joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021b70
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
mov qword [0x14010fba8], rdx
xor edx, edx
mov dword [rsp + 0x20], edx
xor edx, edx
mov qword [0x14010fba0], rcx
xor ecx, ecx
mov qword [0x14010fbb0], r8
lea r8, [0x140021b4f]
mov dword [0x14010fbb8], r9d
lea r9, [0x14010fba0]
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x38
ret

Function at 0x140021bba
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp qword [0x14010fb20], 0
mov dword [0x14010fc90], ecx
jne 0x140021c0c
xor eax, eax
xor edx, edx
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x20], edx
lea r8, [0x14001fe2c]
xor edx, edx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov edx, 1
mov qword [0x14010fb20], rax
test rax, rax
jne 0x140021c0e
lea rcx, str.Unable_to_start_update_check_thread
call fcn.1400380b9
xor edx, edx
mov eax, edx
add rsp, 0x38
ret

Function at 0x140021c15
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
xor edx, edx
xor r9d, r9d
lea r8, [0x140020c58]
xor ecx, ecx
mov dword [rsp + 0x20], edx
xor edx, edx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov rdx, rax
mov eax, 1
test rdx, rdx
jne 0x140021c7d
lea rcx, str.Unable_to_start_Windows_ISO_download_thread
call fcn.1400380b9
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8007
mov rax, qword [0x1400b42b0]
mov dword [rax], 0xe0031205
mov rax, qword [0x1400b4b90]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
add rsp, 0x38
ret
Function at 0x140025a56
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt
Reference public rsa key

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
lea rsi, [0x140082f20]
mov r12, rcx
lea rdi, [rsp + 0x4c]
mov ecx, 0x45
mov rbp, r8
rep movsd dword [rdi], dword [rsi]
xor r8d, r8d
lea rcx, [rsp + 0x30]
mov ebx, edx
mov qword [rsp + 0x30], r8
xor edx, edx
mov r13d, r9d
mov r9d, 0x18
mov qword [rsp + 0x38], r8
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000008
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea rdx, [rsp + 0x60]
lea r8, [0x140095b60]
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x140025ad3
call fcn.14002493d
lea rcx, str.PKI:_Could_not_create_the_default_key_container:__s
mov rdx, rax
jmp 0x140025b27
mov rcx, rax
neg rcx
mov cl, byte [r8 + rcx]
mov byte [rdx + rax], cl
inc rax
cmp rax, 0x100
jne 0x140025ad3
xor ecx, ecx
lea rax, [rsp + 0x40]
xor r9d, r9d
mov r8d, 0x114
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x4c]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x140025b33
call fcn.14002493d
lea rcx, str.PKI:_Could_not_import_public_key:__s
mov rdx, rax
call fcn.1400380b9
xor ebp, ebp
jmp 0x140025bfd
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x140025b68
call fcn.14002493d
lea rcx, str.PKI:_Could_not_create_empty_hash:__s
mov rdx, rax
jmp 0x140025b27
xor r9d, r9d
mov rcx, qword [rsp + 0x38]
mov r8d, ebx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x140025b91
call fcn.14002493d
lea rcx, str.PKI:_Could_not_hash_data:__s
mov rdx, rax
jmp 0x140025b27
lea eax, [r13 - 1]
xor edx, edx
cdqe
cmp edx, eax
jge 0x140025bb7
mov cl, byte [rbp + rdx]
mov r8b, byte [rbp + rax]
mov byte [rbp + rdx], r8b
inc rdx
mov byte [rbp + rax], cl
dec rax
jmp 0x140025b99
xor eax, eax
xor edx, edx
mov r9, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rdx
mov r8d, r13d
mov rdx, rbp
mov dword [rsp + 0x28], eax
call qword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
mov ebp, eax
test eax, eax
jne 0x140025bfd
xor eax, eax
mov ecx, ebx
mov rdi, r12
rep stosb byte [rdi], al
call fcn.14002493d
lea rcx, str.Signature_validation_failed:__s
mov rdx, rax
call fcn.1400380b9
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140025c0d
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140025c1f
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, ebp
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x14002746f
Capabilities:
Create thread
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [0x140110f50], 0
je 0x140027488
mov eax, 1
jmp 0x140027530
xor edx, edx
xor ecx, ecx
lea r8, [0x1400265e7]
xor r9d, r9d
mov qword [rsp + 0x28], rdx
xor edx, edx
mov dword [rsp + 0x20], ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [0x140110f50], rax
test rax, rax
jne 0x1400274cd
call fcn.140038579
lea rcx, str.Failed_to_start_process_search_thread:__s
mov rdx, rax
call fcn.1400380b9
xor eax, eax
jmp 0x140027530
mov edx, 0xfffffffe
lea rcx, [0x1400265e7]
xor ebx, ebx
call qword [sym.imp.KERNEL32.DLL_SetThreadPriority]
cmp qword [0x14010fdb8], 0
jne 0x14002747e
inc ebx
mov ecx, 0x64
call qword [sym.imp.KERNEL32.DLL_Sleep]
cmp ebx, 0x32
jne 0x1400274e1
lea rcx, str.Failed_to_start_process_search_thread:_hLock_init_failure_
call fcn.1400380b9
mov rcx, qword [0x140110f50]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_TerminateThread]
mov rcx, qword [0x140110f50]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
mov qword [0x140110f50], rax
jmp 0x1400274c9
add rsp, 0x30
pop rbx
ret

Function at 0x140027536
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x140110f50]
test rcx, rcx
je 0x14002758e
xor edx, edx
mov dword [0x14010fda0], edx
mov edx, 0x7d0
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x140027585
lea rcx, str.Process_search_thread_did_not_exit_within_timeout___forcefully_terminating_it_
call fcn.1400380b9
mov rcx, qword [0x140110f50]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_TerminateThread]
mov rcx, qword [0x140110f50]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
mov qword [0x140110f50], rax
add rsp, 0x28
ret
Function at 0x140027593
Capabilities:
Get disk information

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x150
cmp qword [0x140110f50], 0
mov word [rsp + 0x2e], 0x3a3f
mov ebp, ecx
mov byte [rsp + 0x30], 0
jne 0x1400275ca
lea rcx, str.Process_search_thread_is_not_started_
call fcn.1400380b9
jmp 0x140027605
cmp qword [0x14010fdb8], 0
jne 0x1400275ee
mov r8d, 0x344
lea rdx, str.process.c
lea rcx, str.blocking_process.hLock___NULL
call qword [sym.imp.msvcrt.dll__wassert]
mov edx, 8
mov ecx, 0x10
call sub.msvcrt.dll_calloc
mov rdi, rax
test rax, rax
jne 0x14002760c
xor eax, eax
jmp 0x14002775a
mov ecx, ebp
lea r12, [rsp + 0x4c]
call fcn.140007c0d
mov r13, qword [sym.imp.KERNEL32.DLL_QueryDosDeviceA]
mov r8d, 0x104
mov rdx, r12
mov rsi, rax
lea rcx, [rax + 4]
call r13
mov ebx, eax
test ebx, ebx
je 0x140027648
mov rcx, r12
mov ebx, 1
call fcn.1400261dd
mov qword [rdi], rax
mov rcx, rsi
lea rsi, [rsp + 0x31]
lea r14, [rsp + 0x2e]
call sub.msvcrt.dll_free
mov rdx, rsi
mov ecx, ebp
call fcn.14000963c
mov al, byte [rsi]
test al, al
je 0x1400276a2
mov byte [rsp + 0x2e], al
mov r8d, 0x104
mov rdx, r12
mov rcx, r14
call r13
mov ebp, ebx
lea rsi, [rsi + 1]
test eax, eax
je 0x14002769e
mov rcx, r12
lea ebp, [rbx + 1]
lea rbx, [rdi + rbx*8]
call fcn.1400261dd
mov qword [rbx], rax
cmp ebp, 0x10
je 0x1400276a4
mov ebx, ebp
jmp 0x140027664
mov ebp, ebx
mov rcx, qword [0x14010fdb8]
mov edx, 0x7d0
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov ebx, eax
test eax, eax
je 0x1400276d5
lea rcx, str.Could_not_obtain_process_search_lock
call fcn.1400380b9
mov rcx, rdi
call sub.msvcrt.dll_free
jmp 0x140027605
cmp qword [0x14010fdb0], 0
jne 0x14002772f
mov rcx, qword [0x14010fdb0]
call sub.msvcrt.dll_free
inc dword [0x14010fda4]
mov rcx, qword [0x14010fdc0]
mov qword [0x14010fdb0], rdi
mov dword [0x14010fdac], ebp
mov dword [0x14010fda0], 1
call qword [sym.imp.KERNEL32.DLL_SetEvent]
test eax, eax
jne 0x14002774d
call fcn.140038579
lea rcx, str.Could_not_signal_start_event_to_process_search:__s
mov rdx, rax
call fcn.1400380b9
jmp 0x14002774d
cmp ebx, dword [0x14010fdac]
mov rax, qword [0x14010fdb0]
jae 0x1400276df
mov edx, ebx
inc ebx
mov rcx, qword [rax + rdx*8]
call sub.msvcrt.dll_free
jmp 0x14002772f
mov rcx, qword [0x14010fdb8]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
add rsp, 0x150
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x14002810c
Capabilities:
Parse credit card information

Disassembly:
push rbp
push rdi
push rsi
push rbx
lea rax, [0x140111020]
xor r9d, r9d
xor edx, edx
mov r10d, 1
mov rbx, rax
mov r8, rcx
movsxd r11, edx
mov cl, byte [r8 + r11]
test cl, cl
je 0x1400282db
cmp r9d, 0x1d
je 0x1400282db
cmp cl, 0x3f
je 0x1400281a6
jg 0x140028176
cmp cl, 0x2b
je 0x14002819e
jg 0x140028165
cmp cl, 0x24
je 0x140028196
cmp cl, 0x2a
jne 0x1400282bd
mov byte [rax], 5
jmp 0x1400282c3
cmp cl, 0x2e
jne 0x1400282bd
mov byte [rax], 1
jmp 0x1400282c3
cmp cl, 0x5c
je 0x1400281ae
cmp cl, 0x5e
je 0x14002818e
cmp cl, 0x5b
je 0x14002821b
jmp 0x1400282bd
mov byte [rax], 2
jmp 0x1400282c3
mov byte [rax], 3
jmp 0x1400282c3
mov byte [rax], 6
jmp 0x1400282c3
mov byte [rax], 4
jmp 0x1400282c3
lea r11, [r8 + r11 + 1]
mov cl, byte [r11]
test cl, cl
je 0x1400282c3
inc edx
cmp cl, 0x64
je 0x1400281f0
jg 0x1400281de
cmp cl, 0x53
je 0x140028208
cmp cl, 0x57
je 0x1400281f8
cmp cl, 0x44
jne 0x140028210
mov byte [rax], 0xb
jmp 0x1400282c3
cmp cl, 0x73
je 0x140028200
cmp cl, 0x77
jne 0x140028210
mov byte [rax], 0xc
jmp 0x1400282c3
mov byte [rax], 0xa
jmp 0x1400282c3
mov byte [rax], 0xd
jmp 0x1400282c3
mov byte [rax], 0xe
jmp 0x1400282c3
mov byte [rax], 0xf
jmp 0x1400282c3
mov byte [rax], 7
mov cl, byte [r11]
jmp 0x1400282c0
cmp byte [r8 + r11 + 1], 0x5e
jne 0x140028232
mov byte [rax], 9
cmp byte [r8 + r11 + 2], 0
je 0x140028260
inc edx
jmp 0x140028235
mov byte [rax], 8
mov edi, edx
mov ecx, r10d
lea rbp, [0x140110fe0]
inc edx
movsxd rsi, edx
mov r11b, byte [r8 + rsi]
cmp r11b, 0x5d
je 0x140028299
test r11b, r11b
je 0x140028299
cmp r11b, 0x5c
jne 0x14002827f
cmp ecx, 0x26
jle 0x140028267
xor eax, eax
jmp 0x1400282ee
cmp byte [r8 + rsi + 1], 0
je 0x140028260
movsxd r11, ecx
lea edx, [rdi + 2]
inc ecx
mov byte [rbp + r11], 0x5c
jmp 0x140028284
cmp ecx, 0x27
jg 0x140028260
movsxd rsi, edx
movsxd r11, ecx
mov edi, edx
inc ecx
mov sil, byte [r8 + rsi]
mov byte [rbp + r11], sil
jmp 0x140028241
cmp ecx, 0x27
jg 0x140028260
lea r11, [0x140110fe0]
movsxd r10, r10d
movsxd rsi, ecx
add r10, r11
mov byte [r11 + rsi], 0
mov qword [rax + 8], r10
lea r10d, [rcx + 1]
jmp 0x1400282c3
mov byte [rax], 7
mov byte [rax + 8], cl
movsxd rcx, edx
add rax, 0x10
cmp byte [r8 + rcx], 0
je 0x140028260
inc edx
inc r9d
jmp 0x140028128
movsxd r9, r9d
lea rax, [0x140111020]
shl r9, 4
mov byte [rbx + r9], 0
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140029870
Capabilities:
Delete file

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
call fcn.140028c45
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov esi, eax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
test rbx, rbx
je 0x14002989f
mov rcx, rbx
call sub.msvcrt.dll_free
mov ecx, edi
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x140029933
Capabilities:
Get file attributes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
call fcn.140028c45
mov rsi, qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp word [rax], 0x22
mov rbx, rax
jne 0x140029974
mov rcx, rax
call sub.msvcrt.dll_wcslen
cmp word [rbx + rax*2 - 2], 0x22
jne 0x140029974
mov rcx, rbx
call sub.msvcrt.dll_wcslen
lea rcx, [rbx + 2]
mov word [rbx + rax*2 - 2], 0
jmp 0x140029977
mov rcx, rbx
call rsi
mov esi, eax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rcx, rbx
mov edi, eax
call sub.msvcrt.dll_free
mov ecx, edi
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140029a5b
Capabilities:
Get graphical window text

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, rcx
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov rbp, qword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
call rbp
mov ebx, eax
test esi, esi
je 0x140029af8
movsxd rcx, esi
mov edx, 2
call sub.msvcrt.dll_calloc
mov rdi, rax
call rbp
test rdi, rdi
je 0x140029af3
mov r8d, esi
mov rcx, r12
mov rdx, rdi
xor r12d, r12d
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, eax
call rbp
mov ebx, eax
test esi, esi
je 0x140029adc
mov rcx, rdi
call fcn.14002999d
mov r12, rax
call rbp
test r12, r12
je 0x140029ad5
mov rcx, r12
call sub.msvcrt.dll_strlen
lea esi, [rax + 2]
call rbp
mov ebx, eax
jmp 0x140029adc
mov ebx, 0xe
xor esi, esi
mov rcx, rdi
call sub.msvcrt.dll_free
test r12, r12
je 0x140029afa
mov rcx, r12
call sub.msvcrt.dll_free
jmp 0x140029afa
mov ebx, 0xe
xor esi, esi
mov ecx, ebx
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x14002a538
Capabilities:
Delete registry key

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
xor eax, eax
lea rdx, [0x14009656d]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x38]
mov rsi, rcx
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, eax
xor eax, eax
test edx, edx
jne 0x14002a5cc
mov rcx, qword [rsp + 0x38]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, eax
mov ebx, eax
and edi, 0xfffffffd
je 0x14002a5ba
mov ecx, eax
call qword [sym.imp.KERNEL32.DLL_SetLastError]
lea r8, str.Key_is_not_empty
cmp ebx, 5
je 0x14002a5ab
call fcn.140038579
mov r8, rax
mov rdx, rsi
lea rcx, str.Failed_to_delete_registry_key_HKCUSoftware_s:__s
call fcn.1400380b9
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
Function at 0x14002a6d4
Capabilities:
Get common file path

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r13, rcx
lea rcx, [0x140112e40]
call fcn.140028c45
lea rcx, [0x1400965a9]
mov rbp, rax
call fcn.140028c45
mov edx, 2
mov ecx, 0x104
mov r12, rax
call sub.msvcrt.dll_calloc
xor r8d, r8d
mov rdx, r12
mov rcx, rbp
mov r9, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
mov r14, qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
call r14
mov esi, eax
test ebx, ebx
je 0x14002a771
xor eax, eax
mov dword [rsp + 0x28], 0x104
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x38], rax
mov r8, rdi
mov ecx, 0xfde9
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov ebx, eax
test eax, eax
jne 0x14002a771
call r14
mov esi, eax
test rdi, rdi
je 0x14002a77e
mov rcx, rdi
call sub.msvcrt.dll_free
test r12, r12
je 0x14002a78b
mov rcx, r12
call sub.msvcrt.dll_free
test rbp, rbp
je 0x14002a798
mov rcx, rbp
call sub.msvcrt.dll_free
mov ecx, esi
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, ebx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x14002a7b1
Capabilities:
Get common file path

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
xor eax, eax
xor r9d, r9d
mov rbp, rcx
lea rdi, [rsp + 0x48]
mov ecx, 0x82
mov r8d, edx
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x48]
mov rdx, rdi
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ebx, eax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
or r9d, 0xffffffff
mov r8, rdi
xor edx, edx
mov esi, eax
xor eax, eax
mov qword [rsp + 0x20], rbp
mov ecx, 0xfde9
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x104
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov ecx, esi
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, ebx
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x14002a82e
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x30
call fcn.140028c45
mov rbx, rax
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test rbx, rbx
je 0x14002a859
mov rcx, rbx
mov dword [rsp + 0x2c], eax
call sub.msvcrt.dll_free
mov eax, dword [rsp + 0x2c]
add rsp, 0x30
pop rbx
ret
Function at 0x14002ade2
Capabilities:
Set registry value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov esi, edx
mov ebp, r9d
mov edx, 0x5c
xor r9d, r9d
mov qword [rsp + 0x60], r9
mov rbx, rcx
mov rdi, r8
mov qword [rsp + 0x68], r9
call sub.msvcrt.dll_strchr
test rax, rax
je 0x14002ae2b
mov r8d, 0x91
lea rdx, [0x1400965d4]
lea rcx, [0x1400965ea]
call qword [sym.imp.msvcrt.dll__wassert]
lea rax, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov r9d, 0x2001d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14002ae5b
xor r8d, r8d
mov qword [rsp + 0x60], r8
jmp 0x14002aec6
lea rax, [rsp + 0x5c]
xor edx, edx
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x30], rdx
lea rdx, [0x140096628]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], 7
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14002aea9
xor eax, eax
mov qword [rsp + 0x68], rax
jmp 0x14002aec6
mov dword [rsp + 0x28], ebp
mov rcx, qword [rsp + 0x68]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14002aed6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14002aee7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x14002af82
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x180
xor eax, eax
mov rbx, rdx
mov edx, dword [rsp + 0x1e0]
mov r12, r9
mov r13, rcx
lea rdi, [rsp + 0x7c]
mov ecx, 0x41
xor r9d, r9d
mov dword [rsp + 0x60], 0xffffffff
rep stosd dword [rdi], eax
mov ecx, edx
mov rdi, r12
mov qword [rsp + 0x68], r9
rep stosb byte [rdi], al
mov rcx, rbx
mov qword [rsp + 0x70], r9
lea r14, [rsp + 0x7c]
mov dword [rsp + 0x64], edx
call sub.msvcrt.dll_strlen
mov rcx, rax
mov rbp, rax
test rbp, rbp
je 0x14002b07b
cmp byte [rbx + rbp], 0x5c
je 0x14002aff8
dec rbp
jmp 0x14002afe4
cmp rbp, 0x103
ja 0x14002b13b
mov eax, 0x104
inc rcx
mov rdi, r14
mov rsi, rbx
cmp rcx, rax
cmova rcx, rax
mov ecx, ecx
rep movsb byte [rdi], byte [rsi]
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov r9d, 0x20019
mov rcx, r13
lea rdx, [rax + 1]
cmp rdx, 0x104
mov edx, 0x103
cmovae rax, rdx
xor r8d, r8d
mov rdx, r14
mov byte [rsp + rax + 0x7c], 0
lea rax, [rsp + 0x70]
mov byte [rsp + rbp + 0x7c], 0
inc rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14002b0f4
xor r8d, r8d
mov qword [rsp + 0x70], r8
jmp 0x14002b11a
lea rax, [rsp + 0x68]
xor r8d, r8d
mov r9d, 0x2001d
mov rcx, r13
mov qword [rsp + 0x20], rax
lea rdx, [0x14009656d]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14002b0ab
xor ecx, ecx
mov qword [rsp + 0x68], rcx
jmp 0x14002b11a
lea rax, [rsp + 0x5c]
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
xor eax, eax
mov dword [rsp + 0x20], edx
lea rdx, [0x14009664a]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 7
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14002b06e
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], r12
lea rdx, [rbx + rbp]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14002b12a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14002b13b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
add rsp, 0x180
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x14002b407
Capabilities:
Get graphical window text

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov byte [rdx], 0
movsxd r13, r8d
mov rbx, rcx
mov rdi, rdx
mov rcx, r13
mov edx, 2
call sub.msvcrt.dll_calloc
mov rcx, rbx
mov r8d, r13d
mov rdx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r14, qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r12d, eax
call r14
mov ebx, eax
test r12d, r12d
je 0x14002b487
xor eax, eax
or r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x38], rax
mov r8, rsi
mov ecx, 0xfde9
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
test eax, eax
jne 0x14002b487
call r14
mov ebx, eax
test rsi, rsi
je 0x14002b494
mov rcx, rsi
call sub.msvcrt.dll_free
mov ecx, ebx
mov byte [rdi + r13 - 1], 0
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp qword [sym.imp.KERNEL32.DLL_SetLastError]
Function at 0x140035908
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x180
xor r10d, r10d
xor eax, eax
xor r9d, r9d
mov dword [r8], r10d
mov r13, rcx
lea rdi, [rsp + 0x7c]
mov ecx, 0x41
rep stosd dword [rdi], eax
mov rcx, rdx
mov qword [rsp + 0x68], r9
mov rbx, rdx
mov qword [rsp + 0x70], r9
mov r12, r8
lea r14, [rsp + 0x7c]
mov dword [rsp + 0x60], 0xffffffff
mov dword [rsp + 0x64], 4
call sub.msvcrt.dll_strlen
mov rcx, rax
mov rbp, rax
test rbp, rbp
je 0x1400359fd
cmp byte [rbx + rbp], 0x5c
je 0x14003597a
dec rbp
jmp 0x140035966
cmp rbp, 0x103
ja 0x140035abd
mov eax, 0x104
inc rcx
mov rdi, r14
mov rsi, rbx
cmp rcx, rax
cmova rcx, rax
mov ecx, ecx
rep movsb byte [rdi], byte [rsi]
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov r9d, 0x20019
mov rcx, r13
lea rdx, [rax + 1]
cmp rdx, 0x104
mov edx, 0x103
cmovae rax, rdx
xor r8d, r8d
mov rdx, r14
mov byte [rsp + rax + 0x7c], 0
lea rax, [rsp + 0x70]
mov byte [rsp + rbp + 0x7c], 0
inc rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140035a76
xor r8d, r8d
mov qword [rsp + 0x70], r8
jmp 0x140035a9c
lea rax, [rsp + 0x68]
xor r8d, r8d
mov r9d, 0x2001d
mov rcx, r13
mov qword [rsp + 0x20], rax
lea rdx, [0x140099441]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140035a2d
xor ecx, ecx
mov qword [rsp + 0x68], rcx
jmp 0x140035a9c
lea rax, [rsp + 0x5c]
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
xor eax, eax
mov dword [rsp + 0x20], edx
lea rdx, [0x14009944a]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 7
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1400359f0
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], r12
lea rdx, [rbx + rbp]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140035aac
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140035abd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
add rsp, 0x180
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140036916
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140036950
xor eax, eax
mov dword [rcx + 0xc], edx
mov dword [rcx + 8], eax
mov ecx, edx
mov edx, 8
call sub.msvcrt.dll_calloc
mov qword [rbx], rax
test rax, rax
jne 0x140036950
lea rcx, str.Could_not_allocate_string_array
add rsp, 0x20
pop rbx
jmp fcn.1400380b9
add rsp, 0x20
pop rbx
ret