joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c4878
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rbp, [rcx + 0x60]
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
cmp r8, 0x40
jbe 0x1400c48c4
call fcn.14009baf8
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.14009bb20
mov rdx, rbp
mov rcx, rbx
call fcn.1400c4c44
mov edi, 0x14
jmp 0x1400c48cc
mov rcx, rbp
call fcn.140106ff0
xor eax, eax
mov qword [rbx + 0xa0], rdi
lea edx, [rax + 0x36]
test rdi, rdi
je 0x1400c48f3
mov ecx, eax
xor byte [rcx + rbx + 0x60], dl
inc eax
mov rdi, qword [rbx + 0xa0]
mov ecx, eax
cmp rcx, rdi
jb 0x1400c48df
mov r8d, 0x40
lea rcx, [rbx + 0x60]
sub r8, rdi
add rcx, rdi
call fcn.140108940
mov rcx, rbx
call fcn.14009baf8
mov r8d, 0x40
mov rdx, rbp
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.14009bb20
Function at 0x1400c7f7c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x14016a900]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov rax, qword [rcx]
xor r8d, r8d
xor edx, edx
mov rbx, rcx
mov rax, qword [rax + 0x20]
call qword [case.0x140092c6b.0]
mov rax, qword [rbx]
lea rdx, [rsp + 0x20]
mov r8d, 0x40
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [case.0x140092c6b.0]
cmp eax, 0x40
jne 0x1400c8072
cmp byte [rsp + 0x20], 0x4d
jne 0x1400c8072
cmp byte [rsp + 0x21], 0x5a
jne 0x1400c8072
mov rax, qword [rbx]
xor r8d, r8d
mov edx, dword [rsp + 0x5c]
mov rcx, rbx
mov rax, qword [rax + 0x20]
call qword [case.0x140092c6b.0]
mov rax, qword [rbx]
lea rdx, [rsp + 0x20]
mov r8d, 0x108
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [case.0x140092c6b.0]
cmp eax, 0x108
jne 0x1400c8072
cmp byte [rsp + 0x20], 0x50
jne 0x1400c8072
cmp byte [rsp + 0x21], 0x45
jne 0x1400c8072
cmp byte [rsp + 0x22], 0
jne 0x1400c8072
cmp byte [rsp + 0x23], 0
jne 0x1400c8072
cmp byte [rsp + 0x38], 0xb
jne 0x1400c8072
cmp byte [rsp + 0x39], 1
jne 0x1400c8059
cmp dword [rbp - 0x6c], 4
jbe 0x1400c8059
mov eax, dword [rbp - 0x48]
jmp 0x1400c8074
cmp byte [rsp + 0x38], 0xb
jne 0x1400c8072
cmp byte [rsp + 0x39], 2
jne 0x1400c8072
cmp dword [rbp - 0x5c], 4
jbe 0x1400c8072
mov eax, dword [rbp - 0x38]
jmp 0x1400c8074
xor eax, eax
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140105c50
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rbp
ret
Function at 0x1400c8b34
Capabilities:
Hide graphical window

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [rdx]
mov r9, rdx
and qword [r11 + 0x20], 0
lea rdx, [r11 + 0x20]
and qword [r11 + 0x10], 0
mov rdi, rcx
mov rcx, r9
mov rsi, r8
mov rax, qword [rax + 0x90]
call qword [case.0x140092c6b.0]
mov ebx, eax
test eax, eax
js 0x1400c8bef
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400c8bfd
mov rax, qword [rcx]
lea r8, [rsp + 0x58]
lea rdx, [0x140142830]
mov rax, qword [rax]
call qword [case.0x140092c6b.0]
mov ebx, eax
test eax, eax
js 0x1400c8bdd
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [case.0x140092c6b.0]
mov ebx, eax
test eax, eax
js 0x1400c8bcb
mov rcx, qword [rsp + 0x58]
mov rdx, rsi
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x140092c6b.0]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140092c6b.0]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140092c6b.0]
test ebx, ebx
js 0x1400c8bfd
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jne 0x1400c8c6e
cmp qword [rdi + 0x10], 0
je 0x1400c8c6e
cmp qword [rdi + 0x40], 0
jne 0x1400c8c6e
mov rdx, qword [rdi + 0x38]
test rdx, rdx
je 0x1400c8c6e
mov rcx, rdi
call fcn.1400c9530
mov rsi, rax
test rax, rax
je 0x1400c8c6e
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov dword [rsp + 0x30], 0x204
xor r8d, r8d
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea edx, [r9 + 1]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [rdi + 0x10]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rdi + 0x10]
mov rdx, rsi
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, rsi
call fcn.140110e68
mov rsi, qword [rsp + 0x60]
shr ebx, 0x1f
xor bl, 1
mov al, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400c9cc8
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
mov eax, 0x2040
call fcn.140105bf0
sub rsp, rax
mov rax, qword [0x14016a900]
xor rax, rsp
mov qword [rsp + 0x2030], rax
xor ebx, ebx
mov rdi, rdx
cmp dword [rdx + 0x10], 6
mov rsi, rcx
mov ebp, 0x400c
jb 0x1400c9d54
mov rax, qword [rdx]
cmp word [rax + 0x78], bp
jne 0x1400c9d54
mov rax, qword [rax + 0x80]
mov rcx, qword [rax + 8]
cmp word [rcx], 0x5c
je 0x1400c9d42
cmp word [rcx], 0x2f
je 0x1400c9d42
lea r8d, [rbx + 5]
lea rdx, str.file:
call fcn.14009fe38
test eax, eax
jne 0x1400c9d54
mov rax, qword [rdi]
or edx, 0xffffffff
mov rcx, qword [rax + 8]
mov word [rcx], dx
jmp 0x1400c9f43
cmp dword [rsi + 0x4c], ebx
je 0x1400c9f43
cmp byte [rsi + 0x49], bl
je 0x1400c9f43
cmp dword [rdi + 0x10], 6
jb 0x1400c9f43
mov rax, qword [rdi]
cmp word [rax + 0x78], bp
jne 0x1400c9f43
mov rax, qword [rax + 8]
lea rbp, [0x14012ae60]
or edx, 0xffffffff
lea r15, str.open
mov word [rax], dx
cmp dword [rsi + 0x4c], 2
lea r14d, [rdx + 2]
mov rax, qword [rdi]
mov rcx, qword [rax + 0x80]
mov rdi, qword [rcx + 8]
jne 0x1400c9f28
call fcn.1400c87b4
mov edx, eax
test eax, eax
je 0x1400c9f00
sub edx, r14d
je 0x1400c9ed3
sub edx, r14d
je 0x1400c9e9c
cmp edx, 2
je 0x1400c9dee
cmp eax, 5
je 0x1400c9f28
cmp eax, 3
je 0x1400c9f28
jmp 0x1400c9f22
mov dword [rsp + 0x28], 0x800
lea r9, [rsp + 0x30]
mov r8, rbp
mov qword [rsp + 0x20], rbp
lea rdx, str.http_shellopencommand
mov rcx, 0xffffffff80000000
call fcn.1400add74
mov edx, 0x22
cmp word [rsp + 0x30], dx
jne 0x1400c9f28
lea rcx, [rsp + 0x32]
call fcn.140106f38
mov rsi, rax
test rax, rax
je 0x1400c9f28
lea rcx, [rsp + 0x30]
call fcn.1400876ec
mov rcx, rax
lea rdx, str.opera.exe
mov r8d, 9
call fcn.14009fe38
test eax, eax
jne 0x1400c9f28
mov r9, rdi
mov word [rsi + 2], bx
lea r8, str._newwindow__s
mov edx, 0x800
lea rcx, [rsp + 0x1030]
call fcn.1400027fc
mov dword [rsp + 0x28], r14d
lea r9, [rsp + 0x1030]
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x30]
jmp 0x1400c9f14
mov r9, rdi
lea r8, str.__new_window__s
mov edx, 0x800
lea rcx, [rsp + 0x1030]
call fcn.1400027fc
mov dword [rsp + 0x28], r14d
lea r9, [rsp + 0x1030]
mov qword [rsp + 0x20], rdi
lea r8, str.chrome.exe
jmp 0x1400c9f14
mov r9, rdi
lea r8, str._new_window__s
mov edx, 0x800
lea rcx, [rsp + 0x1030]
call fcn.1400027fc
lea r9, [rsp + 0x1030]
lea r8, str.firefox.exe
jmp 0x1400c9f0a
mov r9, rdi
lea r8, str.iexplore.exe
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbp
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, rax
cmp rbx, 0x20
ja 0x1400c9f43
mov dword [rsp + 0x28], r14d
xor r9d, r9d
mov r8, rdi
mov qword [rsp + 0x20], rbp
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.140105c50
lea r11, [rsp + 0x2040]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400cad28
Capabilities:
Get disk information
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x4360]
mov eax, 0x4460
call fcn.140105bf0
sub rsp, rax
mov rax, qword [0x14016a900]
xor rax, rsp
mov qword [rbp + 0x4350], rax
mov rax, rdx
mov rdi, rcx
mov r14d, 0x800
lea rdx, [rbp + 0xf50]
mov r8d, r14d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x7fe
ja 0x1400caf6a
mov r9d, r14d
lea r8, [rbp + 0xf50]
lea rdx, [rbp + 0xf50]
lea rcx, [0x1401a0cb0]
call fcn.14004ca74
lea rcx, [rbp + 0xf50]
call fcn.1400876ec
mov edx, 0x3a
mov rcx, rax
call fcn.140106f38
xor esi, esi
test rax, rax
je 0x1400cae04
cmp byte [0x1401d1522], sil
jne 0x1400cae04
lea ecx, [rsi + 0x65]
call fcn.140096d58
mov ecx, 0x528
mov rbx, rax
call fcn.140096d58
lea r9d, [rsi + 0x31]
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.1400d7004
cmp eax, 1
jne 0x1400caed8
mov byte [0x1401d1522], al
mov r8, r14
lea rdx, [rbp + 0xf50]
lea rcx, [rsp + 0x50]
call fcn.14009ccc8
lea rcx, [rsp + 0x50]
call fcn.140087740
lea rcx, [rsp + 0x50]
call fcn.1400876ec
mov ebx, 0xa00
cmp word [rax], si
jne 0x1400caf53
mov r8, r14
lea rdx, [rbp + 0x1f50]
lea rcx, [rbp + 0xf50]
call fcn.14008696c
mov dword [rsp + 0x38], esi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rsi
lea rcx, [rbp + 0x1f50]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1400caf6a
test dword [rsp + 0x40], 0x80000
je 0x1400caf6a
mov ecx, 0x65e
call fcn.140096d58
mov r8, rax
lea r9, [rbp + 0x1f50]
mov rdx, rbx
lea rcx, [rbp + 0x2f50]
call fcn.1400027fc
mov ecx, 0x65
call fcn.140096d58
mov r8, rax
lea rdx, [rbp + 0x2f50]
mov r9d, 0x30
mov rcx, rdi
call fcn.1400d7004
xor al, al
jmp 0x1400caf6c
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1400126f8
test al, al
jne 0x1400cae3a
mov ecx, 0x14e
call fcn.140096d58
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r8, str.__s__n_s
mov rdx, rbx
lea rcx, [rbp + 0x2f50]
call fcn.1400027fc
mov ecx, 0x65
call fcn.140096d58
mov r8, rax
lea rdx, [rbp + 0x2f50]
mov r9d, 0x34
mov rcx, rdi
call fcn.1400d7004
cmp eax, 6
jne 0x1400caed8
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.1400762a8
lea rcx, [rsp + 0x50]
call fcn.140076738
test al, al
je 0x1400caedf
jmp 0x1400cae3a
mov al, 1
mov rcx, qword [rbp + 0x4350]
xor rcx, rsp
call fcn.140105c50
lea r11, [rsp + 0x4460]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400d5878
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1040
call fcn.140105bf0
sub rsp, rax
mov rax, qword [0x14016a900]
xor rax, rsp
mov qword [rsp + 0x1030], rax
xor ebp, ebp
mov sil, r8b
cmp word [0x140173998], bp
mov rdi, rdx
mov rbx, rcx
je 0x1400d58bf
lea rdx, [0x140173998]
jmp 0x1400d594f
lea r9, [0x14012ae60]
mov dword [rsp + 0x20], edi
mov r8, rbx
lea rdx, str.TempFolder
lea rcx, [0x14012b1c0]
call fcn.1400adec0
mov r8d, 0x800
mov word [rsp + 0x30], bp
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp word [rbx], bp
je 0x1400d591c
dec eax
cmp eax, 0x7fe
ja 0x1400d5917
mov r8, rdi
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14009ccc8
cmp word [rbx], bp
jne 0x1400d5923
test sil, sil
je 0x1400d5931
jmp 0x1400d5957
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400d5957
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1400d5945
cmp word [rbx], bp
jne 0x1400d5957
lea rdx, str._rartemp
mov rcx, rbx
mov r8, rdi
call fcn.14009ccc8
mov rdx, rdi
mov rcx, rbx
call fcn.140085ac8
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.140105c50
mov rbx, qword [rsp + 0x1070]
add rsp, 0x1040
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400d5988
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor r8d, r8d
lea rdx, str.NoDrives
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov ebx, eax
call fcn.1400add30
not eax
and eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1400d5c80
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov eax, 0x2030
call fcn.140105bf0
sub rsp, rax
mov rax, qword [0x14016a900]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov rdi, rdx
mov rsi, r8
mov rdx, rcx
mov r8d, 0x7ff
lea rcx, [rsp + 0x1020]
mov bl, r9b
call fcn.14009ccc8
xor ebp, ebp
test bl, bl
je 0x1400d5d1a
cmp byte [0x14019e2c0], bpl
jne 0x1400d5ce2
cmp byte [0x14019e20b], bpl
lea r9d, [rbp + 0x61]
je 0x1400d5ce8
mov r9d, SHRestricted
lea rcx, [rsp + 0x1020]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bp
jne 0x1400d5cf4
lea rcx, [rsp + 0x1020]
mov edx, 2
lea rcx, [rcx + rax*2]
lea r8, [0x140140240]
call fcn.1400027fc
mov ebx, 0x800
lea rcx, [rsp + 0x20]
mov edx, ebx
xor r8d, r8d
call fcn.1400d5878
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.140085ac8
mov r8d, ebx
lea rdx, [rsp + 0x1020]
lea rcx, [rsp + 0x20]
call fcn.14009cca0
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.140076bd4
test rax, rax
je 0x1400d5d85
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400d5d85
mov r8, rsi
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14009ccc8
mov al, 1
jmp 0x1400d5daa
mov ecx, 0x1f7
call fcn.140096d58
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.1400dba04
lea rcx, [0x1401af488]
call fcn.14007029c
xor al, al
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.140105c50
mov rbx, qword [rsp + 0x2068]
add rsp, 0x2030
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d5dd0
Capabilities:
Capture screenshot

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov r12, rax
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r15, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rcx, r15
mov r14, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
lea r8, [rsp + 0x60]
mov edx, 0x20
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.GDI32.dll_GetObjectW]
mov r8d, dword [rsp + 0x68]
mov rcx, r15
mov edx, dword [rsp + 0x64]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdx, rbx
mov rcx, r14
mov rsi, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, rsi
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [rsp + 0x68]
mov rbx, rax
mov r9d, dword [rsp + 0x64]
mov ecx, r9d
mov dword [rsp + 0x50], 0xcc0020
neg ecx
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x40], ecx
mov rcx, rbp
and dword [rsp + 0x38], 0
lea r8d, [r9 - 1]
mov dword [rsp + 0x30], r8d
xor r8d, r8d
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], edx
xor edx, edx
call qword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [rsp + 0x68]
xor r8d, r8d
mov r9d, dword [rsp + 0x64]
xor edx, edx
mov dword [rsp + 0x40], 0xcc0020
mov rcx, r14
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_BitBlt]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r15
mov rcx, r12
call qword [sym.imp.USER32.dll_ReleaseDC]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret

Function at 0x1400d6238
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.1400d5a28
test al, al
jne 0x1400d629a
lea rdx, [rsp + 0x38]
mov byte [rsp + 0x38], 1
lea rcx, [0x1400d5640]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp byte [rsp + 0x38], 0
je 0x1400d629a
cmp ebx, 5
jne 0x1400d6293
mov rcx, qword [0x140172470]
test rcx, rcx
je 0x1400d629a
cmp qword [0x140172490], 0
jne 0x1400d629a
xor r9d, r9d
lea edx, [rbx + 0xb]
xor r8d, r8d
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400d629a
mov ecx, ebx
call fcn.14009d730
add rsp, 0x20
pop rbx
ret

Function at 0x1400d6b60
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
mov rax, rdx
mov rdx, rcx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x1400d6b7c
Capabilities:
Query environment variable

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x1050
call fcn.140105bf0
sub rsp, rax
mov rax, qword [0x14016a900]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
call fcn.140086e3c
test al, al
je 0x1400d6c1a
movzx r9d, word [rsi]
lea r8, str.___c:__
mov edx, 0xa
lea rcx, [rsp + 0x20]
call fcn.1400027fc
mov r8d, 0x800
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x7fe
ja 0x1400d6c04
cmp word [rsp + 0x40], 0x25
je 0x1400d6c04
mov r8, rdi
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14009ccc8
jmp 0x1400d6c1a
movzx r9d, word [rsi]
lea r8, str._c:_
mov rdx, rdi
mov rcx, rbx
call fcn.1400027fc
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140105c50
add rsp, 0x1050
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400d6d70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
lea r8, [0x14013d868]
mov rdx, rcx
mov rcx, qword [0x1401af2d0]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x1400d6efd
mov rdx, rax
mov rcx, qword [0x1401af2d0]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test eax, eax
je 0x1400d6efd
mov rdx, rbx
mov rcx, qword [0x1401af2d0]
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400d6efd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400d6efd
and qword [rsp + 0x68], 0
mov esi, edi
mov edx, edi
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x1400d6ef6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400d6eed
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call fcn.140106ff0
and qword [rsp + 0x58], 0
lea r8, [rsp + 0x58]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x1400d6ee4
mov rsi, qword [rsp + 0x58]
lea ecx, [rax + 0x18]
call sub.gdiplus.dll_GdipAlloc
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400d6e91
lea rax, str.pf_r_
mov qword [rbx], rax
lea rax, [0x140140388]
mov qword [rbx], rax
and qword [rsp + 0x60], 0
lea rdx, [rsp + 0x60]
mov rcx, rsi
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov dword [rbx + 0x10], eax
mov rax, qword [rsp + 0x60]
mov qword [rbx + 8], rax
jmp 0x1400d6e93
xor ebx, ebx
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140092c6b.0]
test rbx, rbx
je 0x1400d6ee4
mov eax, dword [rbx + 0x10]
and dword [rbx + 0x10], 0
test eax, eax
jne 0x1400d6ed0
mov r8d, 0xffffff
lea rdx, [rsp + 0x68]
mov rcx, qword [rbx + 8]
call sub.gdiplus.dll_GdipCreateHBITMAPFromBitmap
test eax, eax
je 0x1400d6ed0
mov dword [rbx + 0x10], eax
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x140092c6b.0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rax, qword [rsp + 0x68]
jmp 0x1400d6eff
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400d74c4
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x1400d74d8
Capabilities:
Set environment variable

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x14016a900]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
call fcn.140086e3c
test al, al
je 0x1400d7521
movzx r9d, word [rbx]
lea r8, [0x1401403b0]
mov edx, 0xa
lea rcx, [rsp + 0x20]
call fcn.1400027fc
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140105c50
add rsp, 0x40
pop rbx
ret

Function at 0x1400d7534
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x1400d7571
mov ecx, 0x627
call fcn.140096d58
mov rcx, rax
mov rdx, rdi
call fcn.1400dba04
lea rcx, [0x1401af488]
call fcn.14007029c
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d96f8
Capabilities:
Extract resource via kernel32 functions
Get graphical window text

Disassembly:
mov r9, qword [rcx + 0x18]
mov r8b, byte [rcx + 0x10]
mov rdx, qword [rcx + 8]
mov ecx, dword [rcx]
jmp fcn.1400d8f70

Function at 0x1400da3ec
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x440
mov rax, qword [0x14016a900]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov r14d, edx
mov rbp, rcx
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x30]
mov edi, 0x200
mov r8d, edi
call qword [sym.imp.USER32.dll_GetWindowTextW]
or rbx, 0xffffffffffffffff
cmp word [0x1401d5c40], 0
je 0x1400da498
mov r8d, edi
lea rdx, [0x140130728]
lea rcx, [rsp + 0x30]
call fcn.14009cca0
lea rax, [rsp + 0x30]
mov rsi, rbx
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1400da45a
mov ecx, 0x5aa
call fcn.140096d58
mov r9, rax
lea rcx, [rsp + 0x30]
lea rax, [0x1401d5c40]
mov rdx, rdi
sub rdx, rsi
mov qword [rsp + 0x20], rax
lea rcx, [rcx + rsi*2]
lea r8, str._s:__s
call fcn.1400027fc
cmp byte [0x1401d25ad], 0
je 0x1400da4e8
mov r8, rdi
lea rdx, [0x140130728]
lea rcx, [rsp + 0x30]
call fcn.14009cca0
lea rax, [rsp + 0x30]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400da4ba
mov ecx, 0x2fd
call fcn.140096d58
sub rdi, rbx
lea rcx, [rsp + 0x30]
lea rcx, [rcx + rbx*2]
mov r8, rax
mov r9d, r14d
mov rdx, rdi
call fcn.1400027fc
mov ebx, 0x80
lea rcx, [rsp + 0x30]
mov edx, ebx
call fcn.1400b6e74
lea rcx, [rbp + 0x28]
mov r8d, ebx
lea rdx, [rsp + 0x30]
call fcn.14009ccc8
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.140105c50
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x1400dacf8
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x1430
call fcn.140105bf0
sub rsp, rax
mov rax, qword [0x14016a900]
xor rax, rsp
mov qword [rsp + 0x1420], rax
mov rbx, rdx
mov edx, ecx
mov rcx, qword [0x140172488]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r8d, 0xa00
lea rdx, [rsp + 0x20]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r10, [rsp + 0x20]
mov rcx, rbx
sub r10, rbx
movzx r8d, word [rcx]
movzx r9d, word [rcx + r10]
sub r8d, r9d
jne 0x1400dad68
add rcx, 2
test r9d, r9d
jne 0x1400dad51
test r8d, r8d
je 0x1400dad79
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rsp + 0x1420]
xor rcx, rsp
call fcn.140105c50
mov rbx, qword [rsp + 0x1450]
add rsp, 0x1430
pop rdi
ret