joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004e3b0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140008fe0
lea rcx, [rsp + 0x40]
call fcn.14004e370
movzx eax, al
test eax, eax
jne 0x14004e3f8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.14004e2a0
mov rax, qword [rsp + 0x70]
jmp 0x14004e5c9
lea rcx, [rsp + 0x40]
call fcn.140009050
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.14004e320
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.140009050
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.14004ab30
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14004e49e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.14004e2a0
mov rax, qword [rsp + 0x80]
jmp 0x14004e5c9
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.14001b970
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140008fe0
lea rcx, [rsp + 0x48]
call fcn.140009730
movzx eax, al
test eax, eax
jne 0x14004e505
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.140009710
lea rcx, [rsp + 0x40]
call fcn.14004e2a0
mov rax, qword [rsp + 0x88]
jmp 0x14004e5c9
lea rcx, [rsp + 0x48]
call fcn.140009050
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.140009050
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.14004ab30
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x14004e59b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.140009710
lea rcx, [rsp + 0x40]
call fcn.14004e2a0
mov rax, qword [rsp + 0xa0]
jmp 0x14004e5c9
lea rcx, [rsp + 0x48]
call fcn.14000ca70
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.140009710
lea rcx, [rsp + 0x40]
call fcn.14004e2a0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x14005d0a0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.14002e6f0
lea rcx, [rsp + 0x48]
call fcn.14002e6f0
call fcn.140037d80
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.14002e5e0
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14005d10f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.14002e780
lea rcx, [rsp + 0x78]
call fcn.14002e780
mov eax, dword [rsp + 0x24]
jmp 0x14005d1a0
call fcn.140037d80
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.14002e5e0
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x14005d156
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.14002e780
lea rcx, [rsp + 0x78]
call fcn.14002e780
mov eax, dword [rsp + 0x2c]
jmp 0x14005d1a0
lea rcx, [rsp + 0x48]
call fcn.14002eab0
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.14002eab0
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.14002e780
lea rcx, [rsp + 0x78]
call fcn.14002e780
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x1400025e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x40], 0
cmp qword [rsp + 0x78], 0
je 0x140002619
cmp qword [rsp + 0x60], 0
je 0x140002619
cmp qword [rsp + 0x68], 0
jne 0x14000261f
jmp 0x140002678
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x14000266b
jmp 0x140002678
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x140002690
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x40], 0
cmp qword [rsp + 0x78], 0
je 0x1400026c9
cmp qword [rsp + 0x60], 0
je 0x1400026c9
cmp qword [rsp + 0x68], 0
jne 0x1400026cf
jmp 0x14000272f
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x70]
imul rax, qword [rsp + 0x68]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x140002722
jmp 0x14000272f
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x140002aa0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x648
mov rax, qword [0x1403a3ab8]
xor rax, rsp
mov qword [rsp + 0x630], rax
mov byte [rsp + 0x20], 1
mov dword [rsp + 0x24], 0
lea rcx, [0x1400544be]
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryA]
test eax, eax
je 0x140002bc5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x24]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x140002bc0
cmp dword [rsp + 0x24], 0
je 0x140002b55
mov edx, 0x200
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
test eax, eax
je 0x140002b4e
lea rcx, [rsp + 0x30]
call fcn.14003e0d0
inc rax
mov r8, rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x230]
call fcn.140040d7c
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_AddDllDirectory]
test rax, rax
jne 0x140002b4c
mov byte [rsp + 0x20], 0
jmp 0x140002b53
mov byte [rsp + 0x20], 0
jmp 0x140002baa
mov edx, 0x200
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x140002ba5
lea rcx, [rsp + 0x30]
call fcn.14003e0d0
inc rax
mov r8, rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x230]
call fcn.140040d7c
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_AddDllDirectory]
test rax, rax
jne 0x140002ba3
mov byte [rsp + 0x20], 0
jmp 0x140002baa
mov byte [rsp + 0x20], 0
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
test eax, eax
jne 0x140002bbe
mov byte [rsp + 0x20], 0
jmp 0x140002bc5
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x630]
xor rcx, rsp
call fcn.140039770
add rsp, 0x648
ret
Function at 0x14000a2a0
Capabilities:
Create process on windows

Disassembly:
push rdi
sub rsp, 0x200
mov rax, qword [0x1403a3ab8]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
call fcn.14000b1b0
test eax, eax
je 0x14000a3e9
lea rax, [rsp + 0xe0]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0xe0]
call fcn.14000b2f0
mov edx, 0x104
lea rcx, [rsp + 0xe0]
call fcn.14000b220
test eax, eax
je 0x14000a3d6
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov dword [rsp + 0x70], 0x68
lea r8, [0x140054860]
mov edx, 0x104
lea rcx, [rsp + 0xe0]
call fcn.1400412dc
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xe0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14000a3c3
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000a3d4
call fcn.14000b580
call fcn.14000b510
mov eax, 3
jmp 0x14000a3fa
jmp 0x14000a3e7
call fcn.14000b580
call fcn.14000b510
mov eax, 3
jmp 0x14000a3fa
jmp 0x14000a3ee
call fcn.14000c950
call fcn.14000b580
call fcn.14000b510
xor eax, eax
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.140039770
add rsp, 0x200
pop rdi
ret

Function at 0x14000b220
Capabilities:
Query environment variable

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp qword [rsp + 0x40], 0
je 0x14000b23c
cmp dword [rsp + 0x48], 0
jne 0x14000b243
xor eax, eax
jmp 0x14000b2e0
mov r8d, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
lea rcx, [0x1400547ac]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov byte [rcx + rax], 0
cmp dword [rsp + 0x20], 0
jne 0x14000b280
mov dword [0x1403a4988], 6
xor eax, eax
jmp 0x14000b2e0
mov eax, dword [rsp + 0x20]
dec eax
mov eax, eax
mov rcx, qword [rsp + 0x40]
movsx eax, byte [rcx + rax]
cmp eax, 0x5c
je 0x14000b2c4
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov byte [rcx + rax], 0x5c
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov byte [rcx + rax], 0
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x48]
lea r8, [0x1400547b8]
mov edx, eax
mov rcx, qword [rsp + 0x40]
call fcn.1400412dc
mov eax, 1
add rsp, 0x38
ret
Function at 0x14000b2f0
Capabilities:
Query environment variable
Write file on windows

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x170
mov rax, qword [0x1403a3ab8]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rax, [0x140387980]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x24], 0x1b158
mov r8d, 0x104
lea rdx, [rsp + 0x50]
lea rcx, [0x1400547dc]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0x104
jae 0x14000b36a
jmp 0x14000b36f
call fcn.14003a124
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x50], 0
cmp dword [rsp + 0x20], 0
jne 0x14000b394
mov dword [0x1403a4988], 6
mov eax, 2
jmp 0x14000b4f1
mov eax, dword [rsp + 0x20]
dec eax
mov eax, eax
movsx eax, byte [rsp + rax + 0x50]
cmp eax, 0x5c
je 0x14000b3e8
mov eax, dword [rsp + 0x20]
mov byte [rsp + rax + 0x50], 0x5c
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp qword [rsp + 0x38], 0x104
jae 0x14000b3d9
jmp 0x14000b3de
call fcn.14003a124
mov rax, qword [rsp + 0x38]
mov byte [rsp + rax + 0x50], 0
lea r8, str.C9632CF058AE4321B6B0B5EA39B710FE
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.1400412dc
mov eax, dword [rsp + 0x24]
mov ecx, eax
call fcn.14003df48
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14000b42a
mov dword [0x1403a4988], 0xd
mov eax, 5
jmp 0x14000b4f1
mov eax, dword [rsp + 0x24]
mov r8d, eax
lea rdx, [0x140387980]
mov rcx, qword [rsp + 0x28]
call fcn.14003b080
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x28]
call fcn.140009df0
mov dword [rsp + 0x20], 0
lea r8, [0x1400547b4]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.140041454
test eax, eax
jne 0x14000b49b
mov eax, dword [rsp + 0x24]
mov r9, qword [rsp + 0x40]
mov r8d, eax
mov edx, 1
mov rcx, qword [rsp + 0x28]
call fcn.1400417e4
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x40]
call fcn.140041530
mov rcx, qword [rsp + 0x28]
call fcn.140040b68
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x20], eax
je 0x14000b4c0
mov dword [0x1403a4988], 8
mov eax, 2
jmp 0x14000b4f1
cmp dword [rsp + 0x188], 0x104
jb 0x14000b4ef
cmp qword [rsp + 0x180], 0
je 0x14000b4ef
lea r8, [rsp + 0x50]
mov edx, 0x104
mov rcx, qword [rsp + 0x180]
call fcn.14003e178
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140039770
add rsp, 0x170
pop rdi
ret

Function at 0x14000b510
Capabilities:
Delete file

Disassembly:
push rdi
sub rsp, 0x140
mov rax, qword [0x1403a3ab8]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0x20]
call fcn.14000b220
test eax, eax
je 0x14000b55a
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140039770
add rsp, 0x140
pop rdi
ret
Function at 0x14000b580
Capabilities:
Delete file
Query environment variable

Disassembly:
push rdi
sub rsp, 0x270
mov rax, qword [0x1403a3ab8]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rax, [rsp + 0x150]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov dword [rsp + 0x20], 0
mov r8d, 0x104
lea rdx, [rsp + 0x150]
lea rcx, [0x14005480c]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0x104
jae 0x14000b5fd
jmp 0x14000b602
call fcn.14003a124
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax + 0x40], 0
cmp dword [rsp + 0x20], 0
jne 0x14000b618
jmp 0x14000b755
mov eax, dword [rsp + 0x20]
dec eax
mov eax, eax
movsx eax, byte [rsp + rax + 0x150]
cmp eax, 0x5c
je 0x14000b675
mov eax, dword [rsp + 0x20]
mov byte [rsp + rax + 0x150], 0x5c
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp qword [rsp + 0x30], 0x104
jae 0x14000b663
jmp 0x14000b668
call fcn.14003a124
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x150], 0
lea r8, [rsp + 0x150]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.14003e178
lea r8, str.DBUtilDrv2.Sys
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.1400412dc
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea r8, [rsp + 0x150]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.14003e178
lea r8, str.DBUtilDrv2.inf
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.1400412dc
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea r8, [rsp + 0x150]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.14003e178
lea r8, str.DBUtilDrv2.cat
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.1400412dc
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea r8, [rsp + 0x150]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.14003e178
lea r8, str.WdfCoinstaller01009.dll
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.1400412dc
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140039770
add rsp, 0x270
pop rdi
ret
Function at 0x14000bd20
Capabilities:
Check mutex on windows

Disassembly:
sub rsp, 0x38
lea r8, str.DBUTILDRVMUX
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14000bd67
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14000bd67
mov dword [0x1403a4988], 4
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret

Function at 0x14000cbc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x198
mov rax, qword [0x1403a3ab8]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x40], 2
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x30], 0
cmp qword [rsp + 0x1a8], 0
je 0x14000cc35
mov eax, 3
jmp 0x14000cdc3
cmp dword [rsp + 0x1b8], 2
jge 0x14000cc49
mov eax, 3
jmp 0x14000cdc3
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x1c0]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x48], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x48]
movsx eax, byte [rcx + rax]
test eax, eax
jne 0x14000cc83
mov eax, 3
jmp 0x14000cdc3
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x1c0]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x58]
movsx eax, byte [rcx + rax]
test eax, eax
jne 0x14000ccbd
mov eax, 3
jmp 0x14000cdc3
xor r9d, r9d
lea r8, [rsp + 0x70]
mov edx, 0x104
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0x104
jae 0x14000ccea
cmp dword [rsp + 0x34], 0
jne 0x14000ccf4
mov eax, 2
jmp 0x14000cdc3
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14000cd0e
mov eax, 2
jmp 0x14000cdc3
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, str.newdev.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x14000cd41
jmp 0x14000cdac
lea rdx, str.UpdateDriverForPlugAndPlayDevicesA
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x14000cd64
jmp 0x14000cdac
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [rsp + 0x60]
test eax, eax
jne 0x14000cd8b
jmp 0x14000cdac
cmp dword [rsp + 0x38], 0
je 0x14000cd9c
mov dword [rsp + 0x3c], 1
jmp 0x14000cda4
mov dword [rsp + 0x3c], 0
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x40], eax
cmp qword [rsp + 0x50], 0
je 0x14000cdbf
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140039770
add rsp, 0x198
ret
Function at 0x140033270
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x38], 0
movzx eax, byte [0x1403a8f32]
cmp eax, 1
jne 0x14003329c
movzx eax, byte [0x1403a8f33]
jmp 0x140033392
mov dword [rsp + 0x30], 0
jmp 0x1400332b0
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 2
jge 0x1400332d9
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
movsxd rcx, dword [rsp + 0x30]
lea rdx, [0x1403a8ed8]
mov qword [rdx + rcx*8], rax
jmp 0x1400332a6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x1403a8ed0], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x1403a8ec0], rax
lea rcx, str.Calling_CreateThread_n
call fcn.140033440
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140034c20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1403a8ec8], rax
mov edx, 0xffffffff
mov rcx, qword [0x1403a8ec0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0xffffffff
je 0x140033367
cmp dword [rsp + 0x34], 0x80
jne 0x140033373
lea rcx, str.Something_wrong_in_the_thread_n
call fcn.140033440
cmp qword [0x1403a8ec8], 0
je 0x140033384
mov byte [0x1403a8f33], 1
mov byte [0x1403a8f32], 1
movzx eax, byte [0x1403a8f33]
add rsp, 0x48
ret
Function at 0x140033460
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x70], 0xfffffffffffffffe
lea rcx, [0x1403a8f18]
call fcn.140003390
test rax, rax
je 0x14003348d
lea rcx, [0x1403a8f18]
call fcn.1400364d0
mov edx, 0xc
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x1400334c2
cmp dword [rsp + 0x50], 0x80010106
je 0x1400334c2
lea rcx, str.Error_initializing_COM___n
call fcn.140033440
xor al, al
jmp 0x1400336c8
cmp dword [rsp + 0x50], 0
jne 0x140033534
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x140033534
cmp dword [rsp + 0x50], 0x80010119
je 0x140033534
lea rcx, str.Failed_to_initialize_COM_security._n
call fcn.140033440
call qword [sym.imp.ole32.dll_CoUninitialize]
xor al, al
jmp 0x1400336c8
lea rcx, [rsp + 0x58]
call fcn.140035960
nop
lea rcx, [rsp + 0x58]
call fcn.1400038c0
mov qword [rsp + 0x20], rax
lea r9, [0x1400561d8]
mov r8d, 1
xor edx, edx
lea rcx, [0x1400561c8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x1400335a0
lea rcx, str.Failed_to_create_IWbemLocator_object._n
call fcn.140033440
call qword [sym.imp.ole32.dll_CoUninitialize]
mov byte [rsp + 0x54], 0
lea rcx, [rsp + 0x58]
call fcn.140035ca0
movzx eax, byte [rsp + 0x54]
jmp 0x1400336c8
lea rcx, [rsp + 0x58]
call fcn.140003390
mov qword [rsp + 0x60], rax
lea rcx, [0x1403a8f18]
call fcn.1400038c0
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ROOTWMI
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
call qword [rax + 0x18]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x140033640
lea rcx, str.Could_not_connect._n
call fcn.140033440
call qword [sym.imp.ole32.dll_CoUninitialize]
mov byte [rsp + 0x55], 0
lea rcx, [rsp + 0x58]
call fcn.140035ca0
movzx eax, byte [rsp + 0x55]
jmp 0x1400336c8
lea rcx, [0x1403a8f18]
call fcn.140003390
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa
mov rcx, rax
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x1400336b4
lea rcx, str.Could_not_set_proxy_blanket._n
call fcn.140033440
call qword [sym.imp.ole32.dll_CoUninitialize]
mov byte [rsp + 0x56], 0
lea rcx, [rsp + 0x58]
call fcn.140035ca0
movzx eax, byte [rsp + 0x56]
jmp 0x1400336c8
mov byte [rsp + 0x57], 1
lea rcx, [rsp + 0x58]
call fcn.140035ca0
movzx eax, byte [rsp + 0x57]
add rsp, 0x88
ret
Function at 0x140042774
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400425a0