joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005cc0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xd8], rbx
mov rbp, r8
mov rdi, rcx
movsxd rcx, dword [rcx + 0x20]
mov eax, dword [rdi + 0x1c]
imul eax, ecx
mov dword [rdi + 0xc], eax
test r8, r8
cmove rbp, rdx
xor esi, esi
or r15, 0xffffffffffffffff
test byte [rdi + 8], 0x80
je 0x140005e7f
test rdx, rdx
jne 0x140005d3f
mov eax, 2
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.140015344
mov rsi, rax
mov ecx, dword [rdi + 0x20]
add ecx, ecx
movsxd r8, ecx
mov rdx, rbp
mov rcx, rax
call fcn.140039a60
mov rdx, rsi
mov rbp, rsi
movsxd rcx, dword [rdi + 0x20]
test rcx, rcx
je 0x140005d64
nop dword [rax + rax]
dec rcx
movzx eax, word [rdx + rcx*2]
rol ax, 8
mov word [rdx + rcx*2], ax
test rcx, rcx
jne 0x140005d50
mov rbx, qword [rdi + 0x28]
cmp dword [rbx - 0x10], 0x3e8
jge 0x140005e7f
mov qword [rsp + 0x38], rbx
call fcn.140015d90
mov rcx, rax
test rax, rax
jne 0x140005d92
mov ecx, 0x80004005
call fcn.140002430
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
call fcn.140015d90
mov rcx, rax
test rax, rax
jne 0x140005db9
mov ecx, 0x80004005
call fcn.140002430
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
call fcn.140008da0
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140007430
nop
mov r9d, 2
lea r8, [0x1400646e8]
lea rdx, str.endian_swap
lea rcx, [rsp + 0x40]
call fcn.14000ae50
lea rdx, [rsp + 0x40]
lea rcx, [rdi + 0x28]
call fcn.140003120
nop
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140005e1f
call fcn.1400073b0
mov rbx, qword [rsp + 0x88]
test rbx, rbx
je 0x140005e41
mov rcx, rbx
call fcn.140004570
mov edx, 0x10
mov rcx, rbx
call fcn.140001c50
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005e60
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005e7f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
movsxd rdx, dword [rdi + 0xc]
mov r9, qword [rdi]
mov r8d, 1
mov rcx, rbp
call fcn.14003ffb4
cmp rax, 1
sete bl
test rsi, rsi
je 0x140005ea8
mov rcx, rsi
call fcn.14001533c
test bl, bl
je 0x140005eda
mov eax, dword [rdi + 0xc]
add dword [rdi + 0x18], eax
lea rcx, [rdi + 0x28]
mov dword [rsp + 0x28], r15d
mov eax, dword [rdi + 0x20]
mov dword [rsp + 0x20], eax
mov r9d, 0x18
mov r8, qword [rdi + 0x30]
lea rdx, str.write
call fcn.1400034f0
jmp 0x140005ee2
mov rcx, rdi
call fcn.140005260
movzx eax, bl
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140010450
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x1100
mov r9d, 0x400
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
call fcn.140015d90
mov rcx, rax
test rax, rax
jne 0x1400104af
mov ecx, 0x80004005
call fcn.140002430
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov r9, qword [rsp + 0x78]
lea rdx, str.error__d_n_s
lea rcx, [rsp + 0x68]
call fcn.140001dd0
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
call fcn.1400029c0
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.140011b00
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_LocalFree]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140011b00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov r15, rdx
mov rbx, rcx
cmp dword [rcx + 0x244], 0
jne 0x140011b40
mov rdx, qword [rdx]
or r14, 0xffffffffffffffff
jmp 0x140011cfd
lea rdx, [0x140063d48]
or r14, 0xffffffffffffffff
mov rax, r14
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x140011b50
mov r8d, eax
mov rcx, r15
call fcn.1400028a0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp dword [rbx + 0x248], 0
je 0x140011c79
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileType]
xor r13d, r13d
test al, 1
jne 0x140011c4b
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r9d, r14d
mov r8, qword [r15]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
mov rcx, rbx
call fcn.140015344
mov rdi, rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, qword [r15]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov ebx, eax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov r8, r14
nop
inc r8
cmp byte [rdi + r8], r13b
jne 0x140011c10
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x90]
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov rcx, rdi
jmp 0x140011cf4
mov rdx, qword [r15]
mov r8d, dword [rdx - 0x10]
add r8d, r8d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x90]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x140011cfa
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov ebp, eax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov rcx, qword [r15]
movsxd rdi, dword [rcx - 0x10]
lea ecx, [rdi + 1]
movsxd rcx, ecx
call fcn.140015344
mov rsi, rax
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.14003a1f0
mov r8d, edi
mov rdx, rsi
mov rcx, qword [r15]
call qword [sym.imp.USER32.dll_CharToOemBuffW]
mov byte [rdi + rsi], 0
xor r13d, r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x90]
mov r8d, edi
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov rcx, rsi
call fcn.14001533c
nop
mov rdx, qword [r15]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140011d16
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400142d0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14d, r8d
mov r15, rcx
mov rdi, r9
mov rbp, rdx
lea eax, [r14 + 1]
mov ecx, eax
mov ebx, eax
call fcn.140015344
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.14003a1f0
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], 0
jne 0x140014315
xor r9d, r9d
lea r10, [r15 + 0x40]
nop word [rax + rax]
xor edx, edx
lea r10, [r10 + 1]
mov eax, r9d
div r8d
movzx eax, byte [rdx + rdi]
mov byte [r10 - 1], r9b
inc r9d
mov byte [r10 + 0xff], al
cmp r9d, 0xff
jle 0x140014330
xor r9b, r9b
lea r8, [r15 + 0x40]
mov r10d, 0x100
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r8]
movzx eax, byte [r8 + 0x100]
lea r8, [r8 + 1]
add al, dl
add r9b, al
movzx ecx, r9b
movzx eax, byte [rcx + r15 + 0x40]
mov byte [r8 - 1], al
mov byte [rcx + r15 + 0x40], dl
sub r10, 1
jne 0x140014370
xor bl, bl
test r14d, r14d
je 0x1400143f8
mov r9, rsi
sub rbp, rsi
mov rdi, r14
nop
inc r10b
lea r9, [r9 + 1]
movzx edx, r10b
movzx r8d, byte [rdx + r15 + 0x40]
add bl, r8b
movzx ecx, bl
movzx eax, byte [rcx + r15 + 0x40]
mov byte [rdx + r15 + 0x40], al
mov byte [rcx + r15 + 0x40], r8b
movzx ecx, byte [rdx + r15 + 0x40]
add rcx, r8
movzx eax, cl
movzx ecx, byte [rax + r15 + 0x40]
xor cl, byte [r9 + rbp - 1]
mov byte [r9 - 1], cl
sub rdi, 1
jne 0x1400143b0
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140014df0
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov r15, rdx
movsxd rdi, ecx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
xor r9d, r9d
mov r8, rbx
xor edx, edx
call fcn.1400278c8
test eax, eax
jne 0x140014e51
lea rcx, str.Fatal_Error:_MFC_initialization_failed_n
call fcn.140001c70
mov eax, 1
jmp 0x140014fca
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov ecx, 0x2c0
call fcn.1400152e8
mov qword [rsp + 0x78], rax
test rax, rax
je 0x140014e7a
mov rcx, rax
call fcn.14000fa50
mov rsi, rax
jmp 0x140014e7c
xor esi, esi
mov r14, rdi
mov ebp, 1
cmp rbp, rdi
jge 0x140014f85
lea r12, str.____
mov rdi, qword [r15 + rbp*8]
call fcn.140015d90
test rax, rax
je 0x140014f7a
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x78], rbx
test rdi, rdi
je 0x140014efc
test rdi, 0xffffffffffff0000
jne 0x140014ee7
movzx edi, di
mov ecx, edi
call fcn.140016424
test rax, rax
je 0x140014f13
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140001ea0
jmp 0x140014f0e
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x140014ef0
jmp 0x140014efe
xor eax, eax
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x78]
call fcn.1400022a0
mov rbx, qword [rsp + 0x78]
cmp qword [rsi + 0x2a8], 0
jne 0x140014f3e
xor ecx, ecx
nop
movzx eax, word [rbx + rcx*2]
inc rcx
cmp ax, word [r12 + rcx*2 - 2]
jne 0x140014f3e
cmp rcx, 8
jne 0x140014f20
mov byte [rsi + 0x240], 1
jmp 0x140014f52
lea rcx, [rsi + 0x298]
mov r8, rbx
mov rdx, qword [rcx + 0x10]
call fcn.1400159d4
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140014f6c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc rbp
cmp rbp, r14
jl 0x140014e94
jmp 0x140014f85
mov ecx, 0x80004005
call fcn.140002430
int3
mov rcx, rsi
call fcn.1400108d0
cmp byte [rsi + 0x240], 0
jne 0x140014fba
mov rax, qword [rsi + 0x260]
cmp dword [rax - 0x10], 0
je 0x140014fba
mov rax, qword [rsi + 0x268]
cmp dword [rax - 0x10], 0
je 0x140014fba
mov rcx, rsi
call fcn.140010520
jmp 0x140014fca
call fcn.14000bf90
mov rcx, rax
mov rdx, rsi
call fcn.14000c2d0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14001a584
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x40]
call fcn.14002ca04
mov rdi, rax
test rax, rax
je 0x14001a600
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x14001a5fb
cmp dword [rbx], 0x40
jb 0x14001a5fb
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
or dword [rbx + 4], 1
xor r8d, r8d
or qword [rbx + 0x30], 0xffffffffffffffff
mov edx, 0x87
mov qword [rbx + 8], rcx
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x14001a5fb
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x14001a604
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14001e550
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x70
mov edi, r9d
mov rsi, r8
mov r14, rdx
mov r15d, ecx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x14007b3c0]
test eax, eax
je 0x14001e5a2
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14007b3c0]
test eax, eax
jne 0x14001e5ab
call fcn.14001511c
test eax, eax
je 0x14001e5c7
lea rdx, [rsp + 0x60]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14001e5d2
xor eax, eax
jmp 0x14001e680
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, rsi
mov rdx, r14
mov ecx, r15d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rsi, rax
mov qword [rsp + 0x68], rax
xor ebx, ebx
test rsi, rsi
sete bl
test ebx, ebx
je 0x14001e662
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14001e664
xor edi, edi
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14001e67d
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x14001e69c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov r14, rcx
and dword [rax - 0x18], 0
and qword [rax + 0x20], 0
xor ebx, ebx
mov eax, dword [0x14007b3c0]
test eax, eax
je 0x14001e6e6
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14007b3c0]
test eax, eax
jne 0x14001e6ef
call fcn.14001511c
test eax, eax
je 0x14001e70b
lea rdx, [rsp + 0x58]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14001e713
xor eax, eax
jmp 0x14001e75a
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.USER32.dll_GetClassInfoExW]
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14001e73d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14001e73f
xor esi, esi
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14001e758
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x14001e770
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14007e7a8]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14007b3c0]
test eax, eax
je 0x14001e7bb
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14007b3c0]
test eax, eax
jne 0x14001e7c4
call fcn.14001511c
test eax, eax
je 0x14001e7e0
lea rdx, [rsp + 0x48]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14001e7e8
xor eax, eax
jmp 0x14001e84d
test rbx, rbx
jne 0x14001e808
lea rcx, str.InitCommonControlsEx
call fcn.14001e4bc
mov rbx, rax
test rax, rax
je 0x14001e81b
mov qword [0x14007e7a8], rax
mov rcx, rbx
call fcn.140037cac
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14001e830
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14001e832
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14001e84b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14001e9a4
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, rcx
xor r14d, r14d
mov word [rax - 0x18], r14w
mov qword [rax + 0x10], r14
mov ebx, r14d
mov eax, dword [0x14007b3c0]
test eax, eax
je 0x14001e9ec
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14007b3c0]
test eax, eax
jne 0x14001e9f5
call fcn.14001511c
test eax, eax
je 0x14001ea11
lea rdx, [rsp + 0x48]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14001ea1b
movzx eax, r14w
jmp 0x14001ea63
mov rcx, rdi
call qword [sym.imp.USER32.dll_RegisterClassW]
movzx ebx, ax
mov word [rsp + 0x20], ax
mov edi, r14d
test bx, bx
sete dil
test edi, edi
je 0x14001ea44
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14001ea47
mov esi, r14d
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x14001ea60
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, bx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140029820
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x140029893
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400298a7
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1400298a7
mov rcx, rax
call fcn.140037cac
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rsi
mov rcx, rbp
call rdi
jmp 0x1400298ac
cmp dword [rcx + 8], 0
je 0x1400298a7
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x1400298ac
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14002ebec
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movzx r14d, r8w
mov r15, rdx
mov r12, rcx
or r13d, 0xffffffff
movzx esi, r13w
mov word [rax - 0x38], r13w
mov rbx, qword [0x14007ef38]
and qword [rax + 0x20], 0
xor edi, edi
mov eax, dword [0x14007b3c0]
test eax, eax
je 0x14002ec4a
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14007b3c0]
test eax, eax
jne 0x14002ec53
call fcn.14001511c
test eax, eax
je 0x14002ec6f
lea rdx, [rsp + 0x78]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne edi, ecx
test edi, edi
jne 0x14002ec79
movzx eax, r13w
jmp 0x14002ecea
test rbx, rbx
jne 0x14002ec99
lea rcx, str.GetFileTitleW
call fcn.14002eb58
mov rbx, rax
test rax, rax
je 0x14002ecb5
mov qword [0x14007ef38], rax
mov rcx, rbx
call fcn.140037cac
movzx r8d, r14w
mov rdx, r15
mov rcx, r12
call rbx
movzx esi, ax
mov word [rsp + 0x20], ax
xor ebx, ebx
cmp si, r13w
sete bl
test ebx, ebx
je 0x14002eccc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14002ecce
xor edi, edi
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14002ece7
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, si
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x14002f9a0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14002fa1a
xor r8d, r8d
call fcn.14002fc60
mov rsi, rax
test rax, rax
jne 0x14002f9d6
mov eax, edi
jmp 0x14002fa30
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x14002f9d2
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret