joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006b470
Capabilities:
Set registry value

Disassembly:
push rbx
push rdi
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1400e44d0]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rbx, [rcx + 0xb0]
mov r15, r8
cmp qword [rbx + 0x18], 0x10
mov r14, rdx
mov rdi, rcx
jb 0x14006b4a9
mov rdx, qword [rbx]
jmp 0x14006b4ac
mov rdx, rbx
mov rcx, qword [rcx + 0x88]
call fcn.14006af50
test al, al
je 0x14006b64e
mov qword [rsp + 0x70], r12
lea r8, [rsp + 0x30]
mov rdx, r14
mov rcx, rdi
xor r12b, r12b
call fcn.140069ab0
cmp dword [rsp + 0x30], 0
jle 0x14006b645
cmp qword [rbx + 0x18], 0x10
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x38], 0
jb 0x14006b4fb
mov rbx, qword [rbx]
mov rcx, qword [rdi + 0x88]
lea rax, [rsp + 0x38]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rsi, qword [rsp + 0x38]
test eax, eax
je 0x14006b540
test rsi, rsi
je 0x14006b640
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov qword [rsp + 0x38], rsi
test rsi, rsi
je 0x14006b640
or rbx, 0xffffffffffffffff
mov qword [rsp + 0x80], rbp
mov rdi, rbx
nop dword [rax + rax]
inc rdi
cmp byte [r14 + rdi], 0
jne 0x14006b560
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [r15 + rax], 0
jne 0x14006b570
add rdi, rax
lea rdi, [rdi*2 + 0xe]
mov rcx, rdi
call fcn.140036520
mov r8, rdi
xor edx, edx
mov rcx, rax
mov rbp, rax
call fcn.140037fb0
mov r9, r15
lea rdx, str._s__s
mov r8, r14
mov rcx, rbp
call fcn.140024f70
mov r8d, dword [rsp + 0x30]
lea rdx, [0x140096ad8]
xor eax, eax
mov byte [rsp + 0x40], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x41], rax
mov qword [rsp + 0x49], rax
mov qword [rsp + 0x51], rax
mov dword [rsp + 0x59], eax
mov word [rsp + 0x5d], ax
mov byte [rsp + 0x5f], al
call fcn.140024f70
nop dword [rax + rax]
inc rbx
cmp byte [rbx + rbp], 0
jne 0x14006b5f0
inc ebx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov ebx, 1
mov qword [rsp + 0x20], rbp
mov r9d, ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
movzx r12d, r12b
mov rcx, rbp
test eax, eax
cmove r12d, ebx
call fcn.140035b94
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
movzx eax, r12b
mov r12, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140035b70
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rbx
ret
Function at 0x14006d390
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor al, al
mov rbx, rcx
cmp dword [rcx + 0x7c], 0xffffffff
je 0x14006d5f7
nop dword [rax]
mov ecx, dword [rbx + 0x7c]
cmp ecx, 0x7c
je 0x14006d5f7
cmp ecx, 0x29
jne 0x14006d3db
cmp dword [rbx + 0x1c], 0
jne 0x14006d5f7
test dword [rbx + 0x80], 0x10000000
je 0x14006d602
cmp ecx, 0x2e
jne 0x14006d43c
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.140070b60
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x10]
cmp rcx, rax
je 0x14006d42f
cmp byte [rcx], 0x5c
jne 0x14006d42c
inc rcx
cmp rcx, rax
je 0x14006d42c
mov edx, dword [rbx + 0x80]
test dl, 8
jne 0x14006d41b
movzx eax, byte [rcx]
sub al, 0x28
cmp al, 1
jbe 0x14006d429
test dl, 0x10
jne 0x14006d42c
movzx eax, byte [rcx]
sub al, 0x7b
test al, 0xfd
jne 0x14006d42c
mov qword [rbx], rcx
inc qword [rbx]
mov rcx, rbx
call fcn.140071860
jmp 0x14006d5e3
cmp ecx, 0x5c
jne 0x14006d4fa
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x10]
cmp rcx, rax
je 0x14006d486
cmp byte [rcx], 0x5c
jne 0x14006d483
inc rcx
cmp rcx, rax
je 0x14006d483
mov edx, dword [rbx + 0x80]
test dl, 8
jne 0x14006d472
movzx eax, byte [rcx]
sub al, 0x28
cmp al, 1
jbe 0x14006d480
test dl, 0x10
jne 0x14006d483
movzx eax, byte [rcx]
sub al, 0x7b
test al, 0xfd
jne 0x14006d483
mov qword [rbx], rcx
inc qword [rbx]
mov rcx, rbx
call fcn.140071860
mov eax, dword [rbx + 0x80]
and eax, 0x80
je 0x14006d4bc
cmp byte [rbx + 0x78], 0x62
jne 0x14006d4bc
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.140070b60
mov rcx, rbx
call fcn.140070bf0
jmp 0x14006d5eb
test eax, eax
je 0x14006d4ed
cmp byte [rbx + 0x78], 0x42
jne 0x14006d4ed
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.140070b60
mov rax, qword [rbx + 0x48]
mov rcx, rbx
xor dword [rax + 0xc], 1
add rax, 0xc
call fcn.140070bf0
jmp 0x14006d5eb
mov rcx, rbx
call fcn.14006d630
jmp 0x14006d5e3
cmp ecx, 0x5b
jne 0x14006d525
mov rcx, rbx
call fcn.140070bf0
mov rcx, rbx
call fcn.14006dd70
mov edx, 0x5d
mov rcx, rbx
lea r8d, [rdx - 0x59]
call fcn.14006fdf0
jmp 0x14006d5e3
cmp ecx, 0x28
jne 0x14006d55c
mov rcx, rbx
call fcn.140070bf0
mov rcx, rbx
call fcn.140071b70
mov edx, 0x29
mov rcx, rbx
movzx edi, al
lea r8d, [rdx - 0x24]
call fcn.14006fdf0
test dil, dil
je 0x14006d5eb
jmp 0x14006d5e3
cmp ecx, 0x5e
jne 0x14006d579
lea rcx, [rbx + 0x40]
mov edx, 2
call fcn.140070b60
mov rcx, rbx
call fcn.140070bf0
jmp 0x14006d5eb
cmp ecx, 0x24
jne 0x14006d596
lea rcx, [rbx + 0x40]
mov edx, 3
call fcn.140070b60
mov rcx, rbx
call fcn.140070bf0
jmp 0x14006d5eb
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x14006d623
cmp ecx, 0x3f
je 0x14006d623
cmp ecx, 0x7b
je 0x14006d623
cmp ecx, 0x7d
jne 0x14006d5bd
test dword [rbx + 0x80], 0x10000000
je 0x14006d60d
cmp ecx, 0x5d
jne 0x14006d5ce
test dword [rbx + 0x80], 0x10000000
je 0x14006d618
movzx edx, byte [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.14006c800
mov rcx, rbx
call fcn.140070bf0
mov rcx, rbx
call fcn.140070ce0
cmp dword [rbx + 0x7c], 0xffffffff
mov al, 1
jne 0x14006d3b0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, 5
call fcn.1400305e4
int3
mov ecx, 6
call fcn.1400305e4
int3
mov ecx, 4
call fcn.1400305e4
int3
mov ecx, 0xa
call fcn.1400305e4
int3
Function at 0x140076488
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140036640
sub rsp, rax
mov rax, qword [0x1400e44d0]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r14, rdx
mov rbx, rcx
call fcn.140050564
xor esi, esi
movsxd r12, eax
cmp dword [rbx + 0x10], esi
jne 0x1400764dc
mov rax, r14
jmp 0x1400765f6
mov rax, qword [rbx]
mov rdi, r12
sub rax, qword [rbx + 8]
xor r8d, r8d
cqo
sar rdi, 6
sub rax, rdx
mov rbx, r12
sar rax, 1
and ebx, 0x3f
mov r15, rax
shl rbx, 6
lea rax, [0x140000000]
mov ecx, r12d
mov rdx, qword [rax + rdi*8 + 0xe7770]
mov rbp, r12
mov rdx, qword [rbx + rdx + 0x30]
call fcn.14005c19c
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rdi*8 + 0xe7770]
cmp r13, qword [rbx + rcx + 0x30]
je 0x140076543
or rax, 0xffffffffffffffff
jmp 0x1400765f6
mov rcx, rbp
mov qword [rsp + 0x20], rsi
sar rcx, 6
lea r9, [rsp + 0x30]
and ebp, 0x3f
lea rdx, [rsp + 0x40]
shl rbp, 6
mov r8d, 0x1000
mov rcx, qword [rax + rcx*8 + 0xe7770]
mov rcx, qword [rcx + rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14007653a
xor r8d, r8d
mov rdx, r14
mov ecx, r12d
call fcn.14005c19c
test rax, rax
js 0x14007653a
mov eax, dword [rsp + 0x30]
cmp r15, rax
jg 0x14007653a
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test r15, r15
je 0x1400765ea
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x1400765ea
cmp byte [rcx], 0xd
jne 0x1400765d0
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1400765df
cmp byte [rcx + 1], 0xa
jne 0x1400765df
inc rcx
jmp 0x1400765df
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0xe4e90]
add rcx, rax
inc rsi
inc rcx
cmp rsi, r15
jne 0x1400765b2
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140035b70
lea r11, [rsp + 0x1050]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140001510
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x30]
mov rbx, rdx
mov rdi, rcx
mov r9d, 1
lea rdx, str.SOFTWARENVIDIA_CorporationNVControlPanel2Client
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
test r8d, r8d
jne 0x14000154a
mov rcx, 0xffffffff80000001
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400015a5
mov rcx, qword [rsp + 0x30]
mov eax, 4
lea r9, [rsp + 0x68]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x14000159f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1400015a7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400015b4
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x40], 0
and dword [rsp + 0x38], 0
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x38]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x14000162b
mov ecx, dword [rsp + 0x38]
test ecx, ecx
je 0x14000162b
cmp ecx, 0xffffffff
je 0x14000162b
lea rdx, [rsp + 0x40]
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
je 0x14000162b
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [rbx], ax
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140001624
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x14000162d
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140001b24
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
lea rdx, [rsp + 0x38]
lea rcx, str.UserDefinedLocale
xor r8d, r8d
mov word [rsp + 0x30], bx
mov dword [rsp + 0x38], ebx
call fcn.140001510
test eax, eax
jne 0x140001b6d
lea rcx, [rsp + 0x30]
call fcn.1400015b4
test eax, eax
jne 0x140001b63
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x140001b68
movzx eax, word [rsp + 0x30]
movzx ecx, ax
jmp 0x140001b71
mov ecx, dword [rsp + 0x38]
call fcn.140001958
mov ecx, 0x3ff
and ax, cx
mov ecx, 1
cmp ax, cx
je 0x140001b92
cmp ax, 0xd
je 0x140001b92
xor eax, eax
jmp 0x140001b94
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x140001b9c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx]
lea rdx, str.NvCplApiGetSetting
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.NvCplApiSetSetting
mov qword [rdi + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.NvCplApiInit
mov qword [rdi + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.NvCplApiGetInfo
mov qword [rdi + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.NvCplApiEnumSettingValues
mov qword [rdi + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.NvCplApiExecute
mov qword [rdi + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
mov qword [rdi + 0x30], rax
cmp qword [rdi], rbx
je 0x140001c3f
cmp qword [rdi + 8], rbx
je 0x140001c3f
call fcn.140056888
test eax, eax
sete bl
xor edx, edx
mov ecx, ebx
call qword [rdi + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140001e54
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.1400693b4
xor edi, edi
lea rdx, [rsp + 0x40]
lea rcx, str.UserDefinedLocale
xor r8d, r8d
mov ebx, 0xa807
mov word [rsp + 0x38], di
mov dword [rsp + 0x40], edi
call fcn.140001510
test eax, eax
jne 0x140001eab
lea rcx, [rsp + 0x38]
call fcn.1400015b4
test eax, eax
jne 0x140001ea1
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x140001ea6
movzx eax, word [rsp + 0x38]
movzx ecx, ax
jmp 0x140001eaf
mov ecx, dword [rsp + 0x40]
call fcn.140001958
movzx ecx, ax
movzx edx, ax
and ecx, 0x3ff
shr dx, 0xa
cmp ecx, 0x12
jg 0x140001fdb
je 0x140001fd1
cmp ecx, 0xa
jg 0x140001f77
je 0x140001f5c
dec ecx
je 0x140001f52
sub ecx, 3
je 0x140001f31
dec ecx
je 0x140001f27
dec ecx
je 0x140001f1d
dec ecx
je 0x140001f13
dec ecx
je 0x140001f09
dec ecx
jne 0x140002084
mov ebx, 0xa80d
jmp 0x140002084
mov ebx, 0xa80c
jmp 0x140002084
mov ebx, 0xa80b
jmp 0x140002084
mov ebx, 0xa80a
jmp 0x140002084
mov ebx, 0xa809
jmp 0x140002084
movzx eax, dx
cmp eax, 2
je 0x140001f48
cmp eax, 4
je 0x140001f48
mov ebx, 0xa823
jmp 0x140002084
mov ebx, 0xa822
jmp 0x140002084
mov ebx, 0xa808
jmp 0x140002084
movzx ecx, dx
dec ecx
je 0x140001f6d
mov ebx, 0xa80f
jmp 0x140002084
mov ebx, 0xa80e
jmp 0x140002084
sub ecx, 0xb
je 0x140001fc7
dec ecx
je 0x140001fbd
dec ecx
je 0x140001fb3
dec ecx
je 0x140001fa9
sub ecx, 2
je 0x140001f9f
dec ecx
jne 0x140002084
mov ebx, 0xa815
jmp 0x140002084
mov ebx, 0xa814
jmp 0x140002084
mov ebx, 0xa813
jmp 0x140002084
mov ebx, 0xa812
jmp 0x140002084
mov ebx, 0xa811
jmp 0x140002084
mov ebx, 0xa810
jmp 0x140002084
mov ebx, 0xa816
jmp 0x140002084
cmp ecx, 0x40
jg 0x140002077
cmp ecx, 0x3f
jge 0x14000207f
cmp ecx, 0x1b
jg 0x14000203d
je 0x140002036
sub ecx, 0x13
je 0x14000202f
dec ecx
je 0x140002028
dec ecx
je 0x140002021
dec ecx
je 0x14000200c
cmp ecx, 3
je 0x14000207f
jmp 0x140002084
movzx ecx, dx
dec ecx
je 0x14000201a
mov ebx, 0xa81a
jmp 0x140002084
mov ebx, 0xa81b
jmp 0x140002084
mov ebx, 0xa819
jmp 0x140002084
mov ebx, 0xa818
jmp 0x140002084
mov ebx, 0xa817
jmp 0x140002084
mov ebx, 0xa81d
jmp 0x140002084
cmp ecx, 0x1d
je 0x140002070
cmp ecx, 0x1e
je 0x140002069
cmp ecx, 0x1f
je 0x140002062
cmp ecx, 0x21
jle 0x140002084
cmp ecx, 0x23
jle 0x14000207f
cmp ecx, 0x24
jne 0x140002084
mov ebx, 0xa81e
jmp 0x140002084
mov ebx, 0xa821
jmp 0x140002084
mov ebx, 0xa820
jmp 0x140002084
mov ebx, 0xa81f
jmp 0x140002084
lea eax, [rcx - 0x43]
cmp eax, 1
ja 0x140002084
mov ebx, 0xa81c
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400089ac
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140008a0f
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140008a23
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008a23
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x140008a28
cmp dword [rcx + 8], 0
je 0x140008a23
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x140008a28
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140008a38
Capabilities:
Delete registry key

Disassembly:
cmp qword [rcx + 0x10], 0
je 0x140008a4e
mov r8, rdx
mov rdx, qword [rcx]
mov rcx, qword [rcx + 0x10]
jmp fcn.1400089ac
mov rcx, qword [rcx]
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add byte [rbp - 0x4affff8d], dh
jae 0x140507dac
add byte [rbp - 0x235cff8d], dh
rol dword [rax], 0xff
invalid

Function at 0x140008bc8
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
xor edi, edi
mov rbx, r8
mov rbp, rdx
mov r12, rcx
test r8, r8
jne 0x140008bf6
lea eax, [rdi + 0xd]
jmp 0x140008c2d
mov rsi, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea rsi, [rsi + rax*2]
lea edi, [rdi + rax*2]
cmp eax, 1
jne 0x140008bf9
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x14000d008
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x1402f2208]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov bl, r9b
mov rsi, r8
lea r9, [rbp - 0x25]
lea r8, [rbp - 0x21]
call fcn.14000bd80
test bl, bl
je 0x14000d0ef
lea rcx, str.COMCTL32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x14000d0ef
mov edx, 0x3ee
mov r8d, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14000d0ef
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000d0ef
lea r8, [rbp - 0x29]
lea rdx, [rbp - 9]
mov rcx, rax
call fcn.14000cb64
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
je 0x14000d0ef
movzx edx, word [rbp - 0x29]
lea r9, [rbp - 0x19]
lea r8, [rbp - 0x11]
lea rcx, [rbp - 9]
call fcn.14000bd80
mov edx, dword [rbp - 0x21]
mov ecx, dword [rsi]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [rbp - 0xd]
mov ecx, dword [rsi + 4]
mov r8d, 8
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r8d, dword [rbp - 0x19]
mov edx, dword [rbp - 0x25]
mov dword [rsi + 4], eax
mov ecx, eax
jmp 0x14000d10e
mov edx, dword [rbp - 0x21]
mov ecx, dword [rsi]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [rbp - 0x1d]
mov ecx, dword [rsi + 4]
mov dword [rsi], eax
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [rsi + 4], eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1401c0410
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000d138
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x1402f2208]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r12, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000d1ac
call fcn.140008780
mov ebx, eax
jmp 0x14000d2bb
mov r8, r12
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x14000d1cd
call fcn.140008780
jmp 0x14000d2af
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000d1c3
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jae 0x14000d208
mov ebx, 0x8007000e
jmp 0x14000d2b1
mov ecx, eax
test eax, eax
je 0x14000d245
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14000d23b
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14000d245
lea rcx, [rsp + 0x70]
call fcn.1400091f0
mov rax, qword [rsp + 0x70]
jmp 0x14000d24f
mov ecx, 0x80070216
call fcn.14000137c
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x14000d266
test rax, rax
je 0x14000d1fe
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14000d1c3
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14000b6ac
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x14000d2d2
lea rcx, [rsp + 0x70]
call fcn.1400bb9c0
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1401c0410
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret
Function at 0x14000db2c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x14000db50
mov eax, 0x80004003
jmp 0x14000dbe7
mov rcx, qword [0x140301100]
mov edx, 0x68
lea r8d, [rdx - 0x63]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
jne 0x14000db72
mov eax, 0x8000ffff
jmp 0x14000dbe7
mov rcx, qword [0x140301100]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000db6b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x14000db6b
lea rdx, [rsi + 0x1c]
mov r8b, 1
mov rcx, rax
call fcn.14000da88
mov dword [rdi], 0x30
mov edx, dword [rsi + 0x24]
mov rcx, rsi
call fcn.14000c754
mov rcx, rsi
mov qword [rdi + 8], rax
mov rax, qword [rsi + 0x1c]
mov qword [rdi + 0x10], rax
mov edx, dword [rsi + 0x28]
call fcn.14000c754
mov rcx, rsi
mov qword [rdi + 0x20], rax
mov edx, dword [rsi + 0x2c]
call fcn.14000c754
mov qword [rdi + 0x18], rax
mov eax, dword [rsi + 0x30]
mov dword [rdi + 0x28], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140012ac8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1402f2208]
xor rax, rsp
mov qword [rbp - 8], rax
mov ebx, edx
mov rsi, rcx
mov qword [rbp - 0x38], rcx
xor edi, edi
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
lea rdx, [rbp - 0x30]
call fcn.140012a70
nop
lea r8, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae r8, qword [rbp - 0x30]
movzx edx, bx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r12, rax
test rax, rax
je 0x140012c66
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140012c66
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140012c66
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsxd r12, eax
mov rdx, r12
lea ecx, [rdi + 0x42]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x140012c66
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140012c66
mov qword [rbp - 0x60], rdi
mov r8, r12
mov rdx, rbx
mov rcx, rax
call fcn.1401c0440
lea r8, [rbp - 0x60]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
setns r12b
test r12b, r12b
je 0x140012c06
lea ecx, [rdi + 0x18]
call sub.gdiplus.dll_GdipAlloc
mov rbx, rax
test rax, rax
je 0x140012bf7
mov rcx, qword [rbp - 0x60]
lea rax, vtable.Gdiplus::Image.0
mov qword [rbx], rax
lea rdx, [rbx + 8]
mov qword [rdx], rdi
call sub.gdiplus.dll_GdipLoadImageFromStream
mov dword [rbx + 0x10], eax
jmp 0x140012bfa
mov rbx, rdi
mov rdx, rbx
lea rcx, [rsi + 8]
call fcn.1400129e4
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test r12b, r12b
jne 0x140012c56
mov ecx, 0x18
call fcn.14005ce38
mov qword [rbp - 0x40], rax
test rax, rax
je 0x140012c41
lea rcx, str.ResourceImage_could_not_load_resource
mov qword [rbp - 0x58], rcx
lea rdx, [rbp - 0x58]
mov rcx, rax
call fcn.1401c0cd8
mov rdi, rax
mov qword [rbp - 0x50], rdi
lea rdx, [0x1402dff38]
lea rcx, [rbp - 0x50]
call fcn.1401c1184
nop
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x140012c66
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
cmp qword [rbp - 0x18], 8
jb 0x140012c77
mov rcx, qword [rbp - 0x30]
call fcn.14005ce7c
nop
mov rax, rsi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401c0410
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret