joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ca280
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1402bf5c8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rdx
mov qword [rsp + 0x40], rdx
cmp qword [rdx + 0x18], 8
jb 0x1400ca2ab
mov rdx, qword [rdx]
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 7
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400ca2d0
lea rcx, [rsp + 0x20]
call fcn.140018360
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
jne 0x1400ca308
xor dil, dil
jmp 0x1400ca310
shr dil, 4
and dil, 1
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400ca34f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ca349
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ca37a
call fcn.1401a9a50
nop
mov rcx, rbx
call fcn.1400272a0
test dil, dil
je 0x1400ca360
mov al, 1
jmp 0x1400ca362
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401a9a30
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
call fcn.1401e3dbc
nop
Function at 0x1400de520
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1402bf5c8]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SOFTWAREAUEP
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400de603
mov dword [rsp + 0x70], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x10
lea r8, str.InstallAnalyticsStatus
lea rdx, [0x14022ee70]
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edx, dword [rsp + 0x74]
mov ecx, 0xffffffff
test eax, eax
cmovne edx, ecx
cmp edx, 1
sete dil
test rbx, rbx
je 0x1400de5da
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, dil
jmp 0x1400de5e2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401a9a30
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
call fcn.140015e70
mov r8, rax
lea r9, str.Unable_to_open_registry_key
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.140046020
lea rdx, [0x1402ba948]
lea rcx, [rsp + 0x40]
call fcn.1401cfc8c
int3
Function at 0x1400de640
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1402bf5c8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rcx
mov rax, qword [rcx]
mov r8, qword [rax]
mov qword [r8 + 0x40], rdx
lea rcx, [rsp + 0x40]
call fcn.1400f2be0
mov rbx, rax
mov rdx, qword [rsi]
mov rdi, qword [rdx]
add rdi, 0x70
xor ebp, ebp
cmp rdi, rax
je 0x1400de6b3
mov rcx, rdi
call fcn.1400272a0
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400de6f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400de6f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400de7aa
call fcn.1401a9a50
mov rbx, qword [rsi]
mov rcx, qword [rbx]
cmp byte [rcx + 0x10], 0
je 0x1400de709
mov rax, qword [rcx]
call qword [rax]
mov rbx, qword [rsi]
mov ecx, 8
call fcn.1401a9cf4
test rax, rax
je 0x1400de71d
mov qword [rax], rbx
jmp 0x1400de720
mov rax, rbp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x1400d4f40]
xor edx, edx
xor ecx, ecx
call fcn.1401e96a4
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400de79b
cmp dword [rsp + 0x38], 0
je 0x1400de7b0
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.1401ae4cc
test eax, eax
jne 0x1400de793
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401a9a30
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, eax
call fcn.1401accec
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call fcn.1401acd28
nop
call fcn.1401e3dbc
nop
mov ecx, 1
call fcn.1401acd28
int3
mov rdx, qword [rdx]
add rcx, 8
jmp 0x1400de640
Function at 0x1400ded30
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x1402bf5c8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xor sil, sil
mov byte [rsp + 0x40], sil
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SOFTWAREAMD
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400dee48
mov rdi, qword [rsp + 0xa0]
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0xa8], 4
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xac]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x10
lea r8, str.UseLocalErrorStrings
lea rdx, [0x14022ee70]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, eax
test eax, eax
jne 0x1400dee76
movzx ebx, sil
mov eax, 1
cmp dword [rsp + 0xac], 0
cmovne ebx, eax
mov byte [rsp + 0x40], bl
test rdi, rdi
je 0x1400dee19
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x1400dee20
movzx eax, bl
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401a9a30
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.140015e70
nop
mov r8, rax
lea r9, str.Unable_to_open_registry_key
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.140046020
lea rdx, [0x1402ba948]
lea rcx, [rsp + 0x50]
call fcn.1401cfc8c
nop
call fcn.140015e70
mov r8, rax
lea r9, str.Unable_to_get_registry_value
mov edx, ebx
lea rcx, [rsp + 0x78]
call fcn.140046020
lea rdx, [0x1402ba948]
lea rcx, [rsp + 0x78]
call fcn.1401cfc8c
int3
Function at 0x1400e0200
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x1402bf5c8]
xor rax, rsp
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, 1
cmp dword [rsp + 0x20], edi
jle 0x1400e0282
lea rbx, [rax + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rbx]
lea rdx, [0x140243e70]
call fcn.1401df7c0
test eax, eax
je 0x1400e02a3
mov rcx, qword [rbx]
lea rdx, str._UPDATECHKFRMCN
call fcn.1401df7c0
test eax, eax
je 0x1400e029c
inc edi
add rbx, 8
cmp edi, dword [rsp + 0x20]
jl 0x1400e0250
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401a9a30
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, 1
jmp 0x1400e0284
mov eax, 2
jmp 0x1400e0284
Function at 0x1400e02b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15, rdx
lea r14, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov rsi, r12
mov rbp, r12
test r14, r14
je 0x1400e04c6
mov rdx, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + 0xff]
shl rsi, cl
add rsi, rsi
nop dword [rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x1400e0374
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x1400e0330
mov ecx, dword [r10]
jmp 0x1400e0457
cmp ecx, 0x4e0
jb 0x1400e0457
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [r11 + 0x634]
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400e0390
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400e03e0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
mov r8, qword [rdi + 0x10]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, r8
ja 0x1400e0310
mov rdx, qword [rdi + 8]
or rsi, rax
lea ecx, [rdx + 0xff]
shl rbp, cl
add rbp, rbp
or rbp, r8
cmp rbp, r14
jb 0x1400e0300
xor edx, edx
mov rax, rbp
div r15
mov rcx, rax
mov r8, rdx
xor edx, edx
mov rax, rsi
div r15
cmp rax, rcx
jb 0x1400e04ea
cmp r8, r14
jne 0x1400e02e0
mov rbx, qword [rsp + 0x20]
mov rax, rsi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15
mov rax, rdx
pop r15
pop r14
pop r12
ret
Function at 0x1400ee250
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0xc0
mov rax, qword [0x1402bf5c8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
lea rax, [r11 - 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSecureBootState
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x1400ee3bf
mov rdi, qword [rsp + 0xa0]
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0xa8], 4
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xac]
mov qword [rsp + 0x28], rax
xor r14d, r14d
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 0x10]
lea r8, str.UEFISecureBootEnabled
lea rdx, [0x14022ee70]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test eax, eax
jne 0x1400ee3ec
mov qword [rbx], r14
cmp dword [rsp + 0xac], 1
jne 0x1400ee357
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov r8d, 2
lea rdx, [0x1402423f4]
mov rcx, rbx
call fcn.140018360
nop
test rdi, rdi
je 0x1400ee352
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
jmp 0x1400ee395
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov r8d, 3
lea rdx, [0x140242400]
mov rcx, rbx
call fcn.140018360
nop
test rdi, rdi
je 0x1400ee38b
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
jmp 0x1400ee395
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401a9a30
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
call fcn.140015e70
mov r8, rax
lea r9, str.Unable_to_open_registry_key
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140046020
lea rdx, [0x1402ba948]
lea rcx, [rsp + 0x50]
call fcn.1401cfc8c
nop
call fcn.140015e70
mov r8, rax
lea r9, str.Unable_to_get_registry_value
mov edx, esi
lea rcx, [rsp + 0x78]
call fcn.140046020
lea rdx, [0x1402ba948]
lea rcx, [rsp + 0x78]
call fcn.1401cfc8c
int3
Function at 0x1401057c0
Capabilities:
Modify service

Disassembly:
push rbx
push rsi
push r15
sub rsp, 0x80
mov rax, qword [0x1402bf5c8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r15d, edx
mov qword [rsp + 0x60], rcx
mov rbx, rcx
lea rdx, str.ServicesActive
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x140105815
mov rcx, rbx
call fcn.1400272a0
mov eax, 0xffffffff
jmp 0x1401058f9
cmp qword [rbx + 0x18], 8
mov rdx, rbx
mov qword [rsp + 0xb8], rdi
jb 0x14010582a
mov rdx, qword [rbx]
mov r8d, 0xf003f
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x14010585c
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call fcn.1400272a0
mov eax, 0xffffffff
jmp 0x1401058f1
mov qword [rsp + 0xb0], rbp
lea r9, [rsp + 0x60]
mov qword [rsp + 0x78], r12
xor r8d, r8d
xor r12d, r12d
mov qword [rsp + 0x70], r14
xor edx, edx
mov dword [rsp + 0x60], r12d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov edx, dword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
je 0x1401058c0
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x60]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov rcx, rbp
test eax, eax
jne 0x140105912
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call fcn.1400272a0
mov eax, 0xffffffff
mov r12, qword [rsp + 0x78]
mov rbp, qword [rsp + 0xb0]
mov r14, qword [rsp + 0x70]
mov rdi, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1401a9a30
add rsp, 0x80
pop r15
pop rsi
pop rbx
ret
mov r14d, dword [rbp + 4]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp r14d, r15d
je 0x140105961
mov qword [rsp + 0x50], r12
mov r9d, 0xffffffff
mov qword [rsp + 0x48], r12
mov r8d, r15d
mov qword [rsp + 0x40], r12
mov edx, r9d
mov qword [rsp + 0x38], r12
mov rcx, rdi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x1401058c0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call fcn.1400272a0
mov eax, r14d
jmp 0x1401058df
Function at 0x14010ade0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x340
mov rax, qword [0x1402bf5c8]
xor rax, rsp
mov qword [rsp + 0x330], rax
movsxd r15, r8d
mov r14, rdx
mov r10, rcx
mov r9, 0xffffffffffffffff
inc r9
cmp byte [rcx + r9], 0
jne 0x14010ae15
xor ebx, ebx
lea rcx, [rsp + 0x20]
movzx eax, bx
mov edi, 0x100
nop
mov byte [rcx], al
lea rcx, [rcx + 1]
inc ax
cmp ax, di
jl 0x14010ae30
xor sil, sil
mov word [rsp + 0x120], bx
xor r11b, r11b
lea r8, [rsp + 0x20]
mov rbp, rdi
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r8]
lea r8, [r8 + 1]
movzx ecx, dl
movzx eax, sil
add cl, byte [rax + r10]
add r11b, cl
lea rcx, [rsp + 0x20]
movzx eax, r11b
add rcx, rax
movzx eax, byte [rcx]
mov byte [r8 - 1], al
movzx eax, sil
inc eax
mov byte [rcx], dl
cdq
idiv r9d
mov esi, edx
sub rbp, 1
jne 0x14010ae60
mov r8, rdi
lea rcx, [rsp + 0x130]
xor edx, edx
call fcn.1401d04f0
mov r8, rdi
lea rcx, [rsp + 0x230]
xor edx, edx
call fcn.1401d04f0
mov r8, rdi
lea rcx, [rsp + 0x230]
mov rdx, r14
call fcn.1401eb7f0
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x130]
call fcn.14013d0b0
movzx r10d, byte [rsp + 0x120]
mov r9, rbx
movzx r11d, byte [rsp + 0x121]
nop
inc r10b
lea rdx, [rsp + 0x20]
movzx eax, r10b
lea rcx, [rsp + 0x20]
add rdx, rax
movzx r8d, byte [rdx]
add r11b, r8b
movzx eax, r11b
add rcx, rax
movzx eax, byte [rcx]
mov byte [rdx], al
mov byte [rcx], r8b
add r8b, byte [rdx]
movzx eax, r8b
movzx ecx, byte [rsp + rax + 0x20]
xor byte [rsp + r9 + 0x130], cl
inc r9
cmp r9, rdi
jl 0x14010af00
mov r8, r15
lea rdx, [rsp + 0x130]
mov rcx, r14
call fcn.1401eb7f0
lea rax, [rsp + 0x20]
nop
mov byte [rax], bl
lea rax, [rax + 1]
inc bx
cmp bx, di
jl 0x14010af60
xor r8b, r8b
mov word [rsp + 0x120], 0
xor r10b, r10b
lea r9, [rsp + 0x20]
lea r11, str.0000000000
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
movzx eax, dl
movzx r8d, r8b
inc r8d
add al, byte [rcx + r11]
lea rcx, [rsp + 0x20]
add r10b, al
movzx eax, r10b
add rcx, rax
movzx eax, byte [rcx]
mov byte [r9 - 1], al
mov eax, 0xcccccccd
mov byte [rcx], dl
mul r8d
shr edx, 3
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub r8d, ecx
sub rdi, 1
jne 0x14010af90
mov rax, r14
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.1401a9a30
mov rbx, qword [rsp + 0x388]
add rsp, 0x340
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140111b00
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [0x1402bf5c8]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov r14, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xor r15d, r15d
mov qword [rsp + 0x70], r15
lea ecx, [r15 + 0x30]
call fcn.1401a9cf4
mov rsi, rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x68], rax
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp - 0x80]
call fcn.1401d04f0
mov edx, 0x104
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r15w
lea rax, [rbp - 0x80]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140111ba3
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x48]
call fcn.140018360
nop
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 0x1b
jb 0x140111c08
lea rdi, [rcx + 0x1b]
mov qword [rsp + 0x58], rdi
lea rbx, [rsp + 0x48]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x48]
lea rcx, [rbx + rcx*2]
mov r8d, 0x36
lea rdx, str.DriverStoreFileRepository
call fcn.1401cfe40
mov word [rbx + rdi*2], r15w
jmp 0x140111c2d
mov qword [rsp + 0x20], 0x1b
lea r9, str.DriverStoreFileRepository
movzx r8d, byte [rsp + 0x30]
mov edx, 0x1b
lea rcx, [rsp + 0x48]
call fcn.14002dc10
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], r14
lea rcx, [rsp + 0x38]
call fcn.1401008a0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140111c89
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140111c84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140111d0a
call fcn.1401a9a50
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r15w
mov rax, qword [rsi + 8]
mov qword [rax], r15
mov rdi, qword [rsi]
test rdi, rdi
je 0x140111cd1
nop dword [rax]
mov rbx, qword [rdi]
lea rcx, [rdi + 0x10]
call fcn.1400272a0
mov edx, 0x30
mov rcx, rdi
call fcn.1401a9a50
mov rdi, rbx
test rbx, rbx
jne 0x140111cb0
mov edx, 0x30
mov rcx, rsi
call fcn.1401a9a50
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.1401a9a30
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1401e3dbc
nop
Function at 0x140117e90
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x1402bf5c8]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x50], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14011808b
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
xor r15d, r15d
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], r15w
lea rax, [rsp + 0x7c]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140117f20
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x20]
call fcn.140018360
nop
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400a8ed0
test eax, eax
sete dil
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140117f90
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140117f8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401180c1
call fcn.1401a9a50
mov rcx, rbx
test dil, dil
je 0x140117fb6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x58], 0
setne bl
mov rcx, rsi
call fcn.1400272a0
movzx eax, bl
jmp 0x140118095
lea rdx, [rsp + 0x50]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x140118081
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], r15w
lea rax, [rsp + 0x7c]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140117ff0
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x20]
call fcn.140018360
nop
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400a8ed0
test eax, eax
sete dil
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14011805c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140118057
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401180bb
call fcn.1401a9a50
mov rcx, rbx
test dil, dil
je 0x140117fb6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x58]
mov dword [r14], eax
mov rcx, rsi
call fcn.1400272a0
mov al, 1
jmp 0x140118095
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, rsi
call fcn.1400272a0
xor al, al
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1401a9a30
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2a0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1401e3dbc
nop
call fcn.1401e3dbc
int3
Function at 0x140119490
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rax, qword [0x1402bf5c8]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 0x59], rcx
mov qword [rbp - 0x51], rdx
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
mov dword [rbp - 0x49], MsiRecordSetStreamA
mov dword [rbp - 0x45], 0x140
lea rax, str.open
mov qword [rbp - 0x39], rax
mov rax, rcx
cmp qword [rcx + 0x18], 8
jb 0x140119508
mov rax, qword [rcx]
mov qword [rbp - 0x31], rax
mov rax, rbx
cmp qword [rdx + 0x18], 8
jb 0x140119519
mov rax, qword [rdx]
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x19], 0
mov ecx, 0x10
call fcn.1401a9cf4
test rax, rax
je 0x14011953a
lea rcx, [rbp - 0x49]
mov qword [rax], rcx
mov qword [rbp + 0x37], rax
lea rcx, [rbp + 0x2f]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400fa340]
xor edx, edx
xor ecx, ecx
call fcn.1401e96a4
mov qword [rbp + 0x27], rax
test rax, rax
je 0x1401195d8
cmp dword [rbp + 0x2f], 0
je 0x1401195ea
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp + 0x2f], eax
je 0x1401195f5
movaps xmm0, xmmword [rbp + 0x27]
movdqa xmmword [rbp + 0x37], xmm0
xor edx, edx
lea rcx, [rbp + 0x37]
call fcn.1401ae4f0
test eax, eax
jne 0x1401195cd
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x27], xmm0
mov rcx, rdi
call fcn.1400272a0
nop
mov rcx, rbx
call fcn.1400272a0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1401a9a30
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov ecx, 2
call fcn.1401acd28
nop
mov dword [rbp + 0x2f], 0
mov ecx, 6
call fcn.1401acd28
nop
mov ecx, 1
call fcn.1401acd28
int3
mov ecx, 5
call fcn.1401acd28
int3