joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140074be0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push r12
push r13
push r15
sub rsp, 0x180
mov rax, qword [0x1400e3e28]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x50], rcx
mov r15, r8
mov rcx, rdx
mov r12, rdx
xor ebp, ebp
xor ebx, ebx
call fcn.140049f20
mov r13, rax
test rax, rax
jne 0x140074c5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.14004a7c0
mov r9, rax
lea rdx, str.schannel:_invalid_path_name_for_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.140035bc0
xor ecx, ecx
lea ebx, [rbp + 0x4d]
call qword [str.05_t_]
jmp 0x140074e18
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, r13
mov qword [rsp + 0x170], r14
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140074cd1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.14004a7c0
mov r9, rax
lea rdx, str.schannel:_failed_to_open_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.140035bc0
xor ecx, ecx
lea ebx, [r14 + 0x4e]
jmp 0x140074e02
lea rdx, [rsp + 0x48]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140074d1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.14004a7c0
mov r9, rax
lea rdx, str.schannel:_failed_to_determine_size_of_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.140035bc0
mov ebx, 0x4d
jmp 0x140074df6
mov qword [rsp + 0x178], rdi
mov rdi, qword [rsp + 0x48]
cmp rdi, 0x100000
jle 0x140074d4f
mov r8d, 0x100000
lea rdx, str.schannel:_CA_file_exceeds_max_size_of__u_bytes
mov rcx, r15
call fcn.140035bc0
mov ebx, 0x4d
jmp 0x140074dee
lea rcx, [rdi + 1]
call qword [str.L__t_]
mov rbp, rax
test rax, rax
jne 0x140074d69
lea ebx, [rax + 0x1b]
jmp 0x140074dee
mov qword [rsp + 0x1c8], rsi
test rdi, rdi
je 0x140074dc8
nop word [rax + rax]
mov r8d, edi
mov dword [rsp + 0x40], 0
sub r8d, ebx
mov esi, ebx
lea rdx, [rbx + rbp]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140074e3a
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x140074dbf
mov edi, esi
jmp 0x140074dc1
add ebx, eax
mov eax, ebx
cmp rax, rdi
jb 0x140074d80
mov rcx, qword [rsp + 0x50]
mov r9, r12
mov r8, rdi
mov byte [rdi + rbp], 0
mov rdx, rbp
mov qword [rsp + 0x20], r15
call fcn.140074940
mov ebx, eax
mov rsi, qword [rsp + 0x1c8]
mov rdi, qword [rsp + 0x178]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [str.05_t_]
mov rcx, r13
call fcn.140093530
mov r14, qword [rsp + 0x170]
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14003b5c0
add rsp, 0x180
pop r15
pop r13
pop r12
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.14004a7c0
mov r9, rax
lea rdx, str.schannel:_failed_to_read_from_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.140035bc0
mov ebx, 0x4d
jmp 0x140074de6
Function at 0x14007cd40
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [str.L__t_]
mov rdi, rax
test rax, rax
jne 0x14007cd82
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x14007cdc9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x14007ce22
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x14007cde0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x14007ce63
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400b6d9d]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400b6d9e]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x14007ce30
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x14008aa2c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14008ab5c
Function at 0x1400a60a8
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400a60c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14008d0c8
or eax, 0xffffffff
jmp 0x1400a60ca
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400da4ab
Capabilities:
Query environment variable

Disassembly:
jmp 0x14027fad0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
lea rcx, reloc.WS2_32.dll_accept
call fcn.1400dabe5
mov rcx, qword [rbp + 0x1a0]
call qword [sym.imp.ucrtbased.dll__strdup]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
call fcn.14027f450
mov qword [rbp + 0x28], rax
lea rdx, [0x1402a9a60]
mov rcx, qword [rbp + 0x28]
call fcn.1400dabfe
test rax, rax
je 0x14027fb55
lea rax, [0x1402a9a60]
mov qword [rbp + 0x168], rax
jmp 0x14027fb63
lea rax, [0x140296740]
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x168]
mov qword [rbp + 0x48], rax
lea rax, [rbp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rcx, str.APPDATA
call qword [sym.imp.ucrtbased.dll_getenv]
mov r9, rax
lea r8, str._s_fpga_miner_fpga_miner_conf.json
mov rdx, qword [rbp + 0x198]
mov rcx, qword [rbp + 0x190]
call fcn.1400da749
cmp qword [rbp + 0x28], 0
je 0x14027fbea
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 0x190]
call fcn.140283110
test eax, eax
je 0x14027fbea
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x28]
lea r8, str._s_sfpga_miner_conf.json
mov rdx, qword [rbp + 0x198]
mov rcx, qword [rbp + 0x190]
call fcn.1400da749
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 0x190]
call fcn.140283110
test eax, eax
je 0x14027fc14
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x190]
mov byte [rcx + rax], 0
jmp 0x14027fc36
mov rax, qword [rbp + 0x198]
mov rcx, qword [rbp + 0x190]
add rcx, rax
mov rax, rcx
mov byte [rax - 1], 0
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_free]
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.1400daa05
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret

Function at 0x1400da6ae
Capabilities:
Terminate process

Disassembly:
jmp 0x14028ae90
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400da843
Capabilities:
Parse pe header

Disassembly:
jmp 0x14028ac10
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14028ac30
xor al, al
jmp 0x14028acb1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14028ac43
xor al, al
jmp 0x14028acb1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14028ac6d
xor al, al
jmp 0x14028acb1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14028ac81
xor al, al
jmp 0x14028acb1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14028ac93
xor al, al
jmp 0x14028acb1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14028acaf
xor al, al
jmp 0x14028acb1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400dd750
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, reloc.WS2_32.dll_accept
call fcn.1400dabe5
cmp qword [rbp + 0x108], 0
jne 0x1400dd7a0
xor r9d, r9d
mov r8d, 1
lea rdx, [0x14029149e]
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rbp + 4], eax
jmp 0x1400dd7cb
mov rcx, qword [rbp + 0x108]
call fcn.1400da537
inc eax
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rbp + 0x108]
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140282c40
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x488
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xb6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4a8]
lea rcx, reloc.WS2_32.dll_accept
call fcn.1400dabe5
mov qword [rbp + 8], 0
mov rcx, qword [rbp + 0x478]
call fcn.1400da537
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
mov rcx, qword [rbp + 0x478]
mov byte [rcx + rax], 0xa
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jle 0x140282df1
mov dword [rbp + 0x48], 0
mov dword [rbp + 0x4c], 0
mov dword [rbp + 0x90], 0
mov dword [rbp + 0x2b4], 0
jmp 0x140282ce7
mov eax, dword [rbp + 0x2b4]
inc eax
mov dword [rbp + 0x2b4], eax
mov eax, dword [rbp + 0x90]
cmp dword [rbp + 0x2b4], eax
jae 0x140282d10
mov eax, dword [rbp + 0x2b4]
mov rcx, qword [rbp + 0x470]
cmp qword [rbp + rax*8 + 0x98], rcx
jne 0x140282d0e
jmp 0x140282d10
jmp 0x140282cd9
mov eax, dword [rbp + 0x90]
cmp dword [rbp + 0x2b4], eax
jne 0x140282d4a
cmp dword [rbp + 0x90], 0x40
jae 0x140282d4a
mov eax, dword [rbp + 0x2b4]
mov rcx, qword [rbp + 0x470]
mov qword [rbp + rax*8 + 0x98], rcx
mov eax, dword [rbp + 0x90]
inc eax
mov dword [rbp + 0x90], eax
xor eax, eax
test eax, eax
jne 0x140282ccd
mov rax, qword [rbp + 0x470]
inc rax
lea rcx, [rbp + 0x48]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
lea r8, [rbp + 0x90]
xor edx, edx
mov ecx, eax
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 1
jge 0x140282d84
xor al, al
jmp 0x140282df3
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x478]
add rcx, rax
mov rax, rcx
xor r9d, r9d
mov r8d, dword [rbp + 0x24]
mov rdx, rax
mov rcx, qword [rbp + 0x470]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jge 0x140282dcd
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x140282dc6
xor al, al
jmp 0x140282df3
mov dword [rbp + 0x64], 0
movsxd rax, dword [rbp + 0x64]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov eax, dword [rbp + 0x64]
mov ecx, dword [rbp + 0x24]
sub ecx, eax
mov eax, ecx
mov dword [rbp + 0x24], eax
jmp 0x140282cab
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_bind
call fcn.1400daa05
mov rax, rdi
lea rsp, [rbp + 0x458]
pop rdi
pop rbp
ret
Function at 0x140001194
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x30]
mov rbx, rdx
mov rdi, rcx
mov r9d, 1
lea rdx, str.SOFTWARENVIDIA_CorporationNVControlPanel2Client
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
test r8d, r8d
jne 0x1400011ce
mov rcx, 0xffffffff80000001
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001229
mov rcx, qword [rsp + 0x30]
mov eax, 4
lea r9, [rsp + 0x68]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x140001223
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x14000122b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140001238
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x40], 0
and dword [rsp + 0x38], 0
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x38]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x1400012af
mov ecx, dword [rsp + 0x38]
test ecx, ecx
je 0x1400012af
cmp ecx, 0xffffffff
je 0x1400012af
lea rdx, [rsp + 0x40]
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
je 0x1400012af
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [rbx], ax
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400012a8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400012b1
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400017a8
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
lea rdx, [rsp + 0x38]
lea rcx, str.UserDefinedLocale
xor r8d, r8d
mov word [rsp + 0x30], bx
mov dword [rsp + 0x38], ebx
call fcn.140001194
test eax, eax
jne 0x1400017f1
lea rcx, [rsp + 0x30]
call fcn.140001238
test eax, eax
jne 0x1400017e7
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x1400017ec
movzx eax, word [rsp + 0x30]
movzx ecx, ax
jmp 0x1400017f5
mov ecx, dword [rsp + 0x38]
call fcn.1400015dc
mov ecx, 0x3ff
and ax, cx
mov ecx, 1
cmp ax, cx
je 0x140001816
cmp ax, 0xd
je 0x140001816
xor eax, eax
jmp 0x140001818
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x140001820
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx]
lea rdx, str.NvCplApiGetSetting
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.NvCplApiSetSetting
mov qword [rdi + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.NvCplApiInit
mov qword [rdi + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.NvCplApiGetInfo
mov qword [rdi + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.NvCplApiEnumSettingValues
mov qword [rdi + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.NvCplApiExecute
mov qword [rdi + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
mov qword [rdi + 0x30], rax
cmp qword [rdi], rbx
je 0x1400018c3
cmp qword [rdi + 8], rbx
je 0x1400018c3
call fcn.140055fcc
test eax, eax
sete bl
xor edx, edx
mov ecx, ebx
call qword [rdi + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140001ad8
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.14005bf80
xor edi, edi
lea rdx, [rsp + 0x40]
lea rcx, str.UserDefinedLocale
xor r8d, r8d
mov ebx, 0xa807
mov word [rsp + 0x38], di
mov dword [rsp + 0x40], edi
call fcn.140001194
test eax, eax
jne 0x140001b2f
lea rcx, [rsp + 0x38]
call fcn.140001238
test eax, eax
jne 0x140001b25
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x140001b2a
movzx eax, word [rsp + 0x38]
movzx ecx, ax
jmp 0x140001b33
mov ecx, dword [rsp + 0x40]
call fcn.1400015dc
movzx ecx, ax
movzx edx, ax
and ecx, 0x3ff
shr dx, 0xa
cmp ecx, 0x12
jg 0x140001c5f
je 0x140001c55
cmp ecx, 0xa
jg 0x140001bfb
je 0x140001be0
dec ecx
je 0x140001bd6
sub ecx, 3
je 0x140001bb5
dec ecx
je 0x140001bab
dec ecx
je 0x140001ba1
dec ecx
je 0x140001b97
dec ecx
je 0x140001b8d
dec ecx
jne 0x140001d08
mov ebx, 0xa80d
jmp 0x140001d08
mov ebx, 0xa80c
jmp 0x140001d08
mov ebx, 0xa80b
jmp 0x140001d08
mov ebx, 0xa80a
jmp 0x140001d08
mov ebx, 0xa809
jmp 0x140001d08
movzx eax, dx
cmp eax, 2
je 0x140001bcc
cmp eax, 4
je 0x140001bcc
mov ebx, 0xa823
jmp 0x140001d08
mov ebx, 0xa822
jmp 0x140001d08
mov ebx, 0xa808
jmp 0x140001d08
movzx ecx, dx
dec ecx
je 0x140001bf1
mov ebx, 0xa80f
jmp 0x140001d08
mov ebx, 0xa80e
jmp 0x140001d08
sub ecx, 0xb
je 0x140001c4b
dec ecx
je 0x140001c41
dec ecx
je 0x140001c37
dec ecx
je 0x140001c2d
sub ecx, 2
je 0x140001c23
dec ecx
jne 0x140001d08
mov ebx, 0xa815
jmp 0x140001d08
mov ebx, 0xa814
jmp 0x140001d08
mov ebx, 0xa813
jmp 0x140001d08
mov ebx, 0xa812
jmp 0x140001d08
mov ebx, 0xa811
jmp 0x140001d08
mov ebx, 0xa810
jmp 0x140001d08
mov ebx, 0xa816
jmp 0x140001d08
cmp ecx, 0x40
jg 0x140001cfb
cmp ecx, 0x3f
jge 0x140001d03
cmp ecx, 0x1b
jg 0x140001cc1
je 0x140001cba
sub ecx, 0x13
je 0x140001cb3
dec ecx
je 0x140001cac
dec ecx
je 0x140001ca5
dec ecx
je 0x140001c90
cmp ecx, 3
je 0x140001d03
jmp 0x140001d08
movzx ecx, dx
dec ecx
je 0x140001c9e
mov ebx, 0xa81a
jmp 0x140001d08
mov ebx, 0xa81b
jmp 0x140001d08
mov ebx, 0xa819
jmp 0x140001d08
mov ebx, 0xa818
jmp 0x140001d08
mov ebx, 0xa817
jmp 0x140001d08
mov ebx, 0xa81d
jmp 0x140001d08
cmp ecx, 0x1d
je 0x140001cf4
cmp ecx, 0x1e
je 0x140001ced
cmp ecx, 0x1f
je 0x140001ce6
cmp ecx, 0x21
jle 0x140001d08
cmp ecx, 0x23
jle 0x140001d03
cmp ecx, 0x24
jne 0x140001d08
mov ebx, 0xa81e
jmp 0x140001d08
mov ebx, 0xa821
jmp 0x140001d08
mov ebx, 0xa820
jmp 0x140001d08
mov ebx, 0xa81f
jmp 0x140001d08
lea eax, [rcx - 0x43]
cmp eax, 1
ja 0x140001d08
mov ebx, 0xa81c
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400083d4
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140008437
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000844b
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000844b
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x140008450
cmp dword [rcx + 8], 0
je 0x14000844b
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x140008450
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140008460
Capabilities:
Delete registry key

Disassembly:
cmp qword [rcx + 0x10], 0
je 0x140008476
mov r8, rdx
mov rdx, qword [rcx]
mov rcx, qword [rcx + 0x10]
jmp fcn.1400083d4
mov rcx, qword [rcx]
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]

Function at 0x1400085f0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
xor edi, edi
mov rbx, r8
mov rbp, rdx
mov r12, rcx
test r8, r8
jne 0x14000861e
lea eax, [rdi + 0xd]
jmp 0x140008655
mov rsi, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea rsi, [rsi + rax*2]
lea edi, [rdi + rax*2]
cmp eax, 1
jne 0x140008621
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x14000c8dc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x1402ee230]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov bl, r9b
mov rsi, r8
lea r9, [rbp - 0x25]
lea r8, [rbp - 0x21]
call fcn.14000b784
test bl, bl
je 0x14000c9c3
lea rcx, str.COMCTL32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x14000c9c3
mov edx, 0x3ee
mov r8d, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14000c9c3
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000c9c3
lea r8, [rbp - 0x29]
lea rdx, [rbp - 9]
mov rcx, rax
call fcn.14000c460
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
je 0x14000c9c3
movzx edx, word [rbp - 0x29]
lea r9, [rbp - 0x19]
lea r8, [rbp - 0x11]
lea rcx, [rbp - 9]
call fcn.14000b784
mov edx, dword [rbp - 0x21]
mov ecx, dword [rsi]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [rbp - 0xd]
mov ecx, dword [rsi + 4]
mov r8d, 8
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r8d, dword [rbp - 0x19]
mov edx, dword [rbp - 0x25]
mov dword [rsi + 4], eax
mov ecx, eax
jmp 0x14000c9e2
mov edx, dword [rbp - 0x21]
mov ecx, dword [rsi]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [rbp - 0x1d]
mov ecx, dword [rsi + 4]
mov dword [rsi], eax
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [rsi + 4], eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1401be9b0
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000ca0c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x1402ee230]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r12, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000ca80
call fcn.1400081a8
mov ebx, eax
jmp 0x14000cb8f
mov r8, r12
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x14000caa1
call fcn.1400081a8
jmp 0x14000cb83
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000ca97
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jae 0x14000cadc
mov ebx, 0x8007000e
jmp 0x14000cb85
mov ecx, eax
test eax, eax
je 0x14000cb19
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14000cb0f
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14000cb19
lea rcx, [rsp + 0x70]
call fcn.140008c78
mov rax, qword [rsp + 0x70]
jmp 0x14000cb23
mov ecx, 0x80070216
call fcn.140001000
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x14000cb3a
test rax, rax
je 0x14000cad2
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14000ca97
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14000b124
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x14000cba6
lea rcx, [rsp + 0x70]
call fcn.14005e2bc
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1401be9b0
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret