joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b9e8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
lea rcx, [rsp + 0x20]
mov r8d, 0x20
call fcn.14000c6a8
xor r11d, r11d
xor r10d, r10d
xor edx, edx
xor r8d, r8d
xor r9d, r9d
cmp r9, 0x28
jg 0x14000ba60
cmp rdx, 4
jge 0x14000ba47
lea rbx, [rsp + rdx*4 + 0x20]
cmp r8, 4
jge 0x14000ba4b
mov eax, dword [rbx]
lea rcx, [r9 + r8]
inc rdx
add rbx, 4
inc r10d
inc r8
cmp rdx, 4
mov dword [rdi + rcx*4 + 0x14], eax
jl 0x14000ba24
cmp r8, 4
jne 0x14000ba5a
inc r11d
add r9, 4
xor r10d, r10d
xor r8d, r8d
cmp rdx, 4
jl 0x14000ba13
movsxd r8, r11d
movsxd r9, r10d
cmp r8, 0xa
jg 0x14000bb2f
lea r11, [0x14001e150]
lea rbx, [0x14001e270]
movzx eax, byte [rsp + 0x2d]
mov cl, byte [rsp + 0x20]
lea rdx, [rsp + 0x24]
xor cl, byte [rax + rbx]
movzx eax, byte [rsp + 0x2e]
mov r10d, 3
mov al, byte [rax + rbx]
xor cl, byte [r11]
xor byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x2f]
mov byte [rsp + 0x20], cl
mov al, byte [rax + rbx]
xor byte [rsp + 0x22], al
movzx eax, byte [rsp + 0x2c]
mov al, byte [rax + rbx]
xor byte [rsp + 0x23], al
inc r11
xor ecx, ecx
mov al, byte [rdx + rcx - 4]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 4
jl 0x14000bac5
add rdx, 4
sub r10, 1
jne 0x14000bac3
xor edx, edx
cmp r8, 0xa
jg 0x14000bb2f
cmp rdx, 4
jge 0x14000bb13
lea r10, [rsp + rdx*4 + 0x20]
cmp r9, 4
jge 0x14000bb17
mov eax, dword [r10]
lea rcx, [r9 + r8*4]
inc rdx
add r10, 4
inc r9
cmp rdx, 4
mov dword [rdi + rcx*4 + 0x14], eax
jl 0x14000baf2
cmp r9, 4
jne 0x14000bb1f
inc r8
xor r9d, r9d
cmp rdx, 4
jl 0x14000bae1
cmp r8, 0xa
jle 0x14000ba7e
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x14000bb3c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
sub rsp, 0x30
lea rbx, [rcx + 0x26]
lea rdi, [rcx + 0x24]
mov esi, 9
lea r13, [0x140000000]
xor r9d, r9d
lea r11, [rsp + r9 + 0x20]
mov r10, rbx
mov ebp, 4
movzx eax, byte [r10 + 1]
lea rdx, [r9 + rax*4]
movzx eax, byte [r10 - 1]
mov r8b, byte [rdx + r13 + 0x1b150]
lea rcx, [r9 + rax*4]
movzx eax, byte [r10 - 2]
xor r8b, byte [rcx + r13 + 0x1b950]
lea rcx, [r9 + rax*4]
movzx eax, byte [r10]
xor r8b, byte [rcx + r13 + 0x1bd50]
lea rcx, [r9 + rax*4]
add r10, 4
xor r8b, byte [rcx + r13 + 0x1b550]
mov byte [r11], r8b
add r11, 4
sub rbp, 1
jne 0x14000bb79
inc r9
cmp r9, 4
jl 0x14000bb6c
lea r8d, [rbp + 0x10]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14000c6a8
add rdi, 0x10
add rbx, 0x10
sub rsi, 1
jne 0x14000bb69
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r13
ret
Function at 0x14000c428
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
jmp 0x14000c428
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r12, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x14000c554
test rbx, rbx
je 0x14000c554
lea rdi, [rcx + 4]
lea rcx, [rax - 0x50]
mov r8d, InitCommonControls
mov rdx, rdi
mov qword [rsp + 0x20], rdi
call fcn.14000c6a8
shr rbx, 4
mov qword [rsp + 0x88], rbx
test rbx, rbx
je 0x14000c538
mov r13d, dword [rsp + 0x34]
mov r14d, dword [rsp + 0x30]
mov r15d, dword [rsp + 0x2c]
mov edi, dword [rsp + 0x28]
lea r8, [rsp + 0x38]
mov rdx, rsi
mov rcx, rbp
call fcn.14000bc14
mov r11d, dword [rsp + 0x38]
mov r9d, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x40]
mov eax, dword [rsp + 0x44]
xor r11d, edi
mov edi, dword [rsi]
xor r9d, r15d
mov r15d, dword [rsi + 4]
xor edx, r14d
mov r14d, dword [rsi + 8]
xor eax, r13d
mov r13d, dword [rsi + 0xc]
mov dword [r12], r11d
mov dword [r12 + 4], r9d
mov dword [r12 + 8], edx
mov dword [r12 + 0xc], eax
add rsi, 0x10
add r12, 0x10
sub rbx, 1
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x2c], r15d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x34], r13d
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x3c], r9d
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x44], eax
jne 0x14000c4a5
mov rbx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov r8d, InitCommonControls
mov rcx, rdi
call fcn.14000c6a8
shl rbx, 4
mov rax, rbx
jmp 0x14000c556
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x14000cbf4
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x28
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x14000cf4c
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x98
mov r9d, 0x64
lea r8, [rsp + 0x20]
mov ecx, 0x400
lea edx, [r9 - 0x55]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
movsx eax, byte [rsp + 0x20]
add rsp, 0x98
ret

Function at 0x14000d280
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rcx, [rsp + 0x48]
mov ebx, edx
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
lea r8, [rsp + 0x40]
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov rcx, qword [rsp + 0x40]
mov rdx, rdi
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000e218
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1020
call fcn.140015e00
sub rsp, rax
mov rsi, r8
mov rbx, rcx
test r9, r9
je 0x14000e244
mov byte [r9], 0
mov rcx, qword [rsp + 0x1050]
test rcx, rcx
je 0x14000e254
mov byte [rcx], 0
test rbx, rbx
je 0x14000e300
mov al, byte [rbx]
test al, al
je 0x14000e300
movsxd rbp, dword [rsp + 0x1058]
xor edi, edi
xor r8d, r8d
inc rbx
cmp al, 0x3d
jne 0x14000e293
test rsi, rsi
je 0x14000e29b
test rdi, rdi
jne 0x14000e29b
test r9, r9
je 0x14000e28e
mov byte [r9], 1
mov rdi, rdx
jmp 0x14000e2a8
cmp al, 0xd
je 0x14000e2b8
cmp al, 0xa
je 0x14000e2bb
mov byte [rdx], al
lea eax, [rbp - 2]
inc rdx
cmp r8d, eax
jg 0x14000e2b3
mov al, byte [rbx]
inc r8d
test al, al
jne 0x14000e274
jmp 0x14000e2bb
mov byte [rcx], 1
jmp 0x14000e2bb
inc rbx
mov byte [rdx], 0
test rsi, rsi
je 0x14000e2fb
mov byte [rsi], 0
test rdi, rdi
je 0x14000e2fb
lea rdx, [rsp + 0x20]
mov r8d, 0x1000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea r11d, [rbp - 1]
lea rdx, [rsp + 0x20]
movsxd r8, r11d
mov rcx, rsi
call fcn.14000c9c8
mov byte [rbp + rsi - 1], 0
mov byte [rdi], 0
mov rax, rbx
jmp 0x14000e302
xor eax, eax
lea r11, [rsp + 0x1020]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14000e31c
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
sub rsp, 0x468
lea rdx, [rsp + 0x60]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp byte [0x14001fcdd], 0
jne 0x14000e3b2
lea rcx, [rsp + 0x60]
call fcn.140008968
mov rdx, qword [str.RarSFX]
mov r8d, 6
mov rcx, rax
call fcn.14000cb78
test eax, eax
jne 0x14000e3b2
lea rcx, [0x140016600]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, [rsp + 0x60]
call fcn.14000c808
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x38]
mov byte [rsp + rax + 0x61], 0
call fcn.14000c654
mov eax, 0x14
lea rcx, [rsp + 0x20]
mov word [rsp + 0x40], ax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rax
call qword [sym.imp.SHELL32.dll_SHFileOperationA]
add rsp, 0x468
ret

Function at 0x14000e4a8
Capabilities:
Hide graphical window

Disassembly:
push rdi
sub rsp, 0x20
mov rcx, qword [0x14001f440]
mov edi, 1
mov dword [0x14001f428], edi
test rcx, rcx
je 0x14000e4e6
lea ecx, [rdi + 0x7c]
call fcn.14000b944
mov rcx, qword [0x14001f440]
mov edx, edi
mov r8, rax
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
mov rcx, qword [0x14001f440]
and dword [0x14001f424], 0
mov dword [0x14001f420], edi
test rcx, rcx
je 0x14000e53b
mov edx, edi
call qword [sym.imp.USER32.dll_ShowWindow]
cmp qword [0x14001fcf8], 0
jne 0x14000e532
cmp byte [0x14001fcdc], 0
jne 0x14000e532
mov rcx, qword [0x14001f440]
xor r9d, r9d
mov r8, rdi
mov edx, 0x111
call qword [sym.imp.USER32.dll_SendMessageA]
jmp 0x14000e532
call fcn.14000cefc
cmp dword [0x14001f430], 2
jne 0x14000e52d
cmp byte [0x14001f450], 0
je 0x14000e549
call fcn.14000e31c
add rsp, 0x20
pop rdi
ret
Function at 0x14000e550
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x450
cmp byte [0x14001f458], 0
mov rbx, rcx
je 0x14000e635
cmp byte [0x14001e380], 0
je 0x14000e635
lea rdx, [0x14001e380]
lea rcx, [rsp + 0x50]
call fcn.14000c978
cmp byte [rsp + 0x50], 0
je 0x14000e5ad
lea rax, [rsp + 0x50]
cmp byte [rax], 0x3a
je 0x14000e5a2
cmp byte [rax], 0x5c
je 0x14000e5a2
cmp byte [rax], 0x2f
jne 0x14000e5a5
mov byte [rax], 0x25
inc rax
cmp byte [rax], 0
jne 0x14000e593
lea rax, [rsp + 0x468]
lea rdx, str.SoftwareWinRAR_SFX
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x470]
xor r8d, r8d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14000e635
mov rcx, rbx
call fcn.14000c808
mov rcx, qword [rsp + 0x470]
lea rdx, [rsp + 0x50]
inc eax
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x470]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x450
pop rbx
ret

Function at 0x14000e640
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x830
cmp byte [0x14001f458], 0
mov rbx, rcx
je 0x14000e71f
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.14000c978
cmp byte [rsp + 0x30], 0
je 0x14000e68c
lea rax, [rsp + 0x30]
cmp byte [rax], 0x3a
je 0x14000e681
cmp byte [rax], 0x5c
je 0x14000e681
cmp byte [rax], 0x2f
jne 0x14000e684
mov byte [rax], 0x25
inc rax
cmp byte [rax], 0
jne 0x14000e672
lea rax, [rsp + 0x858]
lea rdx, str.SoftwareWinRAR_SFX
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000e71f
mov rcx, qword [rsp + 0x858]
lea rax, [rsp + 0x848]
lea r9, [rsp + 0x850]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x430]
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x848], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000e711
lea rdx, [rsp + 0x430]
mov rcx, rbx
call fcn.14000c978
mov rcx, qword [rsp + 0x858]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x830
pop rbx
ret
Function at 0x14000e8f4
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov esi, r9d
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
cmp byte [0x14001f396], 0
mov qword [0x14001f398], rbp
mov dword [0x14001f390], esi
je 0x14000e931
mov eax, 1
jmp 0x14000e968
cmp byte [0x14001f397], 0
je 0x14000e941
mov eax, 2
jmp 0x14000e968
mov r8, qword [0x14001f440]
mov rcx, qword [0x14001a0f8]
lea r9, [0x14000d800]
lea rdx, str.REPLACEFILEDLG
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_DialogBoxParamA]
sub rax, 1
je 0x14000e9e2
sub rax, 1
je 0x14000e9c7
sub rax, 1
je 0x14000e9db
sub rax, 1
jne 0x14000e9b5
mov r8, qword [0x14001f440]
mov rcx, qword [0x14001a0f8]
lea r9, [0x14000dc18]
lea rdx, str.RENAMEDLG
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_DialogBoxParamA]
test rax, rax
je 0x14000e914
mov byte [rbx], 0x52
jmp 0x14000e9f0
sub rax, 1
je 0x14000e9cc
cmp rax, 1
jne 0x14000e9f0
mov byte [0x14001f397], al
mov byte [rbx], 0x4e
jmp 0x14000e9f0
mov dword [0x14001f430], 1
mov byte [rbx], 0x43
jmp 0x14000e9f0
mov byte [0x14001f396], 1
xor edx, edx
mov rcx, rdi
mov byte [rbx], 0x59
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140010e08
Capabilities:
Hash data using sha1

Disassembly:
and dword [rcx + 0x18], 0
and dword [rcx + 0x14], 0
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
ret
Function at 0x14000f720
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14000f7ec
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14000f7ec
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x14000f805
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x14000f7dc
cmp byte [rax], 0x5c
jne 0x14000f7d6
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x14000f7d6
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x14000f7c2
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x14000f7d3
test r8b, 0x10
jne 0x14000f7d6
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x14000f7d6
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.140011b00
test edi, edi
jne 0x14000f740
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.140010b60
int3
Function at 0x1400175c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x1f70]
mov eax, 0x2070
call fcn.14001edd0
sub rsp, rax
mov rax, qword [0x14002c180]
xor rax, rsp
mov qword [rbp + 0x1f60], rax
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
mov edi, 0xf
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x20], 0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x140021840]
movdqu xmmword [rsp + 0x50], xmm1
mov byte [rsp + 0x40], 0
mov byte [rsp + 0x60], 0
xor edx, edx
mov r8d, 0xfff
lea rcx, [rsp + 0x61]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x1000
lea rdx, [rsp + 0x60]
lea rcx, str.ONEVPL_DISPATCHER_LOG
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0xffe
ja 0x140017747
lea rax, [rsp + 0x60]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140017680
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140002180
mov byte [rbp + 0xf60], 0
xor edx, edx
mov r8d, 0xfff
lea rcx, [rbp + 0xf61]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x1000
lea rdx, [rbp + 0xf60]
lea rcx, str.ONEVPL_DISPATCHER_LOG_FILE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0xffe
ja 0x1400176fd
lea rax, [rbp + 0xf60]
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400176e0
mov r8, rbx
lea rdx, [rbp + 0xf60]
lea rcx, [rsp + 0x40]
call fcn.140002180
lea rcx, [rsp + 0x20]
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x38]
cmp rdi, 0xf
cmova rcx, rbx
mov r8, qword [rsp + 0x30]
cmp r8, 2
jne 0x14001774c
lea rdx, [0x1400233ac]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001774c
lea rcx, [rsi + 0x100b0]
lea r8, [rsp + 0x40]
lea edx, [rax + 1]
call fcn.1400032e0
mov esi, eax
jmp 0x140017751
mov rbx, qword [rsp + 0x20]
mov esi, 0xfffffffd
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140017791
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001778c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001778c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001ea8c
movdqa xmm0, xmmword [0x140021840]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
cmp rdi, 0xf
jbe 0x1400177de
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400177d6
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400177d6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14001ea8c
mov eax, esi
mov rcx, qword [rbp + 0x1f60]
xor rcx, rsp
call fcn.14001e7f0
lea r11, [rsp + 0x2070]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14001e020
Capabilities:
Query or enumerate registry key

Disassembly:
sub rsp, 0x48
mov rcx, qword [rcx]
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
sete al
add rsp, 0x48
ret

Function at 0x14001e100
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, qword [rsp + 0x70]
xor r14d, r14d
mov dword [rsp + 0x60], r8d
mov rsi, r9
mov edi, r8d
test rbx, rbx
je 0x14001e12e
mov ebp, dword [rbx]
jmp 0x14001e131
mov ebp, r14d
mov rcx, qword [rcx]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001e1ce
cmp dword [rsp + 0x60], edi
jne 0x14001e1ce
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14001e192
test rsi, rsi
je 0x14001e192
test rbx, rbx
je 0x14001e192
mov r8d, ebp
cmp r8, 2
jb 0x14001e1ce
mov edx, dword [rbx]
lea rcx, [r8 - 2]
shr r8, 1
mov eax, edx
shr rax, 1
dec r8
cmp rcx, rdx
cmovb rax, r8
mov word [rsi + rax*2], r14w
mov al, 1
jmp 0x14001e1d0
cmp edi, 7
jne 0x14001e1ca
test rsi, rsi
je 0x14001e1ca
test rbx, rbx
je 0x14001e1ca
mov r8d, ebp
cmp r8, 4
jb 0x14001e1ce
mov edx, dword [rbx]
lea rcx, [r8 - 4]
shr r8, 1
mov eax, edx
shr rax, 1
dec r8
inc rax
cmp rcx, rdx
cmovb rax, r8
mov dword [rsi + rax*2 - 2], r14d
mov al, 1
jmp 0x14001e1d0
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14001f4b8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001f502
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001f502
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001f502
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001f502
cmp dword [rcx + 0x84], 0xe
jbe 0x14001f502
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001f504
xor al, al
add rsp, 0x28
ret
Function at 0x140068a90
Capabilities:
Inspect section memory permissions

Disassembly:
mov r8d, ecx
mov r9d, ecx
xor ecx, ecx
and r8d, 0xe0000000
cmp r8d, 0xe0000000
mov eax, 0x40
cmovne eax, ecx
mov edx, eax
bts edx, 7
cmp r8d, 0xa0000000
cmovne edx, eax
mov eax, edx
or eax, 0x20
cmp r8d, 0x60000000
cmovne eax, edx
mov ecx, eax
or ecx, 0x10
cmp r8d, 0x20000000
cmovne ecx, eax
mov eax, ecx
or eax, 4
cmp r8d, 0xc0000000
cmovne eax, ecx
mov ecx, eax
or ecx, 8
cmp r8d, 0x80000000
cmovne ecx, eax
mov eax, ecx
or eax, 2
cmp r8d, 0x40000000
cmovne eax, ecx
mov ecx, eax
or ecx, 1
test r8d, r8d
cmovne ecx, eax
mov eax, ecx
bts eax, 9
bt r9d, 0x1a
cmovae eax, ecx
ret
Function at 0x1400012d4
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x120
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, qword [rbx + 0x20]
mov edx, 9
mov rbp, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edi, edi
lea rdx, [rsp + 0x50]
lea r8d, [rdi + 0x64]
mov rcx, rbp
mov rsi, rax
mov word [rsp + 0x50], di
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rbx + 0x20]
lea rdx, [rsp + 0x130]
mov dword [rsp + 0x130], edi
mov dword [rsp + 0x134], edi
call qword [sym.imp.USER32.dll_ClientToScreen]
lea r8d, [rdi + 0x10]
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.1400b93b0
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r8d, dword [rsp + 0x40]
mov r9d, dword [rsp + 0x44]
mov edi, dword [rsp + 0x48]
mov ebx, dword [rsp + 0x4c]
mov dword [rsp + 0x30], 4
sub edi, r8d
sub r8d, dword [rsp + 0x130]
sub ebx, r9d
sub r9d, dword [rsp + 0x134]
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x44], r9d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov r8d, dword [rsp + 0x44]
mov edx, dword [rsp + 0x40]
mov r9d, edi
mov rcx, rsi
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_MoveWindow]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.USER32.dll_ShowWindow]
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400036f4
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rcx
mov rcx, qword [rcx]
mov ebx, esi
cmp rcx, rsi
je 0x14000371a
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov edx, 0x2d0
mov rcx, rdi
call fcn.14004bf70
cmp ebx, esi
jg 0x1400037c5
mov rax, qword [rdi]
lea rcx, [0x1400d64f0]
mov r8d, 0x208
mov word [rax], si
mov rdx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, esi
mov ebx, eax
jg 0x1400037aa
mov rdx, qword [rdi]
lea rcx, [0x1400d64e0]
mov r8d, 0x208
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, esi
mov ebx, eax
jg 0x1400037aa
mov rdx, qword [rdi]
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x24]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
cmp ebx, esi
jle 0x1400037c5
mov rax, qword [rdi]
lea rdx, [0x1400d64d0]
lea rcx, [rax + rbx*2]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
add ebx, 5
cmp ebx, esi
jle 0x1400037c5
mov rax, qword [rdi]
movsxd rcx, ebx
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov rax, qword [rdi]
inc ebx
movsxd rcx, ebx
mov word [rax + rcx*2], si
mov rcx, qword [rdi]
call fcn.140024958
cmp ebx, esi
jle 0x1400037dd
mov rcx, qword [rdi]
call fcn.1400b8a34
cmp eax, esi
jne 0x140003812
mov rdx, qword [rdi]
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x24]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov rcx, qword [rdi]
lea rdx, str.TEMP_
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, qword [rdi]
call fcn.140024958
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140003cfc
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [0x1400f1908]
mov rbx, rcx
mov byte [rcx], 0x11
mov edx, 0x10000
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x140003c80]
xor ecx, ecx
mov dword [rsp + 0x20], edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140003d3f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140003d42
mov byte [rbx], 0
add rsp, 0x30
pop rbx
ret