joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140022cc0
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0xb0
mov rsi, rcx
movups xmm0, xmmword [0x1400377d8]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140022cf8
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x88], rcx
test r9, r9
mov qword [rsp + 0x80], r9
lea rcx, [rsp + 0x88]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140022d61
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140022d95
test eax, eax
js 0x140022d75
mov rdx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0xb0
pop rsi
ret
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb0
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x80]
call fcn.14001e570
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x78]
call fcn.14001bbc0
mov ecx, 7
int 0x29
ud2
Function at 0x14002fbb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14002fc2a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14002fc20
cmp r11, r10
ja 0x14002fcb5
cmp r10, rdx
ja 0x14002fcc7
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x14002fc22
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14002fc00
jmp 0x14002fc97
ja 0x14002fc2a
mov r11, r10
cmp rax, r8
jne 0x14002fbd2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14002fc9b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14002fc70
mov r8, r10
sub ecx, r9d
jns 0x14002fc8e
jmp 0x14002fc9d
cmp r10, rdx
je 0x14002fca9
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14002fc9d
xor al, 1
cmp r8, rdx
jne 0x14002fc50
jmp 0x14002fc9d
xor eax, eax
jmp 0x14002fc9d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.1400321d0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400326d0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400326c0
int3

Function at 0x1400310dc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140031126
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140031126
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140031126
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140031126
cmp dword [rcx + 0x84], 0xe
jbe 0x140031126
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140031128
xor al, al
add rsp, 0x28
ret
Function at 0x140002ef8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002f42
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002f42
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002f42
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002f42
cmp dword [rcx + 0x84], 0xe
jbe 0x140002f42
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002f44
xor al, al
add rsp, 0x28
ret
Function at 0x140001c7c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140001ae4
Function at 0x14000b8de
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x98
call fcn.14000bada
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov ecx, dword [rax + 0x3c]
mov rax, qword [rsp + 0x88]
movsxd rcx, ecx
add rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
add rax, 0x70
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x68]
mov ecx, dword [rcx]
add rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax + 0x1c]
mov rax, qword [rsp + 0x88]
mov ecx, ecx
add rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax + 0x20]
mov rax, qword [rsp + 0x88]
mov ecx, ecx
add rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax + 0x24]
mov rax, qword [rsp + 0x88]
mov ecx, ecx
add rax, rcx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 0
mov eax, dword [rsp + 0x3c]
cmp eax, dword [rsp + 0x5c]
jae 0x14000baca
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x3c]
cmp dword [rax + rcx*4], 0
jne 0x14000b9e7
jmp 0x14000baba
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x3c]
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
cmp eax, dword [rsp + 0x58]
jae 0x14000bab5
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x34]
movzx eax, word [rax + rcx*2]
cmp eax, dword [rsp + 0x3c]
jne 0x14000baa0
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x34]
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x88]
mov ecx, dword [rsp + 0x30]
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call fcn.14000bbb1
cmp rax, 0xe
jne 0x14000ba9b
mov rax, qword [rsp + 0x28]
movsx eax, byte [rax]
cmp eax, 0x56
jne 0x14000ba9b
mov rax, qword [rsp + 0x28]
movsx eax, byte [rax + 7]
cmp eax, 0x50
jne 0x14000ba9b
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x88]
add rax, rcx
mov qword [rsp + 0x90], rax
jmp 0x14000baca
jmp 0x14000baa0
jmp 0x14000baa5
mov eax, dword [rsp + 0x34]
add eax, 1
mov dword [rsp + 0x34], eax
jmp 0x14000b9ff
jmp 0x14000baba
mov eax, dword [rsp + 0x3c]
add eax, 1
mov dword [rsp + 0x3c], eax
jmp 0x14000b9c1
mov rax, qword [rsp + 0x90]
add rsp, 0x98
ret
Function at 0x14000bada
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
sub rsp, 0x58
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov qword [rsp + 0x50], rax
mov rax, qword gs:[0x60]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rax, 0x38
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 8]
movzx eax, word [rax + 0x18]
cmp eax, 0
jne 0x14000bb60
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x30], rax
jmp 0x14000bb72
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
jmp 0x14000bb29
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14000bb93
mov rax, qword [rsp + 0x20]
add rsp, 0x58
ret
Function at 0x113d560
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x113d56d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x113d57d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x113d565
lea eax, [rcx + 1]
jmp 0x113d58b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x113d59e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x113d584
sub eax, 3
jb 0x113d5be
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x113d60d
sar eax, 1
movsxd rbp, eax
jb 0x113d5f4
jmp 0x113d5cc
add ebx, ebx
jne 0x113d5ca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x113d5f4
inc ecx
add ebx, ebx
jne 0x113d5da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x113d5f4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x113d5ed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x113d5dc
add ecx, 2
jmp 0x113d5f9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.0113d522
jmp 0x113d56d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xd2f000]
mov eax, dword [rdi]
or eax, eax
je 0x113d669
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xd3d000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x113d619
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x113d663
mov qword [rbx], rax
add rbx, 8
jmp 0x113d639
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x113d6ad
cmp al, 0xef
ja 0x113d695
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x113d675
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x113d684
mov eax, dword [rdi]
add rdi, 4
jmp 0x113d684
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x113d701
sub rsp, 0xffffffffffffff80
jmp 0x4767c0
Function at 0x140004c30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov r8d, 6
add ax, 1
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x140004d92
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140004d92
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x140004d92
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x140004cd6
nop
cmp rdi, r11
jae 0x140004d92
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x140004cc0
cmp rdi, r11
jae 0x140004d92
movzx eax, word [rdi]
test ax, ax
je 0x140004d92
movzx ebx, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x140004d0c
mov edx, ebx
mov rcx, rsi
call fcn.140002cd0
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x140004d29
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.140144ee0
test eax, eax
je 0x140004d68
cmp eax, 0xc
je 0x140004d62
cmp eax, 0x16
je 0x140004d5c
cmp eax, 0x22
je 0x140004d5c
cmp eax, 0x50
je 0x140004d68
call fcn.140129ec4
int3
call fcn.140129ec4
int3
call fcn.140129e7c
int3
test ebx, ebx
js 0x140004d87
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x140004d87
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x140004d94
mov ecx, 0x80070057
call fcn.140002cb0
int3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x140004db0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140004de3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
je 0x140004e27
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x140004e22
cmp rbx, r11
jae 0x140004e27
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140004e10
cmp rbx, r11
jb 0x140004e2b
xor eax, eax
jmp 0x140004e37
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140010e60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rax, r8
mov rbp, rdx
mov rdi, rcx
xor r13d, r13d
lea r8, [0x140188e78]
mov rdx, rax
mov rcx, rbp
mov rbx, r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x140010fff
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
mov esi, eax
je 0x140010fff
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov r12, rax
je 0x140010fff
lea ecx, [r13 + 2]
mov rdx, rsi
mov rbp, rsi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x140010fff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, dword [rsp + 0x70]
test rax, rax
je 0x140010f8e
mov r8, rbp
mov rdx, r12
mov rcx, rax
call fcn.1401492a0
lea r8, [rsp + 0x20]
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r13
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x140010fff
mov rdx, qword [rsp + 0x20]
mov rcx, rdi
call fcn.140011e10
test eax, eax
js 0x140010fff
call fcn.14003c890
test eax, eax
je 0x140010f7a
test esi, esi
je 0x140010f6b
mov rcx, qword [rsp + 0x20]
xor edx, edx
call fcn.140011da0
jmp 0x140010f76
mov rcx, qword [rdi + 8]
xor edx, edx
call fcn.140011d30
mov qword [rdi + 0x48], rax
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test esi, esi
je 0x140010fa3
mov rcx, rdi
call fcn.140011050
movss xmm1, dword [0x14019acec]
movss xmm0, dword [0x1401ec4ec]
ucomiss xmm0, xmm1
jp 0x140010fc9
jne 0x140010fc9
movss xmm0, dword [0x1401ec5a4]
ucomiss xmm0, xmm1
jp 0x140010fc9
je 0x140010ff8
mov edx, 3
mov eax, 7
test esi, esi
cmovne edx, eax
mov rcx, rdi
call fcn.140011240
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x140010ff8
mov r8, qword [rcx]
mov edx, 1
call qword [r8]
mov qword [rdi + 0x48], r13
mov eax, 1
jmp 0x14001102d
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140011014
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x20], r13
test rbx, rbx
je 0x14001102b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x140018bd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
lea r8, [0x140188e78]
xor ebx, ebx
mov rbp, rcx
mov qword [rsp + 0x58], rbx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x140018ce4
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
mov esi, eax
je 0x140018ce4
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbp, rax
je 0x140018ce4
lea ecx, [rbx + 2]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x140018ce4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140018cb8
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call fcn.1401492a0
lea r8, [rsp + 0x58]
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x58], rdi
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x140018ce4
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140018cfd
xor edx, edx
call fcn.140011da0
test rax, rax
mov rdi, rax
je 0x140018ce4
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, rdi
call fcn.140018710
test rdi, rdi
mov rbx, rax
je 0x140018cdf
mov r8, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [r8]
mov rax, rbx
jmp 0x140018d16
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140018cfd
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x58], 0
test rbx, rbx
je 0x140018d14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x1400340c0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x140034149
mov ecx, 0x114
mov ebx, 1
call fcn.140146b20
test rax, rax
mov rdi, rax
je 0x1400341be
xor edx, edx
mov r8d, 0x114
mov rcx, rax
call fcn.140148fe0
mov rcx, rdi
mov dword [rdi], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov r11d, dword [rdi + 4]
cmp r11d, 4
jne 0x140034124
lea ebx, [r11 + 1]
jmp 0x1400341b6
cmp r11d, 5
jne 0x1400341b6
cmp dword [rdi + 8], 0
jne 0x14003413a
lea ebx, [r11 + 1]
jmp 0x1400341b6
cmp r11d, 5
jne 0x1400341b6
cmp dword [rdi + 8], ebx
lea eax, [r11 + 2]
jmp 0x1400341b3
cmp al, 4
jae 0x14003415a
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x114
mov ebx, 2
call fcn.140146b20
test rax, rax
mov rdi, rax
je 0x1400341be
xor edx, edx
mov r8d, 0x114
mov rcx, rax
call fcn.140148fe0
mov rcx, rdi
mov dword [rdi], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov r11d, dword [rdi + 4]
cmp r11d, 4
jne 0x1400341b6
cmp dword [rdi + 8], 0xa
jne 0x1400341a6
lea ebx, [r11 - 1]
jmp 0x1400341b6
cmp r11d, 4
jne 0x1400341b6
cmp dword [rdi + 8], 0x5a
mov eax, r11d
cmove ebx, eax
mov rcx, rdi
call fcn.140146bf0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14003b9c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x2a8
mov rax, qword [0x1401ea158]
xor rax, rsp
mov qword [rsp + 0x290], rax
cmp dword [0x140208574], 0
jne 0x14003bb1e
lea rax, [rsp + 0x38]
mov qword [rsp + 0x2a0], rdi
lea rdx, str.SoftwareMicrosoftPlus_ThemesCurrent
mov edi, 1
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov dword [0x140208574], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003bb16
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x30], 0x104
mov dword [rsp + 0x34], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003bb0b
mov rax, qword [str.Windows_Classic.theme]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x2b0], rbx
mov qword [rcx], rax
mov rax, qword [0x1401886f8]
mov qword [rcx + 8], rax
mov rax, qword [0x140188700]
mov qword [rcx + 0x10], rax
mov rax, qword [0x140188708]
mov qword [rcx + 0x18], rax
mov rax, qword [0x140188710]
mov qword [rcx + 0x20], rax
mov eax, dword [0x140188718]
mov dword [rcx + 0x28], eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x40]
movsxd rbx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp ebx, eax
jl 0x14003bb03
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsp + 0x40]
movsxd rcx, eax
mov rax, rbx
sub rax, rcx
lea rcx, [rsp + rax*2 + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ecx, dword [0x140208570]
test eax, eax
cmove ecx, edi
mov dword [0x140208570], ecx
mov rbx, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x2a0]
mov eax, dword [0x140208570]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140144dc0
add rsp, 0x2a8
ret
Function at 0x14003c980
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov edi, ecx
mov ecx, 0x10
mov ebx, edx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x11
mov esi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp esi, edi
jge 0x14003c9c5
cvtsi2ss xmm1, esi
cvtsi2ss xmm0, edi
divss xmm1, xmm0
movss dword [0x1401ec61c], xmm1
jmp 0x14003c9cd
movss xmm1, dword [0x1401ec61c]
cmp eax, ebx
jge 0x14003c9e7
cvtsi2ss xmm2, eax
cvtsi2ss xmm0, ebx
divss xmm2, xmm0
movss dword [0x1401ec6d4], xmm2
jmp 0x14003c9ef
movss xmm2, dword [0x1401ec6d4]
comiss xmm1, xmm2
jbe 0x14003ca01
movss dword [0x1401ec61c], xmm2
movaps xmm1, xmm2
jmp 0x14003ca11
comiss xmm2, xmm1
jbe 0x14003ca11
movss dword [0x1401ec6d4], xmm1
movaps xmm2, xmm1
movss xmm0, dword [0x14019acec]
comiss xmm0, xmm2
jbe 0x14003cac9
cmp eax, 0x258
movss xmm3, dword [0x14019bd1c]
jg 0x14003ca34
movaps xmm0, xmm3
divss xmm0, xmm2
comiss xmm0, dword [0x14019bd18]
movss dword [0x1401ec6d4], xmm0
movaps xmm2, xmm0
jbe 0x14003ca59
movss dword [0x1401ec6d4], xmm3
movaps xmm2, xmm3
jmp 0x14003cabe
comiss xmm0, dword [0x14019bd14]
jbe 0x14003ca6c
movss xmm2, dword [0x14019bd10]
jmp 0x14003cab6
comiss xmm0, dword [0x14019bd0c]
jbe 0x14003ca7f
movss xmm2, dword [0x14019bd08]
jmp 0x14003cab6
comiss xmm0, dword [0x14019bd04]
jbe 0x14003ca92
movss xmm2, dword [0x14019bd00]
jmp 0x14003cab6
comiss xmm0, dword [0x14019ae88]
jbe 0x14003caa5
movss xmm2, dword [0x14019ad18]
jmp 0x14003cab6
comiss xmm0, dword [0x14019bcfc]
jbe 0x14003cabe
movss xmm2, dword [0x14019bcf8]
movss dword [0x1401ec6d4], xmm2
movss dword [0x1401ec61c], xmm2
movaps xmm1, xmm2
movss xmm0, dword [0x1401ec4ec]
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareRealtekAudioGUI_INFORMATION
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mulss xmm0, xmm1
movss xmm1, dword [0x1401ec5a4]
mulss xmm1, xmm2
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x20], rax
movss dword [0x1401ec4ec], xmm0
movss dword [0x1401ec5a4], xmm1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003cb84
movss xmm0, dword [0x1401ec6d4]
mov rbx, qword [rsp + 0x50]
lea rdx, str.CplScalingFactor
addss xmm0, dword [0x14019acf0]
mov r9d, 4
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], 4
mulss xmm0, dword [0x14019ace8]
cvttss2si rax, xmm0
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x14003cb84
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret