joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1409bc293
Capabilities:
Packed with generic packer

Disassembly:
lea rbx, [rbx - 0x63daadc3]
setb cl
mov qword [rsp + 0x28], rcx
push rdi
push rdx
mov rdi, qword [rsp + 0x38]
or ecx, dword [rsp + 0x3a]
xchg qword [rsp + 0x48], rbx
mov rdi, qword [rsp + 8]
add qword [rsp + 0x40], 0xffffffffbf8315ca
mov rdx, qword [rsp + 0x38]
call fcn.140007f7e
call fcn.140006eb8
push rdx
movabs rdx, 0x34865d3ac41a72b5
pushfq
shr dl, 0x47
push rbp
mov qword [rsp + 0x18], 0xffffffffe04754df
mov rdx, qword [rsp + 0x10]
movabs rbp, 0x8024828747112e34
setbe bpl
jns 0x1407c5c9c
and ebp, 0x50a91884
neg bp
pop rbp
call fcn.140938d73
movabs rcx, 0xc383822464277f10
jbe fcn.140a524d8
add r15, 0x2b9cf12b
js 0x1407708c4
xchg ebp, eax
clc
xlatb
fsubr dword [rsi + 0x18d9bb61]
xchg ecx, eax
invalid

Function at 0x1409f4ed3
Capabilities:
Packed with generic packer

Disassembly:
setne byte [rsp + 0x28]
add qword [rsp + 0x18], 0xffffffffffe3ed32
push rdi

Function at 0x140a4b679
Capabilities:
Packed with generic packer

Disassembly:
push rdx
movabs rdx, 0xf4b104bf61374737
add dl, 0x82
mov rbx, qword [rsp + rbx - 0xffd7]
mov qword [rsp + 0x28], rax
not bx
jns 0x1405e0f61
invalid

Function at 0x140a62ea0
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
push 0xffffffff84a2022b
call 0x140743ea3

Function at 0x140a62eaa
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
mov r9, qword [rsp + 0x68]
xor word [rsp + 0x28], 0x800f
shl dword [rsp + 0x28], 0xa5
jbe 0x14093231a
mov rcx, qword [rsp + rbp*2 + 0x78]
je 0x14075518a
bswap r9
or byte [rsp + rbp + 0x28], bpl
shr byte [rsp + rbp*2 + 0x40], 0x36
and byte [rsp + 0x40], bpl
jo 0x1407356a0
lea r9, [r9 + r9*8 - 0x22ce40eb]
mov rbp, qword [rsp + 0x38]
adc eax, 0x48dd31bf
mov ebp, dword [rsp + 0x38]
shl byte [rsp + 0x40], 0x34
jns 0x140a401d5
jb 0x140a62eda
test dword [rcx + 0x580fce6], 0xc0265476
sbb dword [rsi - 0x74], esi
movsb byte [rdi], byte [rsi]
int1
test dword [rcx - 0x1f619687], 0xf9e2dc89
div byte [rdi + 0x52]
pop rcx
invalid

Function at 0x140a8287d
Capabilities:
Packed with generic packer

Disassembly:
or r15b, r15b
mov r15, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0xffffffffe05b40c2
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.140b1bba1
Function at 0x140c1d772
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
add r8b, r15b
ror dh, 2
clc
push rdi
or r8b, sil
push rbx
bt rax, rsp
cdqe
mov rax, qword gs:[0x30]
xor dl, r11b
cmp sil, r14b
mov rax, qword [rax + 0x60]
mov rdx, qword [rax + 0x18]
add rdx, 0x20
rcl r8b, 0x31
sub eax, eax
jmp 0x140c1d7ab
mov r8, rdx
jmp 0x140c1d7b3
jmp 0x140c1d7c7
test r11w, r11w
jmp 0x140c1d7c1
je 0x140c1d879
mov r8, qword [r8]
cmp r12d, 0x8ab6eea5
clc
cmp r8, rdx
jmp 0x140c1d7da
je 0x140c1d88b
test rcx, rcx
jmp 0x140c1d7e8
je 0x140c1d879
mov r9, qword [r8 + 0x50]
mov r11w, bp
sub r10d, r10d
nop word [rax + rax]
movsx esi, byte [rcx + r10]
shr edi, 0x29
not bl
lea edi, [rsi - 0x41]
movsx r11, ax
mov r11d, esi
add r11d, 0x20
rcr bx, cl
shr ebx, cl
shl bl, 0xa2
cmp dil, 0x1a
movzx rdi, cx
movsxd rbx, ebp
cmovae r11d, esi
btr rsi, 0xa5
movzx edi, word [r9 + r10*2]
shr rbx, cl
lea ebx, [rdi - 0x41]
rcl sil, cl
lea esi, [rdi + 0x20]
stc
cmp bx, 0x1a
jmp 0x140c1d84e
cmovae esi, edi
cmp r15b, 0x8c
test r11w, r11w
jmp 0x140c1d85e
je 0x140c1d7b8
inc r10
test spl, sil
cmp r11w, si
je 0x140c1d7ff
jmp 0x140c1d7b8
mov rax, qword [r8 + 0x20]
bswap di
cmovbe rbx, rbx
mov rdi, 0xffffffffaaa06e88
pop rbx
movzx di, sil
movsx rsi, cx
pop rdi
pop rsi
jmp 0x140c1d89c
ret

Function at 0x140c1d89d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
xor r8w, r15w
push r14
push rsi
push rdi
bswap r9
push rbp
movzx r8d, cx
xor r9b, bpl
sbb r8w, bx
push rbx
sub r8d, r15d
shr r8b, cl
movsxd r9, dword [rcx + 0x3c]
not r8d
shrd r8d, r8d, 0x37
mov r8d, dword [r9 + rcx + 0x88]
cmp ax, r8w
test bl, 0xbb
clc
xor eax, eax
stc
test r8, r8
je 0x140c1da5f
cmp dword [r9 + rcx + 0x8c], 0
jmp 0x140c1d8f3
je 0x140c1da5f
mov r9d, dword [r8 + rcx + 0x18]
cmp bp, 0x84a1
stc
test r9, r9
je 0x140c1da12
mov r11d, dword [rcx + r8 + 0x20]
movsx r14w, dl
lea r11, [r11 + rcx]
xor eax, eax
bsr r15d, ebx
not r14b
sub r10d, r10d
sar r15b, cl
nop word cs:[rax + rax]
mov esi, dword [r11 + r10*4]
sub r15, 0x442b87be
add rsi, rcx
or r14w, r13w
xchg bp, r14w
sal rbp, 0xc
sub edi, edi
nop dword [rax]
movsx r14d, byte [rdx + rdi]
ror bl, cl
bsf rbp, rsp
movsx r15d, byte [rsi + rdi]
neg rbp
mov bpl, r9b
btc bx, 0x94
lea ebp, [r14 - 0x41]
bts ebx, esi
and bh, dh
cmc
mov ebx, r14d
jmp 0x140c1d98b
add ebx, 0x20
cmp bpl, 0x1a
cmovae ebx, r14d
bts bp, r11w
lea r14d, [r15 - 0x41]
bts ebp, ecx
xor ebp, r10d
mov ebp, r15d
cmc
add ebp, 0x20
cmp r13d, 0x812a4930
cmp r14b, 0x1a
seta r14b
cmovae ebp, r15d
clc
xor r14b, 0x20
mov r14d, ebx
clc
jmp 0x140c1d9cd
or r14w, bp
sete r14b
jmp 0x140c1d9da
je 0x140c1d9ec
inc rdi
cmp bx, bp
je 0x140c1d958
test r14b, r14b
jne 0x140c1da1e
inc r10
cmp r9d, 0x6e863a1b
cmp r10, r9
jmp 0x140c1da07
jne 0x140c1d935
jmp 0x140c1da5f
sub eax, eax
jmp 0x140c1da19
jmp 0x140c1da5f
mov eax, dword [rcx + r8 + 0x1c]
jmp 0x140c1da28
mov edx, dword [rcx + r8 + 0x24]
lea rdx, [rdx + rcx]
mov r8d, r10d
movzx edx, word [rdx + r8*2]
ror r14w, 0x8a
add rax, rcx
mov eax, dword [rax + rdx*4]
mov r14d, 0xbd03c7bb
sets dil
cmp sp, sp
add rax, rcx
mov bpl, 0x36
movsx r14d, r12w
cmovp bx, bp
pop rbx
pop rbp
xchg si, di
pop rdi
mov r15d, r15d
pop rsi
pop r14
pop r15
jmp 0x140c1da72
ret
Function at 0x140c206c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
movabs rax, 0x9ab9cbbbef3b2f3a
bts dx, cx
adc dl, ch
mov dword [rsp + 0x2c], 0
stc
xadd dh, cl
mov qword [rsp + 0x40], rax
rol rcx, 0x95
rcl cl, cl
mov rcx, qword [rsp + 0x40]
movabs rdx, 0x776d726946746547
cmc
cmp bl, 0x82
test rsp, 0x3a1cbd3f
xor rdx, rcx
sar cx, cl
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x30], rax
adc cl, r15b
mov rcx, qword [rsp + 0x30]
movzx edx, r9w
movabs rdx, 0x65707954657261
xor rdx, rcx
rcl cx, cl
mov qword [rsp + 0x48], rdx
add cl, 0xa0
cmovl cx, cx
mov qword [rsp + 0x30], rax
shld cx, r13w, 0x9d
sal rcx, 0x31
movsx cx, bh
mov qword [rsp + 0x20], 2
xchg ch, ch
adc cx, ax
mov rcx, qword [rsp + 0x20]
cmp bpl, 0x99
test rcx, rcx
jmp 0x140c2076f
je 0x140c207b6
sub ecx, ecx
add dl, r12b
nop dword [rax + rax]
mov rdx, qword [rsp + 0x30]
cmp r12b, 0x9a
clc
xor qword [rsp + rcx*8 + 0x40], rdx
movsx rdx, bx
inc rcx
shld dx, r11w, 0x88
mov rdx, qword [rsp + 0x20]
test di, 0xc7a0
cmp rcx, rdx
jmp 0x140c207b0
jb 0x140c20782
mov qword [rsp + 0x30], rax
rol dx, 0x90
bswap cx
mov rcx, qword [rsp + 0x30]
add dl, 0xae
rcr dx, cl
movabs rdx, 0x32336c656e72656b
jmp 0x140c207e3
xor rdx, rcx
mov rcx, 0x162d7ba1
cmc
mov qword [rsp + 0x30], rdx
bsr cx, bp
mov qword [rsp + 0x20], rax
adc cl, 0xae
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
test r12b, spl
mov qword [rsp + 0x50], 2
cmp dil, r8b
mov rax, qword [rsp + 0x50]
cmp rcx, rsp
clc
test si, bp
test rax, rax
jmp 0x140c20831
je 0x140c20884
xor eax, eax
rcl ecx, 6
nop dword [rax]
adc cx, 0xf393
movzx rcx, r10w
mov rcx, qword [rsp + 0x20]
test r11w, 0x6dbc
xor qword [rsp + rax*8 + 0x30], rcx
xchg cl, cl
mov cx, r11w
inc rax
cmp spl, 0x8e
bts cx, bx
cmp r14b, al
mov rcx, qword [rsp + 0x50]
clc
cmp r11b, bl
cmp cx, 0x3f1d
cmp rax, rcx
jb 0x140c20849
lea rcx, [rsp + 0x30]
jmp 0x140c2088e
call fcn.140c1d772
lea rdx, [rsp + 0x40]
mov cl, r13b
jmp 0x140c208a4
mov rcx, rax
jmp 0x140c208ac
call fcn.140c1d89d
lea rcx, [rsp + 0x2c]
jmp 0x140c208bb
call rax
test eax, eax
jmp 0x140c208c4
je 0x140c208d0
mov eax, dword [rsp + 0x2c]
clc
cmc
add rsp, 0x58
jmp 0x140c208d9
ret
Function at 0x140c247a3
Capabilities:
Encode data using xor

Disassembly:
push rsi
test r15d, r13d
inc rcx
mov ecx, r9d
sub rsp, 0x250
movabs rax, 0x9ab9cbbbef3b2f3a
sar ecx, cl
movzx ecx, r12w
mov qword [rsp + 0x50], rax
btc edx, r9d
sbb ecx, r12d
mov rcx, qword [rsp + 0x50]
movsx dx, r9b
movabs rdx, 0x6c75646f4d746547
cmp spl, 0xbe
xor rdx, rcx
mov cl, 0x90
mov qword [rsp + 0x38], rdx
sal cx, 0xaf
add ecx, 0x7293553c
mov qword [rsp + 0x50], rax
bswap ecx
or dx, di
mov rcx, qword [rsp + 0x50]
clc
rol dl, 0xc
movabs rdx, 0x6d614e656c694665
jmp 0x140c24821
xor rdx, rcx
mov qword [rsp + 0x40], rdx
btr ecx, 0x3f
mov qword [rsp + 0x50], rax
btr cx, 0x3c
mov rcx, qword [rsp + 0x50]
xor rcx, 0x5765
mov qword [rsp + 0x48], rcx
mov cl, 0xb7
jmp 0x140c24854
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x20], 3
add cx, r13w
clc
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140c248b9
xor ecx, ecx
movzx dx, r14b
cmp dl, bpl
sbb dx, 0x388a
nop word [rax + rax]
mov rdx, qword [rsp + 0x50]
test r12d, 0xd715428c
xor qword [rsp + rcx*8 + 0x38], rdx
movsx dx, r10b
not rdx
inc rcx
rcr dh, cl
test r9b, bl
mov rdx, qword [rsp + 0x20]
cmp rcx, rdx
jb 0x140c2488a
mov qword [rsp + 0x50], rax
rcl cx, cl
ror rcx, 0x36
cmp ax, 0xecb8
mov rcx, qword [rsp + 0x50]
movabs rdx, 0x32336c656e72656b
test r14b, 0x3c
test ch, bl
xor rdx, rcx
movzx ecx, r15w
mov qword [rsp + 0x20], rdx
btc cx, sp
test rdx, 0xffffffffc31eb1b5
neg cx
mov qword [rsp + 0x50], rax
sal ch, 0x89
bts rcx, r15
mov rcx, qword [rsp + 0x50]
test r14, 0xffffffff8c243105
mov qword [rsp + 0x28], rcx
cmp bl, bpl
clc
mov qword [rsp + 0x50], rax
xor eax, 0x5f8e590a
movsx rax, di
mov qword [rsp + 0x30], 2
movsxd rax, ebx
shl ah, cl
mov rax, qword [rsp + 0x30]
test bp, 0x148f
jmp 0x140c24947
test rax, rax
jmp 0x140c2494f
je 0x140c2499c
xor eax, eax
sar cl, 0xbe
adc cl, r14b
nop dword [rax]
bsr rcx, r8
movsx ecx, r14w
mov rcx, qword [rsp + 0x50]
stc
xor qword [rsp + rax*8 + 0x20], rcx
not cx
xchg cl, cl
dec cl
inc rax
or ch, 0xa7
mov rcx, qword [rsp + 0x30]
cmp ecx, r12d
cmp r14b, 0x36
cmc
cmp rax, rcx
jmp 0x140c24996
jb 0x140c24969
lea rcx, [rsp + 0x20]
jmp 0x140c249a6
call fcn.140c1d772
lea rdx, [rsp + 0x38]
movsx rcx, bp
mov rcx, rax
call fcn.140c1d89d
lea rsi, [rsp + 0x50]
bsr r8w, cx
sub r8b, 0xb8
btr dx, r12w
mov r8d, 0x200
shl dx, 0x95
sub edx, 0x6c0c40a5
sub ecx, ecx
movsx rdx, ax
mov dl, r11b
movsxd rdx, eax
mov rdx, rsi
jmp 0x140c249f3
call rax
mov rcx, rsi
jmp 0x140c249fd
call fcn.140c23a82
nop
xadd sil, sil
bsf si, si
add rsp, 0x250
jmp 0x140c24a17
pop rsi
jmp 0x140c24a1d
ret
Function at 0x140c2980d
Capabilities:
Encode data using xor

Disassembly:
push rsi
btc edx, 0xa6
cmp bl, r12b
xchg ah, dh
push rdi
sub rsp, 0x58
cqo
mov rsi, rcx
movabs rax, 0x9ab9cbbbef3b2f3a
mov rdi, qword [rcx]
mov qword [rsp + 0x40], rax
bswap ecx
mov rcx, qword [rsp + 0x40]
sal dh, cl
movabs rdx, 0x656c694664616552
jmp 0x140c2984b
xor rdx, rcx
or cx, sp
movsxd rcx, r11d
mov qword [rsp + 0x40], rdx
bswap rcx
cmp rcx, 0x3b167883
mov qword [rsp + 0x30], rax
sal cx, cl
cmp r12w, r11w
mov rcx, qword [rsp + 0x30]
cmp cl, r10b
stc
mov qword [rsp + 0x48], rcx
bts rcx, r15
setl cl
mov qword [rsp + 0x30], rax
btc cx, r9w
shl ecx, 1
stc
mov qword [rsp + 0x28], 2
mov rcx, qword [rsp + 0x28]
clc
test r11b, cl
cmp spl, 0x30
test rcx, rcx
jmp 0x140c298af
je 0x140c298f4
xor ecx, ecx
movsx dx, r8b
rcr dl, cl
shld edx, r11d, 0xb3
nop dword [rax + rax]
and dl, 0x32
movzx dx, dl
mov rdx, qword [rsp + 0x30]
test rbp, r14
xor qword [rsp + rcx*8 + 0x40], rdx
movzx dx, r13b
dec dl
inc rcx
mov rdx, qword [rsp + 0x28]
cmp rcx, rdx
jb 0x140c298cf
mov qword [rsp + 0x30], rax
cdq
mov rcx, qword [rsp + 0x30]
shl dh, 0x38
xor dh, 6
sbb dx, 0xbf98
movabs rdx, 0x32336c656e72656b
cmp si, dx
jmp 0x140c2991c
xor rdx, rcx
dec cl
bsf cx, r11w
mov qword [rsp + 0x30], rdx
stc
add cx, 0xe38f
mov qword [rsp + 0x28], rax
test rcx, rsi
neg rcx
mov rcx, qword [rsp + 0x28]
clc
mov qword [rsp + 0x38], rcx
clc
stc
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x50], 2
rcl rax, 0x36
sar eax, 0x37
mov rax, qword [rsp + 0x50]
test rax, rax
jmp 0x140c2996b
je 0x140c299af
sub eax, eax
nop dword [rax]
ror cl, cl
ror ch, 0x3f
mov rcx, qword [rsp + 0x28]
cmp r11b, cl
xor qword [rsp + rax*8 + 0x30], rcx
bswap rcx
movsxd rcx, eax
dec ch
inc rax
movsx cx, bh
mov rcx, qword [rsp + 0x50]
cmp r13b, 0xa6
cmp rax, rcx
jmp 0x140c299a9
jb 0x140c2997c
lea rcx, [rsp + 0x30]
call fcn.140c1d772
lea rdx, [rsp + 0x40]
mov rcx, rax
jmp 0x140c299c6
call fcn.140c1d89d
mov rcx, qword [rsi + 8]
bsr r8, r15
or r8b, 0xbc
mov rdx, qword [rsi + 0x10]
adc r8b, 0x8d
ror r8b, 0x1b
mov r8d, dword [rdx]
bt rdx, r13
mov rdx, qword [rcx]
shl ch, 0xab
shl cl, cl
mov rcx, qword [rdi]
mov qword [rsp + 0x20], 0
sub r9d, r9d
call rax
nop
sbb sil, 0x9a
sal rdi, 0x3f
mov di, 0x3b1
add rsp, 0x58
bswap si
not sil
movzx si, al
pop rdi
setno sil
mov sil, 0x3a
pop rsi
ret
Function at 0x1400094e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbp, rcx
mov rdx, r8
mov rcx, rdi
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, 0x42
mov edx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.14004aea0
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rbp + 0x10]
lea r8, [rsp + 0x58]
mov edx, 1
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov rsi, qword [rsp + 0x58]
mov ecx, 0x18
call sub.gdiplus.dll_GdipAlloc
test rax, rax
mov rbx, rax
je 0x1400095f7
lea rax, [0x140079f38]
lea rdx, [rbx + 8]
mov rcx, rsi
mov qword [rbx], rax
mov qword [rbx + 8], 0
call sub.gdiplus.dll_GdipLoadImageFromStream
mov dword [rbx + 0x10], eax
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0
call sub.gdiplus.dll_GdipGetImageWidth
test eax, eax
je 0x1400095b6
mov dword [rbx + 0x10], eax
mov eax, dword [rsp + 0x40]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0
mov dword [rbp + 0x50], eax
mov rcx, qword [rbx + 8]
call sub.gdiplus.dll_GdipGetImageHeight
test eax, eax
je 0x1400095da
mov dword [rbx + 0x10], eax
mov ecx, dword [rsp + 0x40]
mov qword [rbp + 8], rbx
mov eax, 1
mov dword [rbp + 0x54], ecx
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400096b0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov rbx, rcx
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rbx], rax
je 0x14000979a
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.IsWow64Process
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.Wow64DisableWow64FsRedirection
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.Wow64RevertWow64FsRedirection
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.GetSystemWow64DirectoryW
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.advapi32.dll
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rbx + 8], rax
je 0x14000979a
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
lea rdx, str.Wow64RevertWow64FsRedirection
mov qword [rbx + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x38], rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14000c4d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov r8d, 6
add ax, 1
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x14000c632
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000c632
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x14000c632
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x14000c576
nop
cmp rdi, r11
jae 0x14000c632
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x14000c560
cmp rdi, r11
jae 0x14000c632
movzx eax, word [rdi]
test ax, ax
je 0x14000c632
movzx ebx, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x14000c5ac
mov edx, ebx
mov rcx, rsi
call fcn.14000c250
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x14000c5c9
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.140046d10
test eax, eax
je 0x14000c608
cmp eax, 0xc
je 0x14000c602
cmp eax, 0x16
je 0x14000c5fc
cmp eax, 0x22
je 0x14000c5fc
cmp eax, 0x50
je 0x14000c608
call fcn.14002a3b4
int3
call fcn.14002a3b4
int3
call fcn.14002a36c
int3
test ebx, ebx
js 0x14000c627
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x14000c627
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x14000c634
mov ecx, 0x80070057
call fcn.14000c230
int3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x14000c650
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x14000c683
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
je 0x14000c6c7
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x14000c6c2
cmp rbx, r11
jae 0x14000c6c7
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x14000c6b0
cmp rbx, r11
jb 0x14000c6cb
xor eax, eax
jmp 0x14000c6d7
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001a7fc
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140090f00]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
lea r8, [rsp + 0x30]
mov rdx, qword [rdx]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, eax
test eax, eax
jne 0x14001a8fb
mov r9d, 0x104
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, eax
test eax, eax
jne 0x14001a8d2
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x28]
call fcn.14000c3c0
nop
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call fcn.14001a7fc
mov ebx, eax
test eax, eax
setne byte [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001a8b9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [rsp + 0x20], 0
je 0x14001a8c2
jmp 0x14001a8d2
jmp 0x14001a852
cmp ebx, 0x103
je 0x14001a8e2
cmp ebx, 0x3f2
jne 0x14001a8f0
mov rdx, qword [rsi]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400469b0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14001cfa8
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
call fcn.1400191c8
mov rbx, rax
mov rax, qword [rax + 0x78]
test rax, rax
je 0x14001cfdf
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x14001cfdf
xor r9d, r9d
xor r8d, r8d
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageW]
test edi, edi
mov rbx, qword [rbx + 0xa0]
je 0x14001d00f
test rbx, rbx
je 0x14001d00f
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14001d00f
mov rax, qword [rbx]
or rdx, 0xffffffffffffffff
mov rcx, rbx
call qword [rax + 0x2d0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140023200
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x140023268
call fcn.140019178
mov r8d, pe_nt_image_headers64
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140023268
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x14002328a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.140022c5c
test rdi, rdi
mov esi, eax
je 0x140023288
test rbx, rbx
je 0x140023288
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x140028acc
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xa0], 0
jne 0x140028b0a
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x140028bbe
call fcn.140029fcc
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x140028b29
mov ecx, 0x80004005
call fcn.14000c230
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rbx + 0xa0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x118]
mov rdx, rsi
or rsi, 0xffffffffffffffff
mov r9, rsi
mov r8, qword [rsp + 0x40]
mov rcx, rdi
call fcn.14004b410
test eax, eax
je 0x140028b91
cmp eax, 0xc
je 0x140028b8b
cmp eax, 0x16
je 0x140028b85
cmp eax, 0x22
je 0x140028b85
cmp eax, 0x50
je 0x140028b91
call fcn.14002a3b4
int3
call fcn.14002a3b4
int3
call fcn.14002a36c
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x140028bbc
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret