joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140132c20
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
cmp dword [rsp + 0x90], 0
jne 0x140132dd7
cmp r8d, 0x110
jne 0x140132c68
call fcn.140133df0
mov rcx, qword [rsp + 0x88]
mov qword [rcx], rax
mov eax, 1
jmp 0x140132dd9
mov ebx, 1
xor esi, esi
lea ebp, [rbx + 1]
cmp r8d, 0x111
jne 0x140132ce5
mov rax, r9
shr rax, 0x10
cmp bx, r9w
jne 0x140132c8d
cmp si, ax
jmp 0x140132ce8
cmp bp, r9w
jne 0x140132cb7
cmp si, ax
jne 0x140132cee
mov rdx, rbp
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_EndDialog]
mov rax, qword [rsp + 0x88]
mov qword [rax], rsi
mov eax, ebx
jmp 0x140132dd9
mov eax, 0x470
cmp ax, r9w
jne 0x140132cee
mov rax, r9
shr rax, 0x10
cmp si, ax
jne 0x140132cee
call fcn.1401343d0
mov rcx, qword [rsp + 0x88]
mov qword [rcx], rax
mov eax, ebx
jmp 0x140132dd9
cmp r8d, ebp
je 0x140132dc8
cmp r8d, dword [0x14030c200]
jne 0x140132d72
lea rax, [rcx + 0x40]
cmp r9, rax
jne 0x140132dc8
lea rcx, [rsp + 0x40]
call fcn.1400e2a80
nop
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, qword [rax]
lea rdx, [0x14026ad70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140132d56
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov rdx, rbp
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_EndDialog]
mov rax, qword [rsp + 0x88]
mov qword [rax], rsi
mov eax, ebx
jmp 0x140132dd9
cmp r8d, 0x2e0
jne 0x140132dd7
call fcn.140044d30
mov rcx, rax
mov rdx, qword [rdi + 8]
call fcn.140048190
mov rax, qword [rsp + 0x80]
test rax, rax
je 0x140132dc8
mov r9d, dword [rax + 4]
mov r8d, dword [rax]
mov ecx, dword [rax + 0xc]
sub ecx, r9d
mov eax, dword [rax + 8]
sub eax, r8d
mov dword [rsp + 0x30], ILIsEqual
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
xor edx, edx
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rax, qword [rsp + 0x88]
mov qword [rax], rsi
mov eax, ebx
jmp 0x140132dd9
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140136120
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, r8
call fcn.140136eb0
test eax, eax
jne 0x140136159
mov eax, 2
jmp 0x1401362fe
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
lea r8, [0x1402670e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rsi, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x140136190
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140136190
xor edi, edi
jmp 0x140136195
mov edi, 1
mov dword [rsp + 0x30], edi
call fcn.14012bfe0
mov qword [0x140316630], rax
call fcn.140166630
mov qword [0x140316638], rax
mov qword [0x140316640], rbp
call fcn.1400f1ae0
mov qword [0x140316648], rax
mov qword [rsp + 0x20], 0
lea rcx, [fcn.140052e50]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rbx, rax
mov qword [rsp + 0x20], rax
lea rcx, [0x140052ee0]
call fcn.1401fec2c
lea rdx, [0x140052ee0]
mov ecx, 0x16
call fcn.140216888
lea rdx, [0x140052ee0]
mov ecx, 2
call fcn.140216888
lea rdx, [0x140052ee0]
mov ecx, 4
call fcn.140216888
lea rdx, [0x140052ee0]
mov ecx, 0xb
call fcn.140216888
lea rdx, [0x140052ee0]
mov ecx, InitCommonControls
call fcn.140216888
nop
mov rcx, rbp
call fcn.140135ee0
mov ebp, eax
lea rcx, [0x1403059a0]
call fcn.140017f80
lea rcx, [0x1403059d0]
call fcn.140017f80
lea rcx, [0x140305a00]
call fcn.140017f80
lea rcx, [0x140305a30]
call fcn.14001e200
call fcn.1400f1ae0
mov rcx, rax
call fcn.1400f1c00
call fcn.14012bfe0
cmp dword [rax + 0xc4], 0
jne 0x1401362b1
call fcn.140166630
mov rcx, rax
xor edx, edx
call fcn.14016d760
test edi, edi
je 0x1401362b1
call fcn.1400d1080
call fcn.140166630
mov rdi, rax
lea rcx, [rax + 0x5b8]
call fcn.140029d60
lea rcx, [rdi + 0x660]
call fcn.140029d60
call fcn.14012bfe0
mov rcx, rax
call fcn.14012de80
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.140137770
nop
test rsi, rsi
je 0x1401362fc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401f74b0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140139990
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
xor r14d, r14d
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x48], r14d
mov qword [rsp + 0x50], r14
mov r9d, dword [rcx + 8]
or r9d, 0x2001f
mov r8, rdx
mov rdx, qword [rcx]
lea rcx, [rsp + 0x40]
call fcn.140139880
mov ebx, eax
test eax, eax
jne 0x140139ac8
mov dword [rsp + 0x58], 0x100
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140139aa1
nop word [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.140139990
mov ebx, eax
test eax, eax
jne 0x140139ac8
mov dword [rsp + 0x58], 0x100
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140139a50
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140139ab6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x48], r14d
mov rdx, rsi
mov rcx, rdi
call fcn.140139bd0
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140139add
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r14
mov eax, ebx
mov dword [rsp + 0x48], r14d
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1401f74b0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140139bd0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x140139c89
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x140139c55
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140139c74
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140139c74
mov rdx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call qword [case.0x140038ca6.0]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp dword [rdi + 8], 0
je 0x140139c74
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp byte [0x140315cc8], 0
jne 0x140139cd4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140139cc4
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140315cc0], rax
mov byte [0x140315cc8], 1
jmp 0x140139cdb
mov rax, qword [0x140315cc0]
mov byte [0x140315cc8], 1
jmp 0x140139cdb
mov rax, qword [0x140315cc0]
mov rcx, qword [rbx]
mov rdx, rsi
test rax, rax
je 0x140139c5e
mov r8d, dword [rbx + 8]
xor r9d, r9d
call qword [case.0x140038ca6.0]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14013b240
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], r14
xor edx, edx
mov r8d, 0x408
lea rcx, [rsp + 0x60]
call fcn.14022eb00
mov qword [rsp + 0x60], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14013b2dc
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14013b2dc
call fcn.140138b70
mov ebx, eax
jmp 0x14013b3fe
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14013b2fd
call fcn.140138b70
jmp 0x14013b3ed
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14013b320
call fcn.140138b70
jmp 0x14013b3ed
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x14013b342
mov ebx, 0x8007000e
jmp 0x14013b3ef
mov ecx, eax
test eax, eax
je 0x14013b377
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14013b436
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14013b377
lea rcx, [rsp + 0x60]
call fcn.140138b40
jmp 0x14013b381
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x14013b394
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x14013b3a5
mov ebx, 0x8007000e
jmp 0x14013b3ef
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14013b3ca
call fcn.140138b70
jmp 0x14013b3ed
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.14013ad70
mov ebx, eax
test rdi, rdi
je 0x14013b3fe
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x14013b415
lea rcx, [rsp + 0x60]
call fcn.140138b20
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1401f74b0
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.140019300
int3
Function at 0x140145170
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x130
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rsp + 0x128], rax
xor esi, esi
mov ebx, esi
sub edx, 0x818b
je 0x1401451aa
cmp edx, 8
jne 0x1401451af
lea ebx, [rsi + 3]
jmp 0x1401451af
mov ebx, 1
mov rdi, qword [rcx + 8]
mov qword [rsp + 0x30], rsi
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x1401452cb
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov ecx, ebx
call fcn.14010d800
test eax, eax
je 0x14014521d
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
mov r8, rbx
lea rdx, [0x14026ad70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rdx, [rbx - 0x18]
jmp 0x140145287
mov dword [0x14030c210], 1
xor edx, edx
mov r8d, 0xe0
lea rcx, [rsp + 0x40]
call fcn.14022eb00
lea rcx, [rsp + 0x40]
call fcn.14010dcb0
nop
mov dword [rsp + 0x88], ebx
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.14010fe70
nop
lea rcx, [rsp + 0x40]
cmp rax, 1
jne 0x140145272
call fcn.14010ded0
nop
mov dword [0x14030c210], esi
jmp 0x14014527e
call fcn.14010ded0
nop
mov dword [0x14030c210], esi
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401452a6
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.1401f74b0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80004005
call fcn.140019300
int3
Function at 0x140145be0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r12d, r12d
mov dword [rsp + 0x30], r12d
call fcn.1400e2200
cmp dword [rax + 0x10], r12d
je 0x140145c4a
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.https:__www.bandisoft.com_bandizip_
lea rdx, [0x14026ad70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rsp + 0x88]
call fcn.140022cf0
mov r13, rax
mov qword [rsp + 0x80], r12
mov rcx, qword [rax]
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x140145c83
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x20]
call qword [case.0x140038ca6.0]
mov rcx, rax
test rax, rax
jne 0x140145ca7
call fcn.140019590
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140038ca6.0]
mov rcx, rax
test rax, rax
je 0x140145e0c
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x80], rbx
mov r14d, 1
mov dword [rsp + 0x30], r14d
lea rcx, str.updater.exe
mov rsi, 0xffffffffffffffff
mov rdi, rsi
nop dword [rax]
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x140145ce0
mov r13, qword [r13]
movsxd r15, dword [r13 - 0x10]
lea ebp, [r15 + rdi]
test ebp, ebp
js 0x140145e17
mov ecx, r14d
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, ebp
or eax, ecx
jge 0x140145d24
mov edx, ebp
lea rcx, [rsp + 0x80]
call fcn.140018ea0
mov rbx, qword [rsp + 0x80]
add r15, r15
je 0x140145d5a
test rbx, rbx
je 0x140145d4a
mov r8, r15
mov rcx, rbx
test r13, r13
je 0x140145d43
mov rdx, r13
call fcn.14022e460
jmp 0x140145d5a
xor edx, edx
call fcn.14022eb00
call fcn.1401fed34
mov dword [rax], 0x16
call fcn.1401feb94
movsxd r8, edi
add r8, r8
lea rcx, [r15 + rbx]
je 0x140145d89
test rcx, rcx
jne 0x140145d7d
call fcn.1401fed34
mov dword [rax], 0x16
call fcn.1401feb94
jmp 0x140145d89
lea rdx, str.updater.exe
call fcn.14022e460
cmp ebp, dword [rbx - 0xc]
jg 0x140145e17
mov dword [rbx - 0x10], ebp
movsxd rax, ebp
mov word [rbx + rax*2], r12w
call fcn.1401b3760
mov rcx, rax
mov r9d, r14d
xor r8d, r8d
mov rdx, rbx
call fcn.1401b37e0
and r14d, 0xfffffffe
mov dword [rsp + 0x30], r14d
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140145ddd
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140145c32
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
jmp 0x140145c32
mov ecx, 0x80004005
call fcn.140019300
int3
mov ecx, 0x80070057
call fcn.140019300
int3
Function at 0x140145e30
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rbp + 0xa0], rax
call fcn.1400e2200
cmp dword [rax + 0x10], 0
je 0x140145ee4
xor edx, edx
mov r8d, 0xb0
lea rcx, [rbp - 0x10]
call fcn.14022eb00
xor ebx, ebx
mov qword [rbp - 8], rbx
lea rax, [rbp]
mov qword [rsp + 0x68], rax
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], rbx
mov dword [rbp + 0x28], ebx
lea rax, vtable.IXSkinCallback.0
mov qword [rbp + 0x30], rax
lea rax, vtable.CLicenseGuideDlg.1.0
mov qword [rbp - 0x10], rax
lea rax, vtable.CLicenseGuideDlg.0
mov qword [rbp + 0x30], rax
lea rcx, [rbp + 0x40]
call fcn.140080a40
nop
mov dword [rbp + 0x38], 5
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.1400f58a0
nop
lea rcx, [rbp - 0x10]
call fcn.1400e69a0
jmp 0x140146014
xor ebx, ebx
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x70]
call fcn.140022dc0
nop
mov rdi, qword [rsp + 0x70]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
mov dword [rbp - 0x1c], eax
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x140146038
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov dword [rbp - 0x80], 0x68
lea r9, str._recovery
mov r8, rdi
lea rdx, str.__s___s
lea rcx, [rsp + 0x68]
call fcn.14001c4c0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [rsp + 0x68]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140145fcb
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x140145fcb
lea rdx, [rbx - 0x18]
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140145ff1
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140146014
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.1401f74b0
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
mov ecx, 0x80004005
call fcn.140019300
int3
Function at 0x140146050
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x2b8], 1
mov edi, edx
mov rbx, rcx
jne 0x140146256
call fcn.140166630
cmp dword [rax + 0x62c], 3
jne 0x1401460fe
call fcn.140166630
add dword [rax + 0x630], edi
call fcn.140166630
cmp dword [rax + 0x630], 0x40
jge 0x1401460bd
call fcn.140166630
mov dword [rax + 0x630], 0x40
mov edx, 0x8186
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140144ea0
call fcn.140166630
cmp dword [rax + 0x630], 0x100
jle 0x1401460dd
call fcn.140166630
mov dword [rax + 0x630], 0x100
call fcn.140166630
mov rcx, qword [rbx + 0x168]
mov edx, dword [rax + 0x630]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1401ab760
call fcn.140166630
mov edx, dword [rax + 0x62c]
test edx, edx
je 0x14014619b
sub edx, 1
je 0x140146142
cmp edx, 1
jne 0x140146256
test edi, edi
jle 0x14014613a
mov edx, 0x8227
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140144ea0
jns 0x140146256
jmp 0x1401461a3
test edi, edi
jg 0x1401460a6
jns 0x140146256
mov rdi, qword [rbx + 0x168]
call fcn.140166630
call fcn.140166630
xor r9d, r9d
xor r8d, r8d
mov dword [rax + 0x62c], 0
mov rcx, qword [rdi + 8]
lea edx, [r9 + 0xb]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 8]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov r8d, eax
and r8d, 0xfffffffd
or r8d, 1
jmp 0x1401461e8
test edi, edi
jle 0x140146256
mov rdi, qword [rbx + 0x168]
call fcn.140166630
call fcn.140166630
xor r9d, r9d
xor r8d, r8d
mov dword [rax + 0x62c], 1
mov rcx, qword [rdi + 8]
lea edx, [r9 + 0xb]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 8]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov r8d, eax
or r8d, 3
cmp eax, r8d
je 0x1401461fc
mov rcx, qword [rdi + 8]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [rdi + 8]
xor r9d, r9d
lea r8d, [r9 + 1]
lea edx, [r9 + 0xb]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 8]
mov r9d, 0x2000000
mov r8d, r9d
mov edx, 0x1036
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
mov rcx, rdi
call fcn.1401ab550
mov rcx, qword [rbx + 0x160]
call fcn.1401adbf0
mov rcx, qword [rbx + 0x168]
mov rdx, rax
call fcn.1401aa030
mov rcx, rbx
call fcn.140163660
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x20
mov dword [rcx + 0x1d0], edx
mov rbx, rcx
cmp edx, 0x40
jge 0x1401ab780
mov dword [rcx + 0x1d0], 0x40
jmp 0x1401ab792
cmp edx, 0x100
jle 0x1401ab792
mov dword [rcx + 0x1d0], 0x100
mov dl, 1
call fcn.1401ab550
mov rdx, qword [rbx + 0x78]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1401aa030
Function at 0x14014fdb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx + 0x168]
mov edi, edx
mov rsi, rcx
call fcn.140166630
call fcn.140166630
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov dword [rax + 0x62c], ebx
mov rcx, qword [rbp + 8]
lea edx, [rbx + 0xb]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 8]
lea edx, [rbx - 0x10]
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov r8d, eax
and r8d, 0xfffffffd
or r8d, 1
cmp eax, r8d
je 0x14014fe1f
mov rcx, qword [rbp + 8]
lea edx, [rbx - 0x10]
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [rbp + 8]
xor r9d, r9d
lea edx, [r9 + 0xb]
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 8]
mov r9d, 0x2000000
mov r8d, r9d
mov edx, 0x1036
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
mov rcx, rbp
call fcn.1401ab550
mov rcx, qword [rsi + 0x160]
call fcn.1401adbf0
mov rcx, qword [rsi + 0x168]
mov rdx, rax
call fcn.1401aa030
mov rcx, rsi
call fcn.140163660
mov rcx, qword [rsi + 0x168]
call fcn.1401a8640
cmp edi, 0x8068
ja 0x14014ffbb
je 0x14014ffa0
add edi, 0xffff7fb7
cmp edi, 0xe
ja case.0x14014feb7.32842
lea rdx, [0x140000000]
mov ecx, dword [rdx + rdi*4 + 0x150018]
add rcx, rdx
jmp rcx
call fcn.140166630
cmp dword [rax + 0x438], ebx
sete bl
call fcn.140166630
mov dword [rax + 0x438], ebx
jmp case.0x14014feb7.32842
call fcn.140166630
cmp dword [rax + 0x43c], ebx
sete bl
call fcn.140166630
mov dword [rax + 0x43c], ebx
jmp case.0x14014feb7.32842
call fcn.140166630
cmp dword [rax + 0x440], ebx
sete bl
call fcn.140166630
mov dword [rax + 0x440], ebx
jmp case.0x14014feb7.32842
call fcn.140166630
cmp dword [rax + 0x444], ebx
sete bl
call fcn.140166630
mov dword [rax + 0x444], ebx
jmp case.0x14014feb7.32842
call fcn.140166630
cmp dword [rax + 0x448], ebx
sete bl
call fcn.140166630
mov dword [rax + 0x448], ebx
jmp case.0x14014feb7.32842
call fcn.140166630
cmp dword [rax + 0x44c], ebx
sete bl
call fcn.140166630
mov dword [rax + 0x44c], ebx
jmp case.0x14014feb7.32842
call fcn.140166630
cmp dword [rax + 0x450], ebx
sete bl
call fcn.140166630
mov dword [rax + 0x450], ebx
jmp case.0x14014feb7.32842
call fcn.140166630
cmp dword [rax + 0x458], ebx
sete bl
call fcn.140166630
mov dword [rax + 0x458], ebx
jmp case.0x14014feb7.32842
call fcn.140166630
cmp dword [rax + 0x454], ebx
sete bl
call fcn.140166630
mov dword [rax + 0x454], ebx
jmp case.0x14014feb7.32842
cmp edi, 0x820c
jne case.0x14014feb7.32842
call fcn.140166630
cmp dword [rax + 0x45c], ebx
sete bl
call fcn.140166630
mov dword [rax + 0x45c], ebx
mov rcx, qword [rsi + 0x168]
call fcn.1401aac90
mov rcx, qword [rsi + 0x160]
call fcn.1401adbf0
mov rcx, qword [rsi + 0x168]
mov rdx, rax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp fcn.1401aa030