joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140022418
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x30
mov rcx, qword [rcx]
lea rax, [r11 + 0x18]
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x20]
lea rax, [r11 + 8]
mov dword [rsp + 0x50], 4
mov rdi, rdx
mov qword [r11 - 0x18], rax
xor ebx, ebx
lea rdx, str.ClearAfterInsert
xor r8d, r8d
mov dword [rsp + 0x40], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140022476
cmp dword [rsp + 0x58], 4
jne 0x140022476
mov eax, ebx
test eax, eax
jne 0x140022476
cmp dword [rsp + 0x40], ebx
setne bl
jmp 0x14002247b
mov ebx, 1
mov dword [rdi], ebx
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14002248c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x30
mov rcx, qword [rcx]
lea rax, [r11 + 0x18]
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x20]
lea rax, [r11 + 8]
mov dword [rsp + 0x50], 4
mov rdi, rdx
mov qword [r11 - 0x18], rax
xor ebx, ebx
lea rdx, str.EnableGrid
xor r8d, r8d
mov dword [rsp + 0x40], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400224ea
cmp dword [rsp + 0x58], 4
jne 0x1400224ea
mov eax, ebx
test eax, eax
jne 0x1400224ea
cmp dword [rsp + 0x40], ebx
setne bl
jmp 0x1400224ef
mov ebx, 1
mov dword [rdi], ebx
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140022500
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x30
mov rcx, qword [rcx]
lea rax, [r11 + 0x18]
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x20]
lea rax, [r11 + 8]
mov dword [rsp + 0x50], 4
mov rdi, rdx
mov qword [r11 - 0x18], rax
xor ebx, ebx
lea rdx, str.ShowSoftKeys
xor r8d, r8d
mov dword [rsp + 0x40], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002255c
cmp dword [rsp + 0x58], 4
jne 0x14002255c
mov eax, ebx
test eax, eax
jne 0x14002255c
cmp dword [rsp + 0x40], ebx
setne bl
mov dword [rdi], ebx
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140026418
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov word [rsp + 0x10], dx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rdi, rcx
mov r9d, 1
mov rax, qword [rbp + 0x40]
mov dword [rax], r9d
xor ebx, ebx
mov qword [rbp + 0x38], rbx
movzx edx, r8w
sub edx, 0x91
je 0x1400264d5
sub edx, r9d
je 0x1400264c4
sub edx, r9d
je 0x1400264bd
sub edx, r9d
je 0x14002649a
cmp edx, r9d
jne 0x14002651f
mov dword [rbp + 0x28], ebx
lea rsi, [rcx + 0x13b8]
lea rdx, [rbp + 0x28]
mov rcx, rsi
call fcn.140022500
test al, al
je 0x14002651f
lea rdx, str.ShowSoftKeys
jmp 0x1400264f6
mov dword [rbp + 0x28], ebx
lea rsi, [rcx + 0x13b8]
lea rdx, [rbp + 0x28]
mov rcx, rsi
call fcn.14002248c
test al, al
je 0x14002651f
lea rdx, str.EnableGrid
jmp 0x1400264f6
mov edx, 2
jmp 0x1400264c7
mov edx, r9d
add rcx, 0x13b8
call fcn.1400223d0
jmp 0x14002651f
mov dword [rbp + 0x28], ebx
lea rsi, [rcx + 0x13b8]
lea rdx, [rbp + 0x28]
mov rcx, rsi
call fcn.140022418
test al, al
je 0x14002651f
lea rdx, str.ClearAfterInsert
mov r9d, 4
cmp dword [rbp + 0x28], ebx
mov dword [rsp + 0x28], r9d
lea rax, [rbp + 0x28]
sete bl
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x28], ebx
xor r8d, r8d
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14001b468
nop
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x14002684c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x1401114f8]
test rcx, rcx
jne 0x140026872
call fcn.14002690c
test eax, eax
je 0x1400268ab
mov rcx, qword [0x1401114f8]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
xor ecx, ecx
test rax, rax
je 0x14002688f
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rax + 0x10], ecx
mov word [rax + 0x14], cx
jmp 0x1400268ff
mov edx, 0x1000
mov r9d, 0x40
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1400268af
xor eax, eax
jmp 0x1400268ff
mov eax, dword [rax]
mov rcx, qword [0x1401114f8]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x1400268dc
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x1400268ff
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x1401114f8]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x1400268e3
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140027150
Capabilities:
Hide graphical window

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
cmp dword [rcx + 0x88], 0
mov rbx, rcx
jne 0x14002724e
xor edi, edi
mov dword [rcx + 0x88], 1
cmp dword [rcx + 0x58], edi
jle 0x1400271e7
xor esi, esi
test rsi, rsi
js 0x14002726b
cmp edi, dword [rbx + 0x58]
jge 0x14002726b
mov rax, qword [rbx + 0x50]
mov r14, qword [rsi + rax]
test r14, r14
je 0x1400271dc
mov rcx, qword [rbx + 0x118]
xor ebp, ebp
test rcx, rcx
je 0x1400271ca
mov edx, dword [r14 + 0x74]
call fcn.14003240c
test rax, rax
je 0x1400271ca
mov ebp, dword [rax + 0x70]
mov rax, qword [r14]
mov edx, ebp
mov rcx, r14
mov rax, qword [rax + 0x68]
call qword [case.0x1400739fa.0]
inc edi
add rsi, 8
cmp edi, dword [rbx + 0x58]
jl 0x14002718c
mov rcx, qword [rbx + 8]
mov edx, 8
call qword [sym.imp.USER32.dll_ShowWindow]
cmp qword [rbx + 0x70], 0
jne 0x140027205
mov rcx, rbx
call fcn.14002a388
lea rdi, [rbx + 0x68]
cmp qword [rdi], 0
jne 0x140027232
mov rcx, rdi
call fcn.140012dc0
test eax, eax
js 0x140027232
mov rcx, qword [rdi]
lea rax, [rbx + 0x60]
cmp qword [rcx + 0x10], 0
je 0x14002722e
test rax, rax
jne 0x140027232
mov qword [rcx + 0x10], rax
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x14002724e
mov rdx, qword [rdi]
test rdx, rdx
je 0x14002724e
mov r8d, 0x800a
call fcn.14002c43c
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov ecx, 0xc000008c
call fcn.14001575c
int3
Function at 0x140038ab4
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov rax, qword [0x14010a078]
xor rax, rsp
mov qword [rsp + 0x40], rax
call qword [sym.imp.UxTheme.dll_IsThemeActive]
xor ebp, ebp
lea r8, [rsp + 0x20]
test eax, eax
setne sil
xor eax, eax
mov qword [rsp + 0x20], rax
lea edx, [rbp + 0x10]
xor r9d, r9d
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayGetDim
lea ecx, [rbp + 0x42]
mov qword [rsp + 0x28], rax
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
lea r14d, [rbp + 1]
test eax, eax
je 0x140038b21
test byte [rsp + 0x24], r14b
jne 0x140038b44
mov ecx, 5
call qword [sym.imp.USER32.dll_GetSysColor]
mov ecx, 2
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSysColor]
test ebx, ebx
je 0x140038b44
mov dil, bpl
test eax, eax
jne 0x140038b47
mov dil, r14b
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov edx, 0x58
mov rbx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, 0x5a
mov rcx, rbx
mov dword [0x14010a4b0], eax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rdx, rbx
xor ecx, ecx
mov dword [0x14010a4ac], eax
call qword [sym.imp.USER32.dll_ReleaseDC]
mov byte [0x140111f19], sil
mov bl, bpl
mov byte [0x140111f1a], dil
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
test ax, ax
je 0x140038bce
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
movzx ecx, ax
lea r8, [rsp + 0x20]
lea edx, [r9 + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140038bce
mov eax, 0x800
movzx ebx, bl
test word [rsp + 0x2e], ax
cmovne ebx, r14d
mov byte [0x140111f10], bl
mov esi, 0x88
lea rbx, [0x14010d200]
mov edi, 6
cmp byte [0x140111f19], bpl
jne 0x140038bf3
test byte [rbx], r14b
jmp 0x140038bf6
test byte [rbx], dil
je 0x140038c32
cmp byte [0x140111f18], bpl
jne 0x140038c06
test byte [rbx], 3
jmp 0x140038c09
test byte [rbx], 4
je 0x140038c32
cmp byte [0x140111f19], bpl
jne 0x140038c7d
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140038c7d
mov rax, qword [rcx]
mov edx, r14d
mov rax, qword [rax]
call qword [case.0x1400739fa.0]
mov qword [rbx + 0x20], rbp
jmp 0x140038c7d
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140038c4e
mov rax, qword [rcx]
mov edx, r14d
mov rax, qword [rax]
call qword [case.0x1400739fa.0]
mov qword [rbx + 0x18], rbp
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140038c6a
mov rax, qword [rcx]
mov edx, r14d
mov rax, qword [rax]
call qword [case.0x1400739fa.0]
mov qword [rbx + 0x20], rbp
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x140038c7d
call qword [sym.imp.GDI32.dll_DeleteObject]
mov qword [rbx + 0x48], rbp
add rbx, 0x70
sub rsi, r14
jne 0x140038be5
lea rbx, [0x14010a4d0]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140038ca2
call qword [sym.imp.GDI32.dll_DeleteObject]
mov qword [rbx], rbp
add rbx, 0x18
sub rdi, r14
jne 0x140038c91
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400e27e0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x140047d38
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebp, 0x80004005
mov qword [rsi + 0x90], rbx
mov dword [rsi + 0x98], eax
mov rax, rbx
neg rax
sbb edi, edi
not edi
and edi, ebp
test rbx, rbx
je 0x140047d95
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rsi + 0x20], rax
cmove edi, ebp
test edi, edi
js 0x140047ec6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rsi + 0x28], rax
cmove edi, ebp
test edi, edi
js 0x140047ec6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rsi + 0x30], rax
cmove edi, ebp
test edi, edi
js 0x140047ec6
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea ebx, [r9 + 1]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rsi + 0x48], rax
cmove edi, ebp
test edi, edi
js 0x140047ec6
lea rax, [rsi + 0x18]
mov r9, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x140049060]
xor edx, edx
mov dword [rsp + 0x20], 4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0x10], rax
test rax, rax
je 0x140047e4c
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140047e4e
mov edi, ebp
test edi, edi
js 0x140047ec6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rsi + 0x58], rax
cmove edi, ebp
test edi, edi
js 0x140047ec6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rsi + 0x50], rax
cmove edi, ebp
test edi, edi
js 0x140047ec6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rsi + 0x38], rax
cmove edi, ebp
test edi, edi
js 0x140047ec6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rsi + 0x40], rax
cmove edi, ebp
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14004bbc4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb8
mov r14, rcx
xor r12d, r12d
xor ecx, ecx
mov ebx, r12d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdi, str.MICROSOFTMATHRESULTPANELMSGWNDCLASS
mov rcx, rax
mov rdx, rdi
lea r8, [rbp - 0x39]
call qword [sym.imp.USER32.dll_GetClassInfoW]
test eax, eax
jne 0x14004bc62
lea rax, [0x14004b9c0]
mov dword [rbp - 0x39], r12d
xor ecx, ecx
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x29], r12
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, 0x7f00
mov qword [rbp - 0x19], r12
xor ecx, ecx
mov qword [rbp - 0x21], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
lea ecx, [r12 + 5]
mov qword [rbp - 0x11], rax
call qword [sym.imp.GDI32.dll_GetStockObject]
lea rcx, [rbp - 0x39]
mov qword [rbp - 1], r12
mov qword [rbp - 9], rax
mov qword [rbp + 7], rdi
call qword [sym.imp.USER32.dll_RegisterClassW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x58], r12
xor r9d, r9d
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov qword [rsp + 0x48], r12
mov rdx, rdi
mov qword [rsp + 0x40], 0xfffffffffffffffd
xor ecx, ecx
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [r14 + 0x180], rax
test rax, rax
je 0x14004bdd2
mov r8, r14
lea rdx, str.MICROSOFTMATHRESULTPANELOBJECT
mov rcx, rax
call qword [sym.imp.USER32.dll_SetPropW]
lea rax, [r14 + 0x1c8]
mov esi, 0x64
mov rcx, rax
mov qword [rbp + 0x6f], rax
mov r8b, 1
mov edx, esi
call fcn.14001ffb8
mov rcx, qword [0x140111af0]
lea r8d, [rsi - 0x5a]
mov edx, 0x5209
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
mov edi, 0x80004005
test rax, rax
jne 0x14004bd11
mov ebx, edi
jmp 0x14004bdb1
mov rcx, qword [0x140111af0]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [0x140111af0]
mov rdx, r15
shr eax, 2
cmp eax, esi
cmovb esi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r13, rax
test rax, rax
je 0x14004bdb1
test esi, esi
je 0x14004bdb1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
test rax, rax
je 0x14004bda8
mov r12d, esi
test esi, esi
je 0x14004bda5
mov r14, qword [rbp + 0x6f]
xor esi, esi
movzx edx, word [r15 + rsi*4]
lea rax, [rbp + 0x7f]
lea r9, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x77]
mov rcx, r14
call fcn.14004dca4
test rax, rax
jne 0x14004bd99
movzx r8d, word [r15 + rsi*4 + 2]
mov rcx, r14
movzx edx, word [r15 + rsi*4]
call fcn.14004dc0c
inc rsi
cmp rsi, r12
jl 0x14004bd63
mov r14, qword [rbp + 0x67]
xor r12d, r12d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeResource]
cmp qword [r14 + 0x1d0], r12
cmove ebx, edi
test ebx, ebx
js 0x14004bdd7
lea rcx, [r14 + 0x140]
mov edx, 0x4e22
call fcn.140021a70
jmp 0x14004bdd7
mov ebx, 0x80004005
mov eax, ebx
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400509cc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
test byte [0x140111380], 1
mov rbx, rcx
je 0x140050a01
lea rdx, [0x1400ee110]
call fcn.140014ac0
xor r12d, r12d
cmp dword [rbx + 0x18], r12d
jne 0x140050b49
mov rcx, qword [0x140111ae8]
lea r8d, [r12 + 0xa]
mov edx, 0x7724
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x140050b28
mov rcx, qword [0x140111af0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [0x140111af0]
mov edi, 0xc8
shr eax, 2
mov rdx, rsi
cmp eax, edi
cmovb edi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x140050b28
test edi, edi
je 0x140050b28
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x140050b1f
mov ebp, edi
test edi, edi
je 0x140050b1f
mov edi, r12d
cmp word [rsi + rdi*4], r12w
je 0x140050b1f
mov eax, dword [rbx + 0x18]
mov r8d, 2
mov rcx, qword [rbx + 8]
inc eax
movzx r15d, word [rsi + rdi*4 + 2]
movsxd rdx, eax
call qword [0x1400e6018]
test rax, rax
je 0x140050b13
mov rcx, qword [rbx + 0x10]
mov r8d, 4
mov qword [rbx + 8], rax
mov eax, dword [rbx + 0x18]
inc eax
movsxd rdx, eax
call qword [0x1400e6018]
test rax, rax
je 0x140050b13
movsxd rdx, dword [rbx + 0x18]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x10], rax
lea r8, [rcx + rdx*2]
test r8, r8
je 0x140050b04
movzx eax, word [rsi + rdi*4]
mov word [r8], ax
mov rax, qword [rbx + 0x10]
lea rax, [rax + rdx*4]
test rax, rax
je 0x140050b10
mov dword [rax], r15d
inc dword [rbx + 0x18]
inc rdi
cmp rdi, rbp
jl 0x140050a94
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [rbx + 0x18], r12d
jle 0x140050b34
mov dword [rbx], 1
test byte [0x140111380], 1
je 0x140050b49
lea rdx, [0x1400ee048]
call fcn.140014ac0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400654dc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
sub rsp, 0x38
xor ebx, ebx
lea esi, [rbx + 2]
cmp dword [0x140111784], esi
jne 0x1400654f9
cmp dword [0x14011177c], 5
jae 0x140065576
mov ecx, dword [0x140111780]
and ecx, 0x3ff
cmp ecx, 4
je 0x140065609
lea eax, [rcx - 0x11]
cmp eax, 1
jbe 0x140065609
cmp ecx, 0x78
je 0x140065609
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov ecx, eax
mov edx, eax
call fcn.140066acc
test eax, eax
jne 0x140065576
mov eax, 0x459
cmp dx, ax
je 0x140065576
mov eax, 0x860
cmp dx, ax
je 0x140065576
and edx, 0x3ff
lea eax, [rdx - 0x39]
cmp eax, 0x3a
ja 0x140065568
movabs rcx, 0x6000124ddfff001
bt rcx, rax
jb 0x140065576
cmp edx, 0x1e
je 0x140065576
cmp edx, 0x2a
jne 0x140065609
lea rax, [rsp + 0x68]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Control_PanelInternational
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140065609
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x58], esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.NumShape
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400655ea
movzx eax, word [rsp + 0x50]
cmp al, 0x2f
jbe 0x1400655ea
sub al, 0x2f
cmp al, 3
movzx ebx, al
cmova ebx, esi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, 0xfd
je 0x140065609
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov ecx, eax
call fcn.14006715c
jmp 0x140065614
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
and eax, 0x3ff
mov dword [0x140111988], eax
mov al, bl
add rsp, 0x38
pop rsi
pop rbx
ret
Function at 0x140065624
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14010a078]
xor rax, rsp
mov qword [rbp - 8], rax
lea rax, [rbp - 0x18]
mov ebx, 1
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.Control_PanelDesktop
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14006572b
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x1c]
lea rax, [rbp - 0x10]
mov dword [rbp - 0x20], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.CaretWidth
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400656ac
cmp dword [rbp - 0x20], 4
cmovbe ebx, dword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x1c]
lea rax, [rbp - 0x10]
mov dword [rbp - 0x20], 8
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.CursorBlinkRate
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140065721
mov ecx, dword [rbp - 0x20]
cmp ecx, 8
ja 0x140065721
xor edx, edx
xor r8d, r8d
test ecx, ecx
je 0x140065713
movzx r9d, byte [rbp + r8 - 0x10]
lea eax, [r9 - 0x30]
cmp eax, 9
ja 0x140065713
lea edx, [rdx + rdx*4]
inc r8d
lea edx, [rdx - 0x18]
lea edx, [r9 + rdx*2]
cmp r8d, ecx
jb 0x1400656f2
or ecx, 0xffffffff
test edx, edx
cmovne ecx, edx
call qword [sym.imp.USER32.dll_SetCaretBlinkTime]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xff
movzx ecx, bl
cmp ebx, eax
cmovl eax, ecx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400e27e0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x140067124
Capabilities:
Get keyboard layout

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, ax
mov qword [0x140111980], rax
mov r9, rax
call fcn.140066a1c
cmp eax, 0x2e
ja 0x140067155
movsxd rcx, eax
lea rax, [0x140111600]
mov qword [rax + rcx*8], r9
add rsp, 0x28
ret

Function at 0x14006715c
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14010a078]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebx, ecx
and ebx, 0x3ff
cmp dword [0x140111784], 2
jne 0x1400672ac
cmp dword [0x14011177c], 5
jb 0x1400672ac
mov r9d, SafeArrayUnaccessData
lea r8, [rsp + 0x20]
lea edx, [r9 - 1]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400672ac
movzx ecx, word [rsp + 0x22]
mov eax, 0xbe7
cmp ecx, eax
ja 0x140067251
je 0x14006724a
cmp ecx, 0x31
je 0x140067243
cmp ecx, 0x661
je 0x14006723c
cmp ecx, 0x6f1
je 0x140067235
cmp ecx, 0x967
je 0x14006722e
cmp ecx, 0x9e7
je 0x140067227
cmp ecx, 0xa67
je 0x14006721d
cmp ecx, 0xae7
je 0x140067213
cmp ecx, 0xb67
jne 0x1400672ac
mov ebx, 0x48
jmp 0x1400672ac
mov ebx, 0x47
jmp 0x1400672ac
mov ebx, 0x46
jmp 0x1400672ac
mov ebx, 0x45
jmp 0x1400672ac
mov ebx, 0x39
jmp 0x1400672ac
mov ebx, 0x29
jmp 0x1400672ac
mov ebx, 1
jmp 0x1400672ac
mov ebx, 9
jmp 0x1400672ac
mov ebx, 0x49
jmp 0x1400672ac
sub ecx, 0xc67
je 0x1400672a7
mov eax, 0x80
sub ecx, eax
je 0x1400672a0
sub ecx, eax
je 0x140067299
sub ecx, 0xea
je 0x140067292
sub ecx, eax
je 0x14006728b
sub ecx, 0x50
je 0x140067284
cmp ecx, 0x8c0
jne 0x1400672ac
lea ebx, [rax - 0x2d]
jmp 0x1400672ac
mov ebx, 0x51
jmp 0x1400672ac
mov ebx, 0x54
jmp 0x1400672ac
mov ebx, 0x1e
jmp 0x1400672ac
mov ebx, 0x4c
jmp 0x1400672ac
mov ebx, 0x4b
jmp 0x1400672ac
mov ebx, 0x4a
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400e27e0
add rsp, 0x50
pop rbx
ret
Function at 0x14007bf84
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x420
mov rax, qword [0x14010a078]
xor rax, rsp
mov qword [rsp + 0x410], rax
movzx ebx, byte [rcx + 0x11]
mov rsi, rcx
mov rcx, rdx
mov r11, r8
mov rdi, rdx
call fcn.14007bd9c
mov rcx, rsi
mov r10, rax
call fcn.14007bd9c
and dword [r11], 0
xor r8d, r8d
test ebx, ebx
je 0x14007c08d
lea rdx, [r10 + 8]
sub r10, rax
lea rcx, [rax + 8]
mov eax, dword [r10 + rcx - 8]
xor eax, dword [rcx - 8]
test eax, 0xff000000
jne 0x14007c015
mov eax, dword [rdx - 4]
cmp dword [rcx - 4], eax
jne 0x14007c015
mov eax, dword [rdx]
cmp dword [rcx], eax
jne 0x14007c015
mov al, byte [rdx + 4]
cmp byte [rcx + 4], al
jne 0x14007c015
inc r8d
add rdx, 0x10
add rcx, 0x10
cmp r8d, ebx
jl 0x14007bfdb
mov eax, dword [r11]
jmp 0x14007c021
mov dword [r11], 1
mov eax, 1
test eax, eax
je 0x14007c08d
mov r10d, ebx
mov rcx, rsi
shl r10d, 4
call fcn.14007bd9c
mov rdx, rax
lea rcx, [rsp + 0x20]
mov r8d, r10d
call qword [sym.imp.msvcrt.dll_memmove]
mov rcx, rdi
call fcn.14007bd9c
mov r8, rbx
test ebx, ebx
je 0x14007c073
lea rdx, [rsp + 0x20]
mov ecx, dword [rax]
lea rax, [rax + 0x10]
xor ecx, dword [rdx]
and ecx, 0xffffff
xor dword [rdx], ecx
lea rdx, [rdx + 0x10]
sub r8, 1
jne 0x14007c059
mov rcx, qword [0x140111fd8]
lea rdx, [rsp + 0x20]
mov r8d, ebx
shl r8d, 2
call fcn.1400703a0
jmp 0x14007c091
movzx eax, word [rdi + 0x12]
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.1400e27e0
add rsp, 0x420
pop rdi
pop rsi
pop rbx
ret