joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400933f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor ecx, ecx
lea rbx, [0x140000000]
movzx eax, word [rcx + rbx + 0x18ac60]
lea rcx, [rcx + 2]
mov word [rsp + rcx + 0x3e], ax
test ax, ax
jne 0x140093414
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400934e4
xor edx, edx
nop dword [rax]
movzx eax, word [rdx + rbx + 0x18ad30]
lea rdx, [rdx + 2]
mov word [rsp + rdx + 0x3e], ax
test ax, ax
jne 0x140093460
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400934da
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x38]
lea rdx, [0x140209d60]
xor r8d, r8d
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x1400934de
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400934e9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x260
pop rbx
ret

Function at 0x140093510
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x258
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor eax, eax
mov dword [rsp + 0x30], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8, [rsp + 0x20]
mov rcx, rax
mov edx, 9
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x140093594
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp qword [rsp + 0x20], 0
je 0x14009358a
lea rcx, [rsp + 0x28]
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
lea rcx, [rsp + 0x30]
call fcn.1400e47e0
lea rcx, [rsp + 0x30]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1400935a0
mov eax, dword [0x1401883d8]
movups xmm0, xmmword [0x1401883c8]
movups xmmword [rcx], xmm0
mov dword [rcx + 0x10], eax
lea rax, [rsp + 0x30]
sub rax, 2
nop word [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x1400935d0
movsd xmm0, qword [0x14018ab70]
lea rcx, [rsp + 0x30]
movsd qword [rax], xmm0
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1400935f0
movsd xmm0, qword [0x14018ab78]
movzx eax, word [0x14018ab80]
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
lea rcx, [rsp + 0x30]
call fcn.1400e7210
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x258
ret
Function at 0x140093640
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov ebp, edx
mov rsi, rcx
and ebp, 0xf
mov edi, ebx
test rcx, rcx
jne 0x14009366c
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
shr edx, 4
xor r9d, r9d
mov qword [rsp + 0x48], r15
inc dx
movzx r8d, dx
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov r15, rax
test rax, rax
je 0x1400936f3
mov rdx, rax
mov rcx, rsi
mov qword [rsp + 0x40], r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, r15
mov rcx, rsi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test eax, eax
je 0x1400936dd
nop
cmp edi, ebp
je 0x1400936dd
mov ecx, ebx
lea edx, [rsi - 1]
cmp edx, ebx
cmovb ecx, edx
inc edi
movzx eax, word [r14 + rcx*2]
inc eax
add ebx, eax
cmp ebx, esi
jb 0x1400936c0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r14, qword [rsp + 0x40]
cmp ebx, esi
jb 0x1400936f3
xor eax, eax
jmp 0x1400936f8
mov eax, 1
mov r15, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret

Function at 0x140094e80
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov ebx, edx
mov rdi, rcx
mov dword [rcx], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x140094f01
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp qword [rsp + 0x30], 0
je 0x140094ee9
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
mov rcx, rdi
call fcn.1400e47e0
mov eax, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140095ed0
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x670
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x660], rax
mov rdi, r9
mov r14d, r8d
mov rsi, rdx
mov r9, rcx
mov rbp, rcx
lea r8, [0x140209d60]
lea rcx, [rsp + 0x30]
lea rdx, [0x14018b178]
call fcn.1400f98c8
mov rcx, rbp
call fcn.1400f9670
lea r8, [0x140209d60]
lea rdx, [0x14018b1a8]
lea rcx, [rsp + 0x450]
mov r9, rax
call fcn.1400f98c8
or rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x450]
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140095f50
add eax, eax
lea r9, [rsp + 0x450]
lea rdx, [rsp + 0x30]
mov r8d, 1
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
lea rax, [rsp + 0x30]
sub rax, 2
nop dword [rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140095f90
movups xmm0, xmmword [0x14018b1c0]
movups xmm1, xmmword [0x14018b1d0]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14018b1e0]
movups xmmword [rax + 0x10], xmm1
movsd qword [rax + 0x20], xmm0
mov rax, rbx
inc rax
cmp word [rsi + rax*2], 0
jne 0x140095fc0
add eax, eax
lea rdx, [rsp + 0x30]
mov r9, rsi
mov r8d, 1
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
test r14d, r14d
je 0x140095ffe
cmp dword [rsp + 0x6c0], 0
jne 0x1400960c0
lea r8, [0x140209d60]
lea rdx, [0x14018b1f0]
lea rcx, [rsp + 0x30]
mov r9, rbp
call fcn.1400f98c8
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x140096020
cmp rax, 1
jbe 0x14009603f
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140096030
mov r9, rdi
jmp 0x1400960a2
lea rdx, [rsp + 0x240]
mov r8d, 0x102
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x240]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140096061
mov eax, dword [0x14018b238]
mov dword [rcx], eax
movzx eax, word [0x14018b23c]
mov word [rcx + 4], ax
lea rax, [rsp + 0x240]
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140096090
lea r9, [rsp + 0x240]
add ebx, ebx
lea rdx, [rsp + 0x30]
mov r8d, 1
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x670
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140096350
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbp, rcx
lea rcx, [0x140208860]
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea r9, [0x140208860]
lea r8, [0x140185e18]
lea rdx, str.Test
lea rcx, str.Others
mov esi, eax
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor r14d, r14d
test eax, eax
mov edi, r14d
setne dil
cmp esi, 0xffffffff
je 0x1400963c1
test sil, 1
jne 0x1400963c5
test edi, edi
jne 0x1400963ed
mov rcx, qword [0x1401fbba0]
lea r9, [0x140208860]
xor r8d, r8d
mov edx, 0x533
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r14
call fcn.1400f11b0
cmp edi, 1
jne 0x1400963fe
lea rcx, [0x140208860]
call fcn.14008cbb0
lea r9, [0x140208860]
lea rdx, str.ShowExtensionsDlg
lea rcx, [0x14018ade0]
mov r8d, 1
mov dword [0x140207d60], 0xd
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x140096435
dec dword [0x140207d60]
dec ebx
test ebx, ebx
jg 0x14009645b
lea r9, [0x140208860]
lea rdx, str.PropPage
lea rcx, str.Others
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, eax
test eax, eax
mov rcx, qword [0x1401fbba0]
cmovs ebx, r14d
lea r9, [0x140095680]
mov r8, rbp
mov edx, 0x588
mov dword [0x140207d64], ebx
mov qword [rsp + 0x20], r14
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov r8d, dword [0x140207d64]
lea rdx, [0x140182ce0]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.1400f98c8
lea r9, [0x140208860]
lea r8, [rsp + 0x30]
lea rdx, str.PropPage
lea rcx, str.Others
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400f9a80
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140098ca0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rbp - 8], rax
xor eax, eax
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
or rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140098ce0
lea r8, [rbp - 0x30]
lea rdx, [0x14018b600]
mov rcx, 0xffffffff80000001
lea ebx, [rax*2 + 2]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140098d40
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x28]
lea rdx, [0x14018b670]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rbp - 0x30]
lea rdx, [0x14018b690]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140098d8d
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x28]
lea rdx, [0x14018b670]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rbp - 0x30]
lea rdx, [0x14018b700]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140098dda
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x28]
lea rdx, [0x14018b670]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rbp - 0x30]
lea rdx, [0x14018b770]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140098e27
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x28]
lea rdx, [0x14018b670]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rbp - 0x30]
lea rdx, [0x14018b7e0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140098e74
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x28]
lea rdx, [0x14018b670]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400f9a80
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140099880
Capabilities:
Read file on windows

Disassembly:
test edx, edx
js 0x140099a86
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov dword [rax + 0x10], edx
push rbx
push rdi
push r12
push r13
sub rsp, 0x38
mov qword [rax + 8], rbp
mov rbp, qword [rsp + 0xa8]
mov qword [rax - 0x28], rsi
mov rsi, qword [rsp + 0xb0]
movsxd rbx, edx
mov qword [rax - 0x30], r14
mov r14, qword [rsp + 0x80]
mov qword [rax - 0x38], r15
mov r15, rbx
mov rbx, qword [rsp + 0x88]
mov r12d, r9d
mov rdi, r8
mov r13, rcx
nop
mov rcx, r13
call fcn.1400fa994
test eax, eax
jne 0x140099a68
mov rax, qword [rsp + 0xa0]
movsxd rax, dword [rax]
cmp r12d, 2
jne 0x140099929
mov ecx, dword [rdi + rax*4]
mov edx, ecx
mov eax, ecx
sar edx, 8
and eax, 0xff00
shl eax, 8
and edx, 0xff00
or edx, eax
mov eax, ecx
shl ecx, 0x18
shr eax, 0x18
or edx, eax
or edx, ecx
jmp 0x14009993a
movzx ecx, word [rdi + rax*2]
movzx edx, cl
mov eax, ecx
shl edx, 8
shr eax, 8
or edx, eax
cmp edx, ebx
mov eax, ebx
cmovl eax, edx
test eax, eax
jle 0x140099a68
movsxd r12, eax
xor edi, edi
mov r9, r13
lea r8d, [rdi + 1]
mov rcx, r14
mov rdx, r12
xor ebx, ebx
call fcn.1400fabdc
test r12, r12
je 0x140099a37
nop dword [rax + rax]
mov rcx, r13
call fcn.1400fa994
test eax, eax
jne 0x140099a37
movsx eax, byte [rdi + r14]
inc rdi
cmp eax, 0x80
jl 0x140099994
sub eax, 0x100
cmp eax, 0xffffff80
je 0x140099a2e
test eax, eax
jns 0x1400999e9
movsxd rdx, dword [rsp + 0x98]
movzx r9d, byte [rdi + r14]
mov r8d, 1
sub r8d, eax
inc rdi
xor ecx, ecx
imul rdx, r15
imul rdx, qword [rsp + 0x90]
test r8d, r8d
jle 0x140099a2e
nop
cmp rbx, rsi
jae 0x140099a2e
lea rax, [rdx + rbx]
inc ecx
inc rbx
mov byte [rax + rbp], r9b
cmp ecx, r8d
jl 0x1400999d0
jmp 0x140099a2e
movsxd r8, dword [rsp + 0x98]
lea r9d, [rax + 1]
xor edx, edx
imul r8, r15
imul r8, qword [rsp + 0x90]
test r9d, r9d
jle 0x140099a2e
nop dword [rax]
cmp rbx, rsi
jae 0x140099a2e
movzx ecx, byte [rdi + r14]
lea rax, [r8 + rbx]
inc edx
inc rdi
inc rbx
mov byte [rax + rbp], cl
cmp edx, r9d
jl 0x140099a10
cmp rdi, r12
jb 0x140099970
mov ebx, dword [rsp + 0x68]
mov rax, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x70]
inc dword [rax]
mov r12d, dword [rsp + 0x78]
dec ebx
dec r15
mov dword [rsp + 0x68], ebx
test ebx, ebx
mov rbx, qword [rsp + 0x88]
jns 0x1400998e0
mov r14, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x60]
mov r15, qword [rsp + 0x20]
add rsp, 0x38
pop r13
pop r12
pop rdi
pop rbx
ret
Function at 0x140099a90
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r15, r9
mov r14, r8
mov rdi, rdx
mov rbx, rcx
call fcn.1400ff110
mov rcx, rbx
mov rsi, rax
call fcn.1400fa96c
test eax, eax
jne 0x140099c12
mov qword [rsp + 0x88], rbp
mov ebp, 0x3ed
nop dword [rax]
mov edx, 4
lea rcx, [rsp + 0x28]
mov r9, rbx
lea r8d, [rdx - 3]
call fcn.1400fabdc
mov edx, 2
lea rcx, [rsp + 0x2c]
lea r8d, [rdx - 1]
mov r9, rbx
call fcn.1400fabdc
rol word [rsp + 0x2c], 8
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, edx
mov r9, rbx
call fcn.1400fabdc
movzx ecx, byte [rsp + 0x20]
mov r8d, 1
movzx eax, cl
not al
and al, 1
add cl, al
mov byte [rsp + 0x20], cl
movzx edx, cl
mov rcx, rbx
call fcn.1400fe870
mov edx, 4
lea rcx, [rsp + 0x2e]
lea r8d, [rdx - 3]
mov r9, rbx
call fcn.1400fabdc
mov ecx, dword [rsp + 0x2e]
mov edx, ecx
mov eax, ecx
shr eax, 0x10
and edx, 0xff0000
or edx, eax
mov eax, ecx
shl ecx, 0x10
and eax, 0xff00
shr edx, 8
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x2e], edx
cmp word [rsp + 0x2c], bp
je 0x140099bce
test dl, 1
je 0x140099b9d
inc edx
mov dword [rsp + 0x2e], edx
mov r8d, 1
mov rcx, rbx
call fcn.1400fe870
mov rcx, rbx
call fcn.1400ff110
lea rcx, [rsi + rdi]
cmp rax, rcx
jge 0x140099c0a
mov rcx, rbx
call fcn.1400fa96c
test eax, eax
je 0x140099ae0
jmp 0x140099c0a
mov edx, InitCommonControls
lea rcx, [rsp + 0x38]
mov r9, rbx
lea r8d, [rdx - 0xf]
call fcn.1400fabdc
movzx ecx, word [rsp + 0x38]
movzx eax, cl
shr ecx, 8
shl eax, 8
or eax, ecx
movzx ecx, word [rsp + 0x40]
mov dword [r14], eax
movzx eax, cl
shr ecx, 8
shl eax, 8
or eax, ecx
mov dword [r15], eax
mov rbp, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14009bca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rcx
test rcx, rcx
jne 0x14009bcb6
xor eax, eax
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
cmp word [rax + 0xe], 1
mov rbx, rax
je 0x14009bce1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x28], r14
mov r14d, dword [rax + 4]
mov eax, dword [rax + 8]
mov qword [rsp + 0x20], r15
cdq
mov esi, eax
lea eax, [r14*4 + 0x1f]
xor esi, edx
sub esi, edx
cdq
and edx, 0x1f
mov r8d, esi
add eax, edx
sar eax, 5
shl eax, 2
movsxd r15, eax
lea eax, [r14 + 0x1f]
cdq
mov ecx, r15d
and edx, 0x1f
add eax, edx
mov edx, r14d
sar eax, 5
shl eax, 2
movsxd r12, eax
mov r9d, r12d
call fcn.14009b440
test eax, eax
jne 0x14009bd52
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
jmp 0x14009beb9
mov qword [rsp + 0x60], rdi
mov edx, esi
mov ecx, 0x40
mov qword [rsp + 0x30], r13
mov edi, esi
imul rdx, r15
add rdx, 0x68
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r13, rax
test rax, rax
jne 0x14009bd8b
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
jmp 0x14009beaf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
xor edx, edx
mov dword [rax], 0x28
mov dword [rax + 4], r14d
mov dword [rax + 8], esi
mov qword [rax + 0xc], 0x40001
mov dword [rax + 0x14], edx
mov ecx, dword [rbx + 0x18]
mov dword [rax + 0x18], ecx
mov ecx, dword [rbx + 0x1c]
mov qword [rax + 0x20], InitCommonControls
mov dword [rax + 0x1c], ecx
mov r8, rax
cmp dword [rbx + 0x20], edx
jbe 0x14009bde6
nop word [rax + rax]
lea rcx, [rdx*4 + 0x28]
inc edx
mov eax, dword [rcx + rbx]
mov dword [rcx + r8], eax
cmp edx, dword [rbx + 0x20]
jb 0x14009bdd0
mov r9d, dword [rbx + 0x20]
lea r10, [r8 + 0x68]
add r9, 0xa
lea r9, [rbx + r9*4]
test esi, esi
je 0x14009be9a
lea ebx, [r14 + 7]
shr ebx, 3
test ebx, ebx
je 0x14009be8b
mov rax, r10
mov r8, r9
mov r11d, ebx
nop word [rax + rax]
movzx ecx, byte [r8]
lea rax, [rax + 4]
lea r8, [r8 + 1]
movzx edx, cl
and cl, 0x87
shr dl, 3
and dl, 8
or dl, cl
shr dl, 3
mov byte [rax - 4], dl
movzx ecx, byte [r8 - 1]
movzx edx, cl
and cl, 0x20
shr dl, 3
and dl, 2
or dl, cl
shr dl, 1
mov byte [rax - 3], dl
movzx ecx, byte [r8 - 1]
movzx edx, cl
shr cl, 2
and dl, 8
and cl, 1
add dl, dl
or dl, cl
mov byte [rax - 2], dl
movzx ecx, byte [r8 - 1]
movzx edx, cl
and cl, 1
and dl, 2
shl dl, 3
or dl, cl
mov byte [rax - 1], dl
dec r11
jne 0x14009be20
add r10, r15
add r9, r12
dec rdi
jne 0x14009be05
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, r13
mov r13, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x38]
mov r14, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14009cdc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push r15
sub rsp, 0x50
mov r15, rcx
test rcx, rcx
jne 0x14009cddc
xor eax, eax
add rsp, 0x50
pop r15
ret
mov qword [rsp + 0x78], rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
cmp word [rax + 0xe], 4
mov rbx, rax
je 0x14009ce08
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rbx, qword [rsp + 0x78]
xor eax, eax
add rsp, 0x50
pop r15
ret
mov qword [rsp + 0x40], rsi
movsxd rsi, dword [rax + 4]
mov eax, dword [rax + 8]
cdq
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
xor eax, edx
sub eax, edx
movsxd r14, eax
lea eax, [rsi*4 + 0x1f]
cdq
mov r8d, r14d
and edx, 0x1f
add eax, edx
sar eax, 5
shl eax, 2
movsxd rcx, eax
lea eax, [rsi + rsi*2]
lea eax, [rax*8 + 0x1f]
mov qword [rsp + 0x68], rcx
mov r9d, ecx
cdq
and edx, 0x1f
add eax, edx
mov edx, esi
sar eax, 5
shl eax, 2
movsxd r13, eax
mov ecx, r13d
call fcn.14009b440
test eax, eax
jne 0x14009ce7e
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
jmp 0x14009cfe7
mov qword [rsp + 0x38], rdi
mov rdi, r13
mov ecx, 0x40
imul rdi, r14
lea rdx, [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x14009ceb3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
jmp 0x14009cfe2
mov rcx, rax
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x30], r12
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea r12, [rdi - 1]
mov dword [rax], 0x28
mov dword [rax + 4], esi
mov dword [rax + 8], r14d
mov qword [rax + 0xc], 0x180001
mov dword [rax + 0x14], 0
mov ecx, dword [rbx + 0x18]
mov dword [rax + 0x18], ecx
mov ecx, dword [rbx + 0x1c]
mov qword [rax + 0x20], 0
mov dword [rax + 0x1c], ecx
mov ebp, dword [rbx + 0x20]
mov rdx, rax
add rbp, 0xa
lea r8, [rax + 0x28]
lea rbp, [rbx + rbp*4]
test r14, r14
je 0x14009cfbf
mov r15, qword [rsp + 0x68]
lea rdi, [rsi + 1]
shr rdi, 1
xor esi, esi
nop dword [rax]
nop word [rax + rax]
xor r10d, r10d
mov r11, rbp
mov rax, rsi
test rdi, rdi
je 0x14009cfab
nop
movzx r9d, byte [r11]
add rax, 3
lea r11, [r11 + 1]
movzx ecx, r9b
and r9b, 0xf
shr cl, 4
movzx edx, cl
movzx ecx, byte [rbx + rdx*4 + 0x28]
mov byte [rax + r8 - 3], cl
movzx ecx, byte [rbx + rdx*4 + 0x29]
mov byte [rax + r8 - 2], cl
movzx ecx, byte [rbx + rdx*4 + 0x2a]
mov byte [rax + r8 - 1], cl
cmp rax, r12
jae 0x14009cfab
movzx edx, r9b
inc r10
add rax, 3
movzx ecx, byte [rbx + rdx*4 + 0x28]
mov byte [rax + r8 - 3], cl
movzx ecx, byte [rbx + rdx*4 + 0x29]
mov byte [rax + r8 - 2], cl
movzx ecx, byte [rbx + rdx*4 + 0x2a]
mov byte [rax + r8 - 1], cl
cmp r10, rdi
jb 0x14009cf40
add rbp, r15
add rsi, r13
dec r14
jne 0x14009cf30
mov r15, qword [rsp + 0x60]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, qword [rsp + 0x70]
mov r12, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop r15
ret