joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400255d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov edx, 0x3fb
mov rcx, qword [rsp + 0x40]
call fcn.14003a774
mov qword [rsp + 0x28], rax
call fcn.140022e60
mov rcx, qword [rsp + 0x28]
cmp rcx, rax
jne 0x140025669
mov rax, qword [rsp + 0x48]
cmp dword [rax + 8], 0x100
je 0x140025611
jmp 0x140025658
mov eax, 0xffff8000
mov word [rsp + 0x20], ax
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0xffff8000
cmp eax, 0xffff8000
je 0x140025635
jmp 0x140025658
mov rax, qword [rsp + 0x48]
cmp qword [rax + 0x10], 0xd
jne 0x140025652
mov rcx, qword [rsp + 0x40]
call fcn.140026410
mov eax, 1
jmp 0x140025699
xor eax, eax
test eax, eax
jne 0x140025601
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.14003bd04
jmp 0x140025699
mov rax, qword [rsp + 0x48]
cmp dword [rax + 8], 0x100
jne 0x14002568a
mov rax, qword [rsp + 0x48]
cmp qword [rax + 0x10], 0xd
jne 0x14002568a
mov eax, 1
jmp 0x140025699
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.14003bd04
add rsp, 0x38
ret
Function at 0x140026fc0
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x140541e58]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0xa0]
cmp dword [rax + 0x120], 0
jne 0x140026ff6
xor eax, eax
jmp 0x140027198
mov rcx, qword [rsp + 0xa0]
call fcn.140027a10
test eax, eax
je 0x140027075
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
mov r9, qword [rsp + 0xa0]
lea r8, [0x140029b20]
xor edx, edx
xor ecx, ecx
call fcn.1401ecc58
mov rcx, qword [rsp + 0xa0]
mov qword [rcx + 0x158], rax
mov rax, qword [rsp + 0xa0]
cmp qword [rax + 0x158], 0
jne 0x14002705b
xor eax, eax
jmp 0x140027198
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax + 0x158]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140027196
mov rax, qword [rsp + 0xa0]
cmp qword [rax + 0x168], 0
je 0x140027196
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax + 0x168]
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx + 0x168]
mov rax, qword [rax]
lea rdx, [rsp + 0x74]
call qword [rax + 0x30]
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax + 0x168]
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx + 0x168]
mov rax, qword [rax]
lea rdx, [rsp + 0x70]
call qword [rax + gethostname]
mov eax, dword [rsp + 0x70]
neg eax
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx + 0x168]
mov rdx, qword [rsp + 0xa0]
mov rdx, qword [rdx + 0x168]
mov qword [rsp + 0x60], rdx
mov rcx, qword [rcx]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0xfc]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0xf8]
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
mov rax, qword [rsp + 0xa0]
mov rdx, qword [rax + 0x128]
mov rax, qword [rsp + 0x60]
mov rcx, rax
mov rax, qword [rsp + 0x68]
call qword [rax + 0x40]
test eax, eax
jne 0x140027196
xor edx, edx
mov rcx, qword [rsp + 0xa0]
call fcn.1400279e0
mov eax, 1
jmp 0x140027198
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401b8dc0
add rsp, 0x98
ret
Function at 0x140028100
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
call fcn.140022740
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14002815d
call fcn.140022740
mov rdx, qword [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140028164
xor eax, eax
jmp 0x140028244
call fcn.140022740
mov rdx, qword [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov edx, eax
mov ecx, 0x22
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400281ab
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x140028244
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1400281db
cmp qword [rsp + 0x40], 0
jne 0x1400281f5
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x140028244
mov eax, dword [rsp + 0x20]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call fcn.140027a60
mov dword [rsp + 0x24], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [rsp + 0x24]
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x14002a120
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x140541e58]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov edx, 0x405
mov rcx, qword [rsp + 0xa0]
call fcn.14003a774
mov qword [rsp + 0x28], rax
call fcn.140022e60
mov rcx, qword [rsp + 0x28]
cmp rcx, rax
jne 0x14002a2dc
mov rax, qword [rsp + 0xa8]
cmp dword [rax + 8], 0x100
je 0x14002a183
jmp 0x14002a2c5
mov eax, 0xffff8000
mov word [rsp + 0x20], ax
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0xffff8000
cmp eax, 0xffff8000
je 0x14002a1aa
jmp 0x14002a2c5
mov rax, qword [rsp + 0xa8]
cmp qword [rax + 0x10], 0xd
jne 0x14002a2bb
mov edx, 8
lea rcx, [rsp + 0x38]
call fcn.140003c50
lea rcx, [rsp + 0x38]
call fcn.140002fa0
nop
lea r8, [rsp + 0x38]
mov edx, 0x405
mov rcx, qword [rsp + 0xa0]
call fcn.14003444c
lea rdx, [0x1402451f0]
lea rcx, [rsp + 0x38]
call fcn.1400031a0
movzx eax, al
test eax, eax
je 0x14002a215
lea rcx, [rsp + 0x38]
call fcn.140003040
jmp 0x14002a2c5
lea rcx, [rsp + 0x60]
call fcn.140006c40
nop
lea rcx, [rsp + 0x40]
call fcn.140006c40
nop
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140026030
mov rax, qword [rsp + 0xa0]
add rax, 0x178
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140026030
lea rcx, [rsp + 0x40]
call fcn.140009f30
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x60]
call fcn.140009f30
mov rcx, qword [rsp + 0x30]
mov rdx, rcx
mov rcx, rax
call fcn.140008130
xor edx, edx
mov rcx, qword [rsp + 0xa0]
call fcn.14003b7a0
mov dword [rsp + 0x24], 1
lea rcx, [rsp + 0x40]
call fcn.140007490
nop
lea rcx, [rsp + 0x60]
call fcn.140007490
nop
lea rcx, [rsp + 0x38]
call fcn.140003040
mov eax, dword [rsp + 0x24]
jmp 0x14002a318
xor eax, eax
test eax, eax
jne 0x14002a16d
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
call fcn.14003bd04
jmp 0x14002a318
mov rax, qword [rsp + 0xa8]
cmp dword [rax + 8], 0x100
jne 0x14002a303
mov rax, qword [rsp + 0xa8]
cmp qword [rax + 0x10], 0xd
jne 0x14002a303
mov eax, 1
jmp 0x14002a318
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
call fcn.14003bd04
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401b8dc0
add rsp, 0x98
ret
Function at 0x14002a380
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x140541e58]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov edx, 8
lea rcx, [rsp + 0x58]
call fcn.140003c50
mov rcx, qword [rsp + 0x90]
call fcn.140004c90
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x88]
call fcn.140004c90
mov rcx, qword [rsp + 0x30]
mov r8, rcx
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14002a960
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.1400045f0
nop
lea rcx, [rsp + 0x40]
call fcn.1400076a0
lea rax, [0x14002a720]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x80]
add rax, 8
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x58]
call fcn.1400031e0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x50]
xor edx, edx
xor ecx, ecx
call fcn.1401ecc58
mov rcx, qword [rsp + 0x80]
mov qword [rcx], rax
mov rax, qword [rsp + 0x80]
cmp qword [rax], 0
je 0x14002a473
lea rcx, [rsp + 0x58]
call fcn.14000ac50
jmp 0x14002a48d
mov rax, qword [rsp + 0x80]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1401babdc
nop
lea rcx, [rsp + 0x58]
call fcn.1400076a0
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401b8dc0
add rsp, 0x78
ret

Function at 0x14002b8d0
Capabilities:
Create tcp socket

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov rax, qword [0x140541e58]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0xffffffffffffffff
jne 0x14002b916
lea rcx, [0x1402455f0]
call fcn.14000aa10
mov eax, 2
mov word [rsp + 0x40], ax
movzx ecx, word [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x42], ax
mov dword [rsp + 0x44], 0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x14002b95f
lea rcx, [0x140245618]
call fcn.14000aa10
mov edx, 5
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x14002b980
lea rcx, [0x140245640]
call fcn.14000aa10
lea r8, [rsp + 0x38]
lea rdx, [0x14002ba10]
lea rcx, [rsp + 0x28]
call fcn.14002a380
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x20]
lea rcx, [0x14054b3b0]
call fcn.1400078e0
lea rcx, [rsp + 0x28]
call fcn.140007850
lea rcx, [0x14054b3b0]
call fcn.14000a220
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401b8dc0
add rsp, 0x68
ret
Function at 0x14002d9c0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x118
mov rax, qword [0x140541e58]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x80], setsockopt
lea rax, [rsp + 0x81]
mov edx, 0x7f
mov rcx, rax
call qword [sym.imp.WS2_32.dll_gethostname]
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], 0xffffffffffffffff
inc qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
cmp byte [rax + rcx], 0
jne 0x14002da29
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x48]
call fcn.140006bb0
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x20], 0
mov rax, qword [rsp + 0x50]
mov r9, rax
lea r8, [rsp + 0x80]
mov edx, 0x1b59
mov rcx, qword [rsp + 0x58]
call fcn.14002cef0
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1401b8dc0
add rsp, 0x118
ret

Function at 0x1400316a4
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x78
test rdx, rdx
je 0x14003170c
mov r10, qword [rcx + 0x10]
test r10, r10
je 0x1400316f6
cmp qword [rcx + 0x18], 0
jne 0x1400316f1
mov eax, dword [rcx + 0xc]
cmp eax, dword [rcx + 0x30]
jae 0x140031712
mov qword [rsp + 0x58], rdx
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0x50
mov edx, eax
mov dword [rsp + 0x24], 0x40
mov r8d, 1
mov rcx, qword [r10 + 8]
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
add rsp, 0x78
ret
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x14003170c
mov rcx, qword [rcx + 0x40]
add rsp, 0x78
jmp fcn.14005da28
call fcn.14002dd78
int3
call fcn.14002dd78
int3

Function at 0x1400341d8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x140034236
call fcn.1400567bc
mov r8d, 0xf0
mov rdx, rdi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140034236
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140034241
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
mov rdx, rbx
mov rcx, rsi
call fcn.1400569fc
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140034ff4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400350ad
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x1400350ad
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400350ad
test rdi, rdi
je 0x1400350ad
xor r14d, r14d
xor esi, esi
call fcn.1400567bc
lea r8, [0x140247de0]
mov rdx, rdi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x14003508d
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rdi
mov rcx, rbp
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400350ad
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
mov r8d, r14d
mov rdx, rsi
mov rcx, rbx
call fcn.14005f2c0
mov edi, eax
test eax, eax
je 0x1400350a9
mov rcx, rbx
call fcn.140034cbc
mov eax, edi
jmp 0x1400350af
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140036020
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x40]
call fcn.14005dd68
mov rdi, rax
test rax, rax
je 0x14003609c
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x140036097
cmp dword [rbx], 0x40
jb 0x140036097
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
or dword [rbx + 4], 1
xor r8d, r8d
or qword [rbx + 0x30], 0xffffffffffffffff
mov edx, 0x87
mov qword [rbx + 8], rcx
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x140036097
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x1400360a0
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003a878
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movsxd rsi, r8d
mov rbx, rdx
mov rdi, rcx
xor ebp, ebp
cmp qword [rcx + 0xd0], rbp
jne 0x14003a8b2
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x14003a956
call fcn.14002f108
mov rcx, rax
test rax, rax
je 0x14003a971
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14006f2b2.0]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov rcx, qword [rdi + 0xd0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
mov rax, qword [rax + 0x118]
call qword [case.0x14006f2b2.0]
mov rdx, rsi
or rdi, 0xffffffffffffffff
mov r9, rdi
mov r8, qword [rsp + 0x30]
mov rcx, rbx
call fcn.1401ee990
test eax, eax
je 0x14003a91a
cmp eax, 0xc
je 0x14003a96b
cmp eax, 0x50
jne 0x14003a97c
test rbx, rbx
jne 0x14003a923
mov ebx, ebp
jmp 0x14003a92e
mov rcx, rbx
call fcn.1401ee3bc
mov rbx, rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
add ecx, edi
test ecx, ecx
jg 0x14003a954
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006f2b2.0]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
call fcn.14002dd9c
nop
mov ecx, 0x80004005
call fcn.140003340
nop
call fcn.14002dd78
int3

Function at 0x14003b014
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
cmp rdx, 0x10000
jae 0x14003b053
cmp dword [rcx + 0xe8], 0
jne 0x14003b053
movzx eax, si
mov dword [rcx + 0xe8], eax
call fcn.1400567bc
mov r8d, 5
mov rdx, rsi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x14003b3b4
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rsi, r9
mov rcx, rdx
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rbx, rbx
jne 0x14003b409
call fcn.14003f67c
mov rdx, rax
test rax, rax
je 0x14003b407
mov rcx, qword [rax]
mov rax, qword [rcx + 0xe8]
mov rcx, rdx
call qword [case.0x14006f2b2.0]
mov rbx, rax
jmp 0x14003b409
xor ebx, ebx
and qword [rdi + 0x108], 0
mov r9, rsi
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.14003b128
Function at 0x14003b0a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov rbx, rdx
mov r14, rcx
xor edi, edi
call fcn.1400567bc
lea r8d, [rdi + 5]
mov rdx, rbx
mov rsi, qword [rax + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14003b0fa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rsi
mov r8, rbp
mov rdx, rdi
mov rcx, r14
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.14003b128

Function at 0x140041ac0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x140041b3b
xor r8d, r8d
call fcn.140041d84
mov rsi, rax
test rax, rax
je 0x140041b37
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140041b37
mov eax, dword [rsp + 0x30]
jmp 0x140041b51
mov eax, edi
jmp 0x140041b51
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140042730
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140042797
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400427ab
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400427ab
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call qword [case.0x14006f2b2.0]
jmp 0x1400427b0
cmp dword [rcx + 8], 0
je 0x1400427ab
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x1400427b0
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140059800
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, [rsp + 0x34]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x30], eax
cmp eax, 0xffffffff
jne 0x14005983c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14005983c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rbx + 0x18]
mov ecx, eax
call fcn.1400f22d0
mov rax, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x140059b30
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test r8d, r8d
jne 0x140059b42
xor eax, eax
jmp 0x140059b70
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x50]
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140059b6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rbx + 0x18]
mov ecx, eax
call fcn.1400f22d0
mov eax, dword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret

Function at 0x140059c4c
Capabilities:
Write file on windows

Disassembly:
test r8d, r8d
je 0x140059c9b
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and qword [rsp + 0x20], 0
lea rdi, [rcx + 0x18]
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x50]
mov ebx, r8d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140059c8b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rdi]
mov ecx, eax
call fcn.1400f22d0
cmp dword [rsp + 0x50], ebx
jne 0x140059c9c
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, rdi
call fcn.1400031e0
or edx, 0xffffffff
mov r8, rax
lea ecx, [rdx + 0xe]
call fcn.1400f1e30
int3

Function at 0x1400627c4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [rdx + 4], 1
mov esi, r8d
mov rbx, qword [rdx + 0x10]
mov rdi, rdx
mov rbp, rcx
jne 0x14006283b
mov rcx, qword [rdi + 8]
mov r8d, 5
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14006280b
call fcn.14002fee0
mov rcx, qword [rdi + 8]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
jne 0x140062825
call fcn.14002fee0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x14006283b
call fcn.14002fee0
call fcn.1400567bc
cmp qword [rax + 0x68], 0
je 0x140062855
mov rdx, rbx
mov rcx, rbp
call fcn.140061c88
mov rbx, rax
mov edx, esi
mov rcx, rbx
call fcn.140062ab0
mov rcx, qword [rbp + 0xf8]
mov rsi, rax
test rcx, rcx
je 0x14006287c
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rbp + 0xf8], 0
test rsi, rsi
je 0x14006288b
mov rbx, rsi
mov qword [rbp + 0xf8], rsi
or dword [rdi + 4], 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rdi + 0x10], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14007e014
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rdx]
cmp dword [rcx - 0x10], 0
je 0x14007e046
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14007e046
lea rcx, [rdi + 0x120]
mov rdx, rbx
call fcn.140135004
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x14007e058
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14007e07e
mov r8, rdx
mov rdx, qword [rbx]
call fcn.140042730
jmp 0x14007e0e9
cmp byte [0x1405505d8], 0
jne 0x14007e0c2
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007e0b2
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1405505d0], rax
jmp 0x14007e0b9
mov rax, qword [0x1405505d0]
mov byte [0x1405505d8], 1
jmp 0x14007e0c9
mov rax, qword [0x1405505d0]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14007e0e3
mov r8d, dword [rbx + 8]
xor r9d, r9d
call qword [case.0x14006f2b2.0]
jmp 0x14007e0e9
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret