joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401e40
Capabilities:
Create pipe
Create thread

Disassembly:
mov r11, rsp
sub rsp, 0x188
mov rax, qword [0x0040e4e8]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 - 8], rsi
mov qword [r11 - 0x10], rdi
mov rdi, rdx
lea rbp, [0x0040f5a0]
lea rdx, str.DEFAULT
mov r8, rbp
mov rsi, rcx
call section..text
mov edx, 0x3ee
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
lea r8d, [r9 + 0x40]
mov rcx, rax
mov edx, 0xc5
call qword [sym.imp.USER32.dll_SendMessageA]
mov edx, 0x3f0
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
mov edx, 0xc5
lea r8d, [r9 + 0x40]
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageA]
lea r8, [0x0040e340]
xor r9d, r9d
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], rbp
call fcn.00402860
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rsi
mov rdx, rax
call fcn.00402770
mov r9d, dword [rdi + 4]
lea r8, [rdi + 8]
lea rdx, str..pipe_s_Msg_d
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
xor ebx, ebx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x3e8
mov r9d, 0xff
xor r8d, r8d
mov edx, 0x400c0003
mov dword [rsp + 0x28], 0x1000
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rdi, qword [rsp + 0x178]
cmp rax, 0xffffffffffffffff
mov rbp, qword [rsp + 0x1a8]
jne 0x401f68
xor eax, eax
jmp 0x401fbd
mov r8, rax
mov edx, 0xffffffeb
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
lea r11, [rsp + 0x40]
lea r8, [0x00401310]
mov qword [rsp + 0x28], r11
mov r9, rsi
mov edx, 0x4000
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0xfffffffe
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rsi, qword [rsp + 0x180]
mov rbx, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.004033a0
add rsp, 0x188
ret
Function at 0x402190
Capabilities:
Create mailslot

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x18], rbx
mov rbx, rcx
mov edx, 0x400
mov ecx, 0x40
mov qword [rax + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov rdi, rax
je 0x4021eb
lea rcx, [rsp + 0x38]
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov edx, 0x400
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x4021ef
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
jmp 0x402266
lea r9, [0x0040e4d0]
mov edx, 2
mov r8d, 0xf01fffff
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
je 0x4021e2
xor r9d, r9d
lea rcx, [rsp + 0x38]
mov r8, rdi
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x4021e2
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x20]
xor edx, edx
mov r8d, 0xffffffff
mov rcx, rbx
mov dword [rsp + 0x20], 0x18
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateMailslotA]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, rbx
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
add rsp, 0x68
ret

Function at 0x402280
Capabilities:
Create mailslot

Disassembly:
sub rsp, 0x28
xor r9d, r9d
xor edx, edx
mov r8d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_CreateMailslotA]
xor ecx, ecx
cmp rax, 0xffffffffffffffff
cmove rax, rcx
add rsp, 0x28
ret

Function at 0x4022b0
Capabilities:
Read file on windows
Read from mailslot

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbx
mov rbx, r9
mov qword [rsp + 0x48], rsi
mov rsi, rdx
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x20], 0
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
test eax, eax
je 0x4022fc
mov r8d, dword [rsp + 0x30]
cmp r8d, 0xffffffff
jne 0x402312
mov dword [rbx], 0
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret
lea r9, [rsp + 0x34]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4022fc
mov eax, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov dword [rbx], eax
mov rbx, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x58
ret
Function at 0x402420
Capabilities:
Read .ini file

Disassembly:
mov r11, rsp
sub rsp, 0x858
mov rax, qword [0x0040e4e8]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov qword [r11 - 8], rbx
mov rbx, qword [rsp + 0x880]
mov r10, r8
mov rax, rdx
mov qword [rsp + 0x28], rcx
mov qword [r11 - 0x10], rdi
mov rdi, r9
lea r8, [0x0040a5e5]
lea r9, [rsp + 0x30]
mov rdx, r10
mov rcx, rax
mov dword [rsp + 0x20], 0x800
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsp + 0x30]
mov edx, eax
call fcn.00402370
test rdi, rdi
je 0x4024a9
lea rdx, [rsp + 0x30]
mov r8, rdi
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x4024b7
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rdi, qword [rsp + 0x848]
mov rbx, qword [rsp + 0x850]
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.004033a0
add rsp, 0x858
ret

Function at 0x4024e0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1168
call fcn.00409bc0
sub rsp, rax
mov rax, qword [0x0040e4e8]
xor rax, rsp
mov qword [rsp + 0x1130], rax
mov qword [rsp + 0x1160], rbx
mov qword [rsp + 0x1158], rbp
mov rbp, qword [rsp + 0x11a0]
mov qword [rsp + 0x1150], rsi
mov rbx, rdx
mov rdx, qword [rsp + 0x1190]
mov qword [rsp + 0x1148], rdi
mov rdi, r8
mov rsi, r9
lea r8, [0x0040a5e5]
mov qword [rsp + 0x1140], r12
mov r12, rcx
lea r9, [rsp + 0x30]
mov rcx, rdi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea r9, [rsp + 0x130]
lea r8, str.ERROR
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x800
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsp + 0x130]
mov edx, eax
call fcn.00402370
test rbp, rbp
mov rdi, qword [rsp + 0x1148]
mov rsi, qword [rsp + 0x1150]
mov rbx, qword [rsp + 0x1160]
je 0x4025f6
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x930]
mov r8, rbp
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x930]
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov r9d, dword [rsp + 0x1198]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x130]
bts r9d, 0x10
mov rcx, r12
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r12, qword [rsp + 0x1140]
mov rbp, qword [rsp + 0x1158]
mov rcx, qword [rsp + 0x1130]
xor rcx, rsp
call fcn.004033a0
add rsp, 0x1168
ret
Function at 0x4026a0
Capabilities:
Log keystrokes

Disassembly:
mov rax, rsp
sub rsp, 0x48
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov dword [rax - 0x18], 3
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
xor r12d, r12d
xor r9d, r9d
xor r8d, r8d
mov dword [rax - 0x20], r12d
lea rdx, [r12 - 1]
mov rbp, rcx
mov dword [rax - 0x28], r12d
call qword [sym.imp.USER32.dll_SetWindowPos]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor edx, edx
mov rcx, rbp
mov edi, eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea r8d, [r12 + 1]
mov ecx, eax
mov edx, edi
mov ebx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, rbp
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor r8d, r8d
mov edx, edi
mov ecx, ebx
mov esi, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [rsp + 0x30], 3
lea rdx, [r12 - 2]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x48
ret

Function at 0x402ac0
Capabilities:
Check os version

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x0040e4e8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x94
call fcn.00403720
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x402ba4
mov eax, dword [rsp + 0x30]
cmp eax, 1
jne 0x402b33
xor eax, eax
cmp dword [rsp + 0x28], eax
seta al
add eax, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.004033a0
add rsp, 0xd8
ret
cmp eax, 2
jne 0x402ba4
mov eax, dword [rsp + 0x24]
cmp eax, 4
jne 0x402b5e
mov eax, 3
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.004033a0
add rsp, 0xd8
ret
cmp eax, 5
jne 0x402b87
xor eax, eax
cmp dword [rsp + 0x28], eax
setne al
add eax, 4
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.004033a0
add rsp, 0xd8
ret
cmp eax, 6
jne 0x402ba4
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.004033a0
add rsp, 0xd8
ret
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.004033a0
add rsp, 0xd8
ret
Function at 0x402c80
Capabilities:
Get session user name

Disassembly:
mov r11, rsp
sub rsp, 0x558
mov rax, qword [0x0040e4e8]
xor rax, rsp
mov qword [rsp + 0x540], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
mov rdi, rcx
mov rbx, rdx
lea rcx, [r11 - 0x218]
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0x200
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rcx, [rsp + 0x140]
xor edx, edx
mov r8d, 0x200
call fcn.00403720
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x140]
mov r8, rbx
call fcn.00402c00
mov rdx, qword [str..MAILSLOT_s_s]
lea r9, [rsp + 0x340]
lea r8, [rsp + 0x140]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_wsprintfA]
call fcn.00402ac0
cmp dword [rsp + 0x20], 0
mov rbx, qword [rsp + 0x570]
jne 0x402d3d
cmp eax, 6
jne 0x402d3d
lea rcx, [rsp + 0x30]
call fcn.00402190
jmp 0x402d47
lea rcx, [rsp + 0x30]
call fcn.00402280
xor r9d, r9d
mov rcx, rdi
mov qword [0x0040f7c0], rax
lea edx, [r9 + 1]
lea r8d, [r9 + 0x64]
call qword [sym.imp.USER32.dll_SetTimer]
mov rdi, qword [rsp + 0x578]
mov eax, 1
mov rcx, qword [rsp + 0x540]
xor rcx, rsp
call fcn.004033a0
add rsp, 0x558
ret
Function at 0x402ee0
Capabilities:
Check mutex on windows

Disassembly:
mov r11, rsp
sub rsp, 0x5c8
mov rax, qword [0x0040e4e8]
xor rax, rsp
mov qword [rsp + 0x590], rax
mov qword [r11 - 8], rbx
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
mov rdi, rcx
mov rcx, r8
mov rsi, r8
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x402f25
xor eax, eax
jmp 0x403174
lea rcx, [rsp + 0x390]
xor edx, edx
mov r8d, 0x200
call fcn.00403720
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x390]
mov r8, rsi
call fcn.00402c00
lea r8, [rsp + 0x390]
lea rdx, str._s_Message_Service
lea rcx, [rsp + 0xf0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rsp + 0xf0]
lea rdx, str.Global_s
lea rcx, [rsp + 0x200]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rsp + 0x200]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x402f1e
mov qword [rsp + 0x5b8], rbp
xor ebp, ebp
test rbx, rbx
jne 0x40304d
lea rax, [0x00402e50]
lea edx, [rbp + 0x65]
mov rcx, rdi
mov dword [rsp + 0x70], 3
mov dword [rsp + 0x80], ebp
mov dword [rsp + 0x84], ebp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], rdi
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0x90], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0xa0], 0x10
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb0], rax
call qword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x403103
lea rcx, [rsp + 0x280]
mov edx, 0x105
mov qword [0x0040f7b8], rdi
call fcn.00402650
lea r9, str.Jetdlg.ini
lea r8, [rsp + 0x280]
lea rdx, str._s_s
lea rcx, [0x0040f5a0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r9, str.Jetmes.ini
lea r8, [rsp + 0x280]
lea rdx, str._s_s
lea rcx, [0x0040f6b0]
call qword [sym.imp.USER32.dll_wsprintfA]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], 0xdc
mov dword [rsp + 0x30], 0xfa
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0xf0]
mov r9d, 0xcf0000
xor ecx, ecx
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExA]
test rax, rax
jne 0x403110
xor eax, eax
jmp 0x40316c
lea rcx, [rsp + 0xc0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
add eax, 1
cmp eax, 1
jbe 0x403165
mov rcx, qword [0x0040f7c8]
lea rdx, [rsp + 0xc0]
call qword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x403110
lea rcx, [rsp + 0xc0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x403110
mov eax, dword [rsp + 0xd0]
mov rbp, qword [rsp + 0x5b8]
mov rdi, qword [rsp + 0x5a8]
mov rsi, qword [rsp + 0x5b0]
mov rbx, qword [rsp + 0x5c0]
mov rcx, qword [rsp + 0x590]
xor rcx, rsp
call fcn.004033a0
add rsp, 0x5c8
ret
Function at 0x403e17
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x0040e4e8]
jne 0x4033ba
rol rcx, 0x10
test cx, 0xffff
jne 0x4033b6
repz ret
ror rcx, 0x10
jmp 0x403d70
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x0040f890]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x0040f988]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x403df5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x0040f890]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x403e17
mov rax, qword [rsp + 0x88]
mov qword [0x0040f988], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x0040f928], rax
mov rax, qword [0x0040f988]
mov qword [0x0040f800], rax
mov rax, qword [rsp + 0x90]
mov qword [0x0040f910], rax
mov dword [0x0040f7f0], 0xc0000409
mov dword [0x0040f7f4], 1
mov rax, qword [0x0040e4e8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x0040e4f0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x0040f888], eax
mov ecx, 1
call fcn.00405c90
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x0040a810]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x0040f888], 0
jne 0x403e9e
mov ecx, 1
call fcn.00405c90
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x406770
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.00405600
xor ebx, ebx
cmp qword [0x00410498], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x4068a1
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x4067d3
xor eax, eax
jmp 0x406981
lea rdx, [0x0040aef0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x4067cc
mov rcx, rax
call fcn.00405590
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x00410498], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00405590
lea rdx, str.GetLastActivePopup
mov rcx, rbp
mov qword [0x004104a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00405590
lea rcx, [rsp + 0x30]
mov qword [0x004104a8], rax
call fcn.00403fa0
test eax, eax
je 0x406857
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00403b30
cmp dword [rsp + 0x30], 2
jne 0x4068a1
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00405590
test rax, rax
mov qword [0x004104b8], rax
je 0x4068a1
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00405590
mov qword [0x004104b0], rax
mov rcx, qword [0x004104b0]
cmp rcx, rsi
je 0x406933
cmp qword [0x004104b8], rsi
je 0x406933
call fcn.00405660
call rax
test rax, rax
mov rbp, rax
je 0x4068fe
mov rcx, qword [0x004104b8]
call fcn.00405660
lea rcx, [rsp + 0x38]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x4068fe
test byte [rsp + 0x48], 1
jne 0x406933
lea rcx, [rsp + 0x34]
call fcn.00403ff0
test eax, eax
je 0x406920
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00403b30
cmp dword [rsp + 0x34], 4
jb 0x40692d
bts edi, 0x15
jmp 0x406967
bts edi, 0x12
jmp 0x406967
mov rcx, qword [0x004104a0]
cmp rcx, rsi
je 0x406967
call fcn.00405660
call rax
test rax, rax
mov rbx, rax
je 0x406967
mov rcx, qword [0x004104a8]
cmp rcx, rsi
je 0x406967
call fcn.00405660
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x00410498]
call fcn.00405660
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x140065b30
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x118
mov byte [rsp + 0x5f], 0
mov qword [rsp + 0x60], 1
mov byte [rsp + 0x6f], 0
mov qword [rsp + 0x70], 1
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x110], rax
lea rcx, [rsp + 0xa8]
xor edx, edx
mov r8d, 0x30
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x78]
lea rdx, [rsp + 0xa8]
mov r8d, 0x30
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0xd8]
lea rdx, [rsp + 0x78]
mov r8d, 0x30
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0xd8]
mov r8d, 0x30
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x28]
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsp + 0x48]
add rsp, 0x118
ret
Function at 0x14008c0f0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor ebx, ebx
xor edi, edi
xor r12d, r12d
cmp r8, 0x201
jae 0x14008c190
jmp 0x14008c17f
jae 0x14008c250
cmp r8, 0x201
jae 0x14008c190
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x14008c1e8
sub r8, r12
sub rdi, r12
cmp rdi, r8
jae 0x14008c1bf
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.1400a4d20
mov rbx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rbp + 0x3d8], r12
mov rdi, rbx
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x14008c211
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14008c2b8
mov r8d, r14d
cmp r15, r8
jne 0x14008c170
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14008c2e5
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14008c17f
jmp 0x14008c190
cmp rsi, r8
jb 0x14008c2ff
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.14008ea40
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x14008c2a1
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rbx
call fcn.1400054a0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
jne 0x14008c289
jmp 0x14008c2a1
lea rcx, str.internal_error:_entered_unreachable_code_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.1400a5810
jmp 0x14008c314
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1400a5e00
ud2
Function at 0x140093c00
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x1400b3700]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x140093c44
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140093caa
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140093ce1
test eax, eax
js 0x140093cbb
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140093cd4
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x1400b3768]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.14008e670
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.14008a1e0
mov ecx, 7
int 0x29
ud2

Function at 0x140094640
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x140094678
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call fcn.140094690
nop
add rsp, 0x38
ret

Function at 0x140094690
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x1400946d3
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x14008cde0]
mov qword [rbp - 0x28], rax
lea rax, str.09_v_
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.X9_v_
lea rcx, [rbp - 0x60]
call fcn.1400a5740
ud2