joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140205a10
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400bbf2d
sub rsp, rax
mov rax, qword [0x140292040]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140296cf0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140205c02
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x140205b56
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140205b56
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x140205b3b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x140205ad8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140205bc2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140205c21
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x140205bfd
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140205c21
jmp 0x140205aae
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400bd80f
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140205cd0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400bbf2d
sub rsp, rax
mov rax, qword [0x140292040]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140296cf0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x140205edd
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x140205e29
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x140205e29
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x140205e09
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x140205d98
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140205e9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140205efc
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x140205ed8
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140205efc
jmp 0x140205d6e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400bd80f
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140002750
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_712
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x14001816b
cmp dword [rcx + 0xd8], 0
jne 0x14001816b
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.14001f834
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.1400184c8
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140002bb8
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x10
mov rax, qword [0x1402479e0]
xor rax, rsp
mov qword [rsp + 8], rax
movups xmm0, xmmword [0x140249758]
lea rax, [0x140259950]
lea r10, [rsp]
mov esi, 4
mov dl, 1
mov dword [rsp], 1
lea r9, [0x140259951]
sub r10, rax
mov r11b, sil
movdqu xmmword [0x140259940], xmm0
mov eax, dword [r9 - 5]
lea r8, [r9 - 1]
mov dword [r8], eax
movzx eax, r11b
and eax, 0x80000003
jge 0x140002c28
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x140002c89
mov al, byte [r9]
mov cl, byte [r8]
mov rbx, rsi
mov byte [r8], al
mov al, byte [r9 + 1]
mov byte [r9], al
mov al, byte [r9 + 2]
mov byte [r9 + 2], cl
mov byte [r9 + 1], al
mov rcx, r8
movzx eax, byte [rcx]
lea rdi, str.cw
mov al, byte [rax + rdi]
mov byte [rcx], al
inc rcx
dec rbx
jne 0x140002c4e
mov rcx, r8
mov rbx, rsi
mov al, byte [r10 + rcx]
xor byte [rcx], al
inc rcx
dec rbx
jne 0x140002c6b
test dl, dl
js 0x140002c81
add dl, dl
jmp 0x140002c86
add dl, dl
xor dl, 0x1b
mov byte [rsp], dl
mov rcx, rsi
mov al, byte [r8 - 0x10]
xor byte [r8], al
inc r8
dec rcx
jne 0x140002c8c
inc r11b
add r9, rsi
sub r10, rsi
cmp r11b, 0x2c
jb 0x140002c0b
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.140182f30
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
add rsp, 0x10
pop rdi
ret
Function at 0x140002ccc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
cmp rcx, rdx
je 0x140002cf3
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
lea r14, [0x140000000]
mov rdx, rcx
mov ebp, 0x10
lea r9, [r14 + 0x2599e0]
neg rdx
mov r8d, ebp
add r9, rdx
mov al, byte [r9 + rcx]
xor byte [rcx], al
inc rcx
dec r8
jne 0x140002d12
lea rsi, [r14 + 0x2599d0]
mov dil, 0xa
add rsi, rdx
mov rcx, rbx
call fcn.140002a20
mov rcx, rbx
mov rdx, rbp
movzx eax, byte [rcx]
mov al, byte [rax + r14 + 0x20bf00]
mov byte [rcx], al
inc rcx
dec rdx
jne 0x140002d3b
mov rcx, rbx
mov rdx, rbp
mov al, byte [rsi + rcx]
xor byte [rcx], al
inc rcx
dec rdx
jne 0x140002d56
cmp dil, 1
je 0x140002d71
mov rcx, rbx
call fcn.140002a90
sub rsi, rbp
add dil, 0xff
jne 0x140002d2d
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140004c80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1402479e0]
xor rax, rsp
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x4bd80506
mov dword [rbp - 0x5c], 0x6e4c665a
mov dword [rbp - 0x58], 0x33439bd
mov dword [rbp - 0x54], 0x65ea3620
mov dword [rbp - 0x50], 0x5200a3e
call fcn.14000433c
lea rcx, [rbp - 0x59]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rcx, [rbp - 0x48]
mov dword [rbp - 0x48], 0x4f38b80a
mov dword [rbp - 0x44], 0xad693f32
mov dword [rbp - 0x40], 0xff18298a
mov dword [rbp - 0x3c], 0x4a713b5d
mov rbx, rax
mov dword [rbp - 0x38], 0x47efdf1b
mov dword [rbp - 0x34], 0x204ae86c
mov dword [rbp - 0x30], 0xde1a5a51
mov byte [rbp - 0x2c], 0x8a
call fcn.14000433c
lea rdx, [rbp - 0x3d]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x28]
mov dword [rbp - 0x28], 0x9d4a330d
mov dword [rbp - 0x24], 0xc9a1df91
mov dword [rbp - 0x20], 0x6e2d93bb
mov dword [rbp - 0x1c], 0x2f674e2f
mov rdi, rax
mov dword [rbp - 0x18], 0xcfb6fcef
mov dword [rbp - 0x14], 0x7df6cfa8
mov dword [rbp - 0x10], 0x562d401c
mov word [rbp - 0xc], 0xee39
mov byte [rbp - 0xa], 0x91
call fcn.14000433c
lea rdx, [rbp - 0x1a]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0x4d2
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
call rdi
mov rcx, rax
or edx, 0xffffffff
call rbx
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140182f30
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140005088
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
lea rbp, [rax - 0x1f8]
sub rsp, 0x2e0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1402479e0]
xor rax, rsp
mov qword [rbp + 0x1d8], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
xor ebx, ebx
mov edi, ebx
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.140005620
nop
mov dword [rbp + 0x1c0], 0x46ea0006
mov dword [rbp + 0x1c4], 0xf56409f
mov dword [rbp + 0x1c8], 0x1fb510dc
mov dword [rbp + 0x1cc], 0x46b6639b
mov dword [rbp + 0x1d0], 0xf7840b5
mov dword [rbp + 0x1d4], 0x1fb510f6
lea rcx, [rbp + 0x1c0]
call fcn.14000433c
lea rdx, [rbp + 0x1ce]
lea rcx, [rsp + 0x48]
call fcn.140005784
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140005306
mov qword [rsp + 0x58], rbx
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rax, qword [rsp + 0x48]
mov word [rax], bx
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x48]
call fcn.140005784
test byte [rsp + 0x70], 0x10
je 0x14000522c
lea rdx, [0x14020c0d8]
lea rcx, [rsp + 0x48]
call fcn.1400058fc
test eax, eax
je 0x1400052a2
lea rdx, [0x14020c0dc]
lea rcx, [rsp + 0x48]
call fcn.1400058fc
test eax, eax
je 0x1400052a2
mov qword [rsp + 0x58], rbx
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rax, qword [rsp + 0x48]
mov word [rax], bx
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140005784
lea rdx, [0x14020c088]
lea rcx, [rsp + 0x48]
call fcn.140005784
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x48]
call fcn.140005784
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x30]
call fcn.140005088
mov rdi, rax
test rax, rax
jne 0x1400052fa
jmp 0x1400052a2
mov rcx, rbx
movsxd r9, dword [rsp + 0x58]
test r9, r9
jle 0x14000528f
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x48]
lea rax, [rsp + 0x48]
cmp rdx, 8
cmovae rax, r8
cmp word [rax + rcx*2], 0x41
jbe 0x140005287
lea rax, [rsp + 0x48]
cmp rdx, 8
cmovae rax, r8
cmp word [rax + rcx*2], 0x5a
ja 0x140005287
lea rax, [rsp + 0x48]
cmp rdx, 8
cmovae rax, r8
add word [rax + rcx*2], 0x20
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x48]
inc rcx
cmp rcx, r9
jl 0x140005243
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.1400058fc
test eax, eax
je 0x1400052b9
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1400052fa
jmp 0x140005158
mov edx, 0x208
mov ecx, 1
call fcn.140183cac
mov rdi, rax
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x38]
lea r8, str._s_s
mov edx, 0x104
mov rcx, rdi
call fcn.140183dcc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbx, rdi
cmp qword [rsp + 0x60], 8
jb 0x140005318
mov rcx, qword [rsp + 0x48]
call fcn.140005e04
mov rax, rbx
mov rcx, qword [rbp + 0x1d8]
xor rcx, rsp
call fcn.140182f30
mov rbx, qword [rsp + 0x310]
add rsp, 0x2e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140005d50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
movzx edx, r8w
mov rsi, rcx
lea r8, str.JPEG
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor ecx, ecx
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
xor ecx, ecx
mov dword [rdi], eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, qword [rsp + 0x30]
mov qword [rsi], rax
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x140008d24
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x140008d9e
xor r8d, r8d
call fcn.140008fe8
mov rsi, rax
test rax, rax
jne 0x140008d5a
mov eax, edi
jmp 0x140008db4
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x140008d56
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14000a218
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14000a27b
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000a28f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000a28f
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x14000a294
cmp dword [rcx + 8], 0
je 0x14000a28f
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14000a294
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14001812c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_712
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x14001816b
cmp dword [rcx + 0xd8], 0
jne 0x14001816b
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.14001f834
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.1400184c8
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400181c8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
mov r15, rcx
xor edi, edi
call fcn.14001f834
lea r8d, [rdi + 5]
mov rbp, qword [rax + 0x18]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbp
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x140018224
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.14001825c
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140018e64
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x40
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x14024e540]
test eax, eax
je 0x140018eb6
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14024e540]
test eax, eax
jne 0x140018ebf
call fcn.140016d20
test eax, eax
je 0x140018edb
lea rdx, [rsp + 0x30]
mov rcx, qword [0x1402464c0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x140018ee3
xor eax, eax
jmp 0x140018f3b
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rsi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rsi, rax
mov qword [rsp + 0x38], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je 0x140018f1d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140018f1f
xor edi, edi
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140018f38
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret

Function at 0x140022338
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x1400223a0
call fcn.14001f834
mov r8d, 0xf0
mov rdx, rsi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400223a0
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x1400223c2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, r14
call fcn.14009d9f4
mov esi, eax
test rdi, rdi
je 0x1400223c0
test rbx, rbx
je 0x1400223c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140023e7c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.140028be4
mov rdi, rax
test rax, rax
je 0x140023ef8
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x140023ef3
cmp dword [rbx], 0x40
jb 0x140023ef3
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x140023ef3
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x140023efc
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140027aec
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x70
mov edi, r9d
mov rsi, r8
mov r14, rdx
mov r15d, ecx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x14024e540]
test eax, eax
je 0x140027b3e
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14024e540]
test eax, eax
jne 0x140027b47
call fcn.140016d20
test eax, eax
je 0x140027b63
lea rdx, [rsp + 0x60]
mov rcx, qword [0x1402464c0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x140027b6e
xor eax, eax
jmp 0x140027c1c
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, rsi
mov rdx, r14
mov ecx, r15d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rsi, rax
mov qword [rsp + 0x68], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je 0x140027bfe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140027c00
xor edi, edi
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140027c19
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret