joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401416d0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140141540

Function at 0x140146927
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1401efd20]
jne 0x14013edda
rol rcx, 0x10
test cx, 0xffff
jne 0x14013edd6
repz ret
ror rcx, 0x10
jmp 0x140146880
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1401fbcd0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1401fbdc8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140146905
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1401fbcd0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140146927
mov rax, qword [rsp + 0x88]
mov qword [0x1401fbdc8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1401fbd68], rax
mov rax, qword [0x1401fbdc8]
mov qword [0x1401fbc40], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1401fbd50], rax
mov dword [0x1401fbc30], 0xc0000409
mov dword [0x1401fbc34], 1
mov rax, qword [0x1401efd20]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1401efd28]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1401fbcc8], eax
mov ecx, 1
call fcn.140152514
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1401b4758]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1401fbcc8], 0
jne 0x1401469ae
mov ecx, 1
call fcn.140152514
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140153470
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1401efd20]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1401450e8
xor ebx, ebx
cmp qword [0x1401fcce0], rbx
mov rdi, rax
jne 0x140153583
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14015365a
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14015365a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1401b63d8]
mov rcx, rsi
mov qword [0x1401fcce0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1401b63c0]
mov rcx, rsi
mov qword [0x1401fcce8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1401fccf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1401fcd00], rax
test rax, rax
je 0x14015357a
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1401fccf8], rax
jmp 0x14015358a
mov rax, qword [0x1401fccf8]
jmp 0x140153591
mov rax, qword [0x1401fccf8]
mov r11, qword [0x1401fcd00]
cmp rax, rdi
je 0x1401535f8
cmp r11, rdi
je 0x1401535f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1401fcd00]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1401535f8
test rax, rax
je 0x1401535f8
call rsi
test rax, rax
je 0x1401535f2
lea rcx, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1401535f2
test byte [rsp + 0x40], 1
jne 0x1401535f8
bts ebp, 0x15
jmp 0x140153638
mov rcx, qword [0x1401fcce8]
cmp rcx, rdi
je 0x140153638
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140153638
call rax
mov rbx, rax
test rax, rax
je 0x140153638
mov rcx, qword [0x1401fccf0]
cmp rcx, rdi
je 0x140153638
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140153638
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1401fcce0]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14015365a
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14015365c
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14013edc0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180001080
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor r9d, r9d
lea r8, str.Nigga_Security
lea rdx, str.Welcome_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov edi, 4
lea rax, [rsp + 0x40]
mov edx, edi
lea rcx, [0x1800032b0]
nop dword [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x1800010d0
mov r9d, edi
mov edx, 0x200
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x18000115f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_Allocate_memory___u__n
call fcn.180001010
mov eax, 0xffffffff
jmp 0x18000125a
lea rcx, [rsp + 0x40]
nop dword [rax]
nop dword [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdi, 1
jne 0x180001170
lea r9, [rsp + 0x30]
mov edx, 0x200
mov r8d, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800011fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_change_memory_protection___u__n
call fcn.180001010
mov eax, 0xfffffffe
jmp 0x18000125a
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x180001239
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_Create_the_thread___u__n
call fcn.180001010
mov eax, 0xfffffffd
jmp 0x18000125a
mov rdx, rbx
lea rcx, str._n_nalloc_mem_:__p_n
call fcn.180001010
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rbx
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180001290
mov rbx, qword [rsp + 0x260]
add rsp, 0x250
pop rdi
ret
Function at 0x1400045e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000462a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000462a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000462a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000462a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000462a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000462c
xor al, al
add rsp, 0x28
ret

Function at 0x6448a83b058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x6448a83b1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x6448a83b089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x6448a83b06f
add dl, dl
jne 0x6448a83b096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x6448a83b0f6
xor eax, eax
add dl, dl
jne 0x6448a83b0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x6448a83b1ad
add dl, dl
jne 0x6448a83b0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6448a83b0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6448a83b0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6448a83b0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x6448a83b0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x6448a83b07e
mov eax, 1
add dl, dl
jne 0x6448a83b106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6448a83b113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x6448a83b0fb
sub eax, ebx
mov ebx, 1
jne 0x6448a83b14c
mov ecx, 1
add dl, dl
jne 0x6448a83b12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x6448a83b13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x6448a83b123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x6448a83b07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x6448a83b168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x6448a83b175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x6448a83b15d
cmp eax, 0x7d00
jae 0x6448a83b19b
cmp eax, 0x500
jb 0x6448a83b196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x6448a83b07e
cmp eax, 0x7f
ja 0x6448a83b19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x6448a83b07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x6448a83b1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x6448a83b07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140003d48
Capabilities:
Check if file exists
Set global application hook

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x280
mov rax, qword [0x140276910]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0x290]
cmp qword [rax + 0x180], 0
je 0x140003da1
mov rax, qword [rsp + 0x290]
mov rcx, qword [rax + 0x180]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [rsp + 0x290]
mov qword [rax + 0x180], 0
xor eax, eax
mov word [rsp + 0x60], ax
lea rax, [rsp + 0x62]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, 2
imul rax, rax, 8
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0x12
jae 0x140003def
jmp 0x140003df4
call fcn.1401abc50
xor eax, eax
mov rcx, qword [rsp + 0x28]
mov word [rsp + rcx + 0x40], ax
mov eax, 2
imul rax, rax, 7
mov ecx, 0x6c
mov word [rsp + rax + 0x40], cx
mov eax, 2
imul rax, rax, 4
mov ecx, 0x2e
mov word [rsp + rax + 0x40], cx
mov eax, 2
imul rax, rax, 0
mov ecx, 0x64
mov word [rsp + rax + 0x40], cx
mov eax, 2
imul rax, rax, 6
mov ecx, 0x6c
mov word [rsp + rax + 0x40], cx
mov eax, 2
imul rax, rax, 2
mov ecx, reloc.OLEAUT32.dll_VarBstrFromDisp
mov word [rsp + rax + 0x40], cx
mov eax, 2
imul rax, rax, 3
mov ecx, 0x78
mov word [rsp + rax + 0x40], cx
mov eax, 2
imul rax, rax, 1
mov ecx, 0x64
mov word [rsp + rax + 0x40], cx
mov eax, 2
imul rax, rax, 5
mov ecx, 0x64
mov word [rsp + rax + 0x40], cx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140003fd4
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, qword [rsp + 0x290]
mov qword [rcx + 0x180], rax
mov rax, qword [rsp + 0x290]
cmp qword [rax + 0x180], 0
je 0x140003fd4
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x38], VarBstrFromDisp
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x38], 0x4d
mov eax, 1
imul rax, rax, 3
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 4
jae 0x140003f27
jmp 0x140003f2c
call fcn.1401abc50
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x38], 0
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x38], VarBstrFromDisp
lea rdx, [rsp + 0x38]
mov rax, qword [rsp + 0x290]
mov rcx, qword [rax + 0x180]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x290]
mov qword [rcx + 0x188], rax
mov rax, qword [rsp + 0x290]
cmp qword [rax + 0x188], 0
je 0x140003fd4
xor r9d, r9d
mov rax, qword [rsp + 0x290]
mov r8, qword [rax + 0x180]
mov rax, qword [rsp + 0x290]
mov rdx, qword [rax + 0x188]
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rcx, qword [rsp + 0x290]
mov qword [rcx + 0x190], rax
mov rax, qword [rsp + 0x290]
cmp qword [rax + 0x190], 0
je 0x140003fd4
mov dword [rsp + 0x20], 1
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1401abef0
add rsp, 0x280
pop rdi
ret
Function at 0x140007598
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
cmp rdx, 0x10000
jae 0x1400075d7
cmp dword [rcx + 0xe8], 0
jne 0x1400075d7
movzx eax, di
mov dword [rcx + 0xe8], eax
call fcn.140029054
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.140007990
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140007634
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
mov r15, rcx
xor edi, edi
call fcn.140029054
lea r8d, [rdi + 5]
mov rdx, rbx
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x140007690
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.1400076c8
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140008484
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x40
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x14027c3dc]
test eax, eax
je 0x1400084d6
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14027c3dc]
test eax, eax
jne 0x1400084df
call fcn.1400085d4
test eax, eax
je 0x1400084fb
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1402753c8]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x140008503
xor eax, eax
jmp 0x14000855b
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rsi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rsi, rax
mov qword [rsp + 0x38], rax
xor ebx, ebx
test rsi, rsi
sete bl
test ebx, ebx
je 0x14000853d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14000853f
xor edi, edi
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140008558
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret

Function at 0x14000b168
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14000b1e2
xor r8d, r8d
call fcn.14000b428
mov rsi, rax
test rax, rax
jne 0x14000b19e
mov eax, edi
jmp 0x14000b1f8
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x14000b19a
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000b77c
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
xor edi, edi
mov rbx, r9
mov r12, r8
mov r15, rdx
mov rsi, rcx
cmp qword [rcx + 0xb0], rdi
je 0x14000b7fe
xor r8d, r8d
call fcn.14000b428
mov rsi, rax
test rax, rax
je 0x14000b897
mov ecx, dword [rsp + 0x70]
mov r9d, 3
mov dword [rsp + 0x28], ecx
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rbx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete dil
mov eax, edi
jmp 0x14000b897
mov ebp, dword [rsp + 0x70]
mov eax, 2
lea ecx, [rbp*2 + 1]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140004cb4
mov r14, rax
mov r8d, edi
test ebp, ebp
je 0x14000b862
mov rdx, rax
mov r8d, ebp
mov r9d, ebp
mov al, byte [rbx]
and al, 0xf
movzx ecx, al
add cx, 0x41
mov word [rdx], cx
lea rdx, [rdx + 4]
mov al, byte [rbx]
inc rbx
shr al, 4
movzx ecx, al
add cx, 0x41
mov word [rdx - 2], cx
sub r9, 1
jne 0x14000b837
lea eax, [r8 + r8]
mov word [r14 + rax*2], di
mov rax, qword [rsi]
mov rbx, qword [rax + 0x110]
mov rcx, rbx
call fcn.1401ac27c
mov r9, r14
mov r8, r12
mov rdx, r15
mov rcx, rsi
call rbx
mov rcx, r14
mov ebx, eax
call fcn.140004cbc
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret

Function at 0x14000c090
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x14000c103
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000c117
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x14000c117
mov rcx, rax
call fcn.1401ac27c
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rsi
mov rcx, rbp
call rdi
jmp 0x14000c11c
cmp dword [rcx + 8], 0
je 0x14000c117
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14000c11c
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140020648
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x1400206b0
call fcn.140029054
mov r8d, 0xf0
mov rdx, rsi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400206b0
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x1400206d2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, r14
call fcn.14002df60
mov esi, eax
test rdi, rdi
je 0x1400206d0
test rbx, rbx
je 0x1400206d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400215a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140021678
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x140021678
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140021678
test rsi, rsi
je 0x140021678
xor r15d, r15d
xor ebp, ebp
xor edi, edi
call fcn.140029054
lea r8, str.AFX_DIALOG_LAYOUT
mov rdx, rsi
mov r14, qword [rax + 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x140021645
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rsi
mov rcx, r14
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x140021678
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
mov r8d, r15d
mov rdx, rbp
mov rcx, rbx
call fcn.1400c2068
mov esi, eax
test rbp, rbp
je 0x140021668
test rdi, rdi
je 0x140021668
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
je 0x140021674
mov rcx, rbx
call fcn.140021208
mov eax, esi
jmp 0x14002167a
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret