joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004a1a0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140313918]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
cmp qword [rcx + 0x28], 0
je 0x14004a398
cmp qword [rcx + 0x18], 0
je 0x14004a398
cmp qword [rcx + 0x30], 0
je 0x14004a398
cmp qword [rcx + 0x20], 0
je 0x14004a398
mov byte [rbp - 0x50], 1
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x14004a3bb
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x48], rax
mov r8d, 3
lea rdx, [0x1402cd198]
lea rcx, [rbp - 0x48]
call fcn.140002aa8
mov rsi, qword [rbp - 0x48]
mov r9, rsi
xor r8d, r8d
mov edx, 0x116fb
mov rcx, qword [rbx]
call fcn.14001da60
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp - 0x40], eax
xor r14d, r14d
mov qword [rbp - 0x38], r14
lea rdx, [rbp - 0x40]
lea rcx, [0x14004a130]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14004a374
call qword [sym.imp.USER32.dll_GetDC]
mov rdi, rax
test rax, rax
je 0x14004a374
mov dword [rbp - 0x30], 0x10028
mov dword [rbp - 0x2c], 0x25
mov qword [rbp - 0x28], 0x1800
mov dword [rbp - 0x20], r14d
mov qword [rbp - 0x1c], 0x20000000
mov qword [rbp - 0x14], r14
mov dword [rbp - 0xc], r14d
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.GDI32.dll_ChoosePixelFormat]
test eax, eax
je 0x14004a374
lea r8, [rbp - 0x30]
mov edx, eax
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SetPixelFormat]
test eax, eax
je 0x14004a374
mov rcx, rdi
call qword [rbx + 0x18]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x14004a374
mov rdx, rax
mov rcx, rdi
call qword [rbx + 0x20]
test eax, eax
je 0x14004a374
lea rcx, str.glGetStringi
call qword [rbx + 0x30]
mov qword [rbx + 0x40], rax
test rax, rax
jne 0x14004a320
lea rdx, str.glGetStringi
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x40], rax
lea rcx, str.glGetString
call qword [rbx + 0x30]
mov qword [rbx + 0x48], rax
test rax, rax
jne 0x14004a348
lea rdx, str.glGetString
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x48], rax
lea rcx, str.glGetIntegerv
call qword [rbx + 0x30]
mov qword [rbx + 0x38], rax
test rax, rax
jne 0x14004a370
lea rdx, str.glGetIntegerv
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x38], rax
mov bl, 1
jmp 0x14004a376
xor bl, bl
lea rdx, [rsi - 0x18]
mov ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14004a393
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, bl
jmp 0x14004a39a
xor al, al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140215e10
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002d2c
int3
Function at 0x14004a560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r15, rdx
mov r13, rcx
xor sil, sil
mov byte [rsp + 0x70], sil
cmp qword [rcx + 0x40], 0
je 0x14004a65a
mov rax, qword [rcx + 0x38]
test rax, rax
je 0x14004a655
xor edi, edi
mov dword [r11 + 0x18], edi
lea rdx, [r11 + 0x18]
mov ecx, 0x821d
call rax
lea r14d, [rdi - 1]
lea r12d, [rdi + 1]
cmp edi, dword [rsp + 0x80]
jge 0x14004a720
mov edx, edi
mov ecx, 0x1f03
call qword [r13 + 0x40]
mov rbx, rax
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x14004a73d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140012a90
nop
test r15, r15
je 0x14004a748
mov rax, qword [rsp + 0x20]
mov rcx, rax
mov r8, r15
sub r8, rax
movzx ebx, word [rcx]
movzx edx, word [rcx + r8]
sub ebx, edx
jne 0x14004a625
add rcx, 2
test edx, edx
jne 0x14004a611
lea rdx, [rax - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004a63f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
movzx esi, sil
test ebx, ebx
cmove esi, r12d
mov byte [rsp + 0x70], sil
inc edi
jmp 0x14004a5b1
jmp 0x14004a72d
mov rax, qword [rcx + 0x48]
test rax, rax
je 0x14004a726
mov ecx, 0x1f03
call rax
mov rbx, rax
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x14004a753
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x88], rax
mov rdx, rbx
lea rcx, [rsp + 0x88]
call fcn.140012a90
nop
mov rbx, qword [rsp + 0x88]
test r15, r15
jne 0x14004a6bd
mov r14d, 0xffffffff
mov edi, r14d
jmp 0x14004a6f2
cmp dword [rbx - 0x10], 0
jge 0x14004a6ce
mov r14d, 0xffffffff
mov edi, r14d
jmp 0x14004a6f2
mov rdx, r15
mov rcx, rbx
call fcn.14021a0c8
mov rdi, rax
mov r14d, 0xffffffff
test rax, rax
jne 0x14004a6ec
mov edi, r14d
jmp 0x14004a6f2
sub rdi, rbx
sar rdi, 1
shr edi, 0x1f
xor dil, 1
lea rdx, [rbx - 0x18]
movzx esi, dil
mov byte [rsp + 0x70], dil
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x14004a720
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov byte [rsp + 0x70], dil
movzx eax, sil
jmp 0x14004a72d
jmp 0x14004a72d
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80004005
call fcn.140002d2c
nop
mov ecx, 0x80004005
call fcn.140002d2c
nop
mov ecx, 0x80004005
call fcn.140002d2c
int3
Function at 0x140050930
Capabilities:
Reference wmi statements

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x6e0
mov rax, qword [0x140313918]
xor rax, rsp
mov qword [rsp + 0x6d0], rax
mov r14, rdx
mov rbx, rcx
lea rdx, [0x1402c239a]
mov rcx, r14
call fcn.140012a90
cmp byte [rbx + 0x28], 0
jne 0x14005097a
xor al, al
jmp 0x140050b29
lea r8, [rsp + 0x48]
lea rdx, str.SELECT__FROM_Win32_BIOS
mov rcx, rbx
call fcn.140054220
test al, al
je 0x140050b27
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x90]
lea edx, [r15 - 1]
mov r8d, MsiSourceListClearAllW
call qword [rax + 0x20]
test eax, eax
js 0x140050b27
mov edi, r15d
cmp edi, dword [rsp + 0x30]
jae 0x140050b27
lea rcx, [rsp + 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lea rsi, [rsp + 0x90]
lea rsi, [rsi + rax*8]
lea r9, [rsp + 0x50]
lea r8, str.SerialNumber
mov rdx, qword [rsi]
call fcn.140053a90
test al, al
je 0x140050b0b
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x38]
call fcn.140055700
nop
mov rax, qword [rax]
test rax, rax
je 0x140050a2d
mov rdx, qword [rax]
jmp 0x140050a30
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.140009744
nop
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x140050a8e
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140050a89
test rbx, rbx
je 0x140050a89
mov rcx, qword [rbx]
test rcx, rcx
je 0x140050a6a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140050a7c
call fcn.140078df4
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.14000410c
mov qword [rsp + 0x38], r15
lea rdx, [rsp + 0x68]
cmp qword [rsp + 0x80], 8
jb 0x140050aad
mov rdx, qword [rsp + 0x68]
test rdx, rdx
jne 0x140050aad
mov eax, r15d
jmp 0x140050abe
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x140050ab4
mov r8d, eax
mov rcx, r14
call fcn.140002aa8
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 8
jb 0x140050b0b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140050b06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140050b52
call fcn.14000410c
mov rcx, qword [rsi]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
inc edi
jmp 0x1400509d0
mov al, 1
mov rcx, qword [rsp + 0x6d0]
xor rcx, rsp
call fcn.140215e10
lea r11, [rsp + 0x6e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.14021f028
nop
int3
Function at 0x140050b60
Capabilities:
Reference wmi statements

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x6b0
mov rax, qword [0x140313918]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov rsi, rdx
mov byte [rdx], 0
cmp byte [rcx + 0x28], 0
jne 0x140050b97
xor al, al
jmp 0x140050c39
lea r8, [rsp + 0x38]
lea rdx, str.SELECT__FROM_Win32_ComputerSystem
call fcn.140054220
test al, al
je 0x140050c37
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x60]
lea edx, [rbx - 1]
mov r8d, MsiSourceListClearAllW
call qword [rax + 0x20]
test eax, eax
js 0x140050c37
nop dword [rax]
cmp ebx, dword [rsp + 0x30]
jae 0x140050c37
lea rcx, [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
lea rdi, [rsp + 0x60]
lea rdi, [rdi + rbx*8]
lea r9, [rsp + 0x40]
lea r8, str.PartOfDomain
mov rdx, qword [rdi]
call fcn.140053a90
test al, al
je 0x140050c1e
cmp word [rsp + 0x48], 0xffff
jne 0x140050c1e
mov byte [rsi], 1
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
inc ebx
jmp 0x140050be0
mov al, 1
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.140215e10
lea r11, [rsp + 0x6b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140050c60
Capabilities:
Reference wmi statements

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x6e0
mov rax, qword [0x140313918]
xor rax, rsp
mov qword [rsp + 0x6d0], rax
mov r14, rdx
mov rbx, rcx
lea rdx, [0x1402c239a]
mov rcx, r14
call fcn.140012a90
cmp byte [rbx + 0x28], 0
jne 0x140050caa
xor al, al
jmp 0x140050e59
lea r8, [rsp + 0x48]
lea rdx, str.SELECT__FROM_Win32_ComputerSystem
mov rcx, rbx
call fcn.140054220
test al, al
je 0x140050e57
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x90]
lea edx, [r15 - 1]
mov r8d, MsiSourceListClearAllW
call qword [rax + 0x20]
test eax, eax
js 0x140050e57
mov edi, r15d
cmp edi, dword [rsp + 0x30]
jae 0x140050e57
lea rcx, [rsp + 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lea rsi, [rsp + 0x90]
lea rsi, [rsi + rax*8]
lea r9, [rsp + 0x50]
lea r8, str.Name
mov rdx, qword [rsi]
call fcn.140053a90
test al, al
je 0x140050e3b
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x38]
call fcn.140055700
nop
mov rax, qword [rax]
test rax, rax
je 0x140050d5d
mov rdx, qword [rax]
jmp 0x140050d60
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.140009744
nop
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x140050dbe
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140050db9
test rbx, rbx
je 0x140050db9
mov rcx, qword [rbx]
test rcx, rcx
je 0x140050d9a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140050dac
call fcn.140078df4
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.14000410c
mov qword [rsp + 0x38], r15
lea rdx, [rsp + 0x68]
cmp qword [rsp + 0x80], 8
jb 0x140050ddd
mov rdx, qword [rsp + 0x68]
test rdx, rdx
jne 0x140050ddd
mov eax, r15d
jmp 0x140050dee
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x140050de4
mov r8d, eax
mov rcx, r14
call fcn.140002aa8
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 8
jb 0x140050e3b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140050e36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140050e82
call fcn.14000410c
mov rcx, qword [rsi]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
inc edi
jmp 0x140050d00
mov al, 1
mov rcx, qword [rsp + 0x6d0]
xor rcx, rsp
call fcn.140215e10
lea r11, [rsp + 0x6e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.14021f028
nop
int3
Function at 0x140050e90
Capabilities:
Reference wmi statements

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x6c0
mov rax, qword [0x140313918]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
mov rsi, rdx
cmp byte [rcx + 0x28], 0
jne 0x140050ec8
xor al, al
jmp 0x1400510b4
lea r8, [rsp + 0x50]
lea rdx, str.SELECT__FROM_Win32_PnPEntity
call fcn.140054220
test al, al
je 0x1400510b2
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x70]
lea edx, [r14 - 1]
mov r8d, MsiSourceListClearAllW
call qword [rax + 0x20]
test eax, eax
js 0x1400510b2
mov edi, r14d
lea r15, str.usbvideo
nop
cmp edi, dword [rsp + 0x30]
jae 0x1400510b2
lea rcx, [rsp + 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov edx, edi
lea r9, [rsp + 0x58]
lea r8, str.Service
mov rdx, qword [rsp + rdx*8 + 0x70]
call fcn.140053a90
test al, al
je 0x14005109b
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.140055700
nop
mov rbx, qword [rax]
test rbx, rbx
je 0x140050f73
mov rbx, qword [rbx]
jmp 0x140050f76
mov rbx, r14
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x1400510dd
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
test rbx, rbx
je 0x140050fcc
cmp rbx, 0x10000
jae 0x140050fb3
movzx edx, bx
lea rcx, [rsp + 0x38]
call fcn.140010ac0
jmp 0x140050fe0
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140050fc0
jmp 0x140050fcf
mov eax, r14d
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140002aa8
nop
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x140051033
mov eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14005102e
test rbx, rbx
je 0x14005102e
mov rcx, qword [rbx]
test rcx, rcx
je 0x14005100f
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140051021
call fcn.140078df4
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.14000410c
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x38]
cmp byte [rsi], 0
jne 0x14005107e
mov rcx, 0xffffffffffffffff
nop dword [rax]
nop dword [rax + rax]
movzx edx, word [rax + rcx*2 + 2]
cmp dx, word [r15 + rcx*2 + 2]
jne 0x140051072
add rcx, 2
cmp rcx, 9
je 0x1400510ad
movzx edx, word [rax + rcx*2]
cmp dx, word [r15 + rcx*2]
je 0x140051050
sbb ecx, ecx
or ecx, 1
test ecx, ecx
sete cl
mov byte [rsi], cl
lea rdx, [rax - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005109b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
inc edi
jmp 0x140050f20
mov ecx, r14d
jmp 0x140051077
mov al, 1
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.140215e10
lea r11, [rsp + 0x6c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov ecx, 0x80004005
call fcn.140002d2c
int3
Function at 0x140053540
Capabilities:
Reference wmi statements

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
sub rsp, 0xb0
cmp byte [rcx + 0x28], 0
jne 0x140053562
xor al, al
add rsp, 0xb0
pop rdi
pop rsi
pop rbx
ret
xor dil, dil
mov byte [rsp + 0xd8], dil
lea r8, [rsp + 0xe8]
lea rdx, str.SELECT__FROM_Win32_SoundDevice
call fcn.140054220
test al, al
je 0x14005373f
xor esi, esi
mov qword [rsp + 0xe0], rsi
mov dword [rsp + 0xd0], esi
mov rcx, qword [rsp + 0xe8]
mov rax, qword [rcx]
lea rdx, [rsp + 0xd0]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0xe0]
mov rbx, 0xffffffffffffffff
lea r8d, [rsi + 1]
mov edx, ebx
call qword [rax + 0x20]
test eax, eax
jne 0x140053730
lea rcx, [rsp + 0x60]
call fcn.140037cf0
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov dil, 1
mov byte [rsp + 0xd8], dil
lea r9, [rsp + 0x48]
lea r8, str.Name
mov rdx, qword [rsp + 0xe0]
call fcn.140053a90
test al, al
je 0x140053683
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
lea r9d, [rsi + 8]
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x140053765
mov rdx, qword [rsp + 0x38]
test rdx, rdx
jne 0x140053659
mov eax, esi
jmp 0x14005366a
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140053660
mov r8d, eax
lea rcx, [rsp + 0x60]
call fcn.140002aa8
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea r9, [rsp + 0x48]
lea r8, str.DeviceID
mov rdx, qword [rsp + 0xe0]
call fcn.140053a90
test al, al
je 0x14005370b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, 8
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x14005376d
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x1400536f2
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x1400536e6
mov esi, ebx
mov r8d, esi
lea rcx, [rsp + 0x68]
call fcn.140002aa8
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0xe0]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rsp + 0x60]
call fcn.140037260
mov rcx, qword [rsp + 0xe8]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
movzx eax, dil
add rsp, 0xb0
pop rdi
pop rsi
pop rbx
ret
mov ecx, eax
call fcn.140002d2c
nop
mov ecx, eax
call fcn.140002d2c
int3
Function at 0x140059ee0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
xor ebp, ebp
xor bl, bl
mov qword [r9 + 0x10], rbp
mov rsi, r9
cmp qword [r9 + 0x18], 8
mov rdi, r8
mov rax, r9
jb 0x140059f14
mov rax, qword [r9]
mov word [rax], bp
mov r9d, 0x20019
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005a023
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rdx, rdi
mov dword [rsp + 0x60], ebp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005a018
mov ecx, dword [rsp + 0x60]
mov eax, 2
inc ecx
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140003e48
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x68]
mov rbx, rax
xor r8d, r8d
lea rax, [rsp + 0x60]
mov rdx, rdi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x68], 3
jne 0x14005a003
mov r8d, dword [rsp + 0x60]
lea eax, [r8 - 1]
mov r9b, 1
mov edx, ebp
test eax, eax
jle 0x14005a003
mov rax, rbx
cmp word [rax], bp
jne 0x140059ff0
movzx ecx, word [rax + 2]
test cx, cx
je 0x140059ff0
mov word [rax], cx
xor r9b, r9b
mov word [rax + 2], bp
mov r8d, dword [rsp + 0x60]
inc edx
lea ecx, [r8 - 1]
add rax, 2
cmp edx, ecx
jl 0x140059fd3
test r9b, r9b
je 0x140059fc3
mov rdx, rbx
mov rcx, rsi
call fcn.140009b0c
mov rcx, rbx
call fcn.140078df4
mov bl, 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x50]
movzx eax, bl
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14007cb24
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r14, r9
mov rdi, r8
mov rsi, rdx
mov r15, rcx
test r8, r8
je 0x14007cb8c
call fcn.14009dd2c
mov r8d, 0xf0
mov rdx, rdi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14007cb8c
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14007cbd2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
mov edi, 1
test rbx, rbx
je 0x14007cbb1
mov rcx, qword [r15]
mov r9, r14
mov r8, rbx
mov rdx, rsi
mov rax, qword [rcx + 0x40]
mov rcx, r15
call qword [case.0x1401b9669.0]
mov edi, eax
mov rcx, qword [rsi + 0xc8]
test rcx, rcx
je 0x14007cbd0
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x140]
mov rdx, r14
call qword [case.0x1401b9669.0]
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x14007d8c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov r14, r8
mov rdi, rdx
mov r8, rcx
test rdx, rdx
je 0x14007d960
movzx eax, word [rdx]
mov r9d, ebx
test ax, ax
je 0x14007d960
movzx eax, ax
inc r9d
add rdx, rax
movzx eax, word [rdx]
test ax, ax
jne 0x14007d8f0
test r9d, r9d
je 0x14007d960
cmp r9d, 1
jne 0x14007d920
mov r8, r14
xor edx, edx
xor ecx, ecx
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
js 0x14007d979
xor eax, eax
jmp 0x14007d963
lea esi, [r9 - 1]
mov rcx, rdi
test esi, esi
je 0x14007d93c
mov edx, esi
movzx eax, word [rcx]
add bx, ax
add rcx, rax
sub rdx, 1
jne 0x14007d92d
movzx edx, bx
mov rcx, r8
add edx, 2
call fcn.14007d820
movzx r8d, bx
mov rdx, rdi
mov rcx, rax
mov qword [r14], rax
call fcn.14021a590
mov eax, esi
jmp 0x14007d963
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
call fcn.14007a03c
int3

Function at 0x14008e9b0
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x78
test rdx, rdx
je 0x14008ea18
mov r10, qword [rcx + 0x10]
test r10, r10
je 0x14008ea02
cmp qword [rcx + 0x18], 0
jne 0x14008e9fd
mov eax, dword [rcx + 0xc]
cmp eax, dword [rcx + 0x30]
jae 0x14008ea1e
mov qword [rsp + 0x58], rdx
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0x50
mov edx, eax
mov dword [rsp + 0x24], MsiGetPropertyW
mov r8d, 1
mov rcx, qword [r10 + 8]
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
add rsp, 0x78
ret
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x14008ea18
mov rcx, qword [rcx + 0x40]
add rsp, 0x78
jmp fcn.1400a7038
call fcn.14007a03c
int3
call fcn.14007a03c
int3
Function at 0x14008fe7c
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14008fef7
xor r8d, r8d
call fcn.14009014c
mov rsi, rax
test rax, rax
je 0x14008fef3
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14008fef3
mov eax, dword [rsp + 0x30]
jmp 0x14008ff0d
mov eax, edi
jmp 0x14008ff0d
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret