joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402530
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00407900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004078e0]
test rbx, rbx
je 0x402584
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x40257b
test r12, r12
je 0x40257b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402560
lea rcx, [0x00407900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x4027b0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x4027c0
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x4027d0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402815
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x40280c
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x402817
add rax, 0x28
cmp rax, r9
jne 0x4027f8
xor eax, eax
ret

Function at 0x4028c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x00404450]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x402939
mov rcx, r10
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402939
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x402936
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x40292d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x402939
add r8, 0x28
cmp r8, r9
jne 0x402918
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x402a20
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x00404450]
xor eax, eax
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x402a8f
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402a8f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
movzx edx, word [r9 + 6]
lea rax, [r9 + rax + 0x18]
test edx, edx
je 0x402a8d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x402a84
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402a98
add rax, 0x28
cmp rax, r9
jne 0x402a70
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x402ab0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x00404450]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x402b28
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402b28
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x402b28
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402b28
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x402b1c
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x402b30
add rdx, 0x28
cmp rdx, r10
jne 0x402b08
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jmp 0x402b40
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x402b4e
mov edx, dword [rax + 0xc]
test edx, edx
je 0x402b25
test r8d, r8d
jg 0x402b38
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x1400ebdb1
Capabilities:
Set registry value

Disassembly:
jmp 0x140160550
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x30]
lea rcx, [0x1403814f6]
call fcn.1400f28c8
mov rax, qword [rbp + 0x170]
cmp qword [rax], 0
jne 0x1401605c6
mov eax, dword [0x1403590c4]
add eax, 5
lea rcx, str.m_hKey___0
mov qword [rsp + 0x28], rcx
lea rcx, [0x1402def88]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1402df980]
mov ecx, 2
call fcn.1400ebdbb
cmp eax, 1
jne 0x1401605c6
int3
xor eax, eax
test eax, eax
jne 0x140160579
cmp qword [rbp + 0x180], 0
je 0x1401605e2
mov dword [rbp + 0x134], 1
jmp 0x1401605ec
mov dword [rbp + 0x134], 0
mov eax, dword [rbp + 0x134]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jne 0x14016063b
mov eax, dword [0x1403590c4]
add eax, 6
lea rcx, str.__atl_condVal
mov qword [rsp + 0x28], rcx
lea rcx, [0x1402def88]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1402df980]
mov ecx, 2
call fcn.1400ebdbb
cmp eax, 1
jne 0x14016063b
int3
cmp dword [rbp + 0x64], 0
jne 0x14016064b
mov eax, recv
jmp 0x1401606fa
xor eax, eax
test eax, eax
jne 0x1401605cc
mov dword [rbp + 0x24], 0
mov rax, qword [rbp + 0x180]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x138], rax
mov qword [rbp + 0x140], 0xffffffffffffffff
inc qword [rbp + 0x140]
mov rax, qword [rbp + 0x138]
mov rcx, qword [rbp + 0x140]
cmp word [rax + rcx*2], 0
jne 0x14016067d
mov rax, qword [rbp + 0x140]
inc eax
mov dword [rbp + 0x44], eax
mov eax, dword [rbp + 0x44]
mov rcx, qword [rbp + 8]
lea rax, [rcx + rax*2]
mov qword [rbp + 8], rax
mov eax, dword [rbp + 0x44]
mov ecx, dword [rbp + 0x24]
lea rax, [rcx + rax*2]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x44], 1
jne 0x140160667
mov eax, dword [rbp + 0x24]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x180]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rbp + 0x178]
mov rax, qword [rbp + 0x170]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret
Function at 0x1400ebeb5
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x14011afb0
mov qword [rsp + 0x18], r8
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x16e8
call fcn.1400ec5ae
sub rsp, rax
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x432
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1708]
mov rax, qword [0x140359238]
xor rax, rbp
mov qword [rbp + 0x16b0], rax
lea rcx, [0x14038109f]
call fcn.1400f28c8
lea r8, [rbp + 0x1024]
mov edx, 0x1000
lea rcx, [rbp + 0x10]
call fcn.1400ee1b5
test eax, eax
jne 0x14011b028
xor al, al
jmp 0x14011b0d9
mov dword [rbp + 0x1044], 0
jmp 0x14011b042
mov eax, dword [rbp + 0x1044]
inc eax
mov dword [rbp + 0x1044], eax
mov eax, dword [rbp + 0x1044]
mov qword [rbp + 0x16a8], rax
mov ecx, dword [rbp + 0x1024]
xor edx, edx
mov eax, ecx
mov ecx, 4
div rcx
mov rcx, qword [rbp + 0x16a8]
cmp rcx, rax
jae 0x14011b0d7
lea rcx, [rbp + 0x1068]
call fcn.1400eea84
nop
mov eax, dword [rbp + 0x1044]
mov eax, dword [rbp + rax*4 + 0x10]
mov dword [rbp + 0x1090], eax
mov r9b, 1
movzx r8d, byte [rbp + 0x16e8]
mov rdx, qword [rbp + 0x16f0]
lea rcx, [rbp + 0x1068]
call fcn.1400ee4ee
movzx eax, al
test eax, eax
je 0x14011b0c6
mov rax, qword [rbp + 0x16e0]
lea rdx, [rbp + 0x1068]
mov rcx, rax
call fcn.1400f2418
nop
lea rcx, [rbp + 0x1068]
call fcn.1400eb087
jmp 0x14011b034
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.1400f1356
mov rax, rdi
mov rcx, qword [rbp + 0x16b0]
xor rcx, rbp
call fcn.1400eea70
lea rsp, [rbp + 0x16c8]
pop rdi
pop rbp
ret
Function at 0x1400ec4af
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14019df40
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x14019df68
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x14019dfb2
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14019df5d
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret

Function at 0x1400ec4c8
Capabilities:
Receive data
Receive data on socket
Reference http user-agent string
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
jmp 0x140169b20
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x438
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x458]
mov rax, qword [0x140359238]
xor rax, rbp
mov qword [rbp + 0x400], rax
lea rcx, [0x1403816ed]
call fcn.1400f28c8
lea rcx, [rbp + 8]
call fcn.1400f2846
nop
lea rdx, str.GET__
lea rcx, [rbp + 8]
call fcn.1400eb497
mov rdx, qword [rbp + 0x440]
lea rcx, [rbp + 8]
call fcn.1400ecac2
lea rdx, str._HTTP_1.1_r_nHost:
lea rcx, [rbp + 8]
call fcn.1400eb979
mov rdx, qword [rbp + 0x438]
lea rcx, [rbp + 8]
call fcn.1400ecac2
lea rdx, str._r_nUser_Agent:_Mozilla_5.0__en_us__AppleWebKit_531.21.10__KHTML__like_Gecko_
lea rcx, [rbp + 8]
call fcn.1400eb979
mov rdx, qword [rbp + 0x448]
lea rcx, [rbp + 8]
call fcn.1400ecac2
lea rdx, str._7B405
lea rcx, [rbp + 8]
call fcn.1400eb979
lea rdx, str._r_nConnection:_close_r_n_r_n
lea rcx, [rbp + 8]
call fcn.1400eb979
lea rcx, [rbp + 8]
call fcn.1400f15ea
mov qword [rbp + 0x3f8], rax
lea rcx, [rbp + 8]
call fcn.1400ebb09
xor r9d, r9d
mov rcx, qword [rbp + 0x3f8]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rbp + 0x430]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0xffffffff
jne 0x140169c62
mov eax, dword [0x1403591e4]
add eax, 0xb
mov r8d, eax
lea rdx, str.C:_assemblageBuilds1788396625873347084hpihhwbmsh_audiorouter_open_audio_router_gui_telemetry.cpp
lea rcx, str.res___SOCKET_ERROR
call fcn.1400eb7d5
xor eax, eax
cmp dword [rbp + 0x44], 0xffffffff
je 0x140169c8a
xor r9d, r9d
mov r8d, 0x200
lea rdx, [rbp + 0x70]
mov rcx, qword [rbp + 0x430]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x140169c88
jmp 0x140169c8a
jmp 0x140169c62
lea rax, [rbp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
lea rcx, [rbp + 8]
call fcn.1400eefd9
nop
lea rcx, [rbp + 8]
call fcn.1400ec61c
lea rcx, [rbp - 0x20]
lea rdx, [0x1402f3210]
call fcn.1400f1356
mov rcx, qword [rbp + 0x400]
xor rcx, rbp
call fcn.1400eea70
lea rsp, [rbp + 0x418]
pop rdi
pop rbp
ret
Function at 0x1400ec4dc
Capabilities:
Create process on windows

Disassembly:
jmp 0x1401556a0
mov qword [rsp + 0x20], r9
mov word [rsp + 0x18], r8w
mov word [rsp + 0x10], dx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x1403814a6]
call fcn.1400f28c8
mov rax, qword [rbp + 0xe0]
mov rax, qword [rax + 0x48]
add rax, 8
mov rcx, rax
call fcn.1400ed9d1
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.https:__www.reddit.com_r_software_comments_3f3em6_is_there_a_alternative_to_chevolume_cyptuz2
lea rdx, str.open
mov rcx, rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x140155739
mov rax, qword [rbp + 0xe0]
add rax, 8
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
lea rdx, str.Could_not_open_the_web_page.
mov rcx, rax
call fcn.1400ee912
xor edx, edx
mov rcx, qword [rbp + 0xe0]
call fcn.1400f2bc5
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1400eca5e
Capabilities:
Delete registry key

Disassembly:
jmp 0x14015a650
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
lea rcx, [0x1403814f6]
call fcn.1400f28c8
mov rax, qword [rbp + 0x100]
cmp qword [rax], 0
jne 0x14015a6c0
mov eax, dword [0x1403590ac]
inc eax
lea rcx, str.m_hKey___0
mov qword [rsp + 0x28], rcx
lea rcx, [0x1402def88]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1402df980]
mov ecx, 2
call fcn.1400ebdbb
cmp eax, 1
jne 0x14015a6c0
int3
xor eax, eax
test eax, eax
jne 0x14015a674
mov rax, qword [rbp + 0x100]
cmp qword [rax + 0x10], 0
je 0x14015a6fa
mov r8, qword [rbp + 0x108]
mov rax, qword [rbp + 0x100]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax + 0x10]
call fcn.1400f18e7
jmp 0x14015a784
movzx eax, byte [0x14035f421]
test eax, eax
jne 0x14015a73c
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x14015a735
lea rdx, str.RegDeleteKeyExW
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14035f418], rax
mov byte [0x14035f421], 1
cmp qword [0x14035f418], 0
je 0x14015a76d
xor r9d, r9d
mov rax, qword [rbp + 0x100]
mov r8d, dword [rax + 8]
mov rdx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax]
call qword [0x14035f418]
jmp 0x14015a784
mov rdx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x1400ed143
Capabilities:
Set registry value

Disassembly:
jmp 0x140160460
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x1403814f6]
call fcn.1400f28c8
mov rax, qword [rbp + 0xe0]
cmp qword [rax], 0
jne 0x1401604d5
mov eax, dword [0x1403590bc]
inc eax
lea rcx, str.m_hKey___0
mov qword [rsp + 0x28], rcx
lea rcx, [0x1402def88]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1402df980]
mov ecx, 2
call fcn.1400ebdbb
cmp eax, 1
jne 0x1401604d5
int3
xor eax, eax
test eax, eax
jne 0x140160489
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1400ed242
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x1401cfaac
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x14035fc98]
test rcx, rcx
jne 0x1401cfad2
call fcn.1401cfc30
test eax, eax
je 0x1401cfb11
mov rcx, qword [0x14035fc98]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rbx, rax
test rax, rax
je 0x1401cfaf3
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x16]
call fcn.1400f098d
jmp 0x1401cfb75
mov edx, 0x1000
mov r9d, 0x40
mov r8d, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1401cfb28
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc0000017
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [rax]
mov rcx, qword [0x14035fc98]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x1401cfb55
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x1401cfb78
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x14035fc98]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x1401cfb5c
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400ed909
Capabilities:
Delete registry value

Disassembly:
jmp 0x14015a7e0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x1403814f6]
call fcn.1400f28c8
mov rax, qword [rbp + 0xe0]
cmp qword [rax], 0
jne 0x14015a850
mov eax, dword [0x1403590b0]
inc eax
lea rcx, str.m_hKey___0
mov qword [rsp + 0x28], rcx
lea rcx, [0x1402def88]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1402df980]
mov ecx, 2
call fcn.1400ebdbb
cmp eax, 1
jne 0x14015a850
int3
xor eax, eax
test eax, eax
jne 0x14015a804
mov rdx, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1400edc79
Capabilities:
Get graphical window text

Disassembly:
jmp 0x14012c380
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x1403811d4]
call fcn.1400f28c8
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14012c3f7
lea rax, str.::IsWindow_m_hWnd_
mov qword [rsp + 0x28], rax
lea rax, [0x1402def88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x3c7
lea rdx, [0x1402e5a20]
mov ecx, 2
call fcn.1400ebdbb
cmp eax, 1
jne 0x14012c3f7
int3
mov r8d, dword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1400ee615
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140269a40
mov rax, rcx
neg rcx
test rax, 7
je 0x140269a5d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140269ab8
test al, 7
jne 0x140269a50
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x140269a71
mov rdx, qword [rax - 8]
test dl, dl
je 0x140269ae2
test dh, dh
je 0x140269adc
shr rdx, 0x10
test dl, dl
je 0x140269ad6
test dh, dh
je 0x140269ad0
shr rdx, 0x10
test dl, dl
je 0x140269aca
test dh, dh
je 0x140269ac4
shr edx, 0x10
test dl, dl
je 0x140269abe
test dh, dh
jne 0x140269a71
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret
Function at 0x1400ee64c
Capabilities:
Query or enumerate registry key

Disassembly:
jmp 0x14015d070
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x508
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xd2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x528]
mov rax, qword [0x140359238]
xor rax, rbp
mov qword [rbp + 0x4b8], rax
lea rcx, [0x1403814f6]
call fcn.1400f28c8
mov edx, 0x18
lea rcx, [rbp + 8]
call fcn.1400f2cfb
xor edx, edx
lea rcx, [rbp + 8]
call fcn.1400ec85b
mov rax, qword [rbp + 0x4e0]
mov eax, dword [rax + 8]
or eax, 0x2001f
mov r9d, eax
mov r8, qword [rbp + 0x4e8]
mov rax, qword [rbp + 0x4e0]
mov rdx, qword [rax]
lea rcx, [rbp + 8]
call fcn.1400ef141
mov dword [rbp + 0x34], eax
cmp dword [rbp + 0x34], 0
je 0x14015d197
cmp dword [rbp + 0x34], 2
je 0x14015d17a
cmp dword [rbp + 0x34], 3
je 0x14015d17a
lea rcx, [0x14035ca98]
call fcn.1400f239b
mov dword [rbp + 0x4b4], eax
mov ecx, dword [0x1403590c8]
add ecx, 7
mov r8d, ecx
lea rdx, str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30133_atlmfcinclude_atlbase.h
lea rcx, [rbp + 0x438]
call fcn.1400edcf6
mov ecx, dword [rbp + 0x34]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbp + 0x4e8]
mov qword [rsp + 0x20], rcx
lea r9, str.CRegKey::RecurseDeleteKey_:_Failed_to_Open_Key__Ts_Error___d__n
xor r8d, r8d
mov ecx, dword [rbp + 0x4b4]
mov edx, ecx
mov rcx, rax
call fcn.1400ec14e
mov eax, dword [rbp + 0x34]
mov dword [rbp + 0x464], eax
lea rcx, [rbp + 8]
call fcn.1400eca77
mov eax, dword [rbp + 0x464]
jmp 0x14015d24a
mov dword [rbp + 0x74], 0x100
lea rax, [rbp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x74]
lea r8, [rbp + 0xa0]
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14015d219
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 8]
call fcn.1400ee64c
mov dword [rbp + 0x34], eax
cmp dword [rbp + 0x34], 0
je 0x14015d210
mov eax, dword [rbp + 0x34]
mov dword [rbp + 0x484], eax
lea rcx, [rbp + 8]
call fcn.1400eca77
mov eax, dword [rbp + 0x484]
jmp 0x14015d24a
mov dword [rbp + 0x74], 0x100
jmp 0x14015d19e
lea rcx, [rbp + 8]
call fcn.1400ee3e0
mov rdx, qword [rbp + 0x4e8]
mov rcx, qword [rbp + 0x4e0]
call fcn.1400eca5e
mov dword [rbp + 0x4a4], eax
lea rcx, [rbp + 8]
call fcn.1400eca77
mov eax, dword [rbp + 0x4a4]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, reloc.WS2_32.dll_connect
call fcn.1400f1356
mov rax, rdi
mov rcx, qword [rbp + 0x4b8]
xor rcx, rbp
call fcn.1400eea70
lea rsp, [rbp + 0x4c8]
pop rdi
pop rbp
ret
Function at 0x1400ee67e
Capabilities:
Query environment variable

Disassembly:
jmp 0x1402a44c0
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1402a4040
lea rcx, [rsp + 0x20]
call fcn.1402a4090
movzx eax, al
test eax, eax
jne 0x1402a4505
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.1402a4070
mov rax, qword [rsp + 0x40]
jmp 0x1402a45ff
lea rcx, [rsp + 0x20]
call fcn.1402a4190
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1402a4130
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400eeba1
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400edcb5
lea rcx, [rsp + 0x28]
call fcn.1400ef272
movzx eax, al
test eax, eax
jne 0x1402a459f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1400f1013
lea rcx, [rsp + 0x20]
call fcn.1402a4070
mov rax, qword [rsp + 0x50]
jmp 0x1402a45ff
lea rcx, [rsp + 0x20]
call fcn.1402a4190
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.1400f2747
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400eeaac
lea rcx, [rsp + 0x28]
call fcn.1400f34a3
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1400f1013
lea rcx, [rsp + 0x20]
call fcn.1402a4070
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret

Function at 0x1400ee8b8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x140112970
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rcx, [0x140381031]
call fcn.1400f28c8
mov rdx, qword [rbp + 0x188]
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x1401129bf
xor eax, eax
jmp 0x140112a6a
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1401129db
xor eax, eax
jmp 0x140112a6a
mov rdx, qword [rbp + 0x188]
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rbp + 0x44], eax
mov eax, dword [rbp + 0x44]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x190]
and eax, 0xf
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jbe 0x140112a49
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 8], rax
jae 0x140112a49
mov rax, qword [rbp + 8]
movzx eax, word [rax]
mov rcx, qword [rbp + 8]
lea rax, [rcx + rax*2 + 2]
mov qword [rbp + 8], rax
mov eax, dword [rbp + 0x84]
dec eax
mov dword [rbp + 0x84], eax
jmp 0x140112a12
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 8], rax
jb 0x140112a57
xor eax, eax
jmp 0x140112a6a
mov rax, qword [rbp + 8]
movzx eax, word [rax]
test eax, eax
jne 0x140112a66
xor eax, eax
jmp 0x140112a6a
mov rax, qword [rbp + 8]
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret