joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001fd0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
lea rbp, [rsp + 0x30]
mov rax, qword [0x14009d2d0]
xor rax, rbp
mov qword [rbp + 0x20], rax
mov rsi, r9
mov r14, r8
mov r12, rdx
mov r15, rcx
mov dword [rbp + 4], 1
xor ebx, ebx
mov dword [rbp], ebx
mov rdi, qword [rbp + 0x90]
test rdi, rdi
je 0x140002029
mov eax, dword [rdi]
mov dword [rbp], eax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 4]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rbp + 4]
test r14, r14
je 0x14000204e
mov dword [r14], ecx
cmp ecx, 1
je 0x14000205c
cmp ecx, 7
jne 0x1400021ac
test rdi, rdi
je 0x1400021ac
mov r14d, dword [rdi]
test r14d, r14d
je 0x1400021ac
test eax, eax
je 0x140002080
cmp eax, 0xea
jne 0x1400021ac
mov eax, dword [rbp]
mov dword [rbp], r14d
mov dword [rdi], eax
test rsi, rsi
je 0x14000209b
mov r8d, eax
xor edx, edx
mov rcx, rsi
call fcn.1400464e0
mov qword [rbp + 8], rbx
lea rcx, [r14 + 0x10]
mov rdx, rbx
cmp rcx, r14
cmova rdx, rcx
test rdx, rdx
je 0x14000211a
cmp rdx, 0x400
ja 0x1400020f8
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x1400020ce
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400443b0
sub rsp, rax
lea rbx, [rsp + 0x30]
mov qword [rbp + 0x10], rbx
test rbx, rbx
je 0x14000211a
mov dword [rbx], 0xcccc
add rbx, 0x10
mov qword [rbp + 0x10], rbx
jmp 0x14000211a
mov rcx, rdx
call fcn.14004f290
mov rbx, rax
mov qword [rbp + 0x18], rax
test rax, rax
je 0x14000211a
mov dword [rax], 0xdddd
add rbx, 0x10
mov qword [rbp + 0x18], rbx
mov qword [rbp + 8], rbx
jmp 0x14000213f
test rbx, rbx
jne 0x140002149
lea eax, [rbx + 0xe]
jmp 0x1400021ac
mov r8d, dword [rbp]
xor edx, edx
mov rcx, rbx
call fcn.1400464e0
lea rax, [rbp]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 4]
xor r8d, r8d
mov rdx, r12
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r14d, eax
test eax, eax
jne 0x140002198
mov qword [rsp + 0x20], rdi
mov r9, rsi
mov r8, rbx
mov edx, dword [rbp + 4]
mov rcx, r15
call fcn.140003990
mov r14d, eax
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x1400021a9
call fcn.14004a7f8
mov eax, r14d
mov rcx, qword [rbp + 0x20]
xor rcx, rbp
call fcn.140043760
lea rsp, [rbp + 0x30]
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140003590
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push r12
push r14
push r15
sub rsp, 0x68
lea rbp, [rsp + 0x30]
mov rax, qword [0x14009d2d0]
xor rax, rbp
mov qword [rbp + 0x28], rax
mov r15, rdx
mov r12, rcx
mov r14, qword [rbp + 0x90]
test r14, r14
je 0x1400035dd
mov dword [r14], 0
mov dword [rbp], 0
mov dword [rbp + 4], 0x1f4
mov qword [rbp + 8], 0
mov eax, dword [rsp]
mov eax, 0x210
sub rsp, rax
lea rbx, [rsp + 0x30]
mov eax, dword [rbx]
mov qword [rbp + 0x10], rbx
test rbx, rbx
je 0x14000361c
mov dword [rbx], 0xcccc
add rbx, 0x10
mov qword [rbp + 0x10], rbx
mov qword [rbp + 8], rbx
jmp 0x14000363a
test rbx, rbx
je 0x1400037ae
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp]
xor r8d, r8d
mov rdx, r15
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp eax, 0xea
jne 0x140003753
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x140003683
call fcn.14004a7f8
mov qword [rbp + 8], 0
mov eax, dword [rbp + 4]
lea rcx, [rax + 0x10]
xor edx, edx
cmp rcx, rax
cmova rdx, rcx
test rdx, rdx
je 0x14000370a
cmp rdx, 0x400
ja 0x1400036e6
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x1400036bc
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400443b0
sub rsp, rax
lea rbx, [rsp + 0x30]
mov qword [rbp + 0x18], rbx
test rbx, rbx
je 0x14000370c
mov dword [rbx], 0xcccc
add rbx, 0x10
mov qword [rbp + 0x18], rbx
jmp 0x14000370c
mov rcx, rdx
call fcn.14004f290
mov rbx, rax
mov qword [rbp + 0x20], rax
test rax, rax
je 0x14000370c
mov dword [rax], 0xdddd
add rbx, 0x10
mov qword [rbp + 0x20], rbx
jmp 0x14000370c
xor ebx, ebx
mov qword [rbp + 8], rbx
jmp 0x14000372a
test rbx, rbx
je 0x1400037ae
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp]
xor r8d, r8d
mov rdx, r15
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x140003799
cmp dword [rbp], 3
je 0x140003764
mov esi, 0xd
jmp 0x140003799
mov rax, qword [rbp + 0x88]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rbp]
mov r8d, dword [rbp + 4]
mov rdx, rbx
call fcn.140003240
mov esi, eax
test r14, r14
je 0x140003799
mov eax, dword [rbp]
mov dword [r14], eax
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x1400037aa
call fcn.14004a7f8
mov eax, esi
jmp 0x1400037b3
mov eax, 0xe
mov rcx, qword [rbp + 0x28]
xor rcx, rbp
call fcn.140043760
lea rsp, [rbp + 0x38]
pop r15
pop r14
pop r12
pop rsi
pop rbx
pop rbp
ret
Function at 0x140003ab0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x80], rbx
mov rax, qword [0x14009d2d0]
xor rax, rbp
mov qword [rbp + 0x28], rax
mov r12, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
xor ebx, ebx
mov dword [rbp], ebx
mov r13d, ebx
mov dword [rbp + 8], ebx
mov rdi, qword [rbp + 0x90]
test rdi, rdi
je 0x140003b12
mov r13d, dword [rdi]
mov dword [rbp + 8], r13d
mov eax, dword [rcx + 8]
test eax, eax
jne 0x140003cf5
mov eax, dword [rbp + 0x98]
test al, 1
jne 0x140003b5c
cmp dword [rbp + 0xa0], ebx
je 0x140003b3e
mov qword [rsp + 0x20], rdi
call fcn.140001fd0
jmp 0x140003cf5
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r9
mov r9, rsi
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x140003cf5
test rdi, rdi
jne 0x140003b6e
test rsi, rsi
jne 0x140003b6e
lea eax, [rdi + 0x57]
jmp 0x140003cf5
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
lea r9, [rbp]
xor r8d, r8d
call fcn.140003590
test rsi, rsi
je 0x140003b8d
mov ecx, dword [rbp + 4]
mov dword [rsi], ecx
test eax, eax
jne 0x140003cf5
test rdi, rdi
je 0x140003cf5
mov qword [rbp + 0x10], rbx
mov esi, dword [rbp]
lea rcx, [rsi + 0x10]
mov rdx, rbx
cmp rcx, rsi
cmova rdx, rcx
test rdx, rdx
je 0x140003c20
cmp rdx, 0x400
ja 0x140003bfe
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x140003bd4
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400443b0
sub rsp, rax
lea rbx, [rsp + 0x30]
mov qword [rbp + 0x18], rbx
test rbx, rbx
je 0x140003c20
mov dword [rbx], 0xcccc
add rbx, 0x10
mov qword [rbp + 0x18], rbx
jmp 0x140003c20
mov rcx, rdx
call fcn.14004f290
mov rbx, rax
mov qword [rbp + 0x20], rax
test rax, rax
je 0x140003c20
mov dword [rax], 0xdddd
add rbx, 0x10
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x10], rbx
jmp 0x140003c4c
test rbx, rbx
jne 0x140003c59
lea eax, [rbx + 0xe]
jmp 0x140003cf5
mov r8d, esi
xor edx, edx
mov rcx, rbx
call fcn.1400464e0
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
lea r9, [rbp]
mov r8, rbx
mov rdx, r14
mov rcx, r15
call fcn.140003590
mov r14d, eax
test eax, eax
jne 0x140003ce1
cmp dword [rbp + 0xa0], eax
je 0x140003cb8
mov edx, dword [rbp + 4]
cmp edx, 1
je 0x140003c9d
cmp edx, 7
jne 0x140003cb8
mov dword [rdi], r13d
mov qword [rsp + 0x20], rdi
mov r9, r12
mov r8, rbx
mov rcx, r15
call fcn.140003990
mov r14d, eax
jmp 0x140003ce1
test r12, r12
je 0x140003cdc
mov esi, dword [rbp]
cmp esi, dword [rdi]
jbe 0x140003ccc
mov r14d, 0xea
jmp 0x140003cdf
mov r8, rsi
mov rdx, rbx
mov rcx, r12
call fcn.140045e30
jmp 0x140003cdf
mov esi, dword [rbp]
mov dword [rdi], esi
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x140003cf2
call fcn.14004a7f8
mov eax, r14d
mov rcx, qword [rbp + 0x28]
xor rcx, rbp
call fcn.140043760
mov rbx, qword [rbp + 0x80]
lea rsp, [rbp + 0x30]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004200
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, r9
lea rax, [rsp + 0x38]
mov rsi, r8
mov qword [rsp + 0x20], rax
mov r15, rdx
movzx ebp, cl
mov r9d, 0x20219
lea rdx, str.SoftwareMcAfeeSystemCore
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov ebx, 3
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r12d, r12d
test eax, eax
mov r14d, r12d
cmove r14, qword [rsp + 0x38]
test r14, r14
je 0x140004370
lea eax, [rdi + rdi]
xor r8d, r8d
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rsi
mov rcx, r14
lea rdx, str.szInstallDir32
test bpl, bpl
jne 0x1400042a1
lea rdx, str.szInstallDir64
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140004367
test rsi, rsi
je 0x140004367
lea rax, [rdi - 1]
cmp rax, 0x7ffffffe
ja 0x14000435a
mov rcx, rdi
mov rax, rsi
cmp word [rax], r12w
je 0x1400042e0
add rax, 2
sub rcx, 1
jne 0x1400042d0
mov rax, rdi
sub rax, rcx
test rcx, rcx
cmove rax, r12
je 0x14000435a
mov rdx, rdi
lea rcx, [rsi + rax*2]
sub rdx, rax
je 0x140004332
sub rax, rdi
lea r9, [0x140085440]
add rax, 0x7ffffffe
add rax, rdx
sub r9, rcx
test rax, rax
je 0x140004332
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x140004332
mov word [rcx], r8w
dec rax
add rcx, 2
sub rdx, 1
jne 0x140004311
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r12w
je 0x14000435a
test r15, r15
je 0x140004367
mov r8, r15
mov rdx, rdi
mov rcx, rsi
call fcn.140004140
test eax, eax
jns 0x140004367
mov ebx, 0x6f
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x68]
test ebx, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
sete al
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x140004400
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov rax, qword [0x14009d2d0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, rcx
xor edi, edi
mov qword [rbp + 0x27], rdi
xor r14d, r14d
mov dword [rbp + 0x2f], r14d
cmp qword [rcx], r14
je 0x1400045a6
mov rax, qword [rcx + 8]
dec rax
cmp rax, 0x7fff
ja 0x1400045a6
mov qword [rcx + 0x18], r14
xor ebx, ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r15d, eax
test eax, eax
je 0x1400044be
mov eax, 2
mul r15
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140043788
mov rdi, rax
mov rdx, rax
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
je 0x1400044a7
mov rcx, rdi
jmp 0x1400044c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call fcn.140043780
xor edi, edi
xor r14d, r14d
jmp 0x1400044c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
xor ecx, ecx
test rcx, rcx
je 0x1400045ab
mov ebx, 0xe
mov ecx, r14d
mov r14, qword [rsi + 8]
add r14, 2
add r14, rcx
lea rcx, [r14 + r14]
call fcn.14004f290
mov rcx, rax
mov qword [rsi + 0x18], rax
test rax, rax
je 0x1400045ab
mov rax, qword [rsi]
mov qword [rsp + 0x20], rax
mov r9, rdi
lea r8, str._ls_ls
mov rdx, r14
call fcn.140004980
test eax, eax
js 0x14000459f
mov rax, qword [rsi + 0x18]
mov byte [rbp - 0x69], 0
mov dword [rbp - 0x65], 0
mov qword [rbp + 0x17], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x61], xmm0
movups xmmword [rbp - 0x51], xmm0
movups xmmword [rbp - 0x41], xmm0
movups xmmword [rbp - 0x31], xmm0
movups xmmword [rbp - 0x21], xmm0
movups xmmword [rbp - 0x11], xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], rax
xor edx, edx
lea rcx, [rbp - 0x69]
call fcn.140004800
mov ebx, eax
cmp byte [rbp - 0x69], 0
je 0x1400045ab
mov dword [rbp + 0x27], 0xaac56b
mov dword [rbp + 0x2b], 0x11d0cd44
mov dword [rbp + 0x2f], 0xc000c28c
mov dword [rbp + 0x33], 0xee95c24f
mov dword [rbp - 0x11], 2
lea r8, [rbp - 0x41]
lea rdx, [rbp + 0x27]
xor ecx, ecx
call qword [sym.imp.WINTRUST.dll_WinVerifyTrust]
jmp 0x1400045ab
mov ebx, 0x6f
jmp 0x1400045ab
mov ebx, 0x57
test rdi, rdi
je 0x1400045b8
mov rcx, rdi
call fcn.140043780
mov eax, ebx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140043760
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140005ad0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
cmp qword [rcx + 0x28], 0
je 0x140005b15
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, 0x1388
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140005b15
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x30]
xor esi, esi
test rcx, rcx
je 0x140005b31
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400408d8.0]
mov qword [rbx + 0x30], rsi
mov rdi, qword [rbx + 0x38]
test rdi, rdi
je 0x140005b78
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x140005b55
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax + 0x60]
call qword [case.0x1400408d8.0]
mov qword [rdi + 0x18], rsi
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140005b74
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax + 0x10]
call qword [case.0x1400408d8.0]
mov qword [rbx + 0x38], rsi
mov rdx, qword [rbx + 0x68]
sub rdx, 0x18
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005b9f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400408d8.0]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140005bb2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x28], rsi
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140005bc5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbx + 0x10], rsi
mov dword [rbx + 0x18], esi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140005bdb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], rsi
mov rcx, qword [rbx]
test rcx, rcx
je 0x140005bec
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140005c00
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rsi, r9
xor ebp, ebp
mov qword [rax - 0x38], rbp
mov dword [rax - 0x30], ebp
mov qword [rax - 0x28], rbp
lea r9d, [rbp + 1]
lea r8, str.SOFTWAREWOW6432NodeMcAfeeSystemCore
lea rcx, [rax - 0x38]
call fcn.14000dab0
test eax, eax
je 0x140005c5d
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140005cae
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x80], ebp
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
lea rdx, str.system_core_version
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x80]
test eax, eax
je 0x140005cbd
test ecx, ecx
jne 0x140005cbd
test rbx, rbx
je 0x140005cae
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
shr rcx, 1
inc rcx
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140043788
mov rdi, rax
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.system_core_version
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140005d1c
mov rcx, rdi
call fcn.140043780
jmp 0x140005ca0
mov eax, dword [rsp + 0x80]
and rax, 0xfffffffffffffffe
mov word [rax + rdi], bp
mov rdx, rdi
mov rcx, rsi
call fcn.140007c80
nop
mov rcx, rdi
call fcn.140043780
nop
test rbx, rbx
je 0x140005d4e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140008780
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov r14, rcx
test r8, r8
je 0x1400088d0
mov rax, qword [r8]
mov rcx, r8
mov rax, qword [rax + 0x18]
call qword [case.0x1400408d8.0]
add rax, 0x18
mov qword [r14], rax
lea rax, [rbx - 1]
cmp rax, 0xfffe
ja 0x1400088aa
movzx r15d, bx
xor edx, edx
lea rcx, [0x14009f6f0]
call fcn.140041ec0
mov rdi, rax
mov ebp, 1
test rax, rax
je 0x1400088b6
mov r12d, r15d
shr r12, 4
nop dword [rax + rax]
xor r9d, r9d
lea r8, [r12 + 1]
lea edx, [r9 + 6]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
je 0x140008878
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140008878
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140008878
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, r15d
and ecx, 0xf
jbe 0x14000886d
cmp rbx, rdx
jae 0x140008878
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add ecx, 0xffffffff
jne 0x140008858
cmp rbx, rdx
jae 0x140008878
cmp word [rbx], 0
jne 0x140008895
mov edx, ebp
inc ebp
lea rcx, [0x14009f6f0]
call fcn.140041ec0
mov rdi, rax
test rax, rax
je 0x1400088b6
jmp 0x140008800
test rdi, rdi
je 0x1400088b6
mov r8d, r15d
mov rdx, rdi
mov rcx, r14
call fcn.140008b40
jmp 0x1400088b6
mov rdx, rbx
mov rcx, r14
call fcn.140007c80
nop
mov rax, r14
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.14000ef90
int3
Function at 0x1400088e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r12
sub rsp, 0x30
lea rax, [rdx - 1]
mov r12, rcx
cmp rax, 0xfffe
ja 0x140008a10
mov qword [rsp + 0x48], rbp
lea rcx, [0x14009f6f0]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x28], r14
movzx r14d, dx
xor edx, edx
call fcn.140041ec0
mov rdi, rax
mov ebp, 1
test rax, rax
je 0x1400089f8
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x20], r15
mov r15d, r14d
shr r15, 4
xor r9d, r9d
lea r8, [r15 + 1]
mov rcx, rdi
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
je 0x1400089b8
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400089b8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400089b8
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
mov ecx, r14d
add rdx, rbx
and ecx, 0xf
jbe 0x1400089ad
cmp rbx, rdx
jae 0x1400089b8
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add ecx, 0xffffffff
jne 0x140008998
cmp rbx, rdx
jae 0x1400089b8
cmp word [rbx], 0
jne 0x1400089d6
mov edx, ebp
lea rcx, [0x14009f6f0]
inc ebp
call fcn.140041ec0
mov rdi, rax
test rax, rax
jne 0x140008941
jmp 0x1400089e9
test rdi, rdi
je 0x1400089e9
mov r8d, r14d
mov rdx, rdi
mov rcx, r12
call fcn.140008b40
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov al, 1
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
add rsp, 0x30
pop r12
ret
xor al, al
add rsp, 0x30
pop r12
ret

Function at 0x140008a20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r14d, edx
mov r12, rcx
xor edx, edx
lea rcx, [0x14009f6f0]
call fcn.140041ec0
mov rdi, rax
mov ebp, 1
test rax, rax
je 0x140008b04
mov r8d, r14d
shr r8d, 4
inc r8w
movzx r15d, r8w
xor r9d, r9d
mov r8, r15
mov rcx, rdi
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
je 0x140008ae8
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140008ae8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140008ae8
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
mov ecx, r14d
add rdx, rbx
and ecx, 0xf
jbe 0x140008add
cmp rbx, rdx
jae 0x140008ae8
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add ecx, 0xffffffff
jne 0x140008ac8
cmp rbx, rdx
jae 0x140008ae8
cmp word [rbx], 0
jne 0x140008b25
mov edx, ebp
lea rcx, [0x14009f6f0]
inc ebp
call fcn.140041ec0
mov rdi, rax
test rax, rax
jne 0x140008a72
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
test rdi, rdi
je 0x140008b04
mov r8d, r14d
mov rdx, rdi
mov rcx, r12
call fcn.140008b40
jmp 0x140008b06
Function at 0x140008b40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov eax, r8d
mov rsi, rdx
shr eax, 4
mov edi, r8d
inc ax
mov r14, rcx
movzx edx, ax
mov r8d, 6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x140008c63
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140008c63
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140008c63
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140008be9
nop word [rax + rax]
cmp rbx, rcx
jae 0x140008c63
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140008bd0
cmp rbx, rcx
jae 0x140008c63
movzx edi, word [rbx]
test di, di
je 0x140008c63
mov r10, qword [r14]
mov ecx, 1
movzx edx, di
mov eax, dword [r10 - 0xc]
sub ecx, dword [r10 - 8]
sub eax, edi
or ecx, eax
jge 0x140008c1f
mov edx, edi
mov rcx, r14
call fcn.1400090c0
mov r10, qword [r14]
movzx edx, word [rbx]
movzx r9d, dx
lea r8, [rbx + 2]
mov rdx, rdi
mov rcx, r10
call fcn.140051460
test eax, eax
je 0x140008c4a
cmp eax, 0xc
je 0x140008c96
cmp eax, 0x16
je 0x140008c80
cmp eax, 0x22
je 0x140008c80
cmp eax, 0x50
jne 0x140008c8b
mov rcx, qword [r14]
cmp edi, dword [rcx - 0xc]
jg 0x140008c80
mov dword [rcx - 0x10], edi
xor edx, edx
mov rcx, qword [r14]
lea eax, [rdx + 1]
mov word [rcx + rdi*2], dx
jmp 0x140008c65
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov ecx, 0x80070057
call fcn.14000ef90
int3
mov ecx, 0x80004005
call fcn.14000ef90
int3
mov ecx, 0x8007000e
call fcn.14000ef90
int3

Function at 0x140008f50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140008fc5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140008fc5
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140008fb5
nop
cmp rbx, rcx
jae 0x140008fc5
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140008fa0
cmp rbx, rcx
jae 0x140008fc5
cmp word [rbx], 0
je 0x140008fc5
mov rax, rbx
jmp 0x140008fc7
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret