joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a0e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
lea rax, [rsp + 0x38]
mov dword [rsp + 0x34], 0x104
mov qword [rsp + 0x28], rax
mov rbx, rcx
lea rax, [0x1401b6698]
xor edi, edi
mov edx, 0x104
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x30], edi
mov word [rsp + 0x38], di
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x14000a13e
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14000a15c
mov edx, dword [rsp + 0x34]
call fcn.14003c464
mov rcx, qword [rsp + 0x28]
mov dword [rsp + 0x30], eax
jmp 0x14000a160
mov dword [rsp + 0x30], edi
mov rdx, rbx
call fcn.140009a60
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret

Function at 0x14000a490
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
mov eax, 0x4050
call fcn.14002ef70
sub rsp, rax
mov rax, qword [rdx + 8]
xor ebp, ebp
mov dword [rdx + 0x10], ebp
mov rbx, rdx
test rax, rax
je 0x14000a4bc
mov word [rax], bp
mov rcx, qword [rcx + 8]
xor r9d, r9d
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000a5a7
xor edx, edx
mov qword [rsp + 0x4068], rdi
mov r8d, 0x4000
lea rcx, [rsp + 0x50]
call fcn.14014d290
xor eax, eax
mov qword [rsp + 0x38], rbp
mov ecx, 3
mov dword [rsp + 0x4060], ebp
lea rdi, [rsp + 0x40]
mov r9d, recv
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x50]
mov qword [rsp + 0x40], rbp
mov ecx, 0x1000
lea r8, [rsp + 0x40]
rep stosd dword [rdi], eax
lea rax, [rsp + 0x4060]
mov edx, 0x2d1400
mov qword [rsp + 0x30], rax
mov rcx, rsi
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x4000
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rdi, qword [rsp + 0x4068]
test eax, eax
je 0x14000a59e
mov eax, dword [rsp + 0x4060]
cmp eax, 0x28
jb 0x14000a59e
lea rdx, [rsp + 0x50]
mov r8, rbx
add rdx, rax
lea rcx, [rsp + 0x50]
mov eax, dword [rsp + 0x68]
add rcx, rax
call fcn.14000a670
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x4050]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret

Function at 0x14000b260
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
lea rax, [rsp + 0x38]
mov dword [rsp + 0x34], 0x104
mov qword [rsp + 0x28], rax
mov rbx, rcx
lea rax, [0x1401b6698]
xor edi, edi
mov edx, 0x104
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x30], edi
mov word [rsp + 0x38], di
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x14000b2be
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14000b2dc
mov edx, dword [rsp + 0x34]
call fcn.14003c464
mov rcx, qword [rsp + 0x28]
mov dword [rsp + 0x30], eax
jmp 0x14000b2e0
mov dword [rsp + 0x30], edi
mov rdx, rbx
call fcn.14000abe0
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x14000b870
Capabilities:
Get common file path
Get disk information

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x440
xor ebx, ebx
lea rcx, [rsp + 0x40]
mov edx, 0x100
mov dword [rax + 8], ebx
mov dword [rax + 0x18], ebx
mov dword [rax + 0x10], ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x14000b8a3
add rsp, 0x440
pop rbx
ret
mov r9d, 3
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x468]
lea edx, [r9 + 1]
call fcn.14003c218
mov dword [rsp + 0x38], 0x100
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x450]
lea rax, [rsp + 0x458]
mov word [rsp + 0x46e], bx
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x240]
lea rax, [rsp + 0x460]
mov r8d, 0x100
lea rcx, [rsp + 0x468]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [rsp + 0x450]
add rsp, 0x440
pop rbx
ret
Function at 0x14000c3b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 8], 0xffffffffffffffff
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
je 0x14000c444
test rdx, rdx
je 0x14000c444
cmp r8d, 1
jb 0x14000c444
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], r14
xor r14d, r14d
mov ebx, r14d
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbp + 8]
lea r9, [rsp + 0x50]
mov r8d, edi
mov edx, ebx
sub r8d, ebx
mov dword [rsp + 0x50], r14d
add rdx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000c426
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x14000c426
add ebx, eax
cmp ebx, edi
jb 0x14000c3f0
mov eax, ebx
lock add qword [0x1401f3d70], rax
mov r14, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000c450
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 8]
xor ebx, ebx
mov dword [rsp + 0x40], ebx
cmp rcx, 0xffffffffffffffff
je 0x14000c48e
test rdx, rdx
je 0x14000c48e
test r8d, r8d
je 0x14000c48e
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000c48a
mov dword [rsp + 0x40], ebx
jmp 0x14000c48e
mov ebx, dword [rsp + 0x40]
mov eax, ebx
lock add qword [0x1401f3d68], rax
mov eax, dword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret

Function at 0x14000c4b0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
je 0x14000c4e4
cmp word [rcx], 0
je 0x14000c4e4
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14000c4f4
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000c515
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test bl, 0x10
jne 0x14000c525
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14000c4e4
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000c4e4
mov eax, reloc.WS2_32.dll_recv
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test bl, 1
je 0x14000c538
xor ebx, 1
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000c550
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x250
mov rbx, rcx
test rcx, rcx
je 0x14000c5ff
cmp word [rcx], 0
je 0x14000c5ff
call fcn.14000d130
test al, al
je 0x14000c5ff
lea rax, [0x1401c0270]
mov edx, 0x103
mov qword [rsp + 0x28], rax
lea r9, str._scheckwritepermissions._s
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rbx
lea rcx, [rsp + 0x40]
call fcn.140003a90
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x40]
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000c5ff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, 1
add rsp, 0x250
pop rbx
ret
xor al, al
add rsp, 0x250
pop rbx
ret

Function at 0x14000c7f0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
push rsi
push r14
push r15
sub rsp, 0x50
xor r15d, r15d
mov rax, rdx
mov qword [rcx + 8], r15
mov r14, rcx
test rdx, rdx
je 0x14000c945
mov qword [rsp + 0x30], r15
lea r8d, [r15 + 3]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000c945
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x40], rdi
mov rcx, rax
mov qword [rsp + 0x70], r15
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov edi, r15d
mov rcx, r14
test eax, eax
cmovne rdi, qword [rsp + 0x70]
lea rdx, [rdi + 2]
call fcn.140003850
test al, al
je 0x14000c92b
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x48], rbp
mov rbp, qword [r14]
test rbp, rbp
je 0x14000c8f6
cmp rdi, 1
jb 0x14000c8f6
mov ebx, r15d
nop dword [rax]
mov r8d, 0xfffffff
mov dword [rsp + 0x80], r15d
mov rax, rdi
mov qword [rsp + 0x20], r15
sub rax, rbx
lea rdx, [rbx + rbp]
cmp rax, r8
lea r9, [rsp + 0x80]
mov rcx, rsi
cmovb r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000c8ec
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x14000c8ec
add rbx, rax
cmp rbx, rdi
jb 0x14000c8a0
lock add qword [0x1401f3d70], rbx
jmp 0x14000c8f9
mov rbx, r15
mov rbp, qword [rsp + 0x48]
cmp rbx, rdi
mov rbx, qword [rsp + 0x78]
jne 0x14000c92b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
mov qword [r14 + 8], rdi
mov rdi, qword [rsp + 0x40]
add rsp, 0x50
pop r15
pop r14
pop rsi
jmp fcn.140003800
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x40]
xor al, al
add rsp, 0x50
pop r15
pop r14
pop rsi
ret
xor al, al
add rsp, 0x50
pop r15
pop r14
pop rsi
ret
Function at 0x14000e640
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x4c0
xor ebp, ebp
mov eax, dword [0x1401f1c90]
cmp eax, 0xffffffff
jne 0x14000e69e
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], 0x20
mov word [rsp + 0x38], bp
lea rax, [0x1401b9aa0]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
call fcn.14000b340
movzx eax, al
mov dword [0x1401f1c90], eax
test eax, eax
jne 0x14000e750
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000e750
xor edx, edx
mov r8d, 0x434
lea rcx, [rsp + 0x84]
call fcn.14014d290
mov dword [rsp + 0x80], 0x438
lea rdx, [rsp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14000e747
lea rsi, str.frida_agent_64.dll
nop dword [rax]
nop word [rax + rax]
mov rbx, rbp
mov rdx, qword [rbx + rsi]
lea rcx, [rsp + 0xb0]
call fcn.14003e590
test eax, eax
je 0x14000e76b
add rbx, 8
cmp rbx, 0x18
jb 0x14000e713
lea rdx, [rsp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x14000e710
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14000e752
Function at 0x14000e7a0
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
sub rsp, 0x430
xor eax, eax
mov dword [r11 + 0x10], 0x3fe
mov dword [rsp + 0x30], eax
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
lea rax, [r11 + 0x20]
mov rsi, rcx
xor ebp, ebp
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
mov qword [r11 + 0x20], rbp
xor r8d, r8d
mov dword [r11 + 0x18], ebp
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000e9eb
mov rcx, qword [rsp + 0x468]
lea rax, [rsp + 0x458]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x460]
lea rax, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.ProcessorNameString
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x468]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14000e9eb
mov word [rsp + 0x42e], bp
lea rax, [rsp + 0x30]
mov r8d, ebp
mov r9d, 0xffdf
nop dword [rax + rax]
movzx edx, word [rax]
test dx, dx
je 0x14000e891
cmp dx, 0x20
jne 0x14000e968
test word [rax + 2], r9w
je 0x14000e884
mov ecx, r8d
inc r8d
mov word [rsp + rcx*2 + 0x30], dx
add rax, 2
cmp r8d, 0x1ff
jb 0x14000e860
mov eax, r8d
lea rdx, str._Processor
lea rcx, [rsp + 0x30]
mov word [rsp + rax*2 + 0x30], bp
call fcn.1400308bc
mov rbx, 0xffffffffffffffff
test rax, rax
je 0x14000e8da
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2 + 0x12], bp
jne 0x14000e8c0
add r8, r8
lea rdx, [rax + 0x14]
mov rcx, rax
call fcn.14014cbf0
lea rdx, str._Graphics
lea rcx, [rsp + 0x30]
call fcn.1400308bc
test rax, rax
je 0x14000e90b
cmp word [rax + rbx*2 + 0x12], bp
lea rbx, [rbx + 1]
jne 0x14000e8f0
lea r8, [rbx + rbx]
mov rcx, rax
lea rdx, [rax + 0x12]
call fcn.14014cbf0
cmp qword [rsi + 8], rbp
je 0x14000e95b
mov edx, dword [rsi + 0x14]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x450], rdi
call fcn.14003c464
mov edx, dword [rsi + 0x14]
cmp eax, edx
lea ecx, [rdx - 1]
cmovb ecx, eax
lea rdx, [rsp + 0x30]
mov ebx, ecx
lea rdi, [rcx + rcx]
mov rcx, qword [rsi + 8]
mov r8, rdi
call fcn.14014cbf0
mov dword [rsi + 0x10], ebx
mov rax, qword [rsi + 8]
mov word [rdi + rax], bp
mov rdi, qword [rsp + 0x450]
mov al, 1
add rsp, 0x430
pop rsi
pop rbp
pop rbx
ret
cmp dx, 0x28
jne 0x14000e9c2
movzx ecx, word [rax + 2]
cmp cx, 0x52
jne 0x14000e98c
cmp word [rax + 4], 0x29
jne 0x14000e879
add rax, 4
jmp 0x14000e884
cmp cx, 0x54
jne 0x14000e9b1
cmp word [rax + 4], 0x4d
jne 0x14000e879
cmp word [rax + 6], 0x29
jne 0x14000e879
add rax, 6
jmp 0x14000e884
cmp cx, 0x74
jne 0x14000e879
cmp word [rax + 4], 0x6d
jmp 0x14000e997
cmp dx, 0x43
jne 0x14000e879
cmp word [rax + 2], 0x50
jne 0x14000e879
cmp word [rax + 4], 0x55
jne 0x14000e879
add rax, 4
jmp 0x14000e884
xor al, al
add rsp, 0x430
pop rsi
pop rbp
pop rbx
ret
Function at 0x140011450
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x420
mov rbx, rcx
test rcx, rcx
je 0x1400115a4
call fcn.14000c4b0
cmp eax, 0xffffffff
jne 0x140011583
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x200
call fcn.14003c218
movzx ecx, word [rsp + 0x20]
lea rdi, [rsp + 0x20]
test cx, cx
je 0x1400115a4
movzx eax, cx
xor esi, esi
cmp ax, 0x5c
jne 0x140011536
mov word [rdi], si
cmp word [rsp + 0x20], si
je 0x1400115a4
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400114e9
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x14001152a
test bl, 0x10
jne 0x140011512
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400115a4
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x14001152a
test bl, 1
je 0x14001152c
xor ebx, 1
lea rcx, [rsp + 0x20]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp ebx, 0xffffffff
je 0x1400115a4
mov word [rdi], 0x5c
movzx ecx, word [rsp + 0x20]
movzx eax, word [rdi + 2]
add rdi, 2
test ax, ax
jne 0x1400114b2
test cx, cx
je 0x1400115a4
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x140011572
test bl, 0x10
jne 0x140011587
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400115a4
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400115a4
mov al, 1
jmp 0x1400115a6
test bl, 1
je 0x14001159c
xor ebx, 1
lea rcx, [rsp + 0x20]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp ebx, 0xffffffff
setne al
jmp 0x1400115a6
xor al, al
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140014500
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov r14, rdx
mov rsi, rcx
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x50], r15
mov edi, dword [rcx + 8]
or edi, 0x2001f
mov qword [rbp + 0x1a0], r15
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test eax, eax
jne 0x14001458f
mov ebx, r15d
test rcx, rcx
je 0x140014579
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rbp + 0x1a0]
mov qword [rsp + 0x40], rcx
and edi, 0x300
mov dword [rsp + 0x48], edi
test ebx, ebx
jne 0x140014663
mov dword [rbp + 0x190], 0x100
lea rax, [rbp + 0x1a8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x190]
lea r8, [rsp + 0x60]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140014637
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140014500
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test eax, eax
jne 0x140014663
mov dword [rbp + 0x190], 0x100
lea rax, [rbp + 0x1a8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x190]
lea r8, [rsp + 0x60]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400145e0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14001464c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], r15d
mov rdx, r14
mov rcx, rsi
call fcn.140014730
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14001466e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x298]
add rsp, 0x260
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140015c40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x460
mov rsi, r9
mov r15, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x50], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x488], rax
test rax, rax
jne 0x140015cc0
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x488], rax
test rax, rax
jne 0x140015cc0
call fcn.140013840
mov ebx, eax
jmp 0x140015dee
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140015ce1
call fcn.140013840
jmp 0x140015ddd
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x140015d04
call fcn.140013840
jmp 0x140015ddd
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x480], eax
inc eax
cmp eax, ebx
jae 0x140015d29
mov ebx, 0x8007000e
jmp 0x140015ddf
mov ecx, eax
test eax, eax
je 0x140015d5e
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x140015e20
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x140015d5e
lea rcx, [rsp + 0x50]
call fcn.140013810
jmp 0x140015d68
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
jmp 0x140015d81
cmp qword [rsp + 0x50], 0
jne 0x140015d90
mov ebx, 0x8007000e
jmp 0x140015ddf
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140015dba
call fcn.140013840
jmp 0x140015ddd
mov ecx, eax
mov rax, qword [rsp + 0x50]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4a0]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x38]
call fcn.140015790
mov ebx, eax
test rdi, rdi
je 0x140015dee
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x50], rax
je 0x140015e05
lea rcx, [rsp + 0x50]
call fcn.1400137f0
nop
mov eax, ebx
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov ecx, 0x80070216
call fcn.140014420
int3
Function at 0x140017130
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
mov ecx, dword [rcx + 0x90]
mov eax, ecx
and eax, 0xc
cmp al, 0xc
jne 0x1400171a5
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x30], rcx
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
movsxd rcx, eax
mov qword [rsp + 0x38], rcx
mov rcx, qword [rdi + 8]
mov dword [rsp + 0x40], 0xfffffffe
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, qword [rdi + 8]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
movsxd r8, eax
lea r9, [rsp + 0x30]
mov edx, 0x4e
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov al, 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
shr ecx, 2
test cl, 1
je 0x1400171e9
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetParent]
mov rdi, qword [rdi + 8]
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
movzx r8d, ax
mov r9, rdi
mov edx, VarUI4FromDisp
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov al, 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov r8, qword [rdi + 0x50]
lea rdx, str.open
mov dword [rsp + 0x28], 1
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
seta bl
jbe 0x140017230
or byte [rdi + 0x94], 2
xor edx, edx
mov rcx, qword [rdi + 8]
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
movzx eax, bl
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret