joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400de4d0
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x4c8]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0x4f0]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x4d8]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x1400de56f
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x1400de55e
nop dword [rax + rax]
cmp rax, rcx
je 0x1400de56f
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x1400de550
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x1400de56f
add rax, 0x18
ret
xor eax, eax
ret

Function at 0x1400de580
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x508]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0x530]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x518]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x1400de61f
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x1400de60e
nop dword [rax + rax]
cmp rax, rcx
je 0x1400de61f
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x1400de600
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x1400de61f
add rax, 0x18
ret
xor eax, eax
ret

Function at 0x1400df1c0
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x128]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
imul r9, r11
shr rax, 0x18
xor r9, rax
mov rax, qword [r10 + 0x100]
imul r9, r11
and r8, r9
shl r8, 4
add r8, qword [r10 + 0x110]
mov rcx, qword [r8 + 8]
cmp rcx, rax
je 0x1400df25c
mov r8, qword [r8]
cmp edx, dword [rcx + 0x10]
je 0x1400df25e
nop dword [rax + rax]
cmp rcx, r8
je 0x1400df25c
mov rcx, qword [rcx + 8]
cmp edx, dword [rcx + 0x10]
jne 0x1400df240
test rcx, rcx
cmove rcx, rax
cmp rcx, rax
setne al
ret
xor ecx, ecx
test rcx, rcx
cmove rcx, rax
cmp rcx, rax
setne al
ret
Function at 0x140108990
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movzx r14d, r9b
mov rbp, r8
mov edi, edx
mov rsi, rcx
call fcn.140109690
mov rbx, rax
test rax, rax
je case.0x140108a38.26
lea r15, [0x140000000]
movabs r13, 0xcbf29ce484222325
movabs r12, 0x100000001b3
mov rcx, qword [rbp + 0x38]
mov qword [rsp + 0x20], rbx
test rcx, rcx
je 0x140108bca
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + 0x10]
test al, al
jne 0x140108bbd
movzx edx, word [rbx + 0x3a]
mov eax, edx
cmp edx, 0x1168
ja 0x140108ade
je case.0x140108a38.23
add eax, 0xffffffe9
cmp eax, 0xa
ja case.0x140108a38.26
mov ecx, dword [r15 + rax*4 + 0x108bd0]
add rcx, r15
jmp rcx
mov eax, edi
movzx edx, dil
xor rdx, r13
shr eax, 8
imul rdx, r12
movzx ecx, al
mov eax, edi
xor rdx, rcx
shr eax, 0x10
imul rdx, r12
movzx ecx, al
xor rdx, rcx
mov eax, edi
mov rcx, qword [rsi + 0xa8]
imul rdx, r12
shr rax, 0x18
xor rdx, rax
imul rdx, r12
and rcx, rdx
mov rdx, qword [rsi + 0x80]
shl rcx, 4
add rcx, qword [rsi + 0x90]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x140108aba
mov rcx, qword [rcx]
cmp edi, dword [rax + 0x10]
je 0x140108aae
nop dword [rax]
cmp rax, rcx
je 0x140108aba
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x140108aa0
test rax, rax
cmove rax, rdx
cmp rax, rdx
jne case.0x140108a38.26
test r14b, r14b
je case.0x140108a38.26
mov rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x20]
sub rax, rcx
sar rax, 4
cmp rax, 2
jbe 0x140108bc4
movzx ecx, word [rcx + 0x20]
jmp 0x140108b02
cmp eax, 0x14ee
jne case.0x140108a38.26
mov rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x20]
sub rax, rcx
sar rax, 4
cmp rax, 1
jbe 0x140108bc4
movzx ecx, word [rcx + 0x10]
mov rax, qword [rbx]
mov edi, dword [rax + rcx*4]
mov edx, edi
mov rcx, rsi
call fcn.140109690
mov rbx, rax
test rax, rax
jne 0x1401089e4
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp edx, 0x21
jne 0x140108b47
test r14b, r14b
je case.0x140108a38.26
mov rcx, qword [rbx + 0x20]
mov edi, 1
mov r8, qword [rbx + 0x18]
mov rax, rcx
sub rax, r8
sar rax, 4
cmp rax, rdi
jbe case.0x140108a38.26
mov edx, edi
nop word [rax + rax]
sub rcx, r8
sar rcx, 4
cmp rcx, rdx
jbe 0x140108bc4
mov rax, qword [rbx]
add rdx, rdx
movzx r9d, r14b
movzx ecx, word [r8 + rdx*8]
mov r8, rbp
mov edx, dword [rax + rcx*4]
mov rcx, rsi
call fcn.140108990
test al, al
jne 0x140108bbd
mov rcx, qword [rbx + 0x20]
inc edi
mov r8, qword [rbx + 0x18]
mov rax, rcx
sub rax, r8
mov edx, edi
sar rax, 4
cmp rdx, rax
jb 0x140108b70
jmp case.0x140108a38.26
mov al, 1
jmp 0x140108b20
call fcn.140075ff0
int3
call fcn.140113b14
int3
Function at 0x140109690
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x1f8]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0x220]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x208]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x14010972f
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x14010971e
nop dword [rax + rax]
cmp rax, rcx
je 0x14010972f
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x140109710
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x14010972f
mov rax, qword [rax + 0x18]
ret
xor eax, eax
ret

Function at 0x140109770
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x548]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0x570]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x558]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x14010980f
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x1401097fe
nop dword [rax + rax]
cmp rax, rcx
je 0x14010980f
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x1401097f0
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x14010980f
add rax, 0x18
ret
lea rax, [r10 + 0x580]
ret

Function at 0x14010a3f0
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x1f8]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0x220]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x208]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x14010a48c
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x14010a48e
nop dword [rax + rax]
cmp rax, rcx
je 0x14010a48c
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x14010a470
test rax, rax
cmove rax, r8
cmp rax, r8
setne al
ret
xor eax, eax
test rax, rax
cmove rax, r8
cmp rax, r8
setne al
ret
Function at 0x14010a680
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x80]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0xa8]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x90]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x14010a71c
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x14010a71e
nop dword [rax + rax]
cmp rax, rcx
je 0x14010a71c
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x14010a700
test rax, rax
cmove rax, r8
cmp rax, r8
setne al
ret
xor eax, eax
test rax, rax
cmove rax, r8
cmp rax, r8
setne al
ret

Function at 0x14010c130
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
movabs r11, 0x100000001b3
movzx r9d, dl
mov r10, rcx
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
mov rbx, qword [r10 + 0x50]
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x40]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and r9, qword [r10 + 0x68]
mov r11, r9
shl r11, 4
add r11, rbx
mov rcx, qword [r11 + 8]
cmp rcx, r8
je 0x14010c215
mov rax, qword [r11]
cmp edx, dword [rcx + 0x10]
je 0x14010c1be
nop dword [rax + rax]
cmp rcx, rax
je 0x14010c215
mov rcx, qword [rcx + 8]
cmp edx, dword [rcx + 0x10]
jne 0x14010c1b0
test rcx, rcx
je 0x14010c215
add r9, r9
mov rax, qword [rbx + r9*8]
cmp qword [r11 + 8], rcx
jne 0x14010c1e9
cmp rax, rcx
jne 0x14010c1df
mov qword [rbx + r9*8], r8
mov qword [r11 + 8], r8
jmp 0x14010c1f5
mov r8, qword [rcx + 8]
mov qword [r11 + 8], r8
jmp 0x14010c1f5
cmp rax, rcx
jne 0x14010c1f5
mov rax, qword [rcx]
mov qword [rbx + r9*8], rax
mov rdx, qword [rcx]
dec qword [r10 + 0x48]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x18
call fcn.140116b70
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140110620
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x488]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0x4b0]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x498]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x1401106bf
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x1401106ae
nop dword [rax + rax]
cmp rax, rcx
je 0x1401106bf
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x1401106a0
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x1401106bf
mov rax, qword [rax + 0x18]
ret
xor eax, eax
ret
Function at 0x1401108b0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov r10d, r8d
mov rbx, rdx
mov r9, rcx
xor esi, esi
mov dword [rsp + 0x20], esi
mov qword [rdx], rsi
mov qword [rdx + 8], rsi
mov qword [rdx + 0x10], rsi
mov dword [rsp + 0x20], 1
movzx r8d, r8b
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rdx, 0x100000001b3
imul r8, rdx
mov eax, r10d
shr eax, 8
movzx ecx, al
xor r8, rcx
imul r8, rdx
mov eax, r10d
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, rdx
mov eax, r10d
shr rax, 0x18
xor r8, rax
imul r8, rdx
mov rcx, qword [r9 + 0xe8]
and rcx, r8
shl rcx, 4
add rcx, qword [r9 + 0xd0]
mov rax, qword [rcx + 8]
mov rdx, qword [r9 + 0xc0]
cmp rax, rdx
je 0x1401109c1
mov rcx, qword [rcx]
cmp r10d, dword [rax + 0x10]
je 0x140110975
cmp rax, rcx
je 0x1401109c1
mov rax, qword [rax + 8]
cmp r10d, dword [rax + 0x10]
jne 0x140110966
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x1401109c1
add rax, 0x18
cmp rbx, rax
je 0x1401109c1
mov rdi, qword [rax + 8]
mov rbp, qword [rax]
sub rdi, rbp
mov rdx, rdi
sar rdx, 3
test rdx, rdx
je 0x1401109ab
mov rcx, rbx
call fcn.140058b90
mov rsi, qword [rbx]
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call fcn.140118b40
lea rax, [rdi + rsi]
mov qword [rbx + 8], rax
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x14011d624
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14011d4b7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14011d4b7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14011d4b7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14011d4b7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14011d4b7
cmp dword [rcx + 0x84], 0xe
jbe 0x14011d4b7
cmp dword [rcx + 0xf8], 0
je 0x14011d4b7
mov ecx, ebx
call fcn.14011d558
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14011d348
cmp dword [rbp + 0x20], 0
je 0x14011d504
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14011d50c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14011d450

Function at 0x140138f94
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140138fb4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14011d27c
or eax, 0xffffffff
jmp 0x140138fb6
xor eax, eax
add rsp, 0x28
ret
Function at 0x140002a60
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x140002b15
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x140002ae1
lea rcx, str.Advapi32.dll
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x140002af9
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je case.default.0x140002af9
mov rdx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je case.default.0x140002af9
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.advapi32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x140034160], 0
jne 0x140002b60
lea rcx, str.Advapi32.dll
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x140002b50
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov qword [0x140034158], rax
mov byte [0x140034160], 1
jmp 0x140002b67
mov rax, qword [0x140034158]
mov byte [0x140034160], 1
jmp 0x140002b67
mov rax, qword [0x140034158]
mov rcx, qword [rbx]
mov rdx, rsi
test rax, rax
je 0x140002aea
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp rax
jo 0xe010be54
or byte [rax + 5], al
add byte [0x144d5540e], 0x80
invalid
Function at 0x1400039d0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140033018]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov qword [rsp + 0x48], rbp
mov r8, rdx
mov dword [rsp + 0x50], ebp
mov rdx, qword [rcx]
mov rdi, rcx
or r9d, 0x2001f
mov qword [rsp + 0x58], rbp
lea rcx, [rsp + 0x48]
call fcn.140003330
mov ebx, eax
test eax, eax
jne 0x140003ae7
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.advapi32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140003ac1
nop dword [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1400039d0
mov ebx, eax
test eax, eax
jne 0x140003ae7
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.advapi32.dll_RegEnumKeyExW]
test eax, eax
je 0x140003a70
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140003ad6
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov rdx, rsi
mov dword [rsp + 0x50], ebp
mov rcx, rdi
call fcn.140002a60
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140003af7
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14000e3e0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x140033018]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000408e
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000408e
call fcn.140002720
mov ebx, eax
jmp 0x1400041b3
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.kernel32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x1400040af
call fcn.140002720
jmp 0x1400041a2
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.kernel32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1400040d2
call fcn.140002720
jmp 0x1400041a2
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x1400040f4
mov ebx, 0x8007000e
jmp 0x1400041a4
mov ecx, eax
test eax, eax
je 0x140004129
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x1400041eb
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x140004129
lea rcx, [rsp + 0x70]
call fcn.140002600
jmp 0x140004133
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x140004146
cmp qword [rsp + 0x70], 0
jne 0x140004155
mov ebx, 0x8007000e
jmp 0x1400041a4
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.kernel32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14000417f
call fcn.140002720
jmp 0x1400041a2
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140003b20
mov ebx, eax
test rdi, rdi
je 0x1400041b3
mov rcx, rdi
call qword [sym.imp.kernel32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x1400041ca
lea rcx, [rsp + 0x70]
call fcn.140002ca0
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14000e3e0
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.140002750
int3
Function at 0x1400064e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.kernel32.dll_LoadResource]
test rax, rax
je 0x140006555
mov rcx, rax
call qword [sym.imp.kernel32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140006555
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.kernel32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140006545
nop
cmp rbx, rcx
jae 0x140006555
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140006530
cmp rbx, rcx
jae 0x140006555
cmp word [rbx], 0
je 0x140006555
mov rax, rbx
jmp 0x140006557
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140006790
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 8
mov dword [rsp + 0x24], 4
call qword [sym.imp.comctl32.dll_InitCommonControlsEx]
xor r9d, r9d
lea rcx, [0x140034180]
mov r8, rbx
xor edx, edx
call fcn.140002db0
call qword [sym.imp.kernel32.dll_GetCommandLineW]
mov rcx, rax
call fcn.140004fe0
mov rdi, qword [0x140034038]
mov esi, eax
lea rcx, [rdi + 0x18]
call qword [sym.imp.kernel32.dll_EnterCriticalSection]
mov rbx, qword [0x1400341e0]
test rbx, rbx
je 0x14000681f
cmp dword [rbx + 8], 0
jle 0x14000681f
mov rcx, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.user32.dll_DestroyWindow]
mov rbx, qword [0x1400341e0]
mov qword [rsp + 0x40], rbp
xor ebp, ebp
test rbx, rbx
je 0x14000684c
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000683b
call fcn.140012484
mov qword [rbx], rbp
mov edx, 0x10
mov qword [rbx + 8], rbp
mov rcx, rbx
call fcn.14000dd7c
lea rcx, [rdi + 0x18]
mov qword [0x1400341e0], rbp
call qword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov rbx, qword [0x1400341d8]
test rbx, rbx
je 0x14000689b
mov rcx, qword [rbx]
test rcx, rcx
je 0x140006879
call fcn.140012484
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000688b
call fcn.140012484
mov qword [rbx + 8], rbp
mov edx, 0x18
mov dword [rbx + 0x10], ebp
mov rcx, rbx
call fcn.14000dd7c
lea rcx, [0x140034180]
call fcn.140005a50
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rbp, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret