joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4546e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45478f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x005b19c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers

Function at 0x45ddc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005b17aa], 0
je 0x45ddce
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x45dde0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005b17aa], 0
je 0x45ddf5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x45de00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005b17aa], 0
je 0x45de35
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005b1d40]
aesenc xmm0, xmmword [0x005b1d50]
aesenc xmm0, xmmword [0x005b1d60]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x45de40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005b17aa], 0
je 0x45de76
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005b1d40]
aesenc xmm0, xmmword [0x005b1d50]
aesenc xmm0, xmmword [0x005b1d60]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback

Function at 0x45f740
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rdx, 2
jmp sym.sigtramp

Function at 0x45fb40
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x45fb74
mov rcx, 0x28
jmp 0x45fb7f
shl rcx, 3
add rcx, 0x1480
mov qword [0x005b19c8], rcx
pop rbp
ret
Function at 0x475760
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47582a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x005b19c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x47580f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004a3380]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x4757fe
mov edi, 1
lea rsi, [0x004a3380]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004dbc78]
lea rsi, [0x004db5a8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString
Function at 0x140004bf0
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x140238ea0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
mov qword [r11 - 0x48], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbp
mov word [rsp + 0x50], bp
test eax, eax
je 0x140004cc1
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
lea ebx, [rax + 1]
mov edx, ebx
lea r8, [0x1401fa25c]
lea rcx, [rsp + 0x28]
call fcn.140003280
nop
mov rsi, qword [rsp + 0x28]
mov rdx, rsi
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
cmp word [rsi], bp
jne 0x140004c95
mov r8d, ebp
jmp 0x140004cab
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rsi + r8*2], 0
jne 0x140004ca0
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140002040
nop
mov rcx, rsi
call fcn.140004dd8
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
mov word [rdi], bp
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140001d00
nop
mov rax, qword [rdi + 0x10]
cmp rax, 1
jbe 0x140004d4c
mov rcx, qword [rdi + 0x18]
cmp rcx, 8
jb 0x140004cfe
mov rdx, qword [rdi]
jmp 0x140004d01
mov rdx, rdi
cmp word [rdx + rax*2 - 2], 0x2f
je 0x140004d1f
cmp rcx, 8
jb 0x140004d14
mov rdx, qword [rdi]
jmp 0x140004d17
mov rdx, rdi
cmp word [rdx + rax*2 - 2], 0x5c
jne 0x140004d4c
lea rdx, [rax - 1]
cmp rdx, rax
ja 0x140004d40
mov qword [rdi + 0x10], rdx
cmp rcx, 8
jb 0x140004d37
mov rax, qword [rdi]
jmp 0x140004d3a
mov rax, rdi
mov word [rax + rdx*2], bp
jmp 0x140004d4c
sub rdx, rax
mov rcx, rdi
call fcn.140003380
nop
cmp qword [rsp + 0x68], 8
jb 0x140004d5e
mov rcx, qword [rsp + 0x50]
call fcn.140004dd8
mov rax, rdi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140170410
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140008ecc
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140008f2f
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140008f43
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008f43
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x140008f48
cmp dword [rcx + 8], 0
je 0x140008f43
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x140008f48
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14000d3c8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140238ea0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rcx
mov rcx, qword [0x14023e838]
test rcx, rcx
jne 0x14000d42d
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000d44e
lea rdx, str.SetDefaultDllDirectories
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14023e838], rax
jmp 0x14000d436
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rbx, rax
test rbx, rbx
je 0x14000d44e
xor edx, edx
mov r8d, 0x800
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x14000d4b0
mov ebx, 0x105
lea rcx, [rsp + 0x20]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x14000d468
xor eax, eax
jmp 0x14000d4b0
lea rcx, [rsp + 0x20]
call fcn.140172c44
cmp word [rsp + rax*2 + 0x1e], 0x5c
je 0x14000d492
lea r8, [0x1401f9f38]
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140173a08
test eax, eax
jne 0x14000d464
lea rcx, [rsp + 0x20]
mov r8, rdi
mov rdx, rbx
call fcn.140173a08
test eax, eax
jne 0x14000d464
lea rcx, [rsp + 0x20]
call fcn.140013c30
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140170410
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret

Function at 0x14000e04c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x14000e0b4
call fcn.140005c68
mov r8d, 0xf0
mov rdx, rsi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14000e0b4
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x14000e0d6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, r14
call fcn.14001a3bc
mov esi, eax
test rdi, rdi
je 0x14000e0d4
test rbx, rbx
je 0x14000e0d4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000fba8
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.1400167d0
mov rdi, rax
test rax, rax
je 0x14000fc24
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x14000fc1f
cmp dword [rbx], 0x40
jb 0x14000fc1f
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x14000fc1f
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x14000fc28
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140013924
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x70
mov edi, r9d
mov rsi, r8
mov r14, rdx
mov r15d, ecx
and qword [rax - 0x10], 0
and qword [rax - 0x18], 0
xor ebx, ebx
mov eax, dword [0x14023b04c]
test eax, eax
je 0x140013976
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14023b04c]
test eax, eax
jne 0x14001397f
call fcn.140008564
test eax, eax
je 0x14001399b
lea rdx, [rsp + 0x60]
mov rcx, qword [0x140233008]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x1400139a6
xor eax, eax
jmp 0x140013a54
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8, rsi
mov rdx, r14
mov ecx, r15d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rsi, rax
mov qword [rsp + 0x68], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je 0x140013a36
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140013a38
xor edi, edi
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140013a51
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x140013a70
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov r14, rcx
and dword [rax - 0x18], 0
and qword [rax + 0x20], 0
xor ebx, ebx
mov eax, dword [0x14023b04c]
test eax, eax
je 0x140013aba
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14023b04c]
test eax, eax
jne 0x140013ac3
call fcn.140008564
test eax, eax
je 0x140013adf
lea rdx, [rsp + 0x58]
mov rcx, qword [0x140233008]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x140013ae7
xor eax, eax
jmp 0x140013b2e
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.USER32.dll_GetClassInfoExW]
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test eax, eax
sete bl
test ebx, ebx
je 0x140013b11
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140013b13
xor esi, esi
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140013b2c
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x140013b44
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14023e828]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14023b04c]
test eax, eax
je 0x140013b8f
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14023b04c]
test eax, eax
jne 0x140013b98
call fcn.140008564
test eax, eax
je 0x140013bb4
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140233008]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140013bbc
xor eax, eax
jmp 0x140013c19
test rbx, rbx
jne 0x140013bdc
lea rcx, str.InitCommonControlsEx
call fcn.140013874
mov rbx, rax
test rax, rax
je 0x140013be7
mov qword [0x14023e828], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140013bfc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140013bfe
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140013c17
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140013cfc
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, rcx
xor r14d, r14d
mov word [rax - 0x18], r14w
mov qword [rax + 0x10], r14
mov ebx, r14d
mov eax, dword [0x14023b04c]
test eax, eax
je 0x140013d44
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14023b04c]
test eax, eax
jne 0x140013d4d
call fcn.140008564
test eax, eax
je 0x140013d69
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140233008]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x140013d73
movzx eax, r14w
jmp 0x140013dbb
mov rcx, rdi
call qword [sym.imp.USER32.dll_RegisterClassW]
movzx ebx, ax
mov word [rsp + 0x20], ax
mov edi, r14d
test bx, bx
sete dil
test edi, edi
je 0x140013d9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140013d9f
mov esi, r14d
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x140013db8
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, bx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140013fc8
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
movsxd rsi, r8d
mov rbx, rdx
mov rdi, rcx
cmp qword [rcx + 0xc8], 0
jne 0x140014006
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1400140be
call fcn.140007c90
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x140014025
mov ecx, 0x80004005
call fcn.140005470
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rdi + 0xc8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x118]
mov rdx, rsi
or rdi, 0xffffffffffffffff
mov r9, rdi
mov r8, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1401721ac
test eax, eax
je 0x14001408d
cmp eax, 0xc
je 0x140014087
cmp eax, 0x16
je 0x140014081
cmp eax, 0x22
je 0x140014081
cmp eax, 0x50
je 0x14001408d
call fcn.140004e34
int3
call fcn.140004e34
int3
call fcn.140004e58
int3
test rbx, rbx
je 0x14001409d
mov rcx, rbx
call fcn.140172c44
mov rbx, rax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
add ecx, edi
test ecx, ecx
jg 0x1400140bc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400146e0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x140014706
mov r8, rdx
mov rdx, qword [rbx]
call fcn.140008ecc
jmp 0x14001476d
cmp byte [0x14023e8b8], 0
jne 0x14001474a
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001473a
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14023e8b0], rax
jmp 0x140014741
mov rax, qword [0x14023e8b0]
mov byte [0x14023e8b8], 1
jmp 0x140014751
mov rax, qword [0x14023e8b0]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140014767
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x14001476d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400158b0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movzx r14d, r8w
mov r15, rdx
mov r12, rcx
or r13d, 0xffffffff
movzx edi, r13w
mov word [rax - 0x38], r13w
mov rbx, qword [0x14023e8c0]
and qword [rax + 0x20], 0
xor esi, esi
mov eax, dword [0x14023b04c]
test eax, eax
je 0x14001590e
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14023b04c]
test eax, eax
jne 0x140015917
call fcn.140008564
test eax, eax
je 0x140015933
lea rdx, [rsp + 0x78]
mov rcx, qword [0x140233008]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14001593d
movzx eax, r13w
jmp 0x1400159a6
test rbx, rbx
jne 0x14001595d
lea rcx, str.GetFileTitleW
call fcn.140015800
mov rbx, rax
test rax, rax
je 0x140015971
mov qword [0x14023e8c0], rax
movzx r8d, r14w
mov rdx, r15
mov rcx, r12
call rbx
movzx edi, ax
mov word [rsp + 0x20], ax
xor ebx, ebx
cmp di, r13w
sete bl
test ebx, ebx
je 0x140015988
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14001598a
xor esi, esi
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400159a3
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, di
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001a8c8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_712
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x14001df9f
cmp dword [rcx + 0xd8], 0
jne 0x14001df9f
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.140005c68
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.14001e2fc
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14001df60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_712
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x14001df9f
cmp dword [rcx + 0xd8], 0
jne 0x14001df9f
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.140005c68
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.14001e2fc
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14001dffc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
mov r15, rcx
xor edi, edi
call fcn.140005c68
lea r8d, [rdi + 5]
mov rbp, qword [rax + 0x18]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbp
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x14001e058
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.14001e090
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret