joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140029fd4
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1400ebe98]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov rsi, rcx
and qword [rbp - 0x40], 0
lea rcx, [rbp - 0x38]
call qword [sym.imp.MFC42u.dll_CDaoIndexFieldInfo::CDaoIndexFieldInfo]
nop dword [rax + rax]
nop
cmp dword [rsi + 0x188], 0
jne 0x14002a02a
mov ebx, 0x80070057
jmp 0x14002a1bc
lea rdx, [rdi + 0x160]
lea rcx, [rbp - 0x30]
call qword [sym.imp.MFC42u.dll_CControlBar::CControlBar]
nop dword [rax + rax]
nop
mov rax, qword [rbp - 0x30]
cmp dword [rax - 8], 0
jne 0x14002a056
mov ebx, 0x80004001
jmp 0x14002a1ab
mov r8, qword [rsi + 0x130]
add r8, 0xb8
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.140025608
mov ebx, eax
test eax, eax
jne 0x14002a1ab
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x38]
call qword [sym.imp.MFC42u.dll_AfxDeleteObject]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x20]
call sub.msvcrt.dll_free
lea r8, [rbp - 0x40]
lea edx, [rbx + 0x12]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.SHLWAPI.dll_SHCreateStreamOnFileW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14002a1ab
mov rcx, qword [rdi + reloc.MFC42u.dll_CDaoRecordView::CDaoRecordView]
mov r8d, dword [rcx + 0x140]
lea edi, [rax + 1]
mov ebx, 0x80070057
mov r9d, 0x80004005
mov r10d, 0x4d7
cmp r8d, r10d
je 0x14002a0e4
mov edx, ebx
jmp 0x14002a0fd
test byte [rcx + 0x160], dil
je 0x14002a0fa
mov eax, dword [rcx + 0x164]
mov dword [rbp - 0x20], eax
xor edx, edx
jmp 0x14002a0fd
mov edx, r9d
cmp r8d, r10d
jne 0x14002a11b
test byte [rcx + 0x160], 2
je 0x14002a118
mov eax, dword [rcx + 0x168]
mov dword [rbp - 0x1c], eax
xor ebx, ebx
jmp 0x14002a11b
mov ebx, r9d
test edx, edx
jne 0x14002a129
test ebx, ebx
jne 0x14002a129
lea rax, [rbp - 0x20]
jmp 0x14002a12b
xor eax, eax
mov rcx, qword [rsi + 0x130]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x40]
mov r8d, edi
mov rdx, qword [rsi + 0x190]
mov rcx, qword [rcx + 0xc0]
call fcn.140061d54
mov ebx, eax
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x14002a169
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str._N_b_]
and qword [rbp - 0x40], 0
mov rcx, qword [rbp - 0x38]
cmp dword [rcx - 8], 0
je 0x14002a184
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test ebx, ebx
jne 0x14002a1ab
test byte [0x1400ed740], 4
je 0x14002a1a9
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, edi
lea rdx, [0x1400a31f0]
call fcn.140016e58
xor ebx, ebx
lea rcx, [rbp - 0x30]
call qword [sym.imp.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef]
nop dword [rax + rax]
nop
lea rcx, [rbp - 0x38]
call qword [sym.imp.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef]
nop dword [rax + rax]
nop
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x14002a1e4
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [str._N_b_]
nop
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140083280
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002fba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 7
jne 0x14002fbde
mov r8, qword [rcx + 0x20]
lea rax, [rcx + 8]
cmp r8, 8
jb 0x14002fbbe
mov r9, qword [rax]
jmp 0x14002fbc1
mov r9, rax
cmp word [r9], 0x23
jne 0x14002fbde
cmp r8, 8
jb 0x14002fbd1
mov rax, qword [rax]
lea rcx, [rax + 2]
add rsp, 0x28
jmp fcn.140055efc
cmp qword [rcx + 0x20], 8
lea r9, [rcx + 8]
jb 0x14002fbec
mov r9, qword [r9]
mov r8d, 0xd6
lea rdx, str.COdtAttributeParser::OdtColorRefFromColor
lea rcx, str.Error:_Func__s_Line__d:_invalid_value__ws
call fcn.14005618c
mov eax, 0x80070057
add rsp, 0x28
ret
Function at 0x14003e830
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400ebe98]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
call fcn.14003e560
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, [rsp + 0x20]
mov ecx, COleDropTarget::XDropTarget::AddRef
lea edx, [r9 + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
nop dword [rax + rax]
mov edi, 1
test eax, eax
je 0x14003e88b
mov eax, 0x800
test word [rsp + 0x2e], ax
je 0x14003e88b
mov al, dil
jmp 0x14003e88d
xor al, al
mov byte [0x1400ed7c8], al
lea rcx, [0x1400ed890]
lea rax, [rbx + 0xc0]
mov qword [0x1400ee050], rax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
nop dword [rax + rax]
mov r9d, 2
lea r8, [0x1400ebeb8]
mov edx, 0x20001009
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
nop dword [rax + rax]
mov ecx, dword [0x1400ebeb8]
test eax, eax
cmove ecx, edi
cmp byte [0x1400ed7c8], 0
mov dword [0x1400ebeb8], ecx
je 0x14003e95b
test byte [0x1400ed7da], dil
je 0x14003e95b
mov rcx, qword [0x1400ee050]
mov edx, 0xffffffec
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
nop dword [rax + rax]
bt rax, 0x16
jb 0x14003e95b
mov rcx, qword [0x1400ee050]
mov edx, 0xffffffec
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
nop dword [rax + rax]
mov rcx, qword [0x1400ee050]
mov edx, 0xffffffec
or rax, 0x7000
mov r8, rax
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
nop dword [rax + rax]
mov r8d, edi
lea rcx, [0x14003ea00]
mov edx, COleDropTarget::XDropTarget::AddRef
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
nop dword [rax + rax]
mov edx, COleDropTarget::XDropTarget::AddRef
lea rcx, [0x14003ea00]
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
nop dword [rax + rax]
xor r8d, r8d
lea rcx, [0x14003eaf0]
mov edx, COleDropTarget::XDropTarget::AddRef
call qword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x100]
xor r9d, r9d
and qword [0x1400ee050], 0
xor r8d, r8d
mov edx, 0x186
call qword [sym.imp.USER32.dll_SendMessageW]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140083280
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14003ec34
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r14
sub rsp, 0xc0
mov rax, qword [0x1400ebe98]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, r8
mov rbp, rcx
call qword [sym.imp.MFC42u.dll_RFX_Date_Bulk]
nop dword [rax + rax]
xor r14d, r14d
mov rsi, rax
cmp dword [rbp], r14d
je 0x14003ed00
lea r8d, [r14 + 0x40]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowTextW]
nop dword [rax + rax]
cmp word [rsp + 0x30], r14w
je 0x14003ecf8
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14004bc44
test eax, eax
jne 0x14003ecce
or r8d, 0xffffffff
lea edx, [rax + 0x40]
lea ecx, [rax + 0x67]
call qword [sym.imp.MFC42u.dll_Ordinal_1498]
nop dword [rax + rax]
mov rcx, rbp
call qword [sym.imp.MFC42u.dll_CGopherFileFind::FindFile]
nop dword [rax + rax]
mov r9d, dword [rbx]
lea rdx, [rsp + 0x30]
mov r8d, 0x40
call fcn.14004bd90
cmp word [rsp + 0x30], r14w
je 0x14003ed2f
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14004bc44
jmp 0x14003ed2f
mov dword [rbx], 0x7fffffff
jmp 0x14003ed2f
cmp dword [rbx], 0x7fffffff
je 0x14003ed2f
mov r9d, dword [rbx]
lea rdx, [rsp + 0x30]
mov r8d, 0x40
call fcn.14004bd90
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetWindowTextW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140083280
mov rbx, qword [rsp + 0xf8]
add rsp, 0xc0
pop r14
pop rsi
pop rbp
ret

Function at 0x14003f440
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1400ebe98]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor esi, esi
cmp dword [0x1400ee058], esi
jne 0x14003f541
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, CSocketFile::CSocketFile
call sub.msvcrt.dll_memset
mov edi, esi
lea rbx, [0x1400ec598]
cmp dword [rbx - 8], esi
jne 0x14003f523
cmp qword [rbx], rsi
je 0x14003f523
mov r8d, 0x104
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
nop dword [rax + rax]
test eax, eax
je 0x14003f504
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
nop dword [rax + rax]
test rax, rax
je 0x14003f504
mov word [rax], si
lea rcx, [rsp + 0x20]
mov r8, qword [rbx]
mov edx, 0x104
call fcn.140009d14
movzx edi, ax
test edi, edi
jne 0x14003f520
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
mov edi, eax
and edi, 0x10
test edi, edi
jne 0x14003f520
movsxd rdx, dword [rbx + 8]
lea r8, [rsp + 0x20]
mov rcx, qword [rbx]
call fcn.140009c88
movzx edi, ax
test edi, edi
je 0x14003f523
mov qword [rbx], rsi
add rbx, 0x50
lea rax, [0x1400eca48]
cmp rbx, rax
jl 0x14003f48d
mov dword [0x1400ee058], 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140083280
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14004ddd8
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rdi
sub rsp, 0x40
xor ebx, ebx
mov dword [rax + 0x10], ebx
test rcx, rcx
je 0x14004de7f
mov qword [rax - 0x18], rbx
lea r8d, [rbx + 3]
mov dword [rax - 0x20], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rax - 0x28], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14004de7f
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], rbx
lea r8d, [rbx + 2]
mov rcx, rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
je 0x14004de6c
cmp dword [rsp + 0x58], 2
jne 0x14004de6c
mov eax, 0xfeff
cmp word [rsp + 0x50], ax
je 0x14004de67
mov eax, 0xfffe
cmp word [rsp + 0x50], ax
jne 0x14004de6c
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov eax, ebx
jmp 0x14004de81
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400526a0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x1400ebe98]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov r12, rdx
mov rbx, rcx
mov rcx, r12
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
xor r14d, r14d
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
nop dword [rax + rax]
mov rcx, rbx
mov r15d, eax
call fcn.1400044dc
mov rcx, qword [rbx + 0x40]
lea r9, [rsp + 0x30]
and dword [rsp + 0x3c], r14d
xor r8d, r8d
mov edx, 0x434
mov dword [rsp + 0x38], eax
call qword [sym.imp.USER32.dll_SendMessageW]
nop dword [rax + rax]
xor edi, edi
test r15d, r15d
je 0x1400527e2
mov r9d, 0x104
lea r8, [rsp + 0x40]
mov edx, edi
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
nop dword [rax + rax]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0x10
je 0x1400527d7
mov eax, dword [rsp + 0x34]
lea r9, [rsp + 0x30]
mov rcx, qword [rbx + 0x40]
xor r8d, r8d
mov edx, CObList::AddTail
mov dword [rsp + 0x30], eax
call qword [sym.imp.USER32.dll_SendMessageW]
nop dword [rax + rax]
lea rcx, [rsp + 0x40]
mov esi, 1
call fcn.1400553c4
test eax, eax
je 0x1400527b5
and dword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov r9d, esi
mov rcx, rbx
call fcn.140004814
mov esi, eax
cmp r15d, 1
jne 0x1400527c6
xor r14d, r14d
test esi, esi
sete r14b
jmp 0x1400527d7
test esi, esi
je 0x1400527d7
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140006940
inc edi
cmp edi, r15d
jb 0x14005272f
mov rcx, qword [rbx + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, CObList::AddTail
call qword [sym.imp.USER32.dll_SendMessageW]
nop dword [rax + rax]
mov eax, r14d
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140083280
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140056238
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1400ebe98]
xor rax, rsp
mov qword [rsp + 0x230], rax
and qword [rdx], 0
mov rbx, rcx
mov ecx, CSocketFile::CSocketFile
mov rsi, rdx
call fcn.140082d90
mov rdi, rax
test rax, rax
jne 0x1400562a2
lea r9, [0x1400a3ca8]
mov r8d, 0x2e6
lea rdx, str.GetTempDirFile
lea rcx, str.Error:_Func__s_Line__d:_Out_of_memory_for_temp_file_name
call fcn.14005618c
mov eax, 0x8007000e
jmp 0x140056348
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
nop dword [rax + rax]
dec eax
cmp eax, 0x103
ja 0x1400562fa
mov r9, rdi
lea rcx, [rsp + 0x20]
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
nop dword [rax + rax]
test eax, eax
jne 0x140056343
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea rcx, str.Error:_Func__s_Line__d:_GetTempFileName_failed
mov r8d, 0x2f3
jmp 0x140056313
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea rcx, str.Error:_Func__s_Line__d:_GetTempPath_failed
mov r8d, 0x2ee
lea r9, [0x1400a3ca8]
mov ebx, eax
lea rdx, str.GetTempDirFile
call fcn.14005618c
test ebx, ebx
je 0x140056343
mov rcx, rdi
call sub.msvcrt.dll_free
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x140056348
mov qword [rsi], rdi
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140083280
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140057610
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x20
and qword [r9], 0
mov r14, r9
xor r9d, r9d
mov r8d, 0x9cbc
mov rdi, rcx
lea edx, [r9 + 0x17]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
nop dword [rax + rax]
lea rbp, str.shellosshell_accesorywordpadutils.cpp
mov rsi, rax
test rax, rax
jne 0x140057673
mov edx, Ordinal_1489
mov rcx, qword [rsp + 0x38]
mov r8, rbp
call fcn.14000b37c
mov ebx, eax
jmp 0x1400576d6
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140057692
mov edx, 0x5d2
jmp 0x140057662
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
nop dword [rax + rax]
test rax, rax
jne 0x1400576b0
mov edx, 0x5d5
jmp 0x140057662
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
nop dword [rax + rax]
test rax, rax
jne 0x1400576cb
mov edx, Ordinal_1499
jmp 0x140057662
mov dword [rsp + 0x50], ebx
xor ebx, ebx
mov qword [rsp + 0x48], rax
test ebx, ebx
jns 0x1400576f3
mov edx, 0x5e8
mov rcx, qword [rsp + 0x38]
mov r8, rbp
mov r9d, ebx
call fcn.14000b344
mov eax, ebx
jmp 0x14005771e
mov edx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
nop dword [rax + rax]
mov qword [r14], rax
test rax, rax
jne 0x14005771c
mov ebx, 0x8007000e
mov edx, Ordinal_1519
jmp 0x1400576df
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140062e54
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
and qword [rbp - 0x18], 0
mov rax, rdx
and qword [rbp - 0x10], 0
lea rdx, [rbp - 0x10]
and dword [r8], 0
mov rsi, rcx
mov rcx, rax
mov rdi, r8
call qword [sym.imp.ole32.dll_StringFromCLSID]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x140062f11
mov rdx, qword [rbp - 0x10]
lea rax, [rbp - 0x18]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140062ec3
mov ebx, 1
jmp 0x140062f11
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x20]
and dword [rbp + 0x30], 0
lea r9, [rbp + 0x30]
and dword [rbp + 0x38], 0
lea rdx, str.Compatibility_Flags
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp + 0x38]
mov dword [rbp - 0x20], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140062f11
cmp dword [rbp + 0x30], 4
jne 0x140062f11
mov eax, dword [rbp + 0x38]
mov dword [rdi], eax
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140062f26
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140062f3b
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140062f54
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [0x1400ebe98]
xor rax, rsp
mov qword [rbp + 0x390], rax
and qword [rsp + 0x50], 0
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionWordpadCOMChecks
and qword [rsp + 0x48], 0
mov rsi, rdx
mov rdi, rcx
mov r15d, 0x104
mov edx, r15d
lea rcx, [rsp + 0x70]
mov ebx, 1
call fcn.140009c88
test eax, eax
js 0x14006319c
lea r8, [0x1400a7e68]
mov edx, r15d
lea rcx, [rsp + 0x70]
call fcn.140009d14
test eax, eax
js 0x14006319c
lea r8, str.KillbitList
mov edx, r15d
lea rcx, [rsp + 0x70]
call fcn.140009d14
test eax, eax
js 0x14006319c
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140063170
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x40]
mov rdx, rdi
call fcn.140062e54
test eax, eax
js 0x140063170
test dword [rsp + 0x40], 0x400
jne 0x140063051
xor ebx, ebx
jmp 0x140063170
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ole32.dll_StringFromCLSID]
nop dword [rax + rax]
test eax, eax
js 0x140063170
xor edi, edi
lea r8, [rsp + 0x70]
mov dword [rsp + 0x58], 0x4e
mov rdx, r15
lea rcx, [rbp + 0x180]
call fcn.140009c88
test eax, eax
js 0x140063170
lea r8, [0x1400a7e68]
mov rdx, r15
lea rcx, [rbp + 0x180]
call fcn.140009d14
test eax, eax
js 0x140063170
mov r8, qword [rsp + 0x48]
lea rcx, [rbp + 0x180]
mov rdx, r15
call fcn.140009d14
test eax, eax
js 0x140063170
lea rax, [rsp + 0x58]
mov r9d, 0x20000002
mov qword [rsp + 0x30], rax
lea r8, str.AlternateCLSID
mov rax, qword [rsp + 0x48]
lea rdx, [rbp + 0x180]
mov qword [rsp + 0x28], rax
mov rcx, 0xffffffff80000002
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x140063170
movups xmm0, xmmword [0x1400a2ad0]
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x60]
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ole32.dll_CLSIDFromString]
nop dword [rax + rax]
test eax, eax
js 0x140063170
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x60]
call fcn.140062e54
test eax, eax
js 0x14006315b
test dword [rsp + 0x40], 0x400
je 0x140063167
add edi, ebx
cmp edi, 0xa
jge 0x140063170
jmp 0x14006306f
movups xmm0, xmmword [rsp + 0x60]
movdqu xmmword [rsi], xmm0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140063186
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14006319c
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.140083280
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
Function at 0x140063634
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x38
xor ebx, ebx
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x20], ebx
mov qword [rbp + 0x30], rbx
mov dword [rbp + 0x18], ebx
cmp word [rcx], bx
je 0x1400636d5
lea rax, [rbp + 0x30]
mov rdx, rcx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400636d5
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x18]
lea rax, [rbp + 0x20]
xor r8d, r8d
lea rdx, str.ComCheckOn
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400636c5
cmp dword [rbp + 0x18], 4
jne 0x1400636c5
lea eax, [rbx + 1]
cmp dword [rbp + 0x20], eax
cmove ebx, eax
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
add rsp, 0x38
pop rbx
pop rbp
ret

Function at 0x1400636e8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x38
xor ebx, ebx
mov dword [rbp + 0x28], 4
lea rax, [rbp + 0x30]
mov dword [rbp + 0x20], ebx
mov r9d, 0x20019
mov qword [rbp + 0x30], rbx
xor r8d, r8d
mov dword [rbp + 0x18], ebx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionWordpadCOMChecks
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14006378c
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x18]
lea rax, [rbp + 0x20]
xor r8d, r8d
lea rdx, str.BlockAllObjects
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14006377c
cmp dword [rbp + 0x18], 4
jne 0x14006377c
lea eax, [rbx + 1]
cmp dword [rbp + 0x20], eax
cmove ebx, eax
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
add rsp, 0x38
pop rbx
pop rbp
ret
Function at 0x140066b40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov r14, r9
mov rsi, rdx
mov r15, rcx
and qword [r9], 0
xor ebx, ebx
mov qword [rax - 0x40], rbx
xor r9d, r9d
lea rdx, str.Image
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
nop dword [rax + rax]
mov rbp, rax
lea r12, str.shellosshell_accesorycommon_apribbon_ribbonutil.cpp
test rax, rax
jne 0x140066bae
lea edx, [rbx + 0x16]
mov r8, r12
mov rcx, qword [rsp + 0x68]
call fcn.14000b37c
mov edi, eax
jmp 0x140066c0e
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140066bcb
lea edx, [rax + 0x18]
jmp 0x140066b9d
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
nop dword [rax + rax]
test rax, rax
jne 0x140066be7
lea edx, [rax + 0x1a]
jmp 0x140066b9d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
nop dword [rax + rax]
test rax, rax
jne 0x140066c00
lea edx, [rax + 0x1c]
jmp 0x140066b9d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x88], edi
xor edi, edi
test edi, edi
jns 0x140066c29
mov rcx, qword [rsp + 0x68]
mov r9d, edi
mov r8, r12
mov edx, 0x2b
call fcn.14000b344
jmp 0x140066c6a
mov edx, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x140066c68
mov rcx, qword [rsp + 0x68]
mov edi, 0x8007000e
mov r9d, edi
mov r8, r12
lea edx, [rax + 0x2d]
call fcn.14000b344
jmp 0x140066c7e
xor edi, edi
test edi, edi
js 0x140066c7e
mov r8, r14
mov rdx, rbx
mov rcx, r15
call fcn.140066a00
mov edi, eax
test rbx, rbx
je 0x140066c94
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
mov rcx, rbx
call qword [str._N_b_]
nop
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret