joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401ab310
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [0x1403c5cc0]
lea rdx, str.Usage:__s__OPTIONS__FILENAME__SQL__nFILENAME_is_the_name_of_an_SQLite_database._A_new_database_is_created_nif_the_file_does_not_previously_exist._n
mov rcx, rax
call fcn.1401ab380
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
test ebx, ebx
je 0x1401ab360
lea r8, str.____append______________append_the_database_to_the_end_of_the_file_n____ascii_______________set_output_mode_to_ascii_n____bail________________stop_after_hitting_an_error_n____batch_______________force_batch_I_O_n____box_________________set_output_mode_to_box_n____column______________set_output_mode_to_column_n____cmd_COMMAND_________run__COMMAND__before_reading_stdin_n____csv_________________set_output_mode_to_csv_n____echo________________print_commands_before_execution_n____init_FILENAME_______read_process_named_file_n_____no_header__________turn_headers_on_or_off_n____help________________show_this_message_n____html________________set_output_mode_to_HTML_n____interactive_________force_interactive_I_O_n____json________________set_output_mode_to_json_n____line________________set_output_mode_to_line_n____list________________set_output_mode_to_list_n____lookaside_SIZE_N____use_N_entries_of_SZ_bytes_for_lookaside_memory_n____markdown____________set_output_mode_to_markdown_n____memtrace____________trace_all_memory_allocations_and_deallocations_n____mmap_N______________default_mmap_size_set_to_N_n____newline_SEP_________set_output_row_separator._Default:__n_n____nofollow____________refuse_to_open_symbolic_links_to_database_files_n____nullvalue_TEXT______set_text_string_for_NULL_values._Default__n____pagecache_SIZE_N____use_N_slots_of_SZ_bytes_each_for_page_cache_memory_n____quote_______________set_output_mode_to_quote_n____readonly____________open_the_database_read_only_n____separator_SEP_______set_output_column_separator._Default:__n____stats_______________print_memory_stats_before_each_finalize_n____table_______________set_output_mode_to_table_n____version_____________show_SQLite_version_n____vfs_NAME____________use_NAME_as_the_default_VFS_n
lea rdx, str.OPTIONS_include:_n_s
call fcn.1401ab380
jmp 0x1401ab36c
lea rdx, str.Use_the__help_option_for_additional_information_n
call fcn.1401a08b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1401ab570
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rdi, [0x1403c5d00]
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x8000
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, eax
test eax, eax
je 0x1401ab5c3
xor eax, eax
cmp ecx, 0x8000
cmovbe rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1401ac7c0
Capabilities:
Create directory
Timestomp file
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov rax, qword [0x14039e2e8]
xor rax, rsp
mov qword [rsp + 0x90], rax
movzx ebp, r9w
mov ebx, 0xf000
movzx eax, bp
mov esi, 0x4000
and ax, bx
xor r14d, r14d
mov r13, rcx
mov r12, r8
mov rdi, rdx
mov rcx, rdx
cmp ax, si
jne 0x1401ac89e
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
test eax, eax
je 0x1401ac941
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0x11
jne 0x1401ac875
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.1401a0660
test eax, eax
jne 0x1401ac875
movzx ecx, word [rsp + 0x66]
movzx eax, cx
and ax, bx
cmp ax, si
jne 0x1401ac875
movzx eax, bp
xor ax, cx
mov ecx, 0x1ff
test cx, ax
je 0x1401ac941
mov edx, ebp
and edx, ecx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__chmod]
test eax, eax
je 0x1401ac941
mov eax, 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1402654f0
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rdx, [0x1402e9888]
mov r15, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rsi, rax
test rax, rax
je 0x1401ac875
mov rcx, r12
call fcn.1401ada00
mov rbx, rax
test rax, rax
je 0x1401ac908
mov rcx, r12
call fcn.1401adb10
movsxd r8, eax
mov r9, rsi
mov edx, 1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, r12
mov rbx, rax
call fcn.1401adb10
movsxd r15, eax
cmp r15, rbx
je 0x1401ac908
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, 2
jmp 0x1401ac87a
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test bp, bp
je 0x1401ac936
mov edx, ebp
mov ecx, 0x1ff
and edx, ecx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__chmod]
test eax, eax
je 0x1401ac936
mov eax, 2
jmp 0x1401ac87a
mov rdx, r15
mov rcx, r13
call fcn.1401ae7e0
mov rbx, qword [rsp + 0x110]
test rbx, rbx
js 0x1401aca10
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
movabs rcx, 0x2b6109100
movsxd rax, ebx
add rax, rcx
mov rcx, rdi
imul rdx, rax, 0x989680
mov dword [rsp + 0x40], edx
sar rdx, 0x20
mov dword [rsp + 0x44], edx
call fcn.140215da0
mov rbx, rax
test rax, rax
je 0x1401ac875
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0x2000000
xor r8d, r8d
mov edx, CMapStringToOb::HashKey
mov dword [rsp + 0x20], 3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rbx
mov rdi, rax
call fcn.1401ba620
cmp rdi, 0xffffffffffffffff
je 0x1401ac875
lea r9, [rsp + 0x40]
xor edx, edx
lea r8, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
sete r14b
mov eax, r14d
jmp 0x1401ac87a
xor eax, eax
jmp 0x1401ac87a
Function at 0x1401c8570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
sub rsp, 0x28
mov rbp, rcx
mov rsi, rdx
mov rcx, rdx
call fcn.1401ec0c0
movsxd rdx, eax
cmp edx, 1
jne 0x1401c859e
mov rdx, rsi
mov rcx, rbp
add rsp, 0x28
pop rsi
pop rbp
jmp fcn.1401ea510
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov dword [r8], ebx
cmp byte [rsi], 0x88
jne 0x1401c85c3
mov rdx, rsi
mov rcx, rbp
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
pop rsi
pop rbp
jmp fcn.1401e3be0
mov eax, dword [rbp + 0x38]
mov qword [rsp + 0x50], r14
mov r14, rdx
mov qword [rsp + 0x20], r15
lea r15d, [rax + 1]
add eax, edx
mov dword [rbp + 0x38], eax
test edx, edx
jle 0x1401c8615
mov qword [rsp + 0x48], rdi
mov edi, r15d
nop dword [rax + rax]
mov rdx, qword [rsi + 0x20]
mov r8d, edi
mov rcx, rbp
mov rdx, qword [rdx + rbx + 8]
call fcn.1401e8ab0
inc edi
lea rbx, [rbx + 0x20]
sub r14, 1
jne 0x1401c85f0
mov rdi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov eax, r15d
mov r15, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
pop rsi
pop rbp
ret
Function at 0x1401d8bd0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r8d
mov rdi, rdx
mov r8, rdx
mov dword [rsp + 0x20], ebx
mov r9, rdx
mov rsi, rcx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
call fcn.1401f4990
test ebx, ebx
jne 0x1401d8c14
mov r8, rdi
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
mov rcx, rsi
call fcn.1401f4990
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1401de870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push r13
sub rsp, 0x30
xor ebp, ebp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rdi
mov rsi, rcx
movsxd rbx, r8d
mov edi, ebp
mov qword [rsp + 0x20], r15
mov r13d, ebp
lea edx, [rbp + 3]
mov r15d, ebp
mov r11, rbx
cmp r9b, 1
jne 0x1401de8ae
lea r10d, [rbp + 1]
jmp 0x1401de8ef
movzx eax, r9b
mov r8d, edx
sub r8d, eax
sub rdx, rax
mov r10d, 2
cmp rdx, rbx
jge 0x1401de8d7
cmp byte [rdx + rcx], dil
jne 0x1401de8d7
add r8d, r10d
add rdx, r10
cmp rdx, rbx
jl 0x1401de8c6
cmp r8d, ebx
movzx eax, r9b
movsxd r11, r8d
setl r15b
and eax, 1
add rcx, rax
xor r11, 1
lea r9, [rsi + r11]
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x28], r14
lea r8, [0x1402f04e0]
cmp rcx, r9
jae 0x1401de94a
mov eax, r10d
nop dword [rax]
movzx edx, byte [rcx]
test byte [rdx + r8], 1
je 0x1401de935
mov eax, r10d
add rcx, rax
cmp rcx, r9
jb 0x1401de910
mov r12d, ebp
mov esi, r10d
mov r14, rcx
mov ebx, ebp
jmp 0x1401de9ba
cmp dl, 0x2d
jne 0x1401de942
mov r13d, 1
jmp 0x1401de947
cmp dl, 0x2b
jne 0x1401de94a
add rcx, rax
mov r12d, r13d
mov r14, rcx
cmp rcx, r9
jae 0x1401de965
cmp byte [rcx], 0x30
jne 0x1401de965
mov eax, r10d
add rcx, rax
cmp rcx, r9
jb 0x1401de955
mov esi, r10d
mov ebx, ebp
cmp rcx, r9
jae 0x1401de9b2
mov r11, rcx
movsx r8, byte [r11]
lea eax, [r8 - 0x30]
cmp al, 9
ja 0x1401de99b
add ebx, r10d
lea rdi, [rdi + rdi*4]
movsxd rax, ebx
lea rdi, [rdi - 0x18]
add rax, rcx
lea rdi, [r8 + rdi*2]
add r11, rsi
cmp rax, r9
jb 0x1401de972
movabs rdx, 0x7fffffffffffffff
cmp rdi, rdx
jbe 0x1401de9b2
mov edi, r13d
add rdi, rdx
jmp 0x1401de9ba
test r13d, r13d
je 0x1401de9ba
neg rdi
mov rdx, qword [rsp + 0x58]
mov qword [rdx], rdi
mov rdi, qword [rsp + 0x60]
test ebx, ebx
jne 0x1401de9d5
cmp r14, rcx
jne 0x1401de9d5
lea ebp, [rbx - 1]
jmp 0x1401dea28
test r15d, r15d
je 0x1401de9e1
mov ebp, 1
jmp 0x1401dea28
movsxd rdx, ebx
lea rax, [rdx + rcx]
cmp rax, r9
jae 0x1401dea23
mov r8d, ebx
lea r11, [0x1402f04e0]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
test byte [rax + r11], 1
je 0x1401dea1e
add r8d, r10d
add rdx, rsi
movsxd rax, r8d
add rax, rcx
cmp rax, r9
jb 0x1401dea00
jmp 0x1401dea23
mov ebp, 1
mov rdx, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x50]
imul eax, r10d, 0x13
cmp ebx, eax
jl 0x1401deabd
jle 0x1401dea67
mov eax, r12d
movabs r8, 0x7fffffffffffffff
add rax, r8
mov qword [rdx], rax
mov eax, 2
mov r12, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop rbp
pop rbx
ret
mov edx, r10d
call fcn.1401c3f80
mov ecx, eax
test eax, eax
js 0x1401deabd
mov rdx, qword [rsp + 0x58]
movabs r8, 0x7fffffffffffffff
mov eax, r13d
add rax, r8
mov qword [rdx], rax
test ecx, ecx
jle 0x1401deaa4
mov eax, 2
mov r12, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop rbp
pop rbx
ret
test r13d, r13d
mov eax, 3
cmovne eax, ebp
mov r12, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop rbp
pop rbx
ret
mov r12, qword [rsp + 0x68]
mov eax, ebp
add rsp, 0x30
pop r13
pop rbp
pop rbx
ret
Function at 0x14021a620
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x30
mov r14, rcx
mov qword [rcx], 0
mov ecx, 0x28
mov rbp, r8
mov r15, rdx
call fcn.1401f4250
mov rbx, rax
test rax, rax
jne 0x1402003a2
lea eax, [rbx + 7]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
cmp byte [reloc.WS2_32.dll_accept], 0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
je 0x1402003fa
mov ecx, reloc.OLEAUT32.dll_SetErrorInfo
call fcn.1401ec100
test eax, eax
jne 0x1402003fa
lea rsi, [rbx + 8]
mov qword [rbx + 0x10], r15
lea rdi, [rbx + 0x10]
mov qword [rsp + 0x28], rsi
mov r9, rbx
mov dword [rsp + 0x20], eax
lea r8, [0x1402004d0]
mov qword [rbx + 0x18], rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
jne 0x140200412
jmp 0x140200402
lea rdi, [rbx + 0x10]
lea rsi, [rbx + 8]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
cmp qword [rdi], 0
mov rdi, qword [rsp + 0x58]
jne 0x14020042f
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rbp
mov dword [rsi], eax
call r15
mov qword [rbx + 0x20], rax
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov qword [r14], rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
jmp 0x140200360
Function at 0x1402259e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd rax, dword [rcx + 0xc]
mov rsi, rdx
movsxd rdi, r8d
mov r9, rcx
test r8d, r8d
jle 0x140225a41
mov r10, rax
xor r11d, r11d
nop word [rax + rax]
movzx ecx, byte [r11 + rsi]
lea r8d, [rax + 1]
mov rdx, qword [r9]
xor eax, eax
xor byte [rdx + r10], cl
lea rcx, [r10 + 1]
cmp r8d, dword [r9 + 8]
cmovl eax, r8d
xor r10d, r10d
inc r11
ret
cmp r8d, dword [r9 + 8]
cmovl r10, rcx
cmp r11, rdi
jl 0x140225a10
add dword [r9 + 0x10], edi
mov rdi, qword [rsp + 0x18]
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov dword [r9 + 0xc], eax
ret
Function at 0x14022bac0
Capabilities:
Find taskbar

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14039e2e8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
test rax, rax
je 0x14022bb17
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r8, rbx
lea rdx, [0x14022b840]
mov rcx, rdi
call qword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x14022bbad
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], gethostbyname
mov ecx, 5
call qword [sym.imp.SHELL32.dll_SHAppBarMessage]
test rax, rax
je 0x14022bb89
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x14022bb6a
sub eax, 1
je 0x14022bb4b
sub eax, 1
je 0x14022bb6a
cmp eax, 1
jne 0x14022bbad
mov ecx, dword [rsp + 0x40]
mov eax, dword [rsp + 0x3c]
mov dword [rbx + 4], eax
mov eax, dword [rsp + 0x44]
mov dword [rbx + 0xc], eax
lea eax, [rcx - 0x64]
mov dword [rbx], eax
lea eax, [rcx - 0x10]
mov dword [rbx + 8], eax
jmp 0x14022bbad
mov ecx, dword [rsp + 0x44]
lea eax, [rcx - 0x64]
mov dword [rbx + 4], eax
lea eax, [rcx - 0x10]
mov dword [rbx + 0xc], eax
mov eax, dword [rsp + 0x38]
mov dword [rbx], eax
mov eax, dword [rsp + 0x40]
mov dword [rbx + 8], eax
jmp 0x14022bbad
xor edx, edx
xor r9d, r9d
mov r8, rbx
lea ecx, [rdx + 0x30]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [rbx + 8]
sub eax, 0x96
mov dword [rbx], eax
mov eax, dword [rbx + 0xc]
sub eax, 0x1e
mov dword [rbx + 4], eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402654f0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x14022e810
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rdx + 8], 0x100
mov rbx, rdx
mov rdi, rcx
jne 0x14022e8cd
mov ecx, select
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x14022e8cd
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14022e863
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14022e8cd
mov rdx, qword [rbx + 0x10]
cmp rdx, 0xc0
jne 0x14022e89d
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov rcx, rdi
not al
and al, 1
movzx edx, al
call fcn.14022f500
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rdi + 0x100]
lea rax, [rdx - 0x31]
cmp rax, rcx
jae 0x14022e8cd
add edx, 0xffffffcf
xor r9d, r9d
mov r8b, 1
mov rcx, rdi
call fcn.14022d1c0
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140231f70
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x14039e2e8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, r8
lea rax, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x140231feb
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x30], SerializeElements<ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1402654f0
mov rbx, qword [rsp + 0x288]
add rsp, 0x260
pop rdi
ret
Function at 0x140232080
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x500
mov rax, qword [0x14039e2e8]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov edi, edx
mov rsi, rcx
xor ebp, ebp
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov r8, rcx
lea rdx, [0x1402c19f0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, rax
cmp eax, 0x20
ja 0x140232235
lea r8, [rsp + 0xe0]
lea rdx, str..htm
mov rcx, 0xffffffff80000000
call fcn.140231f70
test eax, eax
jne 0x140232232
lea rdx, str._shellopencommand
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0xe0]
mov rcx, 0xffffffff80000000
call fcn.140231f70
test eax, eax
jne 0x140232232
lea rdx, str.__1_
lea rcx, [rsp + 0xe0]
call sub.VCRUNTIME140.dll_wcsstr
mov rbx, rax
test rax, rax
jne 0x140232181
lea rdx, [0x1402fd194]
lea rcx, [rsp + 0xe0]
call sub.VCRUNTIME140.dll_wcsstr
mov rbx, rax
test rax, rax
jne 0x140232181
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rbx, [rsp + rcx*2 + 0xde]
jmp 0x140232184
mov word [rax], bp
lea rdx, [0x1402c8fe0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__15]
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x50], rcx
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400f8f90
nop
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_char_StrTraitMFC_DLL_char_ATL::ChTraitsCRT_char__1]
nop
lea rax, [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
cmp rcx, rax
je 0x140232206
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___2]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_WinExec]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XImage::XImage]
mov rax, rbx
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.1402654f0
mov rbx, qword [rsp + 0x530]
add rsp, 0x500
pop rdi
pop rsi
pop rbp
ret
Function at 0x140232b10
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
cmp qword [rcx + 0x120], 0
jne 0x140232bcb
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov edx, SerializeElements<ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_4946]
mov rcx, rax
mov edx, SerializeElements<ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edx, 0xffffffff
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDialogImpl::ProcessMouseClick]
lea rdx, str.winhlp32.exe
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_COleCurrency::operator_]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x140232bb6
mov edx, 0x6a
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadCursorW]
test rax, rax
je 0x140232bb6
mov rcx, rax
call qword [sym.imp.USER32.dll_CopyIcon]
mov qword [rbx + 0x120], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140233710
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x160]
test rcx, rcx
je 0x140233744
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140233744
mov rcx, qword [rbx + 0x160]
add rsp, 0x20
pop rbx
jmp 0x14023ec80
add rsp, 0x20
pop rbx
ret
push rbx
push rdi
sub rsp, 0x48
mov rdi, rcx
add rcx, 0x670
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
test eax, eax
jle 0x14023edc3
mov qword [rsp + 0x70], rbp
lea rcx, [rdi + 0x670]
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x40], r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x68]
lea rcx, [rdi + 0x130]
call sub.mfc140u.dll_Ordinal_6648
mov eax, dword [rsp + 0x60]
mov ecx, reloc.WS2_32.dll_recv
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], 0xffffffff
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
movzx esi, ax
mov edx, 0x44f
mov eax, 0x8000
and si, ax
cmovne ecx, dword [rsp + 0x68]
xor ebx, ebx
mov r14d, ebx
mov dword [rsp + 0x20], ecx
mov rcx, qword [rdi + 0x170]
test si, si
sete r14b
mov r8, r14
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x14023ed80
test si, si
je 0x14023ed55
mov rcx, qword [rdi + 0x170]
lea edx, [rbx + 0xe]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x20], eax
jmp 0x14023ed59
mov dword [rsp + 0x20], ebx
mov rcx, qword [rdi + 0x170]
lea r9, [rsp + 0x20]
mov r8, r14
mov dword [rsp + 0x24], 0xffffffff
mov edx, 0x44f
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x14023edb4
mov eax, dword [rsp + 0x30]
lea rcx, [rdi + 0x130]
test eax, eax
cmovns ebx, eax
mov r8d, ebx
mov edx, ebx
call sub.mfc140u.dll_CFrameWnd::SetHelpCapture
mov rcx, qword [rdi + 0x170]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x437
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x140233bc0
Capabilities:
Reference sql statements

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
call fcn.140233c50
mov edx, eax
lea rcx, [0x1403c4350]
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.14010a870