joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140029240
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rsp + 0x50]
mov rdi, rcx
mov qword [rcx + 0x158], rsi
mov ebp, edx
mov dword [rcx + 0x13c], 1
mov qword [rcx + 0x160], r8
mov dword [rcx + 0x150], r9d
test r9d, r9d
je 0x1400292d6
test rsi, rsi
je 0x1400292d6
mov rax, qword [rsi]
mov rcx, rsi
mov qword [rsp + 0x30], rbx
call qword [rax + 0xd8]
mov edx, dword [rdi + 0x150]
mov r8d, 1
mov rbx, rax
mov rcx, qword [rax + 8]
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov rcx, qword [rdi + 0x158]
mov rdx, rbx
mov r9, qword [rcx]
call qword [r9 + 0xe0]
mov rcx, qword [rdi + 0x158]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_DrawMenuBar]
mov rbx, qword [rsp + 0x30]
movzx edx, bp
mov r8, rsi
mov rcx, rdi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp method.CCommonDialog.virtual_720
Function at 0x14002a320
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x260
mov rax, qword [0x1400ab680]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r14, r9
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], r9
mov dword [rsp + 0x30], 0
call fcn.14003be40
mov rcx, rax
test rax, rax
je 0x14002a494
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
mov dword [rsp + 0x30], 1
mov rax, qword [rbp + 0x258]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r9, [rsp + 0x50]
lea r8, [0x1400901e0]
mov rdx, qword [r14]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x50]
mov rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp word [rcx + rax*2], 0
jne 0x14002a3c4
mov r8d, eax
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140002ba0
mov rax, qword [rdi]
cmp dword [rax - 0x10], 0
jne 0x14002a43b
mov rax, qword [rbp + 0x260]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r9, [rsp + 0x50]
lea r8, [0x1400901e0]
mov rdx, qword [r14]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x50]
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14002a420
mov r8d, eax
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140002ba0
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002a458
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14002a473
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14005df90
add rsp, 0x260
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.140002fe0
int3
Function at 0x14002a4a0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rsi, rdx
mov dword [rsp + 0x28], 1
xor ebx, ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8, qword [rdx]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea edi, [rbx - 1]
cmp rax, 0x20
jg 0x14002a563
call fcn.14003be40
mov rcx, rax
test rax, rax
je 0x14002a58d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov r8, qword [rsi]
lea rdx, str.url.dll_FileProtocolHandler__s
lea rcx, [rsp + 0x40]
call fcn.14000c550
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
mov rbx, qword [rsp + 0x40]
mov r9, rbx
lea r8, str.rundll32.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002a563
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14002a57d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x80004005
call fcn.140002fe0
int3
Function at 0x1400301a0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx ecx, r8b
mov rsi, r9
mov r9, qword [r9]
mov r8d, ecx
mov eax, ecx
shl r8d, 8
shl eax, 0x10
mov rbx, rdx
mov rdx, qword [rdx]
or r8d, eax
or r8d, ecx
lea rcx, str.Color
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
movzx edi, ax
and edi, 0xffffff00
shr ecx, 0x10
movzx edx, cl
or edi, edx
movzx eax, al
mov rdx, qword [rbx]
mov ebx, 0xffffffff
shl eax, 0x10
or edi, eax
mov eax, ebx
sub rdx, 0x18
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003021a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140030235
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140030250
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r9
movzx r8d, r8b
mov r9, qword [r9]
lea rcx, str.Alpha
mov rbx, rdx
mov rdx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rdx, qword [rbx]
mov ebx, 0xffffffff
mov ecx, ebx
mov edi, eax
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400302a0
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x1400302ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x30]
movzx eax, dil
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400302d0
Capabilities:
Read .ini file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1400ab680]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rsi, r9
mov edi, r8d
mov rbx, rdx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], r9
mov dword [rsp + 0x30], 0
call fcn.14003be40
mov rcx, rax
test rax, rax
je 0x1400303d4
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x30], 1
mov r8d, edi
lea rdx, str.ParentTheme_d
mov rcx, rbx
call fcn.14000c550
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r9, [rsp + 0x50]
lea r8, [0x1400901e0]
mov rdx, qword [rbx]
lea rcx, str.Info
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x50]
mov rdi, 0xffffffffffffffff
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140030380
mov r8d, eax
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140002ba0
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400303b6
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14005df90
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80004005
call fcn.140002fe0
int3
Function at 0x140030d10
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1400ab680]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov eax, dword [0x1400ac240]
cmp eax, 0xffffffff
jne 0x140030d83
xor edx, edx
mov dword [0x1400ac240], 0
mov r8d, 0x118
lea rcx, [rsp + 0x24]
call fcn.140060b10
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 5
mov eax, dword [0x1400ac240]
jne 0x140030d83
cmp dword [rsp + 0x28], 0
mov ecx, 1
cmove eax, ecx
mov dword [0x1400ac240], eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14005df90
add rsp, 0x158
ret
Function at 0x1400346f0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1400ab680]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor eax, eax
mov rsi, rdx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov word [rsp + 0x50], ax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [rsp + 0x30], eax
mov rcx, 0xffffffffffffffff
mov edx, eax
mov eax, 2
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.1400027b0
mov r8d, dword [rsp + 0x30]
mov r9, rax
xor edx, edx
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x14003481e
lea r9, [rsp + 0x30]
mov rcx, rdi
lea r8, [rsp + 0x38]
lea rdx, [0x140090a94]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
lea r9, [rsp + 0x30]
mov rcx, rdi
lea r8, [rsp + 0x38]
lea rdx, str.VarFileInfoTranslation
call qword [sym.imp.VERSION.dll_VerQueryValueW]
mov rax, qword [rsp + 0x38]
lea rdx, str.StringFileInfo_04X_04X_s
mov ecx, dword [rax]
mov eax, ecx
shr rax, 0x10
movzx r9d, ax
lea rax, [0x140097a70]
movzx r8d, cx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, [rsp + 0x30]
mov rcx, rdi
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
mov r8, qword [rsp + 0x38]
lea rcx, [rsp + 0x50]
mov edx, 0x100
call fcn.1400684b0
test rsi, rsi
je 0x14003481e
mov r8, qword [rsp + 0x38]
mov edx, 0x100
mov rcx, rsi
call fcn.1400684b0
mov rcx, rdi
call fcn.14003b55c
cmp word [rsp + 0x50], 0
je 0x140034846
lea rcx, [rsp + 0x50]
call fcn.14006caac
mulsd xmm0, qword [0x14009b690]
cvttsd2si eax, xmm0
jmp 0x140034848
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14005df90
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14003c370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CCommonDialog.virtual_720
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
cmp rdx, 0x10000
jae 0x14003c3af
cmp dword [rcx + 0xe8], 0
jne 0x14003c3af
movzx eax, si
mov dword [rcx + 0xe8], eax
call fcn.140049e7c
mov r8d, 5
mov rdx, rsi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x14003c688
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rsi, r9
mov rcx, rdx
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rbx, rbx
jne 0x14003c6dd
call fcn.14004790c
mov rdx, rax
test rax, rax
je 0x14003c6db
mov rcx, qword [rax]
mov rax, qword [rcx + 0xe8]
mov rcx, rdx
call qword [case.0x140040b02.0]
mov rbx, rax
jmp 0x14003c6dd
xor ebx, ebx
and qword [rdi + 0x108], 0
mov r9, rsi
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.14003c3fc

Function at 0x14003fc34
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x14003fc92
call fcn.140049e7c
mov r8d, 0xf0
mov rdx, rdi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14003fc92
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14003fc9d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
mov rdx, rbx
mov rcx, rsi
call fcn.14003b0fc
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400404f8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400405b1
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x1400405b1
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400405b1
test rdi, rdi
je 0x1400405b1
xor r14d, r14d
xor esi, esi
call fcn.140049e7c
lea r8, [0x1400847a0]
mov rdx, rdi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x140040591
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rdi
mov rcx, rbp
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400405b1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
mov r8d, r14d
mov rdx, rsi
mov rcx, rbx
call fcn.140053844
mov edi, eax
test eax, eax
je 0x1400405ad
mov rcx, rbx
call fcn.140040220
mov eax, edi
jmp 0x1400405b3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140041448
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x40]
call fcn.1400521bc
mov rdi, rax
test rax, rax
je 0x1400414c4
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x1400414bf
cmp dword [rbx], 0x40
jb 0x1400414bf
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
or dword [rbx + 4], 1
xor r8d, r8d
or qword [rbx + 0x30], 0xffffffffffffffff
mov edx, 0x87
mov qword [rbx + 8], rcx
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x1400414bf
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x1400414c8
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14004586c
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x78
test rdx, rdx
je 0x1400458d4
mov r10, qword [rcx + 0x10]
test r10, r10
je 0x1400458be
cmp qword [rcx + 0x18], 0
jne 0x1400458b9
mov eax, dword [rcx + 0xc]
cmp eax, dword [rcx + 0x30]
jae 0x1400458da
mov qword [rsp + 0x58], rdx
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0x50
mov edx, eax
mov dword [rsp + 0x24], 0x40
mov r8d, 1
mov rcx, qword [r10 + 8]
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
add rsp, 0x78
ret
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x1400458d4
mov rcx, qword [rcx + 0x40]
add rsp, 0x78
jmp fcn.140051f40
call fcn.14003b7f8
int3
call fcn.14003b7f8
int3
Function at 0x14004895c
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x1400489d7
xor r8d, r8d
call fcn.140048c2c
mov rsi, rax
test rax, rax
je 0x1400489d3
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400489d3
mov eax, dword [rsp + 0x30]
jmp 0x1400489ed
mov eax, edi
jmp 0x1400489ed
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400494b0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140049517
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004952b
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004952b
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call qword [case.0x140040b02.0]
jmp 0x140049530
cmp dword [rcx + 8], 0
je 0x14004952b
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x140049530
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140055ea0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rdx]
cmp dword [rcx - 0x10], 0
je 0x140055ed2
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140055ed2
lea rcx, [rdi + 0x120]
mov rdx, rbx
call fcn.14005c4bc
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x140055ee4
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140055f0a
mov r8, rdx
mov rdx, qword [rbx]
call fcn.1400494b0
jmp 0x140055f76
cmp byte [0x1400b11a0], 0
jne 0x140055f4e
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140055f3e
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400b1198], rax
jmp 0x140055f45
mov rax, qword [0x1400b1198]
mov byte [0x1400b11a0], 1
jmp 0x140055f55
mov rax, qword [0x1400b1198]
mov rdx, rdi
mov rcx, qword [rbx]
test rax, rax
je 0x140055f6f
xor r9d, r9d
mov r8d, dword [rbx + 8]
call qword [case.0x140040b02.0]
jmp 0x140055f76
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140066e70
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r8
push rdi
sub rsp, 0x320
xor esi, esi
lea rcx, [rax + 0x18]
mov qword [rax + 0x18], rsi
call fcn.140066e20
lea rdx, [rsp + 0x110]
mov qword [rsp + 0xa0], rax
mov rcx, rax
mov rdi, rax
call fcn.140066d44
lea rax, [rsp + 0x110]
mov qword [rsp + 0x88], rax
mov ebx, dword [rsp + 0x248]
add rbx, rdi
cmp dword [rbx], esi
je 0x140066f13
mov rdx, qword [rsp + 0x340]
mov ecx, esi
cmp word [rdx], si
je 0x140066ee6
inc ecx
cmp word [rdx + rcx*2], si
jne 0x140066ede
cmp cl, byte [rbx]
je 0x140066ef8
cmp cl, byte [rbx + 1]
je 0x140066ef8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, rdx
call fcn.140066e4c
cmp eax, dword [rbx + 4]
je 0x140066f13
cmp eax, dword [rbx + 8]
je 0x140066f13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [rsp + 0x200]
lea rcx, [rsp + 0x20]
add rdx, rdi
call rdx
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x14006eaec
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14006e8dc
Function at 0x14007531c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400753a3
mov rsi, rbx
cmp word [rax], bp
je 0x140075362
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14007534c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140075348
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14006fbe0
mov rdi, rax
test rax, rax
je 0x140075390
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140060460
mov rbp, rdi
xor ecx, ecx
call fcn.14006fba4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400792dc
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x1400b1cd0]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x14007933a
cmp word [rdx], r12w
jne 0x14007933a
or byte [rax + r8*8 + 0x38], cl
jmp 0x140079340
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x14007949b
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x140079476
lea r9, [rcx + 2]
cmp ax, r13w
je 0x140079379
mov rcx, r9
jmp 0x14007939c
cmp r9, rdx
jae 0x1400793b3
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x14007935d
jmp 0x14007949b
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140079470
cmp dword [rsp + 0x80], edi
je 0x140079470
mov rdx, r14
lea r11, [0x1400b1cd0]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x140079449
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x14007941c
mov word [rbx], r12w
jmp 0x140079497
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x140079425
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x140079497
cmp word [rsp + 0x70], r12w
jne 0x140079456
cmp rbx, rsi
je 0x140079416
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.1400791fc
cmp word [rsp + 0x70], r12w
je 0x14007949b
mov word [rbx], r13w
jmp 0x140079497
lea r11, [0x1400b1cd0]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x140079493
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x14007949b
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret