joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400233f0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x14006e078]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp byte [rcx], 0
mov r14, rdx
mov qword [rsp + 0x70], rbp
mov rbx, rcx
mov qword [rsp + 0x78], rsi
mov esi, 1
je 0x140023453
lea rdi, [rcx + 0x10]
mov qword [rsp + 0x20], 0
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x34]
mov r8d, esi
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x14002344d
mov byte [rdi], sil
mov ebp, dword [rsp + 0x34]
jmp 0x140023484
mov edi, dword [rcx + 0x2c]
mov ecx, dword [rcx + 0x28]
lea eax, [rdi + 1]
cmp eax, ecx
jbe 0x140023464
mov esi, ecx
sub esi, edi
mov rdx, rdi
mov r8d, esi
add rdx, qword [rbx + 0x20]
lea rcx, [rsp + 0x30]
mov ebp, esi
call fcn.140029380
lea eax, [rdi + rsi]
mov dword [rbx + 0x2c], eax
lea rdi, [rbx + 0x10]
mov rsi, qword [rsp + 0x78]
cmp ebp, 1
mov rbp, qword [rsp + 0x70]
jne 0x1400234b3
movzx eax, byte [rsp + 0x30]
mov dword [r14], eax
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140027270
add rsp, 0x40
pop r14
pop rdi
pop rbx
ret
cmp byte [rbx], 0
je 0x14002349b
cmp byte [rdi], 0
je 0x14002349b
mov eax, 0xffffffff
jmp 0x14002349d
Function at 0x140024180
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400243ae
cmp dword [rcx + 0x1c], 0
je 0x1400243ae
mov qword [rsp + 0x48], rbx
mov rbx, qword [rcx + 0x80]
mov qword [rsp + 0x20], rbp
xor ebp, ebp
test rbx, rbx
je 0x1400241e8
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400241c5
call fcn.140035634
mov qword [rbx], rbp
cmp dword [rbx + 0x64], ebp
je 0x1400241d6
lea rcx, [rbx + 8]
call fcn.140022b80
mov rcx, rbx
mov dword [rbx + 0x64], ebp
call fcn.140035634
mov qword [rdi + 0x80], rbp
lea r9, [rsp + 0x50]
mov rcx, rdi
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
call fcn.140023ed0
test eax, eax
je 0x140024219
mov rbx, qword [rsp + 0x48]
mov eax, 0xffffff99
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0xb0
call fcn.140036150
mov rbx, rax
test rax, rax
je 0x140024256
mov ecx, 0x4000
call fcn.140036150
mov ecx, dword [rsp + 0x40]
mov dword [rbx + 0x68], ecx
mov ecx, dword [rsp + 0x50]
mov dword [rbx + 0x6c], ecx
mov qword [rbx], rax
mov dword [rbx + 0x70], ebp
test rax, rax
jne 0x14002426c
mov rcx, rbx
call fcn.140035634
mov rbx, qword [rsp + 0x48]
mov eax, 0xffffff98
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov eax, dword [rdi + 0x40]
mov ecx, dword [rdi + 0x38]
mov dword [rbx + 0x78], eax
mov rax, qword [rdi]
mov qword [rbx + 0x88], rax
mov eax, dword [rdi + 0x10]
mov dword [rbx + 0x94], eax
mov dword [rbx + 0x64], ebp
mov dword [rbx + 0x74], ebp
mov dword [rbx + 0x90], ecx
mov dword [rbx + 0x24], ebp
test ecx, ecx
je 0x1400242bb
lea rcx, [rbx + 8]
mov qword [rbx + 0x38], rbp
mov qword [rbx + 0x40], rbp
mov qword [rbx + 0x48], rbp
call fcn.140022c60
test eax, eax
jne 0x1400242bb
mov dword [rbx + 0x64], 1
mov eax, dword [rdi + 0x44]
movzx ecx, byte [rdi + 0x34]
mov dword [rbx + 0x7c], eax
and cl, 1
mov eax, dword [rdi + 0x48]
mov dword [rbx + 0x80], eax
mov eax, dword [rdi + 0x34]
shr eax, 3
mov byte [rbx + 0x98], cl
test al, 1
je 0x1400242e7
movzx eax, byte [rdi + 0x3d]
jmp 0x1400242eb
movzx eax, byte [rdi + 0x43]
mov byte [rbx + 0xac], al
neg cl
mov dword [rbx + 0x9c], 0x12345678
sbb eax, eax
mov dword [rbx + 0xa0], 0x23456789
and eax, 0xc
mov dword [rbx + 0xa4], 0x34567890
mov dword [rbx + 0xa8], eax
test rsi, rsi
je 0x140024382
lea r8, [0x1400638a0]
movzx eax, byte [rsi]
test al, al
je 0x140024382
mov edx, dword [rbx + 0x9c]
xor rax, rdx
movzx ecx, al
shr edx, 8
xor edx, dword [r8 + rcx*4]
mov ecx, dword [rbx + 0xa4]
movzx eax, dl
add eax, dword [rbx + 0xa0]
mov dword [rbx + 0x9c], edx
imul edx, eax, 0x8088405
movzx eax, cl
shr ecx, 8
inc edx
mov dword [rbx + 0xa0], edx
shr rdx, 0x18
xor rax, rdx
xor ecx, dword [r8 + rax*4]
mov dword [rbx + 0xa4], ecx
add rsi, 1
jne 0x140024328
mov eax, dword [rsp + 0x58]
mov ecx, dword [rdi + 0x7c]
add eax, 0x1e
add ecx, eax
mov dword [rbx + 0x10], ebp
mov rbp, qword [rsp + 0x20]
xor eax, eax
mov dword [rbx + 0x60], ecx
mov qword [rdi + 0x80], rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
mov eax, 0xffffff9a
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140024e70
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r14
sub rsp, 0x250
mov rax, qword [0x14006e078]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rdx
mov rbp, rcx
mov rbx, 0xffffffffffffffff
mov r14d, 0x104
test rcx, rcx
je 0x140024f0d
mov rdx, rcx
mov r8d, r14d
lea rcx, [rsp + 0x20]
call fcn.140035f50
lea rcx, [rsp + 0x20]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x140024ec2
test rax, rax
je 0x140024ef0
movzx ecx, byte [rsp + rax + 0x1f]
cmp cl, 0x2f
je 0x140024edf
cmp cl, 0x5c
jne 0x140024ef0
dec rax
cmp rax, r14
jae 0x14002501f
mov byte [rsp + rax + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140024f0d
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
movzx eax, byte [rsi]
test al, al
je 0x140024ff5
mov qword [rsp + 0x280], rdi
mov rcx, rsi
mov rdi, rsi
cmp al, 0x2f
je 0x140024f2e
cmp al, 0x5c
jne 0x140024f31
mov rdi, rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140024f26
cmp rdi, rsi
je 0x140024f6f
sub rdi, rsi
lea rcx, [rsp + 0x20]
mov r8, rdi
mov rdx, rsi
call fcn.140029380
cmp rdi, r14
jae 0x140025019
lea rdx, [rsp + 0x20]
mov byte [rsp + rdi + 0x20], 0
mov rcx, rbp
call fcn.140024e70
mov byte [rsp + 0x130], 0
test rbp, rbp
je 0x140024f8f
mov r8, r14
lea rcx, [rsp + 0x130]
mov rdx, rbp
call fcn.140035f50
mov byte [rsp + 0x233], 0
lea rax, [rsp + 0x130]
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x140024fa0
sub r14, rbx
lea rcx, [rsp + 0x130]
add rcx, rbx
mov r8, r14
mov rdx, rsi
call fcn.140035f50
lea rcx, [rsp + 0x130]
mov byte [rsp + 0x233], 0
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140024fed
xor edx, edx
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov rdi, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140027270
mov rbx, qword [rsp + 0x288]
add rsp, 0x250
pop r14
pop rsi
pop rbp
ret
call fcn.140027678
int3
call fcn.140027678
int3
Function at 0x140025430
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rbp, rcx
mov ecx, 0x258
call fcn.140027290
mov rsi, rax
mov qword [rsp + 0x78], rax
xor edx, edx
mov r8d, 0x258
mov rcx, rax
call fcn.140029a50
xor r15d, r15d
mov qword [rsi], r15
mov rbx, 0xffffffffffffffff
mov dword [rsi + 8], ebx
mov dword [rsi + 0x138], ebx
mov qword [rsi + 0x140], r15
mov qword [rsi + 0x148], r15
lea rdx, [rsi + 0x150]
mov ecx, 0x103
call qword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
nop dword [rax]
nop word [rax + rax]
lea rbx, [rbx + 1]
cmp byte [rsi + rbx + 0x150], 0
jne 0x1400254b0
movzx eax, byte [rbx + rsi + 0x14f]
cmp al, 0x5c
je 0x1400254d8
cmp al, 0x2f
je 0x1400254d8
mov word [rbx + rsi + 0x150], 0x2f
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140025598
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov edi, eax
cmp eax, 0xffffffff
setne bl
mov ecx, 0x30
call fcn.140027290
mov r14, rax
mov byte [rax], 1
mov byte [rax + 0x18], 1
mov byte [rax + 1], bl
mov qword [rax + 8], rbp
mov byte [rax + 0x10], 0
mov dword [rax + 0x14], r15d
cmp edi, 0xffffffff
je 0x14002556b
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov dword [r14 + 0x14], eax
mov rcx, r14
call fcn.140023760
mov qword [rsi], rax
test rax, rax
je 0x140025598
mov dword [0x140070fb0], r15d
mov ecx, 0x10
call fcn.140027290
mov dword [rax], 1
mov qword [rax + 8], rsi
jmp 0x1400255e1
mov dword [0x140070fb0], 0x200
mov rcx, qword [rsi + 0x140]
test rcx, rcx
je 0x1400255b3
call fcn.1400272cc
mov qword [rsi + 0x140], r15
mov rcx, qword [rsi + 0x148]
test rcx, rcx
je 0x1400255cb
call fcn.1400272cc
mov qword [rsi + 0x148], r15
mov edx, 0x258
mov rcx, rsi
call fcn.1400272cc
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x1400259e0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.DLL_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.DLL_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140025a64
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140052690]
cmp byte [rcx + rax], 0
je 0x140025a64
dec r8
sub rdx, 1
jne 0x140025a4a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140026340
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
mov r8d, 3
call qword [sym.imp.KERNEL32.DLL_MoveFileExW]
test eax, eax
je 0x14002635b
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.DLL_GetLastError]

Function at 0x140027570
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess_1]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.DLL_TerminateProcess]

Function at 0x140028164
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test rax, rax
je 0x1400281ae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400281ae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400281ae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400281ae
cmp dword [rcx + 0x84], 0xe
jbe 0x1400281ae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400281b0
xor al, al
add rsp, 0x28
ret

Function at 0x14002de30
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14002dc5c
Function at 0x1400015a0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x14023d380]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x180]
xor edi, edi
test rcx, rcx
je 0x1400015dd
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 0x180], rdi
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.14017b0d0
lea rdx, [rsp + 0x20]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, str.driverhelper64.dll
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140001684
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx + 0x180], rax
test rax, rax
je 0x140001684
lea rdx, [0x1401fdc18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x188], rax
test rax, rax
je 0x140001684
mov r8, qword [rbx + 0x180]
xor r9d, r9d
mov rdx, rax
lea ecx, [r9 + 3]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbx + 0x190], rax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140179510
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret

Function at 0x1400018c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1400018f3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140001939
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140001934
nop
cmp rbx, rcx
jae 0x140001939
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
dec edi
jne 0x140001920
cmp rbx, rcx
jb 0x14000193d
xor eax, eax
jmp 0x140001949
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400020e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_712
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x1400154a7
cmp dword [rcx + 0xd8], 0
jne 0x1400154a7
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.140022ebc
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.140015804
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140002120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14023d380]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
mov eax, 0x33
lea rcx, [rbp - 0x28]
xor ebx, ebx
mov dword [rbp - 0x24], 0x63006d
mov dword [rbp - 0x20], 0x6c0074
mov dword [rbp - 0x12], VarBstrFromDisp
mov dword [rbp - 0x16], 0x6c0064
mov dword [rbp - 0x28], 0x6f0043
mov dword [rbp - 0x1a], 0x2e0032
mov word [rbp - 0x1c], ax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x1400021df
lea rdx, [rbp - 0x40]
mov rcx, rax
mov dword [rbp - 0x3f], 0x4374696e
mov dword [rbp - 0x2f], 0x784573
mov dword [rbp - 0x33], 0x6c6f7274
mov dword [rbp - 0x38], 0x6f436e6f
mov word [rbp - 0x3b], 0x6d6f
mov byte [rbp - 0x39], 0x6d
mov byte [rbp - 0x40], 0x49
mov byte [rbp - 0x34], 0x6e
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400021d6
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140179510
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140002420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14023d380]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
mov eax, 0x2e
lea rcx, [rbp - 0x20]
mov r14d, edx
xor ebx, ebx
mov dword [rbp - 0x12], 0x6c0064
mov dword [rbp - 0x18], 0x320033
mov dword [rbp - 0x1c], 0x720065
mov dword [rbp - 0xe], VarBstrFromDisp
mov word [rbp - 0x14], ax
mov dword [rbp - 0x20], 0x730055
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x1400024d4
lea rdx, [rbp - 0x30]
mov rcx, rax
mov dword [rbp - 0x27], 0x576567
mov dword [rbp - 0x2c], 0x7373654d
mov word [rbp - 0x2f], 0x736f
mov byte [rbp - 0x2d], 0x74
mov byte [rbp - 0x28], 0x61
mov byte [rbp - 0x30], 0x50
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400024cb
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140179510
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140015468
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_712
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x1400154a7
cmp dword [rcx + 0xd8], 0
jne 0x1400154a7
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.140022ebc
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.140015804
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140015504
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
mov r15, rcx
xor edi, edi
call fcn.140022ebc
lea r8d, [rdi + 5]
mov rbp, qword [rax + 0x18]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbp
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x140015560
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.140015598
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400160f0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x40
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x14023f210]
test eax, eax
je 0x140016142
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14023f210]
test eax, eax
jne 0x14001614b
call fcn.14001009c
test eax, eax
je 0x140016167
lea rdx, [rsp + 0x30]
mov rcx, qword [0x140237178]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x14001616f
xor eax, eax
jmp 0x1400161c7
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rsi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rsi, rax
mov qword [rsp + 0x38], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je 0x1400161a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1400161ab
xor edi, edi
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400161c4
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret

Function at 0x1400178a4
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14001791e
xor r8d, r8d
call fcn.140017b68
mov rsi, rax
test rax, rax
jne 0x1400178da
mov eax, edi
jmp 0x140017934
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x1400178d6
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140018390
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1400183f3
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140018407
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140018407
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x14001840c
cmp dword [rcx + 8], 0
je 0x140018407
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14001840c
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14001aa14
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x14023d380]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rcx
mov rcx, qword [0x140242700]
test rcx, rcx
jne 0x14001aa79
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001aa9a
lea rdx, str.SetDefaultDllDirectories
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140242700], rax
jmp 0x14001aa82
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rbx, rax
test rbx, rbx
je 0x14001aa9a
xor edx, edx
mov r8d, 0x800
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x14001aafc
mov ebx, 0x105
lea rcx, [rsp + 0x20]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x14001aab4
xor eax, eax
jmp 0x14001aafc
lea rcx, [rsp + 0x20]
call fcn.14017a580
cmp word [rsp + rax*2 + 0x1e], 0x5c
je 0x14001aade
lea r8, [0x1401a4910]
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14017a4f8
test eax, eax
jne 0x14001aab0
lea rcx, [rsp + 0x20]
mov r8, rdi
mov rdx, rbx
call fcn.14017a4f8
test eax, eax
jne 0x14001aab0
lea rcx, [rsp + 0x20]
call fcn.14002112c
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140179510
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret