joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000457c8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
sub rsp, 0x30
mov rsi, r8
mov r12, rdx
mov r13, rcx
mov rbx, qword [0x1000e3010]
and qword [rax - 0x18], 0
xor edi, edi
mov eax, dword [0x1000e2c28]
test eax, eax
je 0x100045815
lea rcx, [0x10000c3b8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1000e2c28]
test eax, eax
jne 0x100045822
call fcn.1000454b0
test eax, eax
je 0x10004583e
lea rdx, [rsp + 0x20]
mov rcx, qword [0x1000de160]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne edi, ecx
test edi, edi
jne 0x100045868
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
mov ecx, 0x54f
test eax, eax
cmove r11d, ecx
movzx eax, r11w
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
jmp 0x1000458c7
test rbx, rbx
jne 0x1000458a8
lea rcx, [0x10000c3f8]
call fcn.100045714
mov rbx, rax
test rax, rax
jne 0x1000458a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x54f
test eax, eax
cmove eax, ecx
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1000458b8
mov qword [0x1000e3010], rax
xor r9d, r9d
mov r8, rsi
mov rdx, r12
mov rcx, r13
call rbx
mov ebx, eax
mov rdx, qword [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
add rsp, 0x30
pop r13
ret

Function at 0x100046128
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, edx
mov esi, edx
mov r8d, 6
shr eax, 4
mov rbp, rcx
inc ax
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor ebx, ebx
mov r12, rax
cmp rax, rbx
jne 0x10004616b
xor eax, eax
jmp 0x1000461ca
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, rbx
je 0x1000461c7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
cmp rax, rbx
je 0x1000461c7
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and esi, 0xf
jbe 0x1000461b6
cmp rdi, r11
jae 0x1000461c7
add esi, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x1000461a4
cmp rdi, r11
jae 0x1000461c7
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1000462f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13, rcx
mov r12d, edx
lea rcx, [0x1000def00]
xor edx, edx
xor ebx, ebx
call fcn.1000cd234
lea r14d, [rbx + 1]
mov ebp, r14d
jmp 0x1000463d6
test rbx, rbx
jne 0x1000463e2
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, r14w
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rbx, rax
test rax, rax
je 0x1000463c5
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100046372
xor ebx, ebx
jmp 0x1000463c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x10004636e
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x1000463af
cmp rdi, r11
jae 0x10004636e
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x10004639d
cmp rdi, r11
jae 0x10004636e
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x1000463e4
lea rcx, [0x1000def00]
mov edx, ebp
call fcn.1000cd234
add ebp, r14d
mov rsi, rax
test rax, rax
jne 0x10004632f
xor esi, esi
test rsi, rsi
jne 0x1000463ed
xor eax, eax
jmp 0x1000463fb
mov r8d, r12d
mov rdx, rsi
mov rcx, r13
call fcn.1000461ec
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret

Function at 0x100048758
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
and qword [rax - 0x18], 0
and qword [rax + 0x20], 0
xor ebx, ebx
mov eax, dword [0x1000e2c28]
test eax, eax
je 0x100048794
lea rcx, [0x10000c3b8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1000e2c28]
test eax, eax
jne 0x1000487a1
call fcn.1000454b0
test eax, eax
je 0x1000487bd
lea rdx, [rsp + 0x58]
mov rcx, qword [0x1000de160]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x1000487c5
xor eax, eax
jmp 0x100048810
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je 0x1000487f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1000487f4
xor esi, esi
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x10004880d
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x100049384
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1000de138]
xor rax, rsp
mov qword [rsp + 0x270], rax
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
mov rdi, rcx
mov rcx, qword [rcx]
lea rax, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x100049488
test rcx, rcx
je 0x1000493fe
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
test ebx, ebx
mov qword [rsp + 0x48], rcx
jmp 0x100049424
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.100049384
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x100049488
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10004940c
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x100049476
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x48], 0
mov rdx, rsi
mov rcx, rdi
call fcn.1000494c0
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test rcx, rcx
je 0x100049493
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1000cd7d0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x10004a22c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x1000de138]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r12, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call fcn.100048758
mov rsi, rax
mov qword [rsp + 0x38], rax
cmp rax, rbx
jne 0x10004a29f
call fcn.10004885c
mov ebx, eax
jmp 0x10004a3e0
mov r8, r12
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
cmp rax, rbx
jne 0x10004a2c2
call fcn.10004885c
mov ebx, eax
jmp 0x10004a3d6
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rsp + 0x40], rax
cmp rax, rbx
jne 0x10004a2e7
call fcn.10004885c
mov ebx, eax
jmp 0x10004a3d6
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jae 0x10004a320
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x10004a316
lea rcx, [rsp + 0x70]
call fcn.100048748
nop
mov eax, 0x8007000e
jmp 0x10004a3f9
mov ecx, eax
cmp rcx, rbx
je 0x10004a35e
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x10004a354
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x10004a35e
lea rcx, [rsp + 0x70]
call fcn.100048828
mov rax, qword [rsp + 0x70]
jmp 0x10004a368
mov ecx, 0x80070057
call fcn.100046abc
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x10004a37f
cmp rax, rbx
jne 0x10004a38b
mov ebx, 0x8007000e
jmp 0x10004a3d6
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
jne 0x10004a3b2
call fcn.10004885c
mov ebx, eax
jmp 0x10004a3d6
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.10004a06c
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x10004a3f7
lea rcx, [rsp + 0x70]
call fcn.100048748
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1000cd7d0
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret
Function at 0x10004b730
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rdi
push r12
sub rsp, 0x70
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor edi, edi
mov eax, dword [0x1000e2c28]
test eax, eax
je 0x10004b76a
lea rcx, [0x10000c3b8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1000e2c28]
test eax, eax
jne 0x10004b777
call fcn.1000454b0
test eax, eax
je 0x10004b793
lea rdx, [rsp + 0x60]
mov rcx, qword [0x1000de160]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne edi, ecx
test edi, edi
jne 0x10004b79e
xor eax, eax
jmp 0x10004b826
and qword [rsp + 0x58], 0
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
and qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0xfffffffffffffffd
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x10000ca00]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov r12, rax
mov qword [rsp + 0x68], rax
xor edi, edi
test rax, rax
sete dil
test edi, edi
je 0x10004b808
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10004b80a
xor esi, esi
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x10004b823
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r12
lea r11, [rsp + 0x70]
mov rsi, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r12
ret

Function at 0x10004b840
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov rsi, rcx
xor ebx, ebx
mov word [rax - 0x18], bx
mov qword [rax + 0x10], rbx
mov edi, ebx
mov eax, dword [0x1000e2c28]
cmp eax, ebx
je 0x10004b881
lea rcx, [0x10000c3b8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1000e2c28]
cmp eax, ebx
jne 0x10004b88e
call fcn.1000454b0
cmp eax, ebx
je 0x10004b8aa
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1000de160]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
cmp eax, ebx
cmovne edi, ecx
cmp edi, ebx
jne 0x10004b8b3
mov ax, bx
jmp 0x10004b8fc
mov rcx, rsi
call qword [sym.imp.USER32.dll_RegisterClassExW]
movzx edi, ax
mov word [rsp + 0x20], ax
mov esi, ebx
cmp di, bx
sete sil
cmp esi, ebx
je 0x10004b8dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x10004b8df
mov r12d, ebx
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
cmp esi, ebx
je 0x10004b8f9
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ax, di
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x10004b918
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rcx
and dword [rax - 0x18], 0
and qword [rax + 0x20], 0
xor ebx, ebx
mov eax, dword [0x1000e2c28]
test eax, eax
je 0x10004b956
lea rcx, [0x10000c3b8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1000e2c28]
test eax, eax
jne 0x10004b963
call fcn.1000454b0
test eax, eax
je 0x10004b97f
lea rdx, [rsp + 0x58]
mov rcx, qword [0x1000de160]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x10004b987
xor eax, eax
jmp 0x10004b9d2
mov r8, rdi
lea rdx, [0x10000ca00]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetClassInfoExW]
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test eax, eax
sete bl
test ebx, ebx
je 0x10004b9b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10004b9b7
xor esi, esi
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x10004b9d0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x10004c2a0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1000de138]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r12, rcx
lea rsi, [0x1000dedd8]
mov rcx, qword [0x1000dedd8]
cmp rcx, rsi
je 0x10004c30a
test byte [rcx + 0x1c], 1
je 0x10004c30a
cmp byte [rcx + 0x19], 7
jb 0x10004c30a
mov edx, 0x13
lea r8, [0x100008e00]
mov rcx, qword [rcx + 0x10]
call fcn.100020584
lea rcx, [0x1000de100]
mov rax, qword [0x1000de100]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
xor edi, edi
cmp qword [r12 + 0x28], rdi
je 0x10004c40a
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x10004c34c
cmp eax, 0x104
jb 0x10004c368
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jne 0x10004c40a
lea r9, [0x10000cb18]
lea r8, [rsp + 0x40]
lea rdx, [0x10000cb40]
lea rcx, [rsp + 0x20]
call fcn.1000449e4
mov rcx, qword [0x1000dedd8]
cmp rcx, rsi
je 0x10004c3bc
test byte [rcx + 0x1c], 1
je 0x10004c3bc
cmp byte [rcx + 0x19], 5
jb 0x10004c3bc
mov edx, 0x14
mov rbx, qword [rsp + 0x20]
mov r9, rbx
lea r8, [0x100008e00]
mov rcx, qword [rcx + 0x10]
call fcn.100020614
jmp 0x10004c3c1
mov rbx, qword [rsp + 0x20]
mov r9d, 2
lea r8d, [r9 + 8]
mov rdx, rbx
mov rcx, qword [r12 + 0x28]
call fcn.1000a85f4
test eax, eax
jne 0x10004c3f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x10004c3f8
and qword [r12 + 0x28], 0
jmp 0x10004c40a
mov rcx, qword [0x1000dedd8]
cmp rcx, rsi
je 0x10004c43b
test byte [rcx + 0x1c], 1
je 0x10004c43b
cmp byte [rcx + 0x19], 7
jb 0x10004c43b
mov edx, 0x15
mov r9d, edi
lea r8, [0x100008e00]
mov rcx, qword [rcx + 0x10]
call fcn.100020d8c
nop
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x10004c457
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1000cd7d0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x10004dc44
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
and qword [rax - 0x28], 0
mov dword [rax + 0x20], 4
mov dword [rax + 0x18], 4
lea rax, [rax - 0x28]
mov rbp, rcx
xor ebx, ebx
and dword [rax + 0x38], ebx
lea rdx, [0x10000cc50]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
xor esi, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10004dce9
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edi, [rbx + 1]
test eax, eax
jne 0x10004dcd4
cmp dword [rsp + 0x68], ebx
je 0x10004dcd6
mov ebx, edi
jmp 0x10004dcd6
mov esi, edi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x30], 0
jmp 0x10004dcf0
mov edi, 1
mov esi, edi
cmp esi, edi
jne 0x10004dd67
lea rax, [rsp + 0x30]
lea rdx, [0x10000cc50]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10004dd67
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x70], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10004dd5c
cmp dword [rsp + 0x68], eax
cmovne ebx, edi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x100051fa8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rdx, r8
mov rsi, r8
mov rbp, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x100051ff4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rdi, rdi
je 0x100051ff4
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rdi], eax
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x100058780
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
mov ecx, dword [0x1000de268]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1000587a5
mov rcx, qword [rax + 0x10]
jmp 0x1000587a7
xor ecx, ecx
test rcx, rcx
je 0x1000587c2
call fcn.10005a13c
mov rbx, rax
test rax, rax
je 0x1000587c2
mov dword [rax + 8], edi
mov dword [rax], 0x81
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1000587d8
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x1000de268]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1000587fe
mov rcx, qword [rax + 0x10]
jmp 0x100058800
xor ecx, ecx
test rcx, rcx
je 0x10005881c
call fcn.10005a13c
mov rbx, rax
test rax, rax
je 0x10005881c
mov qword [rax + 8], rdi
mov dword [rax], 0x83
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x100058830
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x1000de268]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x100058856
mov rcx, qword [rax + 0x10]
jmp 0x100058858
xor ecx, ecx
test rcx, rcx
je 0x100058884
call fcn.10005a13c
mov rbx, rax
test rax, rax
je 0x100058884
and dword [rax], 0xffffffc4
or dword [rax], 4
test rdi, rdi
je 0x100058879
bts dword [rdi], 0x1e
and dword [rax], 0x3f
bts dword [rax], 7
mov qword [rax + 8], rdi
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x100058898
Capabilities:
Extract resource via kernel32 functions
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rbp, rcx
mov ecx, dword [0x1000de268]
mov r13, rdx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1000588d4
mov rcx, qword [rax + 0x10]
jmp 0x1000588d6
xor ecx, ecx
test rcx, rcx
je 0x100058a0b
call fcn.10005a13c
mov rbx, rax
test rax, rax
je 0x100058a0b
and dword [rax], 0xffffffc5
or dword [rax], 5
xor r12d, r12d
xor esi, esi
lea r14d, [r12 + 1]
test r13, r13
je 0x100058978
mov eax, ebp
lea edx, [rsi + 6]
xor r9d, r9d
shr eax, 4
mov rcx, r13
xor edi, edi
add ax, r14w
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x100058945
mov rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x100058945
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rdi, rdi
je 0x10005896c
and ebp, 0xf
jbe 0x100058960
mov ecx, ebp
movzx eax, word [rdi]
add eax, r14d
sub rcx, r14
lea rdi, [rdi + rax*2]
jne 0x100058951
movzx esi, word [rdi]
lea r12, [rdi + 2]
test rsi, rsi
jne 0x100058973
lea r12, [0x10000c3f4]
add rsi, r14
jmp 0x100058996
test rbp, rbp
je 0x100058996
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
repne scasw ax, word [rdi]
mov r12, rbp
not rcx
sub rcx, r14
lea rsi, [r14 + rcx]
and dword [rbx], 0x3f
and qword [rbx + 8], 0
bts dword [rbx], 7
test r12, r12
je 0x1000589d6
lea rdi, [rsi + rsi]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx + 8], rax
test rax, rax
je 0x1000589d6
mov r8, r12
mov rdx, rsi
mov rcx, rax
call fcn.100045190
cmp qword [rbx + 8], 0
jne 0x100058a0b
mov ecx, dword [rbx]
mov eax, ecx
and eax, 0xffffff80
cmp eax, 0xffffff80
je 0x100058a09
mov eax, ecx
not ecx
and eax, 0xffffff80
and ecx, 0x7f
sub eax, r14d
xor eax, ecx
mov dword [rbx], eax
test eax, 0xffffff80
jne 0x100058a09
mov rcx, rbx
call fcn.100059224
xor ebx, ebx
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop r13
pop r12
ret

Function at 0x100058a34
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, ecx
mov ecx, dword [0x1000de268]
mov edi, edx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x100058a60
mov rcx, qword [rax + 0x10]
jmp 0x100058a62
xor ecx, ecx
test rcx, rcx
je 0x100058a80
call fcn.10005a13c
mov rbx, rax
test rax, rax
je 0x100058a80
mov dword [rax + 8], esi
mov dword [rax + 0xc], edi
mov dword [rax], 0x86
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret