joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001fd70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1400491b0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x50], r14
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], r14
xor edx, edx
mov r8d, 0x408
lea rcx, [rsp + 0x70]
call fcn.140027620
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14001fe1c
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14001fe1c
call fcn.14001c730
mov ebx, eax
jmp 0x14001ff44
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14001fe3d
call fcn.14001c730
jmp 0x14001ff33
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14001fe60
call fcn.14001c730
jmp 0x14001ff33
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x14001fe82
mov ebx, 0x8007000e
jmp 0x14001ff35
mov ecx, eax
test eax, eax
je 0x14001feba
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14001feb0
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14001feba
lea rcx, [rsp + 0x70]
call fcn.14001c5a0
jmp 0x14001fec4
mov ecx, 0x80070216
call fcn.140012950
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x14001fed7
cmp qword [rsp + 0x70], 0
jne 0x14001fee6
mov ebx, 0x8007000e
jmp 0x14001ff35
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14001ff10
call fcn.14001c730
jmp 0x14001ff33
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
loopne 0x14001ff26
add byte [rax], al

Function at 0x14001ff80
Capabilities:
Delete registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x2208]
mov eax, 0x2308
call fcn.140027590
sub rsp, rax
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov rax, qword [0x1400491b0]
xor rax, rsp
mov qword [rbp + 0x21f0], rax
mov dword [rsp + 0x4c], r9d
mov qword [rsp + 0x50], r8
mov rdi, rdx

Function at 0x1400208a0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400491b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], r8d
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400275f0
add rsp, 0x48
ret
Function at 0x1400208f0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9, r8
mov r10, rdx
test r8, r8
jne 0x140020908
lea eax, [r8 + 0xd]
add rsp, 0x38
ret
xor r8d, r8d
mov rdx, r9
nop
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x140020914
inc eax
lea rdx, [rdx + rax*2]
lea r8d, [r8 + rax*2]
cmp eax, 1
jne 0x140020910
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x140020a10
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400491b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x50], rax
test rax, rax
jne 0x140020a54
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400275f0
add rsp, 0x40
pop rbx
ret
lea rax, [rsp + 0x30]
lea r8, [0x14001e900]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x140020a95
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x50], rdi
mov rax, rdi
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
int3

Function at 0x140021250
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
cmp byte [0x14004dd89], 0
mov esi, edx
mov rbx, rcx
je 0x140021276
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
xor ecx, ecx
mov qword [rsp + 0x30], rdi
call qword [sym.imp.ole32.dll_CoInitialize]
mov edi, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x1400212bc
cmp eax, 0x80010106
jne 0x14002131c
lea rcx, str.Mscoree.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x1400212c0
mov eax, edi
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov byte [rbx + 0x62], 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [rsp + 0x40]
mov rcx, rbx
mov rdx, rax
call fcn.14001ec10
cmp al, 1
jne 0x14002130c
mov edx, esi
mov rcx, rbx
call fcn.14001f170
mov edi, eax
test eax, eax
jne 0x1400212fe
mov rcx, rbx
call fcn.140020830
mov rcx, rbx
call fcn.14001efe0
mov edi, eax
jmp 0x140021310
js 0x140021310
mov rcx, rbx
call fcn.14001efe0
mov edi, eax
jmp 0x140021310
mov edi, dword [rsp + 0x40]
cmp byte [rbx + 0x62], 0
je 0x14002131c
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret
Function at 0x140021470
Capabilities:
Check mutex on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1400491b0]
xor rax, rsp
mov qword [rbp + 0x160], rax
movups xmm0, xmmword [str.IGFXTRAYMUTEX]
mov eax, dword [0x140039148]
movsd xmm1, qword [0x140039140]
lea rcx, [rsp + 0x6c]
xor edx, edx
mov r8d, 0x1ec
mov r15d, r9d
mov ebx, 1
xor edi, edi
movaps xmmword [rsp + 0x50], xmm0
movsd qword [rsp + 0x60], xmm1
mov dword [rsp + 0x68], eax
call fcn.140027620
lea r8, [rsp + 0x50]
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, ebx
cmp eax, 0xb7
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareIntelDisplayigfxcuiigfxtrayTrayIcon
cmove r14d, edi
mov r9d, 0xf003f
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x44], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareIntelDisplayigfxcuiigfxtrayTrayIcon
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400215b1
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x44]
lea rdx, str.ShowTrayIcon
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400215b1
mov ebx, dword [rsp + 0x40]
jmp 0x1400215f2
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400215ee
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x44]
lea rdx, str.ShowTrayIcon
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400215ee
mov ebx, dword [rsp + 0x40]
jmp 0x1400215f2
mov dword [rsp + 0x40], ebx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14d, r14d
je 0x14002162d
xor ecx, ecx
call fcn.14001e5a0
test al, al
je 0x14002162d
test ebx, ebx
je 0x14002162d
lea rcx, [0x14004dea0]
mov edx, r15d
call fcn.140021250
mov edi, eax
test rsi, rsi
je 0x14002163b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1400275f0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400295c0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140029428
Function at 0x140001b00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test rax, rax
je 0x140001b4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b4a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b4c
xor al, al
add rsp, 0x28
ret

Function at 0x140002580
Capabilities:
Delete file
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x490
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x40], 0
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
movzx eax, byte [0x140098470]
test eax, eax
jne 0x140002696
mov edx, 0x104
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
lea r9, [rsp + 0x280]
lea r8, str._shvdd.dmp
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.140001130
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20000002
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 3
mov edx, 0x40000000
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x140002666
lea rdx, [rsp + 0x70]
lea rcx, str.File__s_cant_be_opened_or_doesnt_exists
call fcn.140001060
jmp 0x1400026d7
mov rdx, qword [rsp + 0x4a8]
mov rcx, qword [rsp + 0x4a0]
call fcn.140002730
movzx eax, al
test eax, eax
jne 0x140002684
jmp 0x1400026d7
mov rdx, qword [rsp + 0x4a0]
lea rcx, [rsp + 0x70]
call fcn.140005c80
movzx eax, byte [0x140098471]
cmp eax, 1
jne 0x1400026af
mov rcx, qword [rsp + 0x4a0]
call fcn.140006240
movzx eax, byte [0x140098470]
cmp eax, 1
jne 0x1400026c8
mov rcx, qword [rsp + 0x4a0]
call fcn.140006110
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov dword [rsp + 0x64], eax
mov byte [rsp + 0x40], 1
cmp qword [rsp + 0x50], 0
je 0x1400026ea
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp qword [rsp + 0x58], 0
je 0x1400026fd
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp qword [rsp + 0x48], 0
je 0x140002710
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
movzx eax, byte [rsp + 0x40]
add rsp, 0x490
pop rdi
ret

Function at 0x140003ab0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
je 0x140003ae4
mov eax, dword [rsp + 0x20]
and eax, 0x10
test eax, eax
je 0x140003ae4
mov dword [rsp + 0x24], 1
jmp 0x140003aec
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x24]
add rsp, 0x38
ret
Function at 0x140003b00
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140003b82
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
jne 0x140003b82
mov r8d, 1
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObjectEx]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xc0
je 0x140003b5e
mov eax, dword [rsp + 0x60]
cmp dword [rsp + 0x34], eax
jne 0x140003b94
mov dword [rsp + 0x30], 1
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x140005a50
Capabilities:
Create process on windows
Get common file path

Disassembly:
push rdi
sub rsp, 0xc70
call fcn.140005b70
movzx eax, al
test eax, eax
jne 0x140005b47
lea rcx, str.It_looks_like_EXDi_COM_extension_is_not_registered._Try_to_register__n
call fcn.140001060
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x618
rep stosb byte [rdi], al
lea rax, [rsp + 0x650]
mov rdi, rax
xor eax, eax
mov ecx, 0x618
rep stosb byte [rdi], al
lea rdx, [rsp + 0x30]
mov ecx, 0x30c
call qword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
test eax, eax
jne 0x140005ac1
lea rcx, str.EXDi_plugin_registration_process_has_problems._Try_register_extension_manually_using__regsvr32.exe__i_HvmmExdi.dll__command_n
call fcn.140001060
xor al, al
jmp 0x140005b55
lea rdx, str.HvmmExdi.dll
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x650]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x650]
lea r8, str.C:WINDOWS_system32_regsvr32.exe__i__s
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.DLL_Sleep]
call fcn.140005b70
movzx eax, al
test eax, eax
jne 0x140005b35
lea rcx, str.Registration_was_successfully_completed.__n
call fcn.140001060
jmp 0x140005b45
lea rcx, str.Some_problem_with_registration._Try_register_EXDi_debugger_plugin_for_Hyper_V_manually_using__regsvr32.exe__i_HvmmExdi.dll__command_n
call fcn.140001060
xor al, al
jmp 0x140005b55
jmp 0x140005b53
lea rcx, str.EXDi_extension_is_already_registered__n
call fcn.140001060
mov al, 1
add rsp, 0xc70
pop rdi
ret

Function at 0x140005b70
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.CLSID53838F70_0936_44A9_AB4E_ABB568401508InprocServer32
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005bec
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x140005be1
mov dword [rsp + 0x30], 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [rsp + 0x30]
add rsp, 0x58
ret

Function at 0x140005c00
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x648
cmp qword [0x140098438], 0
jne 0x140005c30
mov ecx, 0x1000
call fcn.140007210
mov qword [0x140098438], rax
cmp qword [0x140098438], 0
jne 0x140005c30
xor al, al
jmp 0x140005c6e
lea rdx, [rsp + 0x20]
mov ecx, 0x30c
call qword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
test eax, eax
jne 0x140005c48
xor al, al
jmp 0x140005c6e
lea rdx, str.hvlib.dll
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
lea rdx, [rsp + 0x20]
mov rcx, qword [0x140098438]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
mov al, 1
add rsp, 0x648
ret
Function at 0x140006110
Capabilities:
Check if file exists
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xd20
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rdx, [rsp + 0x700]
mov ecx, 0x30c
call qword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
lea rdx, str.windbg.exe
lea rcx, [rsp + 0x700]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
lea r8, str._v__kx_exdi:CLSID53838F70_0936_44A9_AB4E_ABB568401508_KdGuess
mov edx, 0x30c
lea rcx, [rsp + 0xe0]
call fcn.140001130
lea rdx, [rsp + 0xe0]
lea rcx, str.___windbg.exe__s__n
call fcn.140001060
call fcn.140005a50
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x700]
call qword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
jne 0x140006220
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
jne 0x140006208
lea rcx, str.___You_must_put_LiveCloudKd.exe_in_the_WinDbg_Directory._n
call fcn.140007270
jmp 0x14000621c
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.CreateProcess_failed___d_._n
call fcn.140001060
xor al, al
jmp 0x140006222
mov al, 1
add rsp, 0xd20
pop rdi
ret

Function at 0x140006240
Capabilities:
Check if file exists
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xd20
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rdx, [rsp + 0x700]
mov ecx, 0x30c
call qword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
lea rdx, [0x14000b048]
lea rcx, [rsp + 0x700]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
lea r8, [0x14000afc0]
mov edx, 0x30c
lea rcx, [rsp + 0xe0]
call fcn.140001130
lea rdx, [rsp + 0xe0]
lea rcx, str.windbg.exe__s__n
call fcn.140001060
call fcn.140005a50
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x700]
call qword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
jne 0x140006350
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
jne 0x140006338
lea rcx, [0x14000af20]
call fcn.140007270
jmp 0x14000634c
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, [0x14000aee8]
call fcn.140001060
xor al, al
jmp 0x140006352
mov al, 1
add rsp, 0xd20
pop rdi
ret
Function at 0x140006fd0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWARELiveCloudKdParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x140007044
lea r8, [rsp + 0x38]
lea rdx, [0x14000d190]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x140007044
lea rcx, str.Driver_parameter_key_was_not_created_n
call fcn.140001060
mov byte [rsp + 0x30], 0
lea r8, [rsp + 0x38]
lea rdx, [0x14000d100]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x1400070b8
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.VmId
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x1400070a7
mov byte [rsp + 0x30], 1
jmp 0x1400070b8
lea rcx, str.VmId_key_was_not_created_n
call fcn.140001060
mov byte [rsp + 0x30], 0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [rsp + 0x30]
add rsp, 0x58
ret

Function at 0x1400070e0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x38
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140007111
lea rcx, str.ERROR:_Cant_load_NTDLL.dll._n
call fcn.140007270
xor al, al
jmp 0x1400071d2
lea rdx, str.NtAllocateVirtualMemory
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x1400984b0], rax
lea rdx, str.NtDuplicateObject
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x1400984a0], rax
lea rdx, str.NtOpenProcess
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x140098498], rax
lea rdx, str.NtQueryObject
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x1400984a8], rax
lea rdx, str.NtQuerySystemInformation
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x140098490], rax
cmp qword [0x1400984b0], 0
je 0x1400071c0
cmp qword [0x1400984a0], 0
je 0x1400071c0
cmp qword [0x140098498], 0
je 0x1400071c0
cmp qword [0x1400984a8], 0
je 0x1400071c0
cmp qword [0x140098490], 0
jne 0x1400071d0
lea rcx, str.ERROR:_Cant_import_any_of_the_NTDLL.dll_functions._n
call fcn.140007270
xor al, al
jmp 0x1400071d2
mov al, 1
add rsp, 0x38
ret
Function at 0x14314d2cb
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 3]
lea rsp, [rsp + 5]
push rdx
not dx
jmp 0x14314d2ab
mov dword [rsp + 1], esp
mov byte [rsp], dl
std
cmc
mov byte [rsp + 5], r13b
mov qword [rsp], r10
jmp 0x14314d26b
lea rdx, [0x43c78893]
std
push r14
mov dx, bx
jmp 0x14314d394
bts rdx, r13
mov dl, r12b
bsf dx, r9w
lea rdx, [r9 + rbp]
lea rdx, [r9 + riz]
jmp 0x14314d295
lea rsp, [rsp + 4]
lea rsp, [rsp + 0x10]
sub rsp, 1
sub rsp, 7
jmp 0x14314d281
setg r14b
not r13d
mov r13b, 0xd4
cld
push rdi
mov r14b, 0xea
jmp 0x14314d32a
mov r14w, word [rsp + 5]
bswap r14d
lea rsp, [rsp + 3]
mov qword [rsp], r13
adc rdx, 0xfcd316b
mov r14d, dword [rsp]
jmp 0x14314d2df
lea rsp, [rsp + 7]
mov qword [rsp + 3], r10
mov rdi, rsp
jmp 0x14314d357
sub rsp, 0x1c
pop r14w
not r13w
cld
sub rsp, 0x1d
mov r14w, ax
jmp 0x14314d314
dec r10d
lea r10, [rax + riz + 0x71]
push r9
cmc
mov rdx, qword [rsp]
jmp 0x14314d36d
shr r13b, 0
mov edi, dword [rsp]
bsr edx, r9d
mov rdi, r15
mov r13, r12
bswap r14
jmp 0x14314d341
sub rsp, 0xe
mov dl, r12b
bsr rdi, rbp
lea rsp, [rsp + 6]
mov qword [rsp], r8
mov r9d, 0x7bce66a4
jmp 0x14314d3c6
sub rsp, 0x1b
add rsp, 0x10
xchg word [rsp + 6], r14w
setnp dl
xchg r14d, edx
mov r14b, 0x58
jmp 0x14314d2f5
not r9d
sub rsi, 0xffffffff8b0cc2c5
push word [rsp + 1]
jmp 0x14314d3f7
cmc
mov r14b, sil
mov r10, qword [rsp]
mov r8d, 0x605a3009
push rsi
push r15
jmp 0x14314d3b0
mov rdi, qword [rsp]
bswap r14d
xchg r10b, r9b
push rbp
neg r14b
xchg di, si
jmp 0x14314d734
not rdx
lea rsp, [rsp + 2]
mov qword [rsp], rcx
lea rdi, [r11*8]
mov r9, 0xfffffffffe9a74b1
setp r14b
jmp 0x14314d3d9
lea rax, [r8 + r11]
sub rsp, 5
lea r8, [r12 + rbp]
pop word [rsp]
jmp 0x14314d431
neg r10w
push r11
mov r14b, 0x9e
mov r15b, 0x19
bswap rdx
mov r15, 0x4d21daf6
jmp 0x14314d447
mov ebx, ecx
rdtsc
rdtsc
mov r14, qword [rsp]
mov dx, word [rsp]
mov r15b, byte [rsp]
jmp 0x14314d460
mov r8d, 0x5cad5477
dec r14w
bsf ebp, esi
mov cl, byte [rsp]
mov r13b, 0x12
push rax
jmp 0x14314d53b
lea r14, [r9 + rbp]
mov edx, 0xa52d8282
mov rbp, qword [rsp]
mov dil, 0xba
push r15
xchg r14w, bp
jmp 0x14314d572
dec r13
mov r9, qword [rsp]
mov r14d, edi
push rbx
mov r8b, dl
sub cl, 6
jmp 0x14314d6ae

Function at 0x14314dd02
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc dx
mov r12w, 0xd42
mov dil, 0x1a
bsr r13w, r10w
add bp, 0xad05
pop rax
jmp 0x14314dca1