joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001e44
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
call fcn.180001e18
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180002089
cmp qword [rsp + 0x80], 0
je 0x180002089
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax + 0x88]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0
je 0x180002089
mov rax, qword [rsp + 0x30]
cmp dword [rax + 4], 0
je 0x180002089
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180002089
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x40], 0
je 0x180002089
cmp qword [rsp + 0x60], 0
je 0x180002089
cmp qword [rsp + 0x48], 0
je 0x180002089
movabs rax, 0x8000000000000000
mov rcx, qword [rsp + 0x80]
and rcx, rax
mov rax, rcx
test rax, rax
je 0x180001fac
mov rax, qword [rsp + 0x80]
and rax, 0xffff
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
jmp 0x180002089
mov dword [rsp + 0x20], 0
jmp 0x180001fc0
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x20], eax
jae 0x180002089
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x60]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x80]
sub rcx, rax
mov dl, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x180002010
inc rax
test dl, dl
jne 0x180001ffe
xor eax, eax
jmp 0x180002015
sbb eax, eax
or eax, 1
test eax, eax
jne 0x180002084
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov edx, dword [rdx]
cmp dword [rcx + rax*4], edx
jb 0x18000205d
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx]
mov rdx, qword [rsp + 0x30]
add ecx, dword [rdx + 4]
mov rdx, qword [rsp + 0x40]
cmp dword [rdx + rax*4], ecx
jbe 0x180002084
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
jmp 0x180002089
jmp 0x180001fb6
mov rax, qword [rsp + 0x50]
add rsp, 0x78
ret
Function at 0x140002b80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x230
mov rax, qword [0x1402b1940]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x200
call fcn.14020ee10
cmp byte [rbx], 0
mov edx, 0xe00
mov eax, 0x1000
mov dword [rbx + 0x14], 0
cmovne edx, eax
mov rcx, rdi
xor r8d, r8d
call fcn.1401e1b98
test eax, eax
jne 0x140002c86
mov r9, rdi
lea edx, [rax + 1]
mov r8d, 0x200
lea rcx, [rsp + 0x20]
call fcn.1401e1e94
cmp rax, 0x200
jne 0x140002c86
lea rcx, [rsp + 0x20]
call fcn.1400027f0
movzx eax, word [rsp + 0x21c]
mov ecx, 0xff
movzx r9d, word [rsp + 0x21e]
and ax, cx
mov word [rbx + 0xa], ax
mov edx, 0x15c1
movzx eax, word [rsp + 0x21a]
mov word [rbx + 0xc], ax
movzx eax, byte [rsp + 0x218]
mov word [rbx + 8], r9w
mov dword [rbx + 4], eax
lea r8d, [rax + rax]
lea ecx, [r8 + 4]
test ecx, ecx
je 0x140002c6d
lea rax, [rsp + 0x21e]
nop
add dx, word [rax]
lea rax, [rax - 2]
sub rcx, 1
jne 0x140002c60
mov ecx, r8d
lea rax, [rsp + 0x216]
add rcx, rcx
sub rax, rcx
cmp word [rax], dx
sete al
jmp 0x140002c8f
mov dword [rbx + 0x14], 0xffffffff
xor al, al
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1401b21e0
mov rbx, qword [rsp + 0x250]
add rsp, 0x230
pop rdi
ret
Function at 0x140002cb0
Capabilities:
Read file on windows

Disassembly:
push rdi
push r14
sub rsp, 0x448
mov rax, qword [0x1402b1940]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rdi, rdx
mov r14, rcx
xor edx, edx
lea rcx, [rsp + 0x220]
mov r8d, 0x200
call fcn.14020ee10
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x200
call fcn.14020ee10
cmp byte [rdi], 0
mov edx, 0x200
mov eax, 0x400
mov dword [rdi + 0x14], 0
cmovne edx, eax
mov rcx, r14
xor r8d, r8d
call fcn.1401e1b98
test eax, eax
jne 0x140002ea1
mov r9, r14
lea edx, [rax + 1]
mov r8d, 0x200
lea rcx, [rsp + 0x20]
call fcn.1401e1e94
cmp rax, 0x200
jne 0x140002ea1
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x440], rbp
call fcn.1400027f0
movzx eax, byte [rsp + 0x25]
movzx ebp, word [rsp + 0x22]
inc ax
movzx edx, byte [rsp + 0x24]
mov word [rdi + 0xc], dx
mov word [rdi + 0xa], ax
test ebp, ebp
je 0x140002e93
movzx ecx, ax
imul ecx, edx
cmp ebp, ecx
jne 0x140002e93
mov qword [rsp + 0x470], rbx
xor edx, edx
mov qword [rsp + 0x438], rsi
mov rcx, r14
mov esi, 2
mov qword [rsp + 0x430], r15
mov r8d, esi
call fcn.1401e1b98
mov rcx, r14
call fcn.1401e247c
xor r8d, r8d
xor edx, edx
mov rcx, r14
mov ebx, eax
call fcn.1401e1b98
xor ecx, ecx
mov eax, ebx
cmp byte [rdi], cl
cdq
setne cl
and edx, 0x1ff
add eax, edx
sar eax, 9
sub eax, ecx
cdq
idiv ebp
mov word [rdi + 8], ax
test edx, edx
je 0x140002df2
inc ax
mov word [rdi + 8], ax
xor ebp, ebp
mov byte [rdi + 1], 1
xor ebx, ebx
lea r15, [rsp + 0x28]
nop
movzx eax, word [r15 + rbx*4]
movzx ecx, word [rsp + rbx*4 + 0x26]
shl eax, 0x10
or eax, ecx
je 0x140002e78
xor edx, edx
mov rcx, r14
cmp byte [rdi], dl
setne dl
xor r8d, r8d
add edx, eax
shl edx, 9
call fcn.1401e1b98
test eax, eax
jne 0x140002e74
mov r9, r14
lea edx, [rax + 1]
mov r8d, 0x200
lea rcx, [rsp + 0x220]
call fcn.1401e1e94
cmp rax, 0x200
jne 0x140002e74
lea rcx, [rsp + 0x220]
call fcn.1400027f0
cmp word [rsp + 0x220], si
jne 0x140002e74
inc ebp
inc rbx
inc si
cmp rbx, 0x40
jl 0x140002e00
jmp 0x140002e78
mov byte [rdi + 1], 0
mov r15, qword [rsp + 0x430]
mov rsi, qword [rsp + 0x438]
mov rbx, qword [rsp + 0x470]
mov dword [rdi + 4], ebp
movzx eax, byte [rdi + 1]
mov rbp, qword [rsp + 0x440]
jmp 0x140002eaa
mov dword [rdi + 0x14], 0xffffffff
xor al, al
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.1401b21e0
add rsp, 0x448
pop r14
pop rdi
ret
Function at 0x140002ed0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1402b1940]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x200
call fcn.14020ee10
mov r9, rsi
mov dword [rbx + 0x14], 0
mov edx, 1
lea rcx, [rsp + 0x50]
mov r8d, 0x200
xor dil, dil
call fcn.1401e1e94
cmp rax, 0x200
jne 0x140002fdf
lea rcx, [rsp + 0x50]
call fcn.140002870
test al, al
je 0x140002f4d
mov byte [rbx], 1
jmp 0x140002f5d
xor r8d, r8d
mov byte [rbx], dil
xor edx, edx
mov rcx, rsi
call fcn.1401e1b98
movups xmm0, xmmword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rsi
movsd xmm1, qword [rbx + 0x10]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x38], xmm0
movsd qword [rsp + 0x30], xmm1
movsd qword [rsp + 0x48], xmm1
call fcn.140002b80
cmp dword [rsp + 0x34], 0xffffffff
je 0x140002fdb
test al, al
je 0x140002fab
movups xmm0, xmmword [rsp + 0x20]
mov dil, 1
movsd xmm1, qword [rsp + 0x30]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
jmp 0x140002fe6
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.140002cb0
cmp dword [rsp + 0x4c], 0xffffffff
je 0x140002fdb
test al, al
je 0x140002fe6
movups xmm0, xmmword [rsp + 0x38]
mov dil, 1
movsd xmm1, qword [rsp + 0x48]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
jmp 0x140002fe6
xor al, al
jmp 0x140002fea
mov dword [rbx + 0x14], 0xffffffff
movzx eax, dil
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1401b21e0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140005170
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
xor edi, edi
mov esi, 0x811c9dc5
mov rcx, qword [rdx]
add rcx, 0xffffffffffffffe8
cmp dword [rcx + 8], edi
je 0x140005275
call fcn.140009750
add rax, 0x18
mov qword [rsp + 0x30], rax
movsxd rbp, dword [rax - 0x10]
test ebp, ebp
js 0x140005291
lfence
mov rbx, qword [rsp + 0x30]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, ebp
or eax, ecx
jge 0x1400051e7
lfence
mov edx, ebp
lea rcx, [rsp + 0x30]
call fcn.1400094e0
mov rbx, qword [rsp + 0x30]
lea eax, [rbp + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.1401ebf88
cmp ebp, dword [rbx - 0xc]
jg 0x140005291
mov dword [rbx - 0x10], ebp
mov word [rbx + rbp*2], di
movsxd r10, dword [rbx - 0x10]
mov r8d, edi
test r10d, r10d
jle 0x140005245
mov rdx, rdi
test rdx, rdx
js 0x140005291
cmp r8d, r10d
jg 0x140005291
movzx ecx, word [rbx + rdx*2]
lea eax, [rcx + rdi]
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
xor ecx, esi
imul esi, ecx, 0x1000193
inc r8d
inc rdx
cmp rdx, r10
jl 0x140005214
lea eax, [rdi + rdi*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul edi, ecx, 0x8001
mov eax, 0xffffffff
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x140005275
lfence
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
ror esi, 0x13
xor esi, edi
mov eax, esi
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80070057
call fcn.140009870
int3

Function at 0x140008f10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140008f88
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140008f88
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140008f75
nop
cmp rbx, rcx
jae 0x140008f88
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140008f60
cmp rbx, rcx
jae 0x140008f88
cmp word [rbx], 0
je 0x140008f88
lfence
mov rax, rbx
jmp 0x140008f8a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140008fa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
shr eax, 4
mov edi, r8d
inc ax
mov rsi, rcx
movzx edx, ax
mov r8d, 6
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x1400090b3
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400090b3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400090b3
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140009045
nop word [rax + rax]
cmp rbx, rcx
jae 0x1400090b3
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140009030
cmp rbx, rcx
jae 0x1400090b3
cmp word [rbx], 0
je 0x1400090b3
movzx edi, word [rbx]
lfence
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or ecx, eax
jge 0x140009077
lfence
mov edx, edi
mov rcx, rsi
call fcn.1400094e0
movzx r9d, word [rbx]
lea r8, [rbx + 2]
mov rcx, qword [rsi]
mov rdx, rdi
call fcn.1401e2624
xor edx, edx
test eax, eax
je 0x14000909a
cmp eax, 0xc
je 0x1400090e1
cmp eax, 0x50
jne 0x1400090db
mov rcx, qword [rsi]
cmp edi, dword [rcx - 0xc]
jg 0x1400090d0
mov dword [rcx - 0x10], edi
mov eax, 1
mov rcx, qword [rsi]
mov word [rcx + rdi*2], dx
jmp 0x1400090b5
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov ecx, 0x80070057
call fcn.140009870
int3
call fcn.140015d94
int3
call fcn.140015db8
int3
Function at 0x1400090f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, edx
mov r14, rcx
mov ecx, edx
call fcn.1400160fc
mov rsi, rax
test rax, rax
je 0x14000920e
mov eax, edi
shr eax, 4
inc ax
movzx edx, ax
mov r8d, 6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x140009208
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140009208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140009208
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x14000919d
cmp rbx, rcx
jae 0x140009208
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140009188
cmp rbx, rcx
jae 0x140009208
cmp word [rbx], 0
je 0x140009208
movzx edi, word [rbx]
lfence
mov rax, qword [r14]
mov esi, 1
mov ecx, esi
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or ecx, eax
jge 0x1400091d1
lfence
mov edx, edi
mov rcx, r14
call fcn.1400094e0
lea r8, [rbx + 2]
movzx r9d, word [rbx]
mov rdx, rdi
mov rcx, qword [r14]
call fcn.1401e2624
xor ecx, ecx
test eax, eax
je 0x1400091f4
cmp eax, 0xc
je 0x14000923a
cmp eax, 0x50
jne 0x140009234
mov rax, qword [r14]
cmp edi, dword [rax - 0xc]
jg 0x140009229
mov dword [rax - 0x10], edi
mov rax, qword [r14]
mov word [rax + rdi*2], cx
jmp 0x14000920c
xor ecx, ecx
mov esi, ecx
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov ecx, 0x80070057
call fcn.140009870
int3
call fcn.140015d94
int3
call fcn.140015db8
int3
Function at 0x140011dc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_720
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
cmp rdx, 0x10000
jae 0x14002c073
cmp dword [rcx + 0xe8], 0
jne 0x14002c073
movzx eax, dx
mov dword [rcx + 0xe8], eax
call fcn.1400403a0
mov r8d, 5
mov rdx, rdi
mov rsi, qword [rax + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14002c0b7
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14002c0b7
mov r9, rsi
mov r8, rbp
mov rdx, rax
mov rcx, rbx
call fcn.14002c3f0
jmp 0x14002c0b9
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140014e84
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
or edx, 0xffffffff
mov rsi, rcx
call fcn.140045d68
xor ebx, ebx
test eax, eax
je 0x140014eee
mov rcx, rsi
mov edi, 0x811c9dc5
call fcn.1401e27f0
mov r8, rax
mov eax, 0xcccccccd
mul r8d
shr edx, 3
inc edx
test r8d, r8d
je 0x140014edc
lfence
movzx ecx, word [rsi + rbx*2]
add ebx, edx
imul edi, edi, 0x1000193
xor edi, ecx
cmp ebx, r8d
jb 0x140014ec9
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.140015d94
int3

Function at 0x140019a44
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r14, r9
mov rdi, r8
mov rsi, rdx
mov r15, rcx
test r8, r8
je 0x140019aac
call fcn.1400403a0
mov r8d, 0xf0
mov rdx, rdi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140019aac
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140019af2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
mov edi, 1
test rbx, rbx
je 0x140019ad1
mov rcx, qword [r15]
mov r9, r14
mov r8, rbx
mov rdx, rsi
mov rax, qword [rcx + 0x40]
mov rcx, r15
call qword [case.0x1400d81fd.0]
mov edi, eax
mov rcx, qword [rsi + 0xc8]
test rcx, rcx
je 0x140019af0
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x140]
mov rdx, r14
call qword [case.0x1400d81fd.0]
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14001a7e4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov r14, r8
mov rdi, rdx
mov r8, rcx
test rdx, rdx
je 0x14001a884
movzx eax, word [rdx]
mov r9d, ebx
test ax, ax
je 0x14001a884
movzx eax, ax
inc r9d
add rdx, rax
movzx eax, word [rdx]
test ax, ax
jne 0x14001a814
test r9d, r9d
je 0x14001a884
cmp r9d, 1
jne 0x14001a844
mov r8, r14
xor edx, edx
xor ecx, ecx
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
js 0x14001a89d
xor eax, eax
jmp 0x14001a887
lea esi, [r9 - 1]
mov rcx, rdi
test esi, esi
je 0x14001a860
mov edx, esi
movzx eax, word [rcx]
add bx, ax
add rcx, rax
sub rdx, 1
jne 0x14001a851
movzx edx, bx
mov rcx, r8
add edx, 2
call fcn.14001a744
movzx r8d, bx
mov rdx, rdi
mov rcx, rax
mov qword [r14], rax
call fcn.14020e750
mov eax, esi
jmp 0x14001a887
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
call fcn.140015d94
int3
Function at 0x14002b1a8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rdi, r9
mov rbx, r8
and qword [r9], 0
mov r14, qword [rbp + 0x40]
and dword [r14], 0
cmp qword [rcx + 0xb0], 0
je 0x14002b280
xor r8d, r8d
call fcn.14002b62c
mov rsi, rax
test rax, rax
je 0x14002b332
mov qword [rbp - 0x20], rsi
and dword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
and dword [rbp + 0x20], 0
and dword [rbp + 0x40], 0
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x20]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp + 0x40]
mov dword [r14], ecx
test eax, eax
jne 0x14002b264
call fcn.140009f40
mov qword [rdi], rax
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002b264
lea ebx, [rax + 1]
jmp 0x14002b272
mov rcx, qword [rdi]
call fcn.140009f50
and qword [rdi], 0
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14002b330
mov rax, qword [rcx]
and qword [rsp + 0x20], 0
mov r9, rbx
mov r8, rdx
lea rdx, [rbp + 0x40]
mov rax, qword [rax + 0x108]
call qword [case.0x1400d81fd.0]
nop
mov rax, qword [rbp + 0x40]
mov ecx, dword [rax - 0x10]
test ecx, ecx
jne 0x14002b2b0
xor ebx, ebx
jmp 0x14002b30c
shr ecx, 1
mov dword [r14], ecx
call fcn.140009f40
mov qword [rdi], rax
xor r8d, r8d
lea ebx, [r8 + 1]
cmp dword [r14], r8d
jbe 0x14002b308
lea ecx, [r8 + r8]
lea edx, [rcx + 1]
test edx, edx
js 0x14002b347
mov rax, qword [rbp + 0x40]
cmp edx, dword [rax - 0x10]
jg 0x14002b347
movsxd r9, ecx
movzx edx, word [rax + r9*2 + 2]
test ecx, ecx
js 0x14002b347
cmp ecx, dword [rax - 0x10]
jg 0x14002b347
shl dl, 4
sub dl, 0x51
add dl, byte [rax + r9*2]
mov rax, qword [rdi]
mov byte [r8 + rax], dl
add r8d, ebx
cmp r8d, dword [r14]
jb 0x14002b2c9
mov rax, qword [rbp + 0x40]
lea rdx, [rax - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14002b330
lfence
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x1400d81fd.0]
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x80070057
call fcn.140009870
int3
Function at 0x14002b354
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14002b3cf
xor r8d, r8d
call fcn.14002b62c
mov rsi, rax
test rax, rax
je 0x14002b3cb
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14002b3cb
mov eax, dword [rsp + 0x30]
jmp 0x14002b3e5
mov eax, edi
jmp 0x14002b3e5
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret