joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002d630
Capabilities:
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x1402ca920]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, rcx
test rcx, rcx
je 0x14002d81f
cmp word [rcx], 0
je 0x14002d81f
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x20], rcx
lea r14, vtable.CVolObject.0
mov qword [rsp + 0x20], r14
xor esi, esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rsi
lea rax, vtable.CWString.0
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
lea r15, vtable.CVolMem.0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], 0x40
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x70], 0xfe
mov ebx, esi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
movzx eax, word [rdi]
cmp ax, 0x5c
je 0x14002d72b
test ax, ax
je 0x14002d76a
cmp word [rdi + 2], 0x3a
jne 0x14002d76a
cmp word [rdi + 4], 0x5c
jne 0x14002d76a
mov edx, 0x5c
mov rcx, rdi
call fcn.1401f477c
test rax, rax
je 0x14002d765
cmp rax, rdi
jbe 0x14002d74e
lea rcx, [rax - 2]
cmp word [rcx], 0x3a
cmovne rax, rcx
sub rax, rdi
lea r8, [rax + 2]
sar r8, 1
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140030360
mov rbx, qword [rsp + 0x38]
test rbx, rbx
jne 0x14002d789
cmp qword [rsp + 0x68], rbx
jne 0x14002d77f
lea rbx, [0x14027a600]
jmp 0x14002d789
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x14002d7d0
cmp word [rbx], 0
je 0x14002d7d0
lea rdx, [rbp - 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x14002d7d0
cmp word [rbx], 0
je 0x14002d7b1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
cmp word [rbp - 0x70], 0
je 0x14002d7dc
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x14002d7dc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], r15
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x14002d801
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x40]
call qword [rax + 0x18]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x20], r14
mov rax, rbx
jmp 0x14002d821
xor eax, eax
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1401f2820
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140042aa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
movdqa xmm4, xmmword [0x140288e80]
xor ebx, ebx
movdqa xmm5, xmmword [0x140288e50]
xor edi, edi
movaps xmmword [rsp], xmm6
mov r10, r8
movdqa xmm6, xmmword [0x140288e20]
mov r9, rdx
xorps xmm3, xmm3
cmp r8, 4
jb 0x140042b68
lea r11d, [rbx + 4]
movdqu xmm1, xmmword [r9 + rbx*4]
mov edx, 8
add rbx, 4
add r11, 4
movdqa xmm0, xmm1
movdqa xmm2, xmm1
pand xmm0, xmm5
pand xmm1, xmm6
pcmpeqd xmm0, xmm3
pcmpeqd xmm1, xmm3
pxor xmm1, xmm0
pand xmm2, xmm4
pmovmskb eax, xmm1
pcmpeqd xmm2, xmm3
pxor xmm0, xmm2
movzx ecx, ax
popcnt r8, rcx
pmovmskb eax, xmm0
shr r8, 2
movzx ecx, ax
popcnt rax, rcx
shr rax, 2
sub rdx, rax
pmovmskb eax, xmm2
add rdx, rdx
movzx ecx, ax
popcnt rax, rcx
shr rax, 2
lea rax, [rax + rax*2]
sub rdx, rax
sub rdx, r8
add rdi, rdx
cmp r11, r10
jbe 0x140042ae1
lea r11, [r9 + rbx*4]
xor r9d, r9d
mov eax, r9d
sub r10, rbx
je 0x140042bb8
nop word [rax + rax]
mov edx, dword [r11 + rax*4]
xor r8d, r8d
cmp edx, 0x7ff
seta r8b
xor ecx, ecx
cmp edx, 0x7f
seta cl
add r8, rcx
xor ecx, ecx
cmp edx, 0xffff
seta cl
inc rax
inc rcx
add r9, rcx
add r9, r8
cmp rax, r10
jb 0x140042b80
mov rbx, qword [rsp + 0x20]
lea rax, [r9 + rdi]
movaps xmm6, xmmword [rsp]
add rsp, 0x10
pop rdi
ret
Function at 0x1400507a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x1400507ab
xor eax, eax
ret
lea r11, [0x1402839d0]
not ecx
cmp r8d, 8
jb 0x140050881
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1400507d0
test r8d, r8d
je 0x1400508ad
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x140050890
not ecx
mov eax, ecx
ret

Function at 0x1400512b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov r10, r8
mov rdi, r9
imul r10d, edx
mov rsi, rdx
cmp byte [r9], 0
mov r11, rcx
je 0x14005130a
mov rdx, rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x48]
mov r8d, r10d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400512f6
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov edx, dword [r9 + 0x2c]
mov ecx, dword [r9 + 0x28]
sub ecx, edx
mov qword [rsp + 0x40], rbx
lea eax, [rdx + r10]
cmp eax, dword [r9 + 0x28]
cmovbe ecx, r10d
add rdx, qword [r9 + 0x20]
mov ebx, ecx
mov r8d, ecx
mov rcx, r11
call fcn.1401f4dc0
add dword [rdi + 0x2c], ebx
mov eax, ebx
mov rbx, qword [rsp + 0x40]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140051350
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
sub rsp, 0x38
cmp byte [rcx], 0
mov r14, rdx
mov qword [rsp + 0x58], rbp
mov rbx, rcx
mov qword [rsp + 0x30], rdi
mov edi, 1
je 0x1400513a0
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x60]
mov r8d, edi
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14005139a
mov byte [rbx + 0x10], dil
mov ebp, dword [rsp + 0x60]
jmp 0x1400513d7
mov qword [rsp + 0x68], rsi
mov esi, dword [rcx + 0x2c]
mov ecx, dword [rcx + 0x28]
lea eax, [rsi + 1]
cmp eax, ecx
jbe 0x1400513b6
mov edi, ecx
sub edi, esi
mov rdx, rsi
mov r8d, edi
add rdx, qword [rbx + 0x20]
lea rcx, [rsp + 0x50]
mov ebp, edi
call fcn.1401f4dc0
lea eax, [rsi + rdi]
mov rsi, qword [rsp + 0x68]
mov dword [rbx + 0x2c], eax
mov rdi, qword [rsp + 0x30]
cmp ebp, 1
mov rbp, qword [rsp + 0x58]
jne 0x1400513f8
movzx eax, byte [rsp + 0x50]
mov dword [r14], eax
xor eax, eax
add rsp, 0x38
pop r14
pop rbx
ret
cmp byte [rbx], 0
je 0x1400513ee
cmp byte [rbx + 0x10], 0
je 0x1400513ee
mov eax, 0xffffffff
add rsp, 0x38
pop r14
pop rbx
ret
Function at 0x1400520d0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400522d6
cmp dword [rcx + 0x1c], 0
je 0x1400522d6
cmp qword [rcx + 0x80], 0
je 0x1400520ff
call fcn.140052670
lea r9, [rsp + 0x50]
mov rcx, rdi
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
call fcn.140051e20
test eax, eax
je 0x140052126
mov eax, 0xffffff99
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0xb0
mov qword [rsp + 0x48], rbx
call fcn.1401f9a98
mov rbx, rax
test rax, rax
jne 0x14005214c
lea eax, [rbx - 0x68]
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0x4000
mov qword [rsp + 0x20], rbp
call fcn.1401f9a98
mov ecx, dword [rsp + 0x40]
xor ebp, ebp
mov dword [rbx + 0x68], ecx
mov ecx, dword [rsp + 0x50]
mov dword [rbx + 0x6c], ecx
mov qword [rbx], rax
mov dword [rbx + 0x70], ebp
test rax, rax
jne 0x140052192
mov rcx, rbx
call fcn.1401f9088
mov rbx, qword [rsp + 0x48]
lea eax, [rbp - 0x68]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov eax, dword [rdi + 0x40]
mov ecx, dword [rdi + 0x38]
mov dword [rbx + 0x78], eax
mov rax, qword [rdi]
mov qword [rbx + 0x88], rax
mov eax, dword [rdi + 0x10]
mov dword [rbx + 0x94], eax
mov dword [rbx + 0x64], ebp
mov dword [rbx + 0x74], ebp
mov dword [rbx + 0x90], ecx
mov dword [rbx + 0x24], ebp
test ecx, ecx
je 0x1400521e1
lea rcx, [rbx + 8]
mov qword [rbx + 0x38], rbp
mov qword [rbx + 0x40], rbp
mov qword [rbx + 0x48], rbp
call fcn.140050b40
test eax, eax
jne 0x1400521e1
mov dword [rbx + 0x64], 1
mov eax, dword [rdi + 0x44]
movzx ecx, byte [rdi + 0x34]
mov dword [rbx + 0x7c], eax
and cl, 1
mov eax, dword [rdi + 0x48]
mov dword [rbx + 0x80], eax
mov eax, dword [rdi + 0x34]
shr eax, 3
mov byte [rbx + 0x98], cl
test al, 1
je 0x14005220d
movzx eax, byte [rdi + 0x3d]
jmp 0x140052211
movzx eax, byte [rdi + 0x43]
mov byte [rbx + 0xac], al
neg cl
mov dword [rbx + 0x9c], 0x12345678
sbb eax, eax
mov dword [rbx + 0xa0], 0x23456789
and eax, 0xc
mov dword [rbx + 0xa4], 0x34567890
mov dword [rbx + 0xa8], eax
test rsi, rsi
je 0x1400522aa
lea r8, [0x1402839d0]
nop
movzx eax, byte [rsi]
test al, al
je 0x1400522aa
mov edx, dword [rbx + 0x9c]
xor rax, rdx
movzx ecx, al
shr edx, 8
xor edx, dword [r8 + rcx*4]
mov ecx, dword [rbx + 0xa4]
movzx eax, dl
add eax, dword [rbx + 0xa0]
mov dword [rbx + 0x9c], edx
imul edx, eax, 0x8088405
movzx eax, cl
shr ecx, 8
inc edx
mov dword [rbx + 0xa0], edx
shr rdx, 0x18
xor rax, rdx
xor ecx, dword [r8 + rax*4]
mov dword [rbx + 0xa4], ecx
add rsi, 1
jne 0x140052250
mov eax, dword [rsp + 0x58]
mov ecx, dword [rdi + 0x7c]
add eax, 0x1e
add ecx, eax
mov dword [rbx + 0x10], ebp
mov rbp, qword [rsp + 0x20]
xor eax, eax
mov dword [rbx + 0x60], ecx
mov qword [rdi + 0x80], rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
mov eax, 0xffffff9a
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140052710
Capabilities:
Get common file path

Disassembly:
mov dword [rsp + 0x18], r8d
push rbp
push r13
push r14
sub rsp, 0x50
cmp qword [rcx], 0
mov ebp, r9d
mov r13, rdx
mov r14, rcx
jne 0x1400528ff
cmp dword [rcx + 8], 0xffffffff
jne 0x1400528ff
mov qword [rsp + 0x70], rbx
lea rbx, [rcx + 0x250]
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140052760
movzx ecx, word [r14 + rax*2 + 0x24e]
cmp cx, 0x5c
je 0x140052798
cmp cx, 0x2f
je 0x140052798
sub rbx, 2
cmp word [rbx + 2], 0
lea rbx, [rbx + 2]
jne 0x140052785
mov eax, dword [0x140284bec]
mov dword [rbx], eax
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r15
cmp ebp, 1
jne 0x1400527f5
mov r9d, ebp
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x140052806
mov eax, 0x2000000
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r14
pop r13
pop rbp
ret
lea eax, [rbp - 2]
cmp eax, 1
jbe 0x140052806
mov ecx, 0x10000
mov eax, ecx
jmp 0x1400527cf
xor edi, edi
xor r12b, r12b
xor r15b, r15b
mov esi, edi
cmp ebp, 1
je 0x14005285e
cmp ebp, 2
jne 0x14005287c
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140052859
mov ecx, 0x200
mov eax, ecx
jmp 0x1400527cf
mov r15b, 1
jmp 0x140052861
mov rsi, r13
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
setne r12b
mov ecx, 0x30
call fcn.1400543c0
lea ecx, [rbp - 1]
mov rbx, rax
cmp ecx, 1
jbe 0x1400528b0
mov word [rax], 0x100
mov byte [rax + 0x18], dil
mov qword [rax + 0x20], r13
mov eax, dword [rsp + 0x80]
mov dword [rbx + 0x28], eax
mov dword [rbx + 0x2c], edi
mov dword [rbx + 0x14], edi
jmp 0x1400528e2
mov byte [rax], 1
mov byte [rax + 0x18], r15b
mov byte [rax + 1], r12b
mov qword [rax + 8], rsi
mov byte [rax + 0x10], dil
mov dword [rax + 0x14], edi
test r12b, r12b
je 0x1400528e2
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbx + 0x14], eax
mov rcx, rbx
call fcn.140051690
test rax, rax
mov qword [r14], rax
mov ecx, 0x200
cmove edi, ecx
mov eax, edi
jmp 0x1400527cf
mov eax, 0x1000000
add rsp, 0x50
pop r14
pop r13
pop rbp
ret
Function at 0x140053030
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbx
push rdi
sub rsp, 0x458
mov rax, qword [0x1402ca920]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14005306d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005306d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [rdi]
test ax, ax
je 0x14005317e
mov qword [rsp + 0x480], rbp
mov rdx, rdi
mov rcx, rdi
cmp ax, 0x2f
je 0x140053093
cmp ax, 0x5c
jne 0x140053096
mov rdx, rcx
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x140053087
xor ebp, ebp
mov qword [rsp + 0x450], rsi
cmp rdx, rdi
je 0x1400530f4
sub rdx, rdi
lea rcx, [rsp + 0x230]
sar rdx, 1
lea rsi, [rdx + rdx]
mov rdx, rdi
mov r8, rsi
call fcn.1401f4dc0
cmp rsi, 0x208
jae 0x140053198
lea rdx, [rsp + 0x230]
mov word [rsp + rsi + 0x230], bp
mov rcx, rbx
call fcn.140053030
mov word [rsp + 0x20], bp
test rbx, rbx
je 0x140053120
lea rcx, [rsp + 0x20]
sub rcx, rbx
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x140053110
lea rcx, [rsp + 0x20]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], bp
lea rcx, [rcx + 2]
jne 0x140053130
xor edx, edx
nop dword [rax]
movzx eax, word [rdi + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140053140
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005316e
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rsi, qword [rsp + 0x450]
mov rbp, qword [rsp + 0x480]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1401f2820
add rsp, 0x458
pop rdi
pop rbx
ret
call fcn.1401f2e5c
int3
Function at 0x140053f60
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x41], 0
mov rsi, rdx
mov edi, r8d
mov rbx, rcx
je 0x140054064
mov rcx, qword [rcx + 0x50]
mov qword [rsp + 0x48], rbp
mov rax, rcx
test rcx, rcx
je 0x140053fa7
cmp dword [rbx + 0x58], edi
jae 0x140053fa7
call fcn.140054408
mov qword [rbx + 0x50], 0
jmp 0x140053fac
test rax, rax
jne 0x140053fbb
lea ecx, [rdi + rdi]
call fcn.140054410
mov qword [rbx + 0x50], rax
mov dword [rbx + 0x58], edi
mov r8, rdi
mov rdx, rsi
mov rcx, rax
mov rbp, rdi
call fcn.1401f4dc0
test edi, edi
je 0x14005405b
xor r11d, r11d
lea rsi, [0x140283f20]
nop
mov rax, qword [rbx + 0x50]
lea r11, [r11 + 1]
mov r8d, dword [rbx + 0x4c]
mov edx, dword [rbx + 0x44]
mov r9d, r8d
mov ecx, edx
and r9d, 0xfffd
movsx r10, byte [r11 + rax - 1]
or r9d, 2
xor rcx, r10
shr edx, 8
movzx eax, cl
movzx ecx, r8b
shr r8d, 8
xor edx, dword [rsi + rax*4]
movzx eax, dl
add eax, dword [rbx + 0x48]
imul eax, eax, 0x8088405
mov dword [rbx + 0x44], edx
inc eax
mov dword [rbx + 0x48], eax
shr rax, 0x18
xor rcx, rax
xor r8d, dword [rsi + rcx*4]
mov ecx, r9d
xor ecx, 1
mov dword [rbx + 0x4c], r8d
mov rax, qword [rbx + 0x50]
imul ecx, r9d
shr ecx, 8
xor cl, r10b
mov byte [r11 + rax - 1], cl
sub rbp, 1
jne 0x140053fe0
mov rsi, qword [rbx + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdx, qword [rbx + 0x30]
test rdx, rdx
je 0x1400540b4
mov ecx, dword [rbx + 0x38]
lea eax, [rcx + rdi]
cmp eax, dword [rbx + 0x3c]
jb 0x140054091
mov dword [rbx + 0x24], 0x30000
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
add rcx, rdx
mov r8, rdi
mov rdx, rsi
call fcn.1401f4dc0
add dword [rbx + 0x38], edi
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400540eb
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x58]
xor eax, eax
mov dword [rbx + 0x24], 0x1000000
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14005706c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r14, r9
mov rdi, r8
mov rsi, rdx
mov r15, rcx
test r8, r8
je 0x1400570d4
call fcn.140062320
mov r8d, 0xf0
mov rdx, rdi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400570d4
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14005711a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
mov edi, 1
test rbx, rbx
je 0x1400570f9
mov rcx, qword [r15]
mov r9, r14
mov r8, rbx
mov rdx, rsi
mov rax, qword [rcx + 0x40]
mov rcx, r15
call qword [case.0x14013d21d.0]
mov edi, eax
mov rcx, qword [rsi + 0xc8]
test rcx, rcx
je 0x140057118
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x140]
mov rdx, r14
call qword [case.0x14013d21d.0]
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x14005b6d0
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x78
test rdx, rdx
je 0x14005b738
mov r10, qword [rcx + 0x10]
test r10, r10
je 0x14005b722
cmp qword [rcx + 0x18], 0
jne 0x14005b71d
mov eax, dword [rcx + 0xc]
cmp eax, dword [rcx + 0x30]
jae 0x14005b73e
mov qword [rsp + 0x58], rdx
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0x50
mov edx, eax
mov dword [rsp + 0x24], 0x40
mov r8d, 1
mov rcx, qword [r10 + 8]
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
add rsp, 0x78
ret
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x14005b738
mov rcx, qword [rcx + 0x40]
add rsp, 0x78
jmp fcn.1400b3280
call fcn.140060708
int3
call fcn.140060708
int3

Function at 0x14005bca8
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14005bd23
xor r8d, r8d
call fcn.14005bf78
mov rsi, rax
test rax, rax
je 0x14005bd1f
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14005bd1f
mov eax, dword [rsp + 0x30]
jmp 0x14005bd39
mov eax, edi
jmp 0x14005bd39
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14005c8d0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14005c937
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005c94b
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005c94b
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call qword [case.0x14013d21d.0]
jmp 0x14005c950
cmp dword [rcx + 8], 0
je 0x14005c94b
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14005c950
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x14005f8d0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14005f8f6
mov r8, rdx
mov rdx, qword [rbx]
call fcn.14005c8d0
jmp 0x14005f962
cmp byte [0x1402d1818], 0
jne 0x14005f93a
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005f92a
lea rdx, [0x1402295c8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402d1810], rax
jmp 0x14005f931
mov rax, qword [0x1402d1810]
mov byte [0x1402d1818], 1
jmp 0x14005f941
mov rax, qword [0x1402d1810]
mov rdx, rdi
mov rcx, qword [rbx]
test rax, rax
je 0x14005f95b
xor r9d, r9d
mov r8d, dword [rbx + 8]
call qword [case.0x14013d21d.0]
jmp 0x14005f962
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14005f970
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x14005fc68
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x20]
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
test eax, eax
jne 0x14005fcaa
mov ecx, dword [rsp + 0x58]
sub ecx, 4
neg ecx
sbb eax, eax
and eax, 0xd
test eax, eax
sete dl
mov eax, edx
add rsp, 0x38
ret