joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007aa0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x120
mov rax, qword [0x140031008]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
movabs rax, 0x5b000a000d
xor edx, edx
mov qword [rsp + 0x40], rax
mov r8d, 0xc0
lea rcx, [rsp + 0x48]
call fcn.140015400
lea rcx, [rsp + 0x40]
test edi, edi
js 0x140007b10
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov r8d, edi
lea rax, [rsp + 0x40]
mov rdx, rbx
lea rcx, [rax + rcx*2]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x140007b19
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x14002ae00]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
add eax, eax
lea rdx, [rsp + 0x40]
mov r8d, eax
mov dword [rsp + 0x30], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140013ba0
add rsp, 0x120
pop rdi
pop rsi
pop rbx
ret

Function at 0x140007b80
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rcx
mov rbx, r8
mov rcx, r8
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdi, 0xffffffffffffffff
lea eax, [rax*2 + 2]
movsxd rcx, eax
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.140013bc8
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
mov rcx, rsi
movsxd r8, eax
test eax, eax
js 0x140007c07
nop word [rax + rax]
movzx eax, word [rbx + rdx*2]
mov word [rcx], ax
test ax, ax
je 0x140007c07
cmp ax, 0x5b
jne 0x140007bfb
add rcx, 2
mov word [rcx], 0x5c
add rcx, 2
inc rdx
cmp rdx, r8
jle 0x140007be0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, str._s_s_r_n
add ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [rbx + 1]
add ecx, eax
mov eax, 2
movsxd r9, ecx
mul r9
cmovo rax, rdi
mov rcx, rax
call fcn.140013bc8
mov r9, rsi
lea rdx, str._s_s_r_n
mov r8, rbp
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
add eax, eax
mov rdx, rdi
mov r8d, eax
mov dword [rsp + 0x30], eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
mov ebx, eax
call fcn.140013bc0
mov rcx, rsi
call fcn.140013bc0
mov eax, ebx
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140007cb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, rcx
mov rbp, r8
mov rcx, rdx
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [0x14002ae58]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rbp
add ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8d, [rax + 1]
mov eax, 2
add r8d, ebx
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140013bc8
mov r8, rsi
lea rdx, [0x14002ae58]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x14002ae60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], 0
add eax, eax
mov rdx, rdi
mov r8d, eax
mov dword [rsp + 0x68], eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
mov ebx, eax
call fcn.140013bc0
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140007d90
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rsi
push r14
sub rsp, 0x138
mov rax, qword [0x140031008]
xor rax, rsp
mov qword [rsp + 0x110], rax
cmp qword [rdx], 0
mov r14, rdx
mov rsi, rcx
je 0x140007f56
mov qword [r11 + 0x18], rbx
mov rbx, qword [rsp + 0x38]
mov qword [r11 - 0x18], rbp
xor ebp, ebp
mov qword [r11 - 0x20], rdi
mov edi, ebp
mov qword [r11 - 0x28], r15
lea r15, [0x14003a6f0]
nop
mov eax, dword [rdx + 0x10]
sub eax, 1
je 0x140007ed9
sub eax, 1
je 0x140007ea4
sub eax, 1
je 0x140007e70
sub eax, 1
je 0x140007e5c
cmp eax, 1
jne 0x140007f21
movsxd rax, dword [0x14003aa10]
cmp eax, dword [0x140039fc0]
jge 0x140007f21
mov rcx, qword [r15 + rax*8]
test rcx, rcx
cmovne rbx, rcx
inc dword [0x14003aa10]
test rcx, rcx
je 0x140007f21
mov rdx, qword [rdx]
mov r8, rbx
mov rcx, rsi
call fcn.140007cb0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140007f21
mov r8, qword [rdx + 8]
mov rcx, rsi
mov rdx, qword [rdx]
call fcn.140007b80
jmp 0x140007f21
mov r9, qword [rdx + 8]
lea rcx, [rsp + 0x40]
mov r8, qword [rdx]
lea rdx, str._s_08x_r_n
mov r9d, dword [r9]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], eax
jmp 0x140007f0b
mov rax, qword [rdx + 8]
lea rcx, [rsp + 0x40]
mov r8, qword [rdx]
lea rdx, str._s_04x_r_n
movzx r9d, word [rax]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
lea r9, [rsp + 0x34]
mov dword [rsp + 0x34], eax
jmp 0x140007f0b
mov r9, qword [rdx + 8]
lea rcx, [rsp + 0x40]
mov r8, qword [rdx]
lea rdx, str._s_d_r_n
mov r9d, dword [r9]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
lea r9, [rsp + 0x38]
mov dword [rsp + 0x38], eax
mov r8d, eax
mov qword [rsp + 0x20], rbp
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc rdi
lea rax, [rdi + rdi*2]
cmp qword [r14 + rax*8], rbp
lea rdx, [r14 + rax*8]
jne 0x140007de0
mov r15, qword [rsp + 0x120]
mov rdi, qword [rsp + 0x128]
mov rbp, qword [rsp + 0x130]
mov rbx, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140013ba0
add rsp, 0x138
pop r14
pop rsi
ret
Function at 0x140008fb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x140031008]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov r8d, 0xffffffff
lea rdx, str.Keyboard
mov rsi, rcx
call fcn.140007aa0
mov edi, eax
lea r15, [0x1400334d0]
and edi, 1
xor r12d, r12d
mov r14d, r12d
nop dword [rax]
movzx ebx, word [r15]
lea rdx, str.Page_03u
mov r8d, r14d
lea rcx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rbp + 0x10]
mov r9d, ebx
lea rdx, str._s_04x_r_n
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r12
add eax, eax
lea rdx, [rsp + 0x40]
mov r8d, eax
mov dword [rsp + 0x30], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc r14d
lea r15, [r15 + 2]
and edi, eax
cmp r14d, 0xe
jl 0x140009010
mov r14d, r12d
lea r15, [0x1400334ec]
nop word [rax + rax]
movzx ebx, word [r15]
lea rdx, str.Button_03u
mov r8d, r14d
lea rcx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rbp + 0x10]
mov r9d, ebx
lea rdx, str._s_04x_r_n
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r12
add eax, eax
lea rdx, [rsp + 0x40]
mov r8d, eax
mov dword [rsp + 0x30], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc r14d
lea r15, [r15 + 2]
and edi, eax
cmp r14d, 0x13
jl 0x140009090
mov r14d, r12d
lea r15, [0x140033512]
nop word [rax + rax]
movzx ebx, word [r15]
lea rdx, str.General_03u
mov r8d, r14d
lea rcx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rbp + 0x10]
mov r9d, ebx
lea rdx, str._s_04x_r_n
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r12
add eax, eax
lea rdx, [rsp + 0x40]
mov r8d, eax
mov dword [rsp + 0x30], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc r14d
lea r15, [r15 + 2]
and edi, eax
cmp r14d, 0xa
jl 0x140009110
mov r14d, r12d
lea r15, [0x140033526]
nop word [rax + rax]
movzx ebx, word [r15]
lea rdx, str.Menu_03u
mov r8d, r14d
lea rcx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rbp + 0x10]
mov r9d, ebx
lea rdx, str._s_04x_r_n
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r12
add eax, eax
lea rdx, [rsp + 0x40]
mov r8d, eax
mov dword [rsp + 0x30], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc r14d
lea r15, [r15 + 2]
and edi, eax
cmp r14d, 0x20
jl 0x140009190
mov eax, edi
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.140013ba0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140009c30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov rax, qword [0x140031008]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
xor r13d, r13d
lea rsi, [0x1400398a0]
mov r12d, r13d
mov r15, rcx
mov r14d, 1
nop word [rax + rax]
mov r8d, r12d
lea rdx, str.AutoBoot_03u
mov rcx, r15
call fcn.140007aa0
mov r9d, dword [rsi]
lea r8, str.Count
lea rdx, str._s_d_r_n
and r14d, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r13
add eax, eax
lea rdx, [rsp + 0x40]
mov r8d, eax
mov dword [rsp + 0x30], eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
and r14d, eax
cmp dword [rsi], r13d
jle 0x140009df6
mov ebx, r13d
mov rbp, r13
nop
mov rax, qword [rsi + 8]
lea r8, str.Item_03u
movzx edi, word [rax + rbp]
movzx eax, word [rax + rbp + 4]
shl edi, 0x10
or edi, eax
test ebx, ebx
js 0x140009d2d
mov r8d, ebx
lea rdx, str.Item_03u
lea rcx, [rsp + 0x110]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x110]
mov r9d, edi
lea rdx, str._s_08x_r_n
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], r13
add eax, eax
lea rdx, [rsp + 0x40]
mov r8d, eax
mov dword [rsp + 0x34], eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
and r14d, eax
lea r8, str.Item_03uDelay
mov rax, qword [rsi + 8]
mov edi, dword [rax + rbp + 8]
test ebx, ebx
js 0x140009da4
mov r8d, ebx
lea rdx, str.Item_03uDelay
lea rcx, [rsp + 0x110]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x110]
mov r9d, edi
lea rdx, str._s_d_r_n
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], r13
add eax, eax
lea rdx, [rsp + 0x40]
mov r8d, eax
mov dword [rsp + 0x38], eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc ebx
add rbp, 0x10
and r14d, eax
cmp ebx, dword [rsi]
jl 0x140009cf0
inc r12d
add rsi, 0x10
cmp r12d, 4
jl 0x140009c80
mov eax, r14d
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140013ba0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000be20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x120
mov rax, qword [0x140031008]
xor rax, rsp
mov qword [rsp + 0x110], rax
movsxd rbx, edx
mov r8d, 0xffffffff
lea rdx, str.Margin
mov rsi, rcx
call fcn.140007aa0
mov edi, eax
and edi, 1
cmp ebx, 1
jbe 0x14000be71
mov rbx, qword [0x140033578]
and ebx, 1
shl rbx, 9
lea rax, [0x1400335d0]
add rbx, rax
lea r14, str.Caption
xor ebp, ebp
lea r15, str.Version
nop
mov rdx, qword [r14]
mov r8d, 0xffffffff
mov rcx, rsi
call fcn.140007aa0
mov r9d, dword [rbx - 4]
lea r8, str.Left
lea rdx, str._s_d_r_n
and edi, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rbp
add eax, eax
lea rdx, [rsp + 0x40]
mov r8d, eax
mov dword [rsp + 0x30], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r9d, dword [rbx]
lea r8, [0x14002ac98]
lea rdx, str._s_d_r_n
and edi, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rbp
add eax, eax
lea rdx, [rsp + 0x40]
mov r8d, eax
mov dword [rsp + 0x34], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r9d, dword [rbx + 4]
lea r8, str.Right
lea rdx, str._s_d_r_n
and edi, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rbp
add eax, eax
lea rdx, [rsp + 0x40]
mov r8d, eax
mov dword [rsp + 0x38], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r9d, dword [rbx + 8]
lea r8, str.Bottom
lea rdx, str._s_d_r_n
and edi, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], rbp
add eax, eax
lea rdx, [rsp + 0x40]
mov r8d, eax
mov dword [rsp + 0x3c], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
add r14, 8
lea rbx, [rbx + 0x10]
and edi, eax
cmp r14, r15
jl 0x14000be90
mov eax, edi
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140013ba0
mov rbx, qword [rsp + 0x160]
add rsp, 0x120
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000c010
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov rax, qword [0x140031008]
xor rax, rsp
mov qword [rsp + 0x110], rax
movsxd rbx, edx
mov rdi, 0xffffffffffffffff
mov r8d, edi
lea rdx, str.Font
mov r12, rcx
call fcn.140007aa0
mov ebp, eax
and ebp, 1
cmp ebx, 1
jbe 0x14000c06b
mov rsi, qword [0x140033578]
and esi, 1
jmp 0x14000c06e
mov rsi, rbx
shl rsi, 9
lea rax, [0x140033620]
add rsi, rax
lea r14, str.Caption
xor ebx, ebx
nop word [rax + rax]
mov rdx, qword [r14]
mov r8d, edi
mov rcx, r12
call fcn.140007aa0
mov r9d, dword [rsi - 8]
lea r8, str.Size
lea rdx, str._s_d_r_n
and ebp, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
add eax, eax
lea rdx, [rsp + 0x40]
mov r8d, eax
mov dword [rsp + 0x30], eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r9d, dword [rsi - 4]
lea r8, str.Flag
lea rdx, str._s_08x_r_n
and ebp, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rbx
add eax, eax
lea rdx, [rsp + 0x40]
mov r8d, eax
mov dword [rsp + 0x34], eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
and ebp, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
movsxd rcx, eax
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.140013bc8
mov rcx, rsi
mov r15, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rdx, rbx
mov rax, r15
mov r8, rcx
test ecx, ecx
js 0x14000c1a7
nop dword [rax]
movzx ecx, word [rsi + rdx*2]
mov word [rax], cx
test cx, cx
je 0x14000c1a7
cmp cx, 0x5b
jne 0x14000c19b
add rax, 2
mov word [rax], 0x5c
add rax, 2
inc rdx
cmp rdx, r8
jle 0x14000c180
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, str._s_s_r_n
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, str.Face
lea edi, [rax + 1]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [rdi + rbx]
add ecx, eax
mov eax, 2
movsxd rdx, ecx
mov rcx, 0xffffffffffffffff
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.140013bc8
mov r9, r15
lea r8, str.Face
lea rdx, str._s_s_r_n
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], 0
add eax, eax
mov rdx, rdi
mov r8d, eax
mov dword [rsp + 0x38], eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
mov ebx, eax
call fcn.140013bc0
mov rcx, r15
call fcn.140013bc0
and ebp, ebx
lea rax, str.Caption
mov rdi, 0xffffffffffffffff
add r14, 8
add rsi, 0x50
lea ebx, [rdi + 1]
cmp r14, rax
jl 0x14000c090
mov eax, ebp
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140013ba0
mov rbx, qword [rsp + 0x170]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000eb20
Capabilities:
Get installed programs
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x270
mov rax, qword [0x140031008]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edi, edi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
lea rcx, [rsp + 0x50]
mov dword [0x14003b06c], edi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x140029ee8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000ec67
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x280], rbx
lea rdx, str.UninstallString
lea rbx, [0x14003ae60]
mov dword [0x14003b06c], 1
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x30], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx eax, word [0x14003ae60]
cmp ax, 0x22
jne 0x14000ec1c
lea rdx, [0x14003ae62]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
movzx eax, word [0x14003ae60]
test ax, ax
je 0x14000ec54
cmp ax, 0x22
je 0x14000ec36
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x14000ec07
jmp 0x14000ec54
test ax, ax
je 0x14000ec54
cmp ax, 0x20
je 0x14000ec36
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x14000ec21
jmp 0x14000ec54
test rbx, rbx
je 0x14000ec54
cmp word [rbx], 0x5c
je 0x14000ec4b
sub rbx, 2
cmp word [rbx], 0x5c
jne 0x14000ec41
mov word [rbx + 2], di
mov edi, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x280]
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140013ba0
add rsp, 0x270
pop rdi
ret
Function at 0x14000ec90
Capabilities:
Check if file exists
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x580]
sub rsp, 0x680
mov rax, qword [0x140031008]
xor rax, rsp
mov qword [rbp + 0x570], rax
call section..text
cmp eax, 0x258
jb 0x14000ee0c
mov rbx, qword [0x14003aa18]
call section..text
cmp eax, 0x1f4
jb 0x14000ed1d
lea rcx, str.shell32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.SHGetFolderPathW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000ed1d
xor r9d, r9d
lea rcx, [rbp + 0x150]
mov qword [rsp + 0x20], rcx
mov r8, rbx
xor ecx, ecx
lea edx, [r9 + 0x1c]
call rax
test eax, eax
js 0x14000ee0c
lea rdx, str.VirtualStore
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x14003ae64]
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.Data_
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.CLaunch.ini
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea rcx, [rsp + 0x40]
test eax, eax
jne 0x14000ee03
lea rdx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.Data_
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x104
lea rcx, [rbp + 0x360]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rdx, [rbp + 0x360]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x14002c088]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.CLaunch.ini
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x40]
call fcn.14000ef10
test eax, eax
jne 0x14000ee63
lea rdx, [0x14003ae60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.Data_
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.CLaunch.ini
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea rcx, [rsp + 0x40]
test eax, eax
je 0x14000ee6d
call fcn.14000ef10
test eax, eax
je 0x14000eeef
mov eax, 1
jmp 0x14000eeef
lea rdx, [0x14003ae60]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.Data_
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x104
lea rcx, [rbp + 0x360]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rdx, [rbp + 0x360]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x14002c088]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.CLaunch.ini
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x40]
call fcn.14000ef10
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
mov rcx, qword [rbp + 0x570]
xor rcx, rsp
call fcn.140013ba0
mov rbx, qword [rsp + 0x690]
add rsp, 0x680
pop rbp
ret