joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000447f0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x5f0
mov rax, qword [0x1000730b0]
xor rax, rsp
mov qword [rsp + 0x5e0], rax
xor edi, edi
mov rbx, rcx
mov rcx, qword [rcx + 0xb0]
mov rbp, rdx
lea rdx, [rsp + 0x60]
lea r8d, [rdi + 0x64]
mov rsi, rdi
mov qword [rsp + 0x30], rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [rsp + 0x60], di
jne 0x10004485b
cmp rbp, 0x2b
jne 0x100044854
mov rcx, rbx
call fcn.100044590
mov al, 1
jmp 0x100044a62
mov rcx, qword [0x100073578]
lea rdx, [rsp + 0x60]
mov r8d, 0x64
mov rcx, qword [rcx + 0x20]
call fcn.100003154
mov r9d, dword [0x100073064]
mov edx, 0x64
lea r8d, [rdx - 0x60]
lea rcx, [rsp + 0x60]
call fcn.100003a78
cmp eax, edi
jne 0x1000449e6
mov rcx, qword [0x100073578]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
call fcn.1000132ac
cmp eax, edi
je 0x1000449d5
mov rcx, qword [rbx + 0xb0]
lea rdx, [rsp + 0x60]
mov r8d, 0x64
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rsi, qword [rsp + 0x30]
cmp rbp, 0xd
je 0x1000448df
cmp rbp, 9
jne 0x1000448ea
cmp word [rsp + 0x60], di
je 0x100044986
movsxd r8, dword [rbx + 0xd0]
mov rcx, qword [rbx + 0xc0]
xor r9d, r9d
mov edx, 0x182
call qword [sym.imp.USER32.dll_SendMessageW]
cmp word [rsp + 0x60], di
je 0x100044986
mov rax, qword [0x100073578]
mov r9, rsi
mov rcx, qword [rax + 0x20]
mov rax, qword [rcx]
cmp dword [rax + 0x358], edi
je 0x100044964
mov edx, dword [0x100073060]
mov eax, 0x2d
lea rcx, [0x1000747e0]
cmp ax, word [rsi]
lea rax, [rsp + 0x130]
mov dword [rsp + 0x28], 0x54
sete dil
mov qword [rsp + 0x20], rax
mov r8d, edi
call fcn.10005224c
lea r9, [rsp + 0x130]
movsxd r8, dword [rbx + 0xd0]
mov rcx, qword [rbx + 0xc0]
mov edx, 0x181
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r8, dword [rbx + 0xd0]
jmp 0x1000449b0
mov rcx, qword [rbx + 0xc0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x18b
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rcx, dword [rbx + 0xd0]
lea r8, [rcx - 1]
cmp eax, ecx
je 0x1000449b0
mov r8, rcx
mov rcx, qword [rbx + 0xc0]
xor r9d, r9d
mov edx, Ordinal_392
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbx
call fcn.1000130b0
mov dil, 1
jmp 0x100044a56
mov rsi, qword [rsp + 0x30]
cmp rsi, rdi
je 0x1000449fa
mov qword [rsp + 0x48], rsi
jmp 0x100044a2b
cmp eax, 0x77
jne 0x1000449fa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, 0x77
jmp 0x100044a07
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, 0xdd
lea r8, [rsp + 0x1e0]
mov r9d, 0x200
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringW]
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x48], rax
mov rcx, qword [rbx + 0xb0]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov edx, 0x1503
mov dword [rsp + 0x38], 0x20
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x50], edi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov al, dil
mov rcx, qword [rsp + 0x5e0]
xor rcx, rsp
call fcn.100001c30
lea r11, [rsp + 0x5f0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x100046200
Capabilities:
Read .ini file

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x1000730b0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r12, r9
mov rbx, r8
mov rdi, rdx
mov ecx, 0x4e20
call fcn.100001f90
mov rsi, rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x2710
mov r9, rax
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebp, eax
xor r13d, r13d
cmp eax, r13d
jbe 0x1000462cf
mov ebx, r13d
mov ecx, ebx
lea rdx, [rsi + rcx*2]
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r13
mov word [rsp + 0x40], r13w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x38]
call fcn.10001b608
nop
mov eax, dword [rsp + 0x50]
lea ebx, [rbx + rax + 1]
lea rdx, [rsp + 0x38]
mov rcx, r12
call fcn.100049080
nop
cmp qword [rsp + 0x58], 8
jb 0x1000462cb
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_free
cmp ebp, ebx
ja 0x10004626b
mov rcx, rsi
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.100001c30
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x100051028
Capabilities:
Get geographical location
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1000730b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.AdjustCalendarDate
mov rcx, rax
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x38]
lea rdx, str.ConvertCalDateTimeToSystemTime
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x38]
lea rdx, str.ConvertSystemTimeToCalDateTime
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x38]
lea rdx, str.GetCalendarMonthsInYear
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x38]
lea rdx, str.GetCalendarDaysInMonth
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x38]
lea rdx, str.GetCalendarDifferenceInDays
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x38]
lea rdx, str.CompareCalendarDates
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [rsp + 0x20]
mov r9d, 8
mov edx, 0x1009
xor ecx, ecx
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
lea rcx, [rsp + 0x20]
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [rbx + 0x40], eax
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.100001c30
add rsp, 0x50
pop rbx
ret
Function at 0x10005452c
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get startup folder

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1000730b0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rsi, rdx
mov rbp, rcx
mov qword [rsp + 0x50], rdx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov word [rsp + 0x60], r12w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x62]
call sub.msvcrt.dll_memset
mov qword [rsi + 0x20], 7
mov qword [rsi + 0x18], r12
lea rbx, [rsi + 8]
mov word [rbx], r12w
xor r8d, r8d
lea rdx, [0x100062c88]
mov rcx, rsi
call fcn.10001b608
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea r8d, [r12 + 0x1a]
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, r12d
je 0x1000546eb
xor eax, eax
or r13, 0xffffffffffffffff
mov rcx, r13
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.10001b608
lea rdx, str.Microsoft_
mov rcx, rsi
call fcn.100048e10
mov r9, r13
xor r8d, r8d
lea rdx, [rbp + 0x28]
mov rcx, rsi
call fcn.10004f198
lea rdx, [0x100065a74]
mov rcx, rsi
call fcn.100048e10
cmp qword [rsi + 0x20], 8
jb 0x100054634
mov rcx, qword [rbx]
jmp 0x100054637
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10005469a
cmp qword [rsi + 0x20], 8
jb 0x10005464e
mov rdx, qword [rbx]
jmp 0x100054651
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
cmp eax, r12d
je 0x10005469a
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], r12w
mov r9, r13
xor r8d, r8d
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.10001bb30
nop
cmp qword [rsp + 0x48], 8
jb 0x1000546eb
mov rcx, qword [rsp + 0x30]
call sub.msvcrt.dll_free
jmp 0x1000546eb
cmp qword [rbp + 0x48], 8
jb 0x1000546a7
mov rdx, qword [rbp + 0x30]
jmp 0x1000546ab
lea rdx, [rbp + 0x30]
cmp qword [rsi + 0x20], 8
jb 0x1000546b5
mov rbx, qword [rbx]
lea r9, [rsp + 0x270]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor r8d, r8d
lea rdx, [0x100062c88]
mov rcx, rsi
call fcn.10001b608
lea rdx, [rsp + 0x270]
mov rcx, rsi
call fcn.100048e10
mov rax, rsi
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.100001c30
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x490
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x100054be0
Capabilities:
Delete file
Delete registry key

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
sub rsp, 0xb0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x1000730b0]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rsi, rcx
lea r8, [rcx + 0x28]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionApplets_
lea rcx, [r11 - 0x80]
call fcn.100053558
nop
lea r8, str.Recovery_
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.100056f90
nop
cmp qword [rsp + 0x68], 8
jb 0x100054c53
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_free
mov r12d, 7
mov qword [rsp + 0x68], r12
xor edi, edi
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x50], di
lea rdx, [0x100062c88]
mov rcx, rsi
call fcn.10004f64c
cmp al, dil
je 0x100054c9d
cmp qword [rsp + 0xa0], 8
jb 0x100054c96
mov rcx, qword [rsp + 0x88]
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x100054db3
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x80]
call fcn.10004f198
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], rdi
mov word [rsp + 0x28], di
mov r8d, 0x10
lea rdx, str.RecoveryFilePath
lea rcx, [rsp + 0x20]
call fcn.10001b608
nop
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x70]
lea rcx, [rsi + 0x60]
call fcn.100054f6c
mov rbx, qword [rax]
cmp qword [rsp + 0x40], 8
jb 0x100054d03
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
cmp rbx, qword [rsi + 0x68]
je 0x100054d68
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], rdi
mov word [rsp + 0x28], di
mov r8d, 0x10
lea rdx, str.RecoveryFilePath
lea rcx, [rsp + 0x20]
call fcn.10001b608
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x60]
call fcn.100054de4
cmp qword [rax + 0x20], 8
jb 0x100054d4b
mov rcx, qword [rax + 8]
jmp 0x100054d4f
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
cmp qword [rsp + 0x40], 8
jb 0x100054d68
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
lea rdx, [rsp + 0x88]
cmp qword [rsp + 0xa0], 8
cmovae rdx, qword [rsp + 0x88]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, 1
cmp eax, edi
cmove edi, ecx
cmp qword [rsp + 0xa0], 8
jb 0x100054db1
mov rcx, qword [rsp + 0x88]
call sub.msvcrt.dll_free
mov eax, edi
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.100001c30
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x10005d118
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x10005d183
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x10005d1a3
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret

Function at 0x1000e3000
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x38
and rsp, 0xfffffffffffffff0
movabs rcx, 0x1000e3062
movabs rax, sym.imp.KERNEL32.dll_LoadLibraryA
call qword [rax]
movabs rdx, 0x1000e306b
mov rcx, rax
movabs rax, sym.imp.KERNEL32.dll_GetProcAddress
call qword [rax]
xor ecx, ecx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov r9, rcx
movabs r8, 0x1000e3078
mov rdx, rcx
call rax
leave
jmp fcn.10001b9b8
Function at 0x1400015c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x1400015d3
xor eax, eax
test eax, eax
jne 0x1400015d3
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x140001627
mov eax, dword [rsp + 0x38]
jmp 0x140001637
cmp dword [rsp + 0x30], 4
je 0x140001635
mov eax, 0xd
jmp 0x140001637
xor eax, eax
add rsp, 0x48
ret

Function at 0x140001640
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x140001658
xor eax, eax
test eax, eax
jne 0x140001658
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
shl rax, 1
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x68]
mov dword [rax], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x1400016c0
mov eax, dword [rsp + 0x38]
jmp 0x140001743
cmp dword [rsp + 0x30], 1
je 0x1400016d5
cmp dword [rsp + 0x30], 2
je 0x1400016d5
mov eax, 0xd
jmp 0x140001743
cmp qword [rsp + 0x60], 0
je 0x140001729
cmp dword [rsp + 0x34], 0
je 0x14000171f
mov eax, dword [rsp + 0x34]
xor edx, edx
mov ecx, 2
div rcx
test rdx, rdx
jne 0x140001716
mov eax, dword [rsp + 0x34]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, rax
mov rax, qword [rsp + 0x60]
movzx eax, word [rax + rcx*2 - 2]
test eax, eax
je 0x14000171d
mov eax, 0xd
jmp 0x140001743
jmp 0x140001729
xor ecx, ecx
mov rax, qword [rsp + 0x60]
mov word [rax], cx
mov eax, dword [rsp + 0x34]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
mov dword [rax], ecx
xor eax, eax
add rsp, 0x48
ret

Function at 0x1400031d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x1400031e8
xor eax, eax
test eax, eax
jne 0x1400031e8
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x140003234
mov eax, dword [rsp + 0x34]
jmp 0x140003244
cmp dword [rsp + 0x30], 3
je 0x140003242
mov eax, 0xd
jmp 0x140003244
xor eax, eax
add rsp, 0x48
ret
Function at 0x14000993b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400470e0]
jne 0x1400073da
rol rcx, 0x10
test cx, 0xffff
jne 0x1400073d6
repz ret
ror rcx, 0x10
jmp 0x140009894
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140049000]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1400490f8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140009919
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140049000]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000993b
mov rax, qword [rsp + 0x88]
mov qword [0x1400490f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140049098], rax
mov rax, qword [0x1400490f8]
mov qword [0x140048f70], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140049080], rax
mov dword [0x140048f60], 0xc0000409
mov dword [0x140048f64], 1
mov rax, qword [0x1400470e0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400470e8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140048ff8], eax
mov ecx, 1
call fcn.14000fb84
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14002efe8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140048ff8], 0
jne 0x1400099c2
mov ecx, 1
call fcn.14000fb84
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14000d1a0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14000d008
Function at 0x140011518
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.14000a998
xor ebx, ebx
mov rdi, rax
cmp qword [0x140049de0], rbx
jne 0x14001161e
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400116f3
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400116f3
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140049de0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140049de8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140049df0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140049e00], rax
test rax, rax
je 0x140011615
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140049df8], rax
jmp 0x140011625
mov rax, qword [0x140049df8]
jmp 0x14001162c
mov rax, qword [0x140049df8]
mov r11, qword [0x140049e00]
cmp rax, rdi
je 0x140011694
cmp r11, rdi
je 0x140011694
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140049e00]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140011694
test rax, rax
je 0x140011694
call rsi
test rax, rax
je 0x14001168e
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14001168e
test byte [rsp + 0x38], 1
jne 0x140011694
bts ebp, 0x15
jmp 0x1400116d2
mov rcx, qword [0x140049de8]
cmp rcx, rdi
je 0x1400116d2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400116d2
call rax
mov rbx, rax
test rax, rax
je 0x1400116d2
mov rcx, qword [0x140049df0]
cmp rcx, rdi
je 0x1400116d2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400116d2
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140049de0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400116f3
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1400116f5
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14001a360
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x14001a3a5
mov r9d, dword [rsp + 0x30]
lea r8, [0x1400316f0]
mov edx, 0x5e
lea rcx, [0x140031720]
call fcn.1400068e0
jmp 0x14001a4c9
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x40], 0
jne 0x14001a40d
mov rax, qword [rsp + 0x50]
add rax, 0x40
mov qword [rsp + 0x20], rax
lea r9, [0x140041588]
mov r8d, reloc.OLEAUT32.dll_SafeArrayUnaccessData
xor edx, edx
lea rcx, [0x140041578]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x14001a40d
mov r9d, dword [rsp + 0x30]
lea r8, [0x1400317a0]
mov edx, 0x65
lea rcx, [0x1400317d0]
call fcn.1400068e0
jmp 0x14001a4c9
mov dword [rsp + 0x34], 0
jmp 0x14001a422
mov eax, dword [rsp + 0x34]
add eax, 1
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 3
jge 0x14001a44d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r11, rax
movsxd rcx, dword [rsp + 0x34]
mov rax, qword [rsp + 0x50]
mov qword [rax + rcx*8 + 8], r11
jmp 0x14001a417
mov dword [rsp + 0x38], 0
jmp 0x14001a462
mov eax, dword [rsp + 0x38]
add eax, 1
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 2
jge 0x14001a48d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r11, rax
movsxd rcx, dword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
mov qword [rax + rcx*8 + 0x28], r11
jmp 0x14001a457
mov rax, qword [rsp + 0x50]
add rax, 0x38
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
lea r8, [0x140019fd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r11, rax
mov rax, qword [rsp + 0x50]
mov qword [rax + 0x20], r11
mov al, 1
jmp 0x14001a50e
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x40], 0
je 0x14001a4fa
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x40]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x40]
mov rax, qword [rax]
call qword [rax + 0x10]
mov r11, qword [rsp + 0x50]
mov qword [r11 + 0x40], 0
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, [0x140031850]
call fcn.1400068e0
xor al, al
add rsp, 0x48
ret

Function at 0x14001aec0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rcx, qword [rsp + 0x50]
call fcn.14001a360
mov byte [rsp + 0x30], al
mov rcx, qword [rsp + 0x50]
call fcn.14001a5c0
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x14001af27
mov rax, qword [rsp + 0x50]
add rax, 0xa8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
lea r8, [0x14001a6b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r11, rax
mov rax, qword [rsp + 0x50]
mov qword [rax + 0xa0], r11
mov al, byte [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x14001dc70
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x498], 0
je 0x14001dd64
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x498]
call fcn.140026cb0
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x498]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x14001dce8
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov edx, 1
mov rcx, qword [rsp + 0x40]
call qword [rax + 0x20]
mov qword [rsp + 0x50], rax
jmp 0x14001dcf1
mov qword [rsp + 0x50], 0
mov rax, qword [rsp + 0x70]
mov qword [rax + 0x498], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWARERealtekAudio
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001dd64
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.SensorAPI_uninit_HRESULT_
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x68
ret