joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014394
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x140014426
mov edx, 0x104
call fcn.140021058
test rax, rax
je 0x140014426
mov rax, qword [rsp + 0xa8]
mov r9, rdi
mov r8, rsi
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xa0]
mov rdx, rbp
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x98]
mov rcx, rbx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x14001443f
lea rcx, str.Safe_CreateProcess_error:_lpApplicationName_is_NULL_or_empty.
call fcn.1400113f8
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14001591c
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ebx, edx
mov rdi, rcx
call fcn.14000fa34
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdx, str._sSun_
mov r8, rdi
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdx, str._sJava_
mov r8, rdi
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test ebx, ebx
lea rbx, str.1.7.0_76
lea r9, [0x140037a50]
mov r8, rdi
mov rcx, rdi
mov qword [rsp + 0x20], rbx
lea rdx, str._s_s_s_x64
jne 0x1400159a2
lea rdx, str._s_s_s
call qword [sym.imp.USER32.dll_wsprintfA]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea r9, [0x140037a50]
lea rdx, str._s_s_s.msi
mov r8, rdi
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_wsprintfA]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140015d3c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x140048f50]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov rbx, rcx
movzx edi, r8w
mov esi, 0xff
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, esi
mov byte [rsp + 0x60], 0
call fcn.14001e2f0
lea rcx, [rbp + 0x61]
mov r8d, esi
xor edx, edx
mov byte [rbp + 0x60], 0
call fcn.14001e2f0
lea rcx, [rbp + 0x161]
mov r8d, esi
xor edx, edx
mov byte [rbp + 0x160], 0
call fcn.14001e2f0
mov rcx, qword [0x14004b0c0]
mov esi, pe_nt_image_headers64
lea r8, [rsp + 0x60]
mov r9d, esi
mov edx, 0x7fa
call qword [sym.imp.USER32.dll_LoadStringA]
mov rcx, qword [0x14004b0c0]
lea r8, [rbp + 0x60]
mov r9d, esi
mov edx, 0x7fb
call qword [sym.imp.USER32.dll_LoadStringA]
lea r8, str.1.7.0_76
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x160]
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, qword [rbx + 8]
lea r9d, [rsi + 0x34]
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x160]
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x140015ec7
and dword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
lea rdx, str.SOFTWAREJavaSoft
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea rsi, str.decline
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsp + 0x58]
lea rdx, str.InstallStatus
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbx + 8]
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, rbx
call fcn.140015c80
mov rcx, qword [rbx + 8]
movzx edx, di
call qword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.14001eba0
mov rbx, qword [rsp + 0x398]
add rsp, 0x370
pop rdi
pop rsi
pop rbp
ret
Function at 0x140018320
Capabilities:
Create thread
Hide graphical window

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov ecx, 0xd5e5e7
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov rcx, qword [rdi + 8]
and qword [rdi + 0x858], 0
and qword [rdi + 0x898], 0
and qword [rdi + 0x888], 0
and qword [rdi + 0x890], 0
mov edx, 0xfa5
mov qword [rdi + 0x8b0], rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r9d, 0xffffff
xor r8d, r8d
mov rcx, rax
mov edx, 0x2001
mov rbx, rax
call qword [sym.imp.USER32.dll_PostMessageA]
mov r9d, 0x32cd32
xor r8d, r8d
mov edx, 0x409
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageA]
mov rcx, qword [rdi + 8]
mov ebx, 0xfffffff0
mov edx, ebx
call qword [sym.imp.USER32.dll_GetWindowLongA]
mov rcx, qword [rdi + 8]
mov edx, ebx
btr eax, 0x10
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.USER32.dll_GetSystemMenu]
lea r8d, [rbx + 0x11]
mov edx, 0xf060
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableMenuItem]
and dword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8, [0x140018104]
mov r9, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rbx, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x140019218
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
lea rbp, [rax - 0x3b8]
sub rsp, 0x490
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140048f50]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov rcx, rdx
mov ebx, r9d
mov rsi, r8
mov rdi, rdx
call qword [sym.imp.GDI32.dll_SaveDC]
mov edx, 2
mov rcx, rdi
mov r12d, eax
call qword [sym.imp.GDI32.dll_SetGraphicsMode]
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 1]
call qword [sym.imp.GDI32.dll_ModifyWorldTransform]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edx, 0x58
mov rcx, rdi
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, 0x5a
mov rcx, rdi
movd xmm6, eax
cvtdq2ps xmm6, xmm6
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mulss xmm6, dword [0x140039d44]
lea rdx, [rsp + 0x20]
mov r8d, 1
mov rcx, rdi
divss xmm6, dword [0x140039d40]
movd xmm2, eax
cvtdq2ps xmm2, xmm2
cvttss2si eax, xmm6
mov dword [rsp + 0x20], eax
lea eax, [rbx + rbx*4]
add eax, eax
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm2
divss xmm0, dword [0x140039d40]
cvttss2si eax, xmm0
mov dword [rsp + 0x24], eax
call qword [sym.imp.GDI32.dll_DPtoLP]
movd xmm0, dword [rsp + 0x24]
cvtdq2pd xmm0, xmm0
call fcn.140021154
xor ebx, ebx
lea rcx, [rsp + 0x71]
mov r8d, 0x3ff
mov qword [rsp + 0x2c], rbx
mov dword [rsp + 0x34], ebx
divsd xmm0, qword [0x140039d38]
mov byte [rsp + 0x3c], bl
mov dword [rsp + 0x3e], ebx
mov word [rsp + 0x42], bx
mov byte [rsp + 0x70], bl
addsd xmm0, qword [0x140039d30]
cvttsd2si eax, xmm0
neg eax
cmp dword [rbp + 0x3e8], ebx
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x3e0]
setne byte [rsp + 0x3d]
xor edx, edx
mov dword [rsp + 0x38], eax
call fcn.14001e2f0
lea r8, [rsp + 0x70]
mov r9d, 0x400
mov edx, 0x1002
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea r8d, [rbx + 5]
lea rdx, str.Japan
lea rcx, [rsp + 0x70]
call fcn.14001ff60
lea rcx, [rsp + 0x44]
mov rdx, rsi
test eax, eax
jne 0x1400193bd
lea rdx, str.MS_UI_Gothic
call fcn.14001e490
lea rcx, [rsp + 0x28]
call qword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edx, r12d
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.GDI32.dll_RestoreDC]
mov rax, rbx
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.14001eba0
movaps xmm6, xmmword [rsp + 0x480]
add rsp, 0x490
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140019404
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x9b0]
sub rsp, 0xab0
mov rax, qword [0x140048f50]
xor rax, rsp
mov qword [rbp + 0x9a0], rax
mov rdi, rcx
mov rcx, qword [rcx + 8]
xor edx, edx
mov rbx, r9
call qword [sym.imp.USER32.dll_EnableWindow]
xor edx, edx
lea r8d, [rdx + 0x38]
lea rcx, [rsp + 0x48]
call fcn.14001e2f0
lea rcx, [rbp + 0x91]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x90], 0
call fcn.14001e2f0
lea rcx, [rbp + 0x1a1]
xor edx, edx
mov r8d, 0x3ff
mov byte [rbp + 0x1a0], 0
call fcn.14001e2f0
mov rcx, qword [0x14004b0c0]
lea r8, [rbp + 0x1a0]
mov r9d, 0x400
mov edx, 0x7fe
mov qword [rsp + 0x40], rbx
call qword [sym.imp.USER32.dll_LoadStringA]
and qword [rsp + 0x30], 0
lea rax, [rbp + 0x90]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea r11, [rbp + 0x1a0]
lea rax, [rsp + 0x30]
lea edx, [r9 + 0x11]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x58], r11
mov dword [rsp + 0x60], 0x49
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov rcx, qword [rsp + 0x48]
test eax, eax
cmove rcx, qword [rsp + 0x30]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
mov rsi, rax
test rax, rax
je 0x1400195ac
lea rcx, [rbp - 0x7f]
xor edx, edx
mov r8d, 0x103
mov byte [rbp - 0x80], 0
call fcn.14001e2f0
lea rdx, [rbp - 0x80]
mov rcx, rsi
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x1400195a3
lea rdx, [rbp - 0x80]
lea rcx, [rdi + 0x48]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rbp + 0x5a1]
xor edx, edx
mov r8d, 0x3ff
mov byte [rbp + 0x5a0], 0
call fcn.14001e2f0
lea r8, [rbp - 0x80]
lea rdx, str.Selected_Folder:__s_n
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x5a0]
call fcn.1400113f8
mov rcx, qword [rdi + 8]
mov edx, 0x408
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rdx, [rdi + 0x48]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rdi + 8]
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
mov rcx, qword [rbp + 0x9a0]
xor rcx, rsp
call fcn.14001eba0
mov rbx, qword [rsp + 0xad8]
add rsp, 0xab0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140019d04
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x140048f50]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov ebx, 0x103
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, ebx
mov byte [rsp + 0x30], 0
call fcn.14001e2f0
lea rcx, [rsp + 0x141]
mov r8d, ebx
xor edx, edx
mov byte [rsp + 0x140], 0
call fcn.14001e2f0
mov ebx, 0x104
lea rdx, [rsp + 0x30]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, 1
jl 0x140019d6d
cmp eax, ebx
jle 0x140019d85
lea r9, [0x14003a188]
lea rcx, [rsp + 0x30]
or r8, 0xffffffffffffffff
mov rdx, rbx
call fcn.14001f9bc
lea rax, [rsp + 0x30]
lea r9, str._sjava_install_reg.log
lea rcx, [rsp + 0x140]
or r8, 0xffffffffffffffff
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.14001f9bc
lea r8, [0x14003a168]
lea rdx, [rsp + 0x140]
lea rcx, [0x14004b0a0]
call fcn.1400215c0
test eax, eax
je 0x140019dd9
call fcn.1400212d4
add rax, 0x60
mov qword [0x14004b0a0], rax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14001eba0
add rsp, 0x260
pop rbx
ret

Function at 0x140019e30
Capabilities:
Delete file
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x140048f50]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
lea rcx, str.___getDefaultBrowserExe:_begin.
call fcn.140019df4
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ebx, eax
cmp eax, 0x104
ja 0x140019f35
test eax, eax
je 0x140019f35
lea rdx, str.javatmp.html
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x140019ee7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.___getDefaultBrowserExe:_CreateFile_failed.
mov ebx, eax
call fcn.140019df4
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140019f41
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x40]
mov r8, rdi
xor edx, edx
call qword [sym.imp.SHELL32.dll_FindExecutableA]
cmp eax, 0x20
jg 0x140019f26
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.___getDefaultBrowserExe:_FindExecutable_failed.
mov ebx, eax
call fcn.140019df4
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x140019f41
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
jmp 0x140019f43
lea rcx, str.___getDefaultBrowserExe:_GetTempPath_failed.
call fcn.140019df4
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14001eba0
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
Function at 0x140019f64
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x140048f50]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov ebx, 0x9c
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, ebx
call fcn.14001e2f0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
xor ebx, ebx
test eax, eax
jne 0x140019fbb
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x24], 6
setae bl
mov eax, ebx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14001eba0
add rsp, 0xd0
pop rbx
ret

Function at 0x140019fe0
Capabilities:
Delete registry value
Query or enumerate registry key
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp + 7], 0xfffffffffffffffe
mov qword [rax + 8], rsi
mov rdi, rdx
mov rsi, rcx
xor r12d, r12d
mov qword [rbp + 0xf], r12
mov dword [rbp + 0x17], r12d
mov qword [rbp + 0x1f], r12
mov qword [rbp + 0x27], r12
mov dword [rbp + 0x2f], r12d
mov qword [rbp + 0x37], r12
mov r9d, 0x20019
lea r8, str.Software
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0xf]
call fcn.140001200
test eax, eax
je 0x14001a056
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x14001a04f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x14001a162
mov r9d, 0x2001f
lea r8, str.JavaSoft
mov rdx, qword [rbp + 0xf]
lea rcx, [rbp + 0x27]
call fcn.140001200
test eax, eax
je 0x14001a090
mov rcx, qword [rbp + 0x27]
test rcx, rcx
je 0x14001a084
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rbp + 0xf], r12
je 0x14001a04f
mov rcx, qword [rbp + 0xf]
jmp 0x14001a049
test rdi, rdi
jne 0x14001a110
mov dword [rbp + 0x77], r12d
mov dword [rbp + 0x7f], r12d
mov rdx, rsi
mov rdi, qword [rbp + 0x27]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x14001a13e
cmp dword [rbp + 0x77], r12d
jne 0x14001a13e
cmp dword [rbp + 0x7f], r12d
jne 0x14001a13e
lea rdx, str.JavaSoft
lea rcx, [rbp + 0xf]
call fcn.140002ed4
jmp 0x14001a13e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov rdi, qword [rbp + 0x27]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop
test rdi, rdi
je 0x14001a14d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rbp + 0xf], r12
je 0x14001a15d
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rsi, qword [rsp + 0xc0]
add rsp, 0xa0
pop r12
pop rdi
pop rbp
ret
Function at 0x14001b3b8
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
lea rbp, [rax - 0xb8]
sub rsp, 0x190
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140048f50]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rcx, rdx
mov ebx, r9d
mov rsi, r8
mov rdi, rdx
call qword [sym.imp.GDI32.dll_SaveDC]
mov edx, 2
mov rcx, rdi
mov r12d, eax
call qword [sym.imp.GDI32.dll_SetGraphicsMode]
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 1]
call qword [sym.imp.GDI32.dll_ModifyWorldTransform]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edx, 0x58
mov rcx, rdi
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, 0x5a
mov rcx, rdi
movd xmm6, eax
cvtdq2ps xmm6, xmm6
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mulss xmm6, dword [0x140039d44]
lea rdx, [rsp + 0x20]
mov r8d, 1
mov rcx, rdi
divss xmm6, dword [0x140039d40]
movd xmm2, eax
cvtdq2ps xmm2, xmm2
cvttss2si eax, xmm6
mov dword [rsp + 0x20], eax
lea eax, [rbx + rbx*4]
add eax, eax
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm2
divss xmm0, dword [0x140039d40]
cvttss2si eax, xmm0
mov dword [rsp + 0x24], eax
call qword [sym.imp.GDI32.dll_DPtoLP]
movd xmm0, dword [rsp + 0x24]
cvtdq2pd xmm0, xmm0
call fcn.140021154
xor ebx, ebx
lea r8, [rsp + 0x70]
mov r9d, pe_nt_image_headers64
mov edx, 0x1002
mov ecx, 0x800
divsd xmm0, qword [0x140039d38]
mov qword [rsp + 0x2c], rbx
mov dword [rsp + 0x34], ebx
mov byte [rsp + 0x3c], bl
mov dword [rsp + 0x3e], ebx
mov word [rsp + 0x42], bx
addsd xmm0, qword [0x140039d30]
cvttsd2si eax, xmm0
neg eax
cmp dword [rbp + 0xe8], ebx
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0xe0]
setne byte [rsp + 0x3d]
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea r8d, [rbx + 5]
lea rdx, str.Japan
lea rcx, [rsp + 0x70]
call fcn.14001ff60
lea rcx, [rsp + 0x44]
mov rdx, rsi
test eax, eax
jne 0x14001b544
lea rdx, str.MS_UI_Gothic
call fcn.14001e490
lea rcx, [rsp + 0x28]
call qword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edx, r12d
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.GDI32.dll_RestoreDC]
mov rax, rbx
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14001eba0
movaps xmm6, xmmword [rsp + 0x180]
add rsp, 0x190
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14001dd5c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x14004b110]
test rcx, rcx
jne 0x14001dcb3
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 0x60]
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x14001dcac
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x14001dcde
and qword [rax], 0
and qword [rax + 8], 0
xor eax, eax
lock cmpxchg qword [rbx + 0x40], rdi
je 0x14001dca8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbx + 0x40]
mov qword [0x14004b110], rcx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x14001dd51
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x14001dd01
xor edx, edx
lea r9, [rsp + 0x30]
mov ecx, 0xc0000017
lea r8d, [rdx + 1]
mov qword [rsp + 0x30], 0x20
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [rax]
mov rcx, qword [0x14004b110]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x14001dd2e
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x14001dd51
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x14004b110]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x14001dd35
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
jmp 0x14001dc38

Function at 0x14001fd40
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14001fbb0
Function at 0x14002299b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140048f50]
jne 0x14001ebba
rol rcx, 0x10
test cx, 0xffff
jne 0x14001ebb6
repz ret
ror rcx, 0x10
jmp 0x1400228f4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14004b980]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14004ba78]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140022979
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14004b980]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14002299b
mov rax, qword [rsp + 0x88]
mov qword [0x14004ba78], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14004ba18], rax
mov rax, qword [0x14004ba78]
mov qword [0x14004b8f0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14004ba00], rax
mov dword [0x14004b8e0], 0xc0000409
mov dword [0x14004b8e4], 1
mov rax, qword [0x140048f50]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140048f58]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14004b978], eax
mov ecx, 1
call fcn.14002c9cc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14003be28]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14004b978], 0
jne 0x140022a22
mov ecx, 1
call fcn.14002c9cc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret