joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003ccc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x140296908]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r14, r9
mov rsi, rdx
mov rdi, rcx
mov dword [rbp + 0x17], 0x690077
mov dword [rbp + 0x1b], 0x69006e
mov dword [rbp + 0x1f], 0x65006e
mov dword [rbp + 0x23], 0x2e0074
mov dword [rbp + 0x27], 0x6c0064
mov dword [rbp + 0x2b], VarBstrFromDisp
xor r15d, r15d
mov dword [rbp - 0x11], 0x6e0049
mov dword [rbp - 0xd], 0x650074
mov dword [rbp - 9], 0x6e0072
mov dword [rbp - 5], 0x740065
mov dword [rbp - 1], 0x650052
mov dword [rbp + 3], 0x640061
mov dword [rbp + 7], 0x690046
mov dword [rbp + 0xb], 0x65006c
mov word [rbp + 0xf], r15w
lea rcx, [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x140003e29
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x41], r15
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x59]
call fcn.1400057e8
cmp word [rbp - 0x11], r15w
jne 0x140003da6
mov r8, r15
jmp 0x140003db8
lea rax, [rbp - 0x11]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x140003dae
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x59]
call fcn.140005864
nop
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x31]
call fcn.140003128
cmp qword [rax + 0x18], 0x10
jb 0x140003ddd
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x31]
call fcn.14000593c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x59]
call fcn.1400057e8
test rbx, rbx
je 0x140003e21
mov r9, r14
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rdi
call rbx
jmp 0x140003e24
mov eax, r15d
test eax, eax
setne al
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1401a55b0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000405c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140296908]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rcx
mov dword [rbp - 0x20], 0x680053
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x6c0065
mov dword [rbp - 0x18], 0x33006c
xor esi, esi
mov dword [rbp - 0x14], 0x2e0032
mov dword [rbp - 0x10], 0x6c0064
mov dword [rbp - 0xc], VarBstrFromDisp
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x14000410b
lea rdx, [0x14024e220]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004102
mov dword [rsp + 0x28], 1
lea rdx, [rbp - 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov r8, rdi
mov dword [rbp - 0x30], 0x70006f
xor ecx, ecx
mov dword [rbp - 0x2c], 0x6e0065
mov word [rbp - 0x28], si
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401a55b0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140004cb0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140296908]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14d, edx
mov rdi, rcx
or ebx, 0xffffffff
xor esi, esi
cmp edx, ebx
jne 0x140004cfd
cmovne esi, edx
mov eax, esi
jmp 0x140004ece
mov rax, qword [rcx + 0x40]
cmp qword [rax], rsi
je 0x140004d37
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x140004d37
lea ecx, [r8 - 1]
mov dword [rdx], ecx
mov rdx, qword [rdi + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], r14b
mov eax, r14d
jmp 0x140004ece
cmp qword [rdi + 0x80], rsi
je 0x140004ecc
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x140004d71
mov rdx, qword [rdi + 0x90]
mov rcx, qword [rdi + 0x88]
mov qword [r8], rcx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
cmp qword [rdi + 0x68], rsi
jne 0x140004d92
movsx ecx, r14b
mov rdx, qword [rdi + 0x80]
call fcn.1401adc64
cmp eax, ebx
cmovne ebx, r14d
jmp 0x140004ecc
mov byte [rbp - 1], r14b
mov qword [rbp + 0x17], rsi
mov qword [rbp + 0x1f], rsi
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 7]
call fcn.14000593c
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp + 7]
call fcn.140005a90
nop
mov r10, qword [rbp + 7]
mov r9, qword [rbp + 0x1f]
lea rdx, [rbp + 7]
cmp r9, 0x10
cmovae rdx, r10
lea r8, [rbp + 7]
cmovae r8, r10
mov rcx, qword [rdi + 0x68]
mov r10, qword [rcx]
add rdx, qword [rbp + 0x17]
lea rax, [rbp - 0x11]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
lea r9, [rbp]
lea r8, [rbp - 1]
lea rdx, [rdi + 0x74]
call qword [r10 + 0x38]
test eax, eax
js 0x140004ebe
cmp eax, 1
jg 0x140004ea3
lea rax, [rbp + 7]
mov r10, qword [rbp + 7]
mov r9, qword [rbp + 0x1f]
cmp r9, 0x10
cmovae rax, r10
mov r15, qword [rbp - 0x11]
sub r15, rax
je 0x140004e6b
lea rcx, [rbp + 7]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x80]
mov r8, r15
mov edx, 1
call fcn.1401aea6c
cmp r15, rax
jne 0x140004ebe
mov r9, qword [rbp + 0x1f]
mov r10, qword [rbp + 7]
mov byte [rdi + 0x71], 1
lea rax, [rbp - 1]
cmp qword [rbp - 9], rax
jne 0x140004e9e
test r15, r15
jne 0x140004dc5
cmp qword [rbp + 0x17], 0x20
jae 0x140004ebe
xor r8d, r8d
lea edx, [r15 + 8]
lea rcx, [rbp + 7]
call fcn.140005cc4
jmp 0x140004dbd
mov ebx, r14d
jmp 0x140004ebe
cmp eax, 3
jne 0x140004ebe
movsx ecx, byte [rbp - 1]
mov rdx, qword [rdi + 0x80]
call fcn.1401adc64
cmp eax, ebx
cmovne ebx, r14d
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 7]
call fcn.14000593c
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1401a55b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140005f58
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140296908]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
xor ebx, ebx
cmp qword [rcx + 0x68], rbx
je 0x1400060a8
cmp byte [rcx + 0x71], bl
je 0x1400060a8
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
jne 0x140005fb1
xor al, al
jmp 0x1400060aa
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.14000593c
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x30]
call fcn.140005a90
nop
mov r10, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
lea rdx, [rbp - 0x30]
cmp r9, 0x10
cmovae rdx, r10
lea r8, [rbp - 0x30]
cmovae r8, r10
mov rcx, qword [rdi + 0x68]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x20]
add r9, rdx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x74]
call qword [r10 + 0x40]
mov ecx, eax
test eax, eax
je 0x140006020
sub ecx, 1
jne 0x14000608f
jmp 0x140006023
mov byte [rdi + 0x71], bl
lea rax, [rbp - 0x30]
mov r10, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
cmp r9, 0x10
cmovae rax, r10
mov rsi, qword [rbp - 0x38]
sub rsi, rax
je 0x14000606d
lea rcx, [rbp - 0x30]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
call fcn.1401aea6c
cmp rsi, rax
jne 0x140006096
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x30]
cmp byte [rdi + 0x71], bl
je 0x140006094
test rsi, rsi
jne 0x140005fe0
xor r8d, r8d
lea edx, [rsi + 8]
lea rcx, [rbp - 0x30]
call fcn.140005cc4
jmp 0x140005fd8
cmp ecx, 2
jne 0x140006096
mov bl, 1
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x30]
call fcn.14000593c
mov al, bl
jmp 0x1400060aa
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1401a55b0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140007cf4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push rdi
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140296908]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rbp + 7], rcx
mov qword [rbp + 0xf], rdx
xor r15d, r15d
mov dword [rbp - 0x39], r15d
mov dword [rbp + 0x1f], 0x6f0049
mov dword [rbp + 0x23], 0x6f0043
mov dword [rbp + 0x27], 0x70006d
mov dword [rbp + 0x2b], 0x65006c
mov dword [rbp + 0x2f], 0x690074
mov dword [rbp + 0x33], 0x6e006f
mov word [rbp + 0x37], r15w
lea rax, [rbp - 0x31]
mov qword [rbp + 0x17], rax
lea rcx, [rbp - 0x31]
call fcn.1400077c0
mov rsi, rax
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x21]
call fcn.1400057e8
cmp word [rbp + 0x1f], r15w
jne 0x140007d9e
mov r8d, r15d
jmp 0x140007db0
lea rax, [rbp + 0x1f]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x140007da6
lea rdx, [rbp + 0x1f]
lea rcx, [rbp - 0x21]
call fcn.140005864
nop
mov r8, rsi
lea rdx, [rbp - 0x21]
mov rcx, rdi
call fcn.140007850
mov dword [rbp - 0x39], 1
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x140007e09
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140007e09
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
or edx, 0xffffffff
lock xadd dword [rbx + 0xc], edx
cmp edx, 1
jne 0x140007e09
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, rdi
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1401a55b0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret

Function at 0x14000b418
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x140296908]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov dword [rbp + 0x3f], 0x74726956
mov dword [rbp + 0x43], 0x416c6175
mov dword [rbp + 0x47], 0x636f6c6c
mov word [rbp + 0x4b], 0x7845
xor ebx, ebx
mov byte [rbp + 0x4d], bl
mov dword [rsp + 0x20], r9d
mov r9d, 0x3000
mov r8, rdx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
jne 0x14000b4ee
mov qword [rbp - 0x19], rbx
mov qword [rbp - 0x11], rbx
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x29]
call fcn.14000593c
cmp byte [rbp + 0x3f], bl
je 0x14000b4aa
lea rcx, [rbp + 0x3f]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], bl
jne 0x14000b49f
mov rbx, rax
mov r8, rbx
lea rdx, [rbp + 0x3f]
lea rcx, [rbp - 0x29]
call fcn.140005b18
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp - 0x29]
lea rcx, [rbp + 0x1f]
call fcn.1400082b8
nop
mov rdx, rax
lea rcx, [rbp + 7]
call fcn.140002470
lea rdx, [0x140290ab8]
lea rcx, [rbp + 7]
call fcn.1401ac7dc
nop
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1401a55b0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rbp
ret
Function at 0x140013360
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_720
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
test rdx, 0xffffffffffff0000
jne 0x140027f8f
cmp dword [rcx + 0xe8], 0
jne 0x140027f8f
movzx eax, dx
mov dword [rcx + 0xe8], eax
call fcn.140038f70
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.1400282f0
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400145c8
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x160
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140296908]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
call fcn.14002de3c
nop
lea rax, vtable.CWinApp.0
mov qword [rbx], rax
xor esi, esi
test rdi, rdi
je 0x140014629
mov rcx, rdi
call fcn.1401b5398
mov qword [rbx + 0xa0], rax
jmp 0x140014630
mov qword [rbx + 0xa0], rsi
call fcn.140038f70
mov rdi, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14001464a
call fcn.14002ac4c
int3
lea rcx, [rax + 0xc0]
lea rdx, [0x140014b8c]
call fcn.14003f164
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14001466f
call fcn.14002ac4c
int3
mov qword [rax + 8], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rbx + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 0x60], eax
mov qword [rdi + 8], rbx
mov qword [rbx + 0x88], rsi
mov qword [rbx + 0x100], rsi
mov qword [rbx + 0xd0], rsi
mov qword [rbx + 0xd8], rsi
mov qword [rbx + 0xb0], rsi
mov qword [rbx + 0xc8], rsi
mov qword [rbx + 0xa8], rsi
mov qword [rbx + 0x118], rsi
mov qword [rbx + 0xb8], rsi
mov qword [rbx + 0x130], rsi
mov qword [rbx + 0x90], rsi
mov qword [rbx + 0x128], rsi
mov qword [rbx + 0x120], rsi
mov dword [rbx + 0x108], esi
mov qword [rbx + 0x110], rsi
mov qword [rbx + 0xe8], rsi
mov qword [rbx + 0xf0], rsi
mov qword [rbx + 0x140], rsi
mov dword [rbx + 0xc0], esi
mov dword [rbx + 0xe0], esi
mov qword [rbx + 0x138], 0x200
mov dword [rbx + 0x14c], esi
mov dword [rbx + 0x150], 0x493e0
mov edi, 1
mov dword [rbx + 0x154], edi
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x34], 6
jne 0x14001475e
cmp dword [rsp + 0x38], edi
jae 0x140014762
cmp dword [rsp + 0x34], 6
mov eax, esi
jbe 0x140014764
mov eax, edi
mov dword [rbx + 0x158], eax
mov dword [rbx + 0x15c], esi
mov qword [rbx + 0x168], rsi
mov qword [rbx + 0x170], rsi
mov dword [rbx + 0x160], edi
mov rax, rbx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1401a55b0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140016748
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov r14, r9
mov rsi, r8
mov rbp, rdx
mov r12, rcx
test r8, r8
je 0x1400167ba
call fcn.140038f70
mov r8d, 0xf0
mov rdx, rsi
mov r15, qword [rax + 0x18]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400167ba
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x140016803
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov esi, 1
test rdi, rdi
je 0x1400167e8
mov r10, qword [r12]
mov r9, r14
mov r8, rdi
mov rdx, rbp
mov rcx, r12
call qword [r10 + 0x40]
mov esi, eax
test rbx, rbx
je 0x1400167e8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rcx, qword [rbp + 0xc8]
test rcx, rcx
je 0x140016801
mov r8, qword [rcx]
mov rdx, r14
call qword [r8 + 0x140]
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400270c8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rsi, r9
mov r14, r8
and qword [r9], 0
mov rbx, qword [rbp + 0x40]
and dword [rbx], 0
cmp qword [rcx + 0xb0], 0
je 0x1400271a7
xor r8d, r8d
call fcn.140027568
mov rdi, rax
test rax, rax
je 0x140027282
mov qword [rbp - 0x18], rax
and dword [rbp - 0x10], 0
and qword [rbp - 8], 0
and dword [rbp + 0x20], 0
and dword [rbp + 0x40], 0
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp + 0x40]
mov dword [rbx], ecx
test eax, eax
jne 0x14002718b
call fcn.14001449c
mov qword [rsi], rax
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002718b
lea ebx, [rax + 1]
jmp 0x140027199
mov rcx, qword [rsi]
call fcn.140014494
and qword [rsi], 0
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140027280
mov rax, qword [rcx]
and qword [rsp + 0x20], 0
mov r9, r8
mov r8, rdx
lea rdx, [rbp + 0x38]
call qword [rax + 0x108]
nop
mov rax, qword [rbp + 0x38]
movsxd rcx, dword [rax - 0x10]
test ecx, ecx
jne 0x1400271d4
xor ebx, ebx
jmp 0x140027266
mov rdi, rcx
shr ecx, 1
mov dword [rbx], ecx
call fcn.14001449c
mov qword [rsi], rax
xor edx, edx
lea ebx, [rdx + 1]
test rdi, rdi
jle 0x140027262
xor r9d, r9d
mov r10d, ebx
test r10, r10
js 0x140027257
mov rax, qword [rbp + 0x38]
lea ecx, [rdx + 1]
cmp ecx, dword [rax - 0x10]
jg 0x140027257
movzx r8d, word [r9 + rax + 2]
test edx, edx
js 0x14002724c
cmp edx, dword [rax - 0x10]
jg 0x14002724c
sub r8b, bl
shl r8b, 4
sub r8b, 0x41
add r8b, byte [r9 + rax]
mov eax, edx
test edx, edx
jns 0x14002722b
lea eax, [rbx + rdx]
sar eax, 1
movsxd rcx, eax
mov rax, qword [rsi]
mov byte [rcx + rax], r8b
add edx, 2
add r10, 2
add r9, 4
movsxd rax, edx
cmp rax, rdi
jl 0x1400271f3
jmp 0x140027262
mov ecx, 0x80070057
call fcn.14000e734
int3
mov ecx, 0x80070057
call fcn.14000e734
int3
mov rax, qword [rbp + 0x38]
lea rdx, [rax - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140027280
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140027298
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x140027312
xor r8d, r8d
call fcn.140027568
mov rsi, rax
test rax, rax
jne 0x1400272ce
mov eax, edi
jmp 0x140027328
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x1400272ca
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400278e8
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
xor edi, edi
mov rbx, r9
mov r12, r8
mov r15, rdx
mov rsi, rcx
cmp qword [rcx + 0xb0], rdi
je 0x14002796a
xor r8d, r8d
call fcn.140027568
mov rsi, rax
test rax, rax
je 0x1400279f8
mov ecx, dword [rsp + 0x70]
mov r9d, 3
mov dword [rsp + 0x28], ecx
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x20], rbx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete dil
mov eax, edi
jmp 0x1400279f8
mov ebp, dword [rsp + 0x70]
mov eax, 2
lea ecx, [rbp*2 + 1]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14001449c
mov r14, rax
mov r8d, edi
test ebp, ebp
je 0x1400279ce
mov rdx, rax
mov r8d, ebp
mov r9d, ebp
mov al, byte [rbx]
and al, 0xf
movzx ecx, al
add cx, 0x41
mov word [rdx], cx
lea rdx, [rdx + 4]
mov al, byte [rbx]
inc rbx
shr al, 4
movzx ecx, al
add cx, 0x41
mov word [rdx - 2], cx
sub r9, 1
jne 0x1400279a3
lea eax, [r8 + r8]
mov r9, r14
mov word [r14 + rax*2], di
mov r8, r12
mov rax, qword [rsi]
mov rdx, r15
mov rcx, rsi
call qword [rax + 0x110]
mov rcx, r14
mov ebx, eax
call fcn.140014494
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x140027e6c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, qword [rcx + 0x100]
xor r14d, r14d
mov rsi, rcx
mov rbp, qword [rcx + 0xf8]
cmp qword [rcx + 0xf0], r14
je 0x140027ece
call fcn.140038f70
mov rdx, qword [rsi + 0xf0]
lea r8d, [r14 + 5]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rbp, rbp
je 0x140027edf
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov ebx, 1
test rdi, rdi
je 0x140027f20
mov edx, dword [rdi]
mov eax, 0xffff
cmp word [rdi + 2], ax
jne 0x140027f03
mov edx, dword [rdi + 0xc]
movzx ecx, word [rdi + 0x12]
movzx eax, word [rdi + 0x14]
jmp 0x140027f0b
movzx ecx, word [rdi + 0xa]
movzx eax, word [rdi + 0xc]
test edx, 0x1801
jne 0x140027f1d
test cx, cx
jne 0x140027f1d
test ax, ax
je 0x140027f20
mov ebx, r14d
cmp qword [rsi + 0xf0], r14
je 0x140027f32
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140027f50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_720
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
test rdx, 0xffffffffffff0000
jne 0x140027f8f
cmp dword [rcx + 0xe8], 0
jne 0x140027f8f
movzx eax, dx
mov dword [rcx + 0xe8], eax
call fcn.140038f70
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.1400282f0
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140027fec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
mov r15, rcx
xor edi, edi
call fcn.140038f70
lea r8d, [rdi + 5]
mov rdx, rbx
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x140028048
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.140028080
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret