joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000652c
Capabilities:
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rdx, qword [0x140050ce8]
xor r12d, r12d
mov rbp, rcx
mov edi, 1
test rdx, rdx
je 0x140006580
mov rcx, rdx
call fcn.1400059e0
mov edx, r12d
mov qword [0x140050ce8], rdx
cmp qword [0x140051660], r12
je 0x140006759
call fcn.140013fc4
test rax, rax
je 0x140006759
call fcn.140013fc4
mov esi, 0x104
lea rbx, [0x14003f4a0]
mov edx, esi
lea rcx, [rsp + 0x50]
cmp qword [rax + 0x60], r12
cmovne rbx, qword [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
je 0x140006752
lea r8, str._notepad.exe
mov edx, esi
lea rcx, [rsp + 0x50]
call fcn.140001584
or r14d, 0xffffffff
test eax, eax
js 0x14000661e
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, r14d
je 0x1400065f9
test al, 0x10
je 0x14000661e
mov edx, esi
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14000661e
lea r8, str._notepad.exe
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140001584
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, r14d
je 0x140006752
test al, 0x10
jne 0x140006752
test rbx, rbx
je 0x140006752
lea rdx, [0x14003f4a0]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x140006752
mov rcx, rbx
call fcn.140017488
test eax, eax
je 0x140006752
mov rcx, qword [0x140050d10]
lea r8, [rsp + 0x260]
mov r9d, 0xff
lea edx, [r9 - 0x55]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x140006752
movsxd rax, dword [0x140050cd8]
lea rcx, [rax + rax*2]
mov rax, qword [str.6ij]
add rcx, rcx
mov r14d, dword [rax + rcx*8 + 0x2c]
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
mov edx, r14d
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 0x402
mov rcx, rbp
mov r15, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rsi, rax
test rax, rax
jne 0x1400066f4
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
mov edx, 0x402
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rsi, rax
mov ecx, 0x48
call fcn.14003c414
test rax, rax
je 0x140006746
mov qword [rsp + 0x40], r15
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x38], r14d
mov r9, rsi
mov qword [rsp + 0x30], rbx
mov r8d, 0x402
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x260]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140013474
mov rdx, rax
mov qword [0x140050ce8], rax
jmp 0x140006759
mov rdx, r12
mov qword [0x140050ce8], rdx
jmp 0x140006759
mov rdx, qword [0x140050ce8]
test rdx, rdx
cmove edi, r12d
mov eax, edi
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14003c810
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140006a94
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x58
xor ebx, ebx
lea rax, [rbp + 0x30]
mov qword [rsp + 0x40], rbx
lea rdx, str.SoftwareMicrosoftMediaPlayerPreferences
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 1
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], ebx
mov qword [rbp + 0x30], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140006b37
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x18]
lea rax, [rbp + 0x20]
mov dword [rbp + 0x20], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.AcceptedPrivacyStatement
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x18], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140006b2d
cmp dword [rbp + 0x18], 4
jne 0x140006b2d
cmp dword [rbp + 0x20], 1
sete bl
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x58
pop rbx
pop rbp
ret
Function at 0x140006b48
Capabilities:
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x580], rax
xor r12d, r12d
mov rsi, rcx
cmp qword [0x140050ce8], r12
mov ebx, 1
jne 0x140006d9b
mov edi, 0x104
lea rcx, [rbp + 0x160]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
je 0x140006d8d
lea r8, str._notepad.exe
mov edx, edi
lea rcx, [rbp + 0x160]
call fcn.140001584
or r15d, 0xffffffff
mov r14b, 0x10
test eax, eax
js 0x140006c0e
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, r15d
je 0x140006be5
test r14b, al
je 0x140006c0e
mov edx, edi
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140006c0e
lea r8, str._notepad.exe
mov rdx, rdi
lea rcx, [rbp + 0x160]
call fcn.140001584
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, r15d
je 0x140006d8d
test r14b, al
jne 0x140006d8d
mov r8d, edi
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140006d8d
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_wcsrchr]
test rax, rax
je 0x140006c61
mov word [rax + 2], r12w
jmp 0x140006c67
mov word [rsp + 0x50], r12w
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea r8, str.eula.txt
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140001584
test eax, eax
js 0x140006d8d
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, r15d
je 0x140006d8d
test r14b, al
jne 0x140006d8d
mov rcx, qword [0x140050d10]
lea r8, [rbp + 0x370]
mov r9d, 0xff
lea edx, [r9 - 0x55]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x140006d8d
movsxd rax, dword [0x140050cd8]
lea rcx, [rax + rax*2]
mov rax, qword [str.6ij]
add rcx, rcx
mov r14d, dword [rax + rcx*8 + 0x2c]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
mov edx, r14d
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 0x402
mov rcx, rsi
mov r15, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdi, rax
test rax, rax
jne 0x140006d33
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
mov edx, 0x402
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdi, rax
mov ecx, 0x48
call fcn.14003c414
test rax, rax
je 0x140006d81
mov qword [rsp + 0x40], r15
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x38], r14d
mov r9, rdi
mov qword [rsp + 0x30], rcx
mov r8d, 0x402
lea rcx, [rbp + 0x160]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x370]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140013474
jmp 0x140006d84
mov rax, r12
mov qword [0x140050ce8], rax
jmp 0x140006d94
mov rax, qword [0x140050ce8]
test rax, rax
cmove ebx, r12d
mov eax, ebx
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.14003c810
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140008f09
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process filename

Disassembly:
push rbx
sub rsp, 0x3b0
mov rax, qword gs:[0x60]
lea rdx, [rsp + 0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbx, qword [rax + 0x30]
mov rcx, rbx
call fcn.140008ed5
mov edx, dword [rsp + 0x15c]
lea rax, [rsp + 0x60]
add rdx, rbx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x20]
call rdx
add rsp, 0x3b0
pop rbx
ret
Function at 0x14000f018
Capabilities:
Accept command line arguments
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 8], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rcx, qword [str.6ij]
lea rax, section..data
cmp rax, rcx
jne 0x14000f151
cmp dword [0x140050d0c], 0xd2af9
je 0x14000f25e
cmp qword [0x140051660], 0
je 0x14000f141
call fcn.140013fc4
test rax, rax
je 0x14000f141
call fcn.140013fc4
cmp dword [rax + 0x138], 0
jne 0x14000f141
xor edx, edx
lea rcx, str.WMPlayerApp
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14000f141
xor edx, edx
lea rcx, str.WMPlayerApp
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
je 0x14000f25e
lea rcx, str.WMPlayer_PluginAddRemove
call qword [sym.imp.USER32.dll_RegisterWindowMessageA]
test eax, eax
je 0x14000f25e
xor r9d, r9d
mov edx, eax
mov rcx, rsi
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14000f10c
lea edx, [rcx + 5]
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14000f25e
cmp dword [0x1400516e0], 4
jl 0x14000f25e
and dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
lea rdx, str.Alerted_WMP_to_the_updated_service._r_n
mov r8d, 0x25
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14000f25e
mov edi, 1
mov dword [0x140050ca0], edi
jmp 0x14000f25e
lea rax, [0x14004f2b0]
mov edi, 1
cmp rax, rcx
jne 0x14000f1ad
mov eax, dword [0x140050ca0]
cmp dword [0x140050d0c], 0xd2af9
cmovne eax, edi
mov dword [0x140050ca0], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, str._RunOnce
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
je 0x14000f25e
and dword [0x140050ca0], 0
mov ecx, edi
call fcn.140011578
jmp 0x14000f25e
mov eax, dword [0x140050d0c]
cmp eax, 0xd2af8
jne 0x14000f209
mov esi, 0x104
lea rcx, [rsp + 0x40]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14000f1fc
lea r8, str.unregmp2.exe
mov edx, esi
lea rcx, [rsp + 0x40]
call fcn.140001584
test eax, eax
js 0x14000f1fc
mov r9d, 0xffff
lea rdx, [rsp + 0x40]
mov r8d, edi
xor ecx, ecx
call fcn.140019694
mov eax, dword [0x140050d0c]
mov rcx, qword [str.6ij]
test eax, eax
js 0x14000f239
lea rdx, str.6ij
cmp rdx, rcx
jne 0x14000f239
cmp dword [0x140050ce0], 0
jne 0x14000f22e
call fcn.1400049a4
call fcn.140004800
jmp 0x14000f233
call fcn.1400049a4
mov eax, dword [0x140050d0c]
cmp eax, 0xd2af9
je 0x14000f259
cmp eax, 0xc00d2afb
je 0x14000f259
test eax, eax
js 0x14000f25e
cmp dword [0x140050c44], 0
jne 0x14000f25e
jmp 0x14000f146
call fcn.1400105f4
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14003c810
mov rsi, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
Function at 0x140019450
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
xor r15d, r15d
mov r14, rcx
mov qword [rax + 0x10], r15
lea ecx, [r15 + 0x28]
call fcn.14003c460
mov rsi, rax
test rax, rax
jne 0x14001948d
mov eax, 0x8007000e
jmp 0x140019674
lea rax, [rsp + 0x78]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
or rbp, 0xffffffffffffffff
test eax, eax
jne 0x140019541
mov ecx, 0x208
call fcn.14003c460
mov rbx, rax
test rax, rax
je 0x140019536
mov edi, 0x104
mov rcx, rax
mov edx, edi
call fcn.140016a9c
test eax, eax
je 0x14001952e
lea r8, str.__Fixups
mov edx, edi
mov rcx, rbx
call fcn.140001584
mov rax, rbp
inc rax
cmp word [rbx + rax*2], r15w
jne 0x1400194f9
mov rcx, qword [rsp + 0x78]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.MPlayer2_FixUp
mov r9d, 1
mov qword [rsp + 0x20], rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call fcn.14003c408
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerSetupFileMoveCacheSource
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 3
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test eax, eax
jne 0x140019645
mov r9d, dword [0x1400516e8]
lea ebx, [rax + 0x14]
jmp 0x1400195ac
mov r9d, dword [0x1400516e8]
cmp r9d, 0x3e8
jge 0x1400195e0
inc r9d
mov dword [0x1400516e8], r9d
lea r8, [0x140042130]
mov rdx, rbx
mov rcx, rsi
call fcn.140001734
mov rcx, qword [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], r15
mov rdx, rsi
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140019592
inc rbp
cmp word [r14 + rbp*2], r15w
jne 0x1400195e0
mov rcx, qword [rsp + 0x78]
lea eax, [rbp*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test eax, eax
jne 0x14001961d
inc dword [0x1400516e8]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x140019645
mov r8, r14
lea rdx, str.File_replacement_for__S_queued_in_non_admin_file_cache._r_n
lea ecx, [rdi + 4]
call fcn.1400168a8
mov ebx, 0xd2af9
jmp 0x14001966a
movzx ebx, di
lea rdx, str.ERROR:_Could_not_store_delayed_file_move_for__S:_0x_x._r_n
or ebx, 0x80070000
mov r8, r14
test edi, edi
mov ecx, 2
cmovle ebx, edi
mov r9d, ebx
call fcn.1400168a8
mov rcx, rsi
call fcn.14003c408
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140038ec8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov edx, dword [0x140050334]
cmp edx, 0xffffffff
je 0x140038f17
test edx, edx
je 0x1400390f0
movzx eax, word [0x140051738]
mov word [0x14005172c], ax
jmp 0x1400390f0
xor ebx, ebx
mov dword [0x140050334], ebx
call fcn.140039120
mov word [0x140051738], ax
lea esi, [rbx + 1]
test ax, ax
je 0x140038f6b
movzx ecx, ax
lea r9d, [rbx + 0x10]
lea r8, [rbp + 0x27]
lea edx, [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14003904f
mov eax, 0x800
test word [rbp + 0x35], ax
je 0x14003904f
mov edx, esi
mov dword [0x140050334], edx
jmp 0x140039055
mov ecx, 0x4a
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x14003904f
xor eax, eax
mov dword [rbp + 7], 0xc
mov qword [rbp + 0x17], rax
lea rdx, str.Control_PanelDesktopResourceLocale
mov dword [rbp + 0x1f], eax
mov r9d, 0x20019
lea rax, [rbp + 0xf]
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14003904f
mov rcx, qword [rbp + 0xf]
lea rax, [rbp + 7]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp + 0x17]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp + 0xf]
mov byte [rbp + 0x22], bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dl, byte [rbp + 0x17]
lea r8, [rbp + 0x17]
mov ecx, ebx
jmp 0x140039028
shl ecx, 4
lea eax, [rdx - 0x30]
cmp al, 9
ja 0x140039007
add ecx, 0xffffffd0
jmp 0x14003901d
lea eax, [rdx - 0x41]
cmp al, 5
ja 0x140039013
add ecx, 0xffffffc9
jmp 0x14003901d
lea eax, [rdx - 0x61]
cmp al, 5
ja 0x140039022
add ecx, 0xffffffa9
movsx eax, dl
add ecx, eax
add r8, rsi
mov dl, byte [r8]
test dl, dl
jne 0x140038ff8
and ecx, 0x3ff
cmp ecx, esi
je 0x14003903b
cmp ecx, 0xd
jne 0x14003904f
mov edx, esi
mov word [0x140051738], cx
mov dword [0x140050334], edx
jmp 0x1400390e9
mov edx, dword [0x140050334]
test edx, edx
jne 0x1400390e2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x58], rbx
lea rdx, str.static
mov qword [rsp + 0x50], rax
xor r9d, r9d
mov qword [rsp + 0x48], rbx
xor r8d, r8d
mov qword [rsp + 0x40], rbx
xor ecx, ecx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400390d8
mov edx, 0xffffffec
mov rcx, rdi
call fcn.140008f09
add byte [rdi], cl
mov edx, 0x8b4816e0
iretd
mov edx, dword [0x140050334]
test edx, edx
je 0x1400390f0
movzx ecx, word [0x140051738]
mov word [0x14005172c], cx
mov eax, edx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14003c810
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14003b004
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov esi, edx
mov r14, rcx
call fcn.14003aa74
xor r15d, r15d
test rdi, rdi
jne 0x14003b040
mov rax, qword [0x140050cb8]
mov rdi, qword [rax + 0x10]
test rdi, rdi
mov ebx, 0x80070057
mov rbp, r15
mov r12d, 0x8000ffff
cmovne ebx, r15d
mov r13d, 1
je 0x14003b099
mov eax, esi
lea r8d, [r13 + 5]
shr eax, 4
mov rcx, rdi
add ax, r13w
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
jne 0x14003b099
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14003b10e
mov ebx, r12d
test ebx, ebx
js 0x14003b10e
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
jne 0x14003b0cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14003b10e
mov ebx, r12d
test ebx, ebx
js 0x14003b10e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdx, rax
cmove ebx, r12d
test ebx, ebx
js 0x14003b10e
and esi, 0xf
je 0x14003b0fc
movzx eax, word [rdx]
lea rdx, [rdx + rax*2]
lea rdx, [rdx + 2]
sub esi, r13d
jne 0x14003b0ec
movzx r8d, word [rdx]
mov rcx, r14
add rdx, 2
call fcn.14003a61c
mov ebx, eax
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x14003b558
Capabilities:
Get file version info

Disassembly:
sub rsp, 0x28
and qword [rsp + 0x38], 0
lea r9, [0x140051dc0]
and dword [rsp + 0x30], 0
lea rcx, str.mfcore.dll
xor edx, edx
mov r8d, 0x200
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x14003b5fe
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [0x140042140]
lea rcx, [0x140051dc0]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14003b5fe
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx + 0xa]
mov word [0x140050348], ax
movzx r8d, word [rcx + 8]
mov word [0x14005034a], r8w
movzx edx, word [rcx + 0xe]
mov word [0x14005034c], dx
movzx eax, word [rcx + 0xc]
mov ecx, 0xc
mov word [0x140050340], cx
mov word [0x14005034e], ax
mov word [0x140050342], r8w
mov word [0x140050344], dx
mov word [0x140050346], ax
mov byte [0x14005175c], 1
lea rax, [0x140050340]
add rsp, 0x28
ret
Function at 0x14003c044
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14d, r9d
mov rbp, r8
mov rsi, rdx
mov rbx, rcx
call fcn.14003bff8
call qword [sym.imp.MFPlat.DLL_MFGetSystemTime]
inc dword [rbx + 0x900]
mov qword [rbx + 0x8f8], rax
cmp dword [rsi + 0x7c8], 0
je 0x14003c12b
cmp dword [rbx + 0x7c8], 0
je 0x14003c12b
mov eax, dword [rsi + 0x7c4]
xor edx, edx
mov ecx, dword [rsi + 0x7e8]
lea edi, [rdx + 0x7c]
cmp eax, edi
cmovb edi, eax
cmp edi, 0xa
jbe 0x14003c0c8
lea edx, [rdi - 0xa]
mov edi, 0xa
lea eax, [rdi - 5]
cmp ecx, eax
cmovb eax, ecx
jmp 0x14003c0ca
mov eax, ecx
mov r8d, edi
shl rdx, 4
shl r8d, 4
add rdx, rsi
mov rcx, rbx
mov dword [rbx + 0x7e8], eax
call sub.msvcrt.dll_memcpy
mov dword [rbx + 0x7c4], edi
movups xmm0, xmmword [rsi + 0x7d0]
movdqu xmmword [rbx + 0x7d0], xmm0
mov eax, dword [rsi + 0x7e0]
mov dword [rbx + 0x7e0], eax
mov eax, dword [rsi + 0x7e4]
mov dword [rbx + 0x7e4], eax
mov eax, dword [rsi + 0x7cc]
mov dword [rbx + 0x7cc], eax
mov eax, dword [rsi + 0x7c0]
mov dword [rbx + 0x7c0], eax
lea rdi, [rbx + 0x7f0]
test rbp, rbp
je 0x14003c15d
mov rdx, rdi
mov rcx, rbp
call fcn.14003c198
test al, al
jne 0x14003c160
or r9, 0xffffffffffffffff
mov r8, rbp
mov edx, 0x100
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_strncpy_s]
jmp 0x14003c160
mov byte [rdi], 0
lea rdx, [rbx + 0x905]
mov dword [rbx + 0x8f0], r14d
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.14003c2d0

Function at 0x14003c198
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r14, rdx
mov r9, rcx
xor edx, edx
movabs rax, 0xcbf29ce484222325
test rcx, rcx
je 0x14003c2ae
test r14, r14
je 0x14003c2ae
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], dl
jne 0x14003c1d6
mov esi, ebx
mov edi, edx
test ebx, ebx
je 0x14003c2ae
inc edi
cmp byte [rcx], 0x3c
je 0x14003c1fd
inc rcx
cmp edi, ebx
jb 0x14003c1ea
jmp 0x14003c2ae
dec esi
mov r15d, esi
add r15, r9
cmp byte [r15], 0x3e
je 0x14003c20f
cmp esi, edi
ja 0x14003c1fd
mov r8d, esi
sub r8d, edi
cmp edi, esi
je 0x14003c2ae
cmp r8d, 0x10
jbe 0x14003c2ae
mov ecx, ebx
sub ecx, r8d
add ecx, 0x11
cmp ecx, 0x100
jae 0x14003c2ae
lea rbp, [rdi + r9]
mov r10d, r8d
lea rcx, [r8 + rbp]
mov r12d, edi
cmp rbp, rcx
mov r11, rbp
cmova r10, rdx
test r10, r10
je 0x14003c277
movzx ecx, byte [r11]
movabs rdx, 0x100000001b3
xor rax, rcx
inc r11
mov rcx, r11
sub rcx, rbp
imul rax, rdx
cmp rcx, r10
jb 0x14003c254
mov r8, r12
mov qword [rsp + 0x20], rax
mov rdx, r9
mov rcx, r14
call sub.msvcrt.dll_memcpy
lea rdx, [rdi + r14]
lea rcx, [rsp + 0x20]
call fcn.14003bf00
sub ebx, esi
lea ecx, [rdi + 0x10]
add rcx, r14
mov rdx, r15
lea r8d, [rbx + 1]
call sub.msvcrt.dll_memcpy
mov dl, 1
mov rbx, qword [rsp + 0x70]
mov al, dl
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14003c2d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor eax, eax
mov rsi, rdx
xor r12d, r12d
mov qword [rdx], rax
mov ebp, r12d
mov qword [rdx + 8], rax
mov r15, rcx
movabs rbx, 0xcbf29ce484222325
mov eax, dword [r15 + 0x7c4]
mov ecx, 0x7c
cmp eax, ecx
cmovb ecx, eax
cmp ebp, ecx
jae 0x14003c3a9
mov eax, ebp
lea r8, [rsp + 0x50]
add rax, rax
mov qword [rsp + 0x50], r12
mov ecx, 4
mov rdi, qword [r15 + rax*8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
lea r14, str.UNLOADED
mov edx, 0x100
test eax, eax
cmovne r14, rdi
mov rcx, r14
mov rdi, r14
call qword [sym.imp.msvcrt.dll_strnlen]
inc eax
mov ecx, eax
add rax, r14
cmp r14, rax
cmova rcx, r12
test rcx, rcx
je 0x14003c392
movzx eax, byte [rdi]
movabs rdx, 0x100000001b3
xor rbx, rax
inc rdi
mov rax, rdi
sub rax, r14
imul rbx, rdx
cmp rax, rcx
jb 0x14003c370
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14003c3a2
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
inc ebp
jmp 0x14003c305
mov rbp, qword [rsp + 0x60]
movabs rax, 0xaa55aa55aa55aa55
mov qword [rsi], rbx
xor rbx, rax
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret