joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140045e5a
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x438
mov rdi, rcx
mov rax, qword [0x1400ca0f0]
xor rax, rsp
mov qword [rsp + 0x430], rax
lea rcx, [rsp + 0x30]
mov edx, 1
mov r8d, 0x3ff
mov r9, rdi
call fcn.14008b8b4
mov rsi, rax
mov rcx, rdi
call fcn.14008c694
test esi, esi
js 0x1400460e6
mov edi, 1
cmp esi, 0x20
jl 0x140046112
movsxd rsi, esi
cmp rsi, 0x400
jb 0x140045ed6
lea rcx, str.i___0__i___sizeof_buf_
lea rdx, str..._sshpubk.c
mov r8d, 0x615
call fcn.140088ff4
mov byte [rsp + rsi + 0x30], 0
movdqa xmm0, xmmword [rsp + 0x30]
movdqa xmm1, xmmword [rsp + 0x40]
pcmpeqb xmm1, xmmword [str.FILE_FORMAT_1.1_nSSH_PRIVATE_KEY__SSH2_PUBLIC_KEY_____BEGIN_SSH2_NSSH_PRIVATE_KEY_____BEGIN_OPENSENCRYPTED_PRIVAT]
pcmpeqb xmm0, xmmword [0x1400a4080]
pand xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x1400460ea
movdqa xmm0, xmmword [rsp + 0x30]
movdqu xmm1, xmmword [rsp + 0x3a]
pcmpeqb xmm1, xmmword [0x1400a4090]
pcmpeqb xmm0, xmmword [0x1400a40a0]
pand xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x1400460f1
movdqa xmm0, xmmword [rsp + 0x30]
movd xmm1, dword [rsp + 0x40]
pcmpeqb xmm1, xmmword [str.ile_]
pcmpeqb xmm0, xmmword [str.PuTTY_User_Key_FUser_Key_File_1]
pand xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x1400460f8
movdqa xmm0, xmmword [rsp + 0x30]
movdqu xmm1, xmmword [rsp + 0x3e]
pcmpeqb xmm1, xmmword [0x1400a40b0]
pcmpeqb xmm0, xmmword [0x1400a40c0]
pand xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x1400460ff
movabs rax, 0x4745422d2d2d2d2d
xor rax, qword [rsp + 0x30]
movabs rcx, 0x204e494745422d2d
xor rcx, qword [rsp + 0x33]
or rcx, rax
je 0x140046106
movabs rax, 0x2032485353204e49
movabs rcx, 0x474542202d2d2d2d
movq xmm0, rcx
movq xmm1, rax
punpcklqdq xmm0, xmm1
movdqa xmm1, xmmword [rsp + 0x40]
pcmpeqb xmm0, xmmword [rsp + 0x30]
pcmpeqb xmm1, xmmword [0x1400a40d0]
pand xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
je 0x14004610d
lea rdx, str.0123456789
lea rsi, [rsp + 0x30]
mov rcx, rsi
call fcn.14008cf48
cmp byte [rsp + rax + 0x30], 0x20
jne 0x14004607b
lea rdi, [rsp + rax]
add rdi, 0x30
lea rcx, [rdi + 1]
lea rdx, str.0123456789
call fcn.14008cf48
cmp byte [rdi + rax + 1], 0x20
jne 0x14004607b
add rdi, rax
inc rdi
lea rcx, [rdi + 1]
lea rdx, str.0123456789
call fcn.14008cf48
movzx eax, byte [rdi + rax + 1]
cmp rax, 0x20
ja 0x14004607b
mov edi, 8
movabs rcx, 0x100000401
bt rcx, rax
jb 0x140046112
lea rdx, [0x1400bc9ad]
mov rcx, rsi
call fcn.14008c948
mov rdi, rax
lea rcx, [rsp + 0x20]
mov qword [rcx], rsi
mov qword [rcx + 8], rax
call fcn.140044920
test rax, rax
je 0x1400460df
lea rsi, [rsp + rdi]
add rsi, 0x30
lea rcx, [rsp + rdi]
add rcx, 0x31
lea rdx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_
call fcn.14008cf48
movzx eax, byte [rax + rsi + 1]
cmp rax, 0x20
ja 0x1400460df
mov edi, 0xa
movabs rcx, 0x100000401
bt rcx, rax
jb 0x140046112
mov edi, 1
jmp 0x140046112
xor edi, edi
jmp 0x140046112
mov edi, 2
jmp 0x140046112
mov edi, 9
jmp 0x140046112
mov edi, 3
jmp 0x140046112
mov edi, 6
jmp 0x140046112
mov edi, 5
jmp 0x140046112
mov edi, 7
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.14007d5e0
mov eax, edi
add rsp, 0x438
pop rdi
pop rsi
ret
Function at 0x140047825
Capabilities:
Encode data using xor

Disassembly:
mov rcx, qword [rcx + 8]
jmp fcn.14001511c

Function at 0x1400479f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebp, dword [rsp + 0xd0]
mov rax, qword [0x1400ca0f0]
xor rax, rsp
mov qword [rsp + 0x60], rax
test ebp, ebp
jle 0x140047ab3
mov rsi, r9
mov r14, rdx
mov rbx, rcx
movsxd r15, r8d
xor edi, edi
mov eax, dword [rbx + 0x20]
cmp ebp, eax
mov r12d, ebp
cmovg r12d, eax
cmp eax, 0x41
jl 0x140047a56
lea rcx, str.h__hlen___MAX_HASH_LEN
lea rdx, str..._sshrsa.c
mov r8d, 0x348
call fcn.140088ff4
mov rcx, rbx
call qword [rbx]
mov r13, rax
mov rcx, qword [rax + 8]
mov rdx, r14
mov r8, r15
call fcn.1400112e8
mov rcx, qword [r13 + 8]
mov edx, edi
call fcn.1400113f5
mov rax, qword [r13]
mov rcx, r13
lea rdx, [rsp + 0x20]
call qword [rax + 0x10]
test r12d, r12d
jle 0x140047aa2
mov eax, r12d
xor ecx, ecx
mov dl, byte [rsp + rcx + 0x20]
xor byte [rsi + rcx], dl
inc rcx
cmp rcx, rax
jb 0x140047a91
jmp 0x140047aa5
movsxd rax, r12d
inc edi
add rsi, rax
sub ebp, r12d
jg 0x140047a2c
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14007d5e0
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140049d23
Capabilities:
Hash data using sha1 via x86 extensions

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
movdqa xmm9, xmmword [rcx]
movdqa xmm8, xmmword [rcx + 0x10]
movdqa xmm6, xmmword [0x1400a1470]
movdqu xmm5, xmmword [rdx]
movdqu xmm4, xmmword [rdx + 0x10]
movdqu xmm3, xmmword [rdx + 0x20]
movdqu xmm2, xmmword [rdx + 0x30]
pshufb xmm5, xmm6
movdqa xmm7, xmm8
paddd xmm7, xmm5
movdqa xmm1, xmm9
sha1rnds4 xmm1, xmm7, 0
pshufb xmm4, xmm6
movdqa xmm7, xmm9
sha1nexte xmm7, xmm4
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm7, 0
sha1msg1 xmm5, xmm4
pshufb xmm3, xmm6
sha1nexte xmm1, xmm3
movaps xmm7, xmm0
sha1rnds4 xmm7, xmm1, 0
sha1msg1 xmm4, xmm3
pshufb xmm2, xmm6
sha1nexte xmm0, xmm2
pxor xmm5, xmm3
sha1msg2 xmm5, xmm2
movaps xmm1, xmm7
sha1rnds4 xmm1, xmm0, 0
sha1msg1 xmm3, xmm2
sha1nexte xmm7, xmm5
pxor xmm4, xmm2
sha1msg2 xmm4, xmm5
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm7, 0
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm1, xmm4
sha1msg2 xmm3, xmm4
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 1
sha1msg1 xmm5, xmm4
xorps xmm2, xmm4
sha1nexte xmm0, xmm3
sha1msg2 xmm2, xmm3
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 1
sha1msg1 xmm4, xmm3
xorps xmm5, xmm3
sha1nexte xmm6, xmm2
sha1msg2 xmm5, xmm2
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 1
sha1msg1 xmm3, xmm2
xorps xmm4, xmm2
sha1nexte xmm1, xmm5
sha1msg2 xmm4, xmm5
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 1
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm0, xmm4
sha1msg2 xmm3, xmm4
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 1
sha1msg1 xmm5, xmm4
xorps xmm2, xmm4
sha1nexte xmm6, xmm3
sha1msg2 xmm2, xmm3
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 2
sha1msg1 xmm4, xmm3
xorps xmm5, xmm3
sha1nexte xmm1, xmm2
sha1msg2 xmm5, xmm2
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 2
sha1msg1 xmm3, xmm2
xorps xmm4, xmm2
sha1nexte xmm0, xmm5
sha1msg2 xmm4, xmm5
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 2
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm6, xmm4
sha1msg2 xmm3, xmm4
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 2
sha1msg1 xmm5, xmm4
xorps xmm2, xmm4
sha1nexte xmm1, xmm3
sha1msg2 xmm2, xmm3
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 2
sha1msg1 xmm4, xmm3
xorps xmm5, xmm3
sha1nexte xmm0, xmm2
sha1msg2 xmm5, xmm2
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 3
sha1msg1 xmm3, xmm2
xorps xmm4, xmm2
sha1nexte xmm6, xmm5
sha1msg2 xmm4, xmm5
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 3
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm1, xmm4
sha1msg2 xmm3, xmm4
movaps xmm5, xmm0
sha1rnds4 xmm5, xmm1, 3
xorps xmm2, xmm4
sha1nexte xmm0, xmm3
sha1msg2 xmm2, xmm3
movaps xmm1, xmm5
sha1rnds4 xmm1, xmm0, 3
sha1nexte xmm5, xmm2
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm5, 3
paddd xmm0, xmm9
movdqa xmmword [rcx], xmm0
sha1nexte xmm1, xmm8
movaps xmmword [rcx + 0x10], xmm1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x14004edbb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov dword [rsp + 0x3c], r9d
mov r15d, r8d
mov r13, rdx
mov qword [rsp + 0x40], rcx
mov esi, dword [rsp + 0xb8]
mov r12d, dword [rsp + 0xb0]
mov ecx, 1
mov edx, 0x10
xor r8d, r8d
call fcn.140011830
mov rdi, rax
mov ebx, 0xffffffff
mov r14d, 0xffffffff
mov ecx, r12d
shl r14d, cl
mov eax, 1
mov ecx, esi
shl eax, cl
movsxd rbp, eax
mov edx, 0x10
mov rcx, rbp
xor r8d, r8d
call fcn.140011830
mov qword [rdi + 8], rax
lea edx, [rbp - 1]
mov dword [rdi], edx
test ebp, ebp
jle 0x14004ee8c
mov word [rax + 2], 0xffff
mov rax, qword [rdi + 8]
mov byte [rax], 0
mov rax, qword [rdi + 8]
mov qword [rax + 8], 0
mov edx, dword [rdi]
test edx, edx
jle 0x14004ee8c
xor eax, eax
xor ecx, ecx
inc rcx
mov rdx, qword [rdi + 8]
mov word [rdx + rax + 0x12], 0xffff
mov rdx, qword [rdi + 8]
mov byte [rdx + rax + 0x10], 0
mov rdx, qword [rdi + 8]
mov qword [rdx + rax + 0x18], 0
movsxd rdx, dword [rdi]
add rax, 0x10
cmp rcx, rdx
jl 0x14004ee5c
test r15d, r15d
jle 0x14004ef0a
xor r14d, ebx
mov r8d, r15d
xor ebp, ebp
movzx eax, byte [r13 + rbp]
cmp eax, r12d
jle 0x14004ef02
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + rbp*4]
mov ecx, eax
and ecx, r14d
cmp ecx, dword [rsp + 0x3c]
jne 0x14004ef02
mov ecx, r12d
sar eax, cl
and eax, edx
cmp eax, edx
jg 0x14004ef02
mov rcx, qword [rdi + 8]
movsxd rdx, eax
shl rdx, 4
mov word [rcx + rdx + 2], bp
movzx ecx, byte [r13 + rbp]
sub ecx, r12d
mov rsi, qword [rdi + 8]
movzx ebx, byte [rsi + rdx]
cmp ecx, ebx
jle 0x14004eef5
add rsi, rdx
mov byte [rsi], cl
movzx ecx, byte [r13 + rbp]
sub ecx, r12d
mov edx, 1
shl edx, cl
add eax, edx
mov edx, dword [rdi]
jmp 0x14004eebe
inc rbp
cmp rbp, r8
jne 0x14004ee99
test edx, edx
mov ebx, dword [rsp + 0xb8]
js 0x14004efa2
mov esi, r15d
lea r14d, [rbx + r12]
mov rbp, 0xffffffffffffffff
xor r15d, r15d
mov rax, qword [rdi + 8]
movzx ecx, byte [rax + r15]
cmp ecx, ebx
jle 0x14004ef93
mov word [rax + r15 + 2], 0xffff
mov rax, qword [rdi + 8]
movzx edx, byte [rax + r15]
sub edx, ebx
cmp edx, 8
mov ecx, 7
cmovge edx, ecx
mov byte [rax + r15], bl
lea r9d, [rbp + 1]
mov ecx, r12d
shl r9d, cl
or r9d, dword [rsp + 0x3c]
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r14d
mov rcx, qword [rsp + 0x40]
mov rdx, r13
mov r8d, esi
call fcn.14004edbb
mov ebx, dword [rsp + 0xb8]
mov rcx, qword [rdi + 8]
mov qword [rcx + r15 + 8], rax
mov edx, dword [rdi]
movsxd rax, edx
inc rbp
add r15, 0x10
cmp rbp, rax
jl 0x14004ef2a
mov rax, rdi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14005f8fc
Capabilities:
Encode data using base64

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x1400ca0f0]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor eax, eax
movsx r8d, byte [rcx + rax]
lea esi, [r8 - 0x41]
cmp sil, 0x19
ja 0x14005f927
add r8d, 0xffffffbf
jmp 0x14005f973
lea esi, [r8 - 0x61]
cmp sil, 0x19
ja 0x14005f937
add r8d, 0xffffffb9
jmp 0x14005f973
lea esi, [r8 - 0x30]
cmp sil, 9
ja 0x14005f947
add r8d, 4
jmp 0x14005f973
cmp r8b, 0x2b
je 0x14005f965
cmp r8b, 0x3d
je 0x14005f96d
cmp r8b, 0x2f
jne 0x14005fa15
mov r8d, 0x3f
jmp 0x14005f973
mov r8d, 0x3e
jmp 0x14005f973
mov r8d, 0xffffffff
mov dword [rsp + rax*4 + 0x20], r8d
inc rax
cmp rax, 4
jne 0x14005f912
mov eax, dword [rsp + 0x20]
xor esi, esi
cmp eax, 0xffffffff
je 0x14005fa17
mov ecx, dword [rsp + 0x24]
cmp ecx, 0xffffffff
je 0x14005fa17
mov r8d, dword [rsp + 0x28]
mov r9d, dword [rsp + 0x2c]
cmp r8d, 0xffffffff
je 0x14005f9bd
mov r10d, 3
cmp r9d, 0xffffffff
jne 0x14005f9cf
mov r10d, 2
jmp 0x14005f9c9
cmp r9d, 0xffffffff
jne 0x14005fa17
mov r10d, 1
mov r9d, 0xffffffff
shl eax, 0x12
shl ecx, 0xc
or eax, ecx
shr eax, 0x10
mov byte [rdx], al
mov esi, 1
cmp r10d, 2
jb 0x14005fa17
shl r8d, 6
mov eax, r8d
and eax, 0xf00
or eax, ecx
mov byte [rdx + 1], ah
mov esi, 2
cmp r10d, 3
jne 0x14005fa17
and r9d, 0x3f
or r9d, r8d
mov byte [rdx + 2], r9b
mov esi, 3
jmp 0x14005fa17
xor esi, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14007d5e0
mov eax, esi
add rsp, 0x40
pop rsi
ret

Function at 0x14005fd69
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14005fd9b
xor r10d, r10d
xor r9d, r9d
mov al, byte [rdx + r10]
xor al, byte [rcx + r10]
movzx eax, al
or r9d, eax
inc r10
cmp r8, r10
jne 0x14005fd74
mov eax, 0x100
sub eax, r9d
cmp eax, 0xff
seta al
ret
mov al, 1
ret

Function at 0x140065994
Capabilities:
Hide graphical window

Disassembly:
push rsi
sub rsp, 0x30
mov rcx, qword [0x1400cd030]
mov qword [rsp + 0x20], 0
lea r9, [fcn.14000ecbb]
mov edx, 0x6f
xor r8d, r8d
call qword [sym.imp.USER32.dll_CreateDialogParamA]
mov rsi, rax
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetActiveWindow]
mov rcx, rsi
add rsp, 0x30
pop rsi
jmp qword [sym.imp.USER32.dll_DestroyWindow]
Function at 0x140071ce8
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov r14d, r9d
mov rbx, r8
mov rdi, rdx
mov rbp, rcx
mov rax, qword [0x1400ca0f0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 1
mov edx, 0x1048
xor r8d, r8d
call fcn.140011830
mov rsi, rax
mov dword [rax], 0
mov qword [rax + 8], rbp
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rbp
mov qword [rsi + 0x10], rax
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rbp
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x1040], rdi
mov byte [rsi + 0x22], 0
mov word [rsi + 0x20], 0
mov qword [rsi + 0x28], rbx
mov dword [rsi + 0x30], r14d
lea rdi, [rsi + 8]
mov rcx, qword [0x1400cdd68]
test rcx, rcx
jne 0x140071d92
lea rcx, [0x140071ddf]
call fcn.14005dc0c
mov rcx, rax
mov qword [0x1400cdd68], rax
mov rdx, rsi
call fcn.14005dcd4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x140071df5]
xor ecx, ecx
xor edx, edx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [rsi + 0x23], 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14007d5e0
mov rax, rsi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140071f7e
Capabilities:
Create thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r14d, r9d
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
mov rax, qword [0x1400ca0f0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r15d, r15d
mov ecx, 1
mov edx, 0x1048
xor r8d, r8d
call fcn.140011830
mov rsi, rax
mov dword [rax], 1
mov qword [rax + 8], rbp
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rbp
mov qword [rsi + 0x10], rax
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rbp
mov qword [rsi + 0x18], rax
mov dword [rsi + 0x20], r15d
mov qword [rsi + 0x28], rdi
lea rcx, [rsi + 0x50]
call fcn.14005fa2c
mov dword [rsi + 0x78], r15d
mov qword [rsi + 0x80], rbx
mov dword [rsi + 0x30], r14d
lea rdi, [rsi + 8]
mov rcx, qword [0x1400cdd68]
test rcx, rcx
jne 0x140072034
lea rcx, [0x140071ddf]
call fcn.14005dc0c
mov rcx, rax
mov qword [0x1400cdd68], rax
mov rdx, rsi
call fcn.14005dcd4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x14007207f]
xor ecx, ecx
xor edx, edx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14007d5e0
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400727be
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp byte [0x1400cdd80], 0
je 0x1400727d4
add rsp, 0x28
pop rdi
pop rsi
ret
mov byte [0x1400cdd80], 1
lea rcx, str.hhctrl.ocx
call fcn.140073bf6
mov rsi, rax
test rax, rax
je 0x140072863
lea rdx, str.HtmlHelpA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400cdd88], rax
test rax, rax
je 0x14007286e
cmp byte [0x1400cdda9], 0
jne 0x14007287e
mov byte [0x1400cdda9], 1
call fcn.140072778
test eax, eax
je 0x14007287e
mov rdx, qword [0x1400cdd78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x1400cddac], eax
test eax, eax
je 0x14007287e
mov rdx, qword [0x1400cdd78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14007287e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x1400cdda0], rax
jmp 0x140072885
mov qword [0x1400cdd88], 0
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x1400cdda0]
test rax, rax
jne 0x1400727cd
xor esi, esi
lea rdi, str.n__v_
mov rdx, qword [rdi + rsi*8]
mov rcx, 0xffffffff80000002
xor r8d, r8d
call fcn.1400741fa
test rax, rax
jne 0x1400728be
test rsi, rsi
mov esi, 1
je 0x140072897
jmp 0x1400727cd
mov qword [0x1400cdd90], rax
mov byte [0x1400cdd98], 0
jmp 0x1400727cd

Function at 0x1400728d1
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1400cdd90]
test rcx, rcx
je 0x140072913
cmp byte [0x1400cdd98], 1
jne 0x140072915
xor ecx, ecx
xor edx, edx
mov r8d, 0x12
xor r9d, r9d
call qword [0x1400cdd88]
mov rcx, qword [0x1400cdd90]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [0x1400cdd90]
jmp 0x140072915
xor ecx, ecx
call fcn.1400118b0
mov qword [0x1400cdd90], 0
mov byte [0x1400cdd98], 0
add rsp, 0x28
ret
Function at 0x140076ba4
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2a8
mov r14, rcx
mov rax, qword [0x1400ca0f0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov edx, 0x107
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov rcx, rdi
call fcn.14008cbc0
mov word [rsp + rax + 0x50], 0x2a5c
mov byte [rsp + rax + 0x52], 0
lea rdx, [rsp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x140076c35
mov rdi, rax
lea rbx, [rsp + 0x160]
mov rsi, qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov rcx, rbx
mov edx, 0x140
call r14
mov rcx, rdi
mov rdx, rbx
call rsi
test eax, eax
jne 0x140076c15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x2c]
mov dword [rcx], eax
mov edx, 4
call r14
lea rcx, [rsp + 0x30]
mov edx, 0x20
call fcn.140076a60
test al, al
je 0x140076c7a
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov edx, 0x20
call r14
mov edx, 0x20
mov rcx, rdi
call fcn.140074310
mov rcx, r14
call fcn.140079cdb
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14007d5e0
nop
add rsp, 0x2a8
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140076ca0
Capabilities:
Get memory capacity

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rax, qword [0x1400ca0f0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rsi, [rsp + 0x78]
mov qword [rsi], rax
mov ecx, 9
mov rdx, rsi
mov r8d, 8
call fcn.140046534
call qword [sym.imp.USER32.dll_GetCapture]
mov qword [rsi], rax
mov ecx, 0xa
mov rdx, rsi
mov r8d, 8
call fcn.140046534
call qword [sym.imp.USER32.dll_GetClipboardOwner]
mov qword [rsi], rax
mov ecx, 0xb
mov rdx, rsi
mov r8d, 8
call fcn.140046534
mov ecx, 0x1cbf
call qword [sym.imp.USER32.dll_GetQueueStatus]
lea rdx, [rsp + 0x74]
mov dword [rdx], eax
mov ecx, 0xc
mov r8d, 4
call fcn.140046534
lea rsi, [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0xd
mov rdx, rsi
mov r8d, 8
call fcn.140046534
lea rsi, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, 6
mov rdx, rsi
mov r8d, 0x38
call fcn.140046534
lea rsi, [rsp + 0x98]
lea r14, [rsp + 0x90]
lea rdi, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x20], rsi
lea rbx, [rsp + 0x80]
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov ecx, 0xe
mov rdx, rbx
mov r8d, 0x20
call fcn.140046534
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], rsi
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov ecx, 0xf
mov rdx, rbx
mov r8d, 0x20
call fcn.140046534
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14007d5e0
nop
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140077e40
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x1400cee20], 1
jne 0x140077e58
mov al, byte [0x1400cee21]
jmp 0x140077fd2
mov byte [0x1400cee20], 1
lea rcx, str.advapi32.dll
call fcn.140073bf6
mov qword [0x1400cee28], rax
test rax, rax
je 0x140077fca
lea rdx, str.GetSecurityInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400cee48], rax
test rax, rax
je 0x140077fca
mov rcx, qword [0x1400cee28]
test rcx, rcx
je 0x140077f8b
lea rdx, str.SetSecurityInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400cee50], rax
test rax, rax
je 0x140077fca
mov rcx, qword [0x1400cee28]
test rcx, rcx
je 0x140077f98
lea rdx, str.OpenProcessToken
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400cee58], rax
test rax, rax
je 0x140077fca
mov rcx, qword [0x1400cee28]
test rcx, rcx
je 0x140077fa5
lea rdx, str.GetTokenInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400cee60], rax
test rax, rax
je 0x140077fca
mov rcx, qword [0x1400cee28]
test rcx, rcx
je 0x140077fb2
lea rdx, [0x1400b1abb]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400cee68], rax
test rax, rax
je 0x140077fca
mov rcx, qword [0x1400cee28]
test rcx, rcx
je 0x140077fbf
lea rdx, [0x1400b1e16]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400cee70], rax
test rax, rax
je 0x140077fca
mov rcx, qword [0x1400cee28]
test rcx, rcx
je 0x140077fd7
lea rdx, str.SetEntriesInAclA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x140077fd9
mov qword [0x1400cee50], 0
jmp 0x140077fca
mov qword [0x1400cee58], 0
jmp 0x140077fca
mov qword [0x1400cee60], 0
jmp 0x140077fca
mov qword [0x1400cee68], 0
jmp 0x140077fca
mov qword [0x1400cee70], 0
xor eax, eax
mov byte [0x1400cee21], al
add rsp, 0x28
ret
xor eax, eax
mov qword [0x1400cee78], rax
test rax, rax
setne al
jmp 0x140077fcc