joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c37c
Capabilities:
Get disk size

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rdx
mov r14, rcx
mov r12d, 0x5c
mov edx, r12d
mov rcx, rsi
mov rdi, r9
mov rbp, r8
call fcn.1400e839c
xor r15d, r15d
mov rbx, rax
test rax, rax
je 0x14000c3cc
mov word [rax], r15w
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x14000c474
test rbx, rbx
je 0x14000c3f3
mov word [rbx], r12w
cmp qword [rsp + 0x20], rbp
jbe 0x14000c401
mov eax, 1
jmp 0x14000c476
test rdi, rdi
je 0x14000c474
mov rcx, qword [0x1401745a0]
mov ebx, 0x104
lea r8, [rsp + 0x30]
mov r9d, ebx
mov edx, 0x16
call fcn.140022af0
test eax, eax
jne 0x14000c449
movzx edx, word [0x140169024]
lea r8, [rsp + 0x30]
lea rcx, [0x140169026]
xor edx, 0xc7c7
mov r9d, ebx
call fcn.14001af80
movzx r8d, word [rsi]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [0x140128df8]
mov r9d, InitCommonControls
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400e79e0
add rsp, 0x250
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000d058
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rbp, r8
mov rsi, rcx
mov rdi, qword [rdx]
xor edx, edx
mov ebx, edx
mov dword [rsp + 0x78], edx
test rdi, rdi
je 0x14000d2a7
lea eax, [rdx + 0x5c]
cmp byte [rsi + 0x318], dl
jne 0x14000d2a3
lea r8, [rdi + 0x50]
mov dword [rsp + 0x28], 0x104
or r9d, 0xffffffff
mov ecx, 0xfde9
cmp byte [rdi + 0x18], dl
mov word [rbp], ax
lea rax, [rbp + 2]
mov qword [rsp + 0x20], rax
je 0x14000d179
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rsi + 0x102]
or rbx, 0xffffffffffffffff
xor edx, edx
inc rbx
cmp word [rcx + rbx*2], dx
jne 0x14000d0db
cmp rbx, 0x11
jbe 0x14000d136
mov edx, 0xf71e6ac9
mov r8d, 0x24
lea rcx, [0x14016739a]
call fcn.1400013a8
mov r8, rax
lea rax, [rsi + 0xe0]
lea rax, [rax + rbx*2]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000d126
add rax, 2
test ecx, ecx
jne 0x14000d112
test edx, edx
sete al
lea rcx, [rsi + 0x102]
xor edx, edx
jmp 0x14000d138
mov al, dl
test al, al
jne 0x14000d16c
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
or rax, 0xffffffffffffffff
xor ecx, ecx
inc rax
cmp word [rbp + rax*2], cx
jne 0x14000d14a
lea r8, [rax*2]
add r8, rbp
mov rdx, rdi
mov rcx, rsi
call fcn.14000d058
xor edx, edx
mov word [rbp], dx
mov ebx, dword [rsp + 0x78]
jmp 0x14000d283
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rsp + 0x30]
call fcn.140021c80
nop
lea rdx, [rsi + 0x102]
mov r8d, 6
lea rcx, [rsp + 0x30]
call fcn.140021cdc
xor r8d, r8d
test al, al
je 0x14000d297
mov rbp, qword [rdi + 0x38]
mov rdx, qword [rsi + 0x590]
mov qword [rsp + 0x40], rdx
mov ecx, r8d
mov qword [rsp + 0x38], rcx
test rbp, rbp
je 0x14000d253
cmp byte [rsi + 0x318], r8b
jne 0x14000d24f
mov eax, 0x10000
mov ebx, eax
cmp rbp, rax
cmovb ebx, ebp
lea eax, [rbx + 0x7ff]
shr eax, 0xb
add dword [rsi + 0x56c], eax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
mov r9, rdx
mov r8, rcx
mov rdx, rdi
mov rcx, qword [rsi + 0x598]
call fcn.140058ed0
cmp dword [rsp + 0x88], ebx
jne 0x14000d24f
mov r8d, ebx
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140021e70
mov rcx, qword [rsp + 0x38]
add rcx, rbx
mov qword [rsp + 0x38], rcx
xor r8d, r8d
sub rbp, rbx
mov rdx, qword [rsp + 0x40]
jne 0x14000d1cf
mov ebx, dword [rsp + 0x78]
lea rcx, [rsp + 0x30]
call fcn.140021c90
mov rbp, qword [rsp + 0x80]
xor ecx, ecx
mov word [rbp], cx
inc dword [rsi + 0x574]
inc ebx
mov dword [rsp + 0x78], ebx
lea rcx, [rsp + 0x30]
call fcn.140021c88
xor edx, edx
mov rdi, qword [rdi + 8]
test rdi, rdi
mov eax, 0x5c
jne 0x14000d08f
jmp 0x14000d2a7
lea rcx, [rsp + 0x30]
call fcn.140021c88
jmp 0x14000d2a7
xor eax, eax
jmp 0x14000d2a9
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000da00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x570]
sub rsp, 0x670
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x560], rax
mov rbx, rdx
mov edx, 0x33
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call fcn.14000d990
xor r15d, r15d
lea r8, [rbp + 0x40]
lea edx, [r15 + 0x37]
mov r9d, 0x104
mov rcx, rdi
movzx r14d, ax
mov word [rbp + 0x40], r15w
call qword [sym.imp.USER32.dll_GetDlgItemTextW]
cmp word [rbp + 0x40], r15w
jne 0x14000da76
xor al, al
jmp 0x14000dbf4
cmp byte [rbx + 0x319], r15b
je 0x14000db0d
lea rcx, [rbp + 0x40]
call fcn.14001f944
test al, al
je 0x14000db0d
mov rcx, qword [0x1401745a0]
mov esi, pe_nt_image_headers64
lea r8, [rsp + 0x40]
lea edx, [rsi - 0x46]
mov r9d, esi
call fcn.140022af0
test eax, eax
jne 0x14000dad1
movzx edx, word [0x140169502]
lea r8, [rsp + 0x40]
lea rcx, [0x140169504]
xor edx, 0xc7c7
mov r9d, esi
call fcn.14001af80
lea r8, [rbp + 0x40]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x250]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [0x140128df8]
lea rdx, [rbp + 0x250]
mov r9d, 0x34
mov rcx, rdi
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x14000da6f
mov word [rbx + 2], r15w
lea rsi, [rbx + 0x102]
lea rdx, [rbp + 0x40]
mov word [rsi], r15w
mov dword [rbx + 0x31a], r15d
mov byte [rbx + 0x318], r15b
mov qword [rbx + 0x358], r15
mov word [rbx + 0x360], r15w
mov rcx, rsi
mov qword [rbx + 0x568], r15
mov qword [rbx + 0x570], r15
mov qword [rbx + 0x578], r15
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, 5
mov rcx, rdi
mov dword [rbx + 0x358], r15d
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov r8, rdi
cmp eax, 1
movzx edx, r14w
mov rcx, rbx
sete al
mov byte [rbx + 0x31a], al
call fcn.14000c4fc
test al, al
je 0x14000da6f
movzx eax, byte [rbx + 0x31a]
mov rcx, qword [0x1401745a8]
mov rdx, rsi
shl eax, 0xa
xor eax, dword [rcx + 0x24]
and eax, 0x400
xor dword [rcx + 0x24], eax
call fcn.14000bc64
mov rcx, qword [0x1401745a8]
call fcn.14000ac78
lea rax, [rsp + 0x30]
lea r8, [0x14000ca94]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rbx + 0x580], rax
setne al
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.1400e79e0
mov rbx, qword [rsp + 0x6b0]
add rsp, 0x670
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000dc1c
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx eax, word [rcx]
xor esi, esi
lea rbx, [rcx + 2]
mov dword [rsp + 0x38], esi
mov qword [r11 - 0x38], rsi
mov qword [r11 - 0x40], rsi
lea r9, [r11 - 0x28]
lea rcx, [r11 - 0x20]
mov rdx, rbx
mov r8d, pe_nt_image_headers64
mov word [rsp + 0x48], ax
mov dword [rsp + 0x4a], 0x5c003a
mov word [rsp + 0x4e], si
mov word [rbx], si
mov qword [r11 - 0x48], rsi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov edi, eax
test eax, eax
je 0x14000dcb3
cmp word [rbx], si
jne 0x14000dcb3
mov edx, 0xf460b737
mov ecx, 0x4203c09a
mov r8d, 0x926a7f3
call fcn.140001420
sub rbx, rax
movzx ecx, word [rax]
mov word [rbx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000dca3
mov eax, edi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400e79e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000f810
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov edx, 0x32
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 0x33
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rsi, rax
call fcn.140004748
xor r8d, r8d
mov edx, 0x1303
mov rcx, rbx
mov r9, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, [rsp + 0x20]
lea rcx, [fcn.14000f4d0]
xor r14d, r14d
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], r14d
call fcn.1400097e8
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1304
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x14000f8e6
mov edx, dword [rsp + 0x30]
mov rcx, rbx
call fcn.14000f720
movsxd r8, dword [rsp + 0x30]
xor r9d, r9d
mov edx, 0x130c
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x14000f9e8
mov edx, 5
mov rcx, rsi
call qword [sym.imp.USER32.dll_ShowWindow]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov edx, 0xb2
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0xfffffff9
lea rcx, [rsp + 0x38]
mov r8d, edx
call qword [sym.imp.USER32.dll_InflateRect]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov edx, 0xb4
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9d, 0xf9f9f9
xor r8d, r8d
mov edx, 0x443
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1401745a0]
mov ebx, 0x100
mov esi, InitCommonControls
lea r8, [rsp + 0x50]
mov r9d, ebx
mov edx, esi
call fcn.140022af0
test eax, eax
jne 0x14000f98f
movzx edx, word [0x140168b1e]
lea r8, [rsp + 0x50]
lea rcx, [0x140168b20]
xor edx, 0xc7c7
mov r9d, ebx
call fcn.14001af80
lea rcx, [rsp + 0x50]
lea rax, [rbp + 0x150]
cmp word [rsp + 0x50], r14w
je 0x14000f9cf
mov r8d, 0xa
movzx edx, word [rcx]
cmp dx, r8w
jne 0x14000f9be
mov dword [rax], 0xa000d
add rax, 4
jmp 0x14000f9c5
mov word [rax], dx
add rax, 2
add rcx, 2
cmp word [rcx], r14w
jne 0x14000f9a9
lea r8, [rbp + 0x150]
mov edx, 0x33
mov rcx, rdi
mov word [rax], r14w
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rax, qword [0x1401745b0]
mov qword [rax + 0x18], rdi
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.1400e79e0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000fdd0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp word [rdx], 0x2f
mov rbx, rdx
mov rdi, rcx
jne 0x14000fee5
mov edx, 0x9c93cd39
mov ecx, 0xca9de79f
mov r8d, 0xfc815fd2
add rbx, 2
call fcn.140001528
mov rdx, rbx
sub rax, rbx
movzx r8d, word [rdx]
movzx r9d, word [rdx + rax]
sub r8d, r9d
jne 0x14000fe35
add rdx, 2
test r9d, r9d
jne 0x14000fe1e
test r8d, r8d
jne 0x14000fe51
mov rcx, rdi
call fcn.14000fcc4
mov ecx, 1
call fcn.140006590
jmp 0x14000ffda
mov edx, 0xdd6d1e6b
mov ecx, 0x8b6334bd
mov r8d, 0xbd7f8c80
call fcn.140001528
mov rcx, rbx
sub rax, rbx
movzx edx, word [rcx]
movzx r8d, word [rcx + rax]
sub edx, r8d
jne 0x14000fe82
add rcx, 2
test r8d, r8d
jne 0x14000fe6c
test edx, edx
jne 0x14000fe95
mov dl, 1
mov rcx, rdi
call fcn.14001ba84
jmp 0x14000ffda
mov edx, 0xd5f43c6f
mov ecx, 0x83fa16a9
mov r8d, 0xb5e6ae8b
call fcn.140001528
sub rax, rbx
movzx ecx, word [rbx]
movzx edx, word [rbx + rax]
sub ecx, edx
jne 0x14000fec0
add rbx, 2
test edx, edx
jne 0x14000fead
test ecx, ecx
jne 0x14000ffda
lea r8d, [rcx + 9]
lea rcx, [0x140167962]
mov edx, 0x210c4e85
call fcn.1400014b0
mov rcx, rax
jmp 0x14000ffd5
mov edx, 0x749f82f7
mov ecx, 0x2291a80f
mov r8d, 0x148d101e
call fcn.140001528
mov r8d, 4
mov rcx, rbx
mov rdx, rax
call fcn.1400e98f4
test eax, eax
jne 0x14000ff1c
mov rcx, rbx
call fcn.14001f5c4
jmp 0x14000ffda
cmp word [rbx + 2], 0x3a
jne 0x14000ff7c
mov rcx, rbx
call fcn.14001f95c
test al, al
je 0x14000ff66
mov edx, 0xecc2e2f4
mov ecx, 0xbaccc818
mov r8d, 0x8cd0701d
call fcn.140001528
xor r9d, r9d
mov r8, rbx
mov rcx, rdi
mov rdx, rax
mov dword [rsp + 0x28], 5
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x14000ffda
mov rcx, rbx
call fcn.14001f944
test al, al
je 0x14000ffda
mov rcx, rbx
call fcn.140016428
jmp 0x14000ffda
mov edx, 0xed7d04d2
mov ecx, 0xbb732fc2
mov r8d, 0x8d6f9638
call fcn.140001528
mov rcx, rbx
mov rdx, rax
call fcn.1400e9920
test rax, rax
je 0x14000ffda
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x40]
or r9d, 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rsp + 0x40]
call fcn.140004878
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400e79e0
mov rbx, qword [rsp + 0x170]
add rsp, 0x150
pop rdi
ret
Function at 0x140011328
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, qword [0x1401747d0]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov edx, 0x101f
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x1200
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rdi, eax
cmp rdi, 0x15
ja 0x1400114bc
and dword [rbp - 0x49], 0
xor edx, edx
lea rcx, [rbp - 0x45]
lea r8d, [rdx + 0x50]
call fcn.1400ea1b0
lea r9, [rbp - 0x49]
mov r8, rdi
mov edx, 0x103b
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x1400114bc
xor eax, eax
mov byte [rbp + 0x17], 0
lea rcx, [rbp + 0x17]
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], rax
mov dword [rbp + 0x28], eax
xor edx, edx
lea r8, [0x140167620]
test dword [r8 + rdx*4], 0x1000
je 0x1400113e6
mov byte [rcx], al
inc rcx
inc eax
movsxd rdx, eax
cmp rdx, 0x15
jb 0x1400113d0
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov byte [rbp + 0x2f], 0
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x40], eax
test rdi, rdi
jle 0x140011436
lea rdx, [rbp + 0x2f]
movsxd rax, dword [rbp + rcx*4 - 0x49]
cmp rax, 0x15
jae 0x14001142e
movzx r8d, byte [rbp + rax + 0x17]
cmp r8, 0x15
jae 0x14001142e
mov byte [rdx], r8b
inc ebx
inc rdx
inc rcx
cmp rcx, rdi
jl 0x14001140f
mov rdx, qword [0x140174678]
lea r8, [rbp - 0x59]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1400114bc
test ebx, ebx
jne 0x14001147a
mov edx, 0x8407a75b
mov ecx, 0x9ebdfdc7
mov r8d, 0x11bb9bff
call fcn.140001378
mov rcx, qword [rbp - 0x59]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1400114b2
mov edx, 0x1ab8eaf1
mov ecx, 0x2b003
mov r8d, 0x8f04d655
call fcn.140001378
mov rcx, qword [rbp - 0x59]
mov r9d, 3
mov rdx, rax
lea rax, [rbp + 0x2f]
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400e79e0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14001241c
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov edx, 0x202b488b
mov ecx, 0x76256441
mov r8d, 0x4039da6e
call fcn.140001528
lea rdx, [rsp + 0x30]
sub rdx, rax
xor edi, edi
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14001245a
lea rcx, [rsp + 0x40]
call fcn.140031dc4
mov edx, 0xfec7267f
mov ecx, 0xa8c90a99
mov r8d, 0x9ed5b49a
mov rbx, rax
call fcn.140001528
sub rbx, rax
movzx ecx, word [rax]
mov word [rbx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14001248f
mov edx, 0xc159a71a
mov ecx, 0x97578a1c
mov r8d, 0xa14b35ff
call fcn.140001528
mov edx, 0xf7fe5200
mov ecx, 0xa1f07f12
mov r8d, 0x97ecc0e9
mov rbx, rax
call fcn.140001528
lea r9, [rsp + 0x30]
mov r8, rbx
xor ecx, ecx
mov rdx, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400e79e0
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
Function at 0x140012cc8
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0xf8]
sub rsp, 0x1e0
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov edx, 0x33
mov r15, rcx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r14, rax
call qword [sym.imp.USER32.dll_CreatePopupMenu]
xor edx, edx
lea rcx, [rbp - 0x78]
lea r8d, [rdx + 0x48]
mov dword [rbp - 0x80], 0x50
mov rsi, rax
mov dword [rbp - 0x7c], 0x43
call fcn.1400ea1b0
lea rax, [rbp - 0x30]
mov ebx, 1
lea rdi, [0x140167624]
mov qword [rbp - 0x48], rax
cmp ebx, 0xc
je 0x140012d83
mov ecx, dword [rdi]
lea rdx, [rbp - 0x30]
mov r8d, pe_nt_image_headers64
and ecx, 0x3f
call fcn.1400109bc
mov eax, dword [rdi]
lea r9, [rbp - 0x80]
shr eax, 9
mov r8d, 1
or edx, 0xffffffff
and eax, 8
mov rcx, rsi
mov dword [rbp - 0x70], ebx
mov dword [rbp - 0x74], eax
call qword [sym.imp.USER32.dll_InsertMenuItemW]
inc ebx
add rdi, 4
movsxd rax, ebx
cmp rax, 0x15
jb 0x140012d46
call qword [sym.imp.USER32.dll_GetMessagePos]
xor edi, edi
mov edx, 0x180
mov ecx, eax
mov qword [rsp + 0x30], rdi
movsx r8d, ax
shr ecx, 0x10
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], edi
movsx r9d, cx
mov rcx, rsi
call qword [sym.imp.USER32.dll_TrackPopupMenu]
mov rcx, rsi
movsxd rbx, eax
call qword [sym.imp.USER32.dll_DestroyMenu]
test ebx, ebx
jle 0x140012e9b
mov rax, rbx
cmp rbx, 0x15
ja 0x140012e9b
lea r8, [0x140167620]
mov ecx, edi
mov edx, 0x1000
test ebx, ebx
jle 0x140012e06
test dword [r8 + rcx*4], edx
je 0x140012dfe
inc edi
inc rcx
cmp rcx, rax
jl 0x140012df6
mov ebx, dword [r8 + rbx*4]
not ebx
xor ebx, dword [r8 + rax*4]
and ebx, edx
xor ebx, dword [r8 + rax*4]
mov dword [r8 + rax*4], ebx
test edx, ebx
je 0x140012e87
xor edx, edx
lea rcx, [rsp + 0x44]
lea r8d, [rdx + 0x34]
call fcn.1400ea1b0
mov ecx, ebx
lea rax, [rbp - 0x30]
and ecx, 0x3f
shr ebx, 0xd
lea rdx, [rbp - 0x30]
and ebx, 0x1ffff
mov r8d, pe_nt_image_headers64
mov dword [rsp + 0x40], InitCommonControls
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x5c], ecx
mov dword [rsp + 0x48], ebx
call fcn.1400109bc
lea r9, [rsp + 0x40]
movsxd r8, edi
mov edx, 0x1061
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, r14
mov rcx, r15
call fcn.1400114e0
jmp 0x140012e9b
movsxd r8, edi
xor r9d, r9d
mov edx, 0x101c
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.1400e79e0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400134f4
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x360], rax
mov r14, rdx
mov rdx, qword [0x140174670]
mov rsi, rcx
lea r8, [rsp + 0x30]
xor ebx, ebx
mov rcx, 0xffffffff80000001
mov dil, bl
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea r15d, [rbx + 1]
test eax, eax
je 0x140013551
jmp 0x1400135eb
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x150]
lea rdx, [0x140128df8]
xor r8d, r8d
mov dword [rsp + 0x3c], r15d
mov dword [rsp + 0x38], 0x106
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400135e0
lea rcx, [rsp + 0x40]
call fcn.14000ad3c
mov rcx, qword [rsp + 0x30]
lea rdx, [0x140128df8]
add eax, eax
mov r9d, r15d
xor r8d, r8d
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
movzx edi, dil
test eax, eax
cmove edi, r15d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test dil, dil
mov edx, 4
mov rcx, rsi
setne bl
mov r8d, ebx
call qword [sym.imp.USER32.dll_CheckDlgButton]
mov r8d, dword [r14 + 0x28]
mov edx, 5
shr r8d, 0x1f
mov rcx, rsi
call qword [sym.imp.USER32.dll_CheckDlgButton]
mov r8d, dword [r14 + 0x24]
mov edi, 7
shr r8d, 8
mov edx, edi
mov rcx, rsi
and r8d, r15d
call qword [sym.imp.USER32.dll_CheckDlgButton]
mov r8d, dword [r14 + 0x24]
lea edx, [rdi - 1]
shr r8d, 0x1e
mov rcx, rsi
and r8d, r15d
call qword [sym.imp.USER32.dll_CheckDlgButton]
mov r8d, dword [r14 + 0x24]
lea edx, [rdi + 2]
shr r8d, 0x1b
mov rcx, rsi
and r8d, r15d
call qword [sym.imp.USER32.dll_CheckDlgButton]
lea edx, [rdi + 1]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, edi
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.1400133ec
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.1400e79e0
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x470
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400162c4
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rcx
mov rcx, qword [0x1401745a8]
mov rbx, rdx
lea rdx, [rsp + 0x20]
xor r8d, r8d
call fcn.14000af2c
test al, al
je 0x140016314
lea r8, [rsp + 0x20]
mov edx, 0x32
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rcx, qword [0x1401745a8]
lea rdx, [rsp + 0x20]
call fcn.14000b110
lea r8, [rsp + 0x20]
mov edx, 0x33
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov r8d, dword [rbx + 0x24]
mov edx, 6
shr r8d, 0x19
mov rcx, rdi
and r8d, 1
call qword [sym.imp.USER32.dll_CheckDlgButton]
mov rax, qword [0x1401745a8]
xor ebx, ebx
cmp qword [rax + 0x38], rbx
mov edx, 6
mov rcx, rdi
setne bl
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
mov edx, 0x50
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, qword [0x1401745a8]
mov rdx, qword [rcx + 0x38]
mov rcx, rax
mov rbx, rax
neg rdx
sbb edx, edx
not edx
and edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1401745a8]
cmp qword [rcx + 0x38], 0
jne 0x140016406
mov edx, 0x9e1fcbe5
mov ecx, 0xc811e51f
mov r8d, 0xfe0d5904
call fcn.140001528
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x50
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 6
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.1400133ec
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400e79e0
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rdi
ret

Function at 0x140016428
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov rbx, rcx
mov edx, 0xcf552735
mov r8d, 0xaf47b5c8
mov ecx, 0x995b082b
call fcn.140001528
lea rcx, [rbp - 0x20]
mov r8, rbx
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
xor ebx, ebx
lea rcx, [rsp + 0x78]
lea r8d, [rbx + 0x60]
xor edx, edx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.1400ea1b0
lea rax, [rsp + 0x50]
lea edi, [rbx + 1]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x70], 0x68
mov dword [rbp - 0x54], edi
mov dword [rsp + 0x20], ebx
mov word [rbp - 0x50], di
mov qword [rbp - 0x78], rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, edi
jne 0x140016506
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, dil
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.1400e79e0
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret