joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140128a70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x90
mov rbx, rdx
xor edx, edx
mov rsi, rcx
lea r8d, [rdx + 0x64]
lea rcx, [rsp + 0x20]
call fcn.140160e90
call fcn.140153968
lea r8, str.WAVE
mov rcx, qword [rax + 0x10]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rbx, rbx
mov rbp, rax
je 0x140128c39
test rax, rax
je 0x140128c39
mov qword [rsp + 0xa0], rdi
call fcn.140153968
mov rdx, rbp
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
call fcn.140153968
mov rdx, rbp
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rdx, [rsp + 0x20]
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x24], 0x204d454d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], ebx
call qword [sym.imp.WINMM.dll_mmioOpenW]
lea rdx, [rsi + 0x94]
mov r9d, 0x20
xor r8d, r8d
mov rcx, rax
mov rbx, rax
mov dword [rsi + 0x9c], 0x45564157
call qword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x140128c2a
lea r9d, [rax + 0x10]
lea r8, [rsi + 0x94]
lea rdx, [rsi + 0x80]
mov rcx, rbx
mov dword [rsi + 0x80], 0x20746d66
call qword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x140128c2a
lea rdx, [rsi + 0x80]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioAscend]
lea r8, [rsi + 0x94]
lea rdx, [rsi + 0x6c]
mov r9d, 0x10
mov rcx, rbx
mov dword [rsi + 0x6c], 0x61746164
call qword [sym.imp.WINMM.dll_mmioDescend]
test eax, eax
jne 0x140128c2a
lea rdx, [rsi + 0x6c]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioAscend]
mov edx, dword [rsi + 0x8c]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioSeek]
mov r8d, dword [rsi + 0x84]
lea rdx, [rsi + 0x44]
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioRead]
cmp dword [rsi + 0x84], eax
jne 0x140128c2a
cmp word [rsi + 0x46], 1
jne 0x140128c2a
cmp word [rsi + 0x52], 0x10
jne 0x140128c2a
mov dword [rsi + 0xe8], 0
mov rax, rbx
mov rdi, qword [rsp + 0xa0]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINMM.dll_mmioClose]
xor eax, eax
jmp 0x140128c0d
xor eax, eax
jmp 0x140128c15
Function at 0x140130ca0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 8], 0
mov edi, edx
mov rbx, rcx
je 0x140130ccd
mov rcx, qword [rcx + 8]
mov edx, edi
mov rax, qword [rcx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x30]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140130e22
bt dword [rax + 0x30], 0xf
jae 0x140130d8b
call fcn.140073880
test eax, eax
jne 0x140130d7e
mov eax, dword [0x14022e714]
test eax, eax
jne 0x140130d19
lea rcx, [0x14022e710]
mov dword [0x14022e710], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [0x14022e714]
cmp eax, 6
jne 0x140130d2b
mov eax, dword [0x14022e718]
cmp eax, 2
jne 0x140130d57
jmp 0x140130d5c
test eax, eax
jne 0x140130d4c
lea rcx, [0x14022e710]
mov dword [0x14022e710], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [0x14022e714]
cmp eax, 6
jne 0x140130d8b
mov eax, dword [0x14022e718]
cmp eax, 3
jne 0x140130d8b
call fcn.14011ae90
test eax, eax
je 0x140130d8b
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0
call sub.ToastDll64.dll_bool___cdecl_GetDisplayMode_unsigned_long_int____ptr64_
cmp dword [rsp + 0x30], 2
jne 0x140130d8b
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x10]
cmp dword [rax + 0x568], 0
je 0x140130e22
bt dword [rax + 0x50], 8
jb 0x140130d7e
lea r8, str.JDPopup
lea rdx, str.General
lea rcx, [0x14022e890]
mov r9d, 1
call fcn.14014ba50
test eax, eax
jne 0x140130e22
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx + 0x274]
bt r8d, 0x11
jae 0x140130df8
mov rax, rdi
imul rax, rax, 0xac
mov ecx, dword [rax + rdx + 0x61c]
and ecx, 0xf000
cmp ecx, 0x2000
je 0x140130d7e
bt r8d, 0x12
jae 0x140130e22
mov rax, rdi
imul rax, rax, 0xac
mov ecx, dword [rax + rdx + 0x61c]
and ecx, 0xf000
cmp ecx, 0x1000
je 0x140130d7e
mov eax, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140132130
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x20
cmp qword [rcx + 8], 0
mov rdi, rcx
je 0x140132153
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x88]
cmp dword [0x14022e824], 0
jne 0x140132222
lea r8, str.Finished
lea rdx, str.DefLevel
lea rcx, [0x14022e890]
xor r9d, r9d
call fcn.14014ba50
test eax, eax
mov dword [0x14022e824], eax
jne 0x140132222
call fcn.14007d240
mov rcx, qword [0x14022f9a0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1401321d2
lea r8, str.Finished
lea rdx, str.DefLevel
lea rcx, [0x14022e890]
mov r9d, 1
call fcn.14014baf0
mov dword [0x14022e824], 1
add rsp, 0x20
pop rdi
ret
mov ecx, 0x20
mov qword [rsp + 0x30], rbx
call fcn.14013d028
test rax, rax
mov rbx, rax
je 0x14013221d
lea rax, method.j.1.virtual_0
mov rcx, rbx
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], eax
mov dword [rbx + 0x14], eax
mov dword [rbx + 0x18], eax
mov rdx, qword [rdi + 0x10]
call fcn.14007d080
mov r11, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r11 + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401359f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rbp
lea rcx, [rsp + 0x68]
call fcn.1400758a0
nop
xor eax, eax
or rbp, 0xffffffffffffffff
mov rcx, rbp
lea rbx, str.HPHPAudioSwitchHPAudioSwitch.exe
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r14, [rcx - 1]
mov rsi, rbx
mov rax, qword [rsp + 0x68]
sub rsi, rax
sar rsi, 1
mov r13d, dword [rax - 0x10]
lea edi, [r13 + rcx - 1]
mov r12d, 1
mov edx, r12d
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x140135a75
mov edx, edi
lea rcx, [rsp + 0x68]
call fcn.140001df0
mov rax, qword [rsp + 0x68]
cmp rsi, r13
ja 0x140135a7e
lea rbx, [rax + rsi*2]
movsxd rdx, r14d
add rdx, rdx
lea rcx, [rax + r13*2]
mov r9, rdx
mov r8, rbx
call fcn.14015cd30
test edi, edi
js 0x140135bd9
mov rax, qword [rsp + 0x68]
cmp edi, dword [rax - 0xc]
jg 0x140135bd9
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x68]
mov word [rax + rcx*2], 0
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x140135ae3
cmp rax, qword [rdi - 0x18]
jne 0x140135ae3
lea rbx, [rdi - 0x18]
lock add dword [rdi - 8], r12d
jmp 0x140135b21
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x140135aff
call fcn.1400c5210
int3
mov eax, dword [rdi - 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rdi - 0x10]
add eax, r12d
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rbx + 0x18]
call fcn.14015cd30
add rbx, 0x18
mov qword [rsp + 0x70], rbx
xor eax, eax
lea rdi, [0x14019cf88]
mov rsi, rbx
mov rcx, r12
repe cmpsw word [rsi], word [rdi]
je 0x140135b43
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
jne 0x140135b6c
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140135b67
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r12d, r12d
jmp 0x140135bb6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140135b9a
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140135b95
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r12d, r12d
jmp 0x140135bb6
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140135bb6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x140135bd4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r12d
jmp 0x140135be4
mov ecx, 0x80070057
call fcn.140001c00
nop
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14013ff70
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.1401583f4
test rax, rax
mov rsi, rax
je 0x14013ffed
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
test rbx, rbx
movzx edi, ax
je 0x14013ffe8
cmp dword [rbx], 0x38
jb 0x14013ffe8
mov rax, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x14013ffe8
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x14013fff1
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140140f64
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
call fcn.1401539b8
mov rbx, rax
mov rax, qword [rax + 0x78]
test rax, rax
je 0x140140f9b
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x140140f9b
xor r9d, r9d
xor r8d, r8d
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageW]
test edi, edi
mov rbx, qword [rbx + 0xa0]
je 0x140140fcb
test rbx, rbx
je 0x140140fcb
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x140140fcb
mov rax, qword [rbx]
or rdx, 0xffffffffffffffff
mov rcx, rbx
call qword [rax + 0x2d0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401446b8
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0xa0], 0
mov rbx, rdx
mov rsi, rcx
jne 0x140144770
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov r8, qword [rbx]
mov edx, 1
mov ecx, dword [r8 - 0xc]
sub edx, dword [r8 - 8]
movsxd rdi, eax
sub ecx, edi
or edx, ecx
jge 0x140144708
mov edx, edi
mov rcx, rbx
call fcn.140001df0
test edi, edi
mov rdx, qword [rbx]
js 0x140144765
cmp edi, dword [rdx - 0xc]
jg 0x140144765
mov dword [rdx - 0x10], edi
mov rax, qword [rbx]
lea r8d, [rdi + 1]
and word [rax + rdi*2], 0
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140144739
xor eax, eax
jmp 0x140144742
call fcn.140160a50
test eax, eax
js 0x14014475a
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14014475a
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
and word [rax + rcx*2], 0
jmp 0x140144780
mov ecx, 0x80070057
call fcn.140001c00
int3
mov ecx, 0x80070057
call fcn.140001c00
int3
mov rcx, qword [rcx + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0x118]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1401472bc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x140147324
call fcn.140153968
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140147324
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x140147346
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.140146d18
test rdi, rdi
mov esi, eax
je 0x140147344
test rbx, rbx
je 0x140147344
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x14014ba50
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xa8], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14014bac7
call fcn.14014b9dc
test rax, rax
mov rsi, rax
jne 0x14014ba83
mov eax, edi
jmp 0x14014badd
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x14014ba7f
mov r9, qword [rcx + 0xd0]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14014bbb0
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
xor ebx, ebx
mov rdi, r9
mov rbp, r8
cmp qword [rcx + 0xa8], rbx
mov rsi, rdx
je 0x14014bc77
cmp r8, rbx
jne 0x14014bc0b
call fcn.14014b8d8
cmp rax, rbx
mov rdi, rax
jne 0x14014bbfa
xor eax, eax
jmp 0x14014bc8d
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, rdi
jmp 0x14014bc66
cmp r9, rbx
jne 0x14014bc2b
call fcn.14014b9dc
cmp rax, rbx
mov rdi, rax
je 0x14014bbf3
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x14014bc06
call fcn.14014b9dc
cmp rax, rbx
mov r12, rax
je 0x14014bbf3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 1
xor r8d, r8d
lea eax, [rax + rax + 2]
mov rdx, rbp
mov rcx, r12
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, r12
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
sete bl
mov eax, ebx
jmp 0x14014bc8d
mov r9, qword [rcx + 0xd0]
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x14014bca8
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
xor edi, edi
mov rbp, r9
mov r14, r8
cmp qword [rcx + 0xa8], rdi
mov rsi, rdx
mov rbx, rcx
je 0x14014bd2a
call fcn.14014b9dc
cmp rax, rdi
mov rsi, rax
jne 0x14014bcf0
xor eax, eax
jmp 0x14014bdb8
mov ecx, dword [rsp + 0x70]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, rax
mov rdx, r14
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
sete dil
mov eax, edi
jmp 0x14014bdb8
mov r12d, dword [rsp + 0x70]
mov eax, 2
lea ecx, [r12 + r12 + 1]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14013d028
cmp r12d, edi
mov r9d, edi
mov r13, rax
jbe 0x14014bd91
mov rdx, rax
mov r9, r12
mov r8, r12
mov al, byte [rbp]
and al, 0xf
movzx ecx, al
add cx, 0x41
mov word [rdx], cx
mov al, byte [rbp]
add rdx, 4
shr al, 4
add rbp, 1
movzx ecx, al
add cx, 0x41
sub r8, 1
mov word [rdx - 2], cx
jne 0x14014bd63
lea eax, [r9 + r9]
mov r8, r14
mov rdx, rsi
mov r9, r13
mov rcx, rbx
mov word [r13 + rax*2], di
call fcn.14014bbb0
mov rcx, r13
mov ebx, eax
call fcn.14013d06c
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r13
pop r12
ret
Function at 0x14014c020
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rsi, r9
mov rbp, r8
and qword [r9], 0
mov rbx, qword [rsp + 0x80]
and dword [rbx], 0
cmp qword [rcx + 0xa8], 0
je 0x14014c105
call fcn.14014b9dc
mov rdi, rax
test rax, rax
je 0x14014c202
mov qword [rsp + 0x38], rax
and dword [rsp + 0x60], 0
and dword [rsp + 0x80], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x80]
mov dword [rbx], ecx
test eax, eax
jne 0x14014c0e7
call fcn.14013d028
mov qword [rsi], rax
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14014c0e7
lea ebx, [rax + 1]
jmp 0x14014c0f5
mov rcx, qword [rsi]
call fcn.14013d06c
and qword [rsi], 0
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x14014c202
and qword [rsp + 0x20], 0
mov r9, r8
mov r8, rdx
lea rdx, [rsp + 0x78]
call fcn.14014bdd8
nop
mov rax, qword [rsp + 0x78]
movsxd rcx, dword [rax - 0x10]
test ecx, ecx
jne 0x14014c14c
lea rdx, [rax - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14014c145
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14014c202
mov rdi, rcx
shr ecx, 1
mov dword [rbx], ecx
call fcn.14013d028
mov qword [rsi], rax
xor r8d, r8d
lea ebx, [r8 + 1]
test rdi, rdi
jle 0x14014c1de
xor r10d, r10d
mov r9, rbx
test r9, r9
js 0x14014c1d3
mov rax, qword [rsp + 0x78]
lea ecx, [r8 + 1]
cmp ecx, dword [rax - 0x10]
jg 0x14014c1d3
movzx r11d, word [r10 + rax + 2]
test r8d, r8d
js 0x14014c1c8
cmp r8d, dword [rax - 0x10]
jg 0x14014c1c8
sub r11b, bl
shl r11b, 4
add r11b, byte [r10 + rax]
sub r11b, 0x41
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
mov rax, qword [rsi]
mov byte [rcx + rax], r11b
add r8d, 2
add r9, 2
add r10, 4
movsxd rax, r8d
cmp rax, rdi
jl 0x14014c16d
jmp 0x14014c1de
mov ecx, 0x80070057
call fcn.140001c00
int3
mov ecx, 0x80070057
call fcn.140001c00
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14014c200
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14014d29c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140210348]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
lea r8, [rsp + 0x30]
mov rdx, qword [rdx]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, eax
test eax, eax
jne 0x14014d39b
mov r9d, 0x104
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, eax
test eax, eax
jne 0x14014d372
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x28]
call fcn.140002000
nop
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call fcn.14014d29c
mov ebx, eax
test eax, eax
setne byte [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14014d359
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [rsp + 0x20], 0
je 0x14014d362
jmp 0x14014d372
jmp 0x14014d2f2
cmp ebx, 0x103
je 0x14014d382
cmp ebx, 0x3f2
jne 0x14014d390
mov rdx, qword [rsi]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14015d000
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140150bf0
Capabilities:
Create http request

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and dword [rcx + 0x20], 0
and qword [rcx + 0x18], 0
test rdx, rdx
lea rax, [0x140198288]
mov edi, r9d
mov r10, rdx
mov rbx, rcx
mov qword [rcx + 8], r8
mov qword [rcx], rax
jne 0x140150c28
call fcn.140153968
mov r10, qword [rax + 0x20]
mov eax, dword [rsp + 0x70]
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, edi
mov rcx, r10
mov dword [rsp + 0x20], eax
call qword [sym.imp.WININET.dll_InternetOpenW]
test rax, rax
mov rdi, rax
mov qword [rbx + 0x10], rax
jne 0x140150c5d
mov rcx, qword [rbx + 8]
xor edx, edx
call fcn.140150b40
int3
lea rcx, [0x14022ce28]
call fcn.140089aa0
lea rcx, [0x14022cdf0]
mov rdx, rdi
call fcn.140155e48
lea rcx, [0x14022ce28]
mov qword [rax], rbx
mov rax, qword [0x14022ce28]
call qword [rax + 0x28]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140151284
Capabilities:
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor r12d, r12d
mov edi, r8d
mov rbp, rdx
cmp qword [rcx + 0x68], r12
mov rbx, rcx
jne 0x1401512f1
mov edx, 0x1000
call fcn.14015071c
cmp eax, r12d
jne 0x1401512be
xor eax, eax
jmp 0x140151371
mov r8d, dword [rbx + 0x60]
mov rdx, qword [rbx + 0x68]
mov rcx, qword [rbx + 0x28]
lea r9, [rsp + 0x40]
call qword [sym.imp.WININET.dll_InternetReadFile]
cmp eax, r12d
jne 0x1401512e6
mov rcx, qword [rbx + 0x38]
xor edx, edx
call fcn.140150b40
int3
mov eax, dword [rsp + 0x40]
mov dword [rbx + 0x64], r12d
mov dword [rbx + 0x70], eax
mov ecx, dword [rbx + 0x64]
mov rsi, rbp
lea edi, [rdi + rdi - 2]
add rcx, qword [rbx + 0x68]
cmp edi, r12d
je 0x140151359
mov eax, dword [rbx + 0x70]
cmp dword [rbx + 0x64], eax
jb 0x14015133c
mov r8d, dword [rbx + 0x60]
mov rdx, qword [rbx + 0x68]
mov rcx, qword [rbx + 0x28]
lea r9, [rsp + 0x40]
call qword [sym.imp.WININET.dll_InternetReadFile]
cmp eax, r12d
je 0x1401513a2
mov eax, dword [rsp + 0x40]
cmp eax, r12d
mov dword [rbx + 0x70], eax
je 0x140151384
mov rcx, qword [rbx + 0x68]
mov dword [rbx + 0x64], r12d
mov al, byte [rcx]
cmp al, 0xd
je 0x14015134b
mov byte [rsi], al
add rsi, 1
add edi, 0xffffffff
add dword [rbx + 0x64], 1
mov al, byte [rcx]
add rcx, 1
cmp al, 0xa
jne 0x1401512ff
mov r8d, edi
xor edx, edx
mov rcx, rsi
and r8d, 1
add r8, 2
call fcn.140160e90
mov rax, rbp
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
mov r8d, edi
xor edx, edx
mov rcx, rsi
and r8d, 1
add r8, 2
call fcn.140160e90
cmp rsi, rbp
cmove rbp, r12
jmp 0x14015136e
mov rcx, qword [rbx + 0x38]
xor edx, edx
call fcn.140150b40
int3