joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802debac
Capabilities:
Encode data using xor

Disassembly:
call 0x152af6bbd
add dword [rdx], edx
or byte [rbx + rcx*4 + 0x64], 0x24
mov r12, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x4557b304
jae 0x1802f0d4a
mov r12, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x4557b304
jae 0x1802f0d4a
add dword [rax], eax
add byte [rax], al
rcl byte [rdx], cl
push rbp
sbb al, 0x44
movabs al, byte [0x9e505f5ff0bcee4c]
sub eax, 0xecf3a572
cli
std
jl 0x1802dec21
lodsb al, byte [rsi]
or r12d, dword [r14 - 0x71]
enter 0xffffffffffffedad, 0x73
mov edi, 0xe42d7140
lodsb al, byte [rsi]
lodsd eax, dword [rsi]
in eax, dx
jae 0x1802deba4
jno 0x1802dec15
in al, 0xac
xor dword [rbx - 0x180bd46d], esp
movabs dword [0x19cdc267e4e77ea1], eax
jge 0x1802debe1
xor al, 0xba
jmp 0x1802debe1
invalid
xor dword [rbx + 0x37], edx
pop rdx
invalid
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.1803add92

Function at 0x18036e733
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x48]
call fcn.180416674
cmp al, 0x37
mov esi, 0x48113df0
out dx, eax
invalid
mov rbx, qword [rsp + 0x40]
and al, 0x40
jns 0x18032cbea
or ecx, dword [rbx + 0x25]
sub dl, dl
insd dword [rdi], dx
cmp eax, 0xe954fe3a
inc byte [rbp*2 + 0x3584028c]
lodsb al, byte [rsi]
sbb al, 0x18
xor byte [rdi - 0x25], ch
xchg esp, eax
jae 0x18036e736
invalid
Function at 0x1400013d0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov edx, 4
mov rbx, rcx
call qword [sym.imp.USER32.dll_KillTimer]
test dword [0x1400a1f50], 0xfffffffd
je 0x140001416
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400014e7
lea r8, str.Received_init_request__but_the_client_has_been_initialized_already.
mov edx, 0x100
add rsp, 0x20
pop rbx
jmp fcn.1400260c0
call fcn.140007050
test eax, eax
je 0x140001495
mov rcx, rbx
call fcn.1400018b0
test eax, eax
je 0x140001464
mov dword [0x1400a1f50], 3
call fcn.140007900
cmp dword [0x1400a1f80], 0
je 0x1400014e7
mov edx, 3
mov r8d, 0x1d4c0
xor r9d, r9d
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_SetTimer]
mov dword [0x1400a1f50], 2
call fcn.1400063c0
mov edx, dword [0x1400a1f60]
test edx, edx
je 0x140001486
mov rcx, rbx
call qword [sym.imp.USER32.dll_UnregisterHotKey]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400014b2
lea r8, str.InitClient___failed__re_scheduling_init.
mov edx, 0x100
call fcn.1400260c0
cmp dword [0x1400a1f50], 0
je 0x1400014ca
call fcn.1400063c0
mov dword [0x1400a1f50], 2
mov edx, 4
mov r8d, 0xea60
xor r9d, r9d
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_SetTimer]
add rsp, 0x20
pop rbx
ret

Function at 0x1400014f0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp rdx, 0xa
je 0x140001531
cmp rdx, 0x12
jne 0x14000153a
mov rcx, qword [0x1400a20e8]
call fcn.140014fb0
test eax, eax
jne 0x140001531
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x14000153a
lea r8, str.WM_POWERBROADCAST_UpdateAdapters_failed
mov edx, 0x100
add rsp, 0x28
jmp fcn.1400260c0
add rsp, 0x28
jmp fcn.140018d00
add rsp, 0x28
ret
Function at 0x140001540
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
sub rcx, 1
je 0x1400015f5
sub rcx, 1
je 0x1400015b7
sub rcx, 5
je 0x140001592
cmp rcx, 1
jne 0x1400016a8
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140001581
lea r8, str.WTS_SESSION_UNLOCK
mov edx, 0x100
call fcn.1400260c0
lea rcx, [0x1400a2008]
call fcn.1400284d0
jmp 0x140001693
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400016a8
lea r8, str.WTS_SESSION_LOCK
mov edx, 0x100
add rsp, 0x28
jmp fcn.1400260c0
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400015d4
lea r8, str.WTS_CONSOLE_DISCONNECT
mov edx, 0x100
call fcn.1400260c0
mov rcx, qword [0x1400a1fd0]
xor eax, eax
mov dword [section..data], eax
test rcx, rcx
je 0x1400016a8
add rsp, 0x28
jmp fcn.14000a290
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140001612
lea r8, str.WTS_CONSOLE_CONNECT
mov edx, 0x100
call fcn.1400260c0
mov dword [section..data], 1
call fcn.140028180
mov rcx, qword [0x1400a20e8]
xor eax, eax
test rcx, rcx
je 0x140001639
call fcn.140015da0
cmp eax, 1
je 0x140001659
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140001659
mov r9d, eax
lea r8, str.EscapeCallManager::UnloadApplicationUserProfiles_failed_with_error_code__d
mov edx, 2
call fcn.1400260c0
cmp dword [0x1400a1f64], 0
je 0x140001693
mov rcx, qword [0x1400a20e8]
call fcn.140015b00
cmp eax, 1
je 0x140001693
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140001693
mov r9d, eax
lea r8, str.EscapeCallManager::LoadApplicationUserProfiles_failed_with_error_code__d
mov edx, 2
call fcn.1400260c0
mov rcx, qword [0x1400a20e8]
test rcx, rcx
je 0x1400016a8
add rsp, 0x28
jmp fcn.140014fb0
add rsp, 0x28
ret
Function at 0x1400016b0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp rdx, 4
jne 0x1400016c3
add rsp, 0x28
jmp fcn.1400013d0
cmp dword [0x1400a1f50], 3
jne 0x1400017d8
sub rdx, 3
je 0x140001762
sub rdx, 2
je 0x140001707
sub rdx, 1
je 0x1400016fc
cmp rdx, 1
jne 0x1400017d8
movzx ecx, dl
add rsp, 0x28
jmp 0x140024680
xor ecx, ecx
add rsp, 0x28
jmp 0x140024680
mov ecx, 5
call fcn.140025c30
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x38], 0
call qword [sym.imp.dwmapi.dll_DwmIsCompositionEnabled]
test eax, eax
jne 0x1400017d8
cmp dword [rsp + 0x38], eax
je 0x14000174a
xor ecx, ecx
call qword [sym.imp.dwmapi.dll_Ordinal_102]
mov ecx, 1
call qword [sym.imp.dwmapi.dll_Ordinal_102]
add rsp, 0x28
ret
mov ecx, 1
call qword [sym.imp.dwmapi.dll_Ordinal_102]
xor ecx, ecx
call qword [sym.imp.dwmapi.dll_Ordinal_102]
add rsp, 0x28
ret
mov ecx, 3
mov dword [rsp + 0x38], 0xffffffff
call fcn.140025c30
mov rcx, qword [0x1400a20e8]
lea rdx, [rsp + 0x38]
call fcn.1400143d0
test eax, eax
jne 0x1400017a9
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400017d8
lea r8, str.TwoMinuteTimerExpired_GetPrimaryAdapterIndex_failed.
lea edx, [rax + 2]
call fcn.1400260c0
add rsp, 0x28
ret
mov edx, dword [rsp + 0x38]
mov rcx, qword [0x1400a20e8]
call fcn.14000d360
test eax, eax
jne 0x1400017d8
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400017d8
lea r8, str.KMD_Message_AdapterEnterIPS_failed.
lea edx, [rax + 2]
call fcn.1400260c0
add rsp, 0x28
ret
push rbx
sub rsp, 0x20
movzx ebx, cl
lea rcx, [0x1400a2120]
call fcn.1400284d0
test bl, bl
je 0x1400246b4
mov ecx, 7
call fcn.140025c30
lea rcx, [0x1400a2128]
add rsp, 0x20
pop rbx
jmp fcn.1400284d0
mov ecx, 6
add rsp, 0x20
pop rbx
jmp fcn.140025c30
Function at 0x140001e30
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
lea rdx, str.PopUpReboot
call fcn.14002d7d4
test rax, rax
je 0x140001e7e
call fcn.140007a50
test eax, eax
je 0x140001e71
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140026ea0
call fcn.14001aeb0
call fcn.140006670
xor eax, eax
add rsp, 0x50
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
lea rdx, str.UninstallPciFilter
call fcn.14002d7d4
test rax, rax
je 0x140001eb3
call fcn.1400079e0
test eax, eax
je 0x140001ea6
call fcn.1400231f0
call fcn.140006660
xor eax, eax
add rsp, 0x50
pop rbx
ret
call fcn.1400072c0
test eax, eax
je 0x140001f7c
lea rdx, str.AMD_EEU_Client
mov rcx, rbx
call fcn.140001050
mov qword [0x1400a1f58], rax
test rax, rax
je 0x140001f7c
mov rcx, rax
call fcn.140001980
test eax, eax
je 0x140001f7c
mov rcx, qword [0x1400a1f58]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8000
call qword [sym.imp.USER32.dll_PostMessageA]
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x140001f42
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageA]
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x140001f20
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140001f5f
lea r8, str.Client_exiting.
mov edx, 0x100
call fcn.1400260c0
mov rcx, qword [0x1400a1f68]
call fcn.1400268e0
mov rcx, qword [0x1400a1f70]
call fcn.1400268e0
call fcn.140023d40
call fcn.140006590
xor eax, eax
add rsp, 0x50
pop rbx
ret
Function at 0x140001fa0
Capabilities:
Read file via mapping

Disassembly:
push rbx
sub rsp, 0x250
lea rax, vtable.IPCClient.0
mov rbx, rcx
mov qword [rcx], rax
xor edx, edx
xor eax, eax
mov r8d, 0x104
mov qword [rcx + 0x30], rax
lea rcx, [rsp + 0x30]
call fcn.14002e170
xor edx, edx
lea rcx, [rsp + 0x140]
mov r8d, 0x104
call fcn.14002e170
mov r9d, dword [0x1400a1004]
lea r8, str.GlobalAMDClient
lea rdx, str._s__u
lea rcx, [rsp + 0x30]
call fcn.1400046d0
mov r9d, dword [0x1400a1004]
lea r8, str.GlobalAMDClientAck
lea rdx, str._s__u
lea rcx, [rsp + 0x140]
call fcn.1400046d0
lea rcx, [rbx + 8]
lea rdx, [rsp + 0x30]
call fcn.140028490
test eax, eax
jne 0x140002073
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400021b5
lea rax, [rsp + 0x30]
lea r9, str.OpenTheEvent_failed_for__s
mov qword [rsp + 0x20], rax
mov edx, 0x60004004
mov r8d, 1
call fcn.140025e10
mov rax, rbx
add rsp, 0x250
pop rbx
ret
lea rcx, [rbx + 0x10]
lea rdx, [rsp + 0x140]
call fcn.140028490
test eax, eax
jne 0x1400020a2
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400021b5
lea rax, [rsp + 0x140]
jmp 0x14000204b
lea rdx, str.GlobalEEU_Memory_Map_Mutex
mov qword [rsp + 0x260], rdi
lea rcx, [rbx + 0x28]
call fcn.1400291c0
test eax, eax
jne 0x1400020d7
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400021ad
lea r9, str.OpenMutex_failed.
jmp 0x140002143
xor edx, edx
lea r8, str.GlobalEEU_Memory_Map
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x14000210b
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400021ad
lea r9, str.OpenFileMapping_failed.
jmp 0x140002143
xor r9d, r9d
mov qword [rsp + 0x20], 0x190
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x20], rax
test rax, rax
jne 0x140002155
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400021ad
lea r9, str.MapViewOfFile_failed.
mov edx, 0x60004008
mov r8d, 1
call fcn.140025e10
jmp 0x1400021ad
lea rcx, [rbx + 0x28]
call fcn.140029130
test eax, eax
je 0x1400021ad
mov rax, qword [rbx + 0x20]
cmp dword [rax], 8
je 0x140002199
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x14000218e
lea r9, str.MemoryMap_version_is_incorrect.
mov edx, 0x60004008
mov r8d, 1
call fcn.140025e10
lea rcx, [rbx + 0x28]
call fcn.1400291f0
jmp 0x1400021ad
or dword [rax + 4], 1
lea rcx, [rbx + 0x28]
call fcn.1400291f0
mov dword [rbx + 0x30], 1
mov rdi, qword [rsp + 0x260]
mov rax, rbx
add rsp, 0x250
pop rbx
ret
Function at 0x140002840
Capabilities:
Create process on windows
Read file via mapping

Disassembly:
push rbx
sub rsp, 0x110
mov rbx, rcx
lea rdx, str.GlobalTray_Icon_Memory_Map_Mutex
add rcx, 0x48
call fcn.140029170
test eax, eax
jne 0x140002890
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140002a9a
lea r9, str.Tray_Icon_Memory_Map_CreateMutex_failed.
mov edx, 0x60004008
mov r8d, 1
call fcn.140025e10
add rsp, 0x110
pop rbx
ret
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xe0]
call fcn.1400262c0
xor r9d, r9d
lea rax, str.GlobalDGTrayIconMemoryMap
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x50]
xor ecx, ecx
mov dword [rsp + 0x20], 0x2ed00
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rbx + 0x38], rax
test rax, rax
jne 0x1400028ec
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140002a9a
lea r9, str.CreateFileMapping_failed.
jmp 0x140002877
xor r9d, r9d
mov qword [rsp + 0x20], 0x2ed00
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x40], rax
test rax, rax
jne 0x14000292d
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140002a9a
lea r9, str.MapViewOfFile_failed.
jmp 0x140002877
xor edx, edx
mov r8d, 0x2ed00
mov rcx, rax
call fcn.14002e170
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.14002e170
xor ebx, ebx
mov dword [rsp + 0x70], 0x68
lea rax, str.WinSta0Default
mov word [rsp + 0xb0], bx
mov qword [rsp + 0x80], rax
lea rcx, str.DGTrayIcon.exe
lea rax, [0x1400a1f90]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140002a7d
mov rcx, qword [0x1400a2058]
test rcx, rcx
je 0x1400029f1
mov rdx, qword [0x1400a1f90]
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x1400029f1
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400029f1
lea r8, str.Failed_to_assign_the_DGTrayIcon_process_to_the_process_terminator_job_object.
mov edx, 0x100
call fcn.1400260c0
mov r8d, 1
mov qword [rsp + 0x120], rbx
lea rdx, str.GlobalDGTrayIconInit
lea rcx, [rsp + 0x120]
call fcn.140028430
test eax, eax
jne 0x140002a34
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140002a9a
lea r9, str.CreateTheEvent_DGTrayIconInitEvent_failed.
mov edx, 0x60004005
jmp 0x14000287c
mov edx, 0x3e8
lea rcx, [rsp + 0x120]
call fcn.1400284f0
test eax, eax
je 0x140002a67
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140002a67
lea r8, str.The_awaited_DGTrayIconInitEvent_hasnt_arrived.
mov edx, 0x10000
call fcn.1400260c0
lea rcx, [rsp + 0x120]
call fcn.140028420
add rsp, 0x110
pop rbx
ret
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140002a9a
lea r8, str.DGTrayIcon_process_failed_to_spawn.
mov edx, 0x100
call fcn.1400260c0
add rsp, 0x110
pop rbx
ret
Function at 0x140005bf0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x1e0
xor eax, eax
mov dword [rsp + 0x50], 1
mov ebx, r8d
mov qword [rsp + 0x58], rax
mov ebp, edx
mov qword [rsp + 0x60], rax
mov r14, rcx
mov qword [rsp + 0x68], rax
xor edi, edi
lea rcx, [rsp + 0x70]
xor edx, edx
lea r8d, [rdi + 0x68]
call fcn.14002e170
xor edx, edx
lea rcx, [rsp + 0xe0]
mov r8d, 0x100
call fcn.14002e170
mov r9d, ebx
mov dword [rsp + 0x70], 0x68
mov r8d, ebp
lea rdx, str.ProcessID:_X_HookType:_X
lea rcx, [rsp + 0xe0]
call fcn.1400046d0
mov r8d, ebp
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140005d7b
lea rdx, [rsp + 0x218]
mov dword [rsp + 0x218], edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0xe0]
lea rax, [rsp + 0x70]
xor r8d, r8d
lea rcx, str...SysWow64_atieah32.exe
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
cmp dword [rsp + 0x218], edi
jne 0x140005cee
lea rcx, str.atieah64.exe
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140005d7b
mov rcx, qword [0x1400a2058]
test rcx, rcx
je 0x140005d3b
mov rdx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x140005d3b
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140005d3b
lea r8, str.Failed_to_assign_atieah_to_the_process_terminator_job_object.
mov edx, 0x100
call fcn.1400260c0
mov rcx, qword [rsp + 0x58]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x50], edi
jne 0x140005d98
mov rcx, qword [0x1400a1fb0]
mov edi, 1
test rcx, rcx
je 0x140005db5
lea r8, str.atieah_UpdateImports_succeeded.
jmp 0x140005dab
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140005db5
lea r8, str.GpuMsgHandler::HookInject_CreateProcess_failed.
mov edx, 2
call fcn.1400260c0
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140005db5
lea r8, str.atieah_UpdateImports_failed.
mov edx, 2
call fcn.1400260c0
mov r8d, edi
mov edx, ebp
mov rcx, r14
call fcn.140005ee0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400072c0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x158
mov qword [rsp + 0x30], 0xfffffffffffffffe
call fcn.1400269a0
mov dword [0x1400a202c], eax
cmp eax, 2
jl 0x140007552
mov dword [rsp + 0x28], 4
lea rax, [0x1400a202c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.EeuOsVersion
lea rdx, str.SoftwareAMDEEU
mov rcx, 0xffffffff80000002
call fcn.140028f20
test eax, eax
jne 0x14000733a
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x14000733a
lea r9, str.Write_RegValue_EeuOsVersion_failed.
mov edx, 0x60004005
lea r8d, [rax + 1]
call fcn.140025e10
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [0x1400a1004], eax
cmp eax, 0xffffffff
jne 0x14000735d
lea rcx, str.WTSGetActiveConsoleSessionId_failed
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x140007552
mov r9d, eax
lea r8, str.atieclxx
lea rdx, str._s__i
lea rcx, [rsp + 0x40]
call fcn.1400046d0
mov ecx, 0x120
call fcn.14002c6ec
mov qword [rsp + 0x160], rax
test rax, rax
je 0x1400073a4
lea r8, [0x14007e9ac]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140025c70
nop
mov qword [0x1400a1fb0], rax
test rax, rax
je 0x140007552
call fcn.140007920
test eax, eax
jne 0x1400073e3
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140007552
lea r8, str.A_client_for_this_session_already_exists.
mov edx, 0x60004002
call fcn.1400260c0
jmp 0x140007552
mov ecx, 0x50
call fcn.14002c6ec
mov qword [rsp + 0x160], rax
test rax, rax
je 0x140007407
mov rcx, rax
call fcn.140001fa0
mov rcx, rax
jmp 0x140007409
xor ecx, ecx
mov qword [0x1400a1fc0], rcx
test rcx, rcx
je 0x14000750d
cmp dword [rcx + 0x30], 0
je 0x14000750d
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1400a1ff0]
call fcn.140028430
test eax, eax
jne 0x140007465
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140007552
lea r9, str.CreateTheEvent__eClientExit_failed.
mov edx, 0x60004004
mov r8d, 1
call fcn.140025e10
jmp 0x140007552
xor r8d, r8d
lea rdx, str.aeed3838_33e0_4c55_88ea_cde13fc507d0
lea rcx, [0x1400a2090]
call fcn.140028430
test eax, eax
jne 0x1400074a8
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140007552
lea r9, str.VerifySingleProcessForRebootPopup_failed_to_create_event.
xor r8d, r8d
mov edx, 0x60004004
call fcn.140025e10
jmp 0x140007552
call fcn.140006f90
test eax, eax
jne 0x1400074d7
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140007552
lea r9, str.Creation_of_IPCClient_Threads_failed.
xor r8d, r8d
mov edx, 0x60004002
call fcn.140025e10
jmp 0x140007552
xor edx, edx
lea rcx, [0x1400a2078]
call fcn.140029170
test eax, eax
jne 0x140007501
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140007552
lea r9, str.CreateTheMutex__mPCIFInstallMutex_failed.
jmp 0x140007450
call fcn.14001f4d0
mov eax, 1
jmp 0x140007554
mov rax, qword [0x1400a1fb0]
test rax, rax
je 0x140007537
lea r9, str.Creation_of_IPCClient_failed.
xor r8d, r8d
mov edx, 0x60004002
mov rcx, rax
call fcn.140025e10
mov rcx, qword [0x1400a1fc0]
cmp dword [rcx + 0x30], 0
jne 0x140007552
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [0x1400a1fc0], 0
xor eax, eax
add rsp, 0x158
ret
Function at 0x1400097f0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x60
test byte [rcx + 4], 0x10
mov rbx, rcx
jne 0x140009825
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140009914
lea r8, str.HandleCrossFirePnPStopStart_ulFlag_does_not_have_PNP_FLAG_QUAD_INTERFACE_set.
mov edx, 0x20000
add rsp, 0x60
pop rbx
jmp fcn.1400260c0
lea rcx, [0x1400a2018]
call fcn.140029130
test eax, eax
jne 0x14000985b
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140009914
lea r8, str.HandleCrossFirePnPStopStart_AcquireTheMutex_failed.
mov edx, 0x20000
add rsp, 0x60
pop rbx
jmp fcn.140025e80
xor eax, eax
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov dword [section..data], eax
mov dword [rsp + 0x70], eax
call qword [sym.imp.dwmapi.dll_DwmIsCompositionEnabled]
test eax, eax
jne 0x1400098ac
cmp dword [rsp + 0x70], eax
je 0x1400098ac
xor ecx, ecx
call qword [sym.imp.dwmapi.dll_Ordinal_102]
mov eax, dword [rsp + 0x70]
mov edx, 1
mov rcx, qword [0x1400a1fd0]
mov dword [rsp + 0x20], eax
call fcn.14000aba0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140016730
test eax, eax
jne 0x1400098f6
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400098f6
lea r8, str.HandleCrossFirePnPStopStart_CompletePnPSequence_failed.
mov edx, 0x20000
call fcn.1400260c0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140009920
lea rcx, [0x1400a2018]
add rsp, 0x60
pop rbx
jmp fcn.1400291f0
add rsp, 0x60
pop rbx
ret

Function at 0x14000a890
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x14000a8b4
lea rdx, str.04874F40_A61B_405c_8206_7116B598FD8A
call qword [sym.imp.USER32.dll_GetPropA]
test rax, rax
jne 0x14000a8cb
xor edx, edx
mov qword [rbx + 0x38], 0
lea rcx, [0x14000a190]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rbx + 0x38], 0
jne 0x14000a907
xor edx, edx
lea rcx, str.9EDE85BB_30B3_4FDF_94C6_267ACB7EB43B
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [rbx + 0x38], rax
test rax, rax
jne 0x14000a907
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x14000a907
lea r8, str.FindCCCWindow_EnumWindows_failed.
mov edx, 0x40000
call fcn.1400260c0
mov rax, qword [rbx + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x14000aa20
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rdi, rdx
mov rbx, rcx
cmp dword [rdx + 0x808], 0
jne 0x14000ab6a
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x14000aa62
lea rdx, str.04874F40_A61B_405c_8206_7116B598FD8A
call qword [sym.imp.USER32.dll_GetPropA]
test rax, rax
jne 0x14000aa79
mov qword [rbx + 0x38], 0
xor edx, edx
lea rcx, [0x14000a190]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rbx + 0x38], 0
jne 0x14000ab6a
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x14000aaa1
lea r8, str.FindCCCWindow_EnumWindows_failed.
mov edx, 0x40000
call fcn.1400260c0
mov edx, 0x5c
lea rcx, [rdi + 8]
call fcn.14002fe64
mov rbx, rax
test rax, rax
je 0x14000ab6a
add rbx, 2
or r8, 0xffffffffffffffff
mov rax, r8
inc rax
cmp word [rbx + rax*2], 0
jne 0x14000aac6
inc eax
mov ecx, eax
mov eax, 2
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.14002c6a4
mov rdi, rax
test rax, rax
je 0x14000ab6a
mov rdx, rax
sub rdx, rbx
nop word [rax + rax]
movzx ecx, word [rbx]
mov word [rdx + rbx], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x14000ab00
mov rbx, qword [0x1400a1fd0]
mov ecx, 0x20
call fcn.14002c6ec
test rax, rax
je 0x14000ab6a
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x18], rcx
mov dword [rax], 0x8486
mov dword [rax + 4], 0x24020
mov dword [rax + 8], 1
mov qword [rax + 0x10], rdi
mov dword [rax + 0x18], ecx
lea rcx, [rbx + 0x10]
mov r8d, 1
mov rdx, rax
call fcn.14002be90
lea rcx, [rbx + 8]
call fcn.1400284d0
nop
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret