joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x38
movsxd rbx, dword [r8 + 0x3c]
mov r15, rdx
mov rcx, qword [rcx + 0x88]
lea rdx, str.VirtualProtect
add rbx, r8
mov rbp, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movzx r8d, word [rbx + 6]
xor r14d, r14d
mov r12, rax
mov r9d, r14d
test r8d, r8d
je 0x14000b206
movzx edx, word [rbx + 0x14]
lea r10, str..text
movsxd rcx, r9d
lea rax, [rcx + rcx*4]
lea rdi, [rdx + rax*8]
mov rax, r14
add rdi, rbx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rdi + rax + 0x18]
inc rax
cmp cl, byte [r10 + rax - 1]
jne 0x14000b1fa
cmp rax, 6
jne 0x14000b170
mov dword [rsp + 0x70], r14d
lea r9, [rsp + 0x70]
mov ecx, dword [rdi + 0x24]
lea r8d, [rax + 0x3a]
mov edx, dword [rdi + 0x20]
add rcx, r15
call r12
test eax, eax
je 0x14000b206
mov r9d, dword [rdi + 0x20]
mov eax, 0xc3050f
mov qword [rsp + 0x30], rsi
mov ecx, 0xcccccc
mov dword [rsp + 0x80], eax
mov esi, r14d
mov dword [rsp + 0x88], ecx
mov edx, r14d
sub r9d, 3
je 0x14000b21b
movzx r10d, byte [rsp + 0x82]
nop dword [rax]
mov r8d, edx
cmp word [r8 + rbp], ax
jne 0x14000b1f1
cmp byte [r8 + rbp + 2], r10b
je 0x14000b219
inc edx
cmp edx, r9d
jb 0x14000b1e0
jmp 0x14000b21b
inc r9d
cmp r9d, r8d
jl 0x14000b151
mov eax, 0xffffffff
add rsp, 0x38
pop r15
pop r14
pop r12
pop rdi
pop rbp
pop rbx
ret
mov esi, edx
movzx r9d, byte [rsp + 0x8a]
mov r11d, 3
mov r8d, r11d
mov r10d, esi
mov eax, r8d
mov rdx, r10
sub rdx, rax
cmp word [rdx + rbp], cx
jne 0x14000b246
cmp byte [rdx + rbp + 2], r9b
je 0x14000b251
inc r8d
cmp r8d, 0x32
jb 0x14000b230
jmp 0x14000b291
sub r11d, r8d
lea rcx, str.First_syscall_found_at_0x_p_n
add esi, r11d
mov ebx, esi
add rbx, rbp
mov rdx, rbx
call fcn.140006830
lea rdx, [0x14003569d]
lea rcx, [0x140048790]
call fcn.1400015a0
mov rcx, rax
mov rdx, rbx
call fcn.1400015a0
mov rcx, rax
call fcn.140001fb0
mov ecx, dword [rdi + 0x20]
movsd xmm0, qword [0x1400361f0]
movzx eax, word [0x1400361f8]
movsd qword [rsp + 0x20], xmm0
mov word [rsp + 0x28], ax
sub ecx, 9
je 0x14000b2e9
mov r8, qword [rsp + 0x20]
movzx edx, al
nop dword [rax + rax]
cmp qword [rcx + rbp], r8
jne 0x14000b2cc
cmp byte [rcx + rbp + 8], dl
je 0x14000b2d3
add ecx, 0xffffffff
jne 0x14000b2c0
jmp 0x14000b2e9
lea r14d, [rcx + 6]
mov edx, r14d
lea rcx, str.Last_syscall_byte_found_at_0x_p_n
add rdx, rbp
call fcn.140006830
test esi, esi
je 0x14000b30c
test r14d, r14d
je 0x14000b30c
cmp esi, r14d
jae 0x14000b30c
mov eax, esi
sub r14d, esi
mov r8d, r14d
lea rdx, [rax + rbp]
lea rcx, [rax + r15]
call fcn.140012390
mov ecx, dword [rdi + 0x24]
lea r9, [rsp + 0x70]
mov edx, dword [rdi + 0x20]
add rcx, r15
mov r8d, dword [rsp + 0x70]
call r12
mov rsi, qword [rsp + 0x30]
test eax, eax
je 0x14000b206
xor eax, eax
add rsp, 0x38
pop r15
pop r14
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x14000e740
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14000e76e
xor eax, eax
jmp 0x14000e854
cmp qword [rcx + 0x68], 0
je 0x14000e77f
call fcn.14000e870
jmp 0x14000e854
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000e796
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000e798
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000e7ca
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.140012390
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x14000e84e
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x14000e801
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14000e82a
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14001e508
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x14000e84e
cmp rsi, rbx
ja 0x14000e808
test rsi, rsi
je 0x14000e84e
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14001e508
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140011124
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001116e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001116e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001116e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001116e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001116e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140011170
xor al, al
add rsp, 0x28
ret
Function at 0x1400176b4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14001751f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001751f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001751f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001751f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001751f
cmp dword [rcx + 0x84], 0xe
jbe 0x14001751f
cmp dword [rcx + 0xf8], 0
je 0x14001751f
mov ecx, ebx
call fcn.1400175d0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400173ac
nop
cmp dword [rbp + 0x20], 0
je 0x14001756d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140017578
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400174b0
Function at 0x1400293a4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.1400106d0
sub rsp, rax
mov rax, qword [0x140047048]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14002698c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1400293f3
mov rax, rbp
jmp 0x1400294fb
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x49a00]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14002a68c
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x49a00]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1400294f7
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400294f7
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14002a68c
test rax, rax
js 0x1400294f7
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1400294f7
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1400294e9
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x1400294e9
cmp byte [rcx], 0xd
jne 0x1400294cf
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1400294de
cmp byte [rcx + 1], 0xa
jne 0x1400294de
inc rcx
jmp 0x1400294de
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x47440]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x1400294b1
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1400294fb
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140010cf0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140029818
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14002982e
mov al, 1
jmp 0x14002988e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14002983f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14002988c
mov ecx, dword [rcx + 0x18]
nop
call fcn.14002c910
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14002988c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14002988c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14002988c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14002988e
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140029a2c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x140049a00]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x140029a83
cmp word [rdx], r13w
jne 0x140029a83
or byte [rax + rdi*8 + 0x38], cl
jmp 0x140029a88
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x140029bad
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x140029bce
lea r9, [rdx + 2]
cmp cx, r11w
je 0x140029ac1
mov rdx, r9
mov word [rbx], cx
jmp 0x140029ae8
cmp r9, r8
jae 0x140029af8
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x140029aa2
jmp 0x140029bad
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140029ba2
cmp dword [rsp + 0x80], esi
je 0x140029ba2
lea r8, [0x140049a00]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x140029b7a
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x140029b4a
mov word [rbx], r13w
jmp 0x140029baa
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x140029b57
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x140029baa
cmp word [rsp + 0x70], r13w
jne 0x140029b87
cmp rbx, r14
je 0x140029b44
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14002a694
cmp word [rsp + 0x70], r13w
je 0x140029bad
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140049a00]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x140029ba7
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x140029bad
Function at 0x14002c16c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14002c1f3
mov rsi, rbx
cmp word [rax], bp
je 0x14002c1b2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14002c19c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14002c198
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400255f8
mov rdi, rax
test rax, rax
je 0x14002c1e0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140012390
mov rbp, rdi
xor ecx, ecx
call fcn.140023c9c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14002ee64
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1400238c4
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x14002ef05
cmp ebx, dword [rsp + 0x30]
je 0x14002eefe
test esi, esi
je 0x14002eefe
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x14002eed9
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14002eee6
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x14002eec3
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14002eeea
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x14002ef07
mov eax, 1
jmp 0x14002ef07
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400015a0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x14023d380]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x180]
xor edi, edi
test rcx, rcx
je 0x1400015dd
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 0x180], rdi
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.14017b0d0
lea rdx, [rsp + 0x20]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, str.driverhelper64.dll
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140001684
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx + 0x180], rax
test rax, rax
