joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400278e0
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x14013d0a8]
xor rax, rsp
mov qword [rsp + 0x450], rax
movzx ebx, dl
mov rdi, rcx
mov qword [rsp + 0x20], rcx
xor esi, esi
mov edx, 0x104
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r9, str.PROCMON24.SYS
lea r8, [rsp + 0x240]
lea rdx, str._sDrivers_s
lea rcx, [rsp + 0x30]
call fcn.140003120
lea rdx, [rsp + 0x30]
lea rcx, str.RCDRIVERNT
call fcn.140027b70
test al, al
jne 0x140027af6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x140027af6
test bl, bl
je 0x1400279d4
lea ecx, [rsi + 0x18]
call fcn.1400b5680
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x14002799d
mov qword [rax + 8], rsi
mov dword [rax + 0x10], 1
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
jmp 0x1400279a0
mov rbx, rsi
test rbx, rbx
mov qword [rdi], rbx
je 0x140027b3c
mov rax, rdi
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400b5660
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea r8, str.PROCMON24.SYS
lea rdx, str.__TEMP___s
lea rcx, [rsp + 0x240]
call fcn.140003120
mov r8d, 0x104
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rsp + 0x30]
lea rcx, str.RCDRIVERNT
call fcn.140027b70
test al, al
je 0x140027a60
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400b5680
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x140027a58
mov qword [rax + 8], rsi
mov dword [rax + 0x10], 1
lea rcx, [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140027b47
jmp 0x140027a5b
mov rbx, rsi
jmp 0x1400279a0
lea rdx, [rsp + 0x240]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea r9, str.PROCMON24.SYS
lea r8, [rsp + 0x240]
lea rdx, str._s_s
lea rcx, [rsp + 0x30]
call fcn.140003120
lea rdx, [rsp + 0x30]
lea rcx, str.RCDRIVERNT
call fcn.140027b70
test al, al
je 0x140027ae7
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400b5680
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x140027adf
mov qword [rax + 8], rsi
mov dword [rax + 0x10], 1
lea rcx, [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140027b52
jmp 0x140027ae2
mov rbx, rsi
jmp 0x1400279a0
xor edx, edx
mov rcx, rdi
call fcn.140026860
jmp 0x1400279ac
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400b5680
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x140027b2d
mov qword [rax + 8], rsi
mov dword [rax + 0x10], 1
lea rcx, [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140027b5d
jmp 0x140027b30
mov rbx, rsi
mov qword [rdi], rbx
test rbx, rbx
jne 0x1400279ac
mov ecx, 0x8007000e
call fcn.1400b6f00
nop
mov ecx, 0x8007000e
call fcn.1400b6f00
nop
mov ecx, 0x8007000e
call fcn.1400b6f00
nop
mov ecx, 0x8007000e
call fcn.1400b6f00
int3
Function at 0x140027b70
Capabilities:
Extract resource via kernel32 functions
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov qword [rsp + 0x40], 0
mov rdx, rcx
lea r8, str.BINRES
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x140027c36
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rdi
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov edx, 0x80
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea r8, [0x1400f79c8]
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.1400ce8f4
mov edx, 0x82
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov r9, qword [rsp + 0x40]
test r9, r9
je 0x140027c36
mov r8d, edi
mov edx, 1
mov rcx, rbx
call fcn.1400cee78
mov rcx, qword [rsp + 0x40]
call fcn.1400cea70
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140027c50
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea r8, [rsp + 0x58]
mov dword [rsp + 0x40], 4
lea rdx, str.SystemCurrentControlSetServicesPROCMON24
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140027cba
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x48], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x1400f7c38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x140034da0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14013d0a8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
xor ebp, ebp
mov dword [rcx + 4], ebp
mov rbx, r8
mov rsi, rdx
mov dword [rcx], r9d
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, rbx
mov qword [rdi + 8], rax
call fcn.1400b0640
mov rdx, rax
mov rcx, rbx
call fcn.1400b0780
mov qword [rdi + 0x10], rax
mov rax, qword [rsp + 0x90]
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rbp
mov qword [rdi + 0x38], rbp
cmp dword [rdi], ebp
je 0x140034ece
test rsi, rsi
je 0x140034e3b
lea rdx, [rsp + 0x38]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x40]
add eax, dword [rsp + 0x38]
cdq
sub eax, edx
sar eax, 1
mov dword [rdi + 0x28], eax
mov eax, dword [rsp + 0x44]
add eax, dword [rsp + 0x3c]
jmp 0x140034e56
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
mov ecx, 1
sub eax, edx
sar eax, 1
mov dword [rdi + 0x28], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
mov rcx, rsi
sub eax, edx
mov edx, 2
sar eax, 1
mov dword [rdi + 0x2c], eax
call qword [sym.imp.USER32.dll_GetAncestor]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetParent]
mov qword [rdi + 0x38], rax
mov rbx, rax
test rax, rax
je 0x140034ea8
call qword [sym.imp.USER32.dll_GetDesktopWindow]
cmp rbx, rax
je 0x140034ea8
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
mov rbx, rax
test rax, rax
jne 0x140034e81
lea rax, [rsp + 0x30]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1400219f0]
xor edx, edx
mov dword [rsp + 0x20], ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x30], rax
mov rax, rdi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400b5660
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400408b0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14013d0a8]
xor rax, rsp
mov qword [rsp + 0x40], rax
movsxd rsi, edx
lea r9, [rsp + 0x30]
mov rbp, r8
mov rdi, rcx
mov rcx, qword [rcx + 0x48]
xorps xmm0, xmm0
mov r8, rsi
mov edx, 0x130a
movups xmmword [rsp + 0x30], xmm0
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rsp + 0x3c]
xor r9d, r9d
sub eax, dword [rsp + 0x34]
xor r8d, r8d
mov rcx, qword [rdi + 0x48]
sub eax, 0xd
cdq
sub eax, edx
mov edx, 0x130b
sar eax, 1
mov ebx, eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8d, dword [rsp + 0x34]
mov ecx, 1
mov r9d, dword [rsp + 0x38]
cmp esi, eax
mov r10d, 4
cmove r10d, ecx
add r8d, ebx
sub r9d, r10d
mov rcx, rbp
lea eax, [r8 + 0xd]
lea edx, [r9 - 0xe]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetRect]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400b5660
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140044d60
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x14013d0a8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
xor ebp, ebp
mov qword [rsp + 0x20], rbp
mov edi, ebp
lea rbx, [0x1400f9900]
nop dword [rax]
mov r9d, 0x104
lea r8, [rsp + 0x30]
mov edx, dword [rbx + 4]
mov rcx, qword [0x140143520]
call qword [sym.imp.USER32.dll_LoadStringW]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1400b0450
lea rdx, [0x1400f9b98]
lea rcx, [rsp + 0x20]
call fcn.1400b0450
mov r9d, 0x104
lea r8, [rsp + 0x30]
mov edx, dword [rbx]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetDlgItemTextW]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1400b0450
lea rdx, [0x1400f9ba0]
lea rcx, [rsp + 0x20]
call fcn.1400b0450
inc edi
lea rbx, [rbx + 8]
cmp edi, 7
jb 0x140044da0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xe]
mov rcx, qword [rsi + 0x68]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x140044eff
call fcn.140009200
mov rcx, rax
test rax, rax
je 0x140044f49
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x28], rbx
mov rcx, qword [rsi + 0x68]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [rax + 1]
test edi, edi
js 0x140044f54
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140044e90
mov edx, edi
lea rcx, [rsp + 0x28]
call fcn.140009ae0
mov rbx, qword [rsp + 0x28]
mov r8d, edi
mov rdx, rbx
mov rcx, qword [rsi + 0x68]
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, 0xffffffff
jne 0x140044eba
test rbx, rbx
jne 0x140044eae
mov eax, ebp
jmp 0x140044ec2
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400cdf38
test eax, eax
js 0x140044f54
cmp eax, dword [rbx - 0xc]
jg 0x140044f54
mov dword [rbx - 0x10], eax
mov eax, eax
mov word [rbx + rax*2], bp
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400b0450
nop
mov eax, 0xffffffff
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x140044eff
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.WS2_32.dll_htonl]
lea rdx, [rsp + 0x20]
mov rcx, qword [rsi + 8]
call fcn.14006f350
nop
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140044f1e
call fcn.1400b0810
nop
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400b5660
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80004005
call fcn.140008df0
nop
mov ecx, 0x80070057
call fcn.140008df0
int3
Function at 0x1400591c0
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14013d0a8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
add rcx, 0x40
mov r8b, 1
movzx edx, r8b
call fcn.140058890
lea rsi, [0x140142790]
mov qword [rsp + 0x30], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [0x1401427b8]
lea rax, [0x140142610]
cmp rcx, rax
je 0x140059234
mov rdx, qword [0x140142610]
mov r8, qword [0x140142618]
sub r8, rdx
sar r8, 5
call fcn.140022280
movzx eax, byte [0x140142628]
mov byte [0x1401427d0], al
mov eax, dword [0x14014262c]
mov dword [0x1401427d4], eax
mov rcx, rsi
call fcn.14002e2b0
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rdi + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rsi
lea r9, [0x140053970]
mov r8, rbx
lea rdx, str.FILTER_CONTROL
mov rcx, rax
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov rbx, rax
mov edx, 0x484
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r9d, 2
lea r8, [rsp + 0x38]
mov rdx, qword [rdi + 8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov ecx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x3c]
sub ecx, r8d
mov r9d, dword [rsp + 0x40]
mov edx, dword [rsp + 0x38]
sub r9d, edx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call qword [sym.imp.USER32.dll_MoveWindow]
mov edx, 0x484
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 0xfffffff4
mov r8d, 0x418
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
lea r8, str.HighlightDialog
mov rdx, qword [0x1401430d8]
mov rcx, qword [rdi + 8]
call fcn.14009c830
mov edx, 0x446
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
mov edx, 0x3f4
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800b
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400b5660
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14005a0f0
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x310
mov rax, qword [0x14013d0a8]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov ebp, dword [rcx + 8]
xor ebx, ebx
mov qword [rsp + 0x328], rdi
mov rdi, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14005a136
call fcn.1400b06e0
mov rsi, rax
jmp 0x14005a139
mov rsi, rbx
mov rcx, qword [rdi]
mov rdi, qword [rsp + 0x328]
test rcx, rcx
je 0x14005a17a
call fcn.1400b0840
test eax, eax
je 0x14005a17a
mov dword [rsp + 0x30], ebx
mov r9d, 0x30000
mov dword [rsp + 0x28], ebp
mov r8d, 1
mov edx, eax
mov dword [rsp + 0x20], ebp
mov rcx, rsi
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
test rax, rax
jne 0x14005a1ac
cmp ebp, 0x10
lea r8, [rsp + 0x40]
mov r9d, 0x2b8
lea rcx, str..exe
sete bl
mov edx, 0x80
add ebx, 0x110
mov dword [rsp + 0x20], ebx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.1400b5660
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
Function at 0x14005a8d0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.1400b0850
test eax, eax
jne 0x14005a91c
lea r9d, [rax + 0x30]
lea r8, [0x1400f7478]
lea rdx, str.The_full_name_of_the_selected_directory_or_file_is_not_available.
mov rcx, rsi
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
jmp 0x14005aac5
mov dword [rbp - 0x29], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
movups xmmword [rbp - 0x11], xmm0
movups xmmword [rbp - 1], xmm0
movups xmmword [rbp + 0xf], xmm0
movups xmmword [rbp + 0x1f], xmm0
movups xmmword [rbp + 0x2f], xmm0
xor eax, eax
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], rax
lea rcx, str.explorer__select_
call fcn.1400b0640
mov rdx, rax
lea rcx, str.explorer__select_
call fcn.1400b0780
mov qword [rbp + 0x7f], rax
mov r8, rdi
lea rdx, [rbp + 0x77]
lea rcx, [rbp + 0x7f]
call fcn.1400b0290
nop
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x14005a987
call fcn.1400b0810
nop
lea rcx, [rbp + 0x77]
call fcn.1400b0200
mov rdx, rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14005aaa1
lea rcx, str.Explorer_could_not_open
call fcn.1400b0640
mov rdx, rax
lea rcx, str.Explorer_could_not_open
call fcn.1400b0780
mov qword [rbp - 0x61], rax
mov r8, rdi
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x61]
call fcn.1400b0290
mov rbx, rax
lea rcx, [0x140100154]
call fcn.1400b0640
mov rdx, rax
lea rcx, [0x140100154]
call fcn.1400b0780
mov qword [rbp - 0x69], rax
lea r8, [rbp - 0x69]
lea rdx, [rbp - 0x59]
mov rcx, rbx
call fcn.1400b0290
nop
mov rcx, qword [rbp - 0x69]
test rcx, rcx
je 0x14005aa40
call fcn.1400b0810
nop
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x14005aa4f
call fcn.1400b0810
nop
mov rcx, qword [rbp - 0x61]
test rcx, rcx
je 0x14005aa5e
call fcn.1400b0810
nop
lea rcx, [rbp - 0x59]
call fcn.1400b0200
mov rdx, rax
mov r9d, gethostbyaddr
lea r8, [0x1400f7478]
mov rcx, rsi
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x14005aa90
call fcn.1400b0810
nop
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x14005aa9f
call fcn.1400b0810
nop
jmp 0x14005aac5
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x14005aac5
call fcn.1400b0810
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x14005aad3
call fcn.1400b0810
nop
mov rbx, qword [rsp + 0x120]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005b740
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbx, r8
mov rdi, rdx
xor r8d, r8d
mov edx, 0x101f
xor r9d, r9d
mov rbp, rcx
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x1200
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, rax
mov rcx, 0xffffffffffffffff
lea r12d, [rax + rax]
mov eax, 4
mul r12
cmovo rax, rcx
mov rcx, rax
call fcn.1400b5c60
mov r14, rax
mov dword [rsp + 0x88], 0xffffffff
lea ecx, [rsi*8]
xor r8d, r8d
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x88]
mov rcx, rdi
mov qword [rsp + 0x20], r14
mov rdx, rbx
xor r15b, r15b
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005b85f
cmp dword [rsp + 0x88], 3
jne 0x14005b85f
mov eax, dword [rsp + 0x30]
lea rcx, [r12*4]
cmp rax, rcx
jne 0x14005b85f
mov r8d, esi
mov edx, 0x103a
mov rcx, rbp
lea r9, [r14 + r8*4]
call qword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
test esi, esi
je 0x14005b85c
mov rdi, r14
mov ecx, dword [rdi]
test ecx, ecx
je 0x14005b852
mov edx, dword [0x140141f28]
mov r8d, 0x60
call qword [sym.imp.KERNEL32.dll_MulDiv]
movsxd r8, ebx
mov edx, 0x101e
movzx r9d, ax
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageW]
inc ebx
add rdi, 4
cmp ebx, esi
jb 0x14005b825
mov r15b, 1
mov rcx, r14
call fcn.1400b56bc
mov rbx, qword [rsp + 0x70]
movzx eax, r15b
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x14005b890
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov r13, rdx
xor r8d, r8d
mov edx, 0x101f
xor r9d, r9d
mov r15, rcx
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x1200
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbp, rax
mov rcx, 0xffffffffffffffff
lea edx, [rax*2]
mov eax, 4
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.1400b5c60
mov r8d, ebp
mov edx, 0x103b
mov rcx, r15
mov r14, rax
lea r9, [rax + r8*4]
call qword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
test ebp, ebp
je 0x14005b960
mov qword [rsp + 0x60], rsi
mov rsi, r14
mov qword [rsp + 0x68], rdi
mov edi, dword [0x140141f28]
xor r9d, r9d
movsxd r8, ebx
mov edx, 0x101d
mov rcx, r15
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8d, edi
mov edx, 0x60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
inc ebx
mov dword [rsi], eax
lea rsi, [rsi + 4]
cmp ebx, ebp
jb 0x14005b920
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
lea eax, [rbp*8]
mov r9d, 3
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], r14
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, r14
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp fcn.1400b56bc
Function at 0x14005c340
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
test rcx, rcx
je 0x14005c413
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movzx edi, dl
mov rbx, rcx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14005c404
movzx r8d, dil
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14005c420
nop
lea rcx, [rsp + 0x30]
call fcn.1400b0850
lea edx, [rax + 1]
add rdx, rdx
mov ecx, 0x2002
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
lea rcx, [rsp + 0x30]
call fcn.1400b0850
lea ebx, [rax + 1]
add rbx, rbx
lea rcx, [rsp + 0x30]
call fcn.1400b0200
mov rdx, rax
mov r8, rbx
mov rcx, rdi
call fcn.1400b9c80
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rsi
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14005c404
call fcn.1400b0810
nop
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14005c700
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14013d0a8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x35], r9b
mov rbx, rcx
mov r9d, 5
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x36]
mov qword [rsp + 0x20], rcx
mov ecx, 0x400
mov byte [rsp + 0x34], 1
lea edx, [r9 + 0xa]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov r9d, 5
lea r8, [rsp + 0x40]
mov ecx, 0x400
lea edx, [r9 + 9]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea r9, [0x14005b0b0]
mov edx, 0x1051
lea r8, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x14005c7a0
lea r9, [0x14005b0b0]
mov byte [rsp + 0x34], al
lea r8, [rsp + 0x20]
mov edx, 0x1030
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400b5660
add rsp, 0x60
pop rbx
ret
Function at 0x14005eb00
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
je 0x14005ebb6
mov rbx, qword [rcx]
cmp qword [rdi], 0
je 0x14005eb82
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x14005eb9a
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x14005eb9a
mov qword [rsp + 0x28], 0
mov rdx, qword [rdi]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call rax
nop
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je case.default.0x14005eb9a
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x1401427f0], 0
jne 0x14005ec01
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005ebf1
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401427e8], rax
mov byte [0x1401427f0], 1
jmp 0x14005ec08
mov rax, qword [0x1401427e8]
mov byte [0x1401427f0], 1
jmp 0x14005ec08
mov rax, qword [0x1401427e8]
mov rdx, rsi
mov rcx, qword [rbx]
test rax, rax
je 0x14005eb8b
xor r9d, r9d
mov r8d, dword [rbx + 8]
call rax
nop
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140060770
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 8]
xor r9d, r9d
mov edx, VarUI4FromDisp
mov r8d, 0x9c8a
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
xor eax, eax
add rsp, 0x20
pop rbx
ret