joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005dc00
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x58], 0xfffffffffffffffe
test rcx, rcx
jne 0x14005dc1d
xor eax, eax
jmp 0x14005ddd2
mov dword [rsp + 0x80], 1
lea rdx, [rsp + 0x48]
call fcn.14003a580
nop
mov rsi, qword [rsp + 0x48]
mov rcx, qword [rsi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rsi - 8], 0
jl 0x14005dc5c
cmp rax, qword [rsi - 0x18]
jne 0x14005dc5c
lea rbx, [rsi - 0x18]
lock add dword [rsi - 8], 1
jmp 0x14005dc9a
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rsi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x14005dc78
call fcn.140001a80
int3
mov eax, dword [rsi - 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rsi - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rsi
add rdx, rdx
lea rcx, [rbx + 0x18]
call fcn.14008f260
lea rax, [rbx + 0x18]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.14005e600
nop
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x98], rbx
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005dd7c
mov rbx, qword [rsp + 0x98]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], 0
test rbx, rbx
je 0x14005dd7c
lea rdx, [rsp + 0x30]
lea rcx, [0x1400c2460]
call fcn.140015590
test eax, eax
js 0x14005dd6c
mov dword [rsp + 0x88], 4
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x90]
xor r8d, r8d
mov rdi, qword [rsp + 0x30]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov edi, dword [rsp + 0x80]
test rbx, rbx
je 0x14005dd92
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14005ddb5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lock xadd dword [rsi - 8], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x14005ddd0
mov rcx, qword [rsi - 0x18]
mov r8, qword [rcx]
lea rdx, [rsi - 0x18]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, edi
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x14005e3c0
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get file attributes

Disassembly:
mov eax, 0x200f8
call fcn.1400b2640
sub rsp, rax
mov rax, qword [0x1400f2bd8]
xor rax, rsp
mov qword [rsp + 0x200e0], rax
lea rcx, [rsp + 0xe2]
xor edx, edx
mov r8d, 0xfffc
mov word [rsp + 0xe0], 0
call fcn.1400935f0
lea rcx, [rsp + 0x100e2]
xor edx, edx
mov r8d, 0xfffc
mov word [rsp + 0x100e0], 0
call fcn.1400935f0
lea rcx, [rsp + 0xe0]
mov edx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14005e538
mov qword [rsp + 0x200f0], rdi
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0xe0]
repne scasw ax, word [rdi]
mov rdi, qword [rsp + 0x200f0]
not rcx
cmp word [rsp + rcx*2 + 0xdc], 0x5c
jne 0x14005e46f
mov word [rsp + rcx*2 + 0xdc], ax
lea r8, [0x1400c2d38]
lea rcx, [rsp + 0xe0]
mov edx, 0x7fff
call fcn.1400905d0
lea r8, str.SRSLabs
lea rcx, [rsp + 0xe0]
mov edx, 0x7fff
call fcn.1400905d0
lea r8, [0x1400c2d38]
lea rcx, [rsp + 0xe0]
mov edx, 0x7fff
call fcn.1400905d0
lea r8, str.176F4E15_8F7C_4833_ADED_81FAE8CCD186
lea rcx, [rsp + 0xe0]
mov edx, 0x7fff
call fcn.1400905d0
lea r8, str._slInit64.dll
lea rcx, [rsp + 0xe0]
mov edx, 0x7fff
call fcn.1400905d0
lea r8, str.rundll32.exe
lea rcx, [rsp + 0x100e0]
mov edx, 0x7fff
call fcn.1400905d0
lea r8, [rsp + 0xe0]
lea rcx, [rsp + 0x100e0]
mov edx, 0x7fff
call fcn.1400905d0
lea r8, str._SRS_InitializeEndpoints_Rundll32
lea rcx, [rsp + 0x100e0]
mov edx, 0x7fff
call fcn.1400905d0
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14005e5e5
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.1400935f0
xor eax, eax
lea rdx, [rsp + 0x100e0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x40], rax
xor eax, eax
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14005e5e5
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
mov rcx, qword [rsp + 0x200e0]
xor rcx, rsp
call fcn.14008f240
add rsp, 0x200f8
ret
xor eax, eax
mov rcx, qword [rsp + 0x200e0]
xor rcx, rsp
call fcn.14008f240
add rsp, 0x200f8
ret
Function at 0x140062570
Capabilities:
Print debug messages

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x130], rbx
mov rax, qword [0x1400f2bd8]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rdi, rdx
mov r13, rcx
mov qword [rsp + 0x48], rdx
lea rcx, str.CWmiEventSink::ServiceBIOSPackage_enter_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor ebx, ebx
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 8]
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
jne 0x1400626f8
lea rcx, [rsp + 0x50]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x80
call fcn.1400932a0
mov r12, qword [rsp + 0x50]
mov rsi, r12
shr rsi, 0x10
mov rbp, r12
shr rbp, 0x20
mov r14, r12
shr r14, 0x30
mov r15, qword [rsp + 0x58]
shr r15, 0x10
call fcn.140063708
mov rcx, rax
test rax, rax
setne bl
test ebx, ebx
jne 0x140062631
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x30], rax
movzx eax, bp
movzx r9d, si
movzx r8d, r12w
mov dword [rsp + 0x20], eax
lea rdx, str.WmiBuffer0_x_WmiBuffer1_x_WmiBuffer2_x_r_n
lea rcx, [rsp + 0x30]
call fcn.140001e50
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
movzx r11d, r15w
movzx r9d, word [rsp + 0x58]
mov r8d, r14d
mov dword [rsp + 0x20], r11d
lea rdx, str.WmiBuffer3_x_WmiBuffer4_x_WmiBuffer5_x_r_n
lea rcx, [rsp + 0x30]
call fcn.140001e50
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp r12w, 2
jne 0x1400626dc
test si, si
je 0x1400626ae
cmp si, 0x10
jne 0x1400626dc
cmp bp, 0x150
jne 0x1400626dc
lea rcx, str.Wmi_Event_Key_______r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [r13 + 0x10]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8063
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_PostMessageW]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400626f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rdi + 8]
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14008f240
mov rbx, qword [rsp + 0x130]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140066e0c
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
test r8d, r8d
mov rbx, rcx
jne 0x140066e1e
xor eax, eax
jmp 0x140066e4f
mov rcx, qword [rcx + 8]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140066e4b
mov rbx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
mov ecx, eax
call fcn.14007bfb4
mov eax, dword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret
Function at 0x140068c4c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.14007b50c
test rax, rax
mov rsi, rax
je 0x140068cc9
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
test rbx, rbx
movzx edi, ax
je 0x140068cc4
cmp dword [rbx], 0x38
jb 0x140068cc4
mov rax, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x140068cc4
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x140068ccd
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140069b9c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
call fcn.140070a74
mov rbx, rax
mov rax, qword [rax + 0x78]
test rax, rax
je 0x140069bd3
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x140069bd3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageW]
test edi, edi
mov rbx, qword [rbx + 0xa0]
je 0x140069c03
test rbx, rbx
je 0x140069c03
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x140069c03
mov rax, qword [rbx]
or rdx, 0xffffffffffffffff
mov rcx, rbx
call qword [rax + 0x2d0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14006d008
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0xa0], 0
mov rbx, rdx
mov rsi, rcx
jne 0x14006d0c0
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov r8, qword [rbx]
mov edx, 1
mov ecx, dword [r8 - 0xc]
sub edx, dword [r8 - 8]
movsxd rdi, eax
sub ecx, edi
or edx, ecx
jge 0x14006d058
mov edx, edi
mov rcx, rbx
call fcn.140001970
test edi, edi
mov rdx, qword [rbx]
js 0x14006d0b5
cmp edi, dword [rdx - 0xc]
jg 0x14006d0b5
mov dword [rdx - 0x10], edi
mov rax, qword [rbx]
lea r8d, [rdi + 1]
and word [rax + rdi*2], 0
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14006d089
xor eax, eax
jmp 0x14006d092
call fcn.140092c90
test eax, eax
js 0x14006d0aa
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14006d0aa
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
and word [rax + rcx*2], 0
jmp 0x14006d0d0
mov ecx, 0x80070057
call fcn.140001950
int3
mov ecx, 0x80070057
call fcn.140001950
int3
mov rcx, qword [rcx + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0x118]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14006fc0c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x14006fc74
call fcn.140070a24
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14006fc74
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x14006fc96
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.14006f668
test rdi, rdi
mov esi, eax
je 0x14006fc94
test rbx, rbx
je 0x14006fc94
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x140070cc4
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xa8], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x140070d3b
call fcn.140070c50
test rax, rax
mov rsi, rax
jne 0x140070cf7
mov eax, edi
jmp 0x140070d51
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x140070cf3
mov r9, qword [rcx + 0xd0]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140070e24
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
xor ebx, ebx
mov rdi, r9
mov rbp, r8
cmp qword [rcx + 0xa8], rbx
mov rsi, rdx
je 0x140070eeb
cmp r8, rbx
jne 0x140070e7f
call fcn.140070b4c
cmp rax, rbx
mov rdi, rax
jne 0x140070e6e
xor eax, eax
jmp 0x140070f01
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, rdi
jmp 0x140070eda
cmp r9, rbx
jne 0x140070e9f
call fcn.140070c50
cmp rax, rbx
mov rdi, rax
je 0x140070e67
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x140070e7a
call fcn.140070c50
cmp rax, rbx
mov r12, rax
je 0x140070e67
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 1
xor r8d, r8d
lea eax, [rax + rax + 2]
mov rdx, rbp
mov rcx, r12
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, r12
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
sete bl
mov eax, ebx
jmp 0x140070f01
mov r9, qword [rcx + 0xd0]
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x140070f1c
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
xor edi, edi
mov rbp, r9
mov r14, r8
cmp qword [rcx + 0xa8], rdi
mov rsi, rdx
mov rbx, rcx
je 0x140070f9e
call fcn.140070c50
cmp rax, rdi
mov rsi, rax
jne 0x140070f64
xor eax, eax
jmp 0x14007102c
mov ecx, dword [rsp + 0x70]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, rax
mov rdx, r14
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
sete dil
mov eax, edi
jmp 0x14007102c
mov r12d, dword [rsp + 0x70]
mov eax, 2
lea ecx, [r12 + r12 + 1]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140063100
cmp r12d, edi
mov r9d, edi
mov r13, rax
jbe 0x140071005
mov rdx, rax
mov r9, r12
mov r8, r12
mov al, byte [rbp]
and al, 0xf
movzx ecx, al
add cx, 0x41
mov word [rdx], cx
mov al, byte [rbp]
add rdx, 4
shr al, 4
add rbp, 1
movzx ecx, al
add cx, 0x41
sub r8, 1
mov word [rdx - 2], cx
jne 0x140070fd7
lea eax, [r9 + r9]
mov r8, r14
mov rdx, rsi
mov r9, r13
mov rcx, rbx
mov word [r13 + rax*2], di
call fcn.140070e24
mov rcx, r13
mov ebx, eax
call fcn.14006314c
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r13
pop r12
ret
Function at 0x140071294
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rsi, r9
mov rbp, r8
and qword [r9], 0
mov rbx, qword [rsp + 0x80]
and dword [rbx], 0
cmp qword [rcx + 0xa8], 0
je 0x140071379
call fcn.140070c50
mov rdi, rax
test rax, rax
je 0x140071476
mov qword [rsp + 0x38], rax
and dword [rsp + 0x60], 0
and dword [rsp + 0x80], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x80]
mov dword [rbx], ecx
test eax, eax
jne 0x14007135b
call fcn.140063100
mov qword [rsi], rax
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007135b
lea ebx, [rax + 1]
jmp 0x140071369
mov rcx, qword [rsi]
call fcn.14006314c
and qword [rsi], 0
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140071476
and qword [rsp + 0x20], 0
mov r9, r8
mov r8, rdx
lea rdx, [rsp + 0x78]
call fcn.14007104c
nop
mov rax, qword [rsp + 0x78]
movsxd rcx, dword [rax - 0x10]
test ecx, ecx
jne 0x1400713c0
lea rdx, [rax - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400713b9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140071476
mov rdi, rcx
shr ecx, 1
mov dword [rbx], ecx
call fcn.140063100
mov qword [rsi], rax
xor r8d, r8d
lea ebx, [r8 + 1]
test rdi, rdi
jle 0x140071452
xor r10d, r10d
mov r9, rbx
test r9, r9
js 0x140071447
mov rax, qword [rsp + 0x78]
lea ecx, [r8 + 1]
cmp ecx, dword [rax - 0x10]
jg 0x140071447
movzx r11d, word [r10 + rax + 2]
test r8d, r8d
js 0x14007143c
cmp r8d, dword [rax - 0x10]
jg 0x14007143c
sub r11b, bl
shl r11b, 4
add r11b, byte [r10 + rax]
sub r11b, 0x41
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
mov rax, qword [rsi]
mov byte [rcx + rax], r11b
add r8d, 2
add r9, 2
add r10, 4
movsxd rax, r8d
cmp rax, rdi
jl 0x1400713e1
jmp 0x140071452
mov ecx, 0x80070057
call fcn.140001950
int3
mov ecx, 0x80070057
call fcn.140001950
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x140071474
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14007215c
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xa0], 0
jne 0x14007219a
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x14007224e
call fcn.140063708
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1400721b9
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rbx + 0xa0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x118]
mov rdx, rsi
or rsi, 0xffffffffffffffff
mov r9, rsi
mov r8, qword [rsp + 0x40]
mov rcx, rdi
call fcn.140092ef0
test eax, eax
je 0x140072221
cmp eax, 0xc
je 0x14007221b
cmp eax, 0x16
je 0x140072215
cmp eax, 0x22
je 0x140072215
cmp eax, 0x50
je 0x140072221
call fcn.140063294
int3
call fcn.140063294
int3
call fcn.14006324c
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x14007224c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140074880
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0xb0], 0
mov rdi, qword [rcx + 0xc0]
mov rbp, qword [rcx + 0xb8]
mov rsi, rcx
je 0x1400748dd
call fcn.140070a24
mov rdx, qword [rsi + 0xb0]
mov r8d, 5
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rbp, rbp
je 0x1400748ee
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rdi, rdi
mov ebx, 1
je 0x14007492b
cmp word [rdi + 2], 0xffff
mov ecx, dword [rdi]
jne 0x14007490f
mov ecx, dword [rdi + 0xc]
movzx edx, word [rdi + 0x12]
movzx eax, word [rdi + 0x14]
jmp 0x140074917
mov dx, word [rdi + 0xa]
mov ax, word [rdi + 0xc]
test ecx, 0x1801
jne 0x140074929
test dx, dx
jne 0x140074929
test ax, ax
je 0x14007492b
xor ebx, ebx
cmp qword [rsi + 0xb0], 0
je 0x14007493e
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140075094
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_624
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test rdx, 0xffffffffffff0000
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xb0], rdx
jne 0x1400750d3
cmp dword [rcx + 0xa8], 0
jne 0x1400750d3
movzx eax, dx
mov dword [rcx + 0xa8], eax
call fcn.140070a24
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.140075038
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400756f8
Capabilities:
Get geographical location

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x2f0
mov rax, qword [0x1400f2bd8]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
cmp r8d, 0x800
mov eax, r8d
mov rsi, rdx
mov rbx, rcx
jne 0x14007576a
lea r8, [0x1400bbe38]
lea rcx, [rsp + 0xa0]
mov edx, 4
call fcn.140090520
test eax, eax
je 0x14007578c
cmp eax, 0xc
je 0x140075764
cmp eax, 0x16
je 0x14007575e
cmp eax, 0x22
je 0x14007575e
cmp eax, 0x50
je 0x14007578c
call fcn.140063294
int3
call fcn.140063294
int3
call fcn.14006324c
int3
mov r9d, 4
lea r8, [rsp + 0xa0]
mov ecx, eax
lea edx, [r9 - 1]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400758af
call fcn.140093150
mov edi, dword [rax]
call fcn.140093150
lea rcx, [rsp + 0xb0]
and dword [rax], 0
lea rax, [rsp + 0xa0]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov esi, 0x112
lea r8d, [rsi - 1]
mov rdx, rsi
call fcn.1400930d0
mov ebx, eax
call fcn.140093150
cmp dword [rax], 0
je 0x140075814
call fcn.140093150
cmp dword [rax], 0
je 0x14007581b
cmp dword [rax], 0xc
je 0x140075809
cmp dword [rax], 0x16
je 0x1400757fe
cmp dword [rax], 0x22
je 0x1400757fe
cmp dword [rax], 0x50
je 0x14007581b
mov ecx, 0x80004005
call fcn.140001950
int3
mov ecx, 0x80070057
call fcn.140001950
int3
mov ecx, 0x8007000e
call fcn.140001950
int3
call fcn.140093150
mov dword [rax], edi
cmp ebx, 0xffffffff
je 0x1400758af
cmp ebx, esi
jae 0x1400758af
lea rcx, [rsp + 0xb0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
xor edx, edx
lea rcx, [rsp + 0x34]
lea r8d, [rdx + 0x6c]
mov rbx, rax
mov dword [rsp + 0x30], 0x70
call fcn.1400935f0
lea rcx, str.KERNEL32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007589a
lea rdx, str.FindActCtxSectionStringW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14007589a
lea rcx, [rsp + 0x30]
xor edx, edx
mov r9, rbx
mov qword [rsp + 0x20], rcx
lea r8d, [rdx + 2]
xor ecx, ecx
call rax
mov rcx, rbx
test eax, eax
jne 0x1400758a2
lea rcx, [rsp + 0xb0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x1400758b1
xor eax, eax
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.14008f240
add rsp, 0x2f0
pop rdi
pop rsi
pop rbx
ret