joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400086f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x470
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x140218f40]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r13, r8
mov rdi, rdx
mov r12, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r8
xor r14d, r14d
mov dword [rsp + 0x38], r14d
lea rdx, [0x1401dc830]
call fcn.1400150a0
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 0x400
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [r13]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or rbp, 0xffffffffffffffff
test eax, eax
jne 0x140008892
mov ebx, 0x200
lea rsi, [0x1401d8f30]
mov eax, dword [rsp + 0x30]
cmp eax, 1
je 0x1400087b0
cmp eax, 2
je 0x1400087b0
cmp eax, 7
jne 0x140008825
mov ecx, dword [rsp + 0x34]
test ecx, ecx
jne 0x140008800
mov rdx, rbx
lea rcx, [rsp + 0x60]
mov rdi, rsi
lea rax, [rsp + 0x60]
sub rdi, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffdfe]
test rax, rax
je 0x1400087f3
movzx eax, word [rdi + rcx]
test ax, ax
je 0x1400087f3
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x1400087d0
jmp 0x1400087f8
test rdx, rdx
jne 0x1400087fc
sub rcx, 2
mov word [rcx], r14w
mov rcx, rbp
lea rdi, [rsp + 0x60]
xor eax, eax
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x60]
mov rcx, r12
call fcn.140014fb0
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x140008892
lea rcx, [rsp + 0x60]
lea rax, [rsp + 0x60]
sub rsi, rax
nop word [rax + rax]
lea rax, [rbx + 0x7ffffdfe]
test rax, rax
je 0x140008863
movzx eax, word [rsi + rcx]
test ax, ax
je 0x140008863
mov word [rcx], ax
add rcx, 2
dec rbx
jne 0x140008840
jmp 0x140008868
test rbx, rbx
jne 0x14000886c
sub rcx, 2
mov word [rcx], r14w
xor eax, eax
mov rcx, rbp
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x60]
mov rcx, r12
call fcn.140014fb0
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebp
dec ebp
test ebp, ebp
jg 0x1400088ae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r12
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14015e210
add rsp, 0x470
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000ef70
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov r11, rsp
push rbx
push rbp
sub rsp, 0x98
mov rax, qword [0x140218f40]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov qword [r11 + 0x10], rdi
lea rcx, [r11 - 0x60]
mov ebp, 1
mov qword [r11 - 0x18], r13
call qword [sym.imp.HID.DLL_HidD_GetHidGuid]
lea r9d, [rbp + 0x11]
lea rcx, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
xor r13d, r13d
mov qword [rsp + 0xb0], rsi
mov ebx, r13d
mov qword [rsp + 0xc0], r12
mov rdi, rax
nop word [rax + rax]
lea rax, [rsp + 0x58]
lea r8, [rsp + 0x48]
mov r9d, ebx
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x58], 0x20
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
test eax, eax
je 0x14000f0d4
lea rax, [rsp + 0x40]
lea rdx, [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], r13d
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailW]
test eax, eax
jne 0x14000f0d1
mov ecx, dword [rsp + 0x40]
call fcn.14015e67c
lea rdx, [rsp + 0x58]
mov rcx, rdi
mov dword [rax], 8
mov r9d, dword [rsp + 0x40]
mov r12, rax
lea rax, [rsp + 0x40]
mov r8, r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailW]
mov qword [rsp + 0x30], r13
lea rcx, [r12 + 4]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000f0bc
lea rdx, [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.HID.DLL_HidD_GetAttributes]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call fcn.14015e734
inc ebx
cmp ebx, 0x32
jb 0x14000efe0
jmp 0x14000f0d4
mov ebp, r13d
mov r13, qword [rsp + 0x90]
mov r12, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xb0]
cmp rdi, 0xffffffffffffffff
je 0x14000f0fb
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rdi, qword [rsp + 0xb8]
sub eax, ebx
cmp eax, 0x64
jae 0x14000f138
nop dword [rax + rax]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x64
jb 0x14000f120
mov eax, ebp
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14015e210
add rsp, 0x98
pop rbp
pop rbx
ret
Function at 0x14000fb00
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [0x140226cac]
xor edi, edi
test r8d, r8d
jne 0x14000fb32
mov r8d, dword [0x140226cb0]
test r8d, r8d
jne 0x14000fb85
lea eax, [rdi + 1]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000fb6c
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x140226cac]
cmp eax, 1
cmove ecx, edi
mov dword [0x140226cac], ecx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 3
mov ecx, edx
call qword [0x1402261c0]
mov r8d, dword [0x140226cb0]
test r8d, r8d
je 0x14000fbcd
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000fbbf
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x140226cb0]
cmp eax, 1
cmove ecx, edi
mov dword [0x140226cb0], ecx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 3
lea ecx, [rdx + 1]
call qword [0x1402261c0]
xor ecx, ecx
call fcn.14000f160
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x14000fc30
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xe0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
call fcn.14001e6e8
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14000fc6b
mov ecx, 0x80004005
call fcn.140014f90
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xf0], rbx
lea rcx, [rsp + 0xf8]
call fcn.140010250
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
or edi, 0xffffffff
cmp rcx, rbx
je 0x14000fcf1
cmp dword [rbx + 0x10], 0
jl 0x14000fcdf
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14000fcdf
call fcn.1400149f0
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14000fcd1
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0xf0], rax
jmp 0x14000fcf1
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0xf0]
call fcn.140014fb0
nop
mov rdx, qword [rsp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000fd13
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.ElantechETDCtrlHelper.exe
lea rcx, [rsp + 0xf0]
call fcn.140013e60
lea rcx, [rsp + 0xa0]
call fcn.14002afd8
nop
xor r8d, r8d
mov rbx, qword [rsp + 0xf0]
mov rdx, rbx
lea rcx, [rsp + 0xa0]
call fcn.14002b0e0
mov esi, eax
cmp eax, 1
jne 0x14000fdc0
xor edx, edx
lea r8d, [rax + 0x6b]
lea rcx, [rsp + 0x34]
call fcn.140160160
mov dword [rsp + 0x30], VarBstrFromDisp
mov dword [rsp + 0x34], 0x400
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x60], 0
cmp dword [rbx - 8], esi
jle 0x14000fda5
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0xf0]
call fcn.140014e20
mov rbx, qword [rsp + 0xf0]
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x14000fdc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
lea rcx, [rsp + 0xa0]
call fcn.14002b038
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
dec edi
test edi, edi
jg 0x14000fde6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, esi
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140010250
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x460
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x478], rbx
mov rax, qword [0x140218f40]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
call fcn.14001e6e8
mov rcx, rax
test rax, rax
setne dil
test edi, edi
jne 0x1400102a8
mov ecx, 0x80004005
call fcn.140014f90
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140010349
mov dword [rsp + 0x34], 0x400
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProgramFilesDir
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140014fb0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14015e210
mov rbx, qword [rsp + 0x478]
add rsp, 0x460
pop rdi
ret
Function at 0x140010ba0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x148
mov rax, qword [0x140218f40]
xor rax, rsp
mov qword [rsp + 0x130], rax
cmp dword [0x1402262e0], 1
je 0x140010cf5
xor eax, eax
mov qword [rsp + 0x140], rdi
lea rcx, [rsp + 0x90]
xor edi, edi
xor edx, edx
mov r8d, 0x9c
mov qword [rsp + 0x52], rax
mov qword [rsp + 0x5a], rax
mov qword [rsp + 0x62], rax
mov word [rsp + 0x50], di
mov qword [rsp + 0x6a], rax
mov qword [rsp + 0x72], rax
mov qword [rsp + 0x7a], rax
mov qword [rsp + 0x82], rax
mov dword [rsp + 0x8a], eax
mov word [rsp + 0x8e], ax
call fcn.140160160
lea r8, [rsp + 0x50]
or edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplaySettingsW]
cmp eax, 1
jne 0x140010c48
mov edi, dword [rsp + 0xa4]
lea ecx, [rax + 1]
mov edx, edi
call qword [0x1402260c8]
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareElantechOtherSetting
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140010ced
lea rdx, str.ScreenOrientationValueToKernel
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x150], rbx
call fcn.1400150a0
mov rcx, qword [rsp + 0x38]
mov r9d, 4
mov rbx, rax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rbx]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
mov rbx, qword [rsp + 0x150]
dec eax
test eax, eax
jg 0x140010ce2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14015e210
add rsp, 0x148
ret
Function at 0x140011610
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x140218f40]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x11c
call fcn.140160160
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, 1
jne 0x1400116f0
mov ecx, dword [rsp + 0x24]
cmp ecx, 5
jne 0x140011682
cmp dword [rsp + 0x28], eax
jb 0x1400116f0
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14015e210
add rsp, 0x158
ret
mov eax, dword [rsp + 0x28]
cmp ecx, 6
jne 0x1400116cc
test eax, eax
jne 0x1400116aa
lea eax, [rcx - 4]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14015e210
add rsp, 0x158
ret
cmp eax, 1
jne 0x1400116ce
mov eax, 3
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14015e210
add rsp, 0x158
ret
jb 0x1400116f0
cmp eax, 2
jb 0x1400116f0
mov eax, 4
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14015e210
add rsp, 0x158
ret
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14015e210
add rsp, 0x158
ret
Function at 0x140013520
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xe0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
call fcn.14001e6e8
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14001355b
mov ecx, 0x80004005
call fcn.140014f90
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xf0], rbx
lea rcx, [rsp + 0xf8]
call fcn.140010250
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
or edi, 0xffffffff
cmp rcx, rbx
je 0x1400135e1
cmp dword [rbx + 0x10], 0
jl 0x1400135cf
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400135cf
call fcn.1400149f0
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400135c1
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0xf0], rax
jmp 0x1400135e1
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0xf0]
call fcn.140014fb0
nop
mov rdx, qword [rsp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140013603
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.ElantechETDGesture.exe
lea rcx, [rsp + 0xf0]
call fcn.140013e60
lea rcx, [rsp + 0xa0]
call fcn.14002afd8
nop
xor r8d, r8d
mov rbx, qword [rsp + 0xf0]
mov rdx, rbx
lea rcx, [rsp + 0xa0]
call fcn.14002b0e0
mov esi, eax
cmp eax, 1
jne 0x1400136a6
xor edx, edx
lea r8d, [rax + 0x6b]
lea rcx, [rsp + 0x34]
call fcn.140160160
mov dword [rsp + 0x30], VarBstrFromDisp
mov dword [rsp + 0x34], 0x400
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x60], 0
cmp dword [rbx - 8], esi
jle 0x140013695
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0xf0]
call fcn.140014e20
mov rbx, qword [rsp + 0xf0]
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop
lea rcx, [rsp + 0xa0]
call fcn.14002b038
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
dec edi
test edi, edi
jg 0x1400136cc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, esi
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400136f0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xe0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
call fcn.14001e6e8
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14001372b
mov ecx, 0x80004005
call fcn.140014f90
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xf0], rbx
lea rcx, [rsp + 0xf8]
call fcn.140010250
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
or edi, 0xffffffff
cmp rcx, rbx
je 0x1400137b1
cmp dword [rbx + 0x10], 0
jl 0x14001379f
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14001379f
call fcn.1400149f0
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140013791
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0xf0], rax
jmp 0x1400137b1
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0xf0]
call fcn.140014fb0
nop
mov rdx, qword [rsp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400137d3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.ElantechETDIntelligent.exe
lea rcx, [rsp + 0xf0]
call fcn.140013e60
lea rcx, [rsp + 0xa0]
call fcn.14002afd8
nop
xor r8d, r8d
mov rbx, qword [rsp + 0xf0]
mov rdx, rbx
lea rcx, [rsp + 0xa0]
call fcn.14002b0e0
mov esi, eax
cmp eax, 1
jne 0x140013876
xor edx, edx
lea r8d, [rax + 0x6b]
lea rcx, [rsp + 0x34]
call fcn.140160160
mov dword [rsp + 0x30], VarBstrFromDisp
mov dword [rsp + 0x34], 0x400
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x60], 0
cmp dword [rbx - 8], esi
jle 0x140013865
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0xf0]
call fcn.140014e20
mov rbx, qword [rsp + 0xf0]
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop
lea rcx, [rsp + 0xa0]
call fcn.14002b038
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
dec edi
test edi, edi
jg 0x14001389c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, esi
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140014be0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140014c13
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140014c56
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x140014c51
cmp rbx, r11
jae 0x140014c56
dec edi
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140014c40
cmp rbx, r11
jb 0x140014c5a
xor eax, eax
jmp 0x140014c66
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001a394
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12, r8
mov rbx, rdx
mov r13, rcx
xor edi, edi
call fcn.14001f778
lea r8d, [rdi + 5]
mov rbp, qword [rax + 0x18]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbp
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x14001a3f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r12
mov rdx, rdi
mov rcx, r13
call fcn.140019e24
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret

Function at 0x14001a484
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x14001a4c3
cmp dword [rcx + 0xd8], 0
jne 0x14001a4c3
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.14001f778
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.14001a428
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14001c158
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14001c1d2
xor r8d, r8d
call fcn.14001c08c
mov rsi, rax
test rax, rax
jne 0x14001c18e
mov eax, edi
jmp 0x14001c1e8
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x14001c18a
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14001c934
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14001c997
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001c9ab
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001c9ab
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x14001c9b0
cmp dword [rcx + 8], 0
je 0x14001c9ab
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14001c9b0
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140020390
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.140030d00
mov rsi, rax
test rax, rax
je 0x14002040c
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x140020407
cmp dword [rbx], 0x40
jb 0x140020407
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x140020407
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x140020410
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140027fac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x140028014
call fcn.14001f778
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140028014
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x140028036
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.140027998
mov esi, eax
test rdi, rdi
je 0x140028034
test rbx, rbx
je 0x140028034
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret