joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e8c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x14001e9e0
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x14001e920
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x14001e920
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x14001e920
Function at 0x140044500
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x140044535
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x140044510
and r10, 0xf
je 0x140044565
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x140044540
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x140044559
mov rax, r8
repz ret

Function at 0x140044570
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x1400445ad
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x140044580
pxor xmm1, xmm1
and r10, 0xf
je 0x1400445e3
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x1400445bb
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x1400445d7
mov rax, r8
repz ret
Function at 0x14012a490
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov edi, edx
mov ecx, edx
call fcn.140140938
mov rsi, rax
test rax, rax
jne 0x14012a4c5
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov eax, edi
mov qword [rsp + 0x30], rbx
shr eax, 4
mov r8d, 6
inc ax
mov qword [rsp + 0x38], rbp
movzx edx, ax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x14012a5bd
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14012a5bd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14012a5bd
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x14012a54e
cmp rbx, rcx
jae 0x14012a5bd
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x14012a535
cmp rbx, rcx
jae 0x14012a5bd
movzx edi, word [rbx]
test di, di
je 0x14012a5bd
mov r10, qword [r14]
mov ebp, 1
mov ecx, ebp
movzx edx, di
mov eax, dword [r10 - 0xc]
sub ecx, dword [r10 - 8]
sub eax, edi
or ecx, eax
jge 0x14012a586
mov edx, edi
mov rcx, r14
call fcn.14012a6e0
mov r10, qword [r14]
movzx edx, word [rbx]
movzx r9d, dx
lea r8, [rbx + 2]
mov rdx, rdi
mov rcx, r10
call fcn.1402d09b8
xor ecx, ecx
test eax, eax
je 0x14012a5a9
cmp eax, 0xc
je 0x14012a5e4
cmp eax, 0x50
jne 0x14012a5de
mov rax, qword [r14]
cmp edi, dword [rax - 0xc]
jg 0x14012a5ea
mov dword [rax - 0x10], edi
mov rax, qword [r14]
mov word [rax + rdi*2], cx
jmp 0x14012a5c1
xor ecx, ecx
mov ebp, ecx
mov rbx, qword [rsp + 0x30]
mov eax, ebp
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call fcn.14013f934
int3
call fcn.14013f958
int3
mov ecx, 0x80070057
call fcn.140129930
int3
Function at 0x14012c2d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CCommonDialog.virtual_720
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
cmp rdx, 0x10000
jae 0x140149eab
cmp dword [rcx + 0xe8], 0
jne 0x140149eab
movzx eax, si
mov dword [rcx + 0xe8], eax
call fcn.1401404b8
mov r8d, 5
mov rdx, rsi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x14014a184
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rsi, r9
mov rcx, rdx
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rbx, rbx
jne 0x14014a1d9
call fcn.14014f8c0
mov rdx, rax
test rax, rax
je 0x14014a1d7
mov rcx, qword [rax]
mov rax, qword [rcx + 0xe8]
mov rcx, rdx
call qword [case.0x14014521e.0]
mov rbx, rax
jmp 0x14014a1d9
xor ebx, ebx
and qword [rdi + 0x108], 0
mov r9, rsi
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.140149ef8

Function at 0x14012f660
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rbx, rax
jne 0x14012f67f
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor edx, edx
mov rcx, rbx
mov edi, eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
cmp edi, eax
je 0x14012f6e7
mov r8d, 1
mov edx, eax
mov ecx, edi
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor r8d, r8d
mov edx, esi
mov ecx, edi
mov ebx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rdi, qword [rsp + 0x38]
mov eax, ebx
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rdi, qword [rsp + 0x38]
mov ebx, eax
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x140133490
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
push r14
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm6
mov rax, qword [0x1403d5798]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r14, r9
movaps xmm6, xmm2
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x20], r9
lea rcx, [rsp + 0x38]
call fcn.140156d28
nop
mov dword [rsp + 0x88], 0x9ac6cdd7
xor ecx, ecx
mov dword [rsp + 0x8c], ecx
cvttsd2si eax, xmm6
mov word [rsp + 0x96], ax
mov dword [rsp + 0x98], ecx
mov word [rsp + 0x90], cx
mov word [rsp + 0x92], bx
movzx eax, word [rsp + 0xfc]
mov word [rsp + 0x94], ax
movups xmm0, xmmword [rsp + 0x88]
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], ecx
movzx eax, word [rsp + 0x9c]
mov word [rsp + 0x74], ax
mov edx, 0xcdd7
lea rax, [rsp + 0x62]
mov r8d, 9
nop dword [rax]
xor dx, word [rax]
lea rax, [rax + 2]
sub r8, 1
jne 0x140133550
mov word [rsp + 0x9c], dx
xor edx, edx
mov rcx, rdi
call qword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
mov esi, eax
test eax, eax
jne 0x14013359f
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteMetaFile]
lea rdx, str.Failed_to_Get_MetaFile_Bits_Size
xor ecx, ecx
call fcn.14012fd50
nop
lea rcx, [rsp + 0x38]
call fcn.140156e28
xor eax, eax
jmp 0x140133657
mov rcx, rsi
call fcn.1402dfb94
mov rbx, rax
mov qword [rsp + 0x30], rax
mov rcx, rdi
test rax, rax
jne 0x1401335c6
call qword [sym.imp.GDI32.dll_DeleteMetaFile]
lea rdx, str.Failed_to_Allocate_Memory_for_Metafile_Bits
jmp 0x140133586
mov r8, rbx
mov edx, esi
call qword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
test eax, eax
jne 0x1401335ef
mov rcx, rbx
call fcn.1402dfb80
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteMetaFile]
lea rdx, str.Failed_to_Get_MetaFile_Bits
jmp 0x140133586
xor r9d, r9d
mov r8d, 0x1001
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.140157460
mov r8d, reloc.WS2_32.dll_shutdown
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x38]
call fcn.14015780c
mov r8d, esi
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.14015780c
lea rcx, [rsp + 0x38]
call fcn.1401570fc
nop
jmp 0x14013363f
mov rcx, rbx
call fcn.1402dfb80
nop
lea rcx, [rsp + 0x38]
call fcn.140156e28
mov eax, 1
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140169a70
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140136770
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x40], rax
call fcn.140141030
mov rcx, rax
test rax, rax
je 0x1401368ad
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rdx, [0x1402fe9a8]
cmp rdx, 0x10000
jae 0x1401367c2
movzx edx, dx
lea rcx, [rsp + 0x38]
call fcn.14012a490
jmp 0x1401367e8
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1401367d0
mov r8d, eax
lea rcx, [rsp + 0x38]
call fcn.14012a7b0
nop
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, rbx
call fcn.140134030
mov r9d, dword [rbx + 0x1894]
xor r8d, r8d
lea rdx, str.Jobs
lea rcx, str.Statistics
call fcn.140138ac0
mov r9d, dword [rbx + 0x1898]
xor r8d, r8d
lea rdx, str.Since
lea rcx, str.Statistics
call fcn.140138ac0
mov r9d, dword [rbx + 0x1900]
xor r8d, r8d
lea rdx, str.ShowSplash
lea rcx, str.V7_54_0_0
call fcn.140138ac0
mov r9d, dword [rbx + 0x18a0]
xor r8d, r8d
lea rdx, str.Count
lea rcx, str.V7_54_0_0
call fcn.140138ac0
mov r9d, dword [rbx + 0x18a8]
xor r8d, r8d
lea rdx, str.Counte
lea rcx, str.V7_54_0_0
call fcn.140138ac0
mov r9d, dword [rbx + 0x18b0]
xor r8d, r8d
lea rdx, str.Total
lea rcx, str.V7_54_0_0
add rsp, 0x20
pop rbx
jmp fcn.140138ac0
mov ecx, 0x80004005
call fcn.140129930
int3
Function at 0x140137b90
Capabilities:
Get graphical window text

Disassembly:
mov rax, rdx
lea r8, [rcx + 0x130]
mov rcx, rax
mov edx, 0x405
jmp 0x140156250
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
call fcn.140156358
xor ebp, ebp
mov dword [rbx + 0x14], 1
mov rsi, rax
mov rcx, rax
cmp dword [rbx], ebp
je 0x1401562d3
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edx, eax
mov rcx, rdi
lea ebx, [rax + 1]
call fcn.140140a60
mov rdx, rax
mov r8d, ebx
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rdi]
test rcx, rcx
jne 0x1401562b0
mov eax, ebp
jmp 0x1401562bd
movsxd rdx, dword [rcx - 0xc]
call fcn.1402df9a8
test eax, eax
js 0x1401562f0
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x1401562f0
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rdi]
mov word [rax + rcx*2], bp
jmp 0x1401562db
mov rdx, qword [rdi]
call fcn.14015e6d4
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80070057
call fcn.140129930
int3
Function at 0x140138620
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov edi, r9d
mov rsi, rdx
mov rbx, rcx
test r8, r8
je 0x140138653
mov r9, r8
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x140138720
call fcn.140141030
mov rcx, rax
test rax, rax
je 0x140138735
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
mov r9, rbx
mov r8, qword [0x1403dd160]
lea rdx, [0x1403060a0]
lea rcx, [rsp + 0x60]
call fcn.14012b980
lea r8, [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
xor ebp, ebp
test eax, eax
sete bpl
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401386cc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebp, ebp
je 0x14013871e
mov dword [rsp + 0x60], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14013871e
cmp dword [rsp + 0x30], 4
mov eax, dword [rsp + 0x34]
je 0x140138720
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov ecx, 0x80004005
call fcn.140129930
int3
Function at 0x140138920
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test r8, r8
je 0x1401389d7
cmp word [r8], 0
je 0x1401389d7
mov r9, rbx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
jne 0x1401389d0
lea rcx, [rsp + 0x70]
call fcn.14012f710
mov rdi, rax
mov r9, qword [rax]
cmp dword [r9 - 8], 1
jle 0x140138988
mov edx, dword [r9 - 0x10]
mov rcx, rax
call fcn.140129fb0
mov r9, qword [rdi]
mov r8, rbx
lea rdx, str.Unable_to_write__s:_n_s
xor ecx, ecx
call fcn.14012fd50
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401389bb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov eax, 1
jmp 0x1401389bd
call fcn.140141030
mov rcx, rax
test rax, rax
je 0x140138aa6
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov r9, rbp
mov r8, qword [0x1403dd160]
lea rdx, [0x1403060a0]
lea rcx, [rsp + 0x70]
call fcn.14012b980
lea r8, [rsp + 0x30]
mov rbx, qword [rsp + 0x70]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
xor ebp, ebp
mov r14d, ebp
test eax, eax
sete r14b
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140138a53
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r14d, r14d
je 0x1401389bb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete bpl
mov eax, ebp
jmp 0x1401389bd
mov ecx, 0x80004005
call fcn.140129930
int3
Function at 0x140138ac0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp + 0x20], r9d
push rsi
push rdi
push r14
sub rsp, 0x40
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
test r8, r8
je 0x140138bcd
cmp word [r8], 0
je 0x140138bcd
call fcn.140141030
mov rcx, rax
test rax, rax
je 0x140138cae
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov r8d, dword [rsp + 0x78]
lea rdx, [0x1402fe9a0]
lea rcx, [rsp + 0x70]
call fcn.14012b980
mov r9, rsi
mov rbx, qword [rsp + 0x70]
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edi, 0xffffffff
test eax, eax
jne 0x140138ba9
lea rcx, [rsp + 0x38]
call fcn.14012f710
mov rbx, rax
mov r9, qword [rax]
cmp dword [r9 - 8], 1
jle 0x140138b70
mov edx, dword [r9 - 0x10]
mov rcx, rax
call fcn.140129fb0
mov r9, qword [rbx]
mov r8, rsi
lea rdx, str.Unable_to_write__s:_n_s
xor ecx, ecx
call fcn.14012fd50
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140138ba0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor esi, esi
mov rbx, qword [rsp + 0x70]
jmp 0x140138bae
mov esi, 1
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140138bc6
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, esi
jmp 0x140138c90
call fcn.140141030
mov rcx, rax
test rax, rax
je 0x140138ca3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov r9, rdi
mov r8, qword [0x1403dd160]
lea rdx, [0x1403060a0]
lea rcx, [rsp + 0x70]
call fcn.14012b980
lea r8, [rsp + 0x30]
mov rbx, qword [rsp + 0x70]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
xor esi, esi
mov r14d, esi
test eax, eax
sete r14b
lea rdx, [rbx - 0x18]
mov edi, 0xffffffff
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140138c49
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r14d, r14d
je 0x140138c8e
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete sil
mov eax, esi
jmp 0x140138c90
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.140129930
int3
mov ecx, 0x80004005
call fcn.140129930
int3
Function at 0x140139c90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140139d05
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140139d05
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140139cf5
nop
cmp rbx, rcx
jae 0x140139d05
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140139ce0
cmp rbx, rcx
jae 0x140139d05
cmp word [rbx], 0
je 0x140139d05
mov rax, rbx
jmp 0x140139d07
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14013ee20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, r8
mov rbp, rdx
mov rsi, rcx
movzx edx, word [rcx + 8]
lea r8, [0x1403078f8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
mov rdx, rax
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rbx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov rcx, qword [r14]
sub rcx, 0x18
call fcn.140129ed0
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call fcn.14013d5f0
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14013eed2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rbp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x140141868
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x78
test rdx, rdx
je 0x1401418d0
mov r10, qword [rcx + 0x10]
test r10, r10
je 0x1401418ba
cmp qword [rcx + 0x18], 0
jne 0x1401418b5
mov eax, dword [rcx + 0xc]
cmp eax, dword [rcx + 0x30]
jae 0x1401418d6
mov qword [rsp + 0x58], rdx
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0x50
mov edx, eax
mov dword [rsp + 0x24], 0x40
mov r8d, 1
mov rcx, qword [r10 + 8]
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
add rsp, 0x78
ret
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x1401418d0
mov rcx, qword [rcx + 0x40]
add rsp, 0x78
jmp fcn.14015e6d4
call fcn.14013f934
int3
call fcn.14013f934
int3