joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007c04
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x40
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x140244770]
test eax, eax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140244770]
test eax, eax
jne reloc.OLEAUT32.dll_VarI1FromDec
call fcn.140007d54
test eax, eax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x30]
mov rcx, qword [0x14023c8a0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne reloc.OLEAUT32.dll_VarI1FromDec
xor eax, eax
jmp reloc.OLEAUT32.dll_VarI1FromDec
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rsi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rsi, rax
mov qword [rsp + 0x38], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je reloc.OLEAUT32.dll_VarI1FromDec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp reloc.OLEAUT32.dll_VarI1FromDec
xor edi, edi
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je reloc.OLEAUT32.dll_VarI1FromDec
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret

Function at 0x14000a37c
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je reloc.OLEAUT32.dll_VarI1FromDec
xor r8d, r8d
call fcn.14000a640
mov rsi, rax
test rax, rax
jne reloc.OLEAUT32.dll_VarI1FromDec
mov eax, edi
jmp reloc.OLEAUT32.dll_VarI1FromDec
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp reloc.OLEAUT32.dll_VarI1FromDec
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000b0d4
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je reloc.OLEAUT32.dll_VarI1FromDec
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp reloc.OLEAUT32.dll_VarI1FromDec
cmp dword [rcx + 8], 0
je reloc.OLEAUT32.dll_VarI1FromDec
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp reloc.OLEAUT32.dll_VarI1FromDec
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14001d13c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, reloc.OLEAUT32.dll_VarI1FromDec
mov rax, qword [0x140242460]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rcx
mov rcx, qword [0x140247c80]
test rcx, rcx
jne reloc.OLEAUT32.dll_VarI1FromDec
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, str.SetDefaultDllDirectories
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140247c80], rax
jmp reloc.OLEAUT32.dll_VarI1FromDec
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rbx, rax
test rbx, rbx
je reloc.OLEAUT32.dll_VarI1FromDec
xor edx, edx
mov r8d, reloc.OLEAUT32.dll_VarI1FromDec
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp reloc.OLEAUT32.dll_VarI1FromDec
mov ebx, reloc.OLEAUT32.dll_VarI1FromDec
lea rcx, [rsp + 0x20]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne reloc.OLEAUT32.dll_VarI1FromDec
xor eax, eax
jmp reloc.OLEAUT32.dll_VarI1FromDec
lea rcx, [rsp + 0x20]
call fcn.14017c22c
cmp word [rsp + rax*2 + 0x1e], 0x5c
je reloc.OLEAUT32.dll_VarI1FromDec
lea r8, [0x1401a6af8]
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14017dc54
test eax, eax
jne reloc.OLEAUT32.dll_VarI1FromDec
lea rcx, [rsp + 0x20]
mov r8, rdi
mov rdx, rbx
call fcn.14017dc54
test eax, eax
jne reloc.OLEAUT32.dll_VarI1FromDec
lea rcx, [rsp + 0x20]
call fcn.140023848
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14017d2f0
mov rbx, qword [rsp + 0x258]
add rsp, reloc.OLEAUT32.dll_VarI1FromDec
pop rdi
ret
Function at 0x14001dda8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je reloc.OLEAUT32.dll_VarI1FromDec
call fcn.140024d98
mov r8d, 0xf0
mov rdx, rsi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, r14
call fcn.140029484
mov esi, eax
test rdi, rdi
je reloc.OLEAUT32.dll_VarI1FromDec
test rbx, rbx
je reloc.OLEAUT32.dll_VarI1FromDec
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14001f870
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.140027244
mov rdi, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je reloc.OLEAUT32.dll_VarI1FromDec
cmp dword [rbx], 0x40
jb reloc.OLEAUT32.dll_VarI1FromDec
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb reloc.OLEAUT32.dll_VarI1FromDec
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp reloc.OLEAUT32.dll_VarI1FromDec
or rax, reloc.OLEAUT32.dll_VarI1FromDec
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14002353c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x70
mov edi, r9d
mov rsi, r8
mov r14, rdx
mov r15d, ecx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x140244770]
test eax, eax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140244770]
test eax, eax
jne reloc.OLEAUT32.dll_VarI1FromDec
call fcn.140007d54
test eax, eax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x60]
mov rcx, qword [0x14023c8a0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne reloc.OLEAUT32.dll_VarI1FromDec
xor eax, eax
jmp reloc.OLEAUT32.dll_VarI1FromDec
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, rsi
mov rdx, r14
mov ecx, r15d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rsi, rax
mov qword [rsp + 0x68], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je reloc.OLEAUT32.dll_VarI1FromDec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp reloc.OLEAUT32.dll_VarI1FromDec
xor edi, edi
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je reloc.OLEAUT32.dll_VarI1FromDec
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x140023688
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov r14, rcx
and dword [rax - 0x18], 0
and qword [rax + 0x20], 0
xor ebx, ebx
mov eax, dword [0x140244770]
test eax, eax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140244770]
test eax, eax
jne reloc.OLEAUT32.dll_VarI1FromDec
call fcn.140007d54
test eax, eax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x58]
mov rcx, qword [0x14023c8a0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne reloc.OLEAUT32.dll_VarI1FromDec
xor eax, eax
jmp reloc.OLEAUT32.dll_VarI1FromDec
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.USER32.dll_GetClassInfoExW]
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test eax, eax
sete bl
test ebx, ebx
je reloc.OLEAUT32.dll_VarI1FromDec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp reloc.OLEAUT32.dll_VarI1FromDec
xor esi, esi
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je reloc.OLEAUT32.dll_VarI1FromDec
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x14002375c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140247c78]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140244770]
test eax, eax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140244770]
test eax, eax
jne reloc.OLEAUT32.dll_VarI1FromDec
call fcn.140007d54
test eax, eax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14023c8a0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne reloc.OLEAUT32.dll_VarI1FromDec
xor eax, eax
jmp reloc.OLEAUT32.dll_VarI1FromDec
test rbx, rbx
jne reloc.OLEAUT32.dll_VarI1FromDec
lea rcx, str.InitCommonControlsEx
call fcn.1400174f8
mov rbx, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov qword [0x140247c78], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je reloc.OLEAUT32.dll_VarI1FromDec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp reloc.OLEAUT32.dll_VarI1FromDec
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je reloc.OLEAUT32.dll_VarI1FromDec
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14002390c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, rcx
xor r14d, r14d
mov word [rax - 0x18], r14w
mov qword [rax + 0x10], r14
mov ebx, r14d
mov eax, dword [0x140244770]
test eax, eax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140244770]
test eax, eax
jne reloc.OLEAUT32.dll_VarI1FromDec
call fcn.140007d54
test eax, eax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14023c8a0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne reloc.OLEAUT32.dll_VarI1FromDec
movzx eax, r14w
jmp reloc.OLEAUT32.dll_VarI1FromDec
mov rcx, rdi
call qword [sym.imp.USER32.dll_RegisterClassW]
movzx ebx, ax
mov word [rsp + 0x20], ax
mov edi, r14d
test bx, bx
sete dil
test edi, edi
je reloc.OLEAUT32.dll_VarI1FromDec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp reloc.OLEAUT32.dll_VarI1FromDec
mov esi, r14d
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je reloc.OLEAUT32.dll_VarI1FromDec
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, bx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140023bd8
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
movsxd rsi, r8d
mov rbx, rdx
mov rdi, rcx
cmp qword [rcx + 0xc8], 0
jne reloc.OLEAUT32.dll_VarI1FromDec
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp reloc.OLEAUT32.dll_VarI1FromDec
call fcn.1400061cc
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne reloc.OLEAUT32.dll_VarI1FromDec
mov ecx, reloc.OLEAUT32.dll_VarI1FromDec
call fcn.140001d50
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rdi + 0xc8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + reloc.OLEAUT32.dll_VarI1FromDec]
mov rdx, rsi
or rdi, reloc.OLEAUT32.dll_VarI1FromDec
mov r9, rdi
mov r8, qword [rsp + 0x40]
mov rcx, rbx
call fcn.14017d190
test eax, eax
je reloc.OLEAUT32.dll_VarI1FromDec
cmp eax, 0xc
je reloc.OLEAUT32.dll_VarI1FromDec
cmp eax, 0x16
je reloc.OLEAUT32.dll_VarI1FromDec
cmp eax, 0x22
je reloc.OLEAUT32.dll_VarI1FromDec
cmp eax, 0x50
je reloc.OLEAUT32.dll_VarI1FromDec
call fcn.140004b20
int3
call fcn.140004b20
int3
call fcn.140004b44
int3
test rbx, rbx
je reloc.OLEAUT32.dll_VarI1FromDec
mov rcx, rbx
call fcn.14017c22c
mov rbx, rax
mov rdx, qword [rsp + 0x40]
add rdx, reloc.OLEAUT32.dll_VarI1FromDec
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
add ecx, edi
test ecx, ecx
jg reloc.OLEAUT32.dll_VarI1FromDec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14002c454
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rdx]
mov rbx, rdx
cmp dword [rcx - 0x10], 0
je reloc.OLEAUT32.dll_VarI1FromDec
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne reloc.OLEAUT32.dll_VarI1FromDec
lea rcx, [rdi + 0x120]
mov rdx, rbx
call fcn.1400af398
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14002c498
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je reloc.OLEAUT32.dll_VarI1FromDec
mov r8, rdx
mov rdx, qword [rbx]
call fcn.14000b0d4
jmp reloc.OLEAUT32.dll_VarI1FromDec
cmp byte [0x140248480], 0
jne reloc.OLEAUT32.dll_VarI1FromDec
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140248478], rax
jmp reloc.OLEAUT32.dll_VarI1FromDec
mov rax, qword [0x140248478]
mov byte [0x140248480], 1
jmp reloc.OLEAUT32.dll_VarI1FromDec
mov rax, qword [0x140248478]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp reloc.OLEAUT32.dll_VarI1FromDec
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400301f4
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movzx r14d, r8w
mov r15, rdx
mov r12, rcx
or r13d, reloc.OLEAUT32.dll_VarI1FromDec
movzx edi, r13w
mov word [rax - 0x38], r13w
mov rbx, qword [0x140248488]
and qword [rax + 0x20], 0
xor esi, esi
mov eax, dword [0x140244770]
test eax, eax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140244770]
test eax, eax
jne reloc.OLEAUT32.dll_VarI1FromDec
call fcn.140007d54
test eax, eax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x78]
mov rcx, qword [0x14023c8a0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne reloc.OLEAUT32.dll_VarI1FromDec
movzx eax, r13w
jmp reloc.OLEAUT32.dll_VarI1FromDec
test rbx, rbx
jne reloc.OLEAUT32.dll_VarI1FromDec
lea rcx, str.GetFileTitleW
call fcn.140030144
mov rbx, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov qword [0x140248488], rax
movzx r8d, r14w
mov rdx, r15
mov rcx, r12
call rbx
movzx edi, ax
mov word [rsp + 0x20], ax
xor ebx, ebx
cmp di, r13w
sete bl
test ebx, ebx
je reloc.OLEAUT32.dll_VarI1FromDec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp reloc.OLEAUT32.dll_VarI1FromDec
xor esi, esi
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je reloc.OLEAUT32.dll_VarI1FromDec
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, di
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400348f8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140248860]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140244770]
test eax, eax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140244770]
test eax, eax
jne reloc.OLEAUT32.dll_VarI1FromDec
call fcn.140007d54
test eax, eax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14023c8a0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne reloc.OLEAUT32.dll_VarI1FromDec
xor eax, eax
jmp reloc.OLEAUT32.dll_VarI1FromDec
test rbx, rbx
jne reloc.OLEAUT32.dll_VarI1FromDec
lea rcx, str.ImageList_GetImageCount
call fcn.1400174f8
mov rbx, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov qword [0x140248860], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je reloc.OLEAUT32.dll_VarI1FromDec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp reloc.OLEAUT32.dll_VarI1FromDec
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je reloc.OLEAUT32.dll_VarI1FromDec
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140039448
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r15, rcx
test r8, r8
jne reloc.OLEAUT32.dll_VarI1FromDec
call fcn.140024d98
mov rdi, qword [rax + 0x18]
lea r8, [0x1401ac310]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
jne reloc.OLEAUT32.dll_VarI1FromDec
xor eax, eax
jmp reloc.OLEAUT32.dll_VarI1FromDec
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r14
mov rcx, r15
mov r8d, eax
call fcn.140039500
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400a2388
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14024b0e8]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140244770]
test eax, eax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140244770]
test eax, eax
jne reloc.OLEAUT32.dll_VarI1FromDec
call fcn.140007d54
test eax, eax
je reloc.OLEAUT32.dll_VarI1FromDec
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14023c8a0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne reloc.OLEAUT32.dll_VarI1FromDec
xor eax, eax
jmp reloc.OLEAUT32.dll_VarI1FromDec
test rbx, rbx
jne reloc.OLEAUT32.dll_VarI1FromDec
lea rcx, str.ImageList_Destroy
call fcn.1400174f8
mov rbx, rax
test rax, rax
je reloc.OLEAUT32.dll_VarI1FromDec
mov qword [0x14024b0e8], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je reloc.OLEAUT32.dll_VarI1FromDec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp reloc.OLEAUT32.dll_VarI1FromDec
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je reloc.OLEAUT32.dll_VarI1FromDec
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
sub rsp, 0x28
cmp qword [rcx + 8], 0
jne reloc.OLEAUT32.dll_VarI1FromDec
xor eax, eax
add rsp, 0x28
ret
call fcn.1400d2dac
mov rcx, rax
add rsp, 0x28
jmp reloc.OLEAUT32.dll_VarI1FromDec