joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10000ba78
Capabilities:
Create thread
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
test edx, edx
mov ebx, edx
mov eax, 0xfffffffe
cmove ebx, eax
mov rdi, rcx
test ebx, ebx
js 0x10001dbdc
mov r8d, dword [rdi + 0x54]
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
jmp fcn.100001fc8
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r11d, dword [rsp + 0x40]
imul r11d, ebx
mov ebx, r11d
neg ebx
jmp 0x10000ba99

Function at 0x10000c5cc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0x1010
call fcn.100002240
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x1030], rbx
mov rax, qword [0x100090120]
xor rax, rsp
mov qword [rsp + 0x1000], rax
mov rsi, r9
mov rbp, r8
mov rbx, rdx
xor edi, edi
lea rcx, [rsp + 0x48]
call fcn.10000c6e4
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.100002460
nop
lea rcx, [rsp + 0x48]
call fcn.1000012b0
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, edi
jne 0x10000c6ae
mov dword [rsp + 0x30], 0xfa0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, qword [rbp]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x10000c6a2
cmp dword [rsp + 0x34], 1
jne 0x10000c6a2
mov word [rsp + 0xffe], di
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.100002350
mov dil, 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x38]
call fcn.1000012b0
mov al, dil
mov rcx, qword [rsp + 0x1000]
xor rcx, rsp
call fcn.100001100
mov rbx, qword [rsp + 0x1030]
add rsp, 0x1010
pop rdi
pop rsi
pop rbp
ret
Function at 0x10000d284
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
or r9, 0xffffffffffffffff
mov rbp, rcx
mov rcx, qword [rcx + 0xb8]
lea r8d, [r9 + 0xd]
mov edx, 0x432
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0xb8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x431
call qword [sym.imp.USER32.dll_SendMessageW]
lea r8, [rsp + 0x54]
lea rdx, [rsp + 0x50]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.COMCTL32.dll_ImageList_GetIconSize]
mov rcx, rbx
call qword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov rcx, qword [0x1000921e0]
mov edx, 2
mov ebx, 0x2000
lea r8d, [rdx + 0x16]
mov r9d, edx
mov dword [rsp + 0x30], ebx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xff00ff
call qword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
mov r8, qword [rsp + 0x50]
mov rcx, rbp
mov rdx, rax
call fcn.10000d460
mov rcx, qword [0x1000921e0]
mov edx, 0x87
mov dword [rsp + 0x30], ebx
and dword [rsp + 0x28], 0
lea r8d, [rdx - 0x6f]
mov r9d, 2
mov rsi, rax
mov dword [rsp + 0x20], 0xff00ff
call qword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
mov r8, qword [rsp + 0x50]
mov rcx, rbp
mov rdx, rax
call fcn.10000d460
mov rcx, qword [0x1000921e0]
mov r9d, 2
mov dword [rsp + 0x30], 0x2020
and dword [rsp + 0x28], 0
lea r8d, [r9 + 0x16]
mov edx, reloc.OLEAUT32.dll_LoadRegTypeLib
mov rdi, rax
mov dword [rsp + 0x20], 0xff00ff
call qword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
mov r8, qword [rsp + 0x50]
mov rcx, rbp
mov rdx, rax
call fcn.10000d460
mov rcx, qword [rbp + 0xb8]
mov r9, rdi
xor r8d, r8d
mov edx, 0x434
mov rbx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0xb8]
mov r9, rsi
xor r8d, r8d
mov edx, 0x430
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0xb8]
mov r9, rbx
xor r8d, r8d
mov edx, 0x436
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0xb8]
or rdi, 0xffffffffffffffff
mov ebx, 0x432
lea r8d, [rdi + 0xd]
mov r9, rdi
mov edx, ebx
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, rdi
mov rcx, qword [rbp + 0xb8]
lea r8d, [rdi + 0xe]
mov edx, ebx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0xb8]
lea r8d, [rdi + 0xf]
mov r9, rdi
mov edx, ebx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x10000da90
Capabilities:
Identify system language via api

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x110
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x100090120]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rdx
xor esi, esi
mov dword [rsp + 0x28], esi
mov word [rsp + 0x50], si
xor edx, edx
mov r8d, 0xa6
lea rcx, [rsp + 0x52]
call sub.msvcrt.dll_memset
lea rcx, [0x100090238]
mov rax, qword [0x100090238]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x28], 1
mov rcx, rdi
call fcn.10000dbe0
cmp rax, rsi
je 0x1000239ee
lea rdx, str.GetUserPreferredUILanguages
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
cmp rax, rsi
je 0x1000239ee
mov dword [rsp + 0x24], 0x54
lea r9, [rsp + 0x24]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x20]
lea ecx, [rsi + 8]
call rax
cmp eax, 1
jne 0x1000239ee
mov edx, esi
mov edi, dword [rsp + 0x24]
add edi, 0xfffffffe
cmp edi, esi
jbe 0x10000db85
lea rax, [rsp + 0x50]
mov ecx, dword [rsp + 0x20]
cmp ecx, esi
jbe 0x10000db81
cmp word [rax], si
je 0x1000239dd
inc edx
add rax, 2
cmp edx, edi
jb 0x10000db6a
mov dword [rsp + 0x20], ecx
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1000085f0
jmp 0x10000dba9
mov rax, rbx
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.100001100
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov r8d, 0x5f
mov word [rax], r8w
dec ecx
jmp 0x10000db77
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx r8d, ax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.100055984
nop
mov rdx, rax
mov rcx, rbx
call fcn.100001c58
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
cmp ecx, esi
jg 0x10000dba9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x10000dba9
Function at 0x10000f510
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x10000f557
cmp rcx, 0xffffffffffffffff
je 0x10000f557
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10000f555
cmp dword [rcx + 0x3c], edx
jl 0x10000f555
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10000f555
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x10000f557
mov rax, rdx
add rsp, 0x18
ret

Function at 0x10000f640
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x100090120]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call sub.msvcrt.dll_memset
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x100000000]
mov esi, SysAllocStringByteLen
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x100023a9d
cmp dword [rsp + 0x24], 5
jb 0x10000f6db
jmp 0x10000f6d7
mov byte [rbx + 0x18], sil
lea rax, [0x10006aca0]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.100007df4
movzx ecx, byte [0x1000900e8]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x1000900e8], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.100001100
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
cmp dword [rsp + 0x30], esi
jne 0x10000f6db
cmp dword [rsp + 0x24], 4
ja 0x10000f6d7
jne 0x10000f6db
cmp dword [rsp + 0x28], 0
ja 0x10000f6d7
jmp 0x10000f6db
Function at 0x100016260
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x290
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x100090120]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, rdx
xor esi, esi
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x50], rsi
mov rax, qword [0x100091250]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x30]
call fcn.100016330
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.100003720
nop
lea rcx, [rsp + 0x30]
call fcn.1000012b0
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, esi
je 0x1000224bc
lea rcx, [rsp + 0x40]
call fcn.1000012b0
mov al, 1
jmp 0x1000162f8
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.100001100
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov dword [rsp + 0x58], 0x208
lea rcx, [rsp + 0x30]
call fcn.100005860
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x100022507
cmp dword [rsp + 0x38], 1
jne 0x100022507
mov bl, 1
jmp 0x10002250a
mov bl, sil
lea rcx, [rsp + 0x30]
call fcn.1000012b0
cmp bl, sil
je 0x1000225e4
mov word [rsp + 0x276], si
cmp word [rsp + 0x70], si
je 0x1000225e4
lea rcx, [rsp + 0x30]
call fcn.1000072f0
nop
lea rcx, [rsp + 0x30]
call fcn.100001680
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rcx, [rsp + 0x48]
call fcn.100005860
nop
lea rcx, [rsp + 0x48]
call fcn.100001680
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.100010d80
mov rcx, rax
lea rdx, [rsp + 0x48]
call fcn.100011498
mov rbx, rax
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov r11d, 8
mov word [rbx], r11w
lea rcx, [rsp + 0x70]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx + 8], rax
cmp rax, rsi
jne 0x1000225cf
mov eax, 0xa
mov word [rbx], ax
mov ecx, 0x8007000e
mov dword [rbx + 8], ecx
call fcn.1000242ec
nop
jmp 0x100023e95
lea rcx, [rsp + 0x48]
call fcn.1000012b0
nop
lea rcx, [rsp + 0x30]
call fcn.1000012b0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x40]
call fcn.1000012b0
mov al, 1
jmp 0x1000162f8
Function at 0x100016484
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
cmp qword [rcx + 0x70], 0
lea rax, vtable.ATL::CThreadPool_class_CThreadPoolWorker__class_ATL::CRTThreadTraits__class_ATL::Win32WaitTraits_.0
mov rbx, rcx
mov qword [rcx], rax
je 0x1000164fe
add rcx, 0x28
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r8d, dword [rbx + 0x54]
xor edx, edx
mov rcx, rbx
call fcn.100001fc8
mov esi, dword [rbx + 0x18]
sub esi, 1
movsxd rdi, esi
jns 0x10001db55
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbx + 0x70], 0
lea rcx, [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
test rcx, rcx
jne 0x10001dba1
mov rcx, qword [rbx + 0x10]
test rcx, rcx
jne 0x10001dbb1
and dword [rbx + 0x18], 0
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
test rdi, rdi
js 0x10001dbc1
cmp esi, dword [rbx + 0x18]
jge 0x10001dbc1
mov rax, qword [rbx + 0x10]
lea rdx, [rsp + 0x40]
mov rbp, qword [rax + rdi*8]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x40], 0x103
jne 0x10001db8a
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
dec esi
sub rdi, 1
js 0x1000164d1
jmp 0x10001db55
call qword [sym.imp.msvcrt.dll_free]
and qword [rbx + 8], 0
jmp 0x10001650b
call qword [sym.imp.msvcrt.dll_free]
and qword [rbx + 0x10], 0
jmp 0x100016518
xor r9d, r9d
xor r8d, r8d
mov ecx, 0xc000008c
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]
Function at 0x100024c2c
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x30
cmp r9d, 0x1d
ja 0x100024c8a
je 0x100024db7
sub r9d, 0xf
je 0x100024c7f
sub r9d, 1
je 0x100024db7
sub r9d, 4
je 0x100024db7
sub r9d, 6
je 0x100024db7
cmp r9d, 1
jne 0x100024cc0
add rcx, 0xffffffffffffff88
call fcn.100025a60
xor ebx, ebx
cmp al, bl
sete bl
mov eax, ebx
jmp 0x100024dbc
add rcx, 0xffffffffffffff88
call fcn.100025bc8
jmp 0x100024c71
cmp r9d, 0x2b
je 0x100024db7
cmp r9d, 0x43
je 0x100024db7
cmp r9d, 0x8e9
jbe 0x100024cc0
cmp r9d, 0x8eb
jbe 0x100024cb9
cmp r9d, 0x8fc
jne 0x100024cc0
xor eax, eax
jmp 0x100024dbc
movzx eax, word [rdx + 0x10]
cmp ax, 9
jne 0x100024d3f
mov ecx, SafeArrayLock
call qword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
cmp ax, bx
jge 0x100024db7
mov rcx, qword [0x100090140]
lea rdx, [rsp + 0x20]
call fcn.100003600
mov rcx, qword [rsp + 0x28]
cmp rcx, rbx
je 0x100024d10
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x900
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x20]
lock add dword [rcx], 0xffffffff
jne 0x100024cb9
mov rcx, qword [rsp + 0x28]
cmp rcx, rbx
je 0x100024d30
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x20]
call sub.msvcrt.dll_free
jmp 0x100024cb9
cmp ax, 0x74
je 0x100024cb9
cmp ax, 8
je 0x100024cb9
cmp ax, 0x25
je 0x100024cb9
cmp ax, 0x27
je 0x100024cb9
cmp ax, 0x26
je 0x100024cb9
cmp ax, 0x28
je 0x100024cb9
cmp ax, 0x21
je 0x100024cb9
cmp ax, 0x22
je 0x100024cb9
mov ecx, SafeArrayLock
call qword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
cmp ax, bx
jl 0x100024cb9
lea ecx, [rbx + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, bx
jl 0x100024cb9
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x100028dc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12d, ecx
lea rcx, [0x1000921d0]
xor edx, edx
xor ebx, ebx
call fcn.100055b68
lea r13d, [rbx + 1]
mov ebp, r13d
jmp 0x100028e9e
test rbx, rbx
jne 0x100028eaa
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, r13w
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rbx, rax
test rax, rax
je 0x100028e8d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100028e3a
xor ebx, ebx
jmp 0x100028e88
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x100028e36
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x100028e77
cmp rdi, r11
jae 0x100028e36
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x100028e65
cmp rdi, r11
jae 0x100028e36
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x100028eac
lea rcx, [0x1000921d0]
mov edx, ebp
call fcn.100055b68
add ebp, r13d
mov rsi, rax
test rax, rax
jne 0x100028df7
xor esi, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rax, rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x10002d7dc
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x100090120]
xor rax, rsp
mov qword [rsp + 0x270], rax
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
mov rdi, rcx
mov rcx, qword [rcx]
lea rax, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x10002d8e0
test rcx, rcx
je 0x10002d856
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
test ebx, ebx
mov qword [rsp + 0x48], rcx
jmp 0x10002d87c
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.10002d7dc
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x10002d8e0
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10002d864
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x10002d8ce
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x48], 0
mov rdx, rsi
mov rcx, rdi
call fcn.10002d940
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test rcx, rcx
je 0x10002d8eb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.100001100
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x10002e698
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x100090120]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r12, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
cmp rax, rbx
jne 0x10002e70c
call fcn.10002c050
mov ebx, eax
jmp 0x10002e84d
mov r8, r12
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
cmp rax, rbx
jne 0x10002e72f
call fcn.10002c050
mov ebx, eax
jmp 0x10002e843
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rsp + 0x40], rax
cmp rax, rbx
jne 0x10002e754
call fcn.10002c050
mov ebx, eax
jmp 0x10002e843
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jae 0x10002e78d
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x10002e783
lea rcx, [rsp + 0x70]
call fcn.10002ccc8
nop
mov eax, 0x8007000e
jmp 0x10002e866
mov ecx, eax
cmp rcx, rbx
je 0x10002e7cb
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x10002e7c1
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x10002e7cb
lea rcx, [rsp + 0x70]
call fcn.10002ccd8
mov rax, qword [rsp + 0x70]
jmp 0x10002e7d5
mov ecx, 0x80070057
call fcn.1000242ec
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x10002e7ec
cmp rax, rbx
jne 0x10002e7f8
mov ebx, 0x8007000e
jmp 0x10002e843
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
jne 0x10002e81f
call fcn.10002c050
mov ebx, eax
jmp 0x10002e843
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.10002e4d8
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x10002e864
lea rcx, [rsp + 0x70]
call fcn.10002ccc8
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.100001100
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret
Function at 0x100034210
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x199], 0
mov rbx, rcx
je 0x10003424a
mov byte [rcx + 0x198], 1
xor edi, edi
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
ja 0x1000342a5
cmp byte [rbx + 0x199], 0
jne 0x10003422f
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x1000342ae
lea rdx, [rsp + 0x20]
call fcn.1000352a0
mov r8d, dword [rbx + 0x94]
lea rdx, str.X_a
mov rcx, qword [rax]
call fcn.100018160
mov rcx, qword [rsp + 0x20]
mov dword [rbx + 0x94], 0xfefefefe
test rcx, rcx
je 0x10003428d
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x48]
mov dword [rax], 1
xor eax, eax
add rsp, 0x30
pop rdi
ret
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_exit]
int3
and dword [rsp + 0x40], 0
lea rdx, [0x1000788f0]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x1000347e0
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x30
mov r10, r8
mov rbx, rcx
test r9d, r9d
jne 0x10003487f
cmp byte [rcx + 0x198], r9b
jne 0x100034893
mov byte [rcx + 0x199], 1
mov rcx, qword [rcx + 0x98]
lea edx, [r9 + 5]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x138]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 8]
and dword [rsp + 0x20], 0
xor eax, eax
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], eax
call qword [sym.imp.USER32.dll_GetClientRect]
movzx eax, word [rsp + 0x28]
movzx r11d, word [rsp + 0x2c]
sub r11w, word [rsp + 0x24]
sub ax, word [rsp + 0x20]
mov rcx, qword [rbx + 8]
movzx r9d, r11w
movzx eax, ax
shl r9d, 0x10
or r9, rax
xor r8d, r8d
lea edx, [r8 + 5]
jmp 0x1000348f9
mov r8d, 0x64
cmp r9d, r8d
jne 0x100034893
mov byte [rcx + 0x199], 0
jmp 0x1000348ea
cmp byte [rcx + 0x199], 0
je 0x1000348e7
cmp byte [rcx + 0x198], 0
je 0x1000348e7
xor ecx, ecx
mov qword [rsp + 0x20], rcx
test r10, r10
je 0x1000348ca
mov rax, qword [r10]
lea r8, [rsp + 0x20]
lea rdx, str.hX_a
mov rcx, r10
call qword [rax]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1000348ff
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
jmp 0x1000348ff
movsxd r8, r9d
mov rcx, qword [rcx + 0x138]
mov edx, 0x402
xor r9d, r9d
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x10003ae6c
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov rbx, r8
mov rsi, rcx
mov rdi, qword [rsp + 0x60]
and dword [rdi], 0
lea rdx, [0x100066a5c]
lea rcx, [rsp + 0x50]
call fcn.100001740
nop
movzx eax, bx
cmp eax, 9
je 0x10003af2b
cmp eax, 0xd
je 0x10003aedc
cmp eax, 0x26
je 0x10003aed1
cmp eax, 0x28
je 0x10003aec6
cmp eax, 0x75
je 0x10003af2b
jmp 0x10003af65
mov dword [rdi], 1
jmp 0x10003af65
mov dword [rdi], 1
jmp 0x10003af65
mov edx, LoadRegTypeLib
lea rcx, [rsp + 0x50]
call fcn.1000017d0
mov r9, rax
mov edx, SafeArrayGetDim
mov r8d, LoadRegTypeLib
mov rcx, qword [rsi + 0x1c0]
call qword [sym.imp.USER32.dll_SendMessageW]
or edx, 0xffffffff
lea rcx, [rsp + 0x50]
call fcn.100001848
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, rsi
call fcn.10003b360
mov dword [rdi], 1
jmp 0x10003af65
mov rax, qword [0x100090140]
mov rcx, qword [rax + 0x90]
test rcx, rcx
je 0x10003af77
call fcn.100005790
test rax, rax
je 0x10003af5f
mov r9d, 1
xor r8d, r8d
mov edx, 0x900
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rdi], 1
movsxd rbx, dword [rdi]
lea rcx, [rsp + 0x50]
call fcn.1000012b0
mov rax, rbx
jmp 0x10003af8e
and dword [rsp + 0x60], 0
lea rdx, [0x1000788f0]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll__CxxThrowException
nop
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret