joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ebe68
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1800ebe79
xor eax, eax
jmp 0x1800ebea7
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1800ebeb0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1800ebec1
xor eax, eax
jmp 0x1800ebee5
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x180104b34
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x180104b99
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180104bad
lea rdx, str.MoveFileTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180104bad
mov rcx, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rcx
mov rcx, rsi
mov rdx, rdi
mov dword [rsp + 0x20], 2
call rax
jmp 0x180104baf
cmp dword [rcx + 8], 0
je 0x180104bad
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x180104baf
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x180104e3c
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x180104e92
cmp qword [rdx], 0
je 0x180104e88
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180104e9c
lea rdx, str.DeleteFileTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180104e8e
mov rdx, qword [rbx]
mov rcx, rdi
call rax
jmp 0x180104e98
cmp dword [rdx + 8], 0
jne 0x180104e92
xor eax, eax
jmp 0x180104e98
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180104eac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rdi
mov ecx, eax
call fcn.180187d64
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180104eb8
Capabilities:
Move file

Disassembly:
push rbx
sub rsp, 0x20
mov rax, r8
mov rbx, rcx
test r8, r8
je 0x180104ed9
mov r8, rdx
mov rdx, rcx
mov rcx, rax
call fcn.180104b34
jmp 0x180104edf
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x180104ef3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
mov ecx, eax
call fcn.180187d64
add rsp, 0x20
pop rbx
ret
Function at 0x180105364
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movzx r14d, r8w
mov r15, rdx
mov r12, rcx
or r13d, 0xffffffff
movzx edi, r13w
mov word [rax - 0x38], r13w
mov rbx, qword [0x1802c86a0]
and qword [rax + 0x20], 0
xor esi, esi
mov eax, dword [0x1802c13a4]
test eax, eax
je 0x1801053c2
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1802c13a4]
test eax, eax
jne 0x1801053cb
call fcn.180012a68
test eax, eax
je 0x1801053e7
lea rdx, [rsp + 0x78]
mov rcx, qword [0x1802b8010]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1801053f1
movzx eax, r13w
jmp 0x18010545a
test rbx, rbx
jne 0x180105411
lea rcx, str.GetFileTitleW
call fcn.1800c94f0
mov rbx, rax
test rax, rax
je 0x180105425
mov qword [0x1802c86a0], rax
movzx r8d, r14w
mov rdx, r15
mov rcx, r12
call rbx
movzx edi, ax
mov word [rsp + 0x20], ax
xor ebx, ebx
cmp di, r13w
sete bl
test ebx, ebx
je 0x18010543c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x18010543e
xor esi, esi
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x180105457
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, di
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x180126d34
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x30
mov qword [rax - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, r9
mov rsi, r8
mov rbx, rcx
lea rcx, [rax + 8]
call fcn.180009300
nop
cmp rbx, 0xffffffff80000000
jne 0x180126db7
call fcn.180040658
cmp eax, 1
jne 0x180126db7
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x20]
call fcn.180082658
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.18000a494
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x180126db0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, 0xffffffff80000001
mov r9, rdi
mov r8, rsi
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x180126de7
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180126dfc
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x40
mov qword [rax - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, r9
mov esi, r8d
mov rbx, rcx
lea rcx, [rax + 8]
call fcn.180009300
nop
cmp rbx, 0xffffffff80000000
jne 0x180126e7f
call fcn.180040658
cmp eax, 1
jne 0x180126e7f
lea r8, [rsp + 0x50]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x30]
call fcn.180082658
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.18000a494
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x180126e78
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, 0xffffffff80000001
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8d, esi
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x180126eb7
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x18014cf10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [rdx + 4], 1
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
je 0x18014cf39
mov rdi, qword [rdx + 0x10]
jmp 0x18014cf8a
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rbx + 8]
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x18014cf5a
call fcn.180051204
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
jne 0x18014cf74
call fcn.180051204
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
jne 0x18014cf8a
call fcn.180051204
call fcn.1800405dc
cmp qword [rax + 0x68], 0
je 0x18014cfa4
mov rdx, rdi
mov rcx, rbp
call fcn.18014c4a8
mov rdi, rax
mov edx, esi
mov rcx, rdi
call fcn.18014d208
mov rcx, qword [rbp + 0xe8]
mov rsi, rax
test rcx, rcx
je 0x18014cfcb
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rbp + 0xe8], 0
test rsi, rsi
je 0x18014cfda
mov rdi, rsi
mov qword [rbp + 0xe8], rsi
or dword [rbx + 4], 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18014d378
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, rcx
xor ebx, ebx
mov qword [rax - 0x18], rbx
mov r14, qword [0x1802c97f0]
and qword [rax + 8], rbx
xor esi, esi
mov eax, dword [0x1802c13a4]
test eax, eax
je 0x18014d3c4
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1802c13a4]
test eax, eax
jne 0x18014d3cd
call fcn.180012a68
test eax, eax
je 0x18014d3e9
lea rdx, [rsp + 0x40]
mov rcx, qword [0x1802b8010]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x18014d3f4
xor eax, eax
jmp 0x18014d478
test r14, r14
jne 0x18014d411
lea rcx, str.CreatePropertySheetPageW
call fcn.18014d674
test rax, rax
je 0x18014d443
mov qword [0x1802c97f0], rax
mov eax, dword [rdi + 4]
mov ecx, 0x4000
test ecx, eax
jne 0x18014d432
cmp dword [rdi], 0x60
jb 0x18014d432
or eax, ecx
mov dword [rdi + 4], eax
mov rax, qword [0x1802b8010]
mov qword [rdi + 0x58], rax
mov rcx, rdi
call qword [0x1802c97f0]
mov rbx, rax
mov qword [rsp + 0x20], rax
xor edi, edi
test rbx, rbx
sete dil
test edi, edi
je 0x18014d45a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x18014d45c
xor esi, esi
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x18014d475
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x18014d490
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1802c97f8]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1802c13a4]
test eax, eax
je 0x18014d4db
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1802c13a4]
test eax, eax
jne 0x18014d4e4
call fcn.180012a68
test eax, eax
je 0x18014d500
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1802b8010]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x18014d508
xor eax, eax
jmp 0x18014d565
test rbx, rbx
jne 0x18014d528
lea rcx, str.DestroyPropertySheetPage
call fcn.18014d674
mov rbx, rax
test rax, rax
je 0x18014d533
mov qword [0x1802c97f8], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x18014d548
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x18014d54a
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x18014d563
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x18014d57c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
or rdi, 0xffffffffffffffff
mov qword [rax - 0x18], rdi
mov rbx, qword [0x1802c9800]
and qword [rax + 0x10], 0
xor esi, esi
mov eax, dword [0x1802c13a4]
test eax, eax
je 0x18014d5cb
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1802c13a4]
test eax, eax
jne 0x18014d5d4
call fcn.180012a68
test eax, eax
je 0x18014d5f0
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1802b8010]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x18014d5fa
or rax, 0xffffffffffffffff
jmp 0x18014d65c
test rbx, rbx
jne 0x18014d61a
lea rcx, str.PropertySheetW
call fcn.18014d674
mov rbx, rax
test rax, rax
je 0x18014d627
mov qword [0x1802c9800], rax
mov rcx, r14
call rbx
mov rdi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
cmp rdi, 0xffffffffffffffff
sete bl
test ebx, ebx
je 0x18014d63e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x18014d640
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x18014d659
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x18016eea4
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1802c9fc0]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1802c13a4]
test eax, eax
je 0x18016eeef
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1802c13a4]
test eax, eax
jne 0x18016eef8
call fcn.180012a68
test eax, eax
je 0x18016ef14
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1802b8010]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x18016ef1c
xor eax, eax
jmp 0x18016ef79
test rbx, rbx
jne 0x18016ef3c
lea rcx, str.GetOpenFileNameW
call fcn.1800c94f0
mov rbx, rax
test rax, rax
je 0x18016ef47
mov qword [0x1802c9fc0], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x18016ef5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x18016ef5e
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x18016ef77
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x18016ef90
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1802c9fc8]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1802c13a4]
test eax, eax
je 0x18016efdb
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1802c13a4]
test eax, eax
jne 0x18016efe4
call fcn.180012a68
test eax, eax
je 0x18016f000
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1802b8010]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x18016f008
xor eax, eax
jmp 0x18016f065
test rbx, rbx
jne 0x18016f028
lea rcx, str.GetSaveFileNameW
call fcn.1800c94f0
mov rbx, rax
test rax, rax
je 0x18016f033
mov qword [0x1802c9fc8], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x18016f048
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x18016f04a
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x18016f063
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x18016f2cc
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1802c9fd0]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1802c13a4]
test eax, eax
je 0x18016f317
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1802c13a4]
test eax, eax
jne 0x18016f320
call fcn.180012a68
test eax, eax
je 0x18016f33c
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1802b8010]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x18016f344
xor eax, eax
jmp 0x18016f3a1
test rbx, rbx
jne 0x18016f364
lea rcx, str.ChooseFontW
call fcn.1800c94f0
mov rbx, rax
test rax, rax
je 0x18016f36f
mov qword [0x1802c9fd0], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x18016f384
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x18016f386
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x18016f39f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x18017491c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1802ca0b0]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1802c13a4]
test eax, eax
je 0x180174967
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1802c13a4]
test eax, eax
jne 0x180174970
call fcn.180012a68
test eax, eax
je 0x18017498c
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1802b8010]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x180174994
xor eax, eax
jmp 0x1801749f1
test rbx, rbx
jne 0x1801749b4
lea rcx, str.PrintDlgW
call fcn.1800c94f0
mov rbx, rax
test rax, rax
je 0x1801749bf
mov qword [0x1802ca0b0], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1801749d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1801749d6
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1801749ef
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x180176950
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rdx]
mov rbx, rdx
cmp dword [rcx - 0x10], 0
je 0x180176982
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180176982
lea rcx, [rdi + 0x120]
mov rdx, rbx
call fcn.180146830
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1801a15c8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1802caa68]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1802c13a4]
test eax, eax
je 0x1801a1613
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1802c13a4]
test eax, eax
jne 0x1801a161c
call fcn.180012a68
test eax, eax
je 0x1801a1638
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1802b8010]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1801a1640
xor eax, eax
jmp 0x1801a169d
test rbx, rbx
jne 0x1801a1660
lea rcx, str.ChooseColorW
call fcn.1800c94f0
mov rbx, rax
test rax, rax
je 0x1801a166b
mov qword [0x1802caa68], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1801a1680
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1801a1682
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1801a169b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140001ce0
Capabilities:
Encode data using xor

Disassembly:
xor rax, rax
xor r10, r10
cmp r8, 0
je 0x140001d2d
cmp r8, 0x10
jne 0x140001d10
mov r10, qword [rcx]
mov r11, qword [rcx + 8]
mov r8d, 1
xor r10, qword [rdx]
xor r11, qword [rdx + 8]
or r10, r11
cmovne rax, r8
repz ret
mov r10b, byte [rcx]
lea rcx, [rcx + 1]
xor r10b, byte [rdx]
lea rdx, [rdx + 1]
or al, r10b
dec r8
jne 0x140001d10
neg rax
shr rax, 0x3f
repz ret
Function at 0x140007d60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140007d80
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret

Function at 0x140007dc0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140007de0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x140007e20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140007e43
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x140007e90
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140007eb3
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x140007f00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140007f29
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret