joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140031e60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov r15, rcx
lea rax, [rbp - 1]
mov qword [rbp + 0x1f], rax
movdqa xmm0, xmmword [0x14003c9c0]
movdqu xmmword [rbp - 0x39], xmm0
mov word [rbp - 0x29], 0x57
xor r13d, r13d
mov eax, r13d
nop dword [rax + rax]
movzx ecx, byte [rbp - 0x39]
xor byte [rbp + rax - 0x38], cl
inc rax
cmp rax, 0x10
jb 0x140031eb0
mov byte [rbp - 0x28], r13b
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], 0xf
lea rax, [rbp - 0x38]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], r13b
jne 0x140031ee3
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 1]
call fcn.140032560
lea rax, [rbp - 1]
mov qword [rbp + 0x27], rax
mov byte [rbp - 0x39], 0x45
mov al, 0x10
mov cl, 0x36
mov dl, 0x20
mov r8b, 0x37
mov r9b, 0x76
mov r10b, 0x77
mov r11b, 0x6b
mov bl, 0x21
mov dil, 0x29
movzx esi, dil
xor r12d, r12d
xor al, 0x45
mov byte [rbp - 0x38], al
xor cl, 0x45
mov byte [rbp - 0x37], cl
xor dl, 0x45
mov byte [rbp - 0x36], dl
xor r8b, 0x45
mov byte [rbp - 0x35], r8b
xor r9b, 0x45
mov byte [rbp - 0x34], r9b
xor r10b, 0x45
mov byte [rbp - 0x33], r10b
xor r11b, 0x45
mov byte [rbp - 0x32], r11b
xor bl, 0x45
mov byte [rbp - 0x31], bl
xor dil, 0x45
mov byte [rbp - 0x30], dil
xor sil, 0x45
mov byte [rbp - 0x2f], sil
mov byte [rbp - 0x2e], r12b
mov qword [rbp - 0x21], r13
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], 0xf
lea rax, [rbp - 0x38]
inc r14
cmp byte [rax + r14], r12b
jne 0x140031f82
mov r8, r14
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x21]
call fcn.140032560
lea rax, [rbp - 0x21]
mov qword [rbp - 0x39], rax
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rdx, qword [rbp - 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r15
call rax
mov ebx, eax
mov rdx, qword [rbp - 9]
cmp rdx, 0x10
jb 0x140032013
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003200e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003200e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003431c
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], 0xf
mov byte [rbp - 0x21], 0
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x140032061
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003205c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003205c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003431c
mov eax, ebx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140032090
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov r15, rcx
lea rax, [rbp - 1]
mov qword [rbp + 0x1f], rax
movdqa xmm0, xmmword [0x14003ca00]
movdqu xmmword [rbp - 0x39], xmm0
mov word [rbp - 0x29], 0x48
xor r13d, r13d
mov eax, r13d
nop dword [rax + rax]
movzx ecx, byte [rbp - 0x39]
xor byte [rbp + rax - 0x38], cl
inc rax
cmp rax, 0x10
jb 0x1400320e0
mov byte [rbp - 0x28], r13b
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], 0xf
lea rax, [rbp - 0x38]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], r13b
jne 0x140032113
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 1]
call fcn.140032560
lea rax, [rbp - 1]
mov qword [rbp + 0x27], rax
mov byte [rbp - 0x39], 0x51
mov al, 4
mov cl, 0x22
mov dl, 0x34
mov r8b, 0x23
mov r9b, 0x62
mov r10b, 0x63
mov r11b, 0x7f
mov bl, 0x35
mov dil, 0x3d
movzx esi, dil
xor r12d, r12d
xor al, 0x51
mov byte [rbp - 0x38], al
xor cl, 0x51
mov byte [rbp - 0x37], cl
xor dl, 0x51
mov byte [rbp - 0x36], dl
xor r8b, 0x51
mov byte [rbp - 0x35], r8b
xor r9b, 0x51
mov byte [rbp - 0x34], r9b
xor r10b, 0x51
mov byte [rbp - 0x33], r10b
xor r11b, 0x51
mov byte [rbp - 0x32], r11b
xor bl, 0x51
mov byte [rbp - 0x31], bl
xor dil, 0x51
mov byte [rbp - 0x30], dil
xor sil, 0x51
mov byte [rbp - 0x2f], sil
mov byte [rbp - 0x2e], r12b
mov qword [rbp - 0x21], r13
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], 0xf
lea rax, [rbp - 0x38]
inc r14
cmp byte [rax + r14], r12b
jne 0x1400321b2
mov r8, r14
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x21]
call fcn.140032560
lea rax, [rbp - 0x21]
mov qword [rbp - 0x39], rax
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rdx, qword [rbp - 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r15
call rax
mov rbx, rax
mov rdx, qword [rbp - 9]
cmp rdx, 0x10
jb 0x140032244
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003223f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003223f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003431c
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], 0xf
mov byte [rbp - 0x21], 0
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x140032292
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003228d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003228d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003431c
mov rax, rbx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400322c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov r12, rdx
mov r15, rcx
lea rax, [rbp - 9]
mov qword [rbp + 0x17], rax
movdqa xmm0, xmmword [0x14003c710]
movdqu xmmword [rbp - 0x49], xmm0
mov dword [rbp - 0x39], 0x3b170c16
mov dword [rbp - 0x35], 0x161d1114
mov dword [rbp - 0x31], 0x1d0a390c
mov word [rbp - 0x2d], 0x19
xor edx, edx
mov ecx, edx
nop word [rax + rax]
movzx eax, byte [rbp - 0x49]
xor byte [rbp + rcx - 0x48], al
movzx eax, byte [rbp - 0x49]
xor byte [rbp + rcx - 0x47], al
add rcx, 2
cmp rcx, 0x1c
jb 0x140032320
mov byte [rbp - 0x2c], dl
mov qword [rbp - 9], rdx
mov qword [rbp + 7], rdx
mov qword [rbp + 0xf], 0xf
lea rax, [rbp - 0x48]
mov r14, 0xffffffffffffffff
mov r8, r14
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], dl
jne 0x140032360
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 9]
call fcn.140032560
lea rax, [rbp - 9]
mov qword [rbp + 0x1f], rax
mov byte [rbp - 0x59], 0x35
mov al, 0x71
mov cl, 0x42
mov dl, 0x58
mov r8b, 0x54
mov r9b, 0x45
mov r10b, 0x5c
mov r11b, 0x1b
mov bl, 0x51
mov dil, 0x59
movzx esi, dil
xor r13d, r13d
xor al, 0x35
mov byte [rbp - 0x58], al
xor cl, 0x35
mov byte [rbp - 0x57], cl
xor dl, 0x35
mov byte [rbp - 0x56], dl
xor r8b, 0x35
mov byte [rbp - 0x55], r8b
xor r9b, 0x35
mov byte [rbp - 0x54], r9b
xor r10b, 0x35
mov byte [rbp - 0x53], r10b
xor r11b, 0x35
mov byte [rbp - 0x52], r11b
xor bl, 0x35
mov byte [rbp - 0x51], bl
xor dil, 0x35
mov byte [rbp - 0x50], dil
xor sil, 0x35
mov byte [rbp - 0x4f], sil
mov byte [rbp - 0x4e], r13b
xor edi, edi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], 0xf
lea rax, [rbp - 0x58]
inc r14
cmp byte [rax + r14], dil
jne 0x140032401
mov r8, r14
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x29]
call fcn.140032560
lea rax, [rbp - 0x29]
mov qword [rbp - 0x59], rax
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0x10
cmovae rcx, qword [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 0x10
cmovae rdx, qword [rbp - 9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, r12
mov rcx, r15
call rax
mov ebx, eax
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x140032495
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032490
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032490
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003431c
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], 0xf
mov byte [rbp - 0x29], 0
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x1400324e3
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400324de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400324de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003431c
mov eax, ebx
mov rbx, qword [rsp + 0xf0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140032cb0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, qword [0x1400e01a0]
xor edi, edi
test rbx, rbx
jne 0x140032d07
lea ecx, [rdi + 0x38]
call fcn.1400342e0
mov rbx, rax
mov qword [rax], rdi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x31], edi
mov word [rax + 0x35], di
mov byte [rax + 0x37], dil
mov dword [rax + 8], 0xffffffff
xor eax, eax
mov qword [rbx + 0xc], rax
mov dword [rbx + 0x14], eax
mov qword [rbx + 0x28], rdi
mov byte [rbx + 0x30], al
mov qword [0x1400e01a0], rbx
mov ecx, 8
call fcn.1400342e0
lea rcx, [rsp + 0x38]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x140032db0]
xor ecx, ecx
mov dword [rsp + 0x20], edi
xor edx, edx
mov qword [rax], rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140032d9f
cmp dword [rsp + 0x38], edi
jne 0x140032d52
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rsp + 0x38], eax
jne 0x140032d6a
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x40]
xor edx, edx
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
je 0x140032d92
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov rbx, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x50
pop rdi
ret
mov ecx, 6
mov dword [rsp + 0x38], edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140005eac
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
movsxd rdi, edx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140005eee
cmp qword [rbx + 0x18], 0
jne 0x140005f2c
mov edx, dword [rbx + 0xc]
cmp edx, dword [rbx + 0x30]
jae 0x140005f37
mov rcx, qword [rcx + 8]
neg edi
sbb r8d, r8d
and r8d, 8
bts r8d, 0xa
call qword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x140005f2c
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140005f3d
mov rcx, qword [rcx + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
call qword [sym.imp.USER32.dll_SendMessageA]
bt rax, 0xd
jae 0x140005f2c
mov rcx, qword [rbx + 0x20]
mov r8, rdi
xor r9d, r9d
mov edx, 0xf1
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.14000ce6c
int3
call fcn.14000ce6c
int3

Function at 0x140006558
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, qword [rcx + 0x100]
xor r14d, r14d
mov rsi, rcx
mov rbp, qword [rcx + 0xf8]
cmp qword [rcx + 0xf0], r14
je 0x1400065ba
call fcn.14000eab4
mov rdx, qword [rsi + 0xf0]
lea r8d, [r14 + 5]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rbp, rbp
je 0x1400065cb
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov ebx, 1
test rdi, rdi
je 0x14000660c
mov edx, dword [rdi]
mov eax, 0xffff
cmp word [rdi + 2], ax
jne 0x1400065ef
mov edx, dword [rdi + 0xc]
movzx ecx, word [rdi + 0x12]
movzx eax, word [rdi + 0x14]
jmp 0x1400065f7
movzx ecx, word [rdi + 0xa]
movzx eax, word [rdi + 0xc]
test edx, 0x1801
jne 0x140006609
test cx, cx
jne 0x140006609
test ax, ax
je 0x14000660c
mov ebx, r14d
cmp qword [rsi + 0xf0], r14
je 0x14000661e
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14000663c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
test rdx, 0xffffffffffff0000
jne 0x14000667b
cmp dword [rcx + 0xe8], 0
jne 0x14000667b
movzx eax, dx
mov dword [rcx + 0xe8], eax
call fcn.14000eab4
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.1400069d8
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400066d8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
mov r15, rcx
xor edi, edi
call fcn.14000eab4
lea r8d, [rdi + 5]
mov rdx, rbx
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x140006734
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.14000676c
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400072c4
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x40
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x1402657b8]
test eax, eax
je 0x140007316
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1402657b8]
test eax, eax
jne 0x14000731f
call fcn.140007414
test eax, eax
je 0x14000733b
lea rdx, [rsp + 0x30]
mov rcx, qword [0x14025e018]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x140007343
xor eax, eax
jmp 0x14000739b
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rsi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov rsi, rax
mov qword [rsp + 0x38], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je 0x14000737d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14000737f
xor edi, edi
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140007398
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret
Function at 0x14000a11c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, r9
mov r14, r8
and qword [r9], 0
mov rbx, qword [rbp + 0x40]
and dword [rbx], 0
cmp qword [rcx + 0xb0], 0
je 0x14000a1fb
xor r8d, r8d
call fcn.14000a5ac
mov rsi, rax
test rax, rax
je 0x14000a2ce
mov qword [rbp - 0x18], rax
and dword [rbp - 0x10], 0
and qword [rbp - 8], 0
and dword [rbp + 0x20], 0
and dword [rbp + 0x40], 0
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rbp + 0x40]
mov dword [rbx], ecx
test eax, eax
jne 0x14000a1df
call fcn.140005a40
mov qword [rdi], rax
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000a1df
lea ebx, [rax + 1]
jmp 0x14000a1ed
mov rcx, qword [rdi]
call fcn.140005a38
and qword [rdi], 0
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000a2cc
mov rax, qword [rcx]
and qword [rsp + 0x20], 0
mov r9, r8
mov r8, rdx
lea rdx, [rbp + 0x38]
call qword [rax + 0x108]
nop
mov rax, qword [rbp + 0x38]
movsxd rcx, dword [rax - 0x10]
test ecx, ecx
jne 0x14000a228
xor ebx, ebx
jmp 0x14000a2b2
mov rsi, rcx
shr ecx, 1
mov dword [rbx], ecx
call fcn.140005a40
mov qword [rdi], rax
xor edx, edx
lea ebx, [rdx + 1]
test rsi, rsi
jle 0x14000a2ae
mov r8d, ebx
test r8, r8
js 0x14000a2a3
mov rax, qword [rbp + 0x38]
lea ecx, [rdx + 1]
cmp ecx, dword [rax - 0x10]
jg 0x14000a2a3
mov r9b, byte [r8 + rax]
test edx, edx
js 0x14000a298
cmp edx, dword [rax - 0x10]
jg 0x14000a298
sub r9b, bl
shl r9b, 4
sub r9b, 0x41
add r9b, byte [r8 + rax - 1]
mov eax, edx
test edx, edx
jns 0x14000a27b
lea eax, [rbx + rdx]
sar eax, 1
movsxd rcx, eax
mov rax, qword [rdi]
mov byte [rcx + rax], r9b
add edx, 2
add r8, 2
movsxd rax, edx
cmp rax, rsi
jl 0x14000a244
jmp 0x14000a2ae
mov ecx, 0x80070057
call fcn.1400028e0
int3
mov ecx, 0x80070057
call fcn.1400028e0
int3
mov rax, qword [rbp + 0x38]
lea rdx, [rax - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000a2cc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000a2e4
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14000a35e
xor r8d, r8d
call fcn.14000a5ac
mov rsi, rax
test rax, rax
jne 0x14000a31a
mov eax, edi
jmp 0x14000a374
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x14000a316
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000ad90
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x1a0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x14025f760]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rdi, r8
mov qword [rsp + 0x38], r8
mov rsi, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], r8
mov rcx, qword [rdx]
sub rcx, 0x18
call fcn.1400029c0
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
cmp rsi, 0xffffffff80000000
jne 0x14000ae48
call fcn.14000eb30
cmp eax, 1
jne 0x14000ae48
lea r8, [rsp + 0x30]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x58]
call fcn.14000acc0
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140008544
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000ae37
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, 0xffffffff80000001
mov qword [rsp + 0x50], rsi
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
test rdi, rdi
je 0x14000ae72
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2001f
xor r9d, r9d
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.14000a7c4
jmp 0x14000ae8c
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test eax, eax
jne 0x14000af77
mov r9d, 0x104
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, eax
test eax, eax
jne 0x14000af33
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x48]
call fcn.140002640
nop
mov r8, qword [rsp + 0x38]
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.14000ad90
mov edi, eax
test eax, eax
setne bl
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000af04
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14000af14
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
jmp 0x14000af38
mov rbx, qword [rsp + 0x30]
jmp 0x14000ae96
mov rax, qword [rsp + 0x38]
cmp edi, 0x103
je 0x14000af48
cmp edi, 0x3f2
jne 0x14000af6b
test rax, rax
je 0x14000af5d
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.14000b074
jmp 0x14000af69
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000af91
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140192d50
add rsp, 0x1a0
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000b074
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14000b0d7
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14000b0eb
lea rdx, str.RegDeleteKeyTransactedA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000b0eb
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x14000b0f0
cmp dword [rcx + 8], 0
je 0x14000b0eb
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x14000b0f0
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret