joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180064cf0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x18008a480]
xor rax, rsp
mov qword [rbp + 0x20], rax
and qword [rsp + 0x30], 0
mov r13d, 1
mov rdi, rcx
cmp r8d, r13d
jne 0x180064f4a
test rcx, rcx
je 0x180064f4a
mov rax, qword [rcx]
test rdx, rdx
lea r15, [0x18003bc80]
mov qword [rbp - 0x20], rax
mov rax, qword [rcx + 8]
cmovne r15, rdx
mov qword [rbp - 0x18], rax
mov rax, qword [rcx + 0x10]
lea ebx, [r13 + 0x77]
mov qword [rbp - 0x10], rax
mov rax, qword [rcx + 0x18]
mov r8d, ebx
mov qword [rbp - 8], rax
mov rax, qword [rcx + 0x20]
xor edx, edx
mov qword [rbp], rax
mov rax, qword [rcx + 0x28]
mov dword [rbp - 0x3c], r13d
mov qword [rbp + 8], rax
mov rax, qword [rcx + 0x30]
mov dword [rbp - 0x40], r13d
mov qword [rbp + 0x10], rax
mov rax, qword [rcx + 0x38]
lea rcx, [rsp + 0x40]
mov qword [rbp + 0x18], rax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
lea rax, [rbp - 0x40]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x40], 0x80000001
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x50], 0xa
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetTickCount]
and qword [rsp + 0x28], 0
mov r14d, eax
lea rax, [rsp + 0x30]
lea edx, [rbx - 0x72]
lea r9, [rsp + 0x40]
mov r8d, 0x1048
mov rcx, r15
mov qword [rsp + 0x20], rax
call sym.DNSAPI.dll_DnsQuery_W
mov ebx, eax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetTickCount]
mov esi, eax
sub esi, r14d
cmp eax, r14d
jae 0x180064e06
sub esi, r13d
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180064e1e
mov edx, r13d
call sym.DNSAPI.dll_DnsFree
and qword [rsp + 0x30], 0
mov eax, 0x251d
mov dword [rdi + 0x24], esi
mov dword [rdi + 0x28], ebx
cmp ebx, eax
jg 0x180064ef7
je 0x180064eee
test ebx, ebx
je 0x180064ee8
cmp ebx, 0x7b
je 0x180064f3e
cmp ebx, 0x5b4
je 0x180064edf
cmp ebx, 0x2329
jle 0x180064e78
cmp ebx, 0x232b
jle 0x180064eee
cmp ebx, 0x232d
je 0x180064ed6
cmp ebx, 0x2331
je 0x180064eee
mov dword [rdi + 0x2c], 0xff
test ebx, ebx
jne 0x180064eca
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov edx, 6
mov r8d, 0x104a
mov rcx, r15
mov qword [rsp + 0x20], rax
call sym.DNSAPI.dll_DnsQuery_W
mov rcx, qword [rsp + 0x30]
mov ebx, eax
test rcx, rcx
je 0x180064ebf
mov edx, r13d
call sym.DNSAPI.dll_DnsFree
test ebx, ebx
je 0x180064eca
mov dword [rdi + 0x2c], send
mov rcx, rdi
call fcn.180063080
xor eax, eax
jmp 0x180064f4f
mov dword [rdi + 0x2c], 6
jmp 0x180064eca
mov dword [rdi + 0x2c], 4
jmp 0x180064eca
and dword [rdi + 0x2c], 0
jmp 0x180064e83
mov dword [rdi + 0x2c], 5
jmp 0x180064e7f
cmp ebx, 0x2558
jl 0x180064e78
cmp ebx, 0x2559
jle 0x180064f3e
cmp ebx, 0x2743
je 0x180064f32
cmp ebx, 0x2746
je 0x180064f32
cmp ebx, 0x274d
je 0x180064f32
lea eax, [rbx - 0x2750]
cmp eax, r13d
ja 0x180064e78
mov dword [rdi + 0x2c], 3
jmp 0x180064e7f
mov dword [rdi + 0x2c], 2
jmp 0x180064e7f
mov eax, 0x57
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.180001000
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x180065b44
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbp, qword [rsp + 0x70]
xor edi, edi
mov rbx, r9
mov r14, r8
movzx r15d, dx
mov rsi, rcx
test rbp, rbp
je 0x180065d59
cmp qword [r9 + 0x38], rdi
je 0x180065d59
lea rcx, [0x18008ac00]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_AcquireSRWLockExclusive]
mov rax, qword [rbx + 0x38]
cmp dword [rax + 0xc], edi
je 0x180065ba0
mov edi, 1
jmp 0x180065ba7
mov dword [rax + 0xc], 1
lea rcx, [0x18008ac00]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_ReleaseSRWLockExclusive]
test edi, edi
jne 0x180065d59
mov ecx, 0x230
call fcn.180008d40
mov rbx, rax
test rax, rax
jne 0x180065c0a
mov rcx, qword [0x18008a130]
lea rax, [0x18008a130]
cmp rcx, rax
je 0x180065d59
test dword [rcx + 0x1c], 0x400
je 0x180065d59
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x22]
lea r8, [0x180082460]
call fcn.180058818
jmp 0x180065d59
test rsi, rsi
je 0x180065c1f
mov r8, rsi
mov edx, 0x100
mov rcx, rax
call fcn.1800091c0
mov rax, qword [rsp + 0x78]
mov edi, 0x800
lea rcx, [0x180038468]
mov r8d, edi
xor edx, edx
mov word [rbx + 0x200], r15w
mov qword [rbx + 0x228], rax
mov qword [rbx + 0x208], r14
mov qword [rbx + 0x220], rbp
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
lea rcx, [0x180065d78]
mov r8d, edi
xor edx, edx
mov qword [rbx + 0x210], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
cmp qword [rbx + 0x210], 0
mov qword [rbx + 0x218], rax
je 0x180065cec
test rax, rax
je 0x180065cec
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x180066430]
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_CreateThread]
test rax, rax
je 0x180065cb9
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x180065d59
mov rcx, qword [0x18008a130]
lea rax, [0x18008a130]
cmp rcx, rax
je 0x180065d2d
test dword [rcx + 0x1c], 0x400
je 0x180065d2d
mov rcx, qword [rcx + 0x10]
lea r8, [0x180082460]
mov edx, 0x24
call fcn.180058818
jmp 0x180065d2d
mov rcx, qword [0x18008a130]
lea rax, [0x18008a130]
cmp rcx, rax
je 0x180065d2d
test dword [rcx + 0x1c], 0x400
je 0x180065d2d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov rcx, qword [0x18008a130]
lea r8, [0x180082460]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x23
call fcn.180058fb0
mov rcx, rbx
call fcn.180008b84
mov rcx, qword [rbx + 0x210]
test rcx, rcx
je 0x180065d47
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
mov rcx, qword [rbx + 0x218]
test rcx, rcx
je 0x180065d59
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x180069a8c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x18008a480]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, r9
mov rdi, r8
call fcn.18006adf0
test eax, eax
je 0x180069c6a
test rdi, rdi
lea r9, [0x180069c98]
cmovne r9, rdi
test rbx, rbx
jne 0x180069b18
mov rcx, qword [0x18008a130]
lea r14, [0x18008a130]
cmp rcx, r14
je 0x180069c65
test dword [rcx + 0x1c], 0x400
je 0x180069c65
mov rcx, qword [rcx + 0x10]
lea r8, [0x180082ab8]
mov edx, 0xbe
call fcn.18005b780
jmp 0x180069c65
mov rcx, qword [0x18008a130]
lea r14, [0x18008a130]
cmp rcx, r14
je 0x180069bbc
test dword [rcx + 0x1c], 0x400
je 0x180069bbc
mov eax, dword [rbx + 0x50]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x90], eax
mov eax, dword [rbx + 0x4c]
mov dword [rsp + 0x88], eax
mov eax, dword [rbx + 0x48]
mov dword [rsp + 0x80], eax
mov eax, dword [rbx + 0x44]
mov dword [rsp + 0x78], eax
mov eax, dword [rbx + 0x40]
mov dword [rsp + 0x70], eax
mov eax, dword [rbx + 0x3c]
mov dword [rsp + 0x68], eax
mov eax, dword [rbx + 0x38]
mov dword [rsp + 0x60], eax
mov eax, dword [rbx + 0x34]
mov dword [rsp + 0x58], eax
mov eax, dword [rbx + 0x30]
mov dword [rsp + 0x50], eax
mov eax, dword [rbx + 0x28]
mov dword [rsp + 0x48], eax
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call fcn.180071f70
mov r9, qword [rbx + 0x10]
lea r8, [0x1800828a0]
call fcn.18006f300
mov rbp, qword [rbx + 0x20]
test rbp, rbp
je 0x180069c44
xor edi, edi
cmp dword [rbp + 4], edi
jbe 0x180069c44
mov r15d, edi
lea rcx, [rsp + 0xa0]
shl r15, 6
add r15, rbp
lea rdx, [r15 + 0x20]
call fcn.1800693b0
mov rcx, qword [0x18008a130]
cmp rcx, r14
je 0x180069c3d
test dword [rcx + 0x1c], 0x400
je 0x180069c3d
mov eax, dword [r15 + 0x4c]
mov rcx, qword [rcx + 0x10]
mov r9d, edi
mov dword [rsp + 0x38], eax
mov eax, dword [r15 + 0x48]
mov dword [rsp + 0x30], eax
mov eax, dword [r15 + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
call fcn.180070c44
inc edi
cmp edi, dword [rbp + 4]
jb 0x180069bdc
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x180069c65
lea r9, [0x180069ca8]
lea r8, [0x180069cb0]
mov qword [rsp + 0x20], rax
call fcn.180069dd0
call fcn.18006f8d0
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180001000
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x18006fb40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r15, qword [rsp + 0xa0]
xor r14d, r14d
or rax, 0xffffffffffffffff
test r15, r15
mov rbp, r8
mov rsi, rcx
cmove r15, rax
mov qword [rsp + 0x88], r14
cmp r15, r8
ja 0x18006fb8e
xor eax, eax
jmp 0x18006fd2b
lea rdi, [rcx + 0x1fe]
mov rbx, r8
lea r13, [rdi - 0x54]
cmp rcx, r13
jae 0x18006fcdf
mov r14b, byte [rbx]
inc rbx
mov r12b, r14b
and r12b, 0xc0
mov rcx, qword [0x18008a130]
lea rax, [0x18008a130]
cmp rcx, rax
je 0x18006fbec
test dword [rcx + 0x1c], 0x1000000
je 0x18006fbec
mov rcx, qword [rcx + 0x10]
movzx eax, r12b
movzx r9d, r14b
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r9d
call fcn.180070600
mov rcx, rsi
test r12b, r12b
jne 0x18006fc4d
mov rdx, rdi
lea r8, [0x18006fdd4]
movzx r9d, r14b
sub rdx, rsi
call fcn.180079640
mov rsi, rax
test r14b, r14b
je 0x18006fd17
movzx r12d, r14b
mov rcx, rsi
lea rax, [r12 + rbx]
mov qword [rsp + 0xa0], rax
cmp rax, r15
jae 0x18006fcf9
mov r8d, r12d
mov rdx, rbx
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov rbx, qword [rsp + 0xa0]
add rsi, r12
jmp 0x18006fcce
cmp r12b, 0xc0
jne 0x18006fd7f
cmp rbx, r15
jae 0x18006fd68
movzx eax, byte [rbx]
movzx r14d, r14b
mov rdx, rdi
shl r14w, 8
lea r8, [0x18006fe58]
sub rdx, rsi
or r14w, ax
inc rbx
movzx r9d, r14w
call fcn.180079640
mov r9, qword [rsp + 0x98]
mov rsi, rax
test r9, r9
je 0x18006fd63
mov rdx, qword [rsp + 0x88]
movzx ecx, r14w
lea rax, [rbx - 2]
test rdx, rdx
cmove rdx, rbx
xor rcx, 0xc000
add rcx, r9
mov qword [rsp + 0x88], rdx
cmp rcx, rax
jae 0x18006fd43
mov rbx, rcx
cmp rsi, r13
jb 0x18006fba5
mov r14, qword [rsp + 0x88]
sub rdi, r13
lea r8, [0x18006fda0]
mov rcx, r13
mov rdx, rdi
call fcn.180079640
mov rbx, rbp
jmp 0x18006fd1f
sub rdi, rsi
lea r8, [0x18006fde0]
movzx r9d, r14b
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call fcn.180079640
mov rbx, rbp
mov r14, qword [rsp + 0x88]
test r14, r14
cmovne rbx, r14
sub rbx, rbp
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
sub rdi, rsi
mov qword [rsp + 0x20], rcx
lea r9, [rbx - 2]
lea r8, [0x18006fe60]
mov rcx, rsi
mov rdx, rdi
call fcn.180079640
jmp 0x18006fd17
mov byte [rax], 0
jmp 0x18006fd17
sub rdi, rsi
lea r8, [0x18006fe20]
mov r9, rbx
mov rdx, rdi
call fcn.180079640
jmp 0x18006fd14
sub rdi, rsi
lea r8, [0x18006fe98]
movzx r9d, r14b
mov rdx, rdi
call fcn.180079640
jmp 0x18006fd14
Function at 0x180079308
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
xor r10d, r10d
xor r11d, r11d
mov rbx, rcx
test rcx, rcx
jne 0x180079325
mov eax, 0x57
jmp 0x1800793f9
test r9d, r9d
je 0x1800793f3
add r8, 0xfffffffffffffffe
mov al, byte [r8 + 2]
dec r9d
cmp al, 0x61
jl 0x180079345
cmp al, 0x7a
jg 0x180079373
sub al, 0x47
jmp 0x180079375
cmp al, 0x41
jl 0x180079351
cmp al, 0x5a
jg 0x180079373
sub al, 0x41
jmp 0x180079375
cmp al, 0x30
jl 0x180079365
cmp al, 0x39
jg 0x18007935d
add al, 4
jmp 0x180079375
cmp al, 0x3d
jne 0x180079373
xor al, al
jmp 0x180079375
cmp al, 0x2b
jne 0x18007936d
mov al, 0x3e
jmp 0x180079375
cmp al, 0x2f
mov al, 0x3f
je 0x180079375
mov al, 0xff
inc r8
cmp al, 0x40
jae 0x1800793eb
shl r10d, 6
movzx eax, al
inc r11d
or r10d, eax
cmp r11d, 4
jne 0x1800793dd
mov eax, r10d
xor r11d, r11d
shr eax, 0x10
mov byte [rcx], al
inc rcx
test r9d, r9d
jne 0x1800793ca
cmp byte [r8 + 1], 0x3d
jne 0x1800793ca
cmp byte [r8], 0x3d
je 0x1800793c0
test r10b, r10b
jne 0x1800793eb
shr r10d, 8
mov byte [rcx], r10b
inc rcx
jmp 0x1800793da
movzx eax, r10w
test eax, eax
jne 0x1800793eb
jmp 0x1800793da
mov eax, r10d
shr eax, 8
mov byte [rcx], al
mov byte [rcx + 1], r10b
add rcx, 2
xor r10d, r10d
test r9d, r9d
jne 0x180079332
test r11d, r11d
je 0x1800793f3
mov byte [rcx], 0
jmp 0x18007931b
sub ecx, ebx
xor eax, eax
mov dword [rdx], ecx
mov rbx, qword [rsp + 8]
ret

Function at 0x180079408
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor r10d, r10d
xor r11d, r11d
mov rbx, rcx
test rcx, rcx
jne 0x18007942a
mov eax, 0x57
jmp 0x180079526
test r9d, r9d
je 0x180079520
add r8, 0xfffffffffffffffc
mov edi, 4
movzx eax, word [r8 + 4]
dec r9d
cmp ax, 0x61
jb 0x180079456
cmp ax, 0x7a
ja 0x18007949b
sub ax, 0x47
jmp 0x1800794a0
cmp ax, 0x41
jb 0x180079468
cmp ax, 0x5a
ja 0x18007949b
sub ax, 0x41
jmp 0x1800794a0
cmp ax, 0x30
jb 0x180079483
cmp ax, 0x39
ja 0x180079479
add ax, di
jmp 0x1800794a0
cmp ax, 0x3d
jne 0x18007949b
xor eax, eax
jmp 0x1800794a0
cmp ax, 0x2b
jne 0x180079490
mov eax, 0x3e
jmp 0x1800794a0
cmp ax, 0x2f
mov eax, 0x3f
je 0x1800794a0
mov eax, 0xffff
add r8, 2
cmp al, 0x40
jae 0x180079518
shl r10d, 6
movzx eax, al
inc r11d
or r10d, eax
cmp r11d, edi
jne 0x18007950a
mov eax, r10d
xor r11d, r11d
shr eax, 0x10
mov byte [rcx], al
inc rcx
test r9d, r9d
jne 0x1800794f7
cmp word [r8 + 2], 0x3d
jne 0x1800794f7
cmp word [r8], 0x3d
je 0x1800794ed
test r10b, r10b
jne 0x180079518
shr r10d, 8
mov byte [rcx], r10b
inc rcx
jmp 0x180079507
movzx eax, r10w
test eax, eax
jne 0x180079518
jmp 0x180079507
mov eax, r10d
shr eax, 8
mov byte [rcx], al
mov byte [rcx + 1], r10b
add rcx, 2
xor r10d, r10d
test r9d, r9d
jne 0x18007943c
test r11d, r11d
je 0x180079520
mov byte [rcx], 0
jmp 0x180079420
sub ecx, ebx
xor eax, eax
mov dword [rdx], ecx
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x1400057f0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140005868
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x140005883
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x140005883
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call qword [case.0x1400126da.0]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x140005883
mov rdx, rdi
mov rcx, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x50]
mov eax, 1
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
sub al, 0x94
mov cl, 0x6a
lodsb al, byte [rsi]
pop r15
jns 0x1400aaa8a
movabs eax, dword [0x7f4d6c3106e76a88]
invalid
xchg byte es:[rdx - 0x23], bl
inc dword [rcx]
and dword [rdx - 0x3bcb9b4d], edi
cli
fsubr qword [rdi - 0x23b88ba0]
retf 0x9f9f

Function at 0x1400058a0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
je 0x14000595b
mov rbx, qword [rcx]
cmp qword [rdi], 0
je 0x140005926
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005946
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005946
mov qword [rsp + 0x28], 0
mov rdx, qword [rdi]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [case.0x1400126da.0]
nop
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp dword [rdi + 8], 0
je 0x140005946
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp byte [0x14006caf8], 0
jne 0x1400059a6
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005996
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006caf0], rax
mov byte [0x14006caf8], 1
jmp 0x1400059ad
mov rax, qword [0x14006caf0]
mov byte [0x14006caf8], 1
jmp 0x1400059ad
mov rax, qword [0x14006caf0]
mov rdx, rsi
mov rcx, qword [rbx]
test rax, rax
je 0x14000592f
xor r9d, r9d
mov r8d, dword [rbx + 8]
call qword [case.0x1400126da.0]
nop
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140007230
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x4a0
mov rax, qword [0x140065770]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
xor esi, esi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x80], rsi
xor edx, edx
lea r8d, [rsi + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1400072b7
xor edx, edx
lea r8d, [rsi + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1400072b7
call fcn.140004680
mov ebx, eax
jmp 0x140007415
mov r8, r15
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x1400072d8
call fcn.140004680
jmp 0x140007404
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x1400072fb
call fcn.140004680
jmp 0x140007404
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x34], eax
inc eax
cmp eax, ebx
jae 0x14000731d
mov ebx, 0x8007000e
jmp 0x140007406
mov ecx, eax
mov qword [rsp + 0x70], rcx
test eax, eax
jne 0x140007343
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x88]
mov qword [rsp + 0x80], rax
jmp 0x14000739a
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x140007456
lea rax, [rcx + rcx]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x40], rax
cmp rax, 0x400
jbe 0x140007331
lfence
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x80]
call fcn.140004650
jmp 0x140007341
cmp qword [rsp + 0x80], 0
jne 0x1400073ac
mov ebx, 0x8007000e
jmp 0x140007406
lfence
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1400073dc
call fcn.140004680
jmp 0x140007404
mov ecx, eax
mov rax, qword [rsp + 0x80]
mov word [rax + rcx*2], si
mov r8d, dword [rsp + 0x4f0]
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x58]
call fcn.140006d40
mov ebx, eax
test rdi, rdi
je 0x140007415
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x88]
cmp qword [rsp + 0x80], rax
je 0x140007435
lea rcx, [rsp + 0x80]
call fcn.140004620
nop
mov eax, ebx
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.140028810
add rsp, 0x4a0
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov dword [rsp + 0x30], 0x80070216
lfence
mov ecx, 0x80070216
call fcn.140004e20
int3
Function at 0x14000c6c0
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x78
test rdx, rdx
je 0x14000c728
mov r10, qword [rcx + 0x10]
test r10, r10
je 0x14000c712
cmp qword [rcx + 0x18], 0
jne 0x14000c70d
mov eax, dword [rcx + 0xc]
cmp eax, dword [rcx + 0x30]
jae 0x14000c72e
mov qword [rsp + 0x58], rdx
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0x50
mov edx, eax
mov dword [rsp + 0x24], 0x40
mov r8d, 1
mov rcx, qword [r10 + 8]
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
add rsp, 0x78
ret
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x14000c728
mov rcx, qword [rcx + 0x40]
add rsp, 0x78
jmp 0x1400197fc
call fcn.140009788
int3
call fcn.140009788
int3
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x140065770]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400198b3
test rdx, rdx
je 0x1400198b3
mov rcx, rdx
call fcn.1400314e8
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x200
mov rsi, rax
call fcn.14002aba0
mov eax, 0x100
cmp rsi, rax
ja 0x140019882
mov r8d, eax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, esi
jne 0x140019882
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x14001988e
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.140028810
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140009788
int3

Function at 0x14000d690
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14000d70b
xor r8d, r8d
call fcn.14000d968
mov rsi, rax
test rax, rax
je 0x14000d707
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [0x140066378]
mov rcx, rsi
mov ebx, eax
call qword [0x140065090]
test ebx, ebx
jne 0x14000d707
mov eax, dword [rsp + 0x30]
jmp 0x14000d721
mov eax, edi
jmp 0x14000d721
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14000ef84
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
or edx, 0xffffffff
mov rsi, rcx
call fcn.140020fc8
xor ebx, ebx
test eax, eax
je 0x14000efee
mov rcx, rsi
mov edi, 0x811c9dc5
call fcn.1400314e8
mov r8, rax
mov eax, 0xcccccccd
mul r8d
shr edx, 3
inc edx
test r8d, r8d
je 0x14000efdc
lfence
movzx ecx, word [rsi + rbx*2]
add ebx, edx
imul edi, edi, 0x1000193
xor edi, ecx
cmp ebx, r8d
jb 0x14000efc9
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.140009788
int3