joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400095c0
Capabilities:
Print debug messages
Resume thread

Disassembly:
push rbp
push r12
sub rsp, 0x838
mov rax, qword [0x140049040]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov eax, dword [rcx + 0x50]
mov rbp, rcx
test eax, eax
jne 0x1400095f0
mov dword [rcx + 0x50], 1
jmp 0x1400095fc
cmp eax, 0x10
jbe 0x1400095fc
mov dword [rcx + 0x50], 0x10
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 8], rax
test rax, rax
jne 0x140009622
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x14000962d
mov rcx, rbp
call fcn.140009750
mov r12d, eax
test r12d, r12d
jne 0x14000972e
mov qword [rsp + 0x858], rbx
mov rbx, qword [rbp + 0x38]
mov qword [rsp + 0x860], rsi
mov qword [rsp + 0x830], rdi
cmp rbx, qword [rbp + 0x40]
jbe 0x14000965d
call fcn.1400214e4
mov rdi, qword [rbp + 0x20]
mov rsi, qword [rbp + 0x40]
cmp qword [rbp + 0x38], rsi
jbe 0x140009670
call fcn.1400214e4
test rdi, rdi
je 0x14000967b
cmp rdi, qword [rbp + 0x20]
je 0x140009680
call fcn.1400214e4
cmp rbx, rsi
je 0x140009716
test rdi, rdi
jne 0x140009698
call fcn.1400214e4
xor r11d, r11d
jmp 0x14000969b
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x20]
jb 0x1400096a6
call fcn.1400214e4
mov r9, qword [rbx]
lea r8, str.start:__p_n
lea rcx, [rsp + 0x20]
mov edx, 0x400
call fcn.140021170
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rdi, rdi
jne 0x1400096d9
call fcn.1400214e4
xor r11d, r11d
jmp 0x1400096dc
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x20]
jb 0x1400096e7
call fcn.1400214e4
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test rdi, rdi
jne 0x1400096ff
call fcn.1400214e4
xor r11d, r11d
jmp 0x140009702
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x20]
jb 0x14000970d
call fcn.1400214e4
add rbx, 8
jmp 0x140009661
mov rdi, qword [rsp + 0x830]
mov rsi, qword [rsp + 0x860]
mov rbx, qword [rsp + 0x858]
mov eax, r12d
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.140020720
add rsp, 0x838
pop r12
pop rbp
ret
Function at 0x140009750
Capabilities:
Create thread
Print debug messages

Disassembly:
mov r11, rsp
push r12
push r13
sub rsp, 0x878
mov rax, qword [0x140049040]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov eax, dword [rcx + 0x50]
xor r12d, r12d
mov r13, rcx
add eax, 1
je 0x1400099e3
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 - 0x18], rdi
nop word [rax + rax]
lea rax, [rsp + 0x30]
lea r8, [0x1400099f0]
mov r9, r13
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r11, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14000991f
mov rdx, qword [r13 + 0x38]
test rdx, rdx
jne 0x1400097e4
xor ecx, ecx
jmp 0x1400097ef
mov rcx, qword [r13 + 0x48]
sub rcx, rdx
sar rcx, 3
mov rdi, qword [r13 + 0x40]
mov rax, rdi
sub rax, rdx
sar rax, 3
cmp rax, rcx
jae 0x140009812
lea rax, [rdi + 8]
mov qword [rdi], r11
mov qword [r13 + 0x40], rax
jmp 0x1400098cf
cmp rdx, rdi
jbe 0x14000981c
call fcn.1400214e4
mov rcx, qword [r13 + 0x40]
mov rbp, qword [r13 + 0x38]
mov rsi, qword [r13 + 0x20]
mov rax, rcx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
sub rax, rbp
test rax, 0xfffffffffffffff8
jne 0x140009844
xor edi, edi
jmp 0x140009865
cmp rbp, rcx
jbe 0x14000984e
call fcn.1400214e4
test rsi, rsi
je 0x140009859
cmp rsi, qword [r13 + 0x20]
je 0x14000985e
call fcn.1400214e4
sub rdi, rbp
sar rdi, 3
movaps xmm0, xmmword [rsp + 0x40]
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x50]
lea rcx, [r13 + 0x20]
mov r8d, 1
movdqa xmmword [rsp + 0x50], xmm0
call fcn.140009f80
mov rsi, qword [r13 + 0x38]
cmp rsi, qword [r13 + 0x40]
jbe 0x140009898
call fcn.1400214e4
mov rbx, qword [r13 + 0x20]
test rbx, rbx
jne 0x1400098ab
call fcn.1400214e4
xor r11d, r11d
jmp 0x1400098ae
mov r11, qword [rbx]
lea rcx, [rsi + rdi*8]
cmp rcx, qword [r11 + 0x20]
ja 0x1400098ca
test rbx, rbx
je 0x1400098c2
mov rax, qword [rbx]
jmp 0x1400098c4
xor eax, eax
cmp rcx, qword [rax + 0x18]
jae 0x1400098cf
call fcn.1400214e4
mov ecx, dword [r13 + 0x50]
inc r12d
inc ecx
cmp r12d, ecx
jb 0x1400097a0
xor eax, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.__CreateThread_failed._n
lea rcx, [rsp + 0x60]
mov edx, 0x400
mov r12d, eax
call fcn.140021170
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test r12d, r12d
je 0x1400099db
mov rbx, qword [r13 + 0x38]
cmp rbx, qword [r13 + 0x40]
jbe 0x140009961
call fcn.1400214e4
mov rdi, qword [r13 + 0x20]
xor eax, eax
jmp 0x140009903
Function at 0x140009a70
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x860
mov rax, qword [0x140049040]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rdi, rcx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
test rax, rax
jne 0x140009ab5
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140009bf8
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov r9d, 0x10
xor r8d, r8d
mov qword [rsp + 0x878], rbx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x140009b00
lea r8, str.Error_in_RegOpenKeyEx___d_._n
jmp 0x140009ba7
mov rcx, qword [rsp + 0x30]
mov edx, 1
mov r9, rsi
lea r8d, [rdx + 0xe]
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov ebx, eax
test eax, eax
jne 0x140009ba0
lea rdx, [rsp + 0x38]
lea ecx, [rax + 2]
or r9d, 0xffffffff
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0xffffffff
jne 0x140009b71
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Error_in_WaitForSingleObject___d_._n
lea rcx, [rsp + 0x50]
mov r9d, eax
mov edx, 0x400
mov ebx, eax
call fcn.140021170
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test ebx, ebx
je 0x140009b00
jmp 0x140009bc4
test eax, eax
je 0x140009b87
cmp eax, 1
jne 0x140009b00
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
jmp 0x140009b00
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
or edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x140009bc4
lea r8, str.Error_in_RegNotifyChangeKeyValue___d_._n
Function at 0x14000c710
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
xor ebx, ebx
mov esi, r9d
mov r12, r8
mov edi, edx
mov rbp, rcx
mov qword [rsp + 0x30], rbx
test r8, r8
je 0x14000c930
test r9d, r9d
je 0x14000c930
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWARESFORZATOSFORZATO_USB_Audio
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r9d, eax
test eax, eax
je 0x14000c806
cmp eax, 2
jne 0x14000c7c8
mov rcx, rbp
call fcn.14000ca80
test eax, eax
jne 0x14000c793
mov ebx, 0xfffffffd
jmp 0x14000c91c
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWARESFORZATOSFORZATO_USB_Audio
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000c806
mov ebx, 0xfffffffe
jmp 0x14000c91c
mov rcx, qword [0x14004c1e0]
lea rax, [0x14004c1e0]
cmp rcx, rax
je 0x14000c7fc
test byte [rcx + 0x1c], 1
je 0x14000c7fc
cmp byte [rcx + 0x19], 2
jb 0x14000c7fc
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003c5a8]
mov edx, 0xb
call fcn.14000c620
mov ebx, 0xfffffffe
jmp 0x14000c91c
lea rbp, [0x14004a9b0]
mov ecx, ebx
lea rdx, [0x14004adf0]
mov rax, rbp
nop dword [rax]
cmp edi, dword [rax]
je 0x14000c836
add rax, 0x110
inc ecx
cmp rax, rdx
jl 0x14000c820
jmp 0x14000c91c
movsxd rdi, ecx
imul rdi, rdi, 0x110
mov r8d, dword [rdi + rbp + 0x108]
cmp esi, r8d
jae 0x14000c891
mov rcx, qword [0x14004c1e0]
lea rax, [0x14004c1e0]
cmp rcx, rax
je 0x14000c889
test byte [rcx + 0x1c], 1
je 0x14000c889
cmp byte [rcx + 0x19], 2
jb 0x14000c889
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r8, [0x14003c5a8]
mov edx, 0xc
mov r9d, esi
call fcn.1400058b0
or ebx, 0xffffffff
jmp 0x14000c91c
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x68], r8d
mov qword [rsp + 0x28], rax
lea rdx, [rdi + rbp + 4]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r8d, dword [rsp + 0x78]
mov r9d, eax
test eax, eax
jne 0x14000c8d3
cmp r8d, dword [rdi + rbp + 0x104]
je 0x14000c91c
mov rcx, qword [0x14004c1e0]
lea rax, [0x14004c1e0]
cmp rcx, rax
je 0x14000c917
test byte [rcx + 0x1c], 1
je 0x14000c917
cmp byte [rcx + 0x19], 2
jb 0x14000c917
mov eax, dword [rdi + rbp + 0x104]
mov rcx, qword [rcx + 0x10]
mov edx, 0xd
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r8d
lea r8, [0x14003c5a8]
call fcn.14000c670
mov ebx, 0xfffffffc
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000c92c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x14000c967
mov rcx, qword [0x14004c1e0]
lea rax, [0x14004c1e0]
cmp rcx, rax
je 0x14000c964
test byte [rcx + 0x1c], 1
je 0x14000c964
cmp byte [rcx + 0x19], 2
jb 0x14000c964
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003c5a8]
mov edx, 0xa
call fcn.140004210
or eax, 0xffffffff
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x14000c980
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
xor edi, edi
mov esi, r9d
mov rbp, r8
mov ebx, edx
mov qword [rsp + 0x30], rdi
test edx, edx
js 0x14000ca61
test r8, r8
je 0x14000ca61
test r9d, r9d
je 0x14000ca61
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWARESFORZATOSFORZATO_USB_Audio
mov r9d, 0x20106
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000c9ef
mov eax, 0xfffffffe
jmp 0x14000ca64
lea r8, [0x14004a9b0]
mov ecx, edi
lea rdx, [0x14004adf0]
mov rax, r8
cmp ebx, dword [rax]
je 0x14000ca15
add rax, 0x110
inc ecx
cmp rax, rdx
jl 0x14000ca02
jmp 0x14000ca4d
movsxd rax, ecx
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x28], esi
imul rax, rax, 0x110
mov r9d, dword [rax + r8 + 0x104]
lea rdx, [rax + r8 + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 0xfffffffb
test eax, eax
cmovne edi, ecx
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000ca5d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x14000ca64
or eax, 0xffffffff
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000ca80
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
xor edi, edi
lea rax, [r11 + 0x10]
lea rdx, str.SOFTWARESFORZATOSFORZATO_USB_Audio
mov qword [r11 - 0x48], rax
lea rax, [r11 + 0x18]
xor r9d, r9d
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x58], rdi
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20106
mov qword [r11 + 0x18], rdi
mov dword [rsp + 0x20], edi
mov dword [r11 + 0x10], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000ccfd
cmp dword [rsp + 0x98], 2
je 0x14000ccfd
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r15
lea r15, [0x14004adf4]
mov qword [rsp + 0x68], r12
mov esi, edi
lea rbp, [0x14004adf0]
lea r14, [0x14004a9b0]
lea r13, [0x14004adf0]
nop dword [rax]
mov edx, dword [rbp]
mov ecx, edi
mov rbx, rdi
mov rax, r14
nop dword [rax + rax]
cmp edx, dword [rax]
je 0x14000cb59
add rax, 0x110
inc ecx
inc rbx
cmp rax, r13
jl 0x14000cb40
jmp 0x14000cbe8
movsxd rax, ecx
mov rcx, qword [rsp + 0xa0]
mov r9d, 0x20119
xor r8d, r8d
imul rax, rax, 0x110
lea r12, [rax + r14 + 4]
lea rax, [rsp + 0xa8]
mov rdx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000cba3
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000cbe8
mov rcx, qword [rsp + 0xa0]
movsxd rax, esi
imul rbx, rbx, 0x110
mov r9d, dword [rbx + r14 + 0x104]
xor r8d, r8d
mov rdx, r12
imul rax, rax, 0x104
add rax, r15
mov dword [rsp + 0x28], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000ccd7
inc esi
add rbp, 0x104
cmp esi, 1
jb 0x14000cb30
lea r15, [0x14004aef8]
mov esi, edi
mov rbp, r15
nop word [rax + rax]
mov edx, dword [rbp]
mov ecx, edi
mov rbx, rdi
mov rax, r14
nop dword [rax + rax]
cmp edx, dword [rax]
je 0x14000cc39
add rax, 0x110
inc ecx
inc rbx
cmp rax, r13
jl 0x14000cc20
jmp 0x14000ccc3
movsxd rax, ecx
mov rcx, qword [rsp + 0xa0]
mov r9d, 0x20119
xor r8d, r8d
imul rax, rax, 0x110
lea r12, [rax + r14 + 4]
lea rax, [rsp + 0xa8]
mov rdx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000cc83
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000ccc3
movsxd rax, esi
imul rbx, rbx, 0x110
xor r8d, r8d
lea rcx, [r15 + rax*8 + 4]
mov rdx, r12
mov eax, dword [rbx + r14 + 0x108]
mov r9d, dword [rbx + r14 + 0x104]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000ccd7
inc esi
add rbp, 8
cmp esi, 2
jb 0x14000cc10
mov edi, 1
mov r12, qword [rsp + 0x68]
mov r13, qword [rsp + 0x60]
mov r14, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x14000cd10
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
add rsp, 0x80
pop rdi
ret
Function at 0x14000de78
Capabilities:
Get geographical location

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x2f0
mov rax, qword [0x140049040]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov eax, r8d
mov rsi, rdx
mov rbx, rcx
cmp r8d, 0x800
jne 0x14000deea
lea r8, [0x140036220]
lea rcx, [rsp + 0xa0]
mov edx, 4
call fcn.1400210ec
test eax, eax
je 0x14000df0c
cmp eax, 0xc
je 0x14000dee4
cmp eax, 0x16
je 0x14000dede
cmp eax, 0x22
je 0x14000dede
cmp eax, 0x50
je 0x14000df0c
call fcn.14000f8c8
int3
call fcn.14000f8c8
int3
call fcn.14000f880
int3
mov r9d, 4
lea r8, [rsp + 0xa0]
mov ecx, eax
lea edx, [r9 - 1]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14000e02f
call fcn.140022974
mov edi, dword [rax]
call fcn.140022974
lea rcx, [rsp + 0xb0]
and dword [rax], 0
lea rax, [rsp + 0xa0]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov esi, 0x112
lea r8d, [rsi - 1]
mov rdx, rsi
call fcn.140021194
mov ebx, eax
call fcn.140022974
cmp dword [rax], 0
je 0x14000df94
call fcn.140022974
cmp dword [rax], 0
je 0x14000df9b
cmp dword [rax], 0xc
je 0x14000df89
cmp dword [rax], 0x16
je 0x14000df7e
cmp dword [rax], 0x22
je 0x14000df7e
cmp dword [rax], 0x50
je 0x14000df9b
mov ecx, 0x80004005
call fcn.140004000
int3
mov ecx, 0x80070057
call fcn.140004000
int3
mov ecx, 0x8007000e
call fcn.140004000
int3
call fcn.140022974
mov dword [rax], edi
cmp ebx, 0xffffffff
je 0x14000e02f
cmp ebx, esi
jae 0x14000e02f
lea rcx, [rsp + 0xb0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
xor edx, edx
lea rcx, [rsp + 0x34]
lea r8d, [rdx + 0x6c]
mov rbx, rax
mov dword [rsp + 0x30], 0x70
call fcn.140021c50
lea rcx, str.KERNEL32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000e01a
lea rdx, str.FindActCtxSectionStringW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000e01a
lea rcx, [rsp + 0x30]
xor edx, edx
mov r9, rbx
mov qword [rsp + 0x20], rcx
lea r8d, [rdx + 2]
xor ecx, ecx
call rax
mov rcx, rbx
test eax, eax
jne 0x14000e022
lea rcx, [rsp + 0xb0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x14000e031
xor eax, eax
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.140020720
add rsp, 0x2f0
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400114a8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_640
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xb0], rdx
test rdx, 0xffffffffffff0000
jne 0x1400114e7
cmp dword [rcx + 0xa8], 0
jne 0x1400114e7
movzx eax, dx
mov dword [rcx + 0xa8], eax
call fcn.140013364
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.14001144c
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400143d8
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.14001b428
mov rsi, rax
test rax, rax
je 0x140014454
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x14001444f
cmp dword [rbx], 0x40
jb 0x14001444f
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x14001444f
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x140014458
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14001aa74
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x14001aadc
call fcn.140013364
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14001aadc
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x14001aafe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.14001a484
mov esi, eax
test rdi, rdi
je 0x14001aafc
test rbx, rbx
je 0x14001aafc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x140022870
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.1400288d8
nop
cmp dword [0x140050000], 1
je 0x14002281c
mov dword [0x14004fffc], 1
mov byte [0x14004fff8], r12b
test ebx, ebx
jne 0x140022808
mov rcx, qword [0x1400524d0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400227f5
mov rcx, qword [0x1400524c8]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140022794
call fcn.140024038
cmp qword [rdi], rax
jne 0x140022794
jmp 0x14002277a
cmp rdi, rsi
jb 0x1400227f5
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140024038
mov qword [rdi], rax
call rbx
mov rcx, qword [0x1400524d0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x1400524c8]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x1400227d3
cmp r13, rax
je 0x1400227f3
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14002277a
lea rdx, [0x140035bd0]
lea rcx, [0x140035bb8]
call fcn.1400225c4
lea rdx, [0x140035be0]
lea rcx, [0x140035bd8]
call fcn.1400225c4
nop
test r12d, r12d
je 0x14002282b
mov ecx, 8
call fcn.1400287d8
test r12d, r12d
jne 0x140022856
mov dword [0x140050000], 1
lea ecx, [r12 + 8]
call fcn.1400287d8
mov ecx, r15d
call fcn.140022558
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400226e4

Function at 0x14002287c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400226e4
Function at 0x140024533
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140049040]
jne 0x14002073a
rol rcx, 0x10
test cx, 0xffff
jne 0x140020736
repz ret
ror rcx, 0x10
jmp 0x14002448c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400505f0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1400506e8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140024511
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400505f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140024533
mov rax, qword [rsp + 0x88]
mov qword [0x1400506e8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140050688], rax
mov rax, qword [0x1400506e8]
mov qword [0x140050560], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140050670], rax
mov dword [0x140050550], 0xc0000409
mov dword [0x140050554], 1
mov rax, qword [0x140049040]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140049048]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400505e8], eax
mov ecx, 1
call fcn.1400263a8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14003ad40]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400505e8], 0
jne 0x1400245ba
mov ecx, 1
call fcn.1400263a8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret