joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006aa0
Capabilities:
Log keystrokes via application hook

Disassembly:
sub rsp, 0x28
test ecx, ecx
je 0x140006bcf
cmp dword [0x14029ad90], 0
jne 0x140006c15
movabs rax, 0xcccccccccccccccc
mov byte [0x140293028], 0xff
mov qword [0x14029ae80], rax
lea rdx, [0x14029aeb8]
mov dword [0x14029ae88], eax
xor r8d, r8d
mov qword [0x14029ae90], rax
mov dword [0x14029ae98], eax
mov qword [0x14029aea0], rax
mov dword [0x14029aea8], eax
mov eax, dword [0x14029ae7c]
movzx ecx, byte [rdx]
cmp cl, 0xff
je 0x140006b23
movzx ecx, cl
cmp eax, ecx
cmovb eax, ecx
inc r8d
inc rdx
mov dword [0x14029ae7c], eax
cmp r8d, 8
jb 0x140006b01
xor r8d, r8d
lea rdx, [0x14029aeb0]
nop dword [rax]
movzx ecx, byte [rdx]
cmp cl, 0xff
je 0x140006b52
movzx ecx, cl
cmp eax, ecx
cmovb eax, ecx
inc r8d
inc rdx
mov dword [0x14029ae7c], eax
cmp r8d, 8
jb 0x140006b30
xor r8d, r8d
lea rdx, [0x14029b100]
nop dword [rax]
movzx ecx, byte [rdx]
cmp cl, 0xff
je 0x140006b82
movzx ecx, cl
cmp eax, ecx
cmovb eax, ecx
inc r8d
inc rdx
mov dword [0x14029ae7c], eax
cmp r8d, 8
jb 0x140006b60
lea rdx, str.Enable_Hook
mov ecx, 0x1d
call fcn.140002ae0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r9d, r9d
lea rdx, [0x14000d6a0]
mov r8, rax
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x14029ad98], rax
test rax, rax
je 0x140006c15
mov dword [0x14029ad90], 1
xor eax, eax
add rsp, 0x28
ret
cmp qword [0x14029ad98], 0
je 0x140006c15
cmp dword [0x14029ad90], 0
je 0x140006c15
lea rdx, str.Disable_Hook
mov ecx, 0x1d
call fcn.140002ae0
mov rcx, qword [0x14029ad98]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
test eax, eax
je 0x140006c15
mov dword [0x14029ad90], 0
xor eax, eax
add rsp, 0x28
ret
mov eax, 0x80004005
add rsp, 0x28
ret
Function at 0x140009a50
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov dword [rsp + 0x48], 4
mov rbx, rcx
mov qword [rsp + 0x50], rax
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], eax
lea r8, [rsp + 0x50]
lea rdx, str.SOFTWAREConexantMicTrayHotkey
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp qword [0x14029b238], 0
je 0x140009b49
cmp dword [0x14029b3cc], 0
je 0x140009b49
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, str.RenderRunning
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140009b49
mov r8d, dword [rsp + 0x40]
lea rdx, str.Key_change_to__d
lea ecx, [rax + 0x1d]
call fcn.140002ae0
mov eax, dword [rsp + 0x40]
sub eax, 1
je 0x140009b3f
cmp eax, 1
jne 0x140009b49
mov rax, qword [rbx + 0x800]
cmp dword [rax + 0x24], 0
jne 0x140009b33
lea rdx, str.PlayWave_Active
mov ecx, 0x1d
call fcn.140002ae0
mov rcx, qword [rbx + 0x800]
call fcn.14000ed90
mov ecx, 0x4e20
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbx + 0x800]
call fcn.14000ef50
mov dword [0x14029aeac], 2
jmp 0x140009b49
mov dword [0x14029aeac], 1
mov r8, qword [rbx + 0x3b8]
mov rcx, rbx
mov rdx, qword [0x14029b238]
call fcn.14000c4c0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140009b6f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret
Function at 0x14000ba80
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rax, qword [0x140294a28]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rcx, qword [0x14029b250]
lea rax, [rcx - 1]
xor esi, esi
cmp rax, 0xfffffffffffffffd
ja 0x14000bace
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14029b250], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
mov rcx, qword [0x14029ae58]
mov rax, qword [rcx]
lea r9, [rsp + 0x40]
xor edx, edx
lea r8d, [rdx + 0xf]
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000bb1a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
mov edi, esi
cmp dword [rsp + 0x30], esi
jbe 0x14000bb98
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea r8, [rsp + 0x38]
mov edx, edi
call qword [rax + 0x20]
mov r8d, 0x104
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call fcn.140015640
mov ebx, eax
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.1401ab280
cmp ebx, 0x10
je 0x14000bb7a
inc edi
cmp edi, dword [rsp + 0x30]
jb 0x14000bb30
jmp 0x14000bb93
mov r9d, dword [rsp + 0x30]
mov r8d, edi
lea rdx, str.Find_HP_EndPoint__d_total__d_EndPoint
mov ecx, 0x1d
call fcn.140002ae0
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
call qword [rax + 0x28]
test eax, eax
je 0x14000bbb8
lea rdx, str.Render_EndPoint_getId_fail
mov ecx, 0x1d
call fcn.140002ae0
mov r8, qword [rsp + 0x48]
lea rdx, str.Render_EndPoint__s
mov ecx, 0x1d
call fcn.140002ae0
cmp dword [0x14029b26c], 0
jne 0x14000bc5d
mov ecx, 0x60
call fcn.14001aae0
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14000bc08
mov r8, qword [rsp + 0x48]
mov rdx, qword [0x14029ae58]
mov rcx, rax
call fcn.14000eb20
mov rbx, rax
jmp 0x14000bc0b
mov rbx, rsi
test rbx, rbx
je 0x14000bc5d
cmp dword [rbx + 0x24], 0
jne 0x14000bc39
lea rdx, str.PlayWave_Active
mov ecx, 0x1d
call fcn.140002ae0
mov rcx, rbx
call fcn.14000ed90
mov dword [0x14029b26c], 1
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x14000bca0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14029b250], rax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000bc6d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1401a6080
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000c530
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
lea rdx, str.CnxtNotificationClient
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
lea r8, [rsp + 0x30]
mov dword [rsp + 0x40], 8
mov rbx, rax
mov dword [rsp + 0x60], 4
lea rax, [0x1401e6f80]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x48], rax
lea rdx, str.SOFTWAREConexantMicTraySmartAudio
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x78], eax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.CopyDataMsg
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r8, qword [rdi + 0x40]
lea r9, [rsp + 0x38]
mov edx, 0x4a
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000c5e2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14000d0c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
sub rsp, 0x58
mov qword [rax - 8], rbx
lea r8, [rax + 0x20]
mov qword [rax - 0x10], rbp
lea rdx, str.SOFTWAREConexantMicTray
mov ebp, ecx
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov rcx, 0xffffffff80000002
xor edi, edi
mov byte [rax + 8], bpl
mov qword [rax + 0x20], rdi
mov dword [rax + 0x10], edi
mov dword [rax + 0x18], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, str.GPIO
lea rax, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [0x14029b5f4]
mov esi, 1
mov ebx, esi
test ebp, ebp
je 0x14000d148
mov ecx, dword [0x140293188]
shl ebx, cl
and ebx, dword [rsp + 0x68]
test eax, eax
js 0x14000d1f5
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, str.SpkMuteLED
xor r9d, r9d
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x20], rax
test ebp, ebp
je 0x14000d187
lea rdx, str.MicMuteLED
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r9d, dword [rsp + 0x68]
test ebx, ebx
je 0x14000d1a8
test r9d, r9d
mov eax, 2
cmove edi, eax
mov byte [rsp + 0x61], dil
jmp 0x14000d1bd
cmp r9d, 1
mov eax, 3
cmove esi, eax
movzx edi, sil
mov byte [rsp + 0x61], sil
movzx eax, dil
mov r8d, ebx
mov dword [rsp + 0x20], eax
mov ecx, 0x1d
lea rdx, str.EPType_Spk_0x_x__read_0x_x__invert_to_reg_0x_x
test ebp, ebp
je 0x14000d1df
lea rdx, str.EPType_Mic_0x_x__read_0x_x__invert_to_reg_0x_x
call fcn.140002ae0
movzx edx, word [rsp + 0x60]
mov rcx, qword [0x14029adc8]
call fcn.140004ae0
mov rcx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000d219
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x58
ret
Function at 0x14000ed90
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rsi
mov rbx, rcx
xor edi, edi
call fcn.140028430
mov rcx, rax
test rax, rax
je 0x14000ef43
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
mov r8, qword [rbx + 0x58]
lea rdx, str.CPlaywave__s__Active_n
lea rcx, [rsp + 0x60]
call fcn.140007150
cmp dword [rbx + 0x24], edi
je 0x14000edf2
mov edi, 0x800700b7
jmp 0x14000ef10
mov rcx, qword [rbx + 0x10]
test rcx, rcx
jne 0x14000ee28
mov edi, 0x80004003
lea rax, str.m_pEnumerator
mov qword [rsp + 0x20], rax
lea r9d, [rcx + 0x79]
lea r8, str.c:usersweisdocuments1_cnxtprojectcodemictraymictray_audkjplaywave.cpp
lea rdx, str._n_s__d__:__NULL_POINTER___s_n
call fcn.140002ae0
jmp 0x14000ef10
cmp qword [rbx + 0x18], 0
je 0x14000ee39
mov edi, 0x800700b7
jmp 0x14000ef10
mov rax, qword [rcx]
lea r8, [rbx + 0x18]
mov rdx, qword [rbx + 0x50]
call qword [rax + 0x28]
cmp qword [rbx + 0x18], 0
jne 0x14000ee58
mov edi, 0x8004080b
jmp 0x14000ef10
cmp qword [rbx + 0x30], 0
jne 0x14000ee73
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x30], rax
cmp qword [rbx + 0x38], 0
jne 0x14000ee8e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x38], rax
cmp qword [rbx + 8], 0
je 0x14000ee9c
mov edi, 0x8000ffff
jmp 0x14000ef10
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, rbx
lea r8, [0x14000fa60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
jne 0x14000eee6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov r8, qword [rbx + 0x58]
lea rdx, str.CPlaywave__s__CreateThread___failed._n
lea rcx, [rsp + 0x60]
call fcn.140007150
jmp 0x14000ef00
mov r9d, dword [rsp + 0x58]
mov r8, qword [rbx + 0x58]
lea rdx, str.CPlaywave__s__CreateThread__x__._n
lea rcx, [rsp + 0x60]
call fcn.140007150
mov dword [rbx + 0x24], 1
mov rcx, rbx
call fcn.14000f4f0
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000ef31
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov ecx, 0x80004005
call fcn.140002d20
int3
Function at 0x140015a60
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x250
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x140294a28]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edx, edx
call fcn.14003047c
nop
lea rax, vtable.CTrayApp.0
mov qword [rbx], rax
mov qword [rbx + 0x178], 0
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call fcn.1401ab280
lea r8, str.c:usersPublicMicTray.log
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1401ad828
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.14000a5c0
nop
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a6080
add rsp, 0x250
pop rbx
ret
Function at 0x140016a30
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x140016ae5
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x140016ab1
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140016ad0
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140016ad0
mov rdx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je 0x140016ad0
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x14029b390], 0
jne 0x140016b30
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140016b20
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14029b388], rax
mov byte [0x14029b390], 1
jmp 0x140016b37
mov rax, qword [0x14029b388]
mov byte [0x14029b390], 1
jmp 0x140016b37
mov rax, qword [0x14029b388]
mov rcx, qword [rbx]
mov rdx, rsi
test rax, rax
je 0x140016aba
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp rax

Function at 0x140016d20
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.140030ddc
lea r8, str.CnxtMicTray
mov edx, 1
xor ecx, ecx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 0x180], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x30]
xor ecx, ecx
cmp eax, 0xb7
cmove edi, ecx
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x140016fc0
Capabilities:
Get session user name
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140294a28]
xor rax, rsp
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [str.DTMLLUAdminUser]
mov ecx, 0xfffe
xor ebx, ebx
movups xmm1, xmmword [0x1401ebd28]
mov dword [rsp + 0x38], 0x7fff
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm1
call fcn.14001ab30
mov rdi, rax
test rax, rax
je 0x1400170f4
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x80], rbp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea ebp, [rbx + 1]
test eax, eax
je 0x140017044
lea r8d, [rbx + 0xf]
mov rcx, rdi
lea rdx, [rsp + 0x40]
call fcn.1401b1f48
test eax, eax
cmove ebx, ebp
mov rcx, rdi
call fcn.14001ab28
test ebx, ebx
je 0x1400170cf
cmp dword [0x14029b3b4], 0
je 0x1400170cf
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], 0
lea rdx, str.SOFTWAREConexantAFA
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400170ca
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x3c], ebp
lea rdx, str.DTMRunning
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400170ca
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x30], 0
call fcn.140014fc0
mov rbp, qword [rsp + 0x80]
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401a6080
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov eax, ebx
jmp 0x1400170d9
Function at 0x1400178b0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140294a28]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov qword [rsp + 0x48], rbp
mov r8, rdx
mov dword [rsp + 0x50], ebp
mov rdx, qword [rcx]
mov rdi, rcx
or r9d, 0x2001f
mov qword [rsp + 0x58], rbp
lea rcx, [rsp + 0x48]
call fcn.140017360
mov ebx, eax
test eax, eax
jne 0x1400179c7
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400179a1
nop dword [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1400178b0
mov ebx, eax
test eax, eax
jne 0x1400179c7
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140017950
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400179b6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov rdx, rsi
mov dword [rsp + 0x50], ebp
mov rcx, rdi
call fcn.140016a30
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400179d7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1401a6080
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140017ee0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x140294a28]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140017f6e
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140017f6e
call fcn.1400165a0
mov ebx, eax
jmp 0x140018093
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140017f8f
call fcn.1400165a0
jmp 0x140018082
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140017fb2
call fcn.1400165a0
jmp 0x140018082
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x140017fd4
mov ebx, 0x8007000e
jmp 0x140018084
mov ecx, eax
test eax, eax
je 0x140018009
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x1400180cb
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x140018009
lea rcx, [rsp + 0x70]
call fcn.140016470
jmp 0x140018013
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x140018026
cmp qword [rsp + 0x70], 0
jne 0x140018035
mov ebx, 0x8007000e
jmp 0x140018084
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14001805f
call fcn.1400165a0
jmp 0x140018082
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140017a00
mov ebx, eax
test rdi, rdi
je 0x140018093
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x1400180aa
lea rcx, [rsp + 0x70]
call fcn.140016c70
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1401a6080
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.140002d20
int3
Function at 0x140019cf0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov eax, 0x1040
call fcn.1401a60e0
sub rsp, rax
mov rax, qword [0x140294a28]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov rbp, rcx
xor ebx, ebx
mov ecx, dword [0x14029b5f0]
test ecx, ecx
je 0x140019d3e
mov rdx, rbp
call fcn.140019e00
test eax, eax
je 0x140019d38
lea eax, [rbx + 1]
jmp 0x140019dbf
mov dword [0x14029b5f0], ebx
mov qword [rsp + 0x1050], rsi
mov qword [rsp + 0x1058], rdi
cmp word [rbp], bx
je 0x140019d9c
lea r8, [rsp + 0x20]
mov edx, 0x1000
lea rcx, [rsp + 0x30]
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x140019d9c
mov esi, dword [rsp + 0x20]
shr esi, 2
test esi, esi
je 0x140019d9c
lea rdi, [rsp + 0x30]
nop dword [rax]
mov ecx, dword [rdi]
test ecx, ecx
je 0x140019d92
mov rdx, rbp
call fcn.140019e00
test eax, eax
jne 0x140019de0
inc ebx
add rdi, 4
cmp ebx, esi
jb 0x140019d80
lea rdx, str.Not_FindMatchProcess_n
mov ecx, 0x1d
call fcn.140002ae0
xor eax, eax
mov rsi, qword [rsp + 0x1050]
mov rdi, qword [rsp + 0x1058]
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1401a6080
mov rbx, qword [rsp + 0x1060]
add rsp, 0x1040
pop rbp
ret
mov ecx, dword [rsp + rbx*4 + 0x30]
mov eax, 1
mov dword [0x14029b5f0], ecx
jmp 0x140019daf

Function at 0x140019e00
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x140294a28]
xor rax, rsp
mov qword [rsp + 0x240], rax
movups xmm0, xmmword [str._unknown_]
mov eax, dword [0x1401ec490]
mov rbx, rdx
mov esi, ecx
mov dword [rsp + 0x40], eax
xor edx, edx
movaps xmmword [rsp + 0x30], xmm0
mov r8d, 0x1f4
lea rcx, [rsp + 0x44]
call fcn.1401ab280
mov r8d, esi
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140019ee7
lea r9, [rsp + 0x20]
mov r8d, 8
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x140019e9d
mov rdx, qword [rsp + 0x28]
lea r8, [rsp + 0x30]
mov r9d, 0x104
mov rcx, rdi
call sub.KERNEL32.dll_K32GetModuleBaseNameW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x30]
sub rbx, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + rbx]
sub edx, ecx
jne 0x140019ec3
add rax, 2
test ecx, ecx
jne 0x140019eb0
test edx, edx
jne 0x140019eed
mov r9d, esi
lea r8, [rsp + 0x30]
lea rdx, str._s___PID:__u__n
mov ecx, 0x1d
call fcn.140002ae0
mov eax, 1
jmp 0x140019eef
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a6080
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret