joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f41bc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor r12d, r12d
mov r9, rdx
mov rbx, rcx
cmp rdx, r12
je 0x1400f4326
cmp dword [rdx], r12d
jge 0x1400f420d
cmp dword [rdx + 4], r12d
jge 0x1400f420d
cmp dword [rdx + 8], r12d
jge 0x1400f420d
cmp dword [rdx + 0xc], r12d
jge 0x1400f420d
or eax, 0xffffffff
mov word [rcx + 0x9a], ax
jmp 0x1400f4326
mov r10d, r12d
mov eax, r10d
cdq
sub eax, edx
sar eax, 1
movsxd r8, eax
mov eax, r10d
inc r10d
cdq
and eax, 1
xor eax, edx
sub eax, edx
movsxd rcx, eax
mov eax, dword [r9]
add r9, 4
cmp r10d, 4
lea rdx, [rcx + r8*2 + 0x22]
mov dword [rbx + rdx*4], eax
jl 0x1400f4210
lea rdi, [rbx + 0x78]
mov ebp, 2
mov rcx, qword [rdi]
cmp rcx, r12
je 0x1400f4258
call qword [sym.imp.GDI32.dll_DeleteObject]
mov qword [rdi], r12
add rdi, 8
sub rbp, 1
jne 0x1400f424a
mov rax, qword [0x140134318]
cmp rax, r12
jne 0x1400f4281
lea ecx, [rbp + 5]
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [0x140134318], rax
mov ecx, dword [rbx + 0x8c]
mov r8d, 0x80000000
cmp ecx, r12d
jge 0x1400f42a2
cmp ecx, r8d
je 0x1400f42a2
mov qword [rbx + 0x78], rax
mov rax, qword [0x140134318]
mov edx, dword [rbx + 0x94]
cmp edx, r12d
jge 0x1400f42b9
cmp edx, r8d
je 0x1400f42b9
mov qword [rbx + 0x80], rax
cmp ecx, r12d
jl 0x1400f42c8
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov qword [rbx + 0x78], rax
mov ecx, dword [rbx + 0x94]
cmp ecx, r12d
jl 0x1400f42e0
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov qword [rbx + 0x80], rax
cmp word [rbx + 0x9a], r12w
jge 0x1400f42f2
mov word [rbx + 0x9a], r12w
mov eax, dword [rbx + 0x94]
cmp eax, r12d
jl 0x1400f4326
cmp eax, dword [rbx + 0x8c]
jne 0x1400f4326
mov eax, dword [rbx + 0x88]
cmp dword [rbx + 0x90], eax
jne 0x1400f4326
mov al, byte [rbx + 0xa4]
cmp al, r12b
jle 0x1400f4326
or al, 0x80
mov byte [rbx + 0xa4], al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1400f4788
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x80
mov rbp, rcx
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.USER32.dll_GetParent]
mov r12, rax
test rax, rax
je 0x1400f48e7
mov rcx, qword [rbp + 0xd0]
test rcx, rcx
je 0x1400f47ce
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x20]
and qword [rbp + 0xd0], 0
and dword [rsp + 0x50], 0
and dword [rsp + 0x54], 0
and dword [rsp + 0x58], 0
and dword [rsp + 0x5c], 0
lea rdx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetWindowRect]
and dword [rsp + 0xa0], 0
and dword [rsp + 0xa4], 0
lea rdx, [rsp + 0xa0]
mov rcx, r12
call qword [sym.imp.USER32.dll_ClientToScreen]
mov r8d, dword [rsp + 0xa4]
mov edx, dword [rsp + 0xa0]
mov esi, dword [rsp + 0x58]
mov edi, dword [rsp + 0x5c]
lea rcx, [rsp + 0x50]
sub esi, dword [rsp + 0x50]
sub edi, dword [rsp + 0x54]
neg r8d
neg edx
call qword [sym.imp.USER32.dll_OffsetRect]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r13, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, edi
mov edx, esi
mov rcx, r13
mov rbx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
lea rcx, [rsp + 0x60]
mov rdx, rbx
mov r8, rax
mov qword [rbp + 0xd0], rax
call fcn.140058f78
mov eax, dword [rsp + 0x54]
and qword [rsp + 0x60], 0
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x30], eax
mov r9d, esi
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], edi
call qword [sym.imp.GDI32.dll_BitBlt]
lea rcx, [rsp + 0x60]
call fcn.140058fcc
test rbx, rbx
je 0x1400f48d6
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteDC]
test r13, r13
je 0x1400f48e7
mov rdx, r13
mov rcx, r12
call qword [sym.imp.USER32.dll_ReleaseDC]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x1400f8a80
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x20
mov eax, 0xffdf
and cx, ax
mov eax, 0x41
cmp ax, cx
je 0x1400f8aa9
mov eax, 0x42
cmp ax, cx
je 0x1400f8aa9
mov eax, 0xfffffffe
jmp 0x1400f8ad2
mov word [rsp + 0x38], cx
mov eax, 0x3a
lea rcx, [rsp + 0x38]
xor ebx, ebx
mov word [rsp + 0x3a], ax
mov word [rsp + 0x3c], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
setne bl
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1400f8ba8
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [rsp + 0xc8]
mov qword [r11 - 0x30], rax
mov rax, qword [rsp + 0xc0]
mov qword [r11 - 0x38], rax
mov rax, qword [rsp + 0xb8]
mov qword [r11 - 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [r11 - 0x48], rax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x50], eax
jmp 0x1400f8c0e
add rsp, 0x78
ret
Function at 0x1400ffa74
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140102344
nop
cmp dword [0x140134568], 1
je 0x1400ffa20
mov dword [0x140134564], 1
mov byte [0x140134560], r12b
test ebx, ebx
jne 0x1400ffa0c
mov rcx, qword [0x1401356b0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400ff9f9
mov rcx, qword [0x1401356a8]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x1400ff998
call fcn.1400ff190
cmp qword [rdi], rax
jne 0x1400ff998
jmp 0x1400ff97e
cmp rdi, rsi
jb 0x1400ff9f9
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.1400ff190
mov qword [rdi], rax
call rbx
mov rcx, qword [0x1401356b0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x1401356a8]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x1400ff9d7
cmp r13, rax
je 0x1400ff9f7
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x1400ff97e
lea rdx, [0x140113340]
lea rcx, [0x140113328]
call fcn.1400ff7c8
lea rdx, [0x140113350]
lea rcx, [0x140113348]
call fcn.1400ff7c8
nop
test r12d, r12d
je 0x1400ffa2f
mov ecx, 8
call fcn.140102244
test r12d, r12d
jne 0x1400ffa5a
mov dword [0x140134568], 1
lea ecx, [r12 + 8]
call fcn.140102244
mov ecx, r15d
call fcn.1400ff75c
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400ff8e8

Function at 0x1400ffa80
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400ff8e8
Function at 0x14010ac7f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140131550]
jne 0x140101bca
rol rcx, 0x10
test cx, 0xffff
jne 0x140101bc6
repz ret
ror rcx, 0x10
jmp 0x14010abd8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140134f20]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140135018]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14010ac5d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140134f20]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14010ac7f
mov rax, qword [rsp + 0x88]
mov qword [0x140135018], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140134fb8], rax
mov rax, qword [0x140135018]
mov qword [0x140134e90], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140134fa0], rax
mov dword [0x140134e80], 0xc0000409
mov dword [0x140134e84], 1
mov rax, qword [0x140131550]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140131558]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140134f18], eax
mov ecx, 1
call fcn.140109dc4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1401268c0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140134f18], 0
jne 0x14010ad06
mov ecx, 1
call fcn.140109dc4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14010b880
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.1400ff190
xor ebx, ebx
mov rdi, rax
cmp qword [0x1401353f8], rbx
jne 0x14010b986
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14010ba5b
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14010ba5b
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x140126920]
mov rcx, rsi
mov qword [0x1401353f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140135400], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140135408], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140135418], rax
test rax, rax
je 0x14010b97d
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140135410], rax
jmp 0x14010b98d
mov rax, qword [0x140135410]
jmp 0x14010b994
mov rax, qword [0x140135410]
mov r11, qword [0x140135418]
cmp rax, rdi
je 0x14010b9fc
cmp r11, rdi
je 0x14010b9fc
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140135418]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14010b9fc
test rax, rax
je 0x14010b9fc
call rsi
test rax, rax
je 0x14010b9f6
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14010b9f6
test byte [rsp + 0x38], 1
jne 0x14010b9fc
bts ebp, 0x15
jmp 0x14010ba3a
mov rcx, qword [0x140135400]
cmp rcx, rdi
je 0x14010ba3a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14010ba3a
call rax
mov rbx, rax
test rax, rax
je 0x14010ba3a
mov rcx, qword [0x140135408]
cmp rcx, rdi
je 0x14010ba3a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14010ba3a
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1401353f8]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14010ba5b
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14010ba5d
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x141500058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1415001df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141500089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14150006f
add dl, dl
jne 0x141500096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415000f6
xor eax, eax
add dl, dl
jne 0x1415000a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415001ad
add dl, dl
jne 0x1415000b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415000c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415000d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415000dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1415000ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14150007e
mov eax, 1
add dl, dl
jne 0x141500106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141500113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1415000fb
sub eax, ebx
mov ebx, 1
jne 0x14150014c
mov ecx, 1
add dl, dl
jne 0x14150012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14150013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141500123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14150007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141500168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141500175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14150015d
cmp eax, 0x7d00
jae 0x14150019b
cmp eax, 0x500
jb 0x141500196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14150007e
cmp eax, 0x7f
ja 0x14150019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14150007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1415001d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14150007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1000106e4
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rsi
mov rdi, rdx
mov rsi, rcx
and qword [rsp + 0x58], 0
mov ecx, 0x38
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x10001074c
mov r8d, dword [rsi + 0xc]
lea rax, [0x100003548]
mov qword [rbx], rax
mov dword [rbx + 0x10], r8d
and qword [rbx + 0x20], 0
and dword [rbx + 0x30], 0
and qword [rbx + 0x18], 0
and qword [rbx + 8], 0
and qword [rbx + 0x28], 0
jmp 0x10001074e
xor ebx, ebx
mov qword [rdi], rbx
test rbx, rbx
je 0x1000107a0
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.100014ee0
mov edi, eax
test eax, eax
js 0x10001078c
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x100015188]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x28], rax
test edi, edi
js 0x1000107a5
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x1000107a5
mov qword [rsi + 0x50], rax
jmp 0x1000107a5
mov edi, 0x8007000e
lea rbx, [0x10001e150]
mov rcx, qword [0x10001e150]
cmp rcx, rbx
je 0x1000107e9
bt dword [rcx + 0x1c], 0x11
jae 0x1000107e9
cmp byte [rcx + 0x19], 4
jb 0x1000107e9
mov edx, 0xd
mov dword [rsp + 0x20], edi
mov r9d, dword [rsi + 0xc]
lea r8, [0x100002050]
mov rcx, qword [rcx + 0x10]
call fcn.10000fdc8
mov rcx, qword [0x10001e150]
test edi, edi
jns 0x100010817
cmp rcx, rbx
je 0x100010817
bt dword [rcx + 0x1c], 0x11
jae 0x100010817
cmp byte [rcx + 0x19], 2
jb 0x100010817
mov edx, 0xe
mov r9d, edi
lea r8, [0x100002050]
mov rcx, qword [rcx + 0x10]
call fcn.10000437c
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x100013e5c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13, rcx
mov r12d, edx
lea rcx, [0x10001e9e0]
xor edx, edx
xor ebx, ebx
call fcn.100017754
lea r14d, [rbx + 1]
mov ebp, r14d
jmp 0x100013f42
test rbx, rbx
jne 0x100013f4e
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, r14w
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExA]
mov rbx, rax
test rax, rax
je 0x100013f31
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100013ede
xor ebx, ebx
jmp 0x100013f2c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x100013eda
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x100013f1b
cmp rdi, r11
jae 0x100013eda
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x100013f09
cmp rdi, r11
jae 0x100013eda
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x100013f50
lea rcx, [0x10001e9e0]
mov edx, ebp
call fcn.100017754
add ebp, r14d
mov rsi, rax
test rax, rax
jne 0x100013e9b
xor esi, esi
test rsi, rsi
jne 0x100013f59
xor eax, eax
jmp 0x100013f67
mov r8d, r12d
mov rdx, rsi
mov rcx, r13
call fcn.1000140b8
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x1000140b8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov r14d, 1
shr eax, 4
mov ebx, r8d
mov rsi, rcx
add ax, r14w
lea r8d, [r14 + 5]
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor r13d, r13d
mov r12, rax
cmp rax, r13
je 0x10001422e
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, r13
je 0x10001422e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
cmp rax, r13
je 0x10001422e
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x100014164
cmp rdi, r11
jae 0x10001422e
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x10001414e
cmp rdi, r11
jae 0x10001422e
cmp word [rdi], r13w
je 0x10001422e
mov rax, qword [rsi]
movzx ebx, word [rdi]
mov ecx, r14d
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x100014196
mov edx, ebx
mov rcx, rsi
call fcn.100014270
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x1000141b7
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
add ecx, r14d
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call sub.msvcrt.dll_memcpy_s
cmp eax, r13d
je 0x100014206
cmp eax, 0xc
je 0x1000141fb
cmp eax, 0x16
je 0x1000141f0
cmp eax, 0x22
je 0x1000141f0
cmp eax, 0x50
je 0x100014206
mov ecx, 0x80004005
call fcn.100007bdc
int3
mov ecx, 0x80070057
call fcn.100007bdc
int3
mov ecx, 0x8007000e
call fcn.100007bdc
int3
cmp ebx, r13d
jl 0x100014223
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x100014223
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, r14d
mov word [rdi + rcx], r13w
jmp 0x100014230
mov ecx, 0x80070057
call fcn.100007bdc
int3
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x1000156f0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x8e0
mov rax, qword [0x10001e100]
xor rax, rsp
mov qword [rsp + 0x8d0], rax
mov rbp, qword [rsp + 0x930]
and qword [rsp + 0x48], 0
mov rsi, rcx
and dword [rbp], 0
mov eax, r8d
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x38], rcx
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov r12, r9
mov rdi, rdx
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x4d0]
mov rcx, rsi
mov edx, eax
mov dword [rsp + 0x40], 0x200
call qword [sym.imp.KERNEL32.dll_RegEnumKeyExW]
test eax, eax
je 0x10001577f
cmp eax, 0xea
je 0x10001577f
mov ebx, 0x887c003a
jmp 0x1000158b1
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ole32.dll_StringFromCLSID]
mov ebx, eax
test eax, eax
js 0x1000158b1
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x1000158b1
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x4d0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000157ed
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1000158b1
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x80]
mov rdx, rdi
call fcn.1000158e8
mov ebx, eax
test eax, eax
js 0x1000158a6
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4d0]
lea rdx, [0x1000036f0]
mov edi, 1
xor r8d, r8d
mov dword [rsp + 0x40], 0x400
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x4b0], edi
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
test eax, eax
je 0x100015865
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1000158a6
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov ebx, eax
test eax, eax
js 0x1000158a6
movdqu xmm0, xmmword [rsp + 0x68]
lea rdx, [rsp + 0x80]
mov rcx, r12
mov r8d, 0x444
movdqu xmmword [rsp + 0x4b4], xmm0
call sub.msvcrt.dll_memcpy
mov dword [rbp], edi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1000158c1
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, ebx
mov rcx, qword [rsp + 0x8d0]
xor rcx, rsp
call fcn.1000169f0
add rsp, 0x8e0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret