joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005ff90
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x18007d010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180060063
cmp byte [rcx + 0x71], 0
je 0x180060063
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18006005f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180060024
sub eax, 1
je 0x180060028
cmp eax, 2
jne 0x18006005f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180064e10
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180060056
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18006005f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18006000c
xor al, al
jmp 0x18006000c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180064e10
add rsp, 0x60
pop rbx
ret
Function at 0x180060a10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x20
mov r15, qword [rdx + 0x18]
mov rdi, rdx
mov rsi, qword [rdx + 0x10]
mov r10, rcx
mov r9, rdx
cmp r15, 0x10
jb 0x180060a3c
mov r9, qword [rdx]
xor ebp, ebp
movabs r8, 0xcbf29ce484222325
mov edx, ebp
test rsi, rsi
je 0x180060a74
movabs rcx, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + r9]
inc rdx
xor r8, rax
imul r8, rcx
cmp rdx, rsi
jb 0x180060a60
mov rcx, qword [r10 + 0x30]
mov rax, qword [r10 + 0x18]
and rcx, r8
add rcx, rcx
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [r10 + 8]
jne 0x180060a92
mov rbx, rbp
jmp 0x180060ae2
mov qword [rsp + 0x40], r14
mov r14, qword [rax + rcx*8]
nop dword [rax + rax]
cmp qword [rbx + 0x28], 0x10
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
jb 0x180060ab2
mov rdx, qword [rdx]
mov rcx, rdi
cmp r15, 0x10
jb 0x180060abe
mov rcx, qword [rdi]
cmp rsi, rax
jne 0x180060acf
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180060add
cmp rbx, r14
je 0x180060ada
mov rbx, qword [rbx + 8]
jmp 0x180060aa0
mov rbx, rbp
mov r14, qword [rsp + 0x40]
test rbx, rbx
mov rbx, qword [rsp + 0x48]
setne bpl
mov rax, rbp
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x1800649b0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1800649e5
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.180060880
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180064b54
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180064acc
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180064b43
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x180064b09
mov r10, qword [rdx]
cmp r10, rax
je 0x180064b03
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180064b43
cmp r9, rdx
je 0x180064b1f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x180064b65
cmp r9, rdx
jne 0x180064b10
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x180064a50
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180064b43
Function at 0x180064b8c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x180064c10
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1800688c0]
cmp byte [rcx + rax], 0
je 0x180064c10
dec r8
sub rdx, 1
jne 0x180064bf6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x14000a3f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
xor edi, edi
mov qword [rax + 0x20], rdi
mov r8, rdx
lea rdx, [rax - 0x40]
call fcn.14000a7c0
nop
lea rdx, [rbx + 0x10]
mov r8, rax
lea rcx, [rsp + 0x30]
call fcn.14000f520
nop
lea r8, [rsp + 0x98]
mov rdx, rax
call fcn.14000a9a0
test al, al
sete bl
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test bl, bl
je 0x14000a46b
xor al, al
jmp 0x14000a5d2
mov dword [rsp + 0x80], edi
mov r8, rbp
lea rdx, [rsp + 0x38]
call fcn.14000a750
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete dil
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov eax, dword [rsp + 0x80]
shr eax, 1
test dil, dil
je 0x14000a5c0
test eax, eax
jne 0x14000a4e4
lea rdx, [0x140028a68]
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
jmp 0x14000a5c0
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.14000ca20
nop
mov r8, rbp
lea rdx, [rsp + 0x38]
call fcn.14000a750
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x28], rcx
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete dil
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
nop
test rbx, rbx
je 0x14000a5c0
mov rax, qword [rsp + 0x58]
sub rax, rbx
sar rax, 1
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x14000a570
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
add rax, rax
cmp rax, 0x1000
jb 0x14000a5b7
test bl, 0x1f
je 0x14000a587
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rbx - 8]
cmp rax, rbx
jb 0x14000a597
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rbx, rax
cmp rbx, 8
jae 0x14000a5a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rbx, 0x27
jbe 0x14000a5b4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rbx, rax
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonUndo::XElementButtonUndo]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000a5f0
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x50], 0
mov r8, rdx
lea rdx, [rsp + 0x30]
call fcn.14000a7c0
nop
lea rdx, [rbx + 8]
mov r8, rax
lea rcx, [rsp + 0x68]
call fcn.14000f520
nop
lea r8, [rsp + 0x50]
mov rdx, rax
call fcn.14000a830
test al, al
sete bl
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test bl, bl
je 0x14000a66c
xor al, al
jmp 0x14000a6c4
mov rdi, qword [rdi]
mov ebx, dword [rdi - 0x10]
mov r8, rsi
lea rdx, [rsp + 0x68]
call fcn.14000a750
mov rdx, qword [rax]
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140013080
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140045008]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rcx
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rdx, qword [rsp + 0x40]
mov eax, 0x7fffffff
shr rdx, 1
mov ecx, 0x18e6fdb
cmp rdx, rax
cmovbe eax, edx
mov edx, 0x3842494d
mov dword [rdi + 0x14], eax
mov rax, qword [rdi + 0x588]
cmp dword [rax + 0x1064], 0
cmovne ecx, edx
xor eax, eax
mov dword [rdi + 0x398], ecx
lea rcx, [rdi + 0x374]
nop
mov word [rcx], ax
lea rcx, [rcx + 2]
inc eax
cmp eax, 0x10
jl 0x1400130f0
mov rcx, qword [rdi + 0x588]
lea rdx, [rdi + 0x3cc]
or eax, 0xffffffff
mov byte [rdi + 0x394], 1
mov word [rdi + 0x3a4], ax
mov rax, qword [rcx]
call qword [rax + 0x68]
mov rcx, qword [rdi + 0x588]
mov rax, qword [rcx]
lea rbx, [rcx + 0x10b0]
call qword [rax + 0x18]
mov qword [rbx], rax
mov eax, 1
mov qword [rdi + 0x3f4], rbx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14001fb30
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140016510
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
mov r8b, 1
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.CrlUtils.dll_public:_void___cdecl_CrlUtils::CommandLine::SetCommandLine_wchar_t_const____ptr64__bool____ptr64]
mov rcx, rbx
call fcn.140016660
mov rcx, rbx
call fcn.140016790
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
lea rdx, vtable.CdrConvStartupInit.0
cmp rax, rdx
je 0x14001656d
call qword [rax + 0xb8]
test al, al
je 0x14001656d
mov rcx, rbx
call fcn.140016850
mov al, 1
jmp 0x140016573
add rsp, 0x30
pop rbx
ret

Function at 0x140017280
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
xor ebx, ebx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x40], rbx
cmp dword [0x140049068], ebx
jne 0x140017327
mov eax, dword [0x14004906c]
test eax, eax
jne 0x140017327
mov ecx, dword [0x140049060]
test ecx, ecx
je 0x1400172d5
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14004906c]
mov ecx, dword [0x140049060]
test eax, eax
jne 0x140017327
test ecx, ecx
jne 0x1400172e6
call fcn.1400170b0
test eax, eax
je 0x1400172fc
lea rdx, [rsp + 0x40]
mov rcx, qword [0x140045038]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x140017327
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x14001731d
cmp eax, 0x78
je 0x14001731d
cmp eax, 1
je 0x14001731d
cmp eax, 0x32
je 0x14001731d
xor eax, eax
jmp 0x14001737f
mov dword [0x14004906c], 1
lea rcx, str.crlutl.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
mov qword [rsp + 0x20], rax
cmp dword [0x140049068], 0
je 0x14001734e
cmp dword [0x14004906c], 0
jne 0x14001737c
mov esi, ebx
test rdi, rdi
sete sil
test esi, esi
je 0x140017363
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test esi, esi
je 0x14001737c
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140017600
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x20], 0
mov rbx, rcx
jne 0x1400176c6
add rcx, 0x38
call fcn.1400176d0
cmp qword [rbx + 0x68], 0
jne 0x140017660
mov rax, qword [rbx + 0x48]
cmp dword [rax - 0x10], 0
jne 0x140017632
xor eax, eax
jmp 0x140017657
mov rcx, qword [rbx + 8]
lea rdx, str.GetUILang
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140017657
call rax
mov rdx, qword [rbx + 0x48]
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x78]
mov qword [rbx + 0x68], rax
test rax, rax
je 0x1400176c6
lea rcx, [rbx + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::DrawButton]
movzx eax, byte [rbx + 0xb0]
xor r9d, r9d
xor r8d, r8d
mov byte [rbx + 0x10], al
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x28], rax
mov r9, rbx
lea r8, [0x1400177b0]
xor edx, edx
lea rax, [rbx + 0x30]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbx + 0x28]
or edx, 0xffffffff
mov qword [rbx + 0x20], rax
add rsp, 0x30
pop rbx
jmp qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
xchg esi, eax
xchg ebp, eax
xchg ebp, eax
invalid
Function at 0x1400199a0
Capabilities:
Get file size
Print debug messages
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x60
mov rax, qword [0x140045008]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov edx, 0x80000000
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x40], ebp
lea r8d, [rbp + 1]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140019b18
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
lea r8d, [rbp + 0xe]
mov rcx, rax
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140019a24
lea rcx, str.Error_reading_welcome_bitmap_file__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x140019aa0
mov eax, dword [rsp + 0x4a]
test eax, eax
jne 0x140019a3b
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x4a], eax
cmp dword [rsp + 0x40], 0xe
jne 0x140019b07
mov ecx, 0x4d42
cmp word [rsp + 0x48], cx
jne 0x140019b07
mov qword [rsp + 0x78], rsi
mov edx, 1
lea esi, [rax - 0xe]
mov qword [rsp + 0x80], rdi
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdi, rax
test rax, rax
jne 0x140019abb
lea rcx, str.Out_of_memory_loading_welcome_bitmap_file__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001fb30
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rbp
ret
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140019af9
lea rcx, str.Error_reading_welcome_bitmap_file__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140019a91
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
jmp 0x140019a93
lea rcx, str.Invalid_welcome_bitmap_file_format__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x140019aa0
lea rcx, str.Welcome_bitmap_file_does_not_exist__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x140019aa0
Function at 0x140019ba0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x40
mov rdi, r8
mov rsi, rcx
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x68], rbx
cmp dword [0x140049068], ebx
jne 0x140019c4d
mov eax, dword [0x14004906c]
test eax, eax
jne 0x140019c4d
mov edx, dword [0x140049060]
test edx, edx
je 0x140019bfb
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14004906c]
mov edx, dword [0x140049060]
test eax, eax
jne 0x140019c4d
test edx, edx
jne 0x140019c0c
call fcn.1400170b0
test eax, eax
je 0x140019c22
lea rdx, [rsp + 0x68]
mov rcx, qword [0x140045038]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x140019c4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x140019c43
cmp eax, 0x78
je 0x140019c43
cmp eax, 1
je 0x140019c43
cmp eax, 0x32
je 0x140019c43
xor eax, eax
jmp 0x140019cb5
mov dword [0x14004906c], 1
mov qword [rsp + 0x20], rbx
lea r9, [0x140017f50]
mov r8, rdi
mov edx, 0x6d47
mov rcx, rsi
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov rsi, rax
mov qword [rsp + 0x30], rax
cmp dword [0x140049068], 0
je 0x140019c84
cmp dword [0x14004906c], 0
jne 0x140019cb2
mov edi, ebx
test rsi, rsi
sete dil
test edi, edi
je 0x140019c99
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x140019cb2
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14001ad20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
xor bl, bl
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x14001ae33
xor eax, eax
lea rdx, str.CLSID
mov qword [rsp + 0x30], rax
mov r9d, 0x20019
mov qword [rsp + 0x78], rax
xor r8d, r8d
mov qword [rsp + 0x70], rax
mov rcx, 0xffffffff80000000
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001ae03
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x78]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001ae03
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.InprocServer32
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001ae03
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, [0x140028a68]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov dword [rsp + 0x68], 0x400
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, bl
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14001ae13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14001ae23
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001ae33
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00c5ecc0]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00c5ecd0]
mov dword [rax], 1
mov rax, qword [0x00c5ece0]
mov dword [rax], 1
mov rax, qword [0x00c5ecb0]
mov dword [rax], 1
mov rax, qword [0x00c5eb00]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x00c5eca0]
mov dword [0x00c6c008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x00c5ec50]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x00c5eab0]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058