joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00405880]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00405890]
mov dword [rax], 1
mov rax, qword [0x004058a0]
mov dword [rax], 1
mov rax, qword [0x00405870]
mov dword [rax], 1
mov rax, qword [0x00405730]
cmp word [rax], 0x5a4d
je 0x4010d0
mov rax, qword [0x00405860]
mov dword [0x00408008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010c2
mov ecx, 2
call sym.__set_app_type
mov rcx, 0xffffffffffffffff
call dbg._encode_pointer
mov rdx, qword [0x004057c0]
mov qword [rdx], rax
mov rdx, qword [0x004057b0]
mov qword [rdx], rax
mov rax, qword [0x00405820]
mov edx, dword [rax]
mov rax, qword [sym.imp.msvcrt.dll__fmode]
mov rax, qword [rax]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x004056e0]
cmp dword [rax], 1
je 0x401120
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401133
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x401530
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_OpenClipboard]
call rax
test eax, eax
setne al
test al, al
je 0x4015ab
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_GetClipboardData]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
je 0x4015a2
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalLock]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x4015a2
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call rax
mov rax, qword [sym.imp.USER32.dll_CloseClipboard]
call rax
mov rax, qword [rbp - 0x10]
jmp 0x4015b0
mov rax, qword [sym.imp.USER32.dll_CloseClipboard]
call rax
mov eax, 0
add rsp, 0x30
pop rbp
ret
Function at 0x4022b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x00408054]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x4023ca
mov rax, qword [0x00408058]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x4022fe
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x4023b0
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x4022e2
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x402402
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x00408058]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x00408058]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4023e5
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x4023a9
sub eax, 0x40
and eax, 0xffffffbf
je 0x4023a9
mov r9, rbp
add r9, qword [0x00408058]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4023d1
add dword [0x00408054], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebp, ebp
jmp 0x40230b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x00408058]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call dbg.__report_error
nop
nop word cs:[rax + rax]

Function at 0x402fe0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x402ff0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x403000
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x403041
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x403038
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x403043
add rax, 0x28
cmp rax, r9
jne 0x403024
xor eax, eax
repz ret

Function at 0x4030f0
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x00405730]
cmp word [rbx], 0x5a4d
je 0x403110
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call sym._ValidateImageBase.part.0
test eax, eax
je 0x403104
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp dbg._FindPESection
Function at 0x403360
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004089c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004089a0]
test rbx, rbx
je 0x4033b4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4033ab
test rsi, rsi
je 0x4033ab
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x403390
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x004089c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
Function at 0x1400010a0
Capabilities:
Create process on windows
Self delete
Terminate process

Disassembly:
sub rsp, 0x468
mov rax, qword [0x140053008]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.14001d250
xor edx, edx
lea rcx, [rsp + 0x240]
mov r8d, 0x208
call fcn.14001d250
lea rcx, str.DeleteAthService_Enter___n
call fcn.14000e220
mov r8d, 0x102
lea rdx, [rsp + 0x240]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r8, [0x140041aa0]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1400219a4
lea r8, [rsp + 0x240]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140021a0c
lea r8, [0x140041aa0]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140021a0c
lea rdx, [rsp + 0x30]
lea rcx, str.DeleteAthService__The_szFilename_is:__s_n
call fcn.14000e220
xor eax, eax
lea r9, str.uninstall
mov dword [rsp + 0x28], eax
lea r8, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140001430
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
sub rsp, 0x2a0
mov rax, qword [0x140053008]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor esi, esi
lea rcx, [rsp + 0x80]
xor edx, edx
mov dword [rsp + 0x50], esi
mov r8d, 0x208
call fcn.14001d250
lea rax, [rsp + 0x78]
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x40], rax
lea rdx, str.SoftwareAtheros
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400014e8
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rdx, str.EnableServiceDebug
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x50], esi
je 0x140001660
mov qword [rsp + 0x2b0], rbx
lea r8, str.C:AthSvc
mov edx, 0x104
mov qword [rsp + 0x2b8], rdi
lea rcx, [rsp + 0x80]
call fcn.1400219a4
lea rax, [rsp + 0x7c]
mov dword [rsp + 0x60], 0x208
mov qword [rsp + 0x40], rax
lea rdx, str.SoftwareAtheros
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400015a0
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.ServiceLogPath
lea rax, [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x140053e04], eax
mov ebx, eax
je 0x1400015d5
xor eax, eax
lock cmpxchg dword [0x140053e04], ebx
cmp dword [0x140053e04], ebx
je 0x1400015d5
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x140053e04], ebx
jne 0x1400015b0
lea rdx, [rsp + 0x80]
call fcn.140019720
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lock cmpxchg dword [0x140053e04], esi
mov edi, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x140053e04], eax
mov ebx, eax
je 0x140001635
nop dword [rax]
nop dword [rax + rax]
xor eax, eax
lock cmpxchg dword [0x140053e04], ebx
cmp dword [0x140053e04], ebx
je 0x140001635
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x140053e04], ebx
jne 0x140001610
test edi, edi
mov eax, esi
cmovg eax, edi
mov dword [0x140053e00], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lock cmpxchg dword [0x140053e04], esi
mov rdi, qword [rsp + 0x2b8]
mov rbx, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140019ce0
add rsp, 0x2a0
pop rsi
ret
Function at 0x140001680
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x140053008]
xor rax, rsp
mov qword [rsp + 0x250], rax
movups xmm0, xmmword [str.SOFTWAREAtherosVistaAddOn]
xor edx, edx
mov r8d, 0x1d0
movups xmm1, xmmword [0x140041e88]
lea rcx, [rsp + 0x78]
xor ebx, ebx
movaps xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x140041e98]
movaps xmmword [rsp + 0x50], xmm1
movsd xmm1, qword [0x140041ea8]
movaps xmmword [rsp + 0x60], xmm0
movsd qword [rsp + 0x70], xmm1
call fcn.14001d250
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], ebx
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x34], 4
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400017d1
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.SwitchRadio
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400017c6
cmp dword [rsp + 0x30], 2
jne 0x1400017c6
lea rcx, str.reset_radio_off_status.__r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, 1
lea rcx, str.Enter_Function_DisableRadioHandler__disable___d_n
mov edx, ebx
call fcn.14000e220
mov r8d, ebx
lea rdx, str.Enter_Function_DisableRadioHandler__disable___d_n
lea ecx, [rbx + 1]
call fcn.1400197e0
call fcn.140009810
cmp eax, 0x32
jl 0x1400017af
lea rcx, str.DisableRadioHandler__dont_send_check_msg__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.DisableRadioHandler__dont_send_check_msg_n
lea ecx, [rbx + 1]
call fcn.1400197e0
mov dword [0x140053e94], ebx
mov ecx, dword [0x140053e70]
xor r9d, r9d
mov r8, rbx
mov edx, 0x5e5d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140019ce0
add rsp, 0x260
pop rbx
ret
Function at 0x1400017f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x268
mov rax, qword [0x140053008]
xor rax, rsp
mov qword [rsp + 0x250], rax
movups xmm0, xmmword [str.SOFTWAREAtherosVistaAddOn]
xor edx, edx
mov r8d, 0x1d0
movups xmm1, xmmword [0x140041e88]
lea rcx, [rsp + 0x78]
movaps xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x140041e98]
movaps xmmword [rsp + 0x50], xmm1
movsd xmm1, qword [0x140041ea8]
movaps xmmword [rsp + 0x60], xmm0
movsd qword [rsp + 0x70], xmm1
call fcn.14001d250
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x34], 4
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400018bd
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.SwitchRadio
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [rsp + 0x30]
lea rcx, str.The_value_of_SwitchRadio_is__d
call fcn.14000e220
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140019ce0
add rsp, 0x268
ret

Function at 0x1400018f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x268
mov rax, qword [0x140053008]
xor rax, rsp
mov qword [rsp + 0x250], rax
movups xmm0, xmmword [str.SOFTWAREAtherosVistaAddOn]
xor edx, edx
mov r8d, 0x1d0
movups xmm1, xmmword [0x140041e88]
lea rcx, [rsp + 0x78]
movaps xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x140041e98]
movaps xmmword [rsp + 0x50], xmm1
movsd xmm1, qword [0x140041ea8]
movaps xmmword [rsp + 0x60], xmm0
movsd qword [rsp + 0x70], xmm1
call fcn.14001d250
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x34], 4
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400019bd
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.ReplaceTrayIconDisabled
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [rsp + 0x30]
lea rcx, str.The_value_of_ReplaceTrayIconDisabled_is__d
call fcn.14000e220
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140019ce0
add rsp, 0x268
ret
Function at 0x1400019f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x30
mov rbp, rcx
lea rcx, str.CommApi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x140001ac0
mov qword [rsp + 0x40], rsi
lea rcx, str.Successfully_load_CommApi.dll_n_n
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r14
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.InitApi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CallApi
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnInitApi
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test r14, r14
je 0x140001aa8
test rdi, rdi
je 0x140001aa8
test rax, rax
je 0x140001aa8
call rdi
movups xmm0, xmmword [0x1400450d8]
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
mov rdx, rbp
movaps xmmword [rsp + 0x20], xmm0
call r14
call rsi
lea rcx, str.Successfully_fire_message_to_btvstack_n_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r14, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
Function at 0x140001e30
Capabilities:
Create thread
Print debug messages
Resume thread

Disassembly:
sub rsp, 0x38
lea rcx, str.Enter_Function_StartCustomThread____n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp qword [0x140053e68], 0
je case.default.0x140001e56
lea rcx, str.Enter_condition_pSvc__hWorkEvent___NULL__n
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [0x140053e68], rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140053e78], rax
xor r9d, r9d
lea r8, [0x14000fa00]
xor edx, edx
lea rax, [0x140053e70]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140053e60], rax
test rax, rax
je 0x140001ed7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov qword [0x140053e60], 0
mov ecx, dword [0x140053e70]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e5b
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov rcx, qword [0x140053e68]
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140001f42
lea rdx, str.Create_Thread_fails__n
mov ecx, 1
call fcn.1400197e0
mov ecx, dword [0x140053e70]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e5b
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov rcx, qword [0x140053e68]
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140001f04
call fcn.140009810
cmp eax, 0x14
jl 0x140001f89
cmp qword [0x140053e80], 0
jne 0x140001f89
lea rax, [0x140053e88]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9, [0x140053e20]
lea r8, [0x140001ad0]
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140053e80], rax
add rsp, 0x38
ret
mov ebx, 0x92f18824
mov word [rcx], es
xchg edx, eax
invalid
int 0x1e
test al, 0x97
cmpsd dword gs:[rsi], dword [rdi]
invalid
add dh, al
wait
movabs eax, dword [0x535b03063627f245]
mov edi, eax
fdivr qword [rdi + 0x5d]
jb 0x14008acea
mov dh, al
mov bl, 0xbf
mov edi, 0xe339e302
sub cl, al
xchg ebx, eax
insd dword [rdi], dx
loop 0x14008ad29
loop 0x14008ad2f
mov esp, dword [rsi + 0x139e34f0]
add esp, dword [rdi + rcx*4 + 0x29]
xor al, 0x2b
jle 0x14008acd0
xor al, 0x65
invalid
Function at 0x140001f90
Capabilities:
Print debug messages
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.Enter_Function_StopCustomThread____n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.140009810
xor ebx, ebx
cmp eax, 0x14
jl 0x140001fe8
cmp qword [0x140053e80], rbx
je 0x140001fe8
lea rcx, str.TerminateThread_pSvc__hTimerThread__0___n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [0x140053e80]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x140053e80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140053e80], rbx
cmp qword [0x140055680], rbx
je 0x140002021
lea rcx, str.TerminateThread_g_hS3S4CheckThread__0___n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [0x140055680]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x140055680]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140055680], rbx
mov rcx, qword [0x140053e60]
test rcx, rcx
je 0x1400020a3
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], ebx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x30], 0x103
jne 0x1400020a3
mov ecx, dword [0x140053e70]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e5c
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov rcx, qword [0x140053e60]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000208f
lea rcx, str.TerminateThread_pSvc__hCustomThread__0___n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [0x140053e60]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x140053e60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140053e60], rbx
mov rcx, qword [0x140053e68]
test rcx, rcx
je 0x1400020bc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140053e68], rbx
mov rcx, qword [0x140053e78]
test rcx, rcx
je 0x1400020d5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140053e78], rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140002310
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x440]
sub rsp, 0x540
mov rax, qword [0x140053008]
xor rax, rsp
mov qword [rbp + 0x430], rax
movups xmm0, xmmword [rcx]
lea rcx, [rbp + 0x5c]
mov eax, dword [0x140042a48]
movaps xmm1, xmmword [0x140042a10]
xor edx, edx
movaps xmmword [rbp - 0x80], xmm0
mov r8d, 0x1bc
movaps xmm0, xmmword [str.SOFTWAREAtherosVistaAddOnSupported]
movaps xmmword [rbp + 0x10], xmm0
movaps xmm0, xmmword [0x140042a20]
movaps xmmword [rbp + 0x30], xmm0
movsd xmm0, qword [0x140042a40]
movaps xmmword [rbp + 0x20], xmm1
movaps xmm1, xmmword [0x140042a30]
movsd qword [rbp + 0x50], xmm0
movaps xmmword [rbp + 0x40], xmm1
mov dword [rbp + 0x58], eax
call fcn.14001d250
xor edi, edi
mov dword [rsp + 0x64], 8
xor edx, edx
mov dword [rsp + 0x60], edi
mov r8d, 0x208
lea rcx, [rbp + 0x220]
call fcn.14001d250
lea r8d, [rdi + 0x40]
mov dword [rsp + 0x70], 4
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x80]
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
je 0x140002445
lea rax, [rsp + 0x68]
xor r8d, r8d
lea r9d, [rdi + 1]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x10]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002445
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rdi
xor r9d, r9d
mov qword [rsp + 0x50], rdi
xor r8d, r8d
mov qword [rsp + 0x48], rdi
xor edx, edx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14000244c
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400024fb
mov qword [rsp + 0x558], rbx
mov ebx, edi
cmp dword [rsp + 0x60], ebx
jbe 0x1400024e6
xor edx, edx
lea rcx, [rbp + 0x220]
mov r8d, 0x208
call fcn.14001d250
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x64]
lea rax, [rsp + 0x74]
mov dword [rsp + 0x64], 0x104
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x220]
lea rax, [rsp + 0x78]
mov edx, ebx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1400024d7
lea rdx, [rbp + 0x220]
lea rcx, [rbp - 0x70]
call fcn.140021830
test eax, eax
jne 0x1400024d7
cmp dword [rsp + 0x74], 1
je 0x1400024e1
inc ebx
cmp ebx, dword [rsp + 0x60]
jb 0x140002460
jmp 0x1400024e6
mov edi, 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x558]
mov eax, edi
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.140019ce0
mov rdi, qword [rsp + 0x560]
add rsp, 0x540
pop rbp
ret