joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ed50
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x50
mov rax, qword [0x140022010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
lea r9, [rsp + 0x20]
mov r14, rcx
mov dword [rsp + 0x20], ebp
xor r8d, r8d
xor edx, edx
mov ebx, ebp
lea ecx, [rbp + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000edde
nop dword [rax]
test rbx, rbx
je 0x14000eda6
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14000ed90
test eax, eax
jns 0x14000edff
test rbx, rbx
je 0x14000ee04
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14000eef6
test rbx, rbx
jne 0x14000ee0b
xor eax, eax
jmp 0x14000eef6
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rdi
mov edi, ebp
cmp dword [rbx], ebp
jbe 0x14000eed6
mov esi, edi
lea rdx, [rbx + 0x30]
imul rax, rsi, 0x128
mov qword [rsp + 0x28], rbp
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], 0xf
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
add rdx, rcx
inc r8
cmp byte [rdx + r8], bpl
jne 0x14000ee54
lea rcx, [rsp + 0x28]
call fcn.1400064a0
cmp qword [r14 + 0x18], 0x10
mov rdx, r14
jb 0x14000ee74
mov rdx, qword [r14]
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14000ef0c
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000eecc
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eec7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ef5d
call fcn.14000f640
inc edi
cmp edi, dword [rbx]
jb 0x14000ee22
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000f620
add rsp, 0x50
pop r14
pop rbp
pop rbx
ret
imul rax, rsi, 0x128
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
mov rdi, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000ef69
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ef64
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ef64
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000f640
mov rax, rdi
jmp 0x14000eee9
Function at 0x140001810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x1400018c7
movsxd r13, dword [rax + 0x3c]
mov r12d, dword [r13 + rax + 0x88]
mov r15d, dword [r12 + rax + 0x1c]
mov r10d, dword [r12 + rax + 0x20]
add r15, rax
mov r11d, dword [r12 + rax + 0x24]
add r10, rax
add r11, rax
test esi, 0xffff0000
jne 0x14000187e
movzx eax, si
sub eax, dword [r12 + rbx + 0x10]
mov eax, dword [r15 + rax*4]
add rax, rbx
jmp 0x1400018c9
mov edi, dword [r12 + rax + 0x18]
xor r14d, r14d
mov r9d, r14d
test edi, edi
je 0x1400018c7
nop dword [rax]
mov eax, dword [r10]
mov r8, rsi
movzx ebp, word [r11]
add rax, rbx
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400018b3
inc rax
test ecx, ecx
jne 0x1400018a0
test edx, edx
je 0x1400018e6
inc r9d
add r11, 2
add r10, 4
cmp r9d, edi
jb 0x140001890
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, dword [r15 + rbp*4]
cmp r12, rcx
ja 0x14000199e
mov eax, dword [r13 + rbx + 0x8c]
add eax, r12d
cmp rcx, rax
jae 0x14000199e
lea rbp, [rcx + rbx]
mov rcx, rbp
lea rdx, [0x1400033b0]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
mov rdi, rax
lea rsi, [rax + 1]
mov rax, 0xffffffffffffffff
sub rsi, rbp
mov rcx, rsi
add rcx, 4
lea edx, [rax + 2]
cmovb rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbx, rax
test rax, rax
je 0x1400018c7
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movzx ecx, word [0x1400033b4]
mov word [rbx + rsi], cx
movzx ecx, byte [0x1400033b6]
mov byte [rbx + rsi + 2], cl
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14000198d
lea rdx, [rdi + 1]
mov rcx, rbx
call fcn.140001810
mov r14, rax
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, r14
jmp 0x1400018c9
lea rax, [rcx + rbx]
jmp 0x1400018c9
Function at 0x14000ebd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
test rax, rax
je 0x14000ec45
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14000ec45
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x14000ec35
nop
cmp rbx, rcx
jae 0x14000ec45
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x14000ec20
cmp rbx, rcx
jae 0x14000ec45
cmp word [rbx], 0
je 0x14000ec45
mov rax, rbx
jmp 0x14000ec47
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400154c0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1400154e2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x140015563
mov rdi, r14
mov rcx, rbx
call fcn.140011950
test rax, rax
jle 0x140015534
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.1400a5110
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140015553
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x140014436.0]
cmp eax, 0xffffffff
je 0x14001555b
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1400154f6
sub r14, rdi
jmp 0x140015658
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14001557a
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001557c
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400155b1
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400a5110
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140015655
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x1400155ec
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x140015630
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400b8830
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x14001566e
cmp rbp, rax
ja 0x140015600
mov r8, rdi
test rdi, rdi
je 0x140015655
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400b8830
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x140015658
Function at 0x140016190
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1401339d8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, rdx
mov r13, rcx
call fcn.140014190
mov rcx, rax
lea r9, [0x1400e8328]
lea r8, str.Utils::GetProcessIDInCurrentLogOn
xor edx, edx
call fcn.14009cf00
xor r15d, r15d
mov ebx, r15d
mov qword [rsp + 0x30], rbx
call fcn.140014190
cmp byte [rax + 0x64], r15b
je 0x14001623e
lea ecx, [r15 + 0x28]
call fcn.140095e50
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140016236
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
call fcn.140014190
mov rdx, rax
lea r8, str.Utils::GetProcessIDInCurrentLogOn
mov rcx, rbx
call fcn.140098570
mov rbx, rax
jmp 0x140016239
mov rbx, r15
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], r15d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
test eax, eax
je 0x140016328
mov esi, r15d
mov rcx, qword [rsp + 0x40]
cmp dword [rsp + 0x48], r15d
jbe 0x140016323
nop
mov r14d, esi
lea rax, [r14 + r14*2]
lea r12, [rax*8]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rbp + r8*2], 0
jne 0x1400162a0
mov rdx, rbp
mov rcx, qword [r12 + rcx + 8]
call fcn.1400bb130
test eax, eax
jne 0x140016312
mov rdi, qword [rsp + 0x40]
call fcn.140014190
mov rcx, rax
mov eax, dword [rdi + r12]
mov dword [rsp + 0x28], eax
mov eax, dword [rdi + r12 + 4]
mov dword [rsp + 0x20], eax
lea r9, str.Process_Id:__ld__Session_Id:__ld
lea r8, str.Utils::GetProcessIDInCurrentLogOn
mov edx, 2
call fcn.14009cf00
mov rcx, qword [rsp + 0x40]
mov eax, dword [r12 + rcx]
cmp dword [r13], eax
jne 0x140016317
lea rax, [r14 + r14*2]
mov r15d, dword [rcx + rax*8 + 4]
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x140016348
mov rcx, qword [rsp + 0x40]
inc esi
cmp esi, dword [rsp + 0x48]
jb 0x140016280
call sub.WTSAPI32.dll_WTSFreeMemory
call fcn.140014190
mov rcx, rax
lea r9, str.Could_not_find_the_correct_process_id_in_the_given_session
lea r8, str.Utils::GetProcessIDInCurrentLogOn
mov edx, 5
call fcn.14009cf00
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], r15d
lea r9, str.Process_Id___d
lea r8, str.Utils::GetProcessIDInCurrentLogOn
mov edx, 1
call fcn.14009cf00
nop
test rbx, rbx
je 0x140016388
mov rcx, rbx
call fcn.140099040
mov edx, 0x28
mov rcx, rbx
call fcn.140095e90
mov eax, r15d
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400964b0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400163c0
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401339d8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rcx
call fcn.140014190
mov rcx, rax
lea r9, [0x1400e8328]
lea r8, str.RpcServer::AppSection::CAppActivationHandler::ImpersonateUserLogOnSession
xor edx, edx
call fcn.14009cf00
xor ebx, ebx
mov qword [rsp + 0x30], rbx
call fcn.140014190
cmp byte [rax + 0x64], bl
je 0x140016453
lea ecx, [rbx + 0x28]
call fcn.140095e50
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14001644e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
mov qword [rdi + 0x20], rax
call fcn.140014190
mov rdx, rax
lea r8, str.RpcServer::AppSection::CAppActivationHandler::ImpersonateUserLogOnSession
mov rcx, rdi
call fcn.140098570
mov rbx, rax
mov qword [rsp + 0x30], rbx
call fcn.140014190
mov rcx, rax
lea r9, str.Inside_ImpersonateUserLogOnSession
lea r8, str.RpcServer::AppSection::CAppActivationHandler::ImpersonateUserLogOnSession
mov edx, 3
call fcn.14009cf00
call fcn.140015f40
test eax, eax
jne 0x140016488
mov dil, 1
lea rsi, str.Error_:_No_Active_sessions_found.
jmp 0x1400164a2
mov ecx, eax
call fcn.140015d00
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400164c3
xor dil, dil
lea rsi, str.GetActiveSessionToken_failed
call fcn.140014190
mov rcx, rax
mov r9, rsi
lea r8, str.RpcServer::AppSection::CAppActivationHandler::ImpersonateUserLogOnSession
mov edx, 5
call fcn.14009cf00
jmp 0x140016564
lea r8, [rsp + 0x40]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x14001650c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Lookup_Privilege_value_Error:__u
lea r8, str.RpcServer::AppSection::CAppActivationHandler::ImpersonateUserLogOnSession
mov edx, 5
call fcn.14009cf00
xor dil, dil
jmp 0x140016564
mov rcx, rdi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x14001653e
call fcn.140014190
mov rcx, rax
lea r9, str.ImpersonateLoggedOnUser_Failure
lea r8, str.RpcServer::AppSection::CAppActivationHandler::ImpersonateUserLogOnSession
mov edx, 5
call fcn.14009cf00
xor dil, dil
jmp 0x140016564
mov byte [rsi], 1
call fcn.140014190
mov rcx, rax
lea r9, str.Exiting_ImpersonateUserLogOnSession_Successfully
lea r8, str.RpcServer::AppSection::CAppActivationHandler::ImpersonateUserLogOnSession
mov edx, 3
call fcn.14009cf00
mov dil, 1
test rbx, rbx
je 0x14001657e
mov rcx, rbx
call fcn.140099040
mov edx, 0x28
mov rcx, rbx
call fcn.140095e90
movzx eax, dil
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400964b0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140020a70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1401339d8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r15, r9
mov rsi, r8
mov rdi, rdx
mov r14, rcx
call fcn.140014190
mov rcx, rax
lea r9, [0x1400e8328]
lea r8, str.Utils::RegGetDword
xor edx, edx
call fcn.14009cf00
xor ebx, ebx
mov qword [rsp + 0x48], rbx
call fcn.140014190
cmp byte [rax + 0x64], bl
je 0x140020b0d
lea ecx, [rbx + 0x28]
call fcn.140095e50
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140020b06
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
call fcn.140014190
mov rdx, rax
lea r8, str.Utils::RegGetDword
mov rcx, rbx
call fcn.140098570
mov rbx, rax
jmp 0x140020b08
xor ebx, ebx
mov qword [rsp + 0x48], rbx
cmp qword [rdi + 0x18], 8
jb 0x140020b17
mov rdi, qword [rdi]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov edi, eax
mov dword [rsp + 0x40], eax
test eax, eax
jne 0x140020bb0
mov dword [rsp + 0x58], 4
cmp qword [rsi + 0x18], 8
jb 0x140020b52
mov rsi, qword [rsi]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
mov r9d, SafeArrayCopy
mov r8, rsi
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov edi, eax
mov dword [rsp + 0x40], eax
test eax, eax
je 0x140020bd5
call fcn.140014190
mov dword [rsp + 0x20], edi
lea r9, str.RegGetValue:Faild_to_read_config_from_registry_0x_08X
lea r8, str.Utils::RegGetDword
mov edx, 5
mov rcx, rax
call fcn.14009cf00
jmp 0x140020bd5
call fcn.140014190
mov dword [rsp + 0x20], edi
lea r9, str.RegOpenKeyEx:Faild_to_read_config_from_registry_0x_08X
lea r8, str.Utils::RegGetDword
mov edx, 5
mov rcx, rax
call fcn.14009cf00
nop
jmp 0x140020be0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
call fcn.140014190
mov rcx, rax
lea r9, [0x1400e8328]
lea r8, str.Utils::RegGetDword
mov edx, 1
call fcn.14009cf00
nop
test rbx, rbx
je 0x140020c26
mov rcx, rbx
call fcn.140099040
mov edx, 0x28
mov rcx, rbx
call fcn.140095e90
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400964b0
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140020c50
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1401339d8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, r8
mov r14, rdx
mov r15, rcx
mov dword [rsp + 0x48], r9d
call fcn.140014190
mov rcx, rax
lea r9, [0x1400e8328]
lea r8, str.Utils::RegSetDword
xor edx, edx
call fcn.14009cf00
xor ebx, ebx
mov qword [rsp + 0x38], rbx
call fcn.140014190
cmp byte [rax + 0x64], bl
je 0x140020ceb
lea ecx, [rbx + 0x28]
call fcn.140095e50
mov rdi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140020ce6
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
mov qword [rdi + 0x20], rax
call fcn.140014190
mov rdx, rax
lea r8, str.Utils::RegSetDword
mov rcx, rdi
call fcn.140098570
mov rbx, rax
mov qword [rsp + 0x38], rbx
cmp qword [r14 + 0x18], 8
jb 0x140020cf5
mov r14, qword [r14]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rdx, r14
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov edi, eax
mov dword [rsp + 0x30], eax
test eax, eax
jne 0x140020d81
cmp qword [rsi + 0x18], 8
jb 0x140020d28
mov rsi, qword [rsi]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov edi, eax
mov dword [rsp + 0x30], eax
test eax, eax
je 0x140020da6
call fcn.140014190
mov dword [rsp + 0x20], edi
lea r9, str.RegSetValueEx:Faild_to_write_config_to_registry_0x_08X
lea r8, str.Utils::RegSetDword
mov edx, 5
mov rcx, rax
call fcn.14009cf00
jmp 0x140020da6
call fcn.140014190
mov dword [rsp + 0x20], edi
lea r9, str.RegOpenKeyEx:Faild_to_write_config_to_registry_0x_08X
lea r8, str.Utils::RegSetDword
mov edx, 5
mov rcx, rax
call fcn.14009cf00
nop
jmp 0x140020db1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
call fcn.140014190
mov rcx, rax
lea r9, [0x1400e8328]
lea r8, str.Utils::RegSetDword
mov edx, 1
call fcn.14009cf00
nop
test rbx, rbx
je 0x140020df7
mov rcx, rbx
call fcn.140099040
mov edx, 0x28
mov rcx, rbx
call fcn.140095e90
mov eax, edi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400964b0
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14003c810
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401339d8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
call fcn.140014190
mov rcx, rax
lea r9, [0x1400e8328]
lea r8, str.RpcServer::SysInfo::CHotKeyHandler::StartMonitoring
xor edx, edx
call fcn.14009cf00
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor esi, esi
call fcn.140014190
cmp byte [rax + 0x64], sil
je 0x14003c8ad
lea ecx, [rbx + 0x28]
call fcn.140095e50
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14003c8a3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
call fcn.140014190
mov rdx, rax
lea r8, str.RpcServer::SysInfo::CHotKeyHandler::StartMonitoring
mov rcx, rbx
call fcn.140098570
mov rbx, rax
jmp 0x14003c8a5
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov rsi, rbx
call fcn.140014190
mov rcx, rax
lea r9, str.Keyboard_Service_in_StartMonitoring_Entry
lea r8, str.RpcServer::SysInfo::CHotKeyHandler::StartMonitoring
mov edx, 2
call fcn.14009cf00
mov dword [rsp + 0x40], 0
call fcn.140014190
mov rcx, rax
lea r9, str.Setting_m_bStopKeyboardThread__FALSE
lea r8, str.RpcServer::SysInfo::CHotKeyHandler::StartMonitoring
mov edx, 3
call fcn.14009cf00
mov dword [rdi + 0x40], 0
mov rcx, qword [rdi + 0x60]
test rcx, rcx
je 0x14003c92a
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetThreadId]
mov edi, eax
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Keyboard_monitoring_thread_is_already_running_with_threadID__d
mov edx, 4
jmp 0x14003c9c2
call fcn.140014190
mov rcx, rax
lea r9, str.Creating_KeyStrokeMonitoringThread...
lea r8, str.RpcServer::SysInfo::CHotKeyHandler::StartMonitoring
mov edx, 3
call fcn.14009cf00
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x1400393b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rdi + 0x60], rax
cmp rax, 0
jne 0x14003c9a6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.CreateThread__KeyStrokeMonitoringThread__failed_with_error_:__d
lea r8, str.RpcServer::SysInfo::CHotKeyHandler::StartMonitoring
mov edx, 5
call fcn.14009cf00
call fcn.140014190
mov rcx, rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
lea r9, str.Keyboard_monitoring_thread_created_with_thread_ID_:__d
mov edx, 2
lea r8, str.RpcServer::SysInfo::CHotKeyHandler::StartMonitoring
call fcn.14009cf00
nop
test rsi, rsi
je 0x14003c9e9
mov rcx, rbx
call fcn.140099040
mov edx, 0x28
mov rcx, rbx
call fcn.140095e90
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400964b0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret