joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140079842
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x18
mov eax, dword [0x140103354]
mov edx, dword [0x14010335c]
lea ebp, [rax - 1]
imul ebp, eax
mov eax, ebp
xor eax, 0xfffffffe
test eax, ebp
sete byte [rsp + 6]
cmp edx, 0xa
setl byte [rsp + 7]
lea rdi, [rcx + 8]
mov ebp, 0xc295f7ff
mov r10d, 0xa413275d
mov r9d, 0xffffffff
mov r11d, 0x8233496a
mov r15d, 0xf49549cc
mov r14d, 0x5625e453
xor r12d, r12d
mov r13d, 0x9a30f094
jmp 0x140079a9c
cmp ebp, 0x1fed192e
jg 0x140079994
cmp ebp, 0xc295f7ff
je 0x140079a0a
cmp ebp, 0xf49549cc
jne 0x140079a9c
mov dword [rcx], r12d
mov dword [rcx + 4], r12d
mov qword [rsp + 8], rdi
mov eax, dword [0x140103354]
mov esi, dword [0x14010335c]
lea ebx, [rax - 1]
imul ebx, eax
mov eax, ebx
xor eax, 0xfffffffe
and eax, ebx
sete bl
cmp esi, 0xa
setl dl
xor dl, bl
mov edx, 0x5625e453
cmovne edx, r13d
test eax, eax
mov ebp, edx
cmove ebp, r13d
cmp esi, 0xa
cmovge ebp, edx
jmp 0x140079a9c
cmp ebp, 0xa413275d
je 0x140079a2f
cmp ebp, 0xa9795ff5
jne 0x140079a9c
mov rax, qword [rsp + 8]
mov dword [rax], 0x6a09e667
mov rax, qword [rsp + 8]
mov dword [rax + 4], 0xbb67ae85
mov rax, qword [rsp + 8]
mov dword [rax + 8], 0x3c6ef372
mov rax, qword [rsp + 8]
mov dword [rax + 0xc], 0xa54ff53a
mov rax, qword [rsp + 8]
mov dword [rax + 0x10], 0x510e527f
mov rax, qword [rsp + 8]
mov dword [rax + 0x14], 0x9b05688c
mov rax, qword [rsp + 8]
add rax, 0x18
mov qword [rsp + 0x10], rax
mov ebp, 0x9bb2cca2
jmp 0x140079a9c
cmp ebp, 0x1fed192f
je 0x140079a80
cmp ebp, 0x5625e453
jne 0x140079a9c
mov qword [rcx], 0
mov ebp, 0xf49549cc
jmp 0x140079a9c
mov ebp, 0xa9795ff5
jmp 0x140079a9c
mov eax, dword [0x140103354]
mov r8d, dword [0x14010335c]
lea esi, [rax - 1]
imul esi, eax
mov eax, esi
xor eax, 0xfffffffe
and eax, esi
sete bl
cmp r8d, 0xa
setl dl
xor dl, bl
mov edx, 0x1fed192f
cmovne edx, r10d
test eax, eax
mov ebp, edx
cmove ebp, r10d
cmp r8d, 0xa
cmovge ebp, edx
jmp 0x140079a9c
mov al, byte [rsp + 6]
mov bl, byte [rsp + 7]
mov edx, eax
xor dl, bl
test bl, bl
mov ebp, 0x5625e453
cmovne ebp, r15d
test al, al
cmove ebp, r14d
test dl, dl
cmovne ebp, r15d
jmp 0x140079a9c
mov rax, qword [rsp + 0x10]
mov dword [rax], 0x1f83d9ab
mov rax, qword [rsp + 8]
mov dword [rax + 0x1c], 0x5be0cd19
mov eax, dword [0x140103354]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, r9d
sete al
mov ebp, 0x1fed192f
cmove ebp, r11d
cmp dword [0x14010335c], 0xa
setl dl
mov ebx, 0x1fed192f
cmovge ebp, ebx
xor dl, al
cmovne ebp, r11d
jmp 0x140079a9c
mov rax, qword [rsp + 0x10]
mov dword [rax], 0x1f83d9ab
mov rax, qword [rsp + 8]
mov dword [rax + 0x1c], 0x5be0cd19
mov ebp, 0xa413275d
cmp ebp, 0xc295f7fe
jg 0x1400798ad
cmp ebp, 0xa413275c
jg 0x14007991d
cmp ebp, 0x9a30f094
je 0x1400799bd
cmp ebp, 0x9bb2cca2
je 0x1400799c7
cmp ebp, 0x8233496a
jne 0x140079a9c
add rsp, 0x18
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400f4040
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x1400fd6a0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x1400f40b9
mov rcx, r10
call fcn.1400f3f10
test eax, eax
je 0x1400f40b9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x1400f40b6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x1400f40ad
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x1400f40b9
add r8, 0x28
cmp r8, r9
jne 0x1400f4098
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x140004b40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140004bb5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140004bb5
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140004ba5
nop
cmp rbx, rcx
jae 0x140004bb5
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140004b90
cmp rbx, rcx
jae 0x140004bb5
cmp word [rbx], 0
je 0x140004bb5
mov rax, rbx
jmp 0x140004bb7
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140007240
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rdi, r8
test r8, r8
je 0x1400072de
mov r8, qword [0x14007ba00]
lea rax, [rsp + 0x48]
xor esi, esi
mov qword [rsp + 0x20], rax
lea r9, str.HardwareConfig
mov qword [rsp + 0x48], rsi
mov rdx, 0xffffffff80000002
lea rcx, [0x14007b9e1]
call fcn.140017e50
test eax, eax
je 0x1400072de
mov r9, qword [rsp + 0x48]
test r9, r9
je 0x1400072de
mov r8d, dword [r9]
xor r8d, 0x92781293
cmp r8d, 0x20
jbe 0x1400072eb
mov qword [rsp + 0x40], rbx
lea edx, [rsi + 2]
lea rbx, [r9 + 4]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x1400072c7
mov word [rbx], si
mov rcx, qword [rsp + 0x48]
mov edx, 4
mov word [rdi], si
call fcn.14003f320
mov rbx, qword [rsp + 0x40]
xor al, al
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov ecx, 7
mov r10d, esi
test r8d, r8d
je 0x140007320
lea rax, [r9 + 4]
mov edx, r8d
mov r10d, r8d
nop dword [rax]
nop word [rax + rax]
add ecx, 7
xor word [rax], cx
lea rax, [rax + 2]
sub rdx, 1
jne 0x140007310
mov eax, r10d
mov edx, 0x80
mov rcx, rdi
mov word [r9 + rax*2 + 4], si
mov r9, 0xffffffffffffffff
mov r8, qword [rsp + 0x48]
add r8, 4
call fcn.140047c08
mov rcx, qword [rsp + 0x48]
mov edx, 4
call fcn.14003f320
mov rsi, qword [rsp + 0x50]
mov al, 1
add rsp, 0x30
pop rdi
ret

Function at 0x140007460
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov r8, qword [0x14007ba00]
lea r9, [0x140067e68]
mov rdx, 0xffffffff80000002
lea rcx, [0x14007b9e1]
call fcn.140017920
mov r8, qword [0x14007ba00]
lea r9, [0x140067d94]
mov rdx, 0xffffffff80000002
lea rcx, [0x14007b9e1]
call fcn.140017920
mov r8, qword [0x14007ba00]
lea r9, str.ItemName
mov rdx, 0xffffffff80000002
lea rcx, [0x14007b9e1]
call fcn.140017920
mov r8, qword [0x14007ba00]
lea r9, str.HardwareConfig
mov rdx, 0xffffffff80000002
lea rcx, [0x14007b9e1]
add rsp, 0x28
jmp fcn.140017920
Function at 0x140007ef0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
xor edi, edi
lea rax, [rsp + 0x40]
mov byte [rsp + 0x28], dil
lea r9, str.IdleSecs
lea r8, str.SoftwareParkControl
mov qword [rsp + 0x20], rax
mov rdx, 0xffffffff80000001
mov dword [rsp + 0x40], edi
lea rcx, [0x14007bba0]
call fcn.140017ad0
test al, al
je 0x140007f41
mov ebx, dword [rsp + 0x40]
test ebx, ebx
jne 0x140007f46
mov ebx, 0x12c
cmp byte [0x14007bce4], dil
jne 0x140007f80
mov byte [rsp + 0x28], dil
lea r9, str.IdleSecs
lea r8, str.SoftwareParkControl
mov dword [rsp + 0x20], ebx
mov rdx, 0xffffffff80000001
mov byte [0x14007bce4], 1
lea rcx, [0x14007bba0]
call fcn.1400179e0
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14007bce0], eax
jle 0x140007fd9
lea rcx, [0x14007bce0]
call fcn.14003ef94
cmp dword [0x14007bce0], 0xffffffff
jne 0x140007fd9
xorps xmm0, xmm0
mov dword [0x14007bce8], 0x1e
lea rcx, [0x14007bce0]
mov qword [0x14007bcf0], rdi
movdqu xmmword [0x14007bd00], xmm0
call fcn.14003ef34
mov rcx, qword [0x14007bb60]
lea rax, [0x14007bb78]
mov qword [0x14007bd00], rax
lea rax, [0x14007bb68]
mov qword [0x14007bd08], rax
test rcx, rcx
je 0x14000800c
mov edx, 0xfa
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r9, [0x14007bce8]
mov dword [0x14007bce8], ebx
mov qword [0x14007bcf0], rax
lea r8, [0x140007d10]
mov qword [0x14007bb60], rax
xor edx, edx
mov rax, qword [0x14007bb98]
xor ecx, ecx
mov qword [0x14007bcf8], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x48], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14000d9b0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140013840
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.140004200
mov rcx, rax
test rax, rax
je 0x1400138ea
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rdi, [0x140067d94]
lea rcx, [rsp + 0x38]
cmp rdi, 0x10000
jae 0x140013891
movzx edx, di
call fcn.140004c20
jmp 0x1400138a0
mov r8d, 2
mov rdx, rdi
call fcn.140003ad0
nop
lea rcx, [rbx + 0x28]
lea rdx, [rsp + 0x38]
call fcn.140013f60
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400138cf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 1
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140013ad0
mov ecx, 0x80004005
call fcn.140003f50
int3
Function at 0x140013900
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140075028]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, r8
mov rdi, rdx
mov r15, rcx
call fcn.140004200
mov rcx, rax
test rax, rax
je 0x140013abc
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov rbx, 0xffffffffffffffff
xor r12d, r12d
test rdi, rdi
je 0x14001397d
cmp rdi, 0x10000
jae 0x14001396e
movzx edx, di
lea rcx, [rsp + 0x58]
call fcn.140004c20
jmp 0x140013991
mov rax, rbx
inc rax
cmp word [rdi + rax*2], r12w
jne 0x140013971
jmp 0x140013980
mov eax, r12d
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.140003ad0
nop
lea rcx, [r15 + 0x48]
lea rdx, [rsp + 0x58]
call fcn.140013bd0
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400139bd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor bpl, bpl
mov dword [rsp + 0x58], r12d
mov rdx, qword [r15 + 0x10]
cmp dword [rdx - 8], 1
jle 0x1400139df
mov edx, dword [rdx - 0x10]
lea rcx, [r15 + 0x10]
call fcn.140003cd0
mov rdx, qword [r15 + 0x10]
mov eax, dword [r15 + 8]
or eax, 2
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140013a91
test rsi, rsi
je 0x140013a5a
cmp word [rsi], ax
je 0x140013a5a
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x140013a25
add ebx, ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140013a86
mov bpl, 1
jmp 0x140013a86
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov ebx, 1
mov r9d, ebx
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx ebp, bpl
test eax, eax
cmove ebp, ebx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rdi
mov rcx, r15
call fcn.140012f40
movzx eax, bpl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14003f5f0
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.140003f50
int3
Function at 0x140013ad0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140075028]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbp, rdx
mov dword [rsp + 0x60], r8d
mov rdx, qword [rcx + 0x10]
xor bl, bl
mov dword [rsp + 0x58], 0
mov rdi, rcx
cmp dword [rdx - 8], 1
jle 0x140013b1a
mov edx, dword [rdx - 0x10]
add rcx, 0x10
call fcn.140003cd0
mov rdx, qword [rdi + 0x10]
mov eax, dword [rdi + 8]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x40], rcx
or eax, 2
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rcx
xor r8d, r8d
mov rcx, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140013b9d
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 1
movzx ebx, bl
test eax, eax
cmove ebx, ecx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rbp
mov rcx, rdi
call fcn.140012f40
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14003f5f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400150d0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x110
mov rax, qword [0x140075028]
xor rax, rsp
mov qword [rsp + 0x100], rax
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
cmp qword [rsp + 0x128], 0
je 0x140015159
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x58], 0xffffffffffffffff
inc qword [rsp + 0x58]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
cmp word [rax + rcx*2], 0
jne 0x140015139
mov rax, qword [rsp + 0x58]
test rax, rax
jne 0x140015160
mov byte [rsp + 0x50], 0
jmp 0x140015165
mov byte [rsp + 0x50], 1
mov edx, 8
lea rcx, [rsp + 0x88]
call fcn.140014d30
lea rcx, [rsp + 0x88]
call fcn.140004310
nop
movzx eax, byte [rsp + 0x50]
test eax, eax
je 0x14001519c
lea rax, [0x140068c64]
mov qword [rsp + 0x60], rax
jmp 0x1400151a8
lea rax, [0x140067734]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x120]
lea rdx, [0x140068c68]
lea rcx, [rsp + 0x88]
call fcn.140007c70
lea rcx, [rsp + 0x88]
call fcn.140007a60
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x130]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x208
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140015254
mov byte [rsp + 0x51], 0
lea rcx, [rsp + 0x88]
call fcn.140003f10
movzx eax, byte [rsp + 0x51]
jmp 0x140015291
cmp qword [rsp + 0x78], 0
je 0x140015267
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x70], 0
je 0x14001527a
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x52], 1
lea rcx, [rsp + 0x88]
call fcn.140003f10
movzx eax, byte [rsp + 0x52]
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.14003f5f0
add rsp, 0x110
pop rdi
ret
Function at 0x140015690
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x858
mov rax, qword [0x140075028]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rcx, qword [rsp + 0x870]
call fcn.140003a30
mov edx, dword [rsp + 0x868]
mov rcx, qword [rsp + 0x860]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x147
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x20], eax
mov eax, 2
imul rax, rax, 0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0x800
jae 0x140015713
jmp 0x140015718
call fcn.14003f718
xor eax, eax
mov rcx, qword [rsp + 0x30]
mov word [rsp + rcx + 0x40], ax
cmp dword [rsp + 0x20], 0xffffffff
je 0x14001574a
movsxd rax, dword [rsp + 0x20]
lea r9, [rsp + 0x40]
mov r8, rax
mov edx, 0x148
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140015760
mov r8d, 0x3ff
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, 2
imul rax, rax, 0
movzx eax, word [rsp + rax + 0x40]
test eax, eax
je 0x140015788
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x870]
call fcn.140003bf0
mov al, 1
jmp 0x14001578a
xor al, al
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.14003f5f0
add rsp, 0x858
ret
Function at 0x140017010
Capabilities:
Identify system language via api

Disassembly:
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x30], 0x409
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x3c], 0x409
movzx eax, byte [rsp + 0x58]
test eax, eax
jne 0x1400170b4
mov dword [rsp + 0x34], 0x409
jmp 0x14001705c
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
movsxd rax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0xf8]
cmp dword [rcx + rax*4], 0
je 0x1400170b4
movsxd rax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0xf8]
movzx eax, word [rcx + rax*4]
and eax, 0x3ff
movzx ecx, word [rsp + 0x38]
and ecx, 0x3ff
cmp eax, ecx
jne 0x1400170b2
movsxd rax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0xf8]
mov eax, dword [rcx + rax*4]
jmp 0x14001712a
jmp 0x140017052
mov rcx, qword [rsp + 0x50]
call fcn.1400166c0
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140017126
movzx eax, byte [rsp + 0x58]
cmp eax, 1
jne 0x140017106
movzx eax, byte [rsp + 0x60]
test eax, eax
jne 0x140017106
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x140016ca0]
xor r8d, r8d
mov edx, 0x65
mov rcx, qword [0x14007af38]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140017126
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x30]
mov dword [rax + 0x100], ecx
mov rcx, qword [rsp + 0x50]
call fcn.1400168b0
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x1400171a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x850
mov rax, qword [0x140075028]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rax, qword [rsp + 0x860]
cmp qword [rax + 0x108], 0
jne 0x1400171dc
mov al, 1
jmp 0x1400173b1
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x800
rep stosb byte [rdi], al
mov edx, 0x400
lea rcx, [rsp + 0x40]
call fcn.140014f10
test rax, rax
jne 0x14001722d
mov eax, 2
imul rax, rax, 0
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0x800
jae 0x14001721c
jmp 0x140017221
call fcn.14003f718
xor eax, eax
mov rcx, qword [rsp + 0x28]
mov word [rsp + rcx + 0x40], ax
mov dword [rsp + 0x20], 0
jmp 0x140017241
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x860]
mov rcx, qword [rcx + 0xf8]
cmp dword [rcx + rax*4], 0
je 0x1400173af
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x860]
mov rcx, qword [rcx + 0x108]
cmp qword [rcx + rax*8], 0
je 0x1400173af
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x860]
mov rcx, qword [rcx + 0xf8]
mov edx, dword [rsp + 0x868]
cmp dword [rcx + rax*4], edx
jne 0x1400173aa
mov edx, 8
lea rcx, [rsp + 0x38]
call fcn.140014d30
lea rcx, [rsp + 0x38]
call fcn.140004310
nop
mov eax, 2
imul rax, rax, 0
movzx eax, word [rsp + rax + 0x40]
test eax, eax
je 0x1400172fa
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x860]
mov rcx, qword [rcx + 0x108]
mov r9, qword [rcx + rax*8]
lea r8, [rsp + 0x40]
lea rdx, str._s_s
lea rcx, [rsp + 0x38]
call fcn.140007c70
jmp 0x14001731b
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x860]
mov rcx, qword [rcx + 0x108]
mov rdx, qword [rcx + rax*8]
lea rcx, [rsp + 0x38]
call fcn.140003bf0
lea rcx, [rsp + 0x38]
call fcn.140007a60
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140017349
mov byte [rsp + 0x24], 1
lea rcx, [rsp + 0x38]
call fcn.140003f10
movzx eax, byte [rsp + 0x24]
jmp 0x1400173b1
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x860]
mov rcx, qword [rcx + 0x108]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140017394
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [rsp + 0x25], 1
lea rcx, [rsp + 0x38]
call fcn.140003f10
movzx eax, byte [rsp + 0x25]
jmp 0x1400173b1
mov byte [rsp + 0x26], 0
lea rcx, [rsp + 0x38]
call fcn.140003f10
movzx eax, byte [rsp + 0x26]
jmp 0x1400173b1
jmp 0x140017237
xor al, al
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.14003f5f0
add rsp, 0x850
pop rdi
ret
Function at 0x1400173d0
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov dword [rsp + 0x2c], eax
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0
jmp 0x140017402
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x140017413
mov dword [rsp + 0x24], 1
jmp 0x14001741b
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x100]
cmp dword [rsp + 0x24], eax
je 0x14001747e
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0xf8]
movzx eax, word [rcx + rax*4]
and eax, 0x3ff
movzx ecx, word [rsp + 0x2c]
and ecx, 0x3ff
cmp eax, ecx
jne 0x140017479
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0xf8]
movzx eax, word [rcx + rax*4]
and eax, 0x3ff
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
jmp 0x140017480
jmp 0x1400173f8
xor eax, eax
add rsp, 0x38
ret

Function at 0x140017920
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x140075028]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400179c9
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x1400179ba
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x1400179cb
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x1400179cb
xor al, al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14003f5f0
add rsp, 0x78
ret