joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140018598
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
xor edi, edi
mov rbx, r9
mov r12, r8
mov r15, rdx
mov rsi, rcx
cmp qword [rcx + 0xb0], rdi
je 0x14001861a
xor r8d, r8d
call fcn.140018124
mov rsi, rax
test rax, rax
je 0x1400186b3
mov ecx, dword [rsp + 0x70]
mov r9d, 3
mov dword [rsp + 0x28], ecx
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rbx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete dil
mov eax, edi
jmp 0x1400186b3
mov ebp, dword [rsp + 0x70]
mov eax, 2
lea ecx, [rbp*2 + 1]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14000d15c
mov r14, rax
mov r8d, edi
test ebp, ebp
je 0x14001867e
mov rdx, rax
mov r8d, ebp
mov r9d, ebp
mov al, byte [rbx]
and al, 0xf
movzx ecx, al
add cx, 0x41
mov word [rdx], cx
lea rdx, [rdx + 4]
mov al, byte [rbx]
inc rbx
shr al, 4
movzx ecx, al
add cx, 0x41
mov word [rdx - 2], cx
sub r9, 1
jne 0x140018653
lea eax, [r8 + r8]
mov word [r14 + rax*2], di
mov rax, qword [rsi]
mov rbx, qword [rax + 0x110]
mov rcx, rbx
call fcn.1402829ec
mov r9, r14
mov r8, r12
mov rdx, r15
mov rcx, rsi
call rbx
mov rcx, r14
mov ebx, eax
call fcn.14000d164
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret

Function at 0x140019558
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x1400195cb
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400195df
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1400195df
mov rcx, rax
call fcn.1402829ec
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rsi
mov rcx, rbp
call rdi
jmp 0x1400195e4
cmp dword [rcx + 8], 0
je 0x1400195df
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x1400195e4
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140020968
Capabilities:
Print debug messages

Disassembly:
mov rcx, qword [rcx + 0x40]
jmp 0x1400217d8
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140476250]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140475fd0]
test eax, eax
je 0x140021823
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140475fd0]
test eax, eax
jne 0x14002182c
call fcn.140015924
test eax, eax
je 0x140021848
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14046a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140021850
xor eax, eax
jmp 0x1400218b5
test rbx, rbx
jne 0x140021870
lea rcx, str.MakeDragList
call fcn.140020fc0
mov rbx, rax
test rax, rax
je 0x140021883
mov qword [0x140476250], rax
mov rcx, rbx
call fcn.1402829ec
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140021898
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14002189a
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400218b3
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14002117c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140476228]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140475fd0]
test eax, eax
je 0x1400211c7
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140475fd0]
test eax, eax
jne 0x1400211d0
call fcn.140015924
test eax, eax
je 0x1400211ec
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14046a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1400211f4
xor eax, eax
jmp 0x140021259
test rbx, rbx
jne 0x140021214
lea rcx, str.ImageList_Destroy
call fcn.140020fc0
mov rbx, rax
test rax, rax
je 0x140021227
mov qword [0x140476228], rax
mov rcx, rbx
call fcn.1402829ec
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14002123c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14002123e
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140021257
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140021270
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x50
mov r14d, r9d
mov r15d, r8d
mov r12, rdx
mov r13, rcx
xor esi, esi
mov qword [rax - 0x20], rsi
mov rbx, qword [0x140476230]
and qword [rax - 0x28], rsi
xor edi, edi
mov eax, dword [0x140475fd0]
test eax, eax
je 0x1400212cd
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140475fd0]
test eax, eax
jne 0x1400212d6
call fcn.140015924
test eax, eax
je 0x1400212f2
lea rdx, [rsp + 0x40]
mov rcx, qword [0x14046a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne edi, ecx
test edi, edi
jne 0x1400212fd
xor eax, eax
jmp 0x140021390
test rbx, rbx
jne 0x14002131d
lea rcx, str.ImageList_LoadImageW
call fcn.140020fc0
mov rbx, rax
test rax, rax
je 0x14002135c
mov qword [0x140476230], rax
mov rcx, rbx
call fcn.1402829ec
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
mov r9d, r14d
mov r8d, r15d
mov rdx, r12
mov rcx, r13
call rbx
mov rsi, rax
mov qword [rsp + 0x48], rax
xor ebx, ebx
test rsi, rsi
sete bl
test ebx, ebx
je 0x140021372
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140021374
xor edi, edi
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14002138d
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x1400214e4
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov qword [rax - 0x18], rdi
mov rbx, qword [0x140476238]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140475fd0]
test eax, eax
je 0x140021530
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140475fd0]
test eax, eax
jne 0x140021539
call fcn.140015924
test eax, eax
je 0x140021555
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14046a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14002155d
xor eax, eax
jmp 0x1400215c6
test rbx, rbx
jne 0x14002157d
lea rcx, str.ImageList_Read
call fcn.140020fc0
mov rbx, rax
test rax, rax
je 0x140021592
mov qword [0x140476238], rax
mov rcx, rbx
call fcn.1402829ec
mov rcx, r14
call rbx
mov rdi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
test rdi, rdi
sete bl
test ebx, ebx
je 0x1400215a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400215aa
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400215c3
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1400217d8
Capabilities:
Print debug messages

Disassembly:
mov rcx, qword [rcx + 0x40]
jmp 0x1400217d8
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140476250]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140475fd0]
test eax, eax
je 0x140021823
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140475fd0]
test eax, eax
jne 0x14002182c
call fcn.140015924
test eax, eax
je 0x140021848
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14046a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140021850
xor eax, eax
jmp 0x1400218b5
test rbx, rbx
jne 0x140021870
lea rcx, str.MakeDragList
call fcn.140020fc0
mov rbx, rax
test rax, rax
je 0x140021883
mov qword [0x140476250], rax
mov rcx, rbx
call fcn.1402829ec
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140021898
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14002189a
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400218b3
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140024b30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x140024b98
call fcn.140036380
mov r8d, 0xf0
mov rdx, rsi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140024b98
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x140024bba
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, r14
call fcn.140049cb4
mov esi, eax
test rdi, rdi
je 0x140024bb8
test rbx, rbx
je 0x140024bb8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140026510
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400265e8
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x1400265e8
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400265e8
test rsi, rsi
je 0x1400265e8
xor r15d, r15d
xor ebp, ebp
xor edi, edi
call fcn.140036380
lea r8, [0x14034e680]
mov rdx, rsi
mov r14, qword [rax + 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x1400265b5
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rsi
mov rcx, r14
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x1400265e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
mov r8d, r15d
mov rdx, rbp
mov rcx, rbx
call fcn.1400549e8
mov esi, eax
test rbp, rbp
je 0x1400265d8
test rdi, rdi
je 0x1400265d8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
je 0x1400265e4
mov rcx, rbx
call fcn.140025ff8
mov eax, esi
jmp 0x1400265ea
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140027838
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x40]
call fcn.140044320
mov rdi, rax
test rax, rax
je 0x1400278b4
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x1400278af
cmp dword [rbx], 0x40
jb 0x1400278af
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
or dword [rbx + 4], 1
xor r8d, r8d
or qword [rbx + 0x30], 0xffffffffffffffff
mov edx, 0x87
mov qword [rbx + 8], rcx
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x1400278af
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x1400278b8
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14002c66c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x70
mov edi, r9d
mov rsi, r8
mov r14, rdx
mov r15d, ecx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x140475fd0]
test eax, eax
je 0x14002c6be
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140475fd0]
test eax, eax
jne 0x14002c6c7
call fcn.140015924
test eax, eax
je 0x14002c6e3
lea rdx, [rsp + 0x60]
mov rcx, qword [0x14046a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14002c6ee
xor eax, eax
jmp 0x14002c79c
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, rsi
mov rdx, r14
mov ecx, r15d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rsi, rax
mov qword [rsp + 0x68], rax
xor ebx, ebx
test rsi, rsi
sete bl
test ebx, ebx
je 0x14002c77e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14002c780
xor edi, edi
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14002c799
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x14002c7b8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov r14, rcx
and dword [rax - 0x18], 0
and qword [rax + 0x20], 0
xor ebx, ebx
mov eax, dword [0x140475fd0]
test eax, eax
je 0x14002c802
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140475fd0]
test eax, eax
jne 0x14002c80b
call fcn.140015924
test eax, eax
je 0x14002c827
lea rdx, [rsp + 0x58]
mov rcx, qword [0x14046a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14002c82f
xor eax, eax
jmp 0x14002c876
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.USER32.dll_GetClassInfoExW]
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14002c859
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14002c85b
xor esi, esi
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14002c874
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x14002c88c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140479648]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140475fd0]
test eax, eax
je 0x14002c8d7
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140475fd0]
test eax, eax
jne 0x14002c8e0
call fcn.140015924
test eax, eax
je 0x14002c8fc
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14046a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14002c904
xor eax, eax
jmp 0x14002c969
test rbx, rbx
jne 0x14002c924
lea rcx, str.InitCommonControlsEx
call fcn.140020fc0
mov rbx, rax
test rax, rax
je 0x14002c937
mov qword [0x140479648], rax
mov rcx, rbx
call fcn.1402829ec
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14002c94c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14002c94e
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14002c967
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14002ca44
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, rcx
xor r14d, r14d
mov word [rax - 0x18], r14w
mov qword [rax + 0x10], r14
mov ebx, r14d
mov eax, dword [0x140475fd0]
test eax, eax
je 0x14002ca8c
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140475fd0]
test eax, eax
jne 0x14002ca95
call fcn.140015924
test eax, eax
je 0x14002cab1
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14046a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14002cabb
movzx eax, r14w
jmp 0x14002cb03
mov rcx, rdi
call qword [sym.imp.USER32.dll_RegisterClassW]
movzx ebx, ax
mov word [rsp + 0x20], ax
mov edi, r14d
test bx, bx
sete dil
test edi, edi
je 0x14002cae4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14002cae7
mov esi, r14d
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x14002cb00
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, bx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14002dafc
Capabilities:
Get graphical window text

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
movsxd rbp, r8d
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0xd0], 0
jne 0x14002db3d
mov r8d, ebp
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x14002dc1a
call fcn.14000dfe0
mov r14, rax
test rax, rax
jne 0x14002db55
mov ecx, 0x80004005
call fcn.1400069ec
int3
mov rax, qword [rax]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call fcn.1402829ec
mov rcx, r14
call rbx
add rax, 0x18
mov qword [rsp + 0x50], rax
mov rdi, qword [rdi + 0xd0]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x118]
mov rcx, rbx
call fcn.1402829ec
lea rdx, [rsp + 0x50]
mov rcx, rdi
call rbx
mov rdx, rbp
or rbx, 0xffffffffffffffff
mov r9, rbx
mov r8, qword [rsp + 0x50]
mov rcx, rsi
call fcn.1402b369c
test eax, eax
je 0x14002dbd6
cmp eax, 0xc
je 0x14002dbd0
cmp eax, 0x16
je 0x14002dbca
cmp eax, 0x22
je 0x14002dbca
cmp eax, 0x50
je 0x14002dbd6
call fcn.140010b4c
int3
call fcn.140010b4c
int3
call fcn.140010bc4
int3
test rsi, rsi
jne 0x14002dbdf
xor ebp, ebp
jmp 0x14002dbea
mov rcx, rsi
call fcn.1402b34e4
mov rbp, rax
mov rsi, qword [rsp + 0x50]
mov ecx, ebx
lock xadd dword [rsi - 8], ecx
add ecx, ebx
test ecx, ecx
jg 0x14002dc18
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call fcn.1402829ec
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
mov eax, ebp
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14002e9b8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
and dword [rax - 0x18], 0
and qword [rax + 0x18], 0
xor ebx, ebx
mov eax, dword [0x140475fd0]
test eax, eax
je 0x14002e9fa
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140475fd0]
test eax, eax
jne 0x14002ea03
call fcn.140015924
test eax, eax
je 0x14002ea1f
lea rdx, [rsp + 0x50]
mov rcx, qword [0x14046a4b0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14002ea27
xor eax, eax
jmp 0x14002ea6b
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14002ea4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14002ea50
xor esi, esi
mov rdx, qword [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14002ea69
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140037948
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbp
mov rsi, r8
mov rbx, rcx
lea rcx, [rax + 8]
call fcn.140007b48
nop
cmp rbx, 0xffffffff80000000
jne 0x1400379e1
call fcn.1400363fc
cmp eax, 1
jne 0x1400379e1
lea r8, [rsp + 0x50]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x60]
call fcn.140018b70
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14000b678
nop
mov r14, qword [rsp + 0x60]
or eax, 0xffffffff
lock xadd dword [r14 - 8], eax
sub eax, 1
jg 0x1400379da
mov rdi, qword [r14 - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call fcn.1402829ec
lea rdx, [r14 - 0x18]
mov rcx, rdi
call rbx
mov rbx, 0xffffffff80000001
test rsi, rsi
je 0x1400379f8
mov r8, qword [rsp + 0x50]
mov rdx, rbx
mov rcx, rsi
call fcn.140019558
jmp 0x140037a06
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebp, eax
mov rsi, qword [rsp + 0x50]
or eax, 0xffffffff
lock xadd dword [rsi - 8], eax
sub eax, 1
jg 0x140037a36
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call fcn.1402829ec
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
mov eax, ebp
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret