joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cd900
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
xor esi, esi
mov rdi, rcx
mov r15d, select
mov qword [rsp + 0x30], rsi
xor ecx, ecx
mov qword [rsp + 0x40], rsi
mov r14d, esi
mov qword [rsp + 0x48], r15
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400cdab2
lea ecx, [rsi + 1]
mov qword [rsp + 0x70], rbx
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
test rax, rax
je 0x1400cd994
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400cd98b
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], sil
jne 0x1400cd966
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140018350
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
test r14, r14
je 0x1400cda6d
cmp r15, 0x10
lea rax, [rsp + 0x30]
lea rbx, [rsp + 0x30]
cmovae rax, rsi
cmovae rbx, rsi
add r14, rax
cmp rbx, r14
je 0x1400cda6d
movabs r12, 0x7ffffffffffffff
nop dword [rax]
cmp byte [0x140248078], 0
movsx ebp, byte [rbx]
je 0x1400cda61
mov rcx, qword [rdi + 0x270]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov word [rsp + 0x20], bp
mov rbp, qword [rdi + 0x260]
cmp qword [rdi + 0x268], r12
je 0x1400cdac4
mov ecx, 0x20
call fcn.1400dc7cc
movsd xmm0, qword [rsp + 0x20]
movsd qword [rax + 0x10], xmm0
mov dword [rax + 0x18], 3
inc qword [rdi + 0x268]
mov rcx, qword [rbp + 8]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov qword [rbp + 8], rax
mov qword [rcx], rax
mov byte [rdi + 0x279], 1
mov rcx, qword [rdi + 0x270]
cmp dword [rcx + 8], 0xffffffff
jge 0x1400cda61
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
inc rbx
cmp rbx, r14
jne 0x1400cd9e0
cmp r15, 0x10
jb 0x1400cdaa0
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400cda98
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400cdad1
mov rcx, rsi
call fcn.1400dc808
mov rbp, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
lea rcx, str.list_too_long
call fcn.1400dadd8
int3
call fcn.1400e34bc
int3
Function at 0x1400cdbf0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x80
mov esi, edx
movzx r12d, r9b
mov byte [rcx + 0x2c4], 0
movzx ebp, r8b
mov rbx, rcx
test r8b, r8b
je 0x1400cde47
movzx edi, byte [rsp + 0xc0]
test r9b, r9b
jne 0x1400cdc81
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov r8d, 0x40
lea rdx, [rsp + 0x40]
mov ecx, eax
mov eax, edi
shl eax, 0x18
shl ecx, 0x10
or ecx, eax
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
test eax, eax
jle 0x1400cdc81
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400cdc66
lea rcx, [rbx + 0x2a0]
lea rdx, [rsp + 0x40]
call fcn.140018350
cmp dword [rbx + 0x2c0], 0xa2
jne 0x1400cde31
cmp esi, 0xa4
jne 0x1400cde31
test dil, dil
je 0x1400cdca9
mov byte [rbx + 0x2c4], 1
mov rcx, qword [rbx + 0x270]
mov qword [rsp + 0xa0], r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test r12b, r12b
jne 0x1400cdd4c
mov r8d, esi
mov qword [rsp + 0xa8], r15
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400cdae0
mov r14, qword [rsp + 0x20]
mov r15, qword [rsp + 0x28]
mov rdi, r14
cmp r14, r15
je 0x1400cdd06
mov rcx, qword [rdi]
movzx edx, bpl
call fcn.1400ce670
add rdi, 8
cmp rdi, r15
jne 0x1400cdcf1
mov r15, qword [rsp + 0xa8]
test r14, r14
je 0x1400cdd4c
mov rdx, qword [rsp + 0x30]
mov rax, r14
sub rdx, r14
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1400cdd44
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400cde8e
mov rcx, r14
call fcn.1400dc808
cmp byte [0x140248078], 0
je 0x1400cddf3
cmp esi, 0x256
jae 0x1400cdd8b
mov byte [rsi + rbx + 8], bpl
cmp byte [rbx + 0xaa], 0
je 0x1400cdd8b
lea eax, [rsi - 0x56]
test eax, 0xffffffdf
jne 0x1400cdd8b
test bpl, bpl
je 0x1400cdd8b
test r12b, r12b
jne 0x1400cdd8b
mov rcx, rbx
call fcn.1400cd900
mov rdi, qword [rbx + 0x260]
movabs rax, 0x7ffffffffffffff
mov dword [rsp + 0x20], esi
mov byte [rsp + 0x24], bpl
mov byte [rsp + 0x25], r12b
cmp qword [rbx + 0x268], rax
je 0x1400cde81
mov ecx, 0x20
call fcn.1400dc7cc
movsd xmm0, qword [rsp + 0x20]
movsd qword [rax + 0x10], xmm0
mov dword [rax + 0x18], 4
inc qword [rbx + 0x268]
mov rcx, qword [rdi + 8]
mov qword [rax], rdi
mov qword [rax + 8], rcx
mov qword [rdi + 8], rax
mov qword [rcx], rax
mov byte [rbx + 0x279], 1
test bpl, bpl
je 0x1400cddfe
mov dword [rbx + 0x2c0], esi
mov rcx, qword [rbx + 0x270]
cmp dword [rcx + 8], 0xffffffff
jge 0x1400cde11
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r14, qword [rsp + 0xa0]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
cmp esi, 0x2e
jne 0x1400cde47
lea rcx, [0x14024b020]
call fcn.1400ca360
jmp 0x1400cdca9
cmp esi, 0x2d
jne 0x1400cdca9
test bpl, bpl
je 0x1400cdca9
test r12b, r12b
jne 0x1400cdca9
cmp byte [0x140248078], r12b
lea rcx, [0x140248070]
sete dl
call fcn.1400c5c80
mov byte [rbx + 0x279], 1
jmp 0x1400cde19
lea rcx, str.list_too_long
call fcn.1400dadd8
int3
call fcn.1400e34bc
int3
Function at 0x1400ef2c0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400ef0ec

Function at 0x140103f40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
mov eax, 0xffffffff
test edx, edx
je 0x140103f7e
mov r10d, edx
lea r11, [0x140122d70]
nop word [rax + rax]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
mov edx, eax
shr eax, 8
xor r8, rdx
movzx ecx, r8b
xor eax, dword [r11 + rcx*4]
sub r10, 1
jne 0x140103f60
not eax
ret
Function at 0x140001540
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov r12, r9
mov r13, r8
mov rbx, rdx
mov r14, rcx
call fcn.14000ddd0
xor edi, edi
lea r8d, [rdi + 5]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x140001659
mov r8d, 0xf0
mov rdx, rbx
mov rcx, r14
mov qword [rsp + 0x68], r15
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15d, edi
test rax, rax
je 0x1400015b7
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
mov rdx, rsi
mov rcx, r14
mov qword [rsp + 0x60], rbp
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000163b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x14000163b
mov rdx, r15
mov rcx, rax
call fcn.14000c400
mov r9, r12
mov r8, r13
mov rsi, rax
mov rax, qword [rsp + 0x80]
mov rcx, r14
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rdi, rax
test rax, rax
jne 0x14000161d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp rsi, rbp
je 0x140001643
test rsi, rsi
je 0x140001643
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140001643
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r15, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
test ebx, ebx
je 0x140001659
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400063a0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x1400063ce
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14000aad0
cmp byte [0x14003af10], 0
jne 0x140006419
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006409
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x14003af10], 1
mov qword [0x14003af08], rax
jmp 0x140006420
mov rax, qword [0x14003af08]
mov byte [0x14003af10], 1
jmp 0x140006420
mov rax, qword [0x14003af08]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14000643f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14000ab44
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x14000ab5f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x14000ab5f
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x14000ab5f
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
add bh, bh
fimul dword [rdi - 0x72270100]
add bh, bh
invalid
Function at 0x14000a620
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1400382d0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor eax, eax
xor ebp, ebp
mov rsi, rdx
mov r8, rdx
mov rdx, qword [rcx]
mov rdi, rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x40]
or r9d, 0x2001f
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x50], rbp
call fcn.1400092e0
mov ebx, eax
test eax, eax
jne 0x14000a747
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x58], pe_nt_image_headers64
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000a721
nop dword [rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.14000a620
mov ebx, eax
test eax, eax
jne 0x14000a747
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x58], pe_nt_image_headers64
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14000a6d0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000a736
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x48], ebp
call fcn.1400063a0
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000a757
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140013730
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000aad0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x1400063ce
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14000aad0
cmp byte [0x14003af10], 0
jne 0x140006419
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006409
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x14003af10], 1
mov qword [0x14003af08], rax
jmp 0x140006420
mov rax, qword [0x14003af08]
mov byte [0x14003af10], 1
jmp 0x140006420
mov rax, qword [0x14003af08]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14000643f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14000ab44
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x14000ab5f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x14000ab5f
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x14000ab5f
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
add bh, bh
fimul dword [rdi - 0x72270100]
add bh, bh
invalid
Function at 0x14000aec0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1400382d0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x50], r14
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], r14
xor edx, edx
mov r8d, 0x408
lea rcx, [rsp + 0x70]
call fcn.140013840
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000af6c
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000af6c
call fcn.140003d10
mov ebx, eax
jmp 0x14000b094
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14000af8d
call fcn.140003d10
jmp 0x14000b083
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14000afb0
call fcn.140003d10
jmp 0x14000b083
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x14000afd2
mov ebx, 0x8007000e
jmp 0x14000b085
mov ecx, eax
test eax, eax
je 0x14000b00a
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14000b000
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14000b00a
lea rcx, [rsp + 0x70]
call fcn.1400033a0
jmp 0x14000b014
mov ecx, 0x80070216
call fcn.140004950
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x14000b027
cmp qword [rsp + 0x70], 0
jne 0x14000b036
mov ebx, 0x8007000e
jmp 0x14000b085
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14000b060
call fcn.140003d10
jmp 0x14000b083
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.14000abe0
mov ebx, eax
test rdi, rdi
je 0x14000b094
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x14000b0ab
lea rcx, [rsp + 0x70]
call fcn.1400068b0
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140013730
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000bf70
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400382d0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], r8d
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140013730
add rsp, 0x48
ret

Function at 0x14000c080
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9, r8
mov r10, rdx
test r8, r8
jne 0x14000c098
lea eax, [r8 + 0xd]
add rsp, 0x38
ret
xor r8d, r8d
mov rdx, r9
nop
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x14000c0a4
inc eax
lea rdx, [rdx + rax*2]
lea r8d, [r8 + rax*2]
cmp eax, 1
jne 0x14000c0a0
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x14000c7a0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400382d0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x50], rax
test rax, rax
jne 0x14000c7e4
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140013730
add rsp, 0x40
pop rbx
ret
lea rax, [rsp + 0x30]
lea r8, [0x140008660]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x14000c825
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x50], rdi
mov rax, rdi
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140013730
add rsp, 0x40
pop rbx
ret

Function at 0x14000d1e0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp byte [0x14003ae31], 0
mov esi, edx
mov rdi, rcx
je 0x14000d206
or eax, 0xffffffff
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor ecx, ecx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.ole32.dll_CoInitialize]
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x14000d248
cmp eax, 0x80010106
jne 0x14000d284
lea rcx, str.Mscoree.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x14000d24c
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov byte [rdi + 0x62], 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [rsp + 0x40]
mov rcx, rdi
mov rdx, rax
call fcn.1400093e0
cmp al, 1
jne 0x14000d274
mov edx, esi
mov rcx, rdi
call fcn.14000bdf0
mov ebx, eax
jmp 0x14000d278
mov ebx, dword [rsp + 0x40]
cmp byte [rdi + 0x62], 0
je 0x14000d284
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000dfd0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
xor ebx, ebx
lea r8, str.GSDBFB22DB52F7
lea edx, [rbx + 1]
xor ecx, ecx
mov edi, r9d
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000e06b
xor ecx, ecx
mov qword [0x14003c940], rbp
call fcn.140008260
test al, al
je 0x14000e030
lea rcx, [0x14003af70]
mov edx, edi
call fcn.14000d1e0
mov ebx, eax
mov rdi, qword [0x14003c940]
lea rdx, str._profile
mov rcx, rdi
call fcn.140012830
test rax, rax
jne 0x14000e05f
lea rdx, str._import
mov rcx, rdi
call fcn.140012830
test rax, rax
je 0x14000e06b
mov rcx, qword [0x14003c940]
call fcn.140007740
test rsi, rsi
je 0x14000e079
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000e5b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400382d0]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
lea rax, [rsp + 0x30]
mov rbx, rdx
mov rdx, rcx
lea r9d, [rdi + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x3c], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x38], 4
test eax, eax
jne 0x14000e679
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.Install
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x38]
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x30]
lea rdx, str.Release
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000e67b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000e67b
mov dword [rbx], edi
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140013730
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14000f450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x2c0
mov rax, qword [0x1400382d0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbx, qword [0x14003cab0]
mov r14, rcx
movzx edx, dx
mov r8d, 0xf0
mov rcx, rbx
mov edi, 1
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14000f67d
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000f67d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14000f67d
mov qword [rsp + 0x2b8], rsi
mov qword [rsp + 0x2b0], r12
mov qword [rsp + 0x2a8], r13
mov qword [rsp + 0x2a0], r15
mov r13d, 0x403
mov r12d, 0x1234
xor r15d, r15d
mov qword [rsp + 0x2f0], rbp
nop dword [rax]
movzx esi, word [rbx]
cmp r15w, si
je 0x14000f637
movzx eax, word [rbx + 2]
mov ebp, dword [rbx + 4]
add rbx, 8
cmp r13w, ax
jne 0x14000f5ab
lea rcx, [rsp + 0x180]
xor edx, edx
mov r8d, 0x108
call fcn.140013840
lea rax, [rsp + 0x188]
lea rcx, [rsp + 0x180]
mov r8d, 3
mov rdx, rbx
mov qword [rsp + 0x180], rax
call fcn.14000fa20
mov rax, qword [rsp + 0x180]
mov rcx, qword [r14 + 8]
movzx edx, si
xor r9d, r9d
mov r8d, 0x143
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov rcx, qword [rsp + 0x180]
cmp rax, 0xffffffffffffffff
lea rax, [rsp + 0x188]
cmove edi, r15d
cmp rcx, rax
je 0x14000f62c
call fcn.140012430
jmp 0x14000f62c
cmp r12w, ax
jne 0x14000f62c
lea rax, [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov r8d, 3
mov rdx, rbx
mov dword [rsp + 0x140], 1
mov qword [rsp + 0x148], 0xffffffffffffffff
mov qword [rsp + 0x30], rax
call fcn.14000fa20
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x150], rcx
cmp rcx, rax
je 0x14000f601
call fcn.140012430
mov rcx, qword [r14 + 8]
lea rax, [rsp + 0x140]
movzx edx, si
xor r9d, r9d
mov r8d, 0x40b
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp rax, 0xffffffffffffffff
cmove edi, r15d
add rbx, rbp
test edi, edi
jne 0x14000f500
mov rbp, qword [rsp + 0x2f0]
mov r12, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2b8]
mov r13, qword [rsp + 0x2a8]
mov r15, qword [rsp + 0x2a0]
mov eax, edi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140013730
add rsp, 0x2c0
pop r14
pop rdi
pop rbx
ret
mov eax, edi
jmp 0x14000f661