joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140048e01
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x3825375a
xor al, 0x37
jl 0x140048e4e
jns 0x140048e81
jb 0x140048e34
sub byte [rbp + 0x6d], ah
invalid
test al, 0x61
scasb al, byte [rdi]
pop rbp
cmpsb byte [rsi], byte [rdi]
xor eax, 0x6574767c
and r8d, dword [rdx + 0x73]
xor dword [rcx], esi
invalid
fcmovu st(0), st(3)
invalid
push rsp
jne 0x140048eff
push rax
sub al, 0x2e
and esp, dword [rbx + rdx*2 + 0x5e]
push rsi
push rdi
push rsi
pop rcx
invalid
mov dh, 0x3b
mov cl, 0x45
cmpsd dword [rsi], dword [rdi]
mov r9b, 0x3e
lodsb al, byte [rsi]
cmp al, 0xab
mov bl, 0x41
test eax, 0xab45a73a
stosb byte [rdi], al
cmp eax, 0x3ea73ab1
stosb byte [rdi], al
cmp byte [rbp + 0x66], dl
xor ebp, dword [rsi + 0x66]
insb byte [rdi], dx
insb byte [rdi], dx
imul esi, dword [rdx], 0x77
jae 0x140048f55
ja 0x140048f95
xor byte [eax + 0x41], cl
push 0x4a68474e
invalid
mov esi, 0xbf64bf5e
push 0xffffffffffffffb1
imul esi, dword [rdx - 0x44964d96], 0x463b6e5f
invalid
push rcx
lea eax, [rdi - 0x72]
xchg r11d, eax
push rcx
invalid

Function at 0x140049b44
Capabilities:
Authenticate hmac

Disassembly:
mov ah, 0x36
stosb byte [rdi], al
xor esi, dword [rdx - 0x4bc348cb]
xor dword [rdi + 0x6c2e6039], esi
insb byte [rdi], dx

Function at 0x140049b50
Capabilities:
Authenticate hmac

Disassembly:
mov ah, 0x36
stosb byte [rdi], al
xor esi, dword [rdx - 0x4bc348cb]
xor dword [rdi + 0x6c2e6039], esi
insb byte [rdi], dx

Function at 0x14005876c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x1400587d4
call fcn.14004eb08
mov r8d, 0xf0
mov rdx, rsi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x1400587d4
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x1400587f6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, r14
call fcn.140069e9c
mov esi, eax
test rdi, rdi
je 0x1400587f4
test rbx, rbx
je 0x1400587f4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14005a4f8
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.14006863c
mov rdi, rax
test rax, rax
je 0x14005a574
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x14005a56f
cmp dword [rbx], 0x40
jb 0x14005a56f
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageA]
bt rax, 0xd
jb 0x14005a56f
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x14005a578
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14005e3b8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x70
mov edi, r9d
mov rsi, r8
mov r14, rdx
mov r15d, ecx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x1402eb534]
test eax, eax
je 0x14005e40a
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1402eb534]
test eax, eax
jne 0x14005e413
call fcn.140055a2c
test eax, eax
je 0x14005e42f
lea rdx, [rsp + 0x60]
mov rcx, qword [0x1402ae228]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14005e43a
xor eax, eax
jmp 0x14005e4e8
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, rsi
mov rdx, r14
mov ecx, r15d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rsi, rax
mov qword [rsp + 0x68], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je 0x14005e4ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14005e4cc
xor edi, edi
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14005e4e5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x14005e504
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov r14, rcx
and dword [rax - 0x18], 0
and qword [rax + 0x20], 0
xor ebx, ebx
mov eax, dword [0x1402eb534]
test eax, eax
je 0x14005e54e
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1402eb534]
test eax, eax
jne 0x14005e557
call fcn.140055a2c
test eax, eax
je 0x14005e573
lea rdx, [rsp + 0x58]
mov rcx, qword [0x1402ae228]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14005e57b
xor eax, eax
jmp 0x14005e5c2
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.USER32.dll_GetClassInfoExA]
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test eax, eax
sete bl
test ebx, ebx
je 0x14005e5a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14005e5a7
xor esi, esi
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14005e5c0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x14005e5d8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1402ee918]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1402eb534]
test eax, eax
je 0x14005e623
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1402eb534]
test eax, eax
jne 0x14005e62c
call fcn.140055a2c
test eax, eax
je 0x14005e648
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1402ae228]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14005e650
xor eax, eax
jmp 0x14005e6ad
test rbx, rbx
jne 0x14005e670
lea rcx, str.InitCommonControlsEx
call fcn.1400556f4
mov rbx, rax
test rax, rax
je 0x14005e67b
mov qword [0x1402ee918], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14005e690
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14005e692
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14005e6ab
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14005e788
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, rcx
xor r14d, r14d
mov word [rax - 0x18], r14w
mov qword [rax + 0x10], r14
mov ebx, r14d
mov eax, dword [0x1402eb534]
test eax, eax
je 0x14005e7d0
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1402eb534]
test eax, eax
jne 0x14005e7d9
call fcn.140055a2c
test eax, eax
je 0x14005e7f5
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1402ae228]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14005e7ff
movzx eax, r14w
jmp 0x14005e847
mov rcx, rdi
call qword [sym.imp.USER32.dll_RegisterClassA]
movzx ebx, ax
mov word [rsp + 0x20], ax
mov edi, r14d
test bx, bx
sete dil
test edi, edi
je 0x14005e828
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14005e82b
mov esi, r14d
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x14005e844
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, bx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14005f33c
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
movsxd rsi, r8d
mov rbx, rdx
mov rdi, rcx
cmp qword [rcx + 0xc8], 0
jne 0x14005f37a
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x14005f432
call fcn.140050b04
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14005f399
mov ecx, 0x80004005
call fcn.1400145b0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rdi + 0xc8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x118]
mov rdx, rsi
or rdi, 0xffffffffffffffff
mov r9, rdi
mov r8, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1401cb3e8
test eax, eax
je 0x14005f401
cmp eax, 0xc
je 0x14005f3fb
cmp eax, 0x16
je 0x14005f3f5
cmp eax, 0x22
je 0x14005f3f5
cmp eax, 0x50
je 0x14005f401
call fcn.1400500b4
int3
call fcn.1400500b4
int3
call fcn.1400500d8
int3
test rbx, rbx
je 0x14005f411
mov rcx, rbx
call fcn.1401c96c0
mov rbx, rax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
add ecx, edi
test ecx, ecx
jg 0x14005f430
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140064d0c
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140064d6f
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140064d83
lea rdx, str.RegDeleteKeyTransactedA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140064d83
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x140064d88
cmp dword [rcx + 8], 0
je 0x140064d83
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x140064d88
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140066ee4
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 8], 0
jne 0x1400665e2
xor eax, eax
add rsp, 0x28
ret
call fcn.140066600
mov rcx, rax
add rsp, 0x28
jmp 0x140066ee4
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1402eebd8]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1402eb534]
test eax, eax
je 0x140066f2f
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1402eb534]
test eax, eax
jne 0x140066f38
call fcn.140055a2c
test eax, eax
je 0x140066f54
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1402ae228]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140066f5c
xor eax, eax
jmp 0x140066fb9
test rbx, rbx
jne 0x140066f7c
lea rcx, str.ImageList_Destroy
call fcn.1400556f4
mov rbx, rax
test rax, rax
je 0x140066f87
mov qword [0x1402eebd8], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140066f9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140066f9e
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140066fb7
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140066fd0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x50
mov r14d, r9d
mov r15d, r8d
mov r12, rdx
mov r13, rcx
xor esi, esi
mov qword [rax - 0x20], rsi
mov rbx, qword [0x1402eebe0]
and qword [rax - 0x28], rsi
xor edi, edi
mov eax, dword [0x1402eb534]
test eax, eax
je 0x14006702d
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1402eb534]
test eax, eax
jne 0x140067036
call fcn.140055a2c
test eax, eax
je 0x140067052
lea rdx, [rsp + 0x40]
mov rcx, qword [0x1402ae228]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne edi, ecx
test edi, edi
jne 0x14006705d
xor eax, eax
jmp 0x1400670e8
test rbx, rbx
jne 0x14006707d
lea rcx, str.ImageList_LoadImageA
call fcn.1400556f4
mov rbx, rax
test rax, rax
je 0x1400670b4
mov qword [0x1402eebe0], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
mov r9d, r14d
mov r8d, r15d
mov rdx, r12
mov rcx, r13
call rbx
mov rsi, rax
mov qword [rsp + 0x48], rax
xor ebx, ebx
test rsi, rsi
sete bl
test ebx, ebx
je 0x1400670ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1400670cc
xor edi, edi
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400670e5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x14006d1b8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movzx r14d, r8w
mov r15, rdx
mov r12, rcx
or r13d, 0xffffffff
movzx edi, r13w
mov word [rax - 0x38], r13w
mov rbx, qword [0x1402eef98]
and qword [rax + 0x20], 0
xor esi, esi
mov eax, dword [0x1402eb534]
test eax, eax
je 0x14006d216
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1402eb534]
test eax, eax
jne 0x14006d21f
call fcn.140055a2c
test eax, eax
je 0x14006d23b
lea rdx, [rsp + 0x78]
mov rcx, qword [0x1402ae228]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14006d245
movzx eax, r13w
jmp 0x14006d2ae
test rbx, rbx
jne 0x14006d265
lea rcx, str.GetFileTitleA
call fcn.14006d108
mov rbx, rax
test rax, rax
je 0x14006d279
mov qword [0x1402eef98], rax
movzx r8d, r14w
mov rdx, r15
mov rcx, r12
call rbx
movzx edi, ax
mov word [rsp + 0x20], ax
xor ebx, ebx
cmp di, r13w
sete bl
test ebx, ebx
je 0x14006d290
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14006d292
xor esi, esi
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14006d2ab
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, di
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x14006e2d8
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x14006e2fe
mov r8, rdx
mov rdx, qword [rbx]
call fcn.140064d0c
jmp 0x14006e365
cmp byte [0x1402eefb0], 0
jne 0x14006e342
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14006e332
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402eefa8], rax
jmp 0x14006e339
mov rax, qword [0x1402eefa8]
mov byte [0x1402eefb0], 1
jmp 0x14006e349
mov rax, qword [0x1402eefa8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14006e35f
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x14006e365
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140072f50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CCommonDialog.virtual_712
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x14008ca83
cmp dword [rcx + 0xd8], 0
jne 0x14008ca83
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.14004eb08
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.14008cdd8
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14008ca44
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CCommonDialog.virtual_712
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x14008ca83
cmp dword [rcx + 0xd8], 0
jne 0x14008ca83
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.14004eb08
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.14008cdd8
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14008cae0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
mov r15, rcx
xor edi, edi
call fcn.14004eb08
lea r8d, [rdi + 5]
mov rbp, qword [rax + 0x18]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbp
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x14008cb3c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.14008cb74
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14008d78c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x40
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x1402eb534]
test eax, eax
je 0x14008d7de
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1402eb534]
test eax, eax
jne 0x14008d7e7
call fcn.140055a2c
test eax, eax
je 0x14008d803
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1402ae228]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14008d80b
xor eax, eax
jmp 0x14008d863
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rsi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov rsi, rax
mov qword [rsp + 0x38], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je 0x14008d845
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14008d847
xor edi, edi
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14008d860
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret

Function at 0x14008f6c0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1402ef488]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1402eb534]
test eax, eax
je 0x14008f70b
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1402eb534]
test eax, eax
jne 0x14008f714
call fcn.140055a2c
test eax, eax
je 0x14008f730
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1402ae228]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14008f738
xor eax, eax
jmp 0x14008f795
test rbx, rbx
jne 0x14008f758
lea rcx, str.GetOpenFileNameA
call fcn.14006d108
mov rbx, rax
test rax, rax
je 0x14008f763
mov qword [0x1402ef488], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14008f778
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14008f77a
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14008f793
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret