcx
je 0x14001e430
lea r8, str.GPUInstallation___GetModuleFileName_failed.
mov edx, 0x80000
call fcn.140032710
add rsp, 0x2e8
ret
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, str.PopUpReboot
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0xe0]
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14001e41c
mov rcx, qword [0x1400b80b8]
test rcx, rcx
je 0x14001e41c
lea r8, str.GPUInstallation___CreateProcess_failed_to_creating_process_for_pop_up.
mov edx, 0x80000
call fcn.140032710
lea rcx, [rsp + 0x50]
call fcn.140032840
lea rcx, [rsp + 0x58]
call fcn.140032840
add rsp, 0x2e8
ret
Function at 0x14001e440
Capabilities:
Check if file exists
Copy file
Create process on windows
Get common file path
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x6e0]
sub rsp, 0x7e0
mov eax, dword [str.Rescan]
mov ebx, ecx
mov dword [rbp - 0x20], eax
lea rcx, [rbp - 0x19]
movzx eax, word [0x14008ca80]
xor edx, edx
mov word [rbp - 0x1c], ax
mov r8d, 0x1f9
movzx eax, byte [0x14008ca82]
mov byte [rbp - 0x1a], al
call fcn.14003aa80
xor edx, edx
lea rcx, [rbp + 0x3e0]
mov r8d, 0x100
call fcn.14003aa80
mov r8d, 0xa
lea rdx, [rbp + 0x3e0]
mov ecx, ebx
call fcn.140061768
lea r8, [0x140093c7c]
mov edx, 0x200
lea rcx, [rbp - 0x20]
call fcn.14005ff14
lea r8, [rbp + 0x3e0]
mov edx, 0x200
lea rcx, [rbp - 0x20]
call fcn.14005ff14
xor eax, eax
lea rcx, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x68]
call fcn.14003aa80
xor edx, edx
mov dword [rsp + 0x70], 0x68
mov r8d, 0x200
lea rcx, [rbp + 0x4e0]
call fcn.14003aa80
mov r8d, 0x200
lea rdx, [rbp + 0x4e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor edx, edx
lea rcx, [rbp + 0x1e0]
mov r8d, 0x200
call fcn.14003aa80
xor ebx, ebx
lea r9, [rbp + 0x6f8]
xor r8d, r8d
mov qword [rbp + 0x6f8], rbx
mov edx, 0x2000
lea rcx, [0x14009e8b8]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x14001e5b5
mov r9, qword [rbp + 0x6f8]
mov rax, 0xffffffffffffffff
mov qword [rbp + 0x700], rbx
nop dword [rax + rax]
inc rax
cmp word [r9 + rax*2], bx
jne 0x14001e580
mov r8d, 0x104
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x700]
call fcn.1400605c4
mov rcx, qword [rbp + 0x6f8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea r8, str.AMD_atieclxx.exe
mov edx, 0x104
lea rcx, [rbp + 0x1e0]
call fcn.14005ff14
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001e5f1
and eax, 0xfffffffc
lea rcx, [rbp + 0x1e0]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor r8d, r8d
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x20]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x1e0]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14001e666
mov rcx, qword [0x1400b80b8]
test rcx, rcx
je 0x14001e666
lea r8, str.GPUInstallation___CreateProcess_failed_to_creating_process_for_rescan.
mov edx, 0x80000
call fcn.140032710
lea rcx, [rsp + 0x50]
call fcn.140032840
lea rcx, [rsp + 0x58]
call fcn.140032840
mov rbx, qword [rsp + 0x7f0]
add rsp, 0x7e0
pop rbp
ret
Function at 0x140025c70
Capabilities:
Check if file exists
Copy file
Create directory
Get common file path
Get file attributes
Query environment variable
Set file attributes

Disassembly:
test rcx, rcx
je 0x140025e86
push rbp
push rsi
push r14
sub rsp, 0x250
mov r14, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x140025e7b
test r8, r8
je 0x140025e7b
xor edx, edx
mov qword [rsp + 0x280], rdi
mov r8d, 0x104
lea rcx, [rsp + 0x140]
call fcn.14003aa80
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call fcn.14003aa80
xor edi, edi
lea r9, [rsp + 0x270]
xor r8d, r8d
mov qword [rsp + 0x270], rdi
mov edx, 0x2000
lea rcx, [0x14009e8b8]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x140025d68
mov r9, qword [rsp + 0x270]
mov qword [rsp + 0x278], rbx
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x288], rdi
nop word [rax + rax]
inc rbx
cmp word [r9 + rbx*2], di
jne 0x140025d20
mov r8d, 0x104
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x288]
call fcn.1400605c4
mov rcx, qword [rsp + 0x270]
test eax, eax
cmove rdi, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rbx, qword [rsp + 0x278]
test rdi, rdi
jne 0x140025d7b
mov r8, rsi
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov rdi, rsi
call fcn.14003b860
movzx eax, word [0x14008f184]
lea rcx, [rsp + 0x30]
mov byte [rsp + rdi + 0x30], 0x5c
xor edx, edx
mov word [rsp + rdi + 0x31], ax
movzx eax, byte [0x14008f186]
mov byte [rsp + rdi + 0x33], al
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x140025ddb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140025ddb
mov rcx, qword [0x1400b80b8]
test rcx, rcx
je 0x140025e73
lea r8, str.CopyEEUClientToUninstallFolder:_failed_to_create_AMD_directory_for_uninstall.
mov edx, 2
call fcn.140032710
jmp 0x140025e73
movsd xmm0, qword [str.atieclxx.exe]
lea r8, [rdi + 0x11]
mov eax, dword [0x140095448]
lea rdx, [rsp + 0x30]
mov byte [rsp + rdi + 0x34], 0x5c
mov rcx, r14
movsd qword [rsp + rdi + 0x35], xmm0
mov dword [rsp + rdi + 0x3d], eax
call fcn.14003b860
mov r8d, 0x104
lea rdx, [rsp + 0x140]
lea rcx, str._SYSTEMROOT_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea r8, str.System32_atieclxx.exe
mov edx, 0x104
lea rcx, [rsp + 0x140]
call fcn.14005ff14
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140025e5d
and eax, 0xfffffffc
lea rcx, [rsp + 0x30]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdi, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rsi
pop rbp
ret
Function at 0x140026280
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x150
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
mov ebx, 0x104
mov r8d, ebx
lea rcx, [rsp + 0x40]
xor edx, edx
xor r14d, r14d
call fcn.14003aa80
lea rax, [rsp + 0x40]
mov r10d, ebx
sub rdi, rax
lea r9, [rsp + 0x40]
nop word [rax + rax]
lea rax, [r10 + 0x7ffffefa]
test rax, rax
je 0x1400262f1
movzx eax, byte [rdi + r9]
test al, al
je 0x1400262f1
mov byte [r9], al
inc r9
sub r10, 1
jne 0x1400262d0
test r10, r10
lea rax, [r9 - 1]
mov rcx, rbx
cmovne rax, r9
mov byte [rax], r14b
lea rax, [rsp + 0x40]
cmp byte [rax], r14b
je 0x140026315
inc rax
sub rcx, 1
jne 0x140026307
mov rax, rbx
mov rdx, r14
sub rax, rcx
test rcx, rcx
cmovne rdx, rax
je 0x14002636b
lea rcx, [rsp + 0x40]
lea rcx, [rcx + rdx]
sub rbx, rdx
je 0x14002635d
lea rax, [rdx + 0x7ffffefa]
add rax, rbx
sub rsi, rcx
test rax, rax
je 0x14002635d
movzx edx, byte [rsi + rcx]
test dl, dl
je 0x14002635d
mov byte [rcx], dl
dec rax
inc rcx
sub rbx, 1
jne 0x140026342
test rbx, rbx
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], r14b
lea r9, [rsp + 0x188]
mov qword [rsp + 0x188], r14
xor r8d, r8d
lea rcx, [0x14009e828]
mov edx, 0x2000
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x140026443
mov r9, qword [rsp + 0x188]
mov rdi, 0xffffffffffffffff
mov rbx, rdi
mov qword [rsp + 0x30], r14
nop
inc rbx
cmp word [r9 + rbx*2], r14w
jne 0x1400263b0
mov r8d, 0x200
mov qword [rsp + 0x20], rbx
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.1400605c4
mov rcx, qword [rsp + 0x188]
test eax, eax
cmovne rbx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test rbx, rbx
je 0x1400264c1
mov byte [rbx + rbp], 0x5c
xor edx, edx
movzx eax, word [0x14008f184]
mov rcx, rbp
mov word [rbx + rbp + 1], ax
movzx eax, byte [0x14008f186]
mov byte [rbx + rbp + 3], al
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x14002645e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14002645e
mov rcx, qword [0x1400b80b8]
test rcx, rcx
je 0x140026443
lea r8, str.CreateInstallPackage:_failed_to_create_AMD_directory_for_uninstall.
mov edx, 2
call fcn.140032710
mov rax, r14
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov byte [rbx + rbp + 4], 0x5c
lea rax, [rsp + 0x40]
add rbx, 5
nop dword [rax]
inc rdi
cmp byte [rax + rdi], r14b
jne 0x140026470
lea rcx, [rbx + rbp]
mov r8, rdi
lea rdx, [rsp + 0x40]
call fcn.14003b860
xor edx, edx
mov rcx, rbp
add rbx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1400264c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400264c1
mov rcx, qword [0x1400b80b8]
test rcx, rcx
je 0x140026443
lea r8, str.CreateInstallPackage:_failed_to_create_amdkmpfd_un_directory_for_uninstall.
jmp 0x140026439
mov rax, rbx
jmp 0x140026446
Function at 0x1400264d0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x2e8
lea rcx, str.EeuPciFilterPackageInstallFolder
call fcn.140026630
lea rcx, str.EeuAudioFilterPackageInstallFolder
call fcn.140026630
xor eax, eax
lea rcx, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x68]
call fcn.14003aa80
xor edx, edx
lea rcx, [rsp + 0xe0]
mov r8d, 0x200
call fcn.14003aa80
lea rax, [rsp + 0x2f0]
mov dword [rsp + 0x2f0], 0x200
mov qword [rsp + 0x28], rax
lea r8, str.EeuClientPathForPciFilterUnInstall
lea rax, [rsp + 0xe0]
mov r9d, 2
lea rdx, [0x14008d018]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call fcn.140035380
cmp eax, 1
jne 0x140026605
lea r8, str.EeuClientPathForPciFilterUnInstall
mov rcx, 0xffffffff80000002
lea rdx, [0x14008d018]
call fcn.140034ef0
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, str.UninstallPciFilter
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0xe0]
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400265f1
mov rcx, qword [0x1400b80b8]
test rcx, rcx
je 0x1400265f1
lea r8, str.GPUInstallation___CreateProcess_failed_to_creating_process_for_PCI_filter_uninstall.
mov edx, 0x80000
call fcn.140032710
lea rcx, [rsp + 0x50]
call fcn.140032840
lea rcx, [rsp + 0x58]
call fcn.140032840
add rsp, 0x2e8
ret
Function at 0x140027080
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
mov eax, 0x1130
call fcn.140039550
sub rsp, rax
movsd xmm0, qword [str._unknown_]
mov r15, rcx
movzx eax, word [0x140095530]
lea rcx, [rsp + 0x2a]
xor edx, edx
movsd qword [rsp + 0x20], xmm0
mov r8d, 0xfa
mov word [rsp + 0x28], ax
call fcn.14003aa80
lea r8, [rsp + 0x1158]
mov edx, 0x1000
lea rcx, [rsp + 0x130]
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x14002718a
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [r15 + rbx], 0
jne 0x140027100
mov r14d, dword [rsp + 0x1158]
xor edi, edi
shr r14d, 2
test r14d, r14d
je 0x14002718a
lea rsi, [rsp + 0x130]
mov r8d, dword [rsi]
test r8d, r8d
je 0x14002717f
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x14002717f
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_K32GetProcessImageFileNameA
mov dword [rsp + 0x1158], eax
cmp eax, ebx
jb 0x140027176
sub eax, ebx
lea rcx, [rsp + 0x20]
add rcx, rax
mov rdx, r15
call fcn.1400619c4
test eax, eax
je 0x1400271a9
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
add rsi, 4
cmp edi, r14d
jb 0x140027125
xor eax, eax
lea r11, [rsp + 0x1130]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + rdi*4 + 0x130]
jmp 0x14002718c
Function at 0x14002a070
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov esi, edx
movsxd r15, r9d
xor r12d, r12d
and esi, 0xf
mov edi, r12d
mov r14, r8
mov ebx, edx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
shr ebx, 4
lea edx, [r12 + 6]
inc bx
movzx r9d, ax
movzx r8d, bx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceExA]
mov r8, r15
xor edx, edx
add r8, r8
mov rcx, r14
mov rbx, rax
call fcn.14003aa80
test rbx, rbx
je 0x14002a148
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x14002a148
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rax
mov eax, r12d
movzx ecx, word [rdx]
cmp eax, esi
je 0x14002a11c
movzx ecx, cx
inc eax
lea rdx, [rdx + rcx*2]
add rdx, 2
cmp eax, 0x10
jb 0x14002a101
jmp 0x14002a13f
test cx, cx
je 0x14002a13f
movzx eax, cx
cmp eax, r15d
jge 0x14002a13f
add rdx, 2
mov r8d, eax
mov rcx, r14
mov edi, eax
call fcn.14005f7c8
mov word [r14 + rdi*2], r12w
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002b480
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Query environment variable

Disassembly:
push rbx
sub rsp, 0x300
call fcn.14002b940
xor edx, edx
lea rcx, [rsp + 0xe0]
mov r8d, 0x104
call fcn.14003aa80
xor edx, edx
lea rcx, [rsp + 0x1f0]
mov r8d, 0x104
call fcn.14003aa80
mov r8d, 0x104
lea rdx, [rsp + 0x1f0]
lea rcx, str.COMMONPROGRAMFILES
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x14002b5b8
lea rax, str.ATI_TechnologiesDSEManager.exe
xor ebx, ebx
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x1f0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0xe0]
call fcn.140062828
test eax, eax
jne 0x14002b52f
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14002b5b8
cmp eax, 0x10
je 0x14002b5b8
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.14003aa80
lea rax, str.WinSta0Default
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0xe0]
xor eax, eax
mov word [rsp + 0xb0], bx
mov qword [rsp + 0x50], rax
xor r9d, r9d
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov qword [rsp + 0x60], rax
xor edx, edx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
add rsp, 0x300
pop rbx
ret
lea rcx, str.Unable_to_create_path_for_DSE_Manager._n
call fcn.14002bc40
add rsp, 0x300
pop rbx
ret