joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006b6b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x140
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140729900]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov r12d, r8d
mov rsi, rdx
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r15d, [r12 + rax]
mov byte [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], VariantTimeToSystemTime
lea rbx, str.NGIOStack::CHTTPClient::OpenSession
mov r9, rbx
lea r8, [0x140746c48]
mov rdx, qword [0x140746c40]
lea rcx, [rsp + 0x70]
call fcn.14000a880
nop
mov rcx, qword [r14 + 0x100]
test rcx, rcx
je 0x14006b888
mov rax, qword [rcx]
call qword [rax + 0x98]
test rax, rax
je 0x14006b7ff
mov rcx, qword [r14 + 0x100]
mov rax, qword [rcx]
call qword [rax + 0x98]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400109f0
nop
lea rcx, [rsp + 0x48]
call fcn.140017570
test al, al
je 0x14006b7f5
lea rcx, [0x1405fe978]
call fcn.140288ad0
mov r9, rax
xor r8d, r8d
lea rdx, [0x1405fe978]
lea rcx, [rsp + 0x48]
call fcn.140014110
cmp rax, 0xffffffffffffffff
je 0x14006b7f5
mov r9, qword [rsp + 0x58]
sub r9, rax
mov r8, rax
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x48]
call fcn.140013f90
mov rdi, rax
lea rbx, [r14 + 0x98]
cmp rbx, rax
je 0x14006b7e5
xor r8d, r8d
mov dl, 1
mov rcx, rbx
call fcn.140009e10
mov rdx, rdi
mov rcx, rbx
call fcn.1400118f0
nop
lea rcx, [rbp + 0x10]
call fcn.140009da0
lea rbx, str.NGIOStack::CHTTPClient::OpenSession
lea rcx, [rsp + 0x48]
call fcn.140009da0
mov rcx, qword [r14 + 0x100]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x38]
mov edi, eax
test eax, eax
je 0x14006b882
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
lea r9, str._s_m_pIDeviceConnection__Open_returned_0x_08X
mov edx, 0x80
lea r8d, [rdx + 0x4a]
lea rcx, [rsp + 0x70]
call fcn.14000acc0
cmp edi, 0x83e8f4fb
je 0x14006b87b
cmp edi, 0x83e8f4fc
jne 0x14006b8b0
mov dword [rsp + 0x78], 0x83e8f5f4
test r12d, r12d
je 0x14006b8a0
mov ecx, reloc.OLEAUT32.dll_SetErrorInfo
call qword [sym.imp.KERNEL32.dll_Sleep]
test rsi, rsi
je 0x14006b882
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test al, al
jne 0x14006b882
mov ebx, 0x83e8fffe
jmp 0x14006b88d
mov ebx, 0x83e8f5f3
jmp 0x14006b88d
mov ebx, dword [rsp + 0x78]
jmp 0x14006b891
mov ebx, 0x83e8f5fe
mov dword [rsp + 0x78], ebx
cmp ebx, 0x83e8f5f4
jne 0x14006b8d8
lea rbx, str.NGIOStack::CHTTPClient::OpenSession
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, r15d
jae 0x14006b8d4
jmp 0x14006b72d
cmp edi, 0x83e8f4fd
je 0x14006b8cd
mov ebx, 0x83e8fff4
mov eax, 0x83e8f5fc
cmp edi, ebx
cmovne ebx, eax
mov dword [rsp + 0x78], ebx
jmp 0x14006b8d8
mov ebx, 0x83e8fffe
jmp 0x14006b8c7
mov ebx, dword [rsp + 0x78]
lea rcx, [rsp + 0x70]
call fcn.14000a9d0
mov eax, ebx
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.1402812e0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400a2940
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x48
cmp dword [rcx + 0x138], 0
mov r11, rcx
mov rax, qword [rsp + 0x70]
je 0x1400a2988
mov rcx, qword [0x14072a9c0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r9
mov r9, rdx
mov rdx, qword [r11 + 0x140]
mov r10, qword [rcx]
mov dword [rsp + 0x20], r8d
mov r8b, byte [r11 + 0x149]
call qword [r10 + 0x60]
add rsp, 0x48
ret
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x70], rax
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_WriteFile]

Function at 0x1400a29a0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x48
cmp dword [rcx + 0x138], 0
mov r11, rcx
mov rax, qword [rsp + 0x70]
je 0x1400a29e8
mov rcx, qword [0x14072a9c0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r9
mov r9, rdx
mov rdx, qword [r11 + 0x140]
mov r10, qword [rcx]
mov dword [rsp + 0x20], r8d
mov r8b, byte [r11 + 0x148]
call qword [r10 + 0x58]
add rsp, 0x48
ret
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x70], rax
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_ReadFile]

Function at 0x1400a6418
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov r14, rdx
mov rsi, rcx
and dword [rax - 0x38], 0
call fcn.140009dc0
mov r15d, 1
mov dword [rsp + 0x20], r15d
mov rbx, qword [r14]
mov rax, qword [r14 + 8]
cmp rbx, rax
je 0x1400a6539
lea r12, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx edi, byte [rbx]
add rbx, r15
mov eax, edi
shr rax, 2
movzx r8d, word [r12 + rax*2]
mov rdx, r15
mov rcx, rsi
call fcn.140010d54
nop
mov rax, qword [r14 + 8]
and edi, 3
mov rdx, r15
mov rcx, rsi
cmp rbx, rax
je 0x1400a64fb
movzx ebp, byte [rbx]
add rbx, r15
mov eax, ebp
shr rax, 4
shl rdi, 4
or rax, rdi
movzx r8d, word [r12 + rax*2]
call fcn.140010d54
nop
mov rax, qword [r14 + 8]
and ebp, 0xf
mov rdx, r15
mov rcx, rsi
cmp rbx, rax
je 0x1400a64f4
movzx edi, byte [rbx]
add rbx, r15
mov eax, edi
shr rax, 6
shl rbp, 2
or rax, rbp
movzx r8d, word [r12 + rax*2]
call fcn.140010d54
mov eax, edi
and eax, 0x3f
movzx r8d, word [r12 + rax*2]
jmp 0x1400a6520
movzx r8d, word [r12 + rbp*8]
jmp 0x1400a6515
shl rdi, 5
movzx r8d, word [rdi + r12]
call fcn.140010d54
mov r8d, 0x3d
mov rdx, r15
mov rcx, rsi
call fcn.140010d54
mov r8d, 0x3d
mov rdx, r15
mov rcx, rsi
call fcn.140010d54
nop
mov rax, qword [r14 + 8]
cmp rbx, rax
jne 0x1400a646c
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400a781c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140729900]
xor rax, rsp
mov qword [rbp - 8], rax
mov esi, edx
mov rdi, rcx
mov qword [rbp - 0x30], rcx
xor r14d, r14d
mov dword [rbp - 0x40], r14d
lea rcx, [rbp - 0x28]
call fcn.140009dc0
nop
mov rbx, qword [rbp - 0x18]
lea edx, [r14 + 0x24]
cmp rbx, rdx
ja 0x1400a78a0
mov rcx, qword [rbp - 0x10]
cmp rcx, rdx
je 0x1400a78a0
jae 0x1400a788a
mov r8, rbx
lea rcx, [rbp - 0x28]
call fcn.14000a1c0
mov rcx, qword [rbp - 0x10]
mov qword [rbp - 0x18], rbx
lea rax, [rbp - 0x28]
cmp rcx, 8
cmovae rax, qword [rbp - 0x28]
mov word [rax + rbx*2], r14w
mov ecx, esi
mov eax, 0x66666667
imul ecx
mov ebx, edx
sar ebx, 2
mov eax, ebx
shr eax, 0x1f
add ebx, eax
lea eax, [rbx + rbx*4]
add eax, eax
sub ecx, eax
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
cdqe
lea rcx, [0x1405ed910]
movsx r8d, byte [rax + rcx]
mov edx, 1
lea rcx, [rbp - 0x28]
call fcn.140010d54
mov ecx, ebx
test ebx, ebx
jne 0x1400a78a2
test esi, esi
jns 0x1400a78f9
lea edx, [rbx + 1]
lea r8d, [rbx + 0x2d]
lea rcx, [rbp - 0x28]
call fcn.140010d54
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x18]
lea r8, [rcx + rax*2]
lea rdx, [rbp - 0x28]
cmovae rdx, qword [rbp - 0x28]
jmp 0x1400a7935
sub r8, 2
cmp rdx, r8
je 0x1400a793a
movzx ecx, word [rdx]
movzx eax, word [r8]
mov word [rdx], ax
mov word [r8], cx
add rdx, 2
cmp rdx, r8
jne 0x1400a791a
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.1400124e4
mov dword [rbp - 0x40], 1
lea rcx, [rbp - 0x28]
call fcn.140009da0
mov rax, rdi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1402812e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400a797c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140729900]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rbp - 0x30], rcx
xor r14d, r14d
mov dword [rbp - 0x40], r14d
lea rcx, [rbp - 0x28]
call fcn.140009dc0
nop
mov rbx, qword [rbp - 0x18]
lea edx, [r14 + 0x24]
cmp rbx, rdx
ja 0x1400a7a01
mov rcx, qword [rbp - 0x10]
cmp rcx, rdx
je 0x1400a7a01
jae 0x1400a79eb
mov r8, rbx
lea rcx, [rbp - 0x28]
call fcn.14000a1c0
mov rcx, qword [rbp - 0x10]
mov qword [rbp - 0x18], rbx
lea rax, [rbp - 0x28]
cmp rcx, 8
cmovae rax, qword [rbp - 0x28]
mov word [rax + rbx*2], r14w
mov rcx, rsi
movabs rax, 0x6666666666666667
imul rcx
mov rbx, rdx
sar rbx, 2
mov rax, rbx
shr rax, 0x3f
add rbx, rax
lea rax, [rbx + rbx*4]
add rax, rax
sub rcx, rax
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
cdqe
lea rcx, [0x1405ed910]
movsx r8d, byte [rax + rcx]
mov edx, 1
lea rcx, [rbp - 0x28]
call fcn.140010d54
mov rcx, rbx
test rbx, rbx
jne 0x1400a7a04
test rsi, rsi
jns 0x1400a7a6c
lea edx, [rbx + 1]
lea r8d, [rbx + 0x2d]
lea rcx, [rbp - 0x28]
call fcn.140010d54
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x18]
lea r8, [rcx + rax*2]
lea rdx, [rbp - 0x28]
cmovae rdx, qword [rbp - 0x28]
jmp 0x1400a7aa8
sub r8, 2
cmp rdx, r8
je 0x1400a7aad
movzx ecx, word [rdx]
movzx eax, word [r8]
mov word [rdx], ax
mov word [r8], cx
add rdx, 2
cmp rdx, r8
jne 0x1400a7a8d
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.1400124e4
mov dword [rbp - 0x40], 1
lea rcx, [rbp - 0x28]
call fcn.140009da0
mov rax, rdi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1402812e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400a7af0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140729900]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rbp - 0x30], rcx
xor r14d, r14d
mov dword [rbp - 0x40], r14d
lea rcx, [rbp - 0x28]
call fcn.140009dc0
nop
mov rbx, qword [rbp - 0x18]
lea edx, [r14 + 0x24]
cmp rbx, rdx
ja 0x1400a7b75
mov rcx, qword [rbp - 0x10]
cmp rcx, rdx
je 0x1400a7b75
jae 0x1400a7b5f
mov r8, rbx
lea rcx, [rbp - 0x28]
call fcn.14000a1c0
mov rcx, qword [rbp - 0x10]
mov qword [rbp - 0x18], rbx
lea rax, [rbp - 0x28]
cmp rcx, 8
cmovae rax, qword [rbp - 0x28]
mov word [rax + rbx*2], r14w
movabs rax, 0xcccccccccccccccd
mul rsi
mov rbx, rdx
shr rbx, 3
lea rax, [rbx + rbx*4]
add rax, rax
sub rsi, rax
mov eax, esi
cdq
xor eax, edx
sub eax, edx
cdqe
lea rcx, [0x1405ed910]
movsx r8d, byte [rax + rcx]
mov edx, 1
lea rcx, [rbp - 0x28]
call fcn.140010d54
mov rsi, rbx
test rbx, rbx
jne 0x1400a7b75
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x18]
lea r8, [rcx + rax*2]
lea rdx, [rbp - 0x28]
cmovae rdx, qword [rbp - 0x28]
jmp 0x1400a7bfa
sub r8, 2
cmp rdx, r8
je 0x1400a7bff
movzx ecx, word [rdx]
movzx eax, word [r8]
mov word [rdx], ax
mov word [r8], cx
add rdx, 2
cmp rdx, r8
jne 0x1400a7bdf
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.1400124e4
mov dword [rbp - 0x40], 1
lea rcx, [rbp - 0x28]
call fcn.140009da0
mov rax, rdi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1402812e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x1400ad800
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
xor ebx, ebx
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.1400a9180
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
sete al
xor al, 1
je 0x1400ad84d
inc ebx
lea rcx, [rsp + 0x28]
call fcn.14008f760
mov rcx, qword [rsp + 0x28]
test rcx, rcx
sete dl
xor dl, 1
jne 0x1400ad831
test rcx, rcx
je 0x1400ad858
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x1400d6ba8
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x38]
sub rsp, 0x130
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x140729900]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov ebx, 7
mov qword [rsp + 0x40], rbx
xor edi, edi
mov qword [rsp + 0x38], rdi
mov word [rsp + 0x28], di
lea r8d, [rbx + 0xe]
lea rdx, str.InstanceFinderDlg.exe
lea rcx, [rsp + 0x28]
call fcn.140009ed0
nop
xor edx, edx
lea rcx, [rbp - 0x38]
call fcn.1400153e8
nop
xor r9d, r9d
lea r8, [rsp + 0x28]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140014bfc
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x38]
call fcn.140009e10
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x28]
call fcn.140009e10
mov qword [rbp - 0x80], rbx
mov qword [rsp + 0x78], rdi
mov word [rsp + 0x68], di
lea r8d, [rbx - 5]
lea rdx, [0x140370e94]
lea rcx, [rsp + 0x68]
call fcn.140009ed0
nop
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rdi
mov word [rsp + 0x48], di
lea r8d, [rbx - 6]
lea rdx, [0x1405ff040]
lea rcx, [rsp + 0x48]
call fcn.140009ed0
nop
lea r8, [rbp - 0x58]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 8]
call fcn.14001c530
nop
lea r8, [rsp + 0x68]
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14001935c
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 0x78]
call fcn.1400192d0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x18]
call fcn.140009e10
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 8]
call fcn.140009e10
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.140009e10
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x68]
call fcn.140009e10
xor edx, edx
lea rcx, [rbp - 0x78]
call fcn.14001615c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x78]
call fcn.140009e10
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x58]
call fcn.140009e10
xor eax, eax
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.1402812e0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x1400ddcb0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x1400ddd2a
xor r8d, r8d
call fcn.1400ddf70
mov rsi, rax
test rax, rax
jne 0x1400ddce6
mov eax, edi
jmp 0x1400ddd40
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x1400ddce2
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400de2d0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
xor edi, edi
mov rbx, r9
mov r12, r8
mov r15, rdx
mov rsi, rcx
cmp qword [rcx + 0xb0], rdi
je 0x1400de352
xor r8d, r8d
call fcn.1400ddf70
mov rsi, rax
test rax, rax
je 0x1400de3eb
mov ecx, dword [rsp + 0x70]
mov r9d, 3
mov dword [rsp + 0x28], ecx
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rbx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete dil
mov eax, edi
jmp 0x1400de3eb
mov ebp, dword [rsp + 0x70]
mov eax, 2
lea ecx, [rbp*2 + 1]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d7300
mov r14, rax
mov r8d, edi
test ebp, ebp
je 0x1400de3b6
mov rdx, rax
mov r8d, ebp
mov r9d, ebp
mov al, byte [rbx]
and al, 0xf
movzx ecx, al
add cx, 0x41
mov word [rdx], cx
lea rdx, [rdx + 4]
mov al, byte [rbx]
inc rbx
shr al, 4
movzx ecx, al
add cx, 0x41
mov word [rdx - 2], cx
sub r9, 1
jne 0x1400de38b
lea eax, [r8 + r8]
mov word [r14 + rax*2], di
mov rax, qword [rsi]
mov rbx, qword [rax + 0x110]
mov rcx, rbx
call fcn.1402815a8
mov r9, r14
mov r8, r12
mov rdx, r15
mov rcx, rsi
call rbx
mov rcx, r14
mov ebx, eax
call fcn.1400d72f0
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret

Function at 0x1400deb94
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x1400dec07
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400dec1b
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1400dec1b
mov rcx, rax
call fcn.1402815a8
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rsi
mov rcx, rbp
call rdi
jmp 0x1400dec20
cmp dword [rcx + 8], 0
je 0x1400dec1b
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x1400dec20
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400e2460
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rdx]
cmp dword [rcx - 0x10], 0
je 0x1400e2492
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400e2492
lea rcx, [rdi + 0x120]
mov rdx, rbx
call fcn.1400f8340
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e24a4
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rsi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400e24cf
mov r8, rdx
mov rdx, qword [rdi]
call fcn.1400deb94
jmp 0x1400e2547
cmp byte [0x140736e88], 0
jne 0x1400e2516
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400e2506
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x140736e80], rax
jmp 0x1400e250d
mov rbx, qword [0x140736e80]
mov byte [0x140736e88], 1
jmp 0x1400e251d
mov rbx, qword [0x140736e80]
test rbx, rbx
je 0x1400e253b
mov rcx, rbx
call fcn.1402815a8
mov r8d, dword [rdi + 8]
xor r9d, r9d
mov rcx, qword [rdi]
mov rdx, rsi
call rbx
jmp 0x1400e2547
mov rcx, qword [rdi]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400ecc70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x1400eccd8
call fcn.1400db734
mov r8d, 0xf0
mov rdx, rsi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400eccd8
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x1400eccfa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, r14
call fcn.1400fb3cc
mov esi, eax
test rdi, rdi
je 0x1400eccf8
test rbx, rbx
je 0x1400eccf8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400edc28
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400edd00
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x1400edd00
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400edd00
test rsi, rsi
je 0x1400edd00
xor r15d, r15d
xor ebp, ebp
xor edi, edi
call fcn.1400db734
lea r8, str.AFX_DIALOG_LAYOUT
mov rdx, rsi
mov r14, qword [rax + 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x1400edccd
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rsi
mov rcx, r14
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x1400edd00
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
mov r8d, r15d
mov rdx, rbp
mov rcx, rbx
call fcn.1400fc1a8
mov esi, eax
test rbp, rbp
je 0x1400edcf0
test rdi, rdi
je 0x1400edcf0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
je 0x1400edcfc
mov rcx, rbx
call fcn.1400ed884
mov eax, esi
jmp 0x1400edd02
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400eeed0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x40]
call fcn.1400e0fd8
mov rdi, rax
test rax, rax
je 0x1400eef4c
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x1400eef47
cmp dword [rbx], 0x40
jb 0x1400eef47
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
or dword [rbx + 4], 1
xor r8d, r8d
or qword [rbx + 0x30], 0xffffffffffffffff
mov edx, 0x87
mov qword [rbx + 8], rcx
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x1400eef47
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x1400eef50
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f3ba4
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x70
mov edi, r9d
mov rsi, r8
mov r14, rdx
mov r15d, ecx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x140736d30]
test eax, eax
je 0x1400f3bf6
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140736d30]
test eax, eax
jne 0x1400f3bff
call fcn.1400da564
test eax, eax
je 0x1400f3c1b
lea rdx, [rsp + 0x60]
mov rcx, qword [0x1407284b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x1400f3c26
xor eax, eax
jmp 0x1400f3cd4
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, rsi
mov rdx, r14
mov ecx, r15d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rsi, rax
mov qword [rsp + 0x68], rax
xor ebx, ebx
test rsi, rsi
sete bl
test ebx, ebx
je 0x1400f3cb6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1400f3cb8
xor edi, edi
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400f3cd1
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret