joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400040b0
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx - 0x128]
mov rbx, rcx
add rcx, 0xfffffffffffffed8
movsxd rdx, dword [rax + 4]
add rcx, rdx
call fcn.140012630
mov rax, qword [rbx - 0x128]
mov edx, dword [rbx - 0x20]
movsxd rcx, dword [rax + 4]
mov rcx, qword [rcx + rbx - 0x120]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [rbx - 0x128]
mov edx, dword [rbx - 4]
movsxd rcx, dword [rax + 4]
mov rcx, qword [rcx + rbx - 0x120]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [rbx - 0x128]
mov edx, dword [rbx - 0x1c]
movsxd rcx, dword [rax + 4]
mov rcx, qword [rcx + rbx - 0x120]
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [rbx - 0xc], 0
lea rdx, [rbx - 0xa0]
jne 0x140004151
lea rdx, [rbx - 0x120]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, 1
mov dword [rbx - 8], 0
add rsp, 0x20
pop rbx
ret
Function at 0x1400063b0
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x140115740]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov rcx, qword [rcx + 0x6e0]
mov r8d, 2
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, 1
jl 0x14000650b
mov qword [rsp + 0x158], rdi
mov eax, 0xff
movzx edi, word [rsp + 0x20]
cmp di, ax
ja 0x140006503
mov rcx, qword [rbx + 0x1e0]
lea edx, [rax + 0x48]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x140006503
mov rcx, qword [rbx + 0x1e0]
xor r9d, r9d
mov qword [rsp + 0x178], rbp
mov edx, 0x150
mov qword [rsp + 0x180], rsi
movsxd r8, eax
mov qword [rsp + 0x150], r14
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rsi, eax
lea r14, [0x14010e680]
add rsi, rsi
mov ebp, dword [r14 + rsi*8 + 4]
cmp ebp, 0x14
jge 0x14000647c
movzx ecx, dil
call fcn.140060580
movzx edi, al
movsxd rax, dword [rbx + 0x10f4]
lea rdx, str.___c_t_s
movzx r8d, dil
lea rcx, [rsp + 0x40]
mov byte [rbx + rax*8 + 0x8f4], dil
movsxd rax, dword [rbx + 0x10f4]
mov dword [rbx + rax*8 + 0x8f8], ebp
inc dword [rbx + 0x10f4]
mov r9, qword [r14 + rsi*8 + 8]
call fcn.140007e30
mov rcx, qword [rbx + 0x1d0]
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x180
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x1d0]
xor r9d, r9d
movsxd r8, eax
mov edx, 0x186
call qword [sym.imp.USER32.dll_SendMessageW]
mov r14, qword [rsp + 0x150]
mov rsi, qword [rsp + 0x180]
mov rbp, qword [rsp + 0x178]
mov rdi, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400265c0
add rsp, 0x160
pop rbx
ret

Function at 0x140007090
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140115740]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov rcx, qword [rcx + 0x6e0]
mov r8d, 2
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, 1
jge 0x1400070f6
mov rcx, qword [rbx + 0x1f8]
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rbx + 0x508]
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400265c0
add rsp, 0x50
pop rbx
ret
movzx edx, byte [rsp + 0x20]
mov rcx, rbx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
call fcn.1400061b0
mov rcx, qword [rbx + 0x1f8]
xor esi, esi
movsxd rdi, eax
mov edx, esi
cmp edi, 0xffffffff
sete dl
call qword [sym.imp.USER32.dll_EnableWindow]
cmp edi, 0xffffffff
je 0x14000714c
mov rcx, qword [rbx + 0x1d0]
mov r8, rdi
xor r9d, r9d
mov edx, 0x186
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbx
call fcn.140007c80
mov rcx, qword [rbx + 0x1d0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x188
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x508]
cmp eax, 0xffffffff
setne sil
mov edx, esi
call qword [sym.imp.USER32.dll_EnableWindow]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400265c0
add rsp, 0x50
pop rbx
ret
Function at 0x1400074a0
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x170
mov rax, qword [0x140115740]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rcx
lea rdx, [rsp + 0x20]
mov rcx, qword [rcx + 0x6e0]
mov r8d, 2
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, 1
jl 0x140007697
mov qword [rsp + 0x198], rsi
mov eax, 0xff
movzx esi, word [rsp + 0x20]
cmp si, ax
ja 0x14000768f
mov qword [rsp + 0x188], rbx
movzx ebx, sil
mov ecx, ebx
mov qword [rsp + 0x168], r12
mov qword [rsp + 0x160], r13
call fcn.140060580
mov ecx, ebx
mov r12d, eax
call fcn.140060554
mov rcx, qword [rdi + 0x1e0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x147
mov r13d, eax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x140007677
mov rcx, qword [rdi + 0x1e0]
xor r9d, r9d
mov qword [rsp + 0x190], rbp
mov edx, 0x150
mov qword [rsp + 0x158], r14
movsxd r8, eax
mov qword [rsp + 0x150], r15
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x1d0]
xor r9d, r9d
movsxd r14, eax
xor r8d, r8d
lea rax, [0x14010e680]
add r14, r14
mov edx, 0x188
mov r15d, dword [rax + r14*8 + 4]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbp, rax
cmp eax, 0xffffffff
je 0x14000765f
movsxd rbx, ebp
lea r9, [0x14010e680]
movzx edx, sil
cmp r15d, 0x14
movzx ecx, r12b
cmovl edx, ecx
lea rcx, [rsp + 0x40]
mov byte [rdi + rbx*8 + 0x8f4], dl
mov dword [rdi + rbx*8 + 0x8f8], r15d
mov r9, qword [r9 + r14*8 + 8]
movzx r8d, dl
lea rdx, str.___c_t_s
call fcn.140007e30
mov rcx, qword [rdi + 0x1d0]
lea r9, [rsp + 0x40]
mov r8, rbx
mov edx, 0x181
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x1d0]
lea eax, [rbp + 1]
movsxd r8, eax
xor r9d, r9d
mov edx, 0x182
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x1d0]
xor r9d, r9d
mov r8, rbx
mov edx, 0x186
call qword [sym.imp.USER32.dll_SendMessageW]
movzx edx, r13b
mov rcx, rdi
call fcn.1400061b0
cmp eax, 0xffffffff
je 0x14000765f
cmp eax, ebp
je 0x14000765f
mov edx, eax
mov rcx, rdi
call fcn.140005f30
mov r14, qword [rsp + 0x158]
mov rbp, qword [rsp + 0x190]
mov r15, qword [rsp + 0x150]
mov rbx, qword [rsp + 0x188]
mov r12, qword [rsp + 0x168]
mov r13, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400265c0
add rsp, 0x170
pop rdi
ret
Function at 0x140008180
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, r9
mov edi, r8d
mov rbp, rdx
mov rbx, rcx
cmp r8d, 0x201
jne 0x1400081d3
lea r8, [rcx + 0xa0]
mov dword [rsp + 0x28], 1
xor ecx, ecx
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov r9, rsi
mov r8d, edi
mov rdx, rbp
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp method.CSmLabel.virtual_0
sub rsp, 0x38
cmp r8d, 0x20
je 0x140008235
cmp r8d, 0x138
je 0x140008222
mov rcx, qword [rcx + 0x18]
add rsp, 0x38
jmp qword [sym.imp.USER32.dll_CallWindowProcW]
mov rax, qword [rcx]
mov rdx, r9
mov r8, qword [rsp + 0x60]
add rsp, 0x38
jmp qword [rax + 8]
mov rcx, qword [rcx + 0x90]
test rcx, rcx
je 0x140008247
call qword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
add rsp, 0x38
ret

Function at 0x140008b30
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x860
mov rax, qword [0x140115740]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rbx, rcx
lea rdx, [rsp + 0x50]
mov rcx, qword [rcx + 0x1d0]
mov r8d, 0x400
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx + 0x4a8]
lea rdx, [rsp + 0x28]
mov r8d, 0x10
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx + 0x1c8]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.1400083c0
cmp eax, 0xffffffff
je 0x140008c07
mov rcx, qword [rbx + 0x1c8]
xor r9d, r9d
movsxd r8, eax
mov edx, 0x182
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x260]
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
xor edx, edx
mov rcx, rbx
call fcn.1400096d0
mov rcx, qword [rbx + 0x1f0]
xor edx, edx
cmp word [rsp + 0x50], dx
setne dl
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rbx + 0x4a8]
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [rbx + 0x4a8]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0xb1
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1400265c0
add rsp, 0x860
pop rbx
ret
Function at 0x140008c20
Capabilities:
Get graphical window text

Disassembly:
push rbx
mov eax, 0x1090
call fcn.140026670
sub rsp, rax
mov rax, qword [0x140115740]
xor rax, rsp
mov qword [rsp + 0x1080], rax
mov rbx, rcx
lea rdx, [rsp + 0x28]
mov rcx, qword [rcx + 0x4a8]
mov r8d, 0x10
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx + 0x1d0]
lea rdx, [rsp + 0x50]
mov r8d, 0x400
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x28]
lea rdx, str._s_t_s
lea rcx, [rsp + 0x850]
call fcn.140007e30
mov rcx, qword [rbx + 0x1c8]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.1400083c0
cmp eax, 0xffffffff
je 0x140008cc5
mov rcx, qword [rbx + 0x1c8]
xor r9d, r9d
movsxd r8, eax
mov edx, 0x182
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x1c8]
lea r9, [rsp + 0x850]
xor r8d, r8d
mov edx, 0x180
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x1c8]
xor r9d, r9d
movsxd r8, eax
mov edx, 0x186
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 1
mov rcx, rbx
call fcn.1400096d0
mov rcx, qword [rbx + 0x1f0]
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rbx + 0x260]
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rbx + 0x4a8]
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [rbx + 0x4a8]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0xb1
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x1080]
xor rcx, rsp
call fcn.1400265c0
add rsp, 0x1090
pop rbx
ret
Function at 0x1400092c0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x860
mov rax, qword [0x140115740]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rbx, rcx
lea rdx, [rsp + 0x50]
mov rcx, qword [rcx + 0x1d0]
mov r8d, 0x400
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx + 0x4a8]
lea rdx, [rsp + 0x28]
mov r8d, 0x10
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [rsp + 0x28], 0
mov rcx, qword [rbx + 0x1c8]
je 0x140009394
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.1400083c0
mov edi, eax
cmp eax, 0xffffffff
je 0x14000933c
mov r8d, eax
jmp 0x14000934b
or r8, 0xffffffffffffffff
cmp dword [rsp + 0x20], r8d
cmovne r8d, dword [rsp + 0x20]
mov rcx, qword [rbx + 0x1c8]
xor r9d, r9d
movsxd r8, r8d
mov edx, 0x186
call qword [sym.imp.USER32.dll_SendMessageW]
cmp edi, 0xffffffff
je 0x1400093a6
mov edi, 1
mov rcx, rbx
mov edx, edi
call fcn.1400096d0
mov rcx, qword [rbx + 0x1f0]
xor eax, eax
cmp word [rsp + 0x50], ax
setne al
mov edx, eax
call qword [sym.imp.USER32.dll_EnableWindow]
mov edx, edi
jmp 0x1400093dc
xor r9d, r9d
or r8, 0xffffffffffffffff
mov edx, 0x186
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
mov rcx, rbx
call fcn.1400096d0
cmp word [rsp + 0x28], 0
je 0x1400093c7
cmp word [rsp + 0x50], 0
je 0x1400093c7
mov edi, 1
jmp 0x1400093cb
xor eax, eax
mov edi, eax
mov rcx, qword [rbx + 0x1f0]
mov edx, edi
call qword [sym.imp.USER32.dll_EnableWindow]
xor edx, edx
mov rcx, qword [rbx + 0x260]
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1400265c0
mov rbx, qword [rsp + 0x878]
add rsp, 0x860
pop rdi
ret

Function at 0x140009590
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x850
mov rax, qword [0x140115740]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rbx, rcx
lea rdx, [rsp + 0x40]
mov rcx, qword [rcx + 0x1d0]
mov r8d, 0x400
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx + 0x4a8]
lea rdx, [rsp + 0x20]
mov r8d, 0x10
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [rsp + 0x40], 0
je 0x1400095f5
cmp word [rsp + 0x20], 0
je 0x1400095f5
mov edx, 1
jmp 0x1400095f7
xor edx, edx
mov rcx, qword [rbx + 0x1f0]
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1400265c0
add rsp, 0x850
pop rbx
ret

Function at 0x14000adb0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
lea r8, [rcx + 0x5c]
mov dword [rsp + 0x28], 1
xor ecx, ecx
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
add rsp, 0x38
ret
Function at 0x14000ae60
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x1a0
mov rax, qword [0x140115740]
xor rax, rsp
mov qword [rsp + 0x190], rax
xor eax, eax
mov rbx, rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.14001c570
lea rcx, [0x140121b60]
call fcn.14000aa30
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [rsp + 0x74]
cmp eax, 4
ja 0x14000aee9
cmp dword [rsp + 0x80], 2
jne 0x14000aedf
cmp eax, 4
je 0x14000aee9
mov dword [rsp + 0x58], 0
jmp 0x14000aef1
mov dword [rsp + 0x58], 1
mov rcx, qword [0x1401217e0]
mov edx, 0x82
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x38], rbx
call qword [sym.imp.USER32.dll_LoadIconW]
mov rcx, qword [0x1401217e0]
mov edx, 0x81
mov qword [rsp + 0x50], rax
call qword [sym.imp.USER32.dll_LoadIconW]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x40], 0x401
mov qword [rsp + 0x48], rax
mov eax, dword [0x1401218ec]
mov dword [rsp + 0x30], eax
call fcn.14001de20
mov ecx, dword [0x1401218e4]
call fcn.14001c080
mov ecx, dword [0x1401218f0]
call fcn.14001dc40
mov ecx, dword [0x1401218e8]
call fcn.14001dcc0
lea rcx, [0x1401218e0]
call fcn.14000a100
lea rcx, [0x140121b60]
call fcn.14000ade0
lea rcx, [0x1401217f0]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
lea r8, [0x14001c400]
xor ecx, ecx
mov dword [rsp + 0x20], 0
xor edx, edx
call fcn.140078a34
mov qword [0x1401217e8], rax
mov eax, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400265c0
add rsp, 0x1a0
pop rbx
ret
Function at 0x14000c060
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x140115740]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
mov rdi, r8
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x34], 6
jb 0x14000c0cb
mov ecx, 0x28
call fcn.14002661c
mov qword [rsp + 0x20], rax
test rax, rax
je 0x14000c0ef
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.14000b590
jmp 0x14000c0f1
mov ecx, 0x98
call fcn.14002661c
mov qword [rsp + 0x20], rax
test rax, rax
je 0x14000c0ef
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.14000b520
jmp 0x14000c0f1
xor eax, eax
mov qword [rbx + 8], rax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400265c0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14000cd80
Capabilities:
Get file attributes
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140115740]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov r8d, 0x104
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ecx, ecx
mov r8d, 0x80070057
test eax, eax
cmovne r8d, ecx
test r8d, r8d
js 0x14000ce1c
lea r8, str.MicrosoftWindowsStart_MenuProgramsUnikeyNT.lnk
mov edx, 0x104
lea rcx, [rsp + 0x20]
call fcn.140078ba8
neg eax
sbb eax, eax
and eax, 0x80070057
jl 0x14000ce1f
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xfffffff
jb 0x14000ce15
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000c7e0
jmp 0x14000ce1f
mov eax, 1
jmp 0x14000ce1f
mov eax, r8d
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400265c0
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret

Function at 0x14000d700
Capabilities:
Write clipboard data

Disassembly:
cmp ecx, 1
jne 0x14000d70c
xor ecx, ecx
jmp fcn.14000ec40
cmp ecx, 0xd
jne 0x14000d71b
mov ecx, 1
jmp fcn.14000ec40
mov eax, 1
ret
Function at 0x14000ec40
Capabilities:
Write clipboard data

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rdi, qword [0x140124378]
xor ebx, ebx
mov r14d, ecx
mov esi, ebx
mov ebp, ebx
test rdi, rdi
jne 0x14000ec6d
xor eax, eax
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0x60], r12
mov rcx, rdi
mov qword [rsp + 0x78], r15
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov rcx, rdi
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r15, rax
test rax, rax
je 0x14000ed5d
lea r9, [rsp + 0x68]
mov dword [rsp + 0x70], r12d
lea r8, [rsp + 0x70]
mov dword [rsp + 0x68], ebx
xor edx, edx
mov dword [rsp + 0x20], r14d
mov rcx, rax
call fcn.140025d30
cmp eax, 6
jne 0x14000ed05
movsxd rdx, dword [rsp + 0x68]
lea ecx, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x14000ed38
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x14000ed38
lea r9, [rsp + 0x68]
mov dword [rsp + 0x70], r12d
lea r8, [rsp + 0x70]
mov dword [rsp + 0x20], r14d
mov rdx, rax
mov rcx, r15
call fcn.140025d30
test eax, eax
jne 0x14000ed38
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test r14d, r14d
mov eax, 0xd
mov ebp, 1
mov rdx, rbx
mov ecx, ebp
cmovne ecx, eax
call qword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x14000ed5d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test rsi, rsi
je 0x14000ed4f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test rbx, rbx
je 0x14000ed5d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r15, qword [rsp + 0x78]
mov eax, ebp
mov r12, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000ed80
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor r9d, r9d
mov rcx, qword [rcx + 0x1c8]
xor r8d, r8d
mov edx, 0x147
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8, qword [rbx + 0x5b8]
xor r9d, r9d
mov edx, 0x147
mov dword [r8 + 0x20], eax
xor r8d, r8d
mov rcx, qword [rbx + 0x1d0]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x5b8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov dword [rcx + 0x24], eax
mov rcx, qword [rbx + 0x1e8]
call qword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
mov edx, 0xf0
cmp rax, 1
mov rax, qword [rbx + 0x5b8]
sete cl
xor r9d, r9d
xor r8d, r8d
mov dword [rax + 0x28], ecx
mov rcx, qword [rbx + 0x1f0]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x5b8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov dword [rcx + 0x26c], eax
mov rcx, qword [rbx + 0x1f8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x5b8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov dword [rcx + 0x270], eax
mov rcx, qword [rbx + 0x200]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x5b8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov dword [rcx + 0x274], eax
mov rcx, qword [rbx + 0x208]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x5b8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov dword [rcx + 0x268], eax
mov rcx, qword [rbx + 0x210]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x5b8]
mov dword [rcx + 0x278], eax
mov rcx, qword [rbx + 0x5b8]
add rsp, 0x20
pop rbx
jmp fcn.140011ba0

Function at 0x14000fcd0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x140124925], 0
mov rbx, rcx
je 0x14000fcec
add rsp, 0x20
pop rbx
jmp fcn.14000f880
lea rcx, [0x140124910]
call fcn.140010350
test al, al
je 0x14000fd10
mov rcx, rbx
mov byte [rbx + 0x1d8], 1
add rsp, 0x20
pop rbx
jmp fcn.14000fd60
mov rax, qword [rbx + 8]
lea r8, [0x1400c65a8]
mov r9d, 0x10
lea rdx, str.Failed_to_start_downloading_update
movsxd rcx, dword [rax + 4]
mov rcx, qword [rcx + rbx + 0x10]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14000fd60

Function at 0x140010780
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140115740]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400107fa
lea rdx, [rsp + 0x20]
mov ecx, 0x103
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x1400107fa
mov edx, 0x2f
mov rcx, rbx
call fcn.140054cb0
test rax, rax
je 0x1400107fa
add rax, 2
cmp word [rax], 0
je 0x1400107fa
mov r9, rax
lea r8, [rsp + 0x20]
lea rdx, str._s_s
mov rcx, rdi
call fcn.140007e30
mov al, 1
jmp 0x1400107fc
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400265c0
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rdi
ret
Function at 0x140010a00
Capabilities:
Extract resource via kernel32 functions
Import public key

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
lea r8, str.CERTIFICATE
xor ecx, ecx
mov edx, 0xc7
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x140010ada
mov rdx, rax
mov qword [rsp + 0x40], rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
xor ecx, ecx
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140010ad5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140010ad5
mov r9d, 1
mov qword [rsp + 0x48], rsi
xor r8d, r8d
mov dword [rsp + 0x20], 0
xor edx, edx
lea rcx, [rdi + 0xa88]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140010ad0
mov r8d, ebp
mov rdx, rbx
mov ecx, 1
call qword [sym.imp.CRYPT32.dll_CertCreateCertificateContext]
mov rbx, rax
test rax, rax
je 0x140010ad0
mov r8, qword [rax + 0x18]
lea r9, [rdi + 0xa90]
mov rcx, qword [rdi + 0xa88]
add r8, 0x60
mov edx, 1
call qword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
mov rcx, rbx
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140010af0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140115740]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp dword [rcx + 0x10], 0
mov rbx, rcx
je 0x140010b1b
mov al, 1
jmp 0x140010ba3
lea rdx, [rsp + 0x30]
mov ecx, 0x103
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x140010bc0
lea r9, [rbx + 0x418]
mov qword [rsp + 0x268], rdi
xor r8d, r8d
lea rdx, str.UkUpdate
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x140010bbc
lea rdx, [rbx + 0x18]
mov dword [rbx + 0xa48], 0
lea rcx, [rbx + 0xa50]
mov qword [rsp + 0x20], rbx
lea r9, [0x140010250]
lea r8, [rbx + 0x418]
call fcn.140002eb0
test rax, rax
je 0x140010bbc
mov dword [rbx + 0x10], 1
mov al, 1
mov rdi, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400265c0
add rsp, 0x250
pop rbx
ret
xor al, al
jmp 0x140010b9b
xor al, al
jmp 0x140010ba3