joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a0b90
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x318
mov qword [rsp + 0x2f8], 0xfffffffffffffffe
mov rax, qword [rsp + 0x328]
mov qword [rsp + 0x300], rax
cmp qword [rsp + 0x300], 0x800d
je 0x1401a0c1d
cmp qword [rsp + 0x300], 0x8030
je 0x1401a0cfb
cmp qword [rsp + 0x300], 0x8034
je 0x1401a0dea
cmp qword [rsp + 0x300], 0x8071
je 0x1401a0d96
cmp qword [rsp + 0x300], 0x80b1
je 0x1401a0e10
jmp 0x1401a0e49
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8033
xor edx, edx
lea rcx, [0x1403acbe0]
call fcn.1400d5e60
test rax, rax
je 0x1401a0c63
mov r8d, 0xffffffff
mov edx, 0x124
mov ecx, 0x89
call fcn.1400f0f30
cmp eax, 7
jne 0x1401a0c63
xor eax, eax
jmp 0x1401a0e4e
mov r8d, 0xffffffff
mov edx, 0x124
mov ecx, 0x75
call fcn.1400f0f30
cmp eax, 6
jne 0x1401a0cf4
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8003
xor edx, edx
lea rcx, [0x1403acbe0]
call fcn.1400d5e60
mov rcx, qword [rsp + 0x320]
add rcx, 0x220
mov r8d, 1
mov edx, 0x800c
call fcn.14000ea40
mov rcx, qword [rsp + 0x320]
add rcx, 0x220
xor r8d, r8d
mov edx, 0x800d
call fcn.14000ea40
mov rcx, qword [rsp + 0x320]
add rcx, 0x220
xor r8d, r8d
mov edx, 0x8030
call fcn.14000ea40
xor eax, eax
jmp 0x1401a0e4e
mov r8d, 0xffffffff
mov edx, 0x124
mov ecx, 0x8b
call fcn.1400f0f30
cmp eax, 6
jne 0x1401a0d8f
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8037
xor edx, edx
lea rcx, [0x1403acbe0]
call fcn.1400d5e60
mov rcx, qword [rsp + 0x320]
add rcx, 0x220
mov r8d, 1
mov edx, 0x800c
call fcn.14000ea40
mov rcx, qword [rsp + 0x320]
add rcx, 0x220
mov r8d, 1
mov edx, 0x800d
call fcn.14000ea40
mov rcx, qword [rsp + 0x320]
add rcx, 0x220
xor r8d, r8d
mov edx, 0x8030
call fcn.14000ea40
xor eax, eax
jmp 0x1401a0e4e
lea rcx, [rsp + 0x2f0]
call fcn.140001000
mov qword [rsp + 0x308], rax
mov rcx, qword [rsp + 0x308]
call fcn.140023510
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x2f0]
call fcn.140001490
xor eax, eax
jmp 0x1401a0e4e
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1401629f0
nop
lea rcx, [rsp + 0x30]
call fcn.140081900
nop
lea rcx, [rsp + 0x30]
call fcn.1401629a0
xor eax, eax
jmp 0x1401a0e4e
mov rax, qword [rsp + 0x320]
mov dword [rax + 0x8e8], 1
mov rcx, qword [rsp + 0x320]
call fcn.14000ec60
test eax, eax
je 0x1401a0e45
mov edx, 2
mov rcx, qword [rsp + 0x320]
call fcn.140078478
xor eax, eax
jmp 0x1401a0e4e
mov eax, 1
add rsp, 0x318
ret
Function at 0x1401b8a90
Capabilities:
Monitor local ipv4 address changes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x70]
cmp dword [rax + 0x220], 0
je 0x1401b8b72
mov qword [rsp + 0x28], 0
call qword [sym.imp.WS2_32.dll_WSACreateEvent]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call sub.IPHLPAPI.DLL_NotifyAddrChange
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x1401b8b02
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x1401b8b02
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, [0x1402190a8]
mov ecx, 1
call fcn.1400dc610
jmp 0x1401b8b72
mov dword [rsp + 0x20], 0x102
mov rax, qword [rsp + 0x70]
cmp dword [rax + 0x220], 0
je 0x1401b8b38
cmp dword [rsp + 0x20], 0x102
jne 0x1401b8b38
mov edx, 0x3e8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x20], eax
jmp 0x1401b8b0a
cmp dword [rsp + 0x20], 0
jne 0x1401b8b62
mov rax, qword [rsp + 0x70]
add rax, 0x314
mov ecx, 1
xchg dword [rax], ecx
lea rdx, [0x1402190e0]
mov ecx, 1
call fcn.1400dc610
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WS2_32.dll_WSACloseEvent]
jmp 0x1401b8a99
add rsp, 0x68
ret
Function at 0x1401bae10
Capabilities:
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x10b0
call fcn.1401d4c90
sub rsp, rax
mov qword [rsp + 0x1090], 0xfffffffffffffffe
mov rax, qword [0x1402a15c0]
xor rax, rsp
mov qword [rsp + 0x10a8], rax
mov dword [rsp + 0x1088], 0
mov byte [rsp + 0x70], 0
lea rdi, [rsp + 0x71]
xor eax, eax
mov ecx, 0xfff
rep stosb byte [rdi], al
mov dword [rsp + 0x1070], 0
jmp 0x1401bae82
mov eax, dword [rsp + 0x1070]
add eax, 2
mov dword [rsp + 0x1070], eax
mov rcx, qword [rsp + 0x10c8]
call fcn.1400a8204
cmp dword [rsp + 0x1070], eax
jge 0x1401baf67
cmp dword [rsp + 0x1070], 0x1000
jge 0x1401baf67
mov rdx, qword [rsp + 0x10c8]
lea rcx, [rsp + 0x1080]
call fcn.1400020d0
mov qword [rsp + 0x1098], rax
mov rax, qword [rsp + 0x1098]
mov qword [rsp + 0x10a0], rax
mov r9d, 2
mov r8d, dword [rsp + 0x1070]
lea rdx, [rsp + 0x1078]
mov rcx, qword [rsp + 0x10a0]
call fcn.140002270
nop
lea rcx, [rsp + 0x1080]
call fcn.140001490
mov dword [rsp + 0x1074], 0
lea rcx, [rsp + 0x1078]
call fcn.140023510
lea r8, [rsp + 0x1074]
lea rdx, [0x140212494]
mov rcx, rax
call fcn.1400aa440
mov eax, dword [rsp + 0x1070]
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
movzx eax, byte [rsp + 0x1074]
mov byte [rsp + rcx + 0x70], al
lea rcx, [rsp + 0x1078]
call fcn.140001490
jmp 0x1401bae71
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x10c8]
call fcn.1400a8204
mov eax, eax
xor edx, edx
mov ecx, 2
div rcx
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x1401bafef
lea rdx, [0x14021201c]
mov rcx, qword [rsp + 0x10c0]
call fcn.1400020d0
mov eax, dword [rsp + 0x1088]
or eax, 1
mov dword [rsp + 0x1088], eax
mov rax, qword [rsp + 0x10c0]
jmp 0x1401bb049
lea rcx, [rsp + 0x50]
call fcn.140002db0
nop
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.1400020a0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x10c0]
call fcn.140001430
mov eax, dword [rsp + 0x1088]
or eax, 1
mov dword [rsp + 0x1088], eax
lea rcx, [rsp + 0x50]
call fcn.140001490
mov rax, qword [rsp + 0x10c0]
mov rcx, qword [rsp + 0x10a8]
xor rcx, rsp
call fcn.1400a8050
add rsp, 0x10b0
pop rdi
ret
Function at 0x1401bb070
Capabilities:
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov dword [rsp + 0x7c], 0
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0xa8]
call fcn.1400a8204
add rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x60]
call fcn.140002db0
nop
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
jne 0x1401bb13e
lea rdx, [0x140211f9c]
mov rcx, qword [rsp + 0xa0]
call fcn.1400020d0
mov eax, dword [rsp + 0x7c]
or eax, 1
mov dword [rsp + 0x7c], eax
lea rcx, [rsp + 0x60]
call fcn.140001490
mov rax, qword [rsp + 0xa0]
jmp 0x1401bb1b9
mov dword [rsp + 0x78], 0
jmp 0x1401bb153
mov eax, dword [rsp + 0x78]
add eax, 1
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x68]
cmp dword [rsp + 0x78], eax
jge 0x1401bb17f
movsxd rcx, dword [rsp + 0x78]
mov rax, qword [rsp + 0x70]
movzx r8d, byte [rax + rcx]
lea rdx, [0x140212488]
lea rcx, [rsp + 0x60]
call fcn.14000efa0
jmp 0x1401bb148
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xa0]
call fcn.140001430
mov eax, dword [rsp + 0x7c]
or eax, 1
mov dword [rsp + 0x7c], eax
lea rcx, [rsp + 0x60]
call fcn.140001490
mov rax, qword [rsp + 0xa0]
add rsp, 0x98
ret
Function at 0x1401c11f0
Capabilities:
Monitor local ipv4 address changes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x70]
cmp dword [rax + 0x220], 0
je 0x1401c12d4
mov qword [rsp + 0x28], 0
call qword [sym.imp.WS2_32.dll_WSACreateEvent]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call sub.IPHLPAPI.DLL_NotifyAddrChange
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x1401c1264
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x1401c1264
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, str.NotifyAddrChange_error..._d
mov ecx, 1
call fcn.1400dc610
xor eax, eax
jmp 0x1401c12d9
mov dword [rsp + 0x20], 0x102
mov rax, qword [rsp + 0x70]
cmp dword [rax + 0x220], 0
je 0x1401c129a
cmp dword [rsp + 0x20], 0x102
jne 0x1401c129a
mov edx, 0x3e8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x20], eax
jmp 0x1401c126c
cmp dword [rsp + 0x20], 0
jne 0x1401c12c4
mov rax, qword [rsp + 0x70]
add rax, 0x2a8
mov ecx, 1
xchg dword [rax], ecx
lea rdx, [0x14021d110]
mov ecx, 1
call fcn.1400dc610
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WS2_32.dll_WSACloseEvent]
jmp 0x1401c11f9
mov eax, 1
add rsp, 0x68
ret

Function at 0x1401c12f0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [rsp + 0xa0]
cmp dword [rax + 0x220], 0
jne 0x1401c1320
mov eax, 1
jmp 0x1401c1426
lea rcx, [rsp + 0x28]
call fcn.140001000
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
lea r8, [0x14021b6a4]
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x30]
call fcn.1400010b0
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
call fcn.140010180
mov r8, rax
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x38]
call fcn.1400010b0
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x78], rax
lea r8, [0x14021d050]
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x40]
call fcn.1400010b0
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x80]
call fcn.140023510
mov r9, rax
mov r8d, 1
lea rdx, [0x14021d060]
lea rcx, [0x14021d078]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x40]
call fcn.140001490
nop
lea rcx, [rsp + 0x38]
call fcn.140001490
nop
lea rcx, [rsp + 0x30]
call fcn.140001490
nop
lea rcx, [rsp + 0x28]
call fcn.140001490
cmp dword [rsp + 0x20], 0
je 0x1401c1419
xor r9d, r9d
mov r8d, 1
xor edx, edx
lea rcx, str.NET_SHARE_CCBootShare__DELETE__Y
call fcn.140004900
mov rcx, qword [rsp + 0xa0]
call fcn.1400d7d30
add rsp, 0x98
ret
Function at 0x1400118b0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x1402cece8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, r8
lea rax, [rsp + 0x40]
mov rbx, rdx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x801a
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14001195a
lea rdx, str.SBAMWsc.log
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea r8, [0x1402743c4]
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.1401cd8c8
test eax, eax
jne 0x14001195a
mov rcx, qword [rsp + 0x30]
lea r8, str.SBAMWsc
mov r9, rbx
mov qword [rsp + 0x20], rdi
lea rdx, str._s:_s:_s_n
call fcn.140016720
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001195a
call fcn.1401d3450
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1401c73d0
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
Function at 0x140013220
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x260
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rax, qword [0x1402cece8]
xor rax, rsp
mov qword [rsp + 0x250], rax
cmp byte [0x1402cf898], 0
jne 0x140013274
lea r8, str.Unable_to_process_WSC_request_to_open_UI__not_allowed_by_policy_for_business_agent
lea rdx, str.LaunchUI
mov ecx, 1
call fcn.140011980
jmp 0x140013382
xor esi, esi
mov word [rsp + 0x40], si
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140013382
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
call fcn.140031ba4
mov rcx, rax
test rax, rax
jne 0x1400132b9
mov ecx, 0x80004005
call fcn.140016620
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
lea rax, str.SBAMUI.exe
lea rdi, str.VIPREUI.exe
cmp byte [0x1402e0d10], 0
cmovne rdi, rax
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x140013309
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1400163d0
mov rbx, qword [rsp + 0x30]
mov r8, rdi
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1401d3b5c
test eax, eax
js 0x140013377
cmp eax, dword [rbx - 0xc]
jg 0x140013377
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], si
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140013382
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140013382
mov ecx, 0x80070057
call fcn.140016620
nop
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1401c73d0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140015da0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140015dd3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140015e1a
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140015e15
nop
cmp rbx, rcx
jae 0x140015e1a
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140015e00
cmp rbx, rcx
jb 0x140015e1e
xor eax, eax
jmp 0x140015e2a
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140016de0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, dword [r9]
mov rbx, r8
add eax, eax
mov rdi, r9
mov dword [rsp + 0x40], eax
xor esi, esi
mov dword [r9], esi
lea rax, [rsp + 0x40]
mov rcx, qword [rcx]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140016e6e
mov eax, dword [rsp + 0x58]
dec eax
cmp eax, 1
ja 0x140016e50
mov ecx, dword [rsp + 0x40]
test rbx, rbx
je 0x140016e68
test ecx, ecx
je 0x140016e65
test cl, 1
jne 0x140016e50
mov eax, ecx
shr rax, 1
cmp word [rbx + rax*2 - 2], si
je 0x140016e68
mov eax, 0xd
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov word [rbx], si
shr ecx, 1
mov dword [rdi], ecx
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140031954
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
or edx, 0xffffffff
mov rsi, rcx
call fcn.140034790
xor ebx, ebx
test eax, eax
je 0x1400319bd
mov rcx, rsi
mov edi, 0x811c9dc5
call fcn.1401d3a30
mov r9, rax
mov eax, 0xcccccccd
mul r9d
shr edx, 3
test r9d, r9d
je 0x1400319ab
movzx r8d, word [rsi + rbx*2]
inc ebx
imul edi, edi, 0x1000193
add ebx, edx
xor edi, r8d
cmp ebx, r9d
jb 0x140031994
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.140032800
int3

Function at 0x140035584
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x1400355f7
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003560b
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x14003560b
mov rcx, rax
call fcn.1401c8134
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rsi
mov rcx, rbp
call rdi
jmp 0x140035610
cmp dword [rcx + 8], 0
je 0x14003560b
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x140035610
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140037ca0
Capabilities:
Get graphical window text

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
movsxd rbp, r8d
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0xd0], 0
jne 0x140037ce1
mov r8d, ebp
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x140037dbe
call fcn.140031ba4
mov r14, rax
test rax, rax
jne 0x140037cf9
mov ecx, 0x80004005
call fcn.140016620
int3
mov rax, qword [rax]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call fcn.1401c8134
mov rcx, r14
call rbx
add rax, 0x18
mov qword [rsp + 0x50], rax
mov rdi, qword [rdi + 0xd0]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x118]
mov rcx, rbx
call fcn.1401c8134
lea rdx, [rsp + 0x50]
mov rcx, rdi
call rbx
mov rdx, rbp
or rbx, 0xffffffffffffffff
mov r9, rbx
mov r8, qword [rsp + 0x50]
mov rcx, rsi
call fcn.1401da6c8
test eax, eax
je 0x140037d7a
cmp eax, 0xc
je 0x140037d74
cmp eax, 0x16
je 0x140037d6e
cmp eax, 0x22
je 0x140037d6e
cmp eax, 0x50
je 0x140037d7a
call fcn.140032800
int3
call fcn.140032800
int3
call fcn.140032824
int3
test rsi, rsi
jne 0x140037d83
xor ebp, ebp
jmp 0x140037d8e
mov rcx, rsi
call fcn.1401d3a30
mov rbp, rax
mov rsi, qword [rsp + 0x50]
mov ecx, ebx
lock xadd dword [rsi - 8], ecx
add ecx, ebx
test ecx, ecx
jg 0x140037dbc
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call fcn.1401c8134
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
mov eax, ebp
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140038c60
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rsi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140038c8b
mov r8, rdx
mov rdx, qword [rdi]
call fcn.140035584
jmp 0x140038d03
cmp byte [0x1402d5bc0], 0
jne 0x140038cd2
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140038cc2
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x1402d5bb8], rax
jmp 0x140038cc9
mov rbx, qword [0x1402d5bb8]
mov byte [0x1402d5bc0], 1
jmp 0x140038cd9
mov rbx, qword [0x1402d5bb8]
test rbx, rbx
je 0x140038cf7
mov rcx, rbx
call fcn.1401c8134
mov r8d, dword [rdi + 8]
xor r9d, r9d
mov rcx, qword [rdi]
mov rdx, rsi
call rbx
jmp 0x140038d03
mov rcx, qword [rdi]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400404a4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x14004050c
call fcn.140035090
mov r8d, 0xf0
mov rdx, rsi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14004050c
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x14004052e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, r14
call fcn.14004adfc
mov esi, eax
test rdi, rdi
je 0x14004052c
test rbx, rbx
je 0x14004052c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140041404
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400414dc
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x1400414dc
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400414dc
test rsi, rsi
je 0x1400414dc
xor r15d, r15d
xor ebp, ebp
xor edi, edi
call fcn.140035090
lea r8, str.AFX_DIALOG_LAYOUT
mov rdx, rsi
mov r14, qword [rax + 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x1400414a9
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rsi
mov rcx, r14
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x1400414dc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
mov r8d, r15d
mov rdx, rbp
mov rcx, rbx
call fcn.14004bb5c
mov esi, eax
test rbp, rbp
je 0x1400414cc
test rdi, rdi
je 0x1400414cc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
je 0x1400414d8
mov rcx, rbx
call fcn.14004106c
mov eax, esi
jmp 0x1400414de
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400425e0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x40]
call fcn.14003880c
mov rdi, rax
test rax, rax
je 0x14004265c
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x140042657
cmp dword [rbx], 0x40
jb 0x140042657
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
or dword [rbx + 4], 1
xor r8d, r8d
or qword [rbx + 0x30], 0xffffffffffffffff
mov edx, 0x87
mov qword [rbx + 8], rcx
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x140042657
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x140042660
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14004741c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_720
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
cmp rdx, 0x10000
jae 0x14004c38f
cmp dword [rcx + 0xe8], 0
jne 0x14004c38f
movzx eax, di
mov dword [rcx + 0xe8], eax
call fcn.140035090
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.14004c748
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret