joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140042554
Capabilities:
Delete registry key

Disassembly:
jmp 0x14008a430
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2d8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x7e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2f8]
mov rax, qword [0x1400f7040]
xor rax, rbp
mov qword [rbp + 0x2a8], rax
lea rcx, [0x14010a50b]
call fcn.1400432e7
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14008a498
xor al, al
jmp 0x14008a668
mov r8, qword [rbp + 0x2d0]
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp + 0x28]
call fcn.140043599
nop
lea rcx, [rbp + 0x28]
call fcn.140041b59
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.140043166
mov r8, qword [rbp + 0x2d0]
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp + 0xb8]
call fcn.140043599
nop
lea rcx, [rbp + 0xb8]
call fcn.140041b59
lea r8, [rbp + 0x98]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [rbp + 0xf4], eax
cmp dword [rbp + 0xf4], 0
je 0x14008a56d
cmp dword [rbp + 0xf4], 2
jne 0x14008a544
mov byte [rbp + 0x214], 1
lea rcx, [rbp + 0xb8]
call fcn.140042da6
nop
lea rcx, [rbp + 0x28]
call fcn.140042da6
movzx eax, byte [rbp + 0x214]
jmp 0x14008a668
mov byte [rbp + 0x234], 0
lea rcx, [rbp + 0xb8]
call fcn.140042da6
nop
lea rcx, [rbp + 0x28]
call fcn.140042da6
movzx eax, byte [rbp + 0x234]
jmp 0x14008a668
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.NtUnloadDriver
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 0x68]
call qword [rbp + 0x118]
mov dword [rbp + 0x134], eax
cmp dword [rbp + 0x134], 0
je 0x14008a5f3
lea rcx, [rbp + 0xb8]
call fcn.140041b59
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov dword [rbp + 0xf4], eax
mov byte [rbp + 0x254], 0
lea rcx, [rbp + 0xb8]
call fcn.140042da6
nop
lea rcx, [rbp + 0x28]
call fcn.140042da6
movzx eax, byte [rbp + 0x254]
jmp 0x14008a668
lea rcx, [rbp + 0xb8]
call fcn.140041b59
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov dword [rbp + 0xf4], eax
cmp dword [rbp + 0xf4], 0
je 0x14008a644
mov byte [rbp + 0x274], 0
lea rcx, [rbp + 0xb8]
call fcn.140042da6
nop
lea rcx, [rbp + 0x28]
call fcn.140042da6
movzx eax, byte [rbp + 0x274]
jmp 0x14008a668
mov byte [rbp + 0x294], 1
lea rcx, [rbp + 0xb8]
call fcn.140042da6
nop
lea rcx, [rbp + 0x28]
call fcn.140042da6
movzx eax, byte [rbp + 0x294]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400de530]
call fcn.140042ccf
mov rax, rdi
mov rcx, qword [rbp + 0x2a8]
xor rcx, rbp
call fcn.14004208b
lea rsp, [rbp + 0x2b8]
pop rdi
pop rbp
ret
Function at 0x140042810
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400b96a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400b96c0
xor al, al
jmp 0x1400b9741
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400b96d3
xor al, al
jmp 0x1400b9741
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400b96fd
xor al, al
jmp 0x1400b9741
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400b9711
xor al, al
jmp 0x1400b9741
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400b9723
xor al, al
jmp 0x1400b9741
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400b973f
xor al, al
jmp 0x1400b9741
mov al, 1
add rsp, 0x38
ret
Function at 0x140042eb9
Capabilities:
Parse pe header

Disassembly:
jmp 0x140087c30
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14010a3b1]
call fcn.1400432e7
mov rax, qword [rbp + 0x120]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140087c6c
xor eax, eax
jmp 0x140087c99
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x120]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0x4550
je 0x140087c95
xor eax, eax
jmp 0x140087c99
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14004323d
Capabilities:
Write file on windows

Disassembly:
jmp 0x14007b190
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x1400f7040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x14010a127]
call fcn.1400432e7
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x14007b1f6
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14007b1fd
mov al, 1
jmp 0x14007b34d
call fcn.140041974
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
mov edx, eax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov dword [rbp + 0x160], eax
call fcn.140041974
mov ecx, dword [rbp + 0x160]
mov edx, ecx
mov ecx, eax
call fcn.140042b6c
movzx eax, al
test eax, eax
je 0x14007b24e
xor al, al
jmp 0x14007b34d
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x14007b2b3
cmp dword [rbp + 0x154], 1
je 0x14007b2be
cmp dword [rbp + 0x154], 3
je 0x14007b33c
jmp 0x14007b34b
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14007b30e
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14007b30e
xor al, al
jmp 0x14007b34d
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14007b329
mov dword [rbp + 0x154], 1
jmp 0x14007b333
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14007b34d
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14007b34d
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.140042ccf
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.14004208b
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400433d2
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400b6350
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
mov rdi, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.140042a1d
and qword [rdi + 0x50], 0
lea rax, [0x140000000]
and dword [rdi + 0x58], 0
lea rcx, [rdi + 0x28]
and dword [rdi + 0x5c], 0
xor r8d, r8d
mov qword [rdi + 0x10], rax
xor edx, edx
mov qword [rdi + 8], rax
lea rax, [0x1400e39e0]
mov qword [rdi + 0x20], rax
mov dword [rdi], 0x60
mov dword [rdi + 0x18], 0xe00
call fcn.140042018
test eax, eax
jne 0x1400b63e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x1400b63e7
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400b63e0
lea rcx, str.ERROR_:_Unable_to_initialize_critical_section_in_CAtlBaseModule_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [0x1400fa420], 1
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021200]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020630]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020630]
call fcn.1400123b8
lea rcx, [0x140021200]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
insb byte [rdi], dx
pop rsi
add r15, qword [rsi]
loop 0x14003f5f3
mov ch, byte [rsi]
xor eax, 0x51d326e4
xlatb
xlatb
jno 0x14003f653
and al, 0xf3
fmul st(3)
cmp al, byte [rbx + 0x599d8610]
mov dh, 0xe1
or cl, byte [edi + edi - 0x6e]
adc dword ss:[rax + riz*8 + 0x5c], ebp
mov cl, 0x23
mov bh, 0x20
jb 0x14003f601
loop 0x14003f643
jae 0x14003f644
out dx, al
invalid
jmp 0x1b8ca9423
jmp 0x1b8ca9423
mov eax, 0x7f8975c8
adc esi, dword [rax + 0x1361c24d]
push 0x10
jg 0x14003f5f2
outsb dx, byte ss:[rsi]
sub al, 0x62
sahf
fcom qword [rbx - 5]
and dword [rsi - 0x23], esp
sbb byte [rsi + 0x19a671d9], bh
sub bh, byte [rbp - 0x3f]
push rbp
invalid
enter 0xffffffffffffd01c, 0x33
invalid
sbb dh, byte [rdx]
push rcx
push rbx
sar dword [rax + 0x78], 0x36
js 0x14003f727
pop rsp
pushfq
mov eax, 0x359a6490
out dx, al
invalid
scasb al, byte [rdi]
xchg esp, eax
invalid
invalid
mov bh, 0x48
xlatb
enter 0xffffffffffff9d51, 0xfffffffffffffff0
add dl, ch
invalid
add al, 0x46
sar dword [rbp - 0x441ff7ac], cl
insd dword [rdi], dx
fnsave dword gs:[rdi - 0x465f6dc7]
fnsave dword [rdi - 0x465f6dc7]
cmp dword [rdx + 0x4fc4b9a0], edx
sub ebp, dword [rax - 0x70011c4d]
xchg esi, eax
ret
invalid

Function at 0x14000727c
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x140007342
lea rcx, [0x140021200]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020630]
jmp 0x140007306
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140007303
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x140020630]
mov rdx, rsi
call fcn.1400123b8
jmp 0x140007306
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400072d3
mov rdx, qword [0x14001f110]
lea rcx, [0x140020630]
mov rdi, rdx
inc rdx
mov qword [0x14001f110], rdx
lea edx, [rbx + 0x20]
call fcn.140012400
lea rcx, [0x140021200]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x140002b70
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
lea rax, vtable.IPCService.0
mov rbx, rcx
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
xor ebp, ebp
mov dword [rbx + 0x40], 0xffffffff
lea rdx, [rsp + 0x30]
mov qword [rbx + 0x48], rbp
lea rcx, [rsp + 0x48]
mov qword [rbx + 0x50], rbp
mov esi, eax
mov dword [rbx + 0x44], ebp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
mov dword [rbx + 0x20], ebp
call fcn.140007d60
lea rcx, [rbx + 0x38]
mov dword [rbx + 0x58], ebp
lea rdx, str.GlobalEEU_Memory_Map_Mutex
call fcn.140009a30
test eax, eax
jne 0x140002c0e
mov rcx, qword [0x14008ed90]
test rcx, rcx
je 0x140002d24
lea r9, str.CreateMutex_failed.
mov edx, 0x60004008
mov r8d, 1
call fcn.140006a40
jmp 0x140002d24
xor r9d, r9d
lea rax, str.GlobalEEU_Memory_Map
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
xor ecx, ecx
mov dword [rsp + 0x20], 0x17c
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rbx + 0x28], rax
test rax, rax
jne 0x140002c58
mov rcx, qword [0x14008ed90]
test rcx, rcx
je 0x140002d24
lea r9, str.CreateFileMapping_failed.
jmp 0x140002bf9
xor r9d, r9d
mov qword [rsp + 0x20], 0x17c
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x140002c99
mov rcx, qword [0x14008ed90]
test rcx, rcx
je 0x140002d24
lea r9, str.MapViewOfFile_failed.
jmp 0x140002bf9
xor edx, edx
mov r8d, 0x17c
mov rcx, rax
call fcn.140013a40
mov rax, qword [rbx + 0x30]
mov edx, esi
mov rcx, rbx
mov dword [rax], 8
call fcn.140003350
lea rdx, [rsp + 0x80]
lea rcx, str.ClientStatusMonitoring
call fcn.1400075f0
test eax, eax
je 0x140002d1d
cmp dword [rsp + 0x80], ebp
je 0x140002d1d
mov r9, rbx
lea r8, [0x140003a70]
mov edx, 8
lea rcx, [rbx + 0x50]
call fcn.140009bb0
test eax, eax
jne 0x140002d1d
mov rcx, qword [0x14008ed90]
test rcx, rcx
je 0x140002d24
lea r9, str.CreateTheThread_for_GetClientStatusThread_failed.
mov edx, 0x60004002
lea r8d, [rax + 1]
call fcn.140006a40
jmp 0x140002d24
mov dword [rbx + 0x48], 1
lea r11, [rsp + 0x70]
mov rax, rbx
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140003830
Capabilities:
Get session information

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x260
cmp dword [rcx + 0x58], 0
mov rbx, rcx
jne 0x140003a59
mov qword [rax + 0x18], rbp
xor ebp, ebp
mov qword [rax - 0x10], rsi
mov qword [rax - 0x18], rdi
nop word [rax + rax]
mov edx, 0x3a98
lea rcx, [0x14008eda0]
call fcn.140009b90
cmp eax, 0x102
jne 0x140003a41
cmp dword [rbx + 0x58], ebp
jne 0x140003a41
cmp dword [rbx + 0x40], 0xffffffff
je 0x140003a38
cmp dword [rbx + 0x4c], ebp
je 0x14000389c
mov dword [rbx + 0x4c], ebp
jmp 0x140003a38
lea rcx, [rbx + 0x38]
call fcn.1400099f0
test eax, eax
jne 0x1400038d3
mov rcx, qword [0x14008ed90]
test rcx, rcx
je 0x140003a38
lea r9, str.IPCService::GetClientStatusLoop_AcquireTheMutex_failed.
mov edx, 0x60004008
lea r8d, [rax + 1]
call fcn.140006a40
jmp 0x140003a38
mov rdx, qword [rbx + 0x30]
lea rcx, [rbx + 0x38]
mov edi, dword [rdx + 4]
mov eax, edi
and eax, 0xfffffffe
mov dword [rdx + 4], eax
call fcn.140009ab0
test dil, 5
jne 0x140003a38
mov edx, dword [rbx + 0x40]
lea rax, [rsp + 0x270]
lea r9, [rsp + 0x278]
mov qword [rsp + 0x20], rax
mov r8d, 8
mov qword [rsp + 0x278], rbp
xor ecx, ecx
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x140003a38
mov rcx, qword [rsp + 0x278]
cmp dword [rcx], 2
jb 0x140003941
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x140003a38
call sub.WTSAPI32.dll_WTSFreeMemory
mov edi, dword [rbx + 0x40]
lea r8, str.GlobalAMDClient
mov r9d, edi
lea rdx, str._s__u
lea rcx, [rsp + 0x30]
call fcn.140002b10
mov r9d, edi
lea r8, str.GlobalAMDClientAck
lea rdx, str._s__u
lea rcx, [rsp + 0x140]
call fcn.140002b10
mov rcx, qword [rbx + 8]
lea rdi, [rdi*8]
add rcx, rdi
lea rdx, [rsp + 0x30]
xor r8d, r8d
call fcn.140009ad0
test eax, eax
je 0x140003a0e
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x140]
add rcx, rdi
xor r8d, r8d
call fcn.140009ad0
test eax, eax
je 0x140003a0e
mov ecx, dword [rbx + 0x40]
call fcn.140004f40
mov rcx, qword [0x14008ed90]
test eax, eax
je 0x1400039ec
test rcx, rcx
je 0x140003a38
mov r9d, dword [rbx + 0x40]
lea r8, str.Client_started_for_session_id__u__because_status_was_not_running_
mov edx, 4
call fcn.140006ca0
jmp 0x140003a38
test rcx, rcx
je 0x140003a38
mov eax, dword [rbx + 0x40]
lea r9, str.Client_for_session_id__u_has_to_be_relaunched.
xor r8d, r8d
mov dword [rsp + 0x20], eax
mov edx, 0x40004003
call fcn.140006a40
jmp 0x140003a38
mov rcx, qword [0x14008ed90]
test rcx, rcx
je 0x140003a38
mov eax, dword [rbx + 0x40]
lea r9, str.Create_client_event_failed_for_session_id_u.
mov edx, 0x60004003
mov dword [rsp + 0x20], eax
mov r8d, 1
call fcn.140006a40
cmp dword [rbx + 0x58], ebp
je 0x140003860
mov rsi, qword [rsp + 0x258]
mov rdi, qword [rsp + 0x250]
mov rbp, qword [rsp + 0x280]
add rsp, 0x260
pop rbx
ret
Function at 0x140004040
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push rbx
sub rsp, 0x250
mov ebx, ecx
call fcn.1400043d0
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call fcn.140013a40
xor edx, edx
lea rcx, [rsp + 0x140]
mov r8d, 0x104
call fcn.140013a40
mov r8d, 0x104
lea rdx, [rsp + 0x140]
lea rcx, str.COMMONPROGRAMFILES
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1400040f3
lea rax, str.ATI_TechnologiesDSEManager.exe
mov qword [rsp + 0x28], 0
lea r9, [rsp + 0x140]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.1400470c4
test eax, eax
jne 0x1400040de
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400040f3
cmp eax, 0x10
je 0x1400040f3
lea rdx, [rsp + 0x30]
mov ecx, ebx
call fcn.140004110
add rsp, 0x250
pop rbx
ret
lea rcx, str.Unable_to_create_path_for_DSE_Manager._n
call fcn.1400046d0
add rsp, 0x250
pop rbx
ret
Function at 0x1400043d0
Capabilities:
Check if file exists
Enumerate processes
Query environment variable
Terminate process

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0x4b8]
sub rsp, 0x5b8
xor edx, edx
lea rcx, [rbp + 0x190]
mov r8d, 0x104
call fcn.140013a40
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.140013a40
mov r8d, 0x104
lea rdx, [rsp + 0x50]
lea rcx, str.COMMONPROGRAMFILES
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140004661
lea rax, str.ATI_TechnologiesDSEManager.exe
xor r14d, r14d
mov qword [rsp + 0x28], r14
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rbp + 0x190]
call fcn.1400470c4
test eax, eax
jne 0x140004479
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140004661
cmp eax, 0x10
je 0x140004661
xor edx, edx
mov qword [rsp + 0x5e0], rsi
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400044b3
lea rcx, str.Unable_to_get_snapshot_of_all_processes._n
call fcn.1400046d0
mov rsi, qword [rsp + 0x5e0]
add rsp, 0x5b8
pop r14
pop rbp
ret
mov qword [rsp + 0x5b0], rdi
mov edi, r14d
mov qword [rsp + 0x5d8], rbx
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x64]
mov r8d, 0x12c
call fcn.140013a40
mov dword [rbp + 0x60], 0x130
test edi, edi
jne 0x1400044fa
lea rdx, [rbp + 0x60]
mov rcx, rsi
call sub.KERNEL32.dll_Process32First
jmp 0x140004508
jle 0x140004510
lea rdx, [rbp + 0x60]
mov rcx, rsi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x140004635
xor edx, edx
lea rcx, [rbp + 0x2a0]
mov r8d, 0x100
call fcn.140013a40
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x100
call fcn.140013a40
mov qword [rsp + 0x40], 0x100
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rcx, [rbp + 0x8c]
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x30], 0x100
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
call fcn.1400480c8
test eax, eax
jne 0x14000462e
lea rdx, str.DSEManager
lea rcx, [rbp + 0x2a0]
call fcn.140046b2c
test eax, eax
jne 0x14000462e
lea rdx, str..exe
lea rcx, [rsp + 0x50]
call fcn.140046b2c
test eax, eax
jne 0x14000462e
mov r8d, dword [rbp + 0x68]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000462e
xor edx, edx
lea rcx, [rbp + 0x3a0]
mov r8d, 0x104
call fcn.140013a40
lea r9, [rbp + 0x4d0]
mov dword [rbp + 0x4d0], 0x104
lea r8, [rbp + 0x3a0]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
test eax, eax
je 0x140004625
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x3a0]
call fcn.140046b2c
test eax, eax
jne 0x140004625
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
jmp 0x1400044d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x5b0]
mov rbx, qword [rsp + 0x5d8]
mov rsi, qword [rsp + 0x5e0]
add rsp, 0x5b8
pop r14
pop rbp
ret
lea rcx, str.Unable_to_create_path_for_DSE_Manager._n
call fcn.1400046d0
add rsp, 0x5b8
pop r14
pop rbp
ret
Function at 0x1400051b0
Capabilities:
Get session information

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r14
sub rsp, 0x40
mov rax, qword [0x14008edd0]
xor r14d, r14d
mov qword [rsp + 0x30], rax
mov esi, r14d
mov rax, qword [0x14008eda0]
mov qword [rsp + 0x38], rax
call fcn.140005420
mov ebx, eax
mov qword [rsp + 0x70], rdi
lea ebp, [r14 + 0x32]
nop dword [rax + rax]
cmp ebx, 2
jne 0x1400053f4
mov r9d, ebp
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov ecx, ebx
call sub.KERNEL32.dll_WaitForMultipleObjects
cmp eax, 0xffffffff
je 0x1400053a8
cmp eax, 0x102
jne 0x1400053cb
mov ebx, r14d
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov edi, eax
cmp eax, 0xffffffff
je 0x14000539b
mov ecx, edi
call fcn.1400050d0
test eax, eax
je 0x14000539b
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], r14
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r8d, 8
mov edx, edi
xor ecx, ecx
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x14000539b
mov rcx, qword [rsp + 0x68]
mov eax, dword [rcx]
test eax, eax
jne 0x140005288
mov rax, qword [0x14008ede8]
mov dword [rax + rdi*4], 3
jmp 0x14000529f
cmp eax, 1
jne 0x14000533d
mov rax, qword [0x14008ede8]
mov dword [rax + rdi*4], 1
mov rcx, qword [rsp + 0x68]
call sub.WTSAPI32.dll_WTSFreeMemory
mov rcx, qword [0x14008ed98]
mov edx, edi
mov ebx, 1
call fcn.140003b20
mov rcx, qword [0x14008ed98]
mov edx, edi
call fcn.140003780
test eax, eax
jne 0x1400052fc
mov rcx, qword [0x14008ed90]
test rcx, rcx
je 0x1400052f2
lea r9, str.Create_client_event_failed_for_session_id_u.
mov dword [rsp + 0x20], edi
mov edx, 0x60004003
mov r8d, ebx
call fcn.140006a40
mov ebx, 3
jmp 0x14000539b
mov ecx, edi
call fcn.140004f40
test eax, eax
je 0x140005327
mov rcx, qword [0x14008ed90]
test rcx, rcx
je 0x140005327
mov r9d, edi
lea r8, str.Client_started_at_service_start_time_for_session_id__u
mov edx, 4
call fcn.140006ca0
mov rcx, qword [0x14008ed98]
xor r8d, r8d
mov edx, 0x200
call fcn.140002f90
jmp 0x14000539b
cmp eax, 2
mov rax, qword [0x14008ed90]
jne 0x140005378
test rax, rax
je 0x140005367
lea r8, str.The_WinStation_is_in_the_process_of_connecting_to_the_client.
mov edx, 4
mov rcx, rax
call fcn.140006ca0
mov rcx, qword [rsp + 0x68]
call sub.WTSAPI32.dll_WTSFreeMemory
mov ebx, 2
mov ebp, 0xfa
jmp 0x14000539b
test rax, rax
je 0x140005396
lea r8, str.Error:_Give_up_waiting_for_client_connected.
mov edx, 4
mov rcx, rax
call fcn.140006ca0
mov rcx, qword [rsp + 0x68]
call sub.WTSAPI32.dll_WTSFreeMemory
inc esi
cmp esi, 0x64
jb 0x1400051f0
jmp 0x1400053d0
mov rcx, qword [0x14008ed90]
test rcx, rcx
je 0x1400053cb
lea r9, str.WaitForSingleEvent_failed.
mov edx, 0x60004006
mov r8d, 1
call fcn.140006a40
cmp esi, 0x64
jb 0x1400053f4
cmp ebx, 2
jne 0x1400053f4
mov rcx, qword [0x14008ed90]
mov ebx, 4
test rcx, rcx
je 0x1400053f4
lea r8, str.WTS_Connect_Query_Times_Out.
mov edx, ebx
call fcn.140006ca0
lea rcx, [0x14008edd8]
mov dword [0x14008edf4], ebx
call fcn.140009b70
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret