joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014bf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r13
sub rsp, 0x50
mov rsi, qword [rdx + 8]
mov r13, rcx
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140014d0e
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], r12
nop
mov rbx, qword [r13 + 0xe80]
lea r8, [rdi + 0x18]
lea rdx, [rsp + 0x30]
lea rcx, [r13 + 0xe78]
call fcn.1400157d0
cmp qword [rax], rbx
je 0x140014c51
lea rdx, [rdi + 0x18]
lea rcx, [r13 + 0xe78]
call fcn.140014560
mov rax, qword [rsp + 0x80]
mov r8, qword [rdi + 0x20]
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rax]
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x88]
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov dword [rsp + 0x88], 4
mov dword [rsp + 0x78], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140014ca7
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [rdi + 0x29], 0
jne 0x140014cf6
mov rax, qword [rdi + 0x10]
cmp byte [rax + 0x29], 0
jne 0x140014cd1
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
jne 0x140014cf6
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
je 0x140014cc3
jmp 0x140014cf6
mov rax, qword [rdi + 8]
cmp byte [rax + 0x29], 0
jne 0x140014cf3
nop dword [rax + rax]
cmp rdi, qword [rax + 0x10]
jne 0x140014cf3
mov rdi, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x29], 0
je 0x140014ce0
mov rdi, rax
cmp rdi, rsi
jne 0x140014c20
mov r12, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r13
pop rdi
pop rsi
ret
Function at 0x140014d20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r13
sub rsp, 0x50
mov rsi, qword [rdx + 8]
mov r13, rcx
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140014e3e
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], r12
nop
mov rbx, qword [r13 + 0xe80]
lea r8, [rdi + 0x18]
lea rdx, [rsp + 0x30]
lea rcx, [r13 + 0xe78]
call fcn.1400157d0
cmp qword [rax], rbx
je 0x140014d81
lea rdx, [rdi + 0x18]
lea rcx, [r13 + 0xe78]
call fcn.140014560
mov rax, qword [rsp + 0x80]
mov r8, qword [rdi + 0x20]
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rax]
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x88]
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov dword [rsp + 0x88], 3
mov dword [rsp + 0x78], 1
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140014dd7
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [rdi + 0x29], 0
jne 0x140014e26
mov rax, qword [rdi + 0x10]
cmp byte [rax + 0x29], 0
jne 0x140014e01
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
jne 0x140014e26
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
je 0x140014df3
jmp 0x140014e26
mov rax, qword [rdi + 8]
cmp byte [rax + 0x29], 0
jne 0x140014e23
nop dword [rax + rax]
cmp rdi, qword [rax + 0x10]
jne 0x140014e23
mov rdi, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x29], 0
je 0x140014e10
mov rdi, rax
cmp rdi, rsi
jne 0x140014d50
mov r12, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r13
pop rdi
pop rsi
ret
Function at 0x140014e50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r13
sub rsp, 0x50
mov rsi, qword [rdx + 8]
mov r13, rcx
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140014f76
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], r12
nop
mov rbx, qword [r13 + 0xe80]
lea r8, [rdi + 0x18]
lea rdx, [rsp + 0x30]
lea rcx, [r13 + 0xe78]
call fcn.1400157d0
cmp qword [rax], rbx
je 0x140014eb5
lea rdx, [rdi + 0x18]
lea rcx, [r13 + 0xe78]
call fcn.140014560
mov ecx, dword [rax]
jmp 0x140014eb7
xor ecx, ecx
mov rax, qword [rsp + 0x80]
mov r8, qword [rdi + 0x20]
mov rdx, qword [rdi + 0x18]
mov dword [rsp + 0x78], ecx
mov rcx, qword [rax]
lea rax, [rsp + 0x78]
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x88]
xor r8d, r8d
mov dword [rsp + 0x88], 3
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140014f09
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [rdi + 0x29], 0
jne 0x140014f5e
mov rax, qword [rdi + 0x10]
cmp byte [rax + 0x29], 0
jne 0x140014f3e
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
jne 0x140014f5e
nop word [rax + rax]
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
je 0x140014f30
jmp 0x140014f5e
mov rax, qword [rdi + 8]
cmp byte [rax + 0x29], 0
jne 0x140014f5b
cmp rdi, qword [rax + 0x10]
jne 0x140014f5b
mov rdi, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x29], 0
je 0x140014f48
mov rdi, rax
cmp rdi, rsi
jne 0x140014e80
mov r12, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r13
pop rdi
pop rsi
ret
Function at 0x140014f80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rsi
push r13
sub rsp, 0x50
mov rsi, qword [rdx + 8]
mov r13, rcx
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x1400150be
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r12
nop
mov rdi, qword [r13 + 0xe80]
lea r8, [rbx + 0x18]
lea rdx, [rsp + 0x30]
lea rcx, [r13 + 0xe78]
call fcn.1400157d0
cmp qword [rax], rdi
je 0x140014fe5
lea rdx, [rbx + 0x18]
lea rcx, [r13 + 0xe78]
call fcn.140014560
mov ecx, dword [rax]
jmp 0x140014fe7
xor ecx, ecx
mov rax, qword [rsp + 0x80]
mov r8, qword [rbx + 0x20]
mov dword [rsp + 0x78], ecx
mov r10, qword [rax]
mov dword [rsp + 0x88], 1
test ecx, ecx
jne 0x140015021
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
dec rcx
add ecx, ecx
mov dword [rsp + 0x78], ecx
mov rdx, qword [rbx + 0x18]
mov rcx, qword [r10 + 8]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x88]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140015055
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [rbx + 0x29], 0
jne 0x1400150a6
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x29], 0
jne 0x14001507f
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
jne 0x1400150a6
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
je 0x140015071
jmp 0x1400150a6
mov rax, qword [rbx + 8]
cmp byte [rax + 0x29], 0
jne 0x1400150a3
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x1400150a3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x29], 0
je 0x140015090
mov rbx, rax
cmp rbx, rsi
jne 0x140014fb0
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop r13
pop rsi
pop rbx
ret
Function at 0x1400150d0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r13
sub rsp, 0x40
mov rsi, qword [rdx + 8]
mov r13, rcx
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400151e6
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r12
nop
mov rbx, qword [r13 + 0xe80]
lea r8, [rdi + 0x18]
lea rdx, [rsp + 0x78]
lea rcx, [r13 + 0xe78]
call fcn.1400157d0
cmp qword [rax], rbx
je 0x140015131
lea rdx, [rdi + 0x18]
lea rcx, [r13 + 0xe78]
call fcn.140014560
mov rax, qword [rsp + 0x70]
mov rdx, qword [rdi + 0x18]
mov r9d, 4
mov rcx, qword [rax]
mov rax, qword [rdi + 0x20]
mov dword [rsp + 0x28], 4
mov r8d, dword [rax]
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x68], r8d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14001517a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [rdi + 0x29], 0
jne 0x1400151ce
mov rax, qword [rdi + 0x10]
cmp byte [rax + 0x29], 0
jne 0x1400151ae
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
jne 0x1400151ce
nop word [rax + rax]
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
je 0x1400151a0
jmp 0x1400151ce
mov rax, qword [rdi + 8]
cmp byte [rax + 0x29], 0
jne 0x1400151cb
cmp rdi, qword [rax + 0x10]
jne 0x1400151cb
mov rdi, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x29], 0
je 0x1400151b8
mov rdi, rax
cmp rdi, rsi
jne 0x140015100
mov r12, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r13
pop rdi
pop rsi
ret

Function at 0x1400151f0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r13
sub rsp, 0x40
mov rsi, qword [rdx + 8]
mov r13, rcx
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140015306
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r12
nop
mov rbx, qword [r13 + 0xe80]
lea r8, [rdi + 0x18]
lea rdx, [rsp + 0x78]
lea rcx, [r13 + 0xe78]
call fcn.1400157d0
cmp qword [rax], rbx
je 0x140015251
lea rdx, [rdi + 0x18]
lea rcx, [r13 + 0xe78]
call fcn.140014560
mov rax, qword [rsp + 0x70]
mov rdx, qword [rdi + 0x18]
mov r9d, 3
mov rcx, qword [rax]
mov rax, qword [rdi + 0x20]
mov dword [rsp + 0x28], 1
movzx r8d, byte [rax]
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x68]
mov byte [rsp + 0x68], r8b
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14001529b
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [rdi + 0x29], 0
jne 0x1400152ee
mov rax, qword [rdi + 0x10]
cmp byte [rax + 0x29], 0
jne 0x1400152ce
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
jne 0x1400152ee
nop word [rax + rax]
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
je 0x1400152c0
jmp 0x1400152ee
mov rax, qword [rdi + 8]
cmp byte [rax + 0x29], 0
jne 0x1400152eb
cmp rdi, qword [rax + 0x10]
jne 0x1400152eb
mov rdi, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x29], 0
je 0x1400152d8
mov rdi, rax
cmp rdi, rsi
jne 0x140015220
mov r12, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r13
pop rdi
pop rsi
ret
Function at 0x140015310
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r13
sub rsp, 0x40
mov rsi, qword [rdx + 8]
mov r13, rcx
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140015416
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r12
nop
mov rbx, qword [r13 + 0xe80]
lea r8, [rdi + 0x18]
lea rdx, [rsp + 0x68]
lea rcx, [r13 + 0xe78]
call fcn.1400157d0
cmp qword [rax], rbx
je 0x140015375
lea rdx, [rdi + 0x18]
lea rcx, [r13 + 0xe78]
call fcn.140014560
mov edx, dword [rax]
jmp 0x140015377
xor edx, edx
mov r8, qword [rdi + 0x20]
mov rax, qword [rsp + 0x70]
mov dword [rsp + 0x28], edx
mov rcx, qword [rax]
mov rdx, qword [rdi + 0x18]
mov qword [rsp + 0x20], r8
mov rcx, qword [rcx + 8]
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400153af
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [rdi + 0x29], 0
jne 0x1400153fe
mov rax, qword [rdi + 0x10]
cmp byte [rax + 0x29], 0
jne 0x1400153de
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
jne 0x1400153fe
nop dword [rax + rax]
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
je 0x1400153d0
jmp 0x1400153fe
mov rax, qword [rdi + 8]
cmp byte [rax + 0x29], 0
jne 0x1400153fb
cmp rdi, qword [rax + 0x10]
jne 0x1400153fb
mov rdi, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x29], 0
je 0x1400153e8
mov rdi, rax
cmp rdi, rsi
jne 0x140015340
mov r12, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r13
pop rdi
pop rsi
ret
Function at 0x140015420
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rsi
push r13
sub rsp, 0x40
mov rsi, qword [rdx + 8]
mov r13, rcx
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x140015536
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r12
nop
mov rdi, qword [r13 + 0xe80]
lea r8, [rbx + 0x18]
lea rdx, [rsp + 0x68]
lea rcx, [r13 + 0xe78]
call fcn.1400157d0
cmp qword [rax], rdi
je 0x140015481
lea rdx, [rbx + 0x18]
lea rcx, [r13 + 0xe78]
call fcn.140014560
mov r8, qword [rbx + 0x20]
mov rax, qword [rsp + 0x70]
mov rdx, qword [rbx + 0x18]
mov r10, qword [rax]
or rcx, 0xffffffffffffffff
mov rdi, r8
xor eax, eax
repne scasw ax, word [rdi]
not rcx
lea r9d, [rax + 1]
dec rcx
add ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [r10 + 8]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400154cb
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [rbx + 0x29], 0
jne 0x14001551e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x29], 0
jne 0x1400154fe
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
jne 0x14001551e
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
je 0x1400154f0
jmp 0x14001551e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x29], 0
jne 0x14001551b
cmp rbx, qword [rax + 0x10]
jne 0x14001551b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x29], 0
je 0x140015508
mov rbx, rax
cmp rbx, rsi
jne 0x140015450
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop r13
pop rsi
pop rbx
ret

Function at 0x1400165d0
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x30
mov r10, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
lea r9d, [rax + 1]
repne scasw ax, word [rdi]
not rcx
dec rcx
add ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [r10 + 8]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14001661b
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x30
pop rdi
ret
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x1400167d0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x100
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x130], rbx
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
mov dword [rsp + 0x34], esi
mov qword [rcx + 0x18], send
mov qword [rcx + 0x10], rsi
mov byte [rcx], sil
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov rbp, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14001683c
mov rdi, qword [rdx]
mov dword [rsp + 0x20], 0xf0000020
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140016940
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140016931
xor r9d, r9d
mov r8d, ebp
mov rdx, rdi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140016922
mov dword [rsp + 0x20], esi
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x70]
mov edx, 2
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140016913
nop dword [rax + rax]
movzx r8d, byte [rsp + rsi + 0x70]
lea rdx, str._02x
lea rcx, [rsp + 0x58]
call fcn.1400d4f30
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x58]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.14000cba0
inc rsi
cmp rsi, 0x10
jl 0x1400168d0
jmp 0x140016955
mov r8d, 0x18
lea rdx, str.Error_getting_hash_param
jmp 0x14001694d
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.Error_hashing_data
jmp 0x14001694d
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.Error_creating_hash
jmp 0x14001694d
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.Error_acquiring_context
mov rcx, rbx
call fcn.140011360
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rax, rbx
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400d4d90
mov rbx, qword [rsp + 0x130]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
Function at 0x140019f00
Capabilities:
Identify system language via api

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x558]
sub rsp, 0x650
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rbp + 0x540], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov edx, 0x468
mov r9d, 0x30000
mov r8d, 1
lea rcx, [0x14017ede0]
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov rdi, rax
xor edx, edx
mov r8d, 0x3d0
lea rcx, [rsp + 0x50]
call fcn.1400dd9f0
mov dword [rsp + 0x50], 0x3d0
mov qword [rsp + 0x70], rdi
mov rax, qword [rbx + 8]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x68], 0x800a
mov dword [rsp + 0x64], 7
mov dword [rsp + 0x60], 0x66
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov ecx, 0x419
cmp ax, cx
je 0x14001a083
lea rax, [rbp + 0x328]
mov qword [rbp + 0x320], rax
lea rcx, [0x14012dc80]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [rax + 1]
lea r8, [rbp + 0x328]
mov edx, ebx
lea rcx, [rbp + 0x320]
call fcn.14001ca20
movsxd rdx, ebx
add rdx, rdx
mov r9, rdx
lea r8, [0x14012dc80]
mov rcx, qword [rbp + 0x320]
call fcn.1400d4e34
test eax, eax
je 0x14001a04c
cmp eax, 0xc
je 0x14001a041
cmp eax, 0x16
je 0x14001a036
cmp eax, 0x22
je 0x14001a036
cmp eax, 0x50
je 0x14001a04c
mov ecx, 0x80004005
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 0x8007000e
call fcn.1400022b0
nop
mov rcx, qword [rbp + 0x320]
lea rdx, [rsp + 0x78]
sub rdx, rcx
nop dword [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
test ax, ax
jne 0x14001a060
lea rax, [rbp + 0x328]
mov rcx, qword [rbp + 0x320]
jmp 0x14001a13e
lea rax, [rbp + 0x438]
mov qword [rbp + 0x430], rax
lea rcx, [0x14012dd60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [rax + 1]
lea r8, [rbp + 0x438]
mov edx, ebx
lea rcx, [rbp + 0x430]
call fcn.14001ca20
movsxd rdx, ebx
add rdx, rdx
mov r9, rdx
lea r8, [0x14012dd60]
mov rcx, qword [rbp + 0x430]
call fcn.1400d4e34
test eax, eax
je 0x14001a10b
cmp eax, 0xc
je 0x14001a100
cmp eax, 0x16
je 0x14001a0f5
cmp eax, 0x22
je 0x14001a0f5
cmp eax, 0x50
je 0x14001a10b
mov ecx, 0x80004005
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 0x8007000e
call fcn.1400022b0
nop
mov rcx, qword [rbp + 0x430]
lea rdx, [rsp + 0x78]
sub rdx, rcx
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
test ax, ax
jne 0x14001a120
lea rax, [rbp + 0x438]
mov rcx, qword [rbp + 0x430]
cmp rcx, rax
je 0x14001a148
call fcn.1400d6134
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov rcx, rdi
test eax, eax
jne 0x14001a166
call qword [sym.imp.USER32.dll_DestroyIcon]
xor eax, eax
jmp 0x14001a171
call qword [sym.imp.USER32.dll_DestroyIcon]
mov eax, 1
mov rcx, qword [rbp + 0x540]
xor rcx, rsp
call fcn.1400d4d90
lea r11, [rsp + 0x650]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14001b230
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov r12, rcx
mov edi, 1
mov rbx, qword [0x140181670]
lea edx, [rdi + 0x66]
mov r8d, 0xf0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14001b3ef
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14001b3ef
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14001b3ef
xor r13d, r13d
mov r15d, 0x403
mov r14d, 0x1234
nop dword [rax]
movzx esi, word [rbx]
cmp r13w, si
je 0x14001b3ef
movzx eax, word [rbx + 2]
mov ebp, dword [rbx + 4]
add rbx, 8
cmp r15w, ax
jne 0x14001b352
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
mov r8d, 3
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.14001c7a0
nop
movzx edx, si
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x143
mov rcx, qword [r12 + 8]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp rax, 0xffffffffffffffff
cmove edi, r13d
lea rax, [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x14001b3e4
call fcn.1400d6134
jmp 0x14001b3e4
cmp r14w, ax
jne 0x14001b3e4
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x40], 0xffffffffffffffff
lea rax, [rsp + 0x188]
mov qword [rsp + 0x180], rax
mov r8d, 3
mov rdx, rbx
lea rcx, [rsp + 0x180]
call fcn.14001c7a0
nop
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x188]
mov rcx, qword [rsp + 0x180]
cmp rcx, rax
je 0x14001b3bb
call fcn.1400d6134
movzx edx, si
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x40b
mov rcx, qword [r12 + 8]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp rax, 0xffffffffffffffff
cmove edi, r13d
add rbx, rbp
test edi, edi
jne 0x14001b2d0
mov eax, edi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400d4d90
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001b430
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
mov ecx, dword [rcx + 0x90]
mov eax, ecx
and eax, 0xc
cmp al, 0xc
jne 0x14001b4a5
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x30], rcx
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [rsp + 0x40], 0xfffffffe
movsxd rcx, eax
mov qword [rsp + 0x38], rcx
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov rcx, qword [rdi + 8]
movsxd rbx, eax
call qword [sym.imp.USER32.dll_GetParent]
lea r9, [rsp + 0x30]
mov r8, rbx
mov edx, MsiInstallMissingFileW
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov al, 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
shr ecx, 2
test cl, 1
je 0x14001b4e6
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov rcx, qword [rdi + 8]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetParent]
mov r9, qword [rdi + 8]
movzx r8d, bx
mov edx, 0x111
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov al, 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov r8, qword [rdi + 0x50]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
seta bl
test bl, bl
je 0x14001b52f
mov rcx, qword [rdi + 8]
or byte [rdi + 0x94], 2
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
movzx eax, bl
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret