joyce8/EMBER2024-capa huggingface dataset:
Function at 0x16005a7b0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x270
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, r8
mov rsi, rdx
mov r14, rcx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov rcx, qword [r14 + 0xb0]
test rcx, rcx
je 0x16009c6e6
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
mov ecx, 0xea
test eax, eax
jne 0x16009c6fc
mov edx, dword [rsp + 0x34]
lea eax, [rdx - 1]
cmp eax, 1
ja 0x16009c705
cmp dword [rsp + 0x34], 2
jne 0x16009c74e
cmp ebx, ecx
je 0x16009c710
mov esi, 0x104
mov edx, esi
mov rcx, rdi
call fcn.160034ad4
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x30], eax
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x16009c72f
add eax, eax
mov dword [rsp + 0x30], eax
test ebx, ebx
jne 0x16009c7c8
mov ecx, dword [rsp + 0x30]
shr ecx, 1
mov dword [rsp + 0x30], ecx
lea eax, [rcx - 1]
neg ecx
sbb edx, edx
and edx, eax
mov rcx, rdi
call fcn.160034aac
mov eax, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.16006e590
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x270
pop r14
pop rdi
pop rsi
ret
mov ecx, 6
jmp 0x16009c6ef
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0x16005a8be
cmp ebx, ecx
jne 0x16009c6ed
jmp 0x16005a83a
cmp edx, 7
je 0x16005a84a
jmp 0x16009c6ed
mov rcx, qword [rsp + 0x288]
mov r9d, 0xce
lea r8, str.onecoreuap_base_appmodel_search_searchcommonpkmutildcregistry.cxx
mov edx, 0x2e7
call fcn.160108adc
mov rcx, qword [rsp + 0x288]
mov r9d, 0xce
lea r8, str.onecoreuap_base_appmodel_search_searchcommonpkmutildcregistry.cxx
mov edx, 0x2ed
call fcn.160108adc
mov edx, dword [rsp + 0x30]
shr edx, 1
cmp ebx, ecx
mov rcx, rdi
jne 0x16009c78e
call fcn.160034ad4
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [r14 + 0xb0]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
jmp 0x16005a896
call fcn.160034ad4
mov edx, dword [rsp + 0x30]
lea r8, [rsp + 0x50]
mov rcx, rax
call fcn.1600c9ebc
mov rcx, qword [rsp + 0x288]
test eax, eax
jns 0x16005a896
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_searchcommonpkmutildcregistry.cxx
mov edx, 0x2fc
call fcn.1600b47d4
mov rcx, qword [rsp + 0x288]
mov r9d, ebx
lea r8, str.onecoreuap_base_appmodel_search_searchcommonpkmutildcregistry.cxx
mov edx, 0x301
call fcn.160108adc
int3
Function at 0x16005a9b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov rdi, r8
xor ecx, ecx
mov rsi, rdx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov rcx, qword [rbx + 0xb0]
mov dword [rsp + 0x50], 4
test rcx, rcx
je 0x16005aa2b
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x30]
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x16009c7f8
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov ecx, 6
jmp 0x16005aa13
cmp dword [rsp + 0x68], 4
jne 0x16005aa11
mov eax, dword [rsp + 0x30]
mov dword [rdi], eax
mov eax, 1
jmp 0x16005aa1b

Function at 0x16005ac0c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rsi, qword [rsp + 0x2c0]
mov r15, r8
mov rdi, qword [rsp + 0x2c8]
lea r8, [rsp + 0x40]
mov rbx, qword [rsp + 0x2d0]
mov r12d, r9d
mov rbp, rdx
mov r14, rcx
call fcn.16005acac
test al, al
mov qword [rsp + 0x30], rbx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rdi
cmove rdx, rbp
mov qword [rsp + 0x20], rsi
mov r9d, r12d
mov r8, r15
mov rcx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.16006e590
add rsp, 0x260
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x16005c4a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
cmp dword [rcx + 0x128], 0xffffffff
mov rbx, rcx
je 0x16009d53c
xor edi, edi
mov sil, dil
cmp qword [rbx + 0x118], rdi
je 0x16009d54d
lea r14, [rbx + 0x120]
mov rcx, qword [r14]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x16009d591
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test eax, eax
je 0x16009d5df
test sil, sil
jne 0x16009d5ff
cmp dword [rbx + 0x12c], 0xffffffff
jne 0x16009d64e
mov rbx, qword [rsp + 0x40]
mov al, dil
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop r14
ret
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
mov dword [rbx + 0x128], eax
jmp 0x16005c4c5
lea rcx, [rbx + 0x68]
mov qword [rsp + 0x20], rdi
mov r9d, 0x20019
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionPropertySystemPropertyHandlers
mov rdx, 0xffffffff80000002
call fcn.16005aa34
test eax, eax
jns 0x16005c4d7
mov rcx, qword [rsp + 0x38]
lea r8, str.onecoreuap_base_appmodel_search_search_searchgather_serverhandlerlist.cxx
mov r9d, eax
mov edx, 0x236
call fcn.1600b47d4
int3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov sil, 1
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov rdx, rax
mov rcx, r14
call fcn.1600161cc
mov rcx, qword [r14]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x16005c4ef
call fcn.1600c1ed0
mov rcx, qword [rsp + 0x38]
lea r8, str.onecoreuap_base_appmodel_search_search_searchgather_serverhandlerlist.cxx
mov r9d, eax
mov edx, 0x23e
call fcn.1600b47d4
int3
lea rcx, str.SearchHandlerList___Registry_change_detected..._waiting_60_seconds_to_re_inspect.
call fcn.16001a1d8
mov sil, 1
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov dword [rbx + 0x12c], eax
jmp 0x16005c4ff
mov r9, qword [r14]
mov edx, 1
mov rcx, qword [rbx + 0x118]
mov dword [rsp + 0x20], 1
lea r8d, [rdx + 4]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegNotifyChangeKeyValue]
test eax, eax
jle 0x16009d62e
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x16005c508
mov rcx, qword [rsp + 0x38]
lea r8, str.onecoreuap_base_appmodel_search_search_searchgather_serverhandlerlist.cxx
mov r9d, eax
mov edx, 0x24d
call fcn.1600b47d4
int3
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, dword [rbx + 0x12c]
cmp eax, 0xea60
jbe 0x16005c515
or dword [rbx + 0x12c], 0xffffffff
mov dil, 1
jmp 0x16005c515
Function at 0x160060c80
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r15, qword [rsp + 0x80]
mov r13, rcx
mov r12, qword [rsp + 0x88]
xor ecx, ecx
mov dword [r9], r8d
mov r14, r9
mov ebp, r8d
mov rdi, rdx
mov dword [r15], ecx
mov esi, ecx
mov dword [r12], ecx
mov bl, 1
test rdx, rdx
je 0x1600a51ba
or r11, 0xffffffffffffffff
inc r11
cmp word [rdx + r11*2], cx
jne 0x160060cd5
mov r10, rdi
mov r8, rcx
cmp r8, r11
jae 0x160060d2e
xor r9b, r9b
lea rax, [0x1601f5f72]
mov edx, ecx
cmp edx, 0xa
jae 0x1600a51c2
movzx ecx, word [r10]
cmp word [rax - 2], cx
ja 0x160060d11
cmp cx, word [rax]
ja 0x160060d11
mov r9b, 1
inc edx
add rax, 4
test r9b, r9b
je 0x160060cf6
xor ecx, ecx
inc r8
add r10, 2
test bl, bl
jne 0x160060ce5
jmp 0x1600a51d3
test bl, bl
je 0x1600a51d3
mov rbx, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r11, rcx
jmp 0x160060cdf
test r9b, r9b
movzx ebx, bl
mov rcx, rsi
cmove ebx, ecx
jmp 0x160060d1e
mov dword [rsp + 0x70], ecx
lea rax, [rsp + 0x80]
mov dword [rsp + 0x80], ecx
lea r9, [rsp + 0x70]
mov rcx, r13
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x88]
mov rdx, rdi
call fcn.1600afc80
mov esi, eax
test eax, eax
js 0x1600a52f5
mov edx, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x88]
mov dword [r12], ecx
test edx, edx
je 0x1600a5223
mov dword [r14], edx
test cl, 1
je 0x1600a523d
shr ecx, 2
and ecx, 1
mov dword [r14], 0x411
mov dword [r15], ecx
jmp 0x160060d36
test cl, 2
je 0x1600a5257
shr ecx, 2
and ecx, 1
mov dword [r14], 0x412
mov dword [r15], ecx
jmp 0x160060d36
test edx, edx
jne 0x1600a526e
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x1600a526e
mov dword [r14], eax
jmp 0x160060d36
test cl, 4
je 0x160060d36
mov ecx, ebp
call fcn.160019768
test al, al
je 0x1600a5291
mov dword [r14], ebp
mov dword [r15], 2
jmp 0x160060d36
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetUserDefaultLangID]
cmp ax, 4
je 0x1600a52e3
lea ecx, [rax - 0x11]
cmp cx, 1
jbe 0x1600a52e3
call qword [sym.imp.api_ms_win_core_localization_obsolete_l1_2_0.dll_GetUserDefaultUILanguage]
cmp ax, 4
je 0x1600a52e3
lea ecx, [rax - 0x11]
cmp cx, 1
jbe 0x1600a52e3
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetSystemDefaultLangID]
cmp ax, 4
je 0x1600a52e3
lea ecx, [rax - 0x11]
cmp cx, 1
jbe 0x1600a52e3
mov dword [r14], 0x411
mov dword [r15], 3
jmp 0x160060d36
movzx eax, ax
mov dword [r14], eax
mov dword [r15], 2
jmp 0x160060d36
cmp esi, 0x80070505
mov eax, 0
cmove esi, eax
jmp 0x160060d36

Function at 0x160066338
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov rdx, rcx
mov ecx, dword [0x160270d20]
cmp ecx, 0xffffffff
jne 0x1600a6a76
add rsp, 0x28
ret
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
test eax, eax
jne 0x16006634e
mov rcx, qword [rsp + 0x28]
lea r8, str.onecoreuap_base_appmodel_searchcommonincludePerUserCatalogResetHelper.h
lea edx, [rax + 0x39]
add rsp, 0x28
jmp fcn.160108704
Function at 0x160066ed8
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, r8
xor r9d, r9d
mov r8d, edx
xor ecx, ecx
lea rdx, [rsp + 0x30]
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetSpecialFolderPathW]
mov rax, qword [rbx]
lea rdx, [rsp + 0x30]
or r9d, 0xffffffff
xor r8d, r8d
mov rcx, rbx
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.16006e590
add rsp, 0x250
pop rbx
ret

Function at 0x1600686bc
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x390
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x380], rax
mov rbx, rdx
mov edi, ecx
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x48], 0
lea rcx, [rsp + 0x40]
call fcn.16000db94
lea rdx, [rsp + 0x40]
mov ecx, 1
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoGetMalloc]
test eax, eax
js 0x16006873f
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, edi
xor ecx, ecx
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderLocation]
test eax, eax
jns 0x160068775
lea rcx, [rsp + 0x38]
call fcn.160069278
nop
lea rcx, [rsp + 0x40]
call fcn.16000db94
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.16006e590
mov rbx, qword [rsp + 0x3b0]
add rsp, 0x390
pop rdi
ret
lea rcx, [rsp + 0x38]
call fcn.160069278
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x38]
lea rdx, [0x1601d7b88]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ext_ms_win_shell_shell32_l1_2_1.dll_SHBindToParent]
test eax, eax
js 0x160068801
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rax, qword [rax + 0x58]
call qword [case.0x16003fc5a.0]
test eax, eax
js 0x160068801
mov r9d, 0x104
lea r8, [rsp + 0x170]
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_shlwapi_winrt_storage_l1_1_1.dll_StrRetToBufW]
nop
mov rax, qword [rbx]
or r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rsp + 0x170]
mov rcx, rbx
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
nop
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rax + 0x28]
call qword [case.0x16003fc5a.0]
jmp 0x16006873f
Function at 0x1600690e4
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rdi, r8
mov byte [r9], 0
mov rsi, r9
lea rax, [rsp + 0x30]
mov r9d, 0x54
mov qword [rsp + 0x20], rax
mov ebp, edx
lea r8, [rsp + 0x40]
mov rbx, rcx
mov rcx, rdi
lea edx, [r9 - 0x53]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
test eax, eax
je 0x1600a7e6e
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rdx]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
je 0x160069198
mov rcx, qword [rbx + 8]
mov eax, 1
mov byte [rcx], 1
mov byte [rsi], 1
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rcx]
mov dword [rdx], ebp
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rcx]
mov qword [rdx], rdi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.16006e590
mov rbx, qword [rsp + 0xd8]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
jmp 0x160069175
call fcn.160069078
test eax, eax
js 0x160069198
jmp 0x16006913e

Function at 0x16006d3dc
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, 0xff
movzx edi, cx
cmp cx, ax
ja 0x16006d40c
movzx ebx, cx
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_isalnum]
test eax, eax
je 0x16006d41c
mov eax, 0x80
cmp di, ax
jae 0x16006d41c
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp ebx, 0x3d
ja 0x16006d44a
je 0x16006d40c
cmp ebx, 0x21
je 0x16006d40c
cmp ebx, 0x22
jbe 0x16006d446
cmp ebx, 0x26
jbe 0x16006d40c
cmp ebx, 0x27
jbe 0x16006d446
cmp ebx, 0x2f
jbe 0x16006d40c
cmp ebx, 0x39
jbe 0x16006d446
cmp ebx, 0x3b
jbe 0x16006d40c
xor eax, eax
jmp 0x16006d411
cmp ebx, 0x3f
jb 0x16006d446
cmp ebx, 0x5f
je 0x16006d40c
jmp 0x1600a98ee
cmp ebx, 0x40
jbe 0x16006d40c
cmp ebx, 0x5c
je 0x16006d40c
cmp ebx, 0x7e
je 0x16006d40c
jmp 0x16006d446

Function at 0x16006ee48
Capabilities:
Print debug messages

Disassembly:
jmp 0x16006ee50
push rbx
sub rsp, 0x540
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_rtlsupport_l1_1_0.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_rtlsupport_l1_1_0.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x16006eecd
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_rtlsupport_l1_1_0.dll_RtlVirtualUnwind]
jmp 0x16006eeed
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.16006e590
add rsp, 0x540
pop rbx
ret
Function at 0x16006ee50
Capabilities:
Print debug messages

Disassembly:
jmp 0x16006ee50
push rbx
sub rsp, 0x540
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_rtlsupport_l1_1_0.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_rtlsupport_l1_1_0.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x16006eecd
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_rtlsupport_l1_1_0.dll_RtlVirtualUnwind]
jmp 0x16006eeed
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.16006e590
add rsp, 0x540
pop rbx
ret
Function at 0x1600b31a4
Capabilities:
Check if file exists

Disassembly:
mov r11, rsp
push rsi
push rdi
sub rsp, 0x258
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [r11 + 8], rbx
xor esi, esi
mov qword [r11 - 0x18], r14
mov ebx, 0x104
mov r14, r8
mov qword [r8], rsi
mov r8, rcx
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.1600b2fdc
mov ecx, ebx
lea rax, [rsp + 0x30]
cmp word [rax], si
je 0x1600b31fc
add rax, 2
sub rcx, 1
jne 0x1600b31ed
mov rax, rbx
mov r8, rsi
sub rax, rcx
test rcx, rcx
cmovne r8, rax
je 0x1600b3262
mov rcx, rbx
lea rdx, [rsp + 0x30]
lea rdx, [rdx + r8*2]
sub rcx, r8
je 0x1600b3254
lea rax, [r8 + 0x7ffffefa]
add rax, rcx
lea r8, [0x1601d9a80]
sub r8, rdx
test rax, rax
je 0x1600b3254
movzx r9d, word [r8 + rdx]
test r9w, r9w
je 0x1600b3254
mov word [rdx], r9w
dec rax
add rdx, 2
sub rcx, 1
jne 0x1600b3233
test rcx, rcx
lea rax, [rdx - 2]
cmovne rax, rdx
mov word [rax], si
lea r8, [rsp + 0x30]
mov qword [rsp + 0x278], rbp
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov rdi, rax
test rax, rax
jne 0x1600b32b3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x1600b3406
mov rcx, qword [rsp + 0x268]
lea r8, [0x1601d9a34]
mov edx, CreateErrorInfo
call fcn.1600b29e0
mov esi, eax
jmp 0x1600b3406
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], esi
mov rcx, rdi
mov dword [rsp + 0x20], esi
call fcn.1600b1c20
mov ebp, eax
test eax, eax
jns 0x1600b32f1
mov rcx, qword [rsp + 0x268]
lea r8, [0x1601d9a34]
mov r9d, eax
mov edx, 0xce
call fcn.1600b29f8
mov esi, ebp
jmp 0x1600b3406
mov rcx, rbx
lea rax, [rsp + 0x30]
cmp word [rax], si
je 0x1600b3308
add rax, 2
sub rcx, 1
jne 0x1600b32f9
mov rax, rbx
mov r8, rsi
sub rax, rcx
test rcx, rcx
cmovne r8, rax
je 0x1600b3369
lea rdx, [rsp + 0x30]
lea rdx, [rdx + r8*2]
sub rbx, r8
je 0x1600b335b
lea rax, [r8 + 0x7ffffefa]
add rax, rbx
lea r8, [0x1601d9a88]
sub r8, rdx
test rax, rax
je 0x1600b335b
movzx ecx, word [r8 + rdx]
test cx, cx
je 0x1600b335b
mov word [rdx], cx
dec rax
add rdx, 2
sub rbx, 1
jne 0x1600b333c
test rbx, rbx
lea rax, [rdx - 2]
cmovne rax, rdx
mov word [rax], si
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
test rax, rax
mov rbx, rax
sete al
test al, al
je 0x1600b33a5
mov rcx, qword [rsp + 0x268]
lea r8, [0x1601d9a34]
mov edx, 0xd4
call fcn.1600b29e0
mov ebp, eax
jmp 0x1600b33d4
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1600b1c20
mov ebp, eax
test eax, eax
jns 0x1600b33e5
mov rcx, qword [rsp + 0x268]
lea r8, [0x1601d9a34]
mov r9d, eax
mov edx, 0xd6
call fcn.1600b29f8
test rbx, rbx
je 0x1600b33e1
mov rcx, rbx
call fcn.1600b0b00
mov esi, ebp
jmp 0x1600b3406
test rbx, rbx
je 0x1600b33f2
mov rcx, rbx
call fcn.1600b0b00
movsxd rcx, dword [rsp + 0x20]
movsxd rax, dword [rsp + 0x24]
shl rcx, 0x1f
or rax, rcx
mov qword [r14], rax
mov r14, qword [rsp + 0x250]
mov rbp, qword [rsp + 0x278]
mov rbx, qword [rsp + 0x270]
test rdi, rdi
je 0x1600b342b
mov rcx, rdi
call fcn.1600b0b00
mov eax, esi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.16006e590
add rsp, 0x258
pop rdi
pop rsi
ret
Function at 0x1600bc3ec
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor eax, eax
mov rsi, rdx
mov r8, rdx
mov qword [rsp + 0x48], rax
mov rdx, qword [rcx]
mov rdi, rcx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov r9d, 0x2001f
mov qword [rsp + 0x58], rax
call fcn.1600693a8
jmp 0x1600bc44d
lea rdx, [rsp + 0x70]
call fcn.1600bc3ec
xor ecx, ecx
mov ebx, eax
test eax, eax
jne 0x1600bc4a8
lea rax, [rsp + 0x60]
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rcx
xor edx, edx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
lea rcx, [rsp + 0x48]
test eax, eax
je 0x1600bc443
call fcn.1600693e8
mov rdx, rsi
mov rcx, rdi
call fcn.1600ba73c
mov ebx, eax
lea rcx, [rsp + 0x48]
call fcn.1600693e8
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.16006e590
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x1600bc65c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x490
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r14, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1600bc6d0
call fcn.1600c1ed0
mov ebx, eax
jmp 0x1600bc7ea
xor r9d, r9d
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FindResourceExW]
mov rdi, rax
test rax, rax
jne 0x1600bc6f4
call fcn.1600c1ed0
jmp 0x1600bc7de
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1600bc6ea
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jae 0x1600bc745
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x1600bc73b
lea rcx, [rsp + 0x70]
call fcn.1600ba8d0
mov ebx, 0x8007000e
jmp 0x1600bc801
mov ecx, eax
mov edx, 2
call fcn.1600b4800
cmp rax, 0x400
jbe 0x1600bc76d
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1600b7fc4
mov rax, qword [rsp + 0x70]
jmp 0x1600bc777
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x1600bc78e
test rax, rax
jne 0x1600bc79a
mov ebx, 0x8007000e
jmp 0x1600bc7e0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
test eax, eax
je 0x1600bc6ea
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.1600bc4d8
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x1600bc801
lea rcx, [rsp + 0x70]
call fcn.1600ba8d0
nop
lea rcx, [rsp + 0x48]
call fcn.160010bd0
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.16006e590
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r14
pop rdi
pop rsi
ret