je 0x140001684
lea rdx, [0x1401fdfb8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x188], rax
test rax, rax
je 0x140001684
mov r8, qword [rbx + 0x180]
xor r9d, r9d
mov rdx, rax
lea ecx, [r9 + 3]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbx + 0x190], rax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140179510
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret

Function at 0x1400018c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1400018f3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140001939
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140001934
nop
cmp rbx, rcx
jae 0x140001939
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
dec edi
jne 0x140001920
cmp rbx, rcx
jb 0x14000193d
xor eax, eax
jmp 0x140001949
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400020e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_712
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x1400155b3
cmp dword [rcx + 0xd8], 0
jne 0x1400155b3
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.140023124
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.140015910
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140002120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14023d380]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
mov eax, 0x33
lea rcx, [rbp - 0x28]
xor ebx, ebx
mov dword [rbp - 0x24], 0x63006d
mov dword [rbp - 0x20], 0x6c0074
mov dword [rbp - 0x12], VarBstrFromDisp
mov dword [rbp - 0x16], 0x6c0064
mov dword [rbp - 0x28], 0x6f0043
mov dword [rbp - 0x1a], 0x2e0032
mov word [rbp - 0x1c], ax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x1400021df
lea rdx, [rbp - 0x40]
mov rcx, rax
mov dword [rbp - 0x3f], 0x4374696e
mov dword [rbp - 0x2f], 0x784573
mov dword [rbp - 0x33], 0x6c6f7274
mov dword [rbp - 0x38], 0x6f436e6f
mov word [rbp - 0x3b], 0x6d6f
mov byte [rbp - 0x39], 0x6d
mov byte [rbp - 0x40], 0x49
mov byte [rbp - 0x34], 0x6e
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400021d6
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140179510
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140002420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14023d380]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
mov eax, 0x2e
lea rcx, [rbp - 0x20]
mov r14d, edx
xor ebx, ebx
mov dword [rbp - 0x12], 0x6c0064
mov dword [rbp - 0x18], 0x320033
mov dword [rbp - 0x1c], 0x720065
mov dword [rbp - 0xe], VarBstrFromDisp
mov word [rbp - 0x14], ax
mov dword [rbp - 0x20], 0x730055
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x1400024d4
lea rdx, [rbp - 0x30]
mov rcx, rax
mov dword [rbp - 0x27], 0x576567
mov dword [rbp - 0x2c], 0x7373654d
mov word [rbp - 0x2f], 0x736f
mov byte [rbp - 0x2d], 0x74
mov byte [rbp - 0x28], 0x61
mov byte [rbp - 0x30], 0x50
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400024cb
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140179510
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140015574
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_712
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x1400155b3
cmp dword [rcx + 0xd8], 0
jne 0x1400155b3
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.140023124
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.140015910
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140015610
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
mov r15, rcx
xor edi, edi
call fcn.140023124
lea r8d, [rdi + 5]
mov rbp, qword [rax + 0x18]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbp
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x14001566c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.1400156a4
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400162c4
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x40
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x14023f210]
test eax, eax
je 0x140016316
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14023f210]
test eax, eax
jne 0x14001631f
call fcn.1400101a0
test eax, eax
je 0x14001633b
lea rdx, [rsp + 0x30]
mov rcx, qword [0x140237178]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x140016343
xor eax, eax
jmp 0x14001639b
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rsi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rsi, rax
mov qword [rsp + 0x38], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je 0x14001637d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14001637f
xor edi, edi
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140016398
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret

Function at 0x140017a78
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x140017af2
xor r8d, r8d
call fcn.140017d3c
mov rsi, rax
test rax, rax
jne 0x140017aae
mov eax, edi
jmp 0x140017b08
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x140017aaa
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret