joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003374
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 8]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 4
jb 0x14000337a
mov rax, rcx
ret

Function at 0x140003a70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
lea rbp, [rsp - 0x10]
sub rsp, 0x110
movdqa xmm0, xmmword [0x14000a080]
lea r9, [rbp + 0x38]
movdqa xmm1, xmmword [0x140009fd0]
lea rdx, [rbp - 0x28]
and qword [rbp + 0x38], 0
mov esi, 0x5f
movdqu xmmword [rbp - 0x28], xmm0
mov byte [rbp + 4], sil
movdqu xmmword [rbp - 0x18], xmm1
mov dword [rbp - 8], 0xd5a1d1f4
mov dword [rbp - 4], 0x20025e1e
mov dword [rbp], 0x1858799b
call fcn.1400026d0
and dword [rbp + 0x30], 0
mov ecx, 0x200
call fcn.140001094
mov rbx, rax
mov rax, qword [section..data]
test rax, rax
jne 0x140003b0a
mov ecx, 0x118
call fcn.140001094
test rax, rax
je 0x140003b03
mov rcx, rax
call fcn.1400013b4
mov qword [section..data], rax
mov r8, qword [rbp + 0x38]
or r9d, 0xffffffff
mov dword [rsp + 0x28], 0x100
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rbx
call qword [rax + 0x78]
and qword [rbp + 0x38], 0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x4bfff8
mov dword [rsp + 0x44], 0xffc3fffc
mov dword [rsp + 0x48], 0xffa60043
mov dword [rsp + 0x4c], 0xff84ff8a
mov dword [rsp + 0x50], 0x7affcc
mov dword [rsp + 0x54], 0x320037
mov dword [rsp + 0x58], 0xffb0ffb3
mov dword [rsp + 0x5c], 0x70071
mov dword [rsp + 0x60], 0x4000b
mov dword [rsp + 0x64], 0x5fffa1
mov dword [rsp + 0x68], 0xffb80063
mov dword [rsp + 0x6c], 0x49ffb4
mov dword [rsp + 0x70], 0x51ffbb
mov dword [rsp + 0x74], 0x3c007a
mov dword [rsp + 0x78], 0x52ffec
mov dword [rsp + 0x7c], 0xffad0016
mov dword [rbp - 0x80], 0x5d006c
mov dword [rbp - 0x7c], 0xffc30053
mov dword [rbp - 0x78], 0x9cffd3
mov dword [rbp - 0x74], 0xc5007e
mov dword [rbp - 0x70], 0x7400f4
mov dword [rbp - 0x6c], 0xe800c5
mov dword [rbp - 0x68], 0xe100bc
mov dword [rbp - 0x64], 0x54004f
mov dword [rbp - 0x60], 0x840006
mov dword [rbp - 0x5c], 0x45009d
mov dword [rbp - 0x58], 0x390037
mov dword [rbp - 0x54], 0x8c0061
mov dword [rbp - 0x50], 0x50066
mov dword [rbp - 0x4c], 0x8c0081
mov dword [rbp - 0x48], 0x8e0064
mov dword [rbp - 0x44], 0x1c0066
mov dword [rbp - 0x40], 0xd9005e
mov dword [rbp - 0x3c], 0x260060
mov dword [rbp - 0x38], 0x8009c
mov dword [rbp - 0x34], 0x610065
mov dword [rbp - 0x30], 0xd300a7
mov dword [rbp - 0x2c], 0x4093582f
call fcn.140003350
lea r8, [rbp + 0x38]
mov rcx, rbx
lea rdx, [rsp + 0x40]
lea r9, [rbp + 0x30]
call fcn.140001e54
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x140003cc6
and qword [rbp - 0x20], 0
lea rcx, [rbp - 0x28]
and qword [rbp - 0x18], 0
mov qword [rbp - 0x28], rax
call fcn.140003cdc
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0xd542514d
mov dword [rsp + 0x34], 0x2b3000b7
mov dword [rsp + 0x38], 0xb7bb
mov dword [rsp + 0x3c], 0xdaa96f5
call fcn.140003334
cmp qword [rbp - 0x18], 0
je 0x140003cc6
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x28]
call fcn.1400040c8
mov rbx, qword [rsp + 0x140]
add rsp, 0x110
pop r14
pop rsi
pop rbp
ret
Function at 0x14005a244
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x40
xor ebx, ebx
mov dword [rsp + 0x58], 4
cmp dword [0x1400af708], ebx
mov dword [rsp + 0x50], ebx
jne 0x14005a2c8
lea rax, [r11 + 0x10]
mov r9d, 0x20000010
mov qword [r11 - 0x18], rax
lea r8, str.CacheDisable
lea rax, [r11 + 8]
mov rcx, 0xffffffff80000002
mov qword [r11 - 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionFveDetect
mov qword [r11 - 0x28], rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, 0xfffffffc
jne 0x14005a2c8
cmp eax, 1
je 0x14005a2c8
mov eax, dword [0x1400ae890]
cmp dword [rsp + 0x50], ebx
mov dword [0x1400af708], 1
cmovne eax, ebx
mov dword [0x1400ae890], eax
jmp 0x14005a2ce
mov eax, dword [0x1400ae890]
add rsp, 0x40
pop rbx
ret

Function at 0x14005b240
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push r14
push r15
sub r12, r12
add r12, 0x60
mov r14, qword gs:[r12]
push r11
mov r11, qword [r14 + 0x10]

Function at 0x14005b70c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14005b758
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14005b750
cmp dword [rcx + 0x3c], edx
jl 0x14005b750
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14005b750
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14005b758
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140001ca0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x1160
call fcn.1400178d0
sub rsp, rax
mov rax, qword [0x140020010]
xor rax, rsp
mov qword [rsp + 0x1150], rax
mov r14, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], ecx
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx], rcx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rcx
mov dword [rsp + 0x20], 1
lea r8, [rsp + 0x30]
mov edx, 0x1000
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140001dc1
mov eax, dword [rsp + 0x30]
shr eax, 2
test eax, eax
je 0x140001dc1
lea rdi, [rsp + 0x40]
mov ebp, eax
nop word [rax + rax]
mov r8d, dword [rdi]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140001db3
mov r9d, 0x104
lea r8, [rsp + 0x1040]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
test eax, eax
je 0x140001daa
lea rax, [rsp + 0x1040]
mov r8, r14
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001d86
inc rax
test ecx, ecx
jne 0x140001d73
test edx, edx
jne 0x140001daa
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140001d9f
mov eax, dword [rdi]
mov dword [rdx], eax
add qword [rbx + 8], 4
jmp 0x140001daa
mov r8, rdi
mov rcx, rbx
call fcn.140015ee0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
sub rbp, 1
jne 0x140001d30
mov rax, rbx
mov rcx, qword [rsp + 0x1150]
xor rcx, rsp
call fcn.140016a70
lea r11, [rsp + 0x1160]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140013b70
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140013b98
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140013bbe
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140013bc0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140013c19
test ecx, ecx
jle 0x140013bf9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140013c19
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140013c19
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140013c40
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140013c62
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140013c78
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140013c94
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140013c96
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140013cd2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140013d6e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140013d0d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140013d4e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140013d6e
cmp rbx, rax
ja 0x140013d20
test rbx, rbx
je 0x140013d6e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140014190
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140020010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400141bd
xor eax, eax
jmp 0x140014329
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400141f7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400141f7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140014329
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14001431c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14001423a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140014265
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140014321
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400142d4
sub eax, 1
je 0x1400142d4
cmp eax, 2
jne 0x14001431c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140014321
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140014302
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14001431c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140014321
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140016a70
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140014850
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140020010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140014923
cmp byte [rcx + 0x71], 0
je 0x140014923
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14001491f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400148e4
sub eax, 1
je 0x1400148e8
cmp eax, 2
jne 0x14001491f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140016a70
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140014916
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14001491f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400148cc
xor al, al
jmp 0x1400148cc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140016a70
add rsp, 0x60
pop rbx
ret

Function at 0x1400173fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140017446
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140017446
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140017446
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140017446
cmp dword [rcx + 0x84], 0xe
jbe 0x140017446
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140017448
xor al, al
add rsp, 0x28
ret
Function at 0x180018340
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x23
syscall
ret
Function at 0x140001680
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400016f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400016f8
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400016e5
nop
cmp rbx, rcx
jae 0x1400016f8
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1400016d0
cmp rbx, rcx
jae 0x1400016f8
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x1400016fa
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140005f30
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SystemCurrentControlSetControlPriorityControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005fac
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Win32PrioritySeparation
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x58]
test eax, eax
je 0x140005fb6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xff000000
add rsp, 0x38
ret
mov qword [rsp + 0x30], rbx
mov ebx, dword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
Function at 0x140006cc0
Capabilities:
Check os version
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x950
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov rbx, qword [0x140093528]
mov r8d, 0x409
movzx r9d, ax
mov ecx, dword [rbx + 0x1024]
lea esi, [r8 - 0xa]
test ecx, ecx
je 0x140006d1e
mov edx, r8d
and r9w, si
nop
and cx, si
cmp cx, r9w
je 0x140006e3d
mov eax, dword [rbx + rdx*4 + 4]
inc rdx
inc r8d
movzx ecx, ax
test eax, eax
jne 0x140006d00
call fcn.1400081e0
mov ebx, eax
test eax, eax
je 0x140006d34
mov dword [0x140093530], eax
call fcn.140008480
mov dword [0x14008db00], ebx
call fcn.140003730
lea r8, [0x14007bbb8]
mov byte [0x140092c01], 1
mov edx, 0x208
lea rcx, [0x14008e28c]
call fcn.14001f05c
mov rdi, qword [0x140093410]
lea rax, str.tweakscheduler.exe
lea rcx, [rsp + 0x30]
mov qword [0x14008e498], rax
mov qword [0x14008dc58], rdi
mov dword [0x14008dc54], 6
mov dword [rsp + 0x30], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
lea r8, [rsp + 0x150]
cmp dword [rsp + 0x34], 5
mov r9d, esi
mov rcx, rdi
mov word [rsp + 0x150], bx
jae 0x140006e48
mov edx, 0x168
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x140006e16
cmp byte [0x14008daf0], bl
je 0x140006de4
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x14008daf0], bl
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, esi
lea r8, [rsp + 0x150]
mov rcx, rax
mov edx, 0x168
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x140006e16
mov word [rsp + 0x150], bx
mov r9d, 0x10
lea r8, str.TweakScheduler_v1.04
lea rdx, [rsp + 0x150]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 2
jmp 0x140006ef0
movsxd rax, r8d
mov ebx, dword [rbx + rax*4]
jmp 0x140006d34
mov edx, 0x14e
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x140006ea4
cmp byte [0x14008daf0], bl
je 0x140006e72
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x14008daf0], bl
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, esi
lea r8, [rsp + 0x150]
mov rcx, rax
mov edx, 0x14e
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x140006ea4
mov word [rsp + 0x150], bx
mov r9d, 0x34
lea r8, str.TweakScheduler_v1.04
lea rdx, [rsp + 0x150]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x140006ecd
mov eax, 1
jmp 0x140006ef0
mov rcx, qword [0x140093410]
lea r9, [0x1400062b0]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov edx, 0x81
call qword [sym.imp.USER32.dll_DialogBoxParamW]
xor eax, eax
lea r11, [rsp + 0x950]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140007fc0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x14008d040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r10, r8
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x40], rcx
mov rax, rdx
lea rcx, [rsp + 0x50]
mov rbx, r9
mov qword [rsp + 0x38], rcx
xor r9d, r9d
xor ecx, ecx
xor r8d, r8d
mov qword [rsp + 0x30], rcx
mov rdx, r10
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], ecx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140008056
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x14000806b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000ba20
add rsp, 0x70
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000ba20
add rsp, 0x70
pop rbx
ret
Function at 0x140008ce0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x840
mov rax, qword [0x14008d040]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov ebp, edx
mov r14, rcx
cmp qword [rcx + 0x108], 0
je 0x140008eab
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x30]
call fcn.14006cc60
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r8d, 0x3ff
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ebx, ebx
lea rdi, [rbx - 1]
test eax, eax
je 0x140008d8f
lea rcx, [rsp + 0x30]
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], bx
jne 0x140008d60
dec eax
movsxd rcx, eax
test eax, eax
jle 0x140008d94
cmp word [rsp + rcx*2 + 0x30], 0x5c
je 0x140008d86
dec eax
dec rcx
test rcx, rcx
jg 0x140008d72
jmp 0x140008d94
cdqe
mov word [rsp + rax*2 + 0x30], bx
jmp 0x140008d94
mov word [rsp + 0x30], bx
mov ecx, ebx
mov rdx, qword [r14 + 0xf8]
cmp dword [rdx], ebx
je 0x140008eec
mov r8, qword [r14 + 0x108]
mov rax, rbx
nop
lea rsi, [rax*8]
cmp qword [rsi + r8], rbx
je 0x140008eec
cmp dword [rdx + rax*4], ebp
je 0x140008dd7
inc ecx
mov eax, ecx
cmp dword [rdx + rcx*4], ebx
jne 0x140008db0
xor al, al
jmp 0x140008ead
call fcn.140002130
mov rcx, rax
test rax, rax
je 0x140008ef0
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
mov rdx, qword [r14 + 0x108]
cmp word [rsp + 0x30], 0
je 0x140008e22
mov r9, qword [rdx + rsi]
lea r8, [rsp + 0x30]
lea rdx, str._s_s
lea rcx, [rsp + 0x20]
call fcn.1400055e0
jmp 0x140008e49
mov rdx, qword [rdx + rsi]
test rdx, rdx
je 0x140008e3c
mov rax, rdi
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x140008e30
mov ebx, eax
mov r8d, ebx
lea rcx, [rsp + 0x20]
call fcn.140002db0
mov rbx, qword [rsp + 0x20]
cmp dword [rbx - 8], 1
jle 0x140008e66
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.140002c80
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140008e94
mov rcx, qword [r14 + 0x108]
mov rcx, qword [rcx + rsi]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140008ed5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140008eab
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov al, 1
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.14000ba20
lea r11, [rsp + 0x840]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140008eec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor al, al
jmp 0x140008ead
mov ecx, 0x80004005
call fcn.1400014d0
int3
Function at 0x14000c3b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000c3fa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000c3fa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000c3fa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000c3fa
cmp dword [rcx + 0x84], 0xe
jbe 0x14000c3fa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000c3fc
xor al, al
add rsp, 0x28
ret

Function at 0x14004ad24
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14004aaa0