joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b17c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x3c18]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
vmovss xmm0, dword [rax + 0x3c20]
vmovss dword [rsp + 0x24], xmm0
mov rax, qword [rsp + 0x50]
vmovss xmm0, dword [rsp + 0x24]
vdivss xmm0, xmm0, dword [rax + 0x14]
vmovss dword [rsp + 0x3c], xmm0
vxorps xmm2, xmm2, xmm2
vxorps xmm1, xmm1, xmm1
mov rcx, qword [rsp + 0x70]
call fcn.14000a270
vxorps xmm0, xmm0, xmm0
vmovss dword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x88]
cmp qword [rsp + 0x30], rax
jae 0x1400b1913
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xa
jne 0x1400b18d5
vmovss xmm1, dword [rsp + 0x20]
mov rax, qword [rsp + 0x70]
vmovss xmm0, dword [rax]
call fcn.14007dd10
mov rax, qword [rsp + 0x70]
vmovss dword [rax], xmm0
mov rax, qword [rsp + 0x70]
vmovss xmm0, dword [rax + 4]
vaddss xmm0, xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
vmovss dword [rax + 4], xmm0
vxorps xmm0, xmm0, xmm0
vmovss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0xa0]
test eax, eax
je 0x1400b18d0
jmp 0x1400b1913
jmp 0x1400b1845
cmp dword [rsp + 0x28], 0xd
jne 0x1400b18e1
jmp 0x1400b1845
movzx edx, word [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.1400a8910
vmulss xmm0, xmm0, dword [rsp + 0x3c]
vmovss dword [rsp + 0x40], xmm0
vmovss xmm0, dword [rsp + 0x20]
vaddss xmm0, xmm0, dword [rsp + 0x40]
vmovss dword [rsp + 0x20], xmm0
jmp 0x1400b1845
mov rax, qword [rsp + 0x70]
vmovss xmm0, dword [rsp + 0x20]
vcomiss xmm0, dword [rax]
jbe 0x1400b1933
mov rax, qword [rsp + 0x70]
vmovss xmm0, dword [rsp + 0x20]
vmovss dword [rax], xmm0
cmp qword [rsp + 0x98], 0
je 0x1400b1970
mov rax, qword [rsp + 0x70]
vmovss xmm0, dword [rax + 4]
vaddss xmm0, xmm0, dword [rsp + 0x24]
vmovups xmm2, xmm0
vmovss xmm1, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.14000a270
mov rax, qword [rax]
mov rcx, qword [rsp + 0x98]
mov qword [rcx], rax
vmovss xmm0, dword [rsp + 0x20]
vcomiss xmm0, dword [0x14013a4b8]
ja 0x1400b1990
mov rax, qword [rsp + 0x70]
vxorps xmm0, xmm0, xmm0
vucomiss xmm0, dword [rax + 4]
jne 0x1400b19aa
mov rax, qword [rsp + 0x70]
vmovss xmm0, dword [rax + 4]
vaddss xmm0, xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
vmovss dword [rax + 4], xmm0
cmp qword [rsp + 0x90], 0
je 0x1400b19c5
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x1400de4b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
and eax, 7
test eax, eax
je 0x1400de4e1
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
and eax, 7
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.1400ddaf0
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
jle 0x1400de53c
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x14]
and eax, 0xff
movsxd rcx, dword [rsp + 0x20]
mov byte [rsp + rcx + 0x28], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x14]
shr eax, 8
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x14], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
sub eax, 8
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x10], eax
jmp 0x1400de4e9
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
jge 0x1400de558
lea rcx, str.zlib_corrupt
call fcn.1400d0ee0
jmp 0x1400de69c
cmp dword [rsp + 0x20], 4
jge 0x1400de57e
mov rcx, qword [rsp + 0x50]
call fcn.1400dd9f0
movsxd rcx, dword [rsp + 0x20]
mov byte [rsp + rcx + 0x28], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
jmp 0x1400de558
mov eax, 1
imul rax, rax, 1
movzx eax, byte [rsp + rax + 0x28]
imul eax, eax, 0x100
mov ecx, 1
imul rcx, rcx, 0
movzx ecx, byte [rsp + rcx + 0x28]
add eax, ecx
mov dword [rsp + 0x24], eax
mov eax, 1
imul rax, rax, 3
movzx eax, byte [rsp + rax + 0x28]
imul eax, eax, 0x100
mov ecx, 1
imul rcx, rcx, 2
movzx ecx, byte [rsp + rcx + 0x28]
add eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x24]
xor eax, 0xffff
cmp dword [rsp + 0x2c], eax
je 0x1400de5ee
lea rcx, str.zlib_corrupt
call fcn.1400d0ee0
jmp 0x1400de69c
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx + 8]
jbe 0x1400de617
lea rcx, str.read_past_buffer
call fcn.1400d0ee0
jmp 0x1400de69c
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x18]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx + 0x28]
jbe 0x1400de650
mov r8d, dword [rsp + 0x24]
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax + 0x18]
mov rcx, qword [rsp + 0x50]
call fcn.1400ddd50
test eax, eax
jne 0x1400de650
xor eax, eax
jmp 0x1400de69c
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rdx]
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x18]
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x18], rax
mov eax, 1
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x1400e9240
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x48]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
add rsp, 0x38
ret
Function at 0x1400f0d20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14014d340]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.140006720
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.1400f0eb0
nop
lea rax, [0x1400f0f30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.140007650
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x1400f0dc3
lea rcx, [rsp + 0x40]
call fcn.140044e90
jmp 0x1400f0ddb
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rcx, [rsp + 0x40]
call fcn.1400f0e00
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140120a30
add rsp, 0x58
ret
Function at 0x140117e10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov ebx, dword [rcx + 0x14]
mov rsi, rcx
call fcn.140117b40
mov rcx, rsi
mov byte [rsp + 0x40], al
call fcn.140117b40
mov rdx, qword [rsi]
mov byte [rsp + 0x41], al
mov rax, qword [rdx]
movsxd rcx, dword [rax + 4]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
test al, al
je 0x140117f9b
xor eax, eax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r14
cmp ebx, 2
mov qword [rsp + 0x20], r15
lea r14, [rsp + 0x40]
setne al
lea r15, [rsp + 0x40]
add r14, rax
xor rax, 1
add r15, rax
movzx edi, byte [r14]
movzx eax, byte [r15]
shl edi, 8
or edi, eax
lea eax, [rdi - 0xdc00]
cmp eax, 0x3ff
ja 0x140117ea5
lea rcx, [rsi + 0x18]
mov edx, 0xfffd
call fcn.140117be0
jmp 0x140117f8c
lea eax, [rdi - 0xd800]
mov qword [rsp + 0x48], rbp
cmp eax, 0x3ff
ja 0x140117f79
mov rcx, rsi
call fcn.140117b40
mov rcx, rsi
mov byte [rsp + 0x40], al
call fcn.140117b40
mov rdx, qword [rsi]
mov byte [rsp + 0x41], al
mov rax, qword [rdx]
movsxd rcx, dword [rax + 4]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
lea rbp, [rsi + 0x18]
test al, al
je 0x140117f59
nop
movzx eax, byte [r15]
movzx ebx, byte [r14]
shl ebx, 8
or ebx, eax
lea eax, [rbx - 0xdc00]
cmp eax, 0x3ff
jbe 0x140117f60
lea rbp, [rsi + 0x18]
mov edx, 0xfffd
mov rcx, rbp
call fcn.140117be0
lea eax, [rbx - 0xd800]
cmp eax, 0x7ff
ja 0x140117f7d
mov rcx, rsi
mov edi, ebx
call fcn.140117b40
mov rcx, rsi
mov byte [rsp + 0x40], al
call fcn.140117b40
mov rdx, qword [rsi]
mov byte [rsp + 0x41], al
mov rax, qword [rdx]
movsxd rcx, dword [rax + 4]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
test al, al
jne 0x140117ef0
mov edx, 0xfffd
jmp 0x140117f7f
and edi, 0x3ff
and ebx, 0x3ff
shl edi, 0xa
or edi, ebx
add edi, 0x10000
jmp 0x140117f7d
lea rbp, [rsi + 0x18]
mov edx, edi
mov rcx, rbp
call fcn.140117be0
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
Function at 0x14012015c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140120196
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14012019b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1401201e4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14012fc10]
cmp byte [rcx + rax], 0
je 0x1401201e4
dec r8
sub rdx, 1
jne 0x1401201ca
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1401218f0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14012193a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14012193a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14012193a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14012193a
cmp dword [rcx + 0x84], 0xe
jbe 0x14012193a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14012193c
xor al, al
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm7
movaps xmmword [rsp + 0x30], xmm6
xor eax, eax
lea rsi, [0x1404fd3f0]
movdqa xmm6, xmmword [0x1404ae850]
movdqa xmm7, xmmword [0x1404ae860]
lea rdi, [rsp + 0x28]
nop
movdqa xmm0, xmmword [rax + rsi]
pxor xmm0, xmm6
movdqa xmm1, xmmword [rax + rsi + 0x10]
pxor xmm1, xmm6
paddb xmm0, xmm7
paddb xmm1, xmm7
pxor xmm0, xmm6
pxor xmm1, xmm6
paddb xmm0, xmm7
paddb xmm1, xmm7
pxor xmm0, xmm6
pxor xmm1, xmm6
paddb xmm0, xmm7
paddb xmm1, xmm7
pxor xmm0, xmm6
pxor xmm1, xmm6
paddb xmm0, xmm7
paddb xmm1, xmm7
pxor xmm0, xmm6
pxor xmm1, xmm6
paddb xmm0, xmm7
paddb xmm1, xmm7
pxor xmm0, xmm6
pxor xmm1, xmm6
paddb xmm0, xmm7
paddb xmm1, xmm7
movdqa xmmword [rax + rsi], xmm0
movdqa xmmword [rax + rsi + 0x10], xmm1
add rax, 0x20
cmp rax, 0x546400
jne 0x140001030
mov edx, 0x546400
mov rcx, rsi
call fcn.140001170
mov rbx, rax
mov eax, 0
test rbx, rbx
je 0x140001030
mov byte [rsp + 0x2c], 0
mov dword [rsp + 0x28], 0x64616f4c
mov rcx, rbx
mov rdx, rdi
call fcn.140001bf0
test rax, rax
jne 0x1400010f8
xor eax, eax
jmp 0x140001030
call rax
mov rcx, rbx
call fcn.140001ae0
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x14001e210
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rdi, rsp
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
cmp qword [rsp + 0x68], 0
je 0x14001e2cb
call fcn.140041650
mov qword [rsp + 0x30], rax
mov r8d, 0xf0
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14001e2cb
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14001e29b
xor eax, eax
jmp 0x14001e307
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001e2cb
mov edx, 0x11a6
lea rcx, [0x1403cc800]
call fcn.140004f20
test eax, eax
je 0x14001e2cb
int3
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x60]
call fcn.140085800
mov dword [rsp + 0x40], eax
cmp qword [rsp + 0x20], 0
je 0x14001e303
cmp qword [rsp + 0x28], 0
je 0x14001e303
mov rcx, qword [rsp + 0x28]
call fcn.1401cc310
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [rsp + 0x40]
add rsp, 0x50
pop rdi
ret

Function at 0x14001e810
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rsp
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14001e862
mov edx, 0x4a6
lea rcx, [0x1403cc800]
call fcn.140004f20
test eax, eax
je 0x14001e862
int3
lea rdx, [0x1403c7300]
mov rcx, qword [rsp + 0x60]
call fcn.1400064f0
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0xc8], 0
jne 0x14001e8ef
mov edx, dword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14001e8ed
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
call fcn.14001e4c0
mov ecx, dword [rsp + 0x38]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x60]
call fcn.14000f840
jmp 0x14001e919
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.140034200
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14001e919
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
call fcn.14001f440
mov rcx, qword [rsp + 0x60]
call fcn.140009130
add rsp, 0x40
pop rdi
ret
Function at 0x14001f440
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rsp
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14001f48e
mov edx, 0x496
lea rcx, [0x1403cc800]
call fcn.140004f20
test eax, eax
je 0x14001f48e
int3
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0xd0], 0
jne 0x14001f4f2
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x24], eax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
call fcn.14001e4c0
mov ecx, dword [rsp + 0x24]
mov r8d, ecx
mov rdx, rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x58]
call fcn.14000f840
jmp 0x14001f539
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0xd0]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0xd0]
mov qword [rsp + 0x28], rcx
mov rax, qword [rax]
mov rax, qword [rax + 0x128]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.140350d30
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x28]
mov rcx, rax
call qword [rsp + 0x30]
add rsp, 0x40
pop rdi
ret
Function at 0x1400202d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rdi, rsp
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x60]
call fcn.14002fb70
test rax, rax
je 0x140020321
mov rcx, qword [rsp + 0x60]
call fcn.14002fb70
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140020321
cmp qword [rsp + 0x68], 0
jne 0x140020328
xor eax, eax
jmp 0x140020436
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
cmp qword [rsp + 0x68], 0
je 0x1400203e4
call fcn.140041650
mov qword [rsp + 0x38], rax
lea r8, str.AFX_DIALOG_LAYOUT
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x1400203e4
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x20], eax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400203b4
xor eax, eax
jmp 0x140020436
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400203e4
mov edx, 0x1490
lea rcx, [0x1403cc800]
call fcn.140004f20
test eax, eax
je 0x1400203e4
int3
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
call fcn.140087c30
mov dword [rsp + 0x48], eax
cmp qword [rsp + 0x28], 0
je 0x140020421
cmp qword [rsp + 0x30], 0
je 0x140020421
mov rcx, qword [rsp + 0x30]
call fcn.1401cc310
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [rsp + 0x48], 0
je 0x140020432
mov rcx, qword [rsp + 0x60]
call fcn.14001f9f0
mov eax, dword [rsp + 0x48]
add rsp, 0x50
pop rdi
ret
Function at 0x1400345f0
Capabilities:
Get graphical window text

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rdi, rsp
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14003465b
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0xd0], 0
jne 0x14003465b
mov edx, 0xfc
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcwinocc.cpp
call fcn.140004f20
test eax, eax
je 0x14003465b
int3
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0xd0], 0
jne 0x14003468d
mov r8d, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x140034721
lea rcx, [rsp + 0x28]
call fcn.140005bf0
nop
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0xd0]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0xd0]
mov qword [rsp + 0x40], rcx
mov rax, qword [rax]
mov rax, qword [rax + 0x128]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.140350d30
lea rdx, [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rcx, rax
call qword [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.140084d30
movsxd rcx, dword [rsp + 0x70]
mov r9, 0xffffffffffffffff
mov r8, rax
mov rdx, rcx
mov rcx, qword [rsp + 0x68]
call fcn.1400111a0
mov rcx, qword [rsp + 0x68]
call fcn.1400109d0
mov dword [rsp + 0x34], eax
lea rcx, [rsp + 0x28]
call fcn.1400061e0
mov eax, dword [rsp + 0x34]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1403cf3c0]
call fcn.140350b90
mov rax, rdi
add rsp, 0x50
pop rdi
ret
Function at 0x14003a600
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
mov rdi, rsp
mov ecx, 0x28
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xb0]
cmp qword [rsp + 0xb8], 0
jne 0x14003a656
mov edx, 0x8a
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.140004f20
test eax, eax
je 0x14003a656
int3
cmp qword [rsp + 0xc0], 0
jne 0x14003a679
mov edx, 0x8b
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.140004f20
test eax, eax
je 0x14003a679
int3
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0xb0], 0
je 0x14003a76e
xor r8d, r8d
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xb0]
call fcn.14003abb0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14003a6c0
mov eax, dword [rsp + 0xc8]
jmp 0x14003a7c5
mov dword [rsp + 0x84], 4
lea rax, [rsp + 0x84]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
xor r8d, r8d
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x94], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x94], 0
jne 0x14003a763
cmp dword [rsp + 0x64], 4
je 0x14003a738
mov edx, 0x99
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.140004f20
test eax, eax
je 0x14003a738
int3
mov eax, dword [rsp + 0x84]
cmp rax, 4
je 0x14003a75d
mov edx, 0x9a
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.140004f20
test eax, eax
je 0x14003a75d
int3
mov eax, dword [rsp + 0x44]
jmp 0x14003a7c5
mov eax, dword [rsp + 0xc8]
jmp 0x14003a7c5
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0xd8], 0
jne 0x14003a798
mov edx, reloc.OLEAUT32.dll_LoadRegTypeLib
lea rcx, str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.140004f20
test eax, eax
je 0x14003a798
int3
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0xd8]
mov r8d, dword [rsp + 0xc8]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1403d0d60]
call fcn.140350b90
mov rax, rdi
add rsp, 0xa0
pop rdi
ret
Function at 0x14003ccb0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rdi, rsp
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x14003cdae
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14003cd3b
lea rax, str.hAdvAPI32___0
mov qword [rsp + 0x28], rax
lea rax, [0x1404c2c40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x29c
lea rdx, str.f:dd_vctools_vc7libs_ship_atlmfcinclude_atltransactionmanager.h
mov ecx, 2
call fcn.14035a580
cmp eax, 1
jne 0x14003cd3b
int3
cmp qword [rsp + 0x30], 0
jne 0x14003cd4d
mov eax, 1
jmp 0x14003cdd0
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14003cdac
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.140350d30
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [rsp + 0x40]
jmp 0x14003cdd0
jmp 0x14003cdcb
mov rax, qword [rsp + 0x60]
cmp dword [rax + 8], 0
je 0x14003cdcb
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14003cdd0
mov eax, 1
add rsp, 0x50
pop rdi
ret