joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003e170
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rdi, rsp
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
shr rax, 0x10
test rax, rax
je 0x14003e1d1
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x68]
call fcn.140052e80
test eax, eax
jne 0x14003e1d1
mov edx, 0xc9
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcdlgcore.cpp
call fcn.140004f20
test eax, eax
je 0x14003e1d1
int3
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0xf0], rcx
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0xf0]
shr rax, 0x10
test rax, rax
jne 0x14003e225
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0xe8], 0
jne 0x14003e225
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0xf0]
and rax, 0xffff
movzx eax, ax
mov rcx, qword [rsp + 0x60]
mov dword [rcx + 0xe8], eax
xor edx, edx
mov rcx, qword [rsp + 0x68]
call fcn.140040280
test eax, eax
jne 0x14003e27e
xor eax, eax
test eax, eax
jne 0x14003e253
mov edx, 0xd2
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcdlgcore.cpp
call fcn.140004f20
test eax, eax
je 0x14003e253
int3
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov rax, qword [rax + 0x250]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.140350d30
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0x40]
xor eax, eax
jmp 0x14003e2e4
call fcn.140041650
mov qword [rsp + 0x20], rax
mov r8d, 5
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x30], rax
mov r9, qword [rsp + 0x20]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
call fcn.14003eab0
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [rsp + 0x38]
add rsp, 0x50
pop rdi
ret
Function at 0x14003e2f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rdi, rsp
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call fcn.140041650
mov qword [rsp + 0x30], rax
mov r8d, 5
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14003e37c
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14003e39c
mov edx, 0x110
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcdlgcore.cpp
call fcn.140004f20
test eax, eax
je 0x14003e39c
int3
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x60]
call fcn.14003e3e0
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x28]
call fcn.1401cc310
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [rsp + 0x40]
add rsp, 0x50
pop rdi
ret
Function at 0x140081370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rsp
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 4]
and eax, 1
test eax, eax
je 0x1400813b7
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x20], rax
jmp 0x14008142a
mov r8d, 5
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400813e7
call fcn.14005bc80
mov rdx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14008140d
call fcn.14005bc80
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14008142a
call fcn.14005bc80
call fcn.14005a1d0
cmp qword [rax + 0x68], 0
je 0x14008144a
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
call fcn.14007f920
mov qword [rsp + 0x20], rax
mov edx, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x20]
call fcn.140081960
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0xf8], 0
je 0x14008148e
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0xf8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rax, qword [rsp + 0x50]
mov qword [rax + 0xf8], 0
cmp qword [rsp + 0x38], 0
je 0x1400814b1
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0xf8], rcx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 4]
or eax, 1
mov rcx, qword [rsp + 0x58]
mov dword [rcx + 4], eax
add rsp, 0x40
pop rdi
ret

Function at 0x140093670
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rdi, rsp
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call fcn.140011fd0
movzx eax, al
test eax, eax
jne 0x1400936d3
mov rcx, qword [rsp + 0x38]
call fcn.140084d30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400936d3
mov rax, qword [rsp + 0x30]
add rax, 0x120
mov rdx, qword [rsp + 0x38]
mov rcx, rax
call fcn.1400f0af0
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400936e0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rsp
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
jne 0x140093748
lea rax, str.m_hKey___0
mov qword [rsp + 0x28], rax
lea rax, [0x1404c2c40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x167e
lea rdx, [0x1403cbaf0]
mov ecx, 2
call fcn.14035a580
cmp eax, 1
jne 0x140093748
int3
xor eax, eax
test eax, eax
jne 0x140093703
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x10], 0
je 0x14009377a
mov r8, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x10]
call fcn.14003ccb0
jmp 0x140093811
movzx eax, byte [0x140a4d180]
test eax, eax
jne 0x1400937bf
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400937b8
lea rdx, str.RegDeleteKeyExW
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140a4d178], rax
mov byte [0x140a4d180], 1
cmp qword [0x140a4d178], 0
je 0x1400937fe
mov rax, qword [0x140a4d178]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.140350d30
xor r9d, r9d
mov rax, qword [rsp + 0x50]
mov r8d, dword [rax + 8]
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [rsp + 0x38]
jmp 0x140093811
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add rsp, 0x40
pop rdi
ret
Function at 0x1400eeb10
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rsp
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x28]
mov edx, dword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
call fcn.1400342d0
mov edx, 0xfffffff0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 3
cmp eax, 3
je 0x1400eeb76
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.1400ef230
jmp 0x1400eeb84
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.1400ef0c0
mov rax, qword [rsp + 0x50]
cmp dword [rax], 0
je 0x1400eec07
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jle 0x1400eebd3
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x60]
call fcn.14001e4c0
mov ecx, dword [rsp + 0x38]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1400eebf6
mov edx, 0xff
mov rcx, qword [rsp + 0x60]
call fcn.14005a520
mov r8d, 0x100
mov rdx, rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x60]
call fcn.14000f840
jmp 0x1400eec48
mov rcx, qword [rsp + 0x60]
call fcn.140084d30
mov r9, rax
mov r8, 0xffffffffffffffff
mov edx, 0x14d
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, 0xffffffffffffffff
jne 0x1400eec48
mov rcx, qword [rsp + 0x60]
call fcn.140084d30
mov rdx, rax
mov rcx, qword [rsp + 0x28]
call fcn.140061a20
mov rcx, rsp
lea rdx, [0x140406b20]
call fcn.140350b90
add rsp, 0x40
pop rdi
ret

Function at 0x1400eeee0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.1400ef230
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0
je 0x1400eef71
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x2c], eax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.14001e4c0
mov ecx, dword [rsp + 0x2c]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call fcn.14000f840
jmp 0x1400eef88
mov rcx, qword [rsp + 0x50]
call fcn.140084d30
mov rdx, rax
mov rcx, qword [rsp + 0x20]
call fcn.140061a20
add rsp, 0x30
pop rdi
ret
Function at 0x1400f4570
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x1400f45d8
lea rax, str.m_hKey___0
mov qword [rsp + 0x28], rax
lea rax, [0x1404c2c40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x16a7
lea rdx, [0x1403cbaf0]
mov ecx, 2
call fcn.14035a580
cmp eax, 1
jne 0x1400f45d8
int3
xor eax, eax
test eax, eax
jne 0x1400f4593
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add rsp, 0x30
pop rdi
ret

Function at 0x1401728d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov rdi, rsp
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
cmp qword [rsp + 0x88], 0
jne 0x140172942
lea rax, str.pnBytes___0
mov qword [rsp + 0x28], rax
lea rax, [0x1404c2c40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x178e
lea rdx, [0x1403cbaf0]
mov ecx, 2
call fcn.14035a580
cmp eax, 1
jne 0x140172942
int3
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x140172987
lea rax, str.m_hKey___0
mov qword [rsp + 0x28], rax
lea rax, [0x1404c2c40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x178f
lea rdx, [0x1403cbaf0]
mov ecx, 2
call fcn.14035a580
cmp eax, 1
jne 0x140172987
int3
xor eax, eax
test eax, eax
jne 0x140172942
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1401729d3
mov eax, dword [rsp + 0x30]
jmp 0x1401729e3
cmp dword [rsp + 0x44], 3
je 0x1401729e1
mov eax, 0xd
jmp 0x1401729e3
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140426830]
call fcn.140350b90
mov rax, rdi
add rsp, 0x60
pop rdi
ret
Function at 0x140172a00
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
mov rdi, rsp
mov ecx, 0x20
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x90]
mov rax, qword [rsp + 0x90]
cmp qword [rax], 0
jne 0x140172a76
lea rax, str.m_hKey___0
mov qword [rsp + 0x28], rax
lea rax, [0x1404c2c40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x1765
lea rdx, [0x1403cbaf0]
mov ecx, 2
call fcn.14035a580
cmp eax, 1
jne 0x140172a76
int3
xor eax, eax
test eax, eax
jne 0x140172a2e
mov dword [rsp + 0x44], 4
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
xor r8d, r8d
mov rdx, qword [rsp + 0x98]
mov rax, qword [rsp + 0x90]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140172acd
mov eax, dword [rsp + 0x30]
jmp 0x140172add
cmp dword [rsp + 0x64], 4
je 0x140172adb
mov eax, 0xd
jmp 0x140172add
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.140350b90
mov rax, rdi
add rsp, 0x80
pop rdi
ret

Function at 0x140173620
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x140173692
lea rax, str.m_hKey___0
mov qword [rsp + 0x28], rax
lea rax, [0x1404c2c40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x1860
lea rdx, [0x1403cbaf0]
mov ecx, 2
call fcn.14035a580
cmp eax, 1
jne 0x140173692
int3
xor eax, eax
test eax, eax
jne 0x14017364d
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x30
pop rdi
ret

Function at 0x1401736d0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x14017373d
lea rax, str.m_hKey___0
mov qword [rsp + 0x28], rax
lea rax, [0x1404c2c40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x1868
lea rdx, [0x1403cbaf0]
mov ecx, 2
call fcn.14035a580
cmp eax, 1
jne 0x14017373d
int3
xor eax, eax
test eax, eax
jne 0x1401736f8
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x30
pop rdi
ret
Function at 0x14017e8d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rsp
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
cmp qword [rsp + 0x60], 0
jne 0x14017e90a
call fcn.140041650
mov qword [rsp + 0x60], rax
lea r8, [0x14042b730]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14017e935
xor eax, eax
jmp 0x14017e9bc
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14017e956
xor eax, eax
jmp 0x14017e9bc
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14017e97d
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x14017e9bc
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call fcn.14017e9d0
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x28]
call fcn.1401cc310
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [rsp + 0x38]
add rsp, 0x40
pop rdi
ret

Function at 0x140357e90
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.140357950
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140357ec8
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call fcn.140350d30
mov ecx, dword [rsp + 0x40]
call qword [rsp + 0x28]
jmp 0x140357ed2
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x38
ret

Function at 0x1403893b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x180001700
Capabilities:
Delete file
Move file

Disassembly:
push rdi
sub rsp, 0x90
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov rax, qword [0x1800e92b0]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdi, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x180001739
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1800018dd
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.180001ab0
mov rbx, rax
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.1800036a0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1800037a0
nop
mov rax, qword [rsp + 0x60]
cmp rax, 0x10
jb 0x1800017d3
inc rax
mov rcx, qword [rsp + 0x48]
cmp rax, 0x1000
jb 0x1800017ce
test cl, 0x1f
je 0x1800017a1
call fcn.180083e00
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800017b0
call fcn.180083e00
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800017bf
call fcn.180083e00
int3
cmp rcx, 0x27
jbe 0x1800017cb
call fcn.180083e00
int3
mov rcx, rax
call fcn.180060d7c
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x58], 0
mov byte [rsp + 0x48], 0
mov rax, qword [rsp + 0x80]
cmp rax, 0x10
jb 0x180001845
inc rax
mov rcx, qword [rsp + 0x68]
cmp rax, 0x1000
jb 0x180001840
test cl, 0x1f
je 0x180001813
call fcn.180083e00
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180001822
call fcn.180083e00
int3
sub rcx, rax
cmp rcx, 8
jae 0x180001831
call fcn.180083e00
int3
cmp rcx, 0x27
jbe 0x18000183d
call fcn.180083e00
int3
mov rcx, rax
call fcn.180060d7c
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rdx, qword [rsp + 0x28]
cmp qword [rdi + 0x18], 0x10
jb 0x180001860
mov rdi, qword [rdi]
mov rcx, rdi
call fcn.180089f30
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rcx, qword [rsp + 0x28]
xor edx, edx
lea r8d, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov rax, qword [rsp + 0x40]
cmp rax, 0x10
jb 0x1800018dd
inc rax
mov rcx, qword [rsp + 0x28]
cmp rax, 0x1000
jb 0x1800018d8
test cl, 0x1f
je 0x1800018ab
call fcn.180083e00
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800018ba
call fcn.180083e00
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800018c9
call fcn.180083e00
int3
cmp rcx, 0x27
jbe 0x1800018d5
call fcn.180083e00
int3
mov rcx, rax
call fcn.180060d7c
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1800612f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x180001900
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x2a0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1800e92b0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rdi, rdx
mov rbp, rcx
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x50]
call fcn.180081920
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x180001964
xor al, al
jmp 0x180001a87
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180001a7c
movabs r14, 0xaaaaaaaaaaaaaa9
nop dword [rax]
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x28]
call fcn.180001d60
nop
lea rbx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rbx, qword [rsp + 0x28]
mov rcx, rbp
call fcn.180006280
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x180001a00
mov rbx, qword [rdi]
lea r9, [rsp + 0x58]
mov r8, qword [rbx + 8]
mov rdx, rbx
call fcn.180003e00
mov rdx, qword [rdi + 8]
mov rcx, r14
sub rcx, rdx
cmp rcx, 1
jb 0x180001a57
lea rcx, [rdx + 1]
mov qword [rdi + 8], rcx
mov qword [rbx + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0x10
jb 0x180001a40
mov rcx, qword [rsp + 0x28]
inc rax
cmp rax, 0x1000
jb 0x180001a3b
test cl, 0x1f
jne 0x180001a76
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180001a70
sub rcx, rax
cmp rcx, 8
jb 0x180001a6a
cmp rcx, 0x27
ja 0x180001a64
mov rcx, rax
call fcn.180060d7c
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x180001a7c
jmp 0x180001990
lea rcx, str.list_T__too_long
call fcn.180025308
nop
call fcn.180083e00
int3
call fcn.180083e00
int3
call fcn.180083e00
int3
call fcn.180083e00
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1800612f0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret