joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400345f0
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x7b0
mov r10d, dword [0x1400e2390]
or ecx, 0xffffffff
xor ebp, ebp
mov esi, r9d
mov r12d, r8d
mov edi, edx
mov ebx, ebp
lea rax, [0x1400e2398]
nop
nop
cmp ecx, 0xffffffff
jne 0x14003463a
cmp dword [rax], ecx
cmove ecx, ebx
cmp dword [rax], r10d
je 0x14003464f
add ebx, 1
add rax, 0x130
cmp ebx, 0x14
jb 0x140034630
jmp 0x140034654
cmp ebx, 0xffffffff
jne 0x140034675
mov eax, dword [0x1400dd138]
test dword [0x1400dd39c], eax
je 0x14003466e
lea rcx, str.SessionTaskHandler:_task__d__cannot_find_active_session
call fcn.14000cbb0
xor eax, eax
jmp 0x14003478d
lea rcx, [rsp + 0x190]
xor edx, edx
mov r8d, 0x620
call fcn.14007cd30
cmp esi, 0xffffffff
lea rcx, [rsp + 0x80]
cmove esi, dword [0x1400df4cc]
mov r8d, 0x104
xor edx, edx
mov dword [rsp + 0x1a0], esi
mov dword [rsp + 0x198], edi
call fcn.14007cd30
cmp edi, 8
je 0x1400346eb
cmp edi, 7
je 0x1400346eb
lea rax, [0x1400e239c]
mov r8d, ebx
lea rdx, [0x1400b4c70]
lea rcx, [rsp + 0x80]
imul r8, r8, 0x130
add r8, rax
call fcn.14007dc1c
jmp 0x14003471a
lea rax, [0x1400e239c]
mov r8d, ebx
lea r9, str._poller
lea rdx, [0x1400b4c60]
lea rcx, [rsp + 0x80]
imul r8, r8, 0x130
add r8, rax
call fcn.14007dc1c
xor edx, edx
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x190], 0x8001
lea r8d, [rdx + 0x2c]
mov dword [rsp + 0x194], 0x620
call fcn.14007cd30
lea rax, [rsp + 0x40]
test r12d, r12d
sete bpl
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x190]
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x80]
mov r8d, 0x620
mov dword [rsp + 0x20], 0x2c
call qword [sym.imp.KERNEL32.dll_CallNamedPipeA]
test eax, eax
je 0x140034788
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 1
lea r11, [rsp + 0x7b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x14003aa60
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r11d, eax
mov eax, 0x10624dd3
sub r11d, esi
mul r11d
shr edx, 6
cmp edx, edi
ja 0x14003aacb
xor edx, edx
mov rcx, rbx
call fcn.140066880
test eax, eax
je 0x14003aab6
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14003aa80
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x14003aae0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r11d, eax
mov eax, 0x10624dd3
sub r11d, esi
mul r11d
shr edx, 6
cmp edx, edi
ja 0x14003ab42
xor edx, edx
mov rcx, rbx
call fcn.140066880
test eax, eax
jne 0x14003ab42
lea rcx, str.CDisplayDeviceMan::WaitUntilDeviceAttached__Driver_not_attached_yet_n
call fcn.14000cbb0
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14003ab00
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x140040c30
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x160
mov rbx, rcx
mov rdi, rdx
xor esi, esi
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x104
mov qword [rax + 0x20], rsi
mov dword [rax + 0x18], esi
call fcn.14007cd30
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.14001bdd0
lea rdx, [rsp + 0x50]
lea rcx, str.CAutoDisplayProfile::SaveAdapterIdentifier_._SubKey__s_n
call fcn.14000cbb0
lea r11, [rsp + 0x188]
lea rdx, [rsp + 0x50]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140040d01
lea rax, [rsp + 0x180]
lea rdx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x188]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov rcx, rdi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140040d01
lea rdx, [rsp + 0x50]
lea rcx, str.Failed_to_open_registry_key__s.
call fcn.14000cbb0
xor eax, eax
jmp 0x140040d3f
mov rcx, qword [rsp + 0x188]
lea rdx, str.AdapterInfo
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 0x44
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140040d60
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x1c0
mov rsi, rdx
xor edx, edx
mov rdi, rcx
lea r8d, [rdx + 0x44]
lea rcx, [rsp + 0x170]
call fcn.14007cd30
xor ebp, ebp
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x104
mov qword [rsp + 0x50], rbp
mov dword [rsp + 0x1f0], ebp
mov dword [rsp + 0x58], 3
mov dword [rsp + 0x1f8], 0x44
call fcn.14007cd30
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.14001bdd0
lea rdx, [rsp + 0x60]
lea rcx, str.CAutoDisplayProfile::ValidateAdapterIdentifier_._SubKey__s_n
call fcn.14000cbb0
lea r11, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140040e57
lea rax, [rsp + 0x1f0]
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov rcx, rsi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140040e57
lea rdx, [rsp + 0x60]
lea rcx, str.ValidateAdapterIdentifier._Failed_to_open_registry_key__s.
call fcn.14000cbb0
xor eax, eax
add rsp, 0x1c0
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x1f8]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x170]
lea rdx, str.AdapterInfo
xor r8d, r8d
mov qword [rsp + 0x1e0], rbx
mov qword [rsp + 0x20], rax
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140040f28
lea r8d, [rax + 0x44]
lea rcx, [rsp + 0x170]
mov rdx, rdi
call fcn.14007eb10
test eax, eax
je 0x140040f24
cmp dword [0x1400df344], ebp
jne 0x140040f24
lea rcx, str.ValidateAdapterIdentifier._The_existing_profile_contains_different_adapter_information._Delete_all_profiles_n
call fcn.14000cbb0
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x104
call fcn.14007cd30
mov rax, qword [str.HKEY_CURRENT_USER_]
lea r11, [rsp + 0x60]
mov qword [r11], rax
mov rax, qword [0x1400b9088]
lea rcx, [rsp + 0x60]
mov qword [r11 + 8], rax
movzx eax, word [0x1400b9090]
xor edx, edx
mov word [r11 + 0x10], ax
movzx eax, byte [0x1400b9092]
mov byte [r11 + 0x12], al
call fcn.14001bdd0
lea rcx, [rsp + 0x60]
call fcn.140018a90
jmp 0x140040f8d
mov bl, 1
jmp 0x140040f8d
lea rcx, str.ValidateAdapterIdentifier._RegQueryValueEx_failed_n
call fcn.14000cbb0
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x104
call fcn.14007cd30
mov rax, qword [str.HKEY_CURRENT_USER_]
lea r11, [rsp + 0x60]
mov qword [r11], rax
mov rax, qword [0x1400b9088]
lea rcx, [rsp + 0x60]
mov qword [r11 + 8], rax
movzx eax, word [0x1400b9090]
xor edx, edx
mov word [r11 + 0x10], ax
movzx eax, byte [0x1400b9092]
mov byte [r11 + 0x12], al
call fcn.14001bdd0
lea rcx, [rsp + 0x60]
call fcn.140018a90
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
mov qword [rsp + 0x50], rbp
jne 0x140040fb1
mov rdx, rsi
mov rcx, rdi
call fcn.140040c30
test eax, eax
setne bl
movzx eax, bl
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1c0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400410d0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
lea rax, [rcx + 0x44]
mov rdi, rcx
xor ebx, ebx
lea rdx, str.DisplayLimits
xor r8d, r8d
lea r9d, [rbx + 3]
mov rcx, rsi
mov dword [rsp + 0x28], 0x70
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140041131
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.DisplayLimits
lea rcx, str.CAutoDisplayProfile::FlushToRegistry.__s_failed._err_d_n
mov r8d, eax
call fcn.14000cbb0
jmp 0x140041136
mov ebx, 1
lea rax, [rdi + 0x254]
lea rdx, str.Device1
mov r9d, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], 0xe4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140041185
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Device1
lea rcx, str.CAutoDisplayProfile::FlushToRegistry.__s_failed._err_d_n
mov r8d, eax
call fcn.14000cbb0
jmp 0x14004118a
mov ebx, 1
lea rax, [rdi + 0x338]
lea rdx, str.Device2
mov r9d, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], 0xe4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1400411d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Device2
lea rcx, str.CAutoDisplayProfile::FlushToRegistry.__s_failed._err_d_n
mov r8d, eax
call fcn.14000cbb0
jmp 0x1400411de
mov ebx, 1
lea rax, [rdi + 0x41c]
lea rdx, str.ProfileFlags
mov r9d, 4
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14004122d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.ProfileFlags
lea rcx, str.CAutoDisplayProfile::FlushToRegistry.__s_failed._err_d_n
mov r8d, eax
call fcn.14000cbb0
jmp 0x140041232
mov ebx, 1
lea rax, [rdi + 0xb4]
lea rdx, str.DeviceProfile
mov r9d, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], 0x1a0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140041295
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.DeviceProfile
lea rcx, str.CAutoDisplayProfile::FlushToRegistry.__s_failed._err_d_n
mov r8d, eax
call fcn.14000cbb0
test ebx, ebx
jne 0x14004129a
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov ebx, 1
xor eax, eax
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rax, [rsp + 0x30]
lea rdx, str.Timestamp
mov r9d, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rsi, qword [rsp + 0x58]
lea rcx, [rsp + 0x30]
mov rax, qword [rcx]
mov qword [rdi + 0x420], rax
mov rax, qword [rcx + 8]
mov qword [rdi + 0x428], rax
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14004a740
Capabilities:
Read .ini file
Write file on windows

Disassembly:
push rsi
push r12
sub rsp, 0x368
mov r12, r8
mov esi, edx
call fcn.14000d5c0
bt eax, 0xa
jae 0x14004a9df
test r12, r12
je 0x14004a9df
lea rcx, [rsp + 0x260]
xor edx, edx
mov r8d, 0x100
mov qword [rsp + 0x380], rbx
mov qword [rsp + 0x360], rdi
call fcn.14007cd30
lea rdx, str.Info_u
lea rcx, [rsp + 0x40]
mov r8d, esi
call fcn.14007dc1c
lea rdx, str.c:LogInfo.ini
lea r9, [rsp + 0x260]
mov qword [rsp + 0x28], rdx
lea r8, [0x1400b6ed5]
lea rcx, str.LogInfos
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x60], 0
call fcn.14007cd30
lea rdx, [0x1400bdd90]
lea rcx, [rsp + 0x260]
call fcn.14007e2a8
test rax, rax
mov rbx, rax
je 0x14004a833
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x14004a833
lea rdx, str.LogInfo:__s___
lea rcx, [rsp + 0x60]
mov r8, rbx
call fcn.14007dc1c
jmp 0x14004a847
lea rdx, str.LogInfo:_code__u___
lea rcx, [rsp + 0x60]
mov r8d, esi
call fcn.14007dc1c
xor esi, esi
cmp dword [r12], esi
jbe 0x14004a91b
mov qword [rsp + 0x388], rbp
lea rbp, [r12 + 4]
test esi, esi
je 0x14004a886
xor eax, eax
lea rdi, [rsp + 0x60]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x1400bdd64]
mov word [rdi - 1], ax
movzx eax, byte [0x1400bdd66]
mov byte [rdi + 1], al
test rbx, rbx
je 0x14004a8dd
lea rdx, [0x1400bdd90]
xor ecx, ecx
call fcn.14007e2a8
test rax, rax
mov rbx, rax
je 0x14004a8dd
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x14004a8dd
mov r9d, dword [rbp]
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x60]
repne scasb al, byte [rdi]
lea rdx, str._s__0x_x
mov r8, rbx
not rcx
lea rcx, [rsp + rcx + 0x5f]
call fcn.14007dc1c
jmp 0x14004a902
mov r8d, dword [rbp]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x60]
lea rdx, str.0x_x
repne scasb al, byte [rdi]
not rcx
lea rcx, [rsp + rcx + 0x5f]
call fcn.14007dc1c
add esi, 1
add rbp, 4
cmp esi, dword [r12]
jb 0x14004a860
mov rbp, qword [rsp + 0x388]
xor eax, eax
or rcx, 0xffffffffffffffff
xor r9d, r9d
mov qword [rsp + 0x30], 0
lea rdi, [rsp + 0x60]
lea r8d, [r9 + 1]
repne scasb al, byte [rdi]
movzx eax, word [0x1400a879c]
lea rcx, str.c:DrvLog.txt
mov word [rdi - 1], ax
movzx eax, byte [0x1400a879e]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 4
mov byte [rdi + 1], al
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x14004a9cf
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x60]
lea r9, [rsp + 0x398]
lea rdx, [rsp + 0x60]
repne scasb al, byte [rdi]
mov dword [rsp + 0x398], 0
mov qword [rsp + 0x20], rax
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x380]
mov rdi, qword [rsp + 0x360]
add rsp, 0x368
pop r12
pop rsi
ret
Function at 0x14004c640
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x200]
test rax, rax
je 0x14000359c
mov rcx, rax
add rsp, 0x28
jmp 0x14004c640
mov eax, dword [rcx + 0x214]
test dword [0x1400dd138], eax
je 0x1400035b6
lea rcx, str.CATIExtEvent::TerminateMsgThread:_ERROR_m_pDriverMessage_is_NULL
call fcn.14000cbb0
add rsp, 0x28
ret
sub rsp, 0x28
cmp dword [0x1400e3e70], 0
je 0x14004c691
xor ecx, ecx
lea rax, [0x1400e3da8]
mov r8d, dword [rax]
test r8d, r8d
je 0x14004c66a
cmp r8d, edx
jne 0x14004c66a
cmp qword [rax - 8], 0
jne 0x14004c678
add ecx, 1
add rax, 0x10
cmp ecx, 0xa
jae 0x14004c691
jmp 0x14004c656
lea rax, [0x1400e3da0]
add rcx, rcx
mov edx, 1
mov rcx, qword [rax + rcx*8]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14004cc30
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
cmp edx, 3
mov edi, r9d
mov ebx, r8d
mov dword [rsp + 0xb8], 0
jb 0x14004cc72
lea rcx, str.bPostMessageToCCC:_ulAceCommand_out_of_range
call fcn.14000cbb0
xor eax, eax
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
mov rcx, qword [0x1400e3e58]
test rcx, rcx
je 0x14004cc90
lea rdx, str.04874F40_A61B_405c_8206_7116B598FD8A
call qword [sym.imp.USER32.dll_GetPropA]
test rax, rax
jne 0x14004ccaa
lea rcx, [0x14004b3b0]
xor edx, edx
mov qword [0x1400e3e58], 0
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [0x1400e3e58], 0
jne 0x14004ccd3
lea rcx, str.bPostMessageToCCC:_failed_to_get_CCC_window_handle
call fcn.14000cbb0
xor eax, eax
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
test edi, edi
je 0x14004cce2
mov ecx, ebx
call fcn.14004aec0
mov ebx, eax
jmp 0x14004cd20
sub ebx, 1
je 0x14004cd1b
sub ebx, 1
je 0x14004cd14
sub ebx, 2
je 0x14004cd0d
sub ebx, 1
je 0x14004cd06
cmp ebx, 1
je 0x14004ccff
xor ebx, ebx
jmp 0x14004cd20
mov ebx, 0x2b
jmp 0x14004cd20
mov ebx, 0x24
jmp 0x14004cd20
mov ebx, 0x18
jmp 0x14004cd20
mov ebx, 0x13
jmp 0x14004cd20
mov ebx, 0x14
cmp ebx, 0x20
jb 0x14004cdf0
cmp ebx, 0x22
jbe 0x14004cd40
cmp ebx, 0x24
jbe 0x14004cdf0
cmp ebx, 0x2a
ja 0x14004cdf0
lea rcx, str.bPostMessageToCCC:_PowerXpress_related_msg
call fcn.14000cbb0
mov ecx, 0x10
call fcn.14007f8a4
test rax, rax
mov rdi, rax
je 0x14004cdf0
mov r8, qword [0x1400e3e58]
lea rdx, str.SendMessage_to__.8X_with_message_id:_.8X__lparam:__.8x
lea rcx, [rsp + 0x30]
mov r9d, 0x8486
mov dword [rsp + 0x20], ebx
call fcn.14007dc1c
lea rcx, [rsp + 0x30]
call fcn.140014620
mov r11, qword [0x1400e3e58]
lea r9, [rsp + 0xb8]
lea rcx, [0x14004b3f0]
xor r8d, r8d
mov rdx, rdi
mov qword [rdi], r11
mov dword [rdi + 8], 0x8486
mov dword [rdi + 0xc], ebx
mov dword [rsp + 0x20], 0
call fcn.14002d550
test rax, rax
je 0x14004cde8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
mov rcx, rdi
call fcn.14007f814
mov rcx, qword [0x1400e3e58]
mov r9d, ebx
xor r8d, r8d
mov edx, 0x8486
call qword [sym.imp.USER32.dll_PostMessageA]
mov rdx, qword [0x1400e3e58]
test eax, eax
je 0x14004ce35
lea rcx, str.bPostMessageToCCC:_PostMessage_success_ccc0x_x
call fcn.14000cbb0
mov eax, 1
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
lea rcx, str.bPostMessageToCCC:_PostMessage_failed_ccc0x_x
call fcn.14000cbb0
mov rbx, qword [rsp + 0xb0]
xor eax, eax
add rsp, 0xa0
pop rdi
ret
Function at 0x14004ced0
Capabilities:
Terminate process
Terminate thread

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x200]
test rax, rax
je 0x14000355c
mov rcx, rax
add rsp, 0x28
jmp 0x14004ced0
mov eax, dword [rcx + 0x214]
test dword [0x1400dd138], eax
je 0x140003576
lea rcx, str.CATIExtEvent::TerminateAllMsgThreads:_ERROR_m_pDriverMessage_is_NULL
call fcn.14000cbb0
add rsp, 0x28
ret
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rcx, qword [0x1400e3e78]
xor esi, esi
test rcx, rcx
je 0x14004cf05
lea edx, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x1400e3e78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1400e3e78], rsi
movsxd rdi, dword [0x1400e3e70]
test edi, edi
mov rax, rdi
je 0x14004cf57
lea rcx, [0x1400e3da0]
add rax, rax
mov qword [rsp + 0x30], rbx
lea rbx, [rcx + rax*8 - 0x10]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14004cf49
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rsi
mov dword [rbx + 8], esi
sub rbx, 0x10
add edi, 0xffffffff
jne 0x14004cf27
mov rbx, qword [rsp + 0x30]
mov dword [0x1400e3e70], esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140052ae0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
test r9b, r9b
mov esi, r8d
mov rbx, rdx
mov rdi, rcx
jne 0x140052b3a
mov qword [rsp + 0x28], rdx
xor r9d, r9d
or rcx, 0xffffffffffffffff
lea r8d, [r9 + 4]
xor edx, edx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test rax, rax
mov qword [rdi + 8], rax
je 0x140052b31
cmp rax, 0xffffffffffffffff
je 0x140052b31
lea rcx, str.CSharedDataBase::Init:_success_to_CreateFileMapping_for__s
jmp 0x140052b5e
lea rcx, str.CSharedDataBase::Init:_failed_to_CreateFileMapping_for__s
jmp 0x140052bb9
mov r8, rdx
xor edx, edx
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
test rax, rax
mov qword [rdi + 8], rax
je 0x140052bb2
cmp rax, 0xffffffffffffffff
je 0x140052bb2
lea rcx, str.CSharedDataBase::Init:_success_to_OpenFileMapping_for__s
mov rdx, rbx
call fcn.14000cbb0
mov rcx, qword [rdi + 8]
xor r9d, r9d
lea edx, [r9 + 6]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdx, rbx
test rax, rax
mov qword [rdi + 0x10], rax
jne 0x140052b94
lea rcx, str.CSharedDataBase::Init:_failed_to_MapViewOfFile_for__s
jmp 0x140052bbc
lea rcx, str.CSharedDataBase::Init:_success_to_MapViewOfFile_for__s
call fcn.14000cbb0
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rcx, str.CSharedDataBase::Init:_failed_to_OpenFileMapping_for__s
mov rdx, rbx
call fcn.14000cbb0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x140056100
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x150
mov rbx, rcx
lea rcx, [0x1400df630]
or edx, 0xffffffff
call fcn.14001afe0
test eax, eax
jne 0x140056142
bt dword [0x1400dd138], 0x10
jae 0x140056268
lea rcx, str.PowerXpressCreateProcess:_failed_to_acquire_PX_mutex_lock
call fcn.14000cbb0
add rsp, 0x150
pop rbx
ret
lea rcx, [0x1400df630]
call fcn.14001af60
test eax, eax
je 0x140056252
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x64]
call fcn.14007cd30
mov r11d, dword [rbx + 0xc]
mov r9d, dword [rbx + 8]
mov r8d, dword [rbx + 4]
lea rdx, str.Ati2evxx.exe__PowerXpress__d__d__d
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x20], r11d
call fcn.14007dc1c
xor r11d, r11d
lea rcx, [rsp + 0xe0]
lea r8d, [r11 + 0x68]
xor edx, edx
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x60], r11
call fcn.14007cd30
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xe0]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0xe0], 0x68
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140056233
bt dword [0x1400dd138], 0x10
jae 0x140056214
lea rcx, str.PowerXpressCreateProcess:_create_PowerXpress_process_n
call fcn.14000cbb0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x150
pop rbx
ret
bt dword [0x1400dd138], 0x10
jae 0x140056268
lea rcx, str.PowerXpressCreateProcess:_failed_to_create_PowerXpress_process_n
call fcn.14000cbb0
add rsp, 0x150
pop rbx
ret
bt dword [0x1400dd138], 0x10
jae 0x140056268
lea rcx, str.PowerXpressCreateProcess:_failed_to_unlock_PX_mutex
call fcn.14000cbb0
add rsp, 0x150
pop rbx
ret
Function at 0x140056280
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rdi
push r13
push r15
mov eax, 0x3148
call fcn.1400a12b0
sub rsp, rax
or rcx, 0xffffffffffffffff
xor eax, eax
xor r15d, r15d
lea rdi, str.dwm.exe
xor edx, edx
mov r8d, 0x1000
repne scasb al, byte [rdi]
mov dword [rsp + 0x3178], r15d
mov ebp, r15d
not rcx
lea r13, [rcx - 1]
lea rcx, [rsp + 0x130]
call fcn.14007cd30
lea r8, [rsp + 0x3178]
lea rcx, [rsp + 0x130]
mov edx, 0x1000
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x140056455
mov eax, dword [rsp + 0x3178]
shr eax, 2
je 0x140056455
mov qword [rsp + 0x3180], rbx
mov qword [rsp + 0x3140], rsi
mov qword [rsp + 0x3138], r12
mov qword [rsp + 0x3130], r14
lea r12, [rsp + 0x130]
mov r14d, eax
nop
nop
mov r8d, dword [r12]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rsi, rax
je 0x140056417
lea rcx, [rsp + 0x1138]
xor edx, edx
mov r8d, 0x1ff8
mov qword [rsp + 0x1130], r15
call fcn.14007cd30
lea r9, [rsp + 0x3170]
lea rdx, [rsp + 0x1130]
mov r8d, 0x2000
mov rcx, rsi
mov dword [rsp + 0x3170], r15d
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x14005640e
test dword [rsp + 0x3170], 0xfffffff8
mov edi, r15d
jbe 0x14005640e
lea rbx, [rsp + 0x1130]
nop
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x104
call fcn.14007cd30
mov rdx, qword [rbx]
lea r8, [rsp + 0x20]
mov r9d, 0x104
mov rcx, rsi
call sub.PSAPI.DLL_GetModuleBaseNameA
test eax, eax
je 0x1400563f4
lea rdx, str.dwm.exe
lea rcx, [rsp + 0x20]
mov r8d, r13d
call fcn.14007f2bc
test eax, eax
je 0x14005640b
mov eax, dword [rsp + 0x3170]
add edi, 1
add rbx, 8
shr eax, 3
cmp edi, eax
jb 0x1400563b0
jmp 0x14005640e
add ebp, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add r12, 4
sub r14, 1
jne 0x140056330
mov r14, qword [rsp + 0x3130]
mov r12, qword [rsp + 0x3138]
mov rsi, qword [rsp + 0x3140]
mov rbx, qword [rsp + 0x3180]
mov eax, ebp
add rsp, 0x3148
pop r15
pop r13
pop rdi
pop rbp
ret
mov eax, r15d
add rsp, 0x3148
pop r15
pop r13
pop rdi
pop rbp
ret