joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021200]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020630]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020630]
call fcn.1400123b8
lea rcx, [0x140021200]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bh, bh
lea ebx, [rcx - 0x7b]
dec dword [rbp - 0x72007aa6]
pop rdx
test edi, edi
lea ebx, [rdx - 0x7b]
dec dword [rbp - 0x71007aa6]
pop rdx
xchg bh, bh
mov ds, word [rbx - 0x7a]
dec dword [rsi + 0x7eff865b]
jbe 0x14003f683
invalid
jle 0x14003f6d0
jbe 0x14003f687
invalid
jle 0x14003f6d4
jbe 0x14003f68b
invalid
jle 0x14003f6d9
jbe 0x14003f68f
invalid
jle 0x14003f6dd
jbe 0x14003f693
invalid
jg 0x14003f6e1
ja 0x14003f697
invalid
jg 0x14003f6e5
ja 0x14003f69b
invalid
jg 0x14003f6e9
ja 0x14003f69f
invalid
jg 0x14003f6ee
ja 0x14003f6a3
invalid
jg case.0x140007389.0
ja 0x14003f6a7
invalid
jg 0x14003f6f6
ja 0x14003f6ab
inc dword [rax - 0x7f0087b4]
or byte [rax + rdi*2 - 1], 0x80
js 0x14003f6b3
inc dword [rax - 0x7f0087b4]
or byte [rax + rdi*2 - 1], 0x80
js 0x14003f6bb
js 0x14003f6bb
inc dword [rax - 0x7f0087b3]
js 0x14003f6c3
or byte [rbp + 0x78], 0xff
or byte [rbp + 0x78], 0xff
inc dword [rcx - 0x7e0086b3]
jns 0x14003f6cb
jns 0x14003f6cb
or dword [rbp + 0x79], 0x794d81ff
jns 0x14003f6cb
inc dword [rcx - 0x7e0086b3]
jns 0x14003f6d3
jns 0x14003f6d3
or dword [rbp + 0x79], 0x794e81ff
or dword [rsi + 0x79], 0x794e81ff
inc dword [rcx + 0x72ff794e]
jns 0x14003f6d3
inc dword [rcx - 0x7e0086b2]
or dword [rsi + 0x79], 0x794e81ff
jns 0x14003f6db
push qword [rdx + 0x42]
jb 0x14003f720
imul edi, edi, 0x55
imul edi, edi, 0x55
sub al, 0x4f
call qword [rbp + 0x2c]
call qword [r13 + 0x2c]
push rbp
invalid
sub al, 0x4f
call qword [rbp + 0x2c]
push rbp
invalid
push rbp
sub al, 0x4f
call qword [rbp + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
push rbp
sub al, 0x4f
call qword [rbp + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
push rbp
sub al, 0x4f
call qword [rbp + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
call qword [r13 + 0x2c]
dec qword [r14 + 0x27]
invalid
Function at 0x1400111f4
Capabilities:
Terminate process

Disassembly:
jmp 0x140012e20
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001127b
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014170
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014190
xor al, al
jmp 0x140014211
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400141a3
xor al, al
jmp 0x140014211
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400141cd
xor al, al
jmp 0x140014211
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400141e1
xor al, al
jmp 0x140014211
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400141f3
xor al, al
jmp 0x140014211
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001420f
xor al, al
jmp 0x140014211
mov al, 1
add rsp, 0x38
ret
Function at 0x140f48058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140f481df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140f48089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f4806f
add dl, dl
jne 0x140f48096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f480f6
xor eax, eax
add dl, dl
jne 0x140f480a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f481ad
add dl, dl
jne 0x140f480b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f480c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f480d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f480dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140f480ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140f4807e
mov eax, 1
add dl, dl
jne 0x140f48106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f48113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f480fb
sub eax, ebx
mov ebx, 1
jne 0x140f4814c
mov ecx, 1
add dl, dl
jne 0x140f4812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f4813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f48123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f4807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140f48168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f48175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f4815d
cmp eax, 0x7d00
jae 0x140f4819b
cmp eax, 0x500
jb 0x140f48196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f4807e
cmp eax, 0x7f
ja 0x140f4819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f4807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140f481d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140f4807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140003470
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
push rdi
sub rsp, 0x80
mov eax, 0x6f46a6c8
mov edx, 0x1be882de
mov r8d, edx
mov r9b, 0xdb
mov r10b, byte [rsp + 0x7f]
mov r11b, r10b
or r11b, r11b
mov byte [rsp + 0x7f], r11b
mov qword [rsp + 0x68], 0xb5ea1e3
mov dword [rsp + 0x5c], 0x6f46a6c8
mov r11b, r10b
add r11b, 0xe9
mov byte [rsp + 0x7f], r11b
sub r9b, r10b
mov rsi, qword [rsp + 0x68]
sub r8, rsi
mov byte [rsp + 0x7f], r9b
mov qword [rsp + 0x50], r8
mov di, word [rsp + 0x62]
or di, di
mov r8, qword [0x1400d9b18]
mov word [rsp + 0x62], di
mov edx, dword [rsp + 0x5c]
mov ebx, edx
add ebx, 0x6ffb992
mov dword [rsp + 0x64], ebx
sub eax, edx
mov dword [rsp + 0x4c], eax
mov word [rsp + 0x62], 0xc01a
cmp r8, 0
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x3c], edx
mov byte [rsp + 0x3b], r10b
mov qword [rsp + 0x30], r8
je 0x140003586
jmp 0x14000355e
mov eax, 0xbf91b247
mov ecx, dword [rsp + 0x5c]
mov byte [rsp + 0x7f], 4
mov rdx, qword [rsp + 0x68]
xor rdx, 0x21298a1b
mov r8b, byte [rsp + 0x3b]
mov byte [rsp + 0x7f], r8b
sub eax, ecx
mov r9, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x3c]
xor ecx, 0xffffffff
mov dword [rsp + 0x64], ecx
mov byte [rsp + 0x7f], 0x34
mov dword [rsp + 0x4c], eax
cmp r9, rdx
jae 0x140003586
jmp 0x14000359c
mov eax, 0x6ff8fbf2
mov ecx, dword [rsp + 0x5c]
mov edx, dword [rsp + 0x5c]
xor ecx, 0x3aacafde
mov word [rsp + 0x62], 0x95da
sub eax, edx
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], ecx
je 0x14000355e
jmp 0x140003518
mov word [rsp + 0x62], 0x9450
mov eax, dword [rsp + 0x4c]
add rsp, 0x80
pop rdi
pop rbx
pop rsi
ret
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x3c]
mov dword [rsp + 0x64], ecx
xor eax, 0x6f46a6c9
mov qword [rsp + 0x70], 0x4b6db35b
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov dword [rsp + 0x2c], eax
call rdx
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x4c], eax
jmp 0x140003586

Function at 0x140004d50
Capabilities:
Encode data using xor

Disassembly:
add byte [rax - 0x77], cl
mov ah, 0x24
jo 0x140004d58
add byte [rax], al
add r11d, dword [rsp + 0x124]
mov dword [rsp + 0x168], 0xe4283696
mov rdi, qword [rsp + 0x158]
add byte [rbx + rax - 0x64], al
and al, 0x24
add dword [rax], eax
add bh, al
test byte [rax + rbp*2], ah
add dword [rax], eax
add byte [rsi + 0x48e42836], dl
mov edi, dword [rsp + 0x158]
mov qword [rsp + 0x170], rsi
add rdi, 0xffffffffa7eef4a9
mov dword [rsp + 0x14c], r11d
mov word [rsp + 0x17e], 0xbfc1
mov rbx, qword [rsp + 0xe8]
mov byte [rsp + 0x167], WSACancelAsyncRequest
add rbx, rcx
mov qword [rsp + 0x108], rbx
add r8b, 0xb
mov byte [rsp + 0x167], r8b
mov r9d, dword [rsp + 0x14c]
mov dword [rsp + 0x104], r9d
mov bp, word [rsp + 0xa2]
xor bp, 0xffff
mov word [rsp + 0x17e], bp
cmp rbx, rdi
je 0x140004a87
jmp 0x140004772
Function at 0x1400058cc
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x48]
mov cx, word [rsp + 0x52]
xor cx, 0xffff
mov word [rsp + 0x52], cx
xor rax, 0x1ff37939
mov dl, byte [rsp + 0x67]
add dl, 0xa7
mov r8, qword [rsp + 0x48]
xor r8, 0x1ff37918
mov r9, qword [rsp + 0x10]
add r9, r8
mov byte [rsp + 0x67], dl
cmp r9, rax
ror dword [rcx + rcx*4 + 0x4c], 0x24
invalid
je 0x140005808
jmp 0x1400057d0
mov eax, dword [rsp + 0xc]
mov dword [rsp + 8], eax
mov rax, qword [rsp + 0x18]
lea rcx, [0x1400cc4d0]
mov dx, word [rsp + 0x52]
or dx, 0xd501
mov word [rsp + 0x52], dx
mov r8d, dword [rcx + rax*4]
mov r9d, dword [rsp + 0x3c]
cmp r8d, r9d
mov qword [rsp + 0x10], rax
mov dword [rsp + 0xc], r8d
jb 0x1400057c6
jmp 0x140005782
mov qword [rsp + 0x58], 0x635d3eef
add rsp, 0x68
pop rbx
pop r14
pop rdi
pop rsi
ret
mov byte [r11 + rcx], al
add r10d, r9d
mov r9d, dword [rsp + 0x3c]
cmp r10d, r9d
mov dword [rsp + 8], r10d
jb 0x14000581b
jmp 0x140005782
Function at 0x140002c00
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x140002c2e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140003f50
cmp byte [0x140038090], 0
jne 0x140002c79
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002c69
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x140038090], 1
mov qword [0x140038088], rax
jmp 0x140002c80
mov rax, qword [0x140038088]
mov byte [0x140038090], 1
jmp 0x140002c80
mov rax, qword [0x140038088]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140002c9f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140003fc4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x140003fdf
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x140003fdf
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x140003fdf
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x140003cb0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1400354c0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor eax, eax
xor ebp, ebp
mov rsi, rdx
mov r8, rdx
mov rdx, qword [rcx]
mov rdi, rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x40]
or r9d, 0x2001f
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x50], rbp
call fcn.140003750
mov ebx, eax
test eax, eax
jne 0x140003dd7
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x58], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140003db1
nop dword [rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.140003cb0
mov ebx, eax
test eax, eax
jne 0x140003dd7
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x58], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140003d60
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140003dc6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x48], ebp
call fcn.140002c00
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140003de7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140012700
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140003f50
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x140002c2e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140003f50
cmp byte [0x140038090], 0
jne 0x140002c79
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002c69
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x140038090], 1
mov qword [0x140038088], rax
jmp 0x140002c80
mov rax, qword [0x140038088]
mov byte [0x140038090], 1
jmp 0x140002c80
mov rax, qword [0x140038088]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140002c9f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140003fc4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x140003fdf
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x140003fdf
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x140003fdf
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x1400041e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1400354c0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x50], r14
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], r14
xor edx, edx
mov r8d, 0x408
lea rcx, [rsp + 0x70]
call fcn.140012810
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000428c
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000428c
call fcn.140002220
mov ebx, eax
jmp 0x1400043b4
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x1400042ad
call fcn.140002220
jmp 0x1400043a3
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1400042d0
call fcn.140002220
jmp 0x1400043a3
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x1400042f2
mov ebx, 0x8007000e
jmp 0x1400043a5
mov ecx, eax
test eax, eax
je 0x14000432a
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x140004320
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14000432a
lea rcx, [rsp + 0x70]
call fcn.140002100
jmp 0x140004334
mov ecx, 0x80070216
call fcn.140002430
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x140004347
cmp qword [rsp + 0x70], 0
jne 0x140004356
mov ebx, 0x8007000e
jmp 0x1400043a5
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140004380
call fcn.140002220
jmp 0x1400043a3
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.140004000
mov ebx, eax
test rdi, rdi
je 0x1400043b4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x1400043cb
lea rcx, [rsp + 0x70]
call fcn.140002cf0
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140012700
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004bf0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400354c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], r8d
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140012700
add rsp, 0x48
ret

Function at 0x140004c40
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9, r8
mov r10, rdx
test r8, r8
jne 0x140004c58
lea eax, [r8 + 0xd]
add rsp, 0x38
ret
xor r8d, r8d
mov rdx, r9
nop
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x140004c64
inc eax
lea rdx, [rdx + rax*2]
lea r8d, [r8 + rax*2]
cmp eax, 1
jne 0x140004c60
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret
Function at 0x140008f80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x2c0
mov rax, qword [0x1400354c0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbx, qword [0x1400382d0]
mov r14, rcx
movzx edx, dx
mov r8d, 0xf0
mov rcx, rbx
mov edi, 1
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400091ad
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400091ad
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400091ad
mov qword [rsp + 0x2b8], rsi
mov qword [rsp + 0x2b0], r12
mov qword [rsp + 0x2a8], r13
mov qword [rsp + 0x2a0], r15
mov r13d, 0x403
mov r12d, 0x1234
xor r15d, r15d
mov qword [rsp + 0x2f0], rbp
nop dword [rax]
movzx esi, word [rbx]
cmp r15w, si
je 0x140009167
movzx eax, word [rbx + 2]
mov ebp, dword [rbx + 4]
add rbx, 8
cmp r13w, ax
jne 0x1400090db
lea rcx, [rsp + 0x180]
xor edx, edx
mov r8d, 0x108
call fcn.140012810
lea rax, [rsp + 0x188]
lea rcx, [rsp + 0x180]
mov r8d, 3
mov rdx, rbx
mov qword [rsp + 0x180], rax
call fcn.14000a210
mov rax, qword [rsp + 0x180]
mov rcx, qword [r14 + 8]
movzx edx, si
xor r9d, r9d
mov r8d, 0x143
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov rcx, qword [rsp + 0x180]
cmp rax, 0xffffffffffffffff
lea rax, [rsp + 0x188]
cmove edi, r15d
cmp rcx, rax
je 0x14000915c
call fcn.140011750
jmp 0x14000915c
cmp r12w, ax
jne 0x14000915c
lea rax, [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov r8d, 3
mov rdx, rbx
mov dword [rsp + 0x140], 1
mov qword [rsp + 0x148], 0xffffffffffffffff
mov qword [rsp + 0x30], rax
call fcn.14000a210
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x150], rcx
cmp rcx, rax
je 0x140009131
call fcn.140011750
mov rcx, qword [r14 + 8]
lea rax, [rsp + 0x140]
movzx edx, si
xor r9d, r9d
mov r8d, 0x40b
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp rax, 0xffffffffffffffff
cmove edi, r15d
add rbx, rbp
test edi, edi
jne 0x140009030
mov rbp, qword [rsp + 0x2f0]
mov r12, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2b8]
mov r13, qword [rsp + 0x2a8]
mov r15, qword [rsp + 0x2a0]
mov eax, edi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140012700
add rsp, 0x2c0
pop r14
pop rdi
pop rbx
ret
mov eax, edi
jmp 0x140009191
Function at 0x1400096d0
Capabilities:
Get keyboard layout
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x120
mov rax, qword [0x1400354c0]
xor rax, rsp
mov qword [rsp + 0x110], rax
xor ebx, ebx
lea rdx, [rsp + 0x20]
lea ecx, [rbx + 0x1e]
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edi, ax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
cmp di, ax
jne 0x140009774
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ecx, ebx
nop dword [rax + rax]
cmp ax, word [rsp + rcx*8 + 0x20]
jne 0x14000972c
mov rbx, qword [rsp + rcx*8 + 0x20]
cmp ax, word [rsp + rcx*8 + 0x28]
jne 0x140009738
mov rbx, qword [rsp + rcx*8 + 0x28]
cmp ax, word [rsp + rcx*8 + 0x30]
jne 0x140009744
mov rbx, qword [rsp + rcx*8 + 0x30]
cmp ax, word [rsp + rcx*8 + 0x38]
jne 0x140009750
mov rbx, qword [rsp + rcx*8 + 0x38]
cmp ax, word [rsp + rcx*8 + 0x40]
jne 0x14000975c
mov rbx, qword [rsp + rcx*8 + 0x40]
cmp ax, word [rsp + rcx*8 + 0x48]
jne 0x140009768
mov rbx, qword [rsp + rcx*8 + 0x48]
add rcx, 6
cmp rcx, 0x1e
jl 0x140009720
jmp 0x1400097c9
mov rax, rbx
cmp di, word [rsp + rax*8 + 0x20]
jne 0x140009783
mov rbx, qword [rsp + rax*8 + 0x20]
cmp di, word [rsp + rax*8 + 0x28]
jne 0x14000978f
mov rbx, qword [rsp + rax*8 + 0x28]
cmp di, word [rsp + rax*8 + 0x30]
jne 0x14000979b
mov rbx, qword [rsp + rax*8 + 0x30]
cmp di, word [rsp + rax*8 + 0x38]
jne 0x1400097a7
mov rbx, qword [rsp + rax*8 + 0x38]
cmp di, word [rsp + rax*8 + 0x40]
jne 0x1400097b3
mov rbx, qword [rsp + rax*8 + 0x40]
cmp di, word [rsp + rax*8 + 0x48]
jne 0x1400097bf
mov rbx, qword [rsp + rax*8 + 0x48]
add rax, 6
cmp rax, 0x1e
jl 0x140009777
mov rax, rbx
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140012700
mov rbx, qword [rsp + 0x130]
add rsp, 0x120
pop rdi
ret