joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002070
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rdi
push r12
sub rsp, 0x280
mov rax, qword [0x180011020]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbp, rcx
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
mov dword [rsp + 0x30], 0x238
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov r12, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x1800021af
lea rdx, [rsp + 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x1800021af
mov qword [rsp + 0x2a8], rbx
mov qword [rsp + 0x2b0], rsi
test rbp, rbp
je 0x180002150
or r9d, 0xffffffff
mov r8, rbp
mov ecx, 0xfde9
lea edx, [r9 + 9]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rsi, eax
test eax, eax
jle 0x180002150
mov rcx, rsi
mov edx, 2
call fcn.1800035dc
mov rbx, rax
test rax, rax
je 0x180002150
or r9d, 0xffffffff
mov r8, rbp
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x180002153
mov rcx, rbx
call fcn.18000359c
mov rbx, rdi
lea rax, [rsp + 0x5c]
mov rcx, rbx
sub rcx, rax
nop
movzx r8d, word [rax]
movzx edx, word [rax + rcx]
sub r8d, edx
jne 0x180002175
add rax, 2
test edx, edx
jne 0x180002160
test r8d, r8d
je 0x18000219b
mov rcx, rbx
call fcn.18000359c
lea rdx, [rsp + 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x1800020e7
jmp 0x18000219f
mov edi, dword [rsp + 0x38]
mov rbx, qword [rsp + 0x2a8]
mov rsi, qword [rsp + 0x2b0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180002f90
add rsp, 0x280
pop r12
pop rdi
pop rbp
ret
Function at 0x180003a2f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180011020]
jne 0x180002faa
rol rcx, 0x10
test cx, 0xffff
jne 0x180002fa6
repz ret
ror rcx, 0x10
jmp 0x180003988
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180012180]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x180012278]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180003a0d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180012180]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180003a2f
mov rax, qword [rsp + 0x88]
mov qword [0x180012278], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180012218], rax
mov rax, qword [0x180012278]
mov qword [0x1800120f0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180012200], rax
mov dword [0x1800120e0], 0xc0000409
mov dword [0x1800120e4], 1
mov rax, qword [0x180011020]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180011028]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180012178], eax
mov ecx, 1
call fcn.1800059b0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18000c370]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180012178], 0
jne 0x180003ab6
mov ecx, 1
call fcn.1800059b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x180006fa8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x180011020]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.180003ad4
xor ebx, ebx
cmp qword [0x180013118], rbx
mov rdi, rax
jne 0x1800070bb
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x180007192
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180007192
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180013118], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180013120], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x180013128], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x180013138], rax
test rax, rax
je 0x1800070b2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x180013130], rax
jmp 0x1800070c2
mov rax, qword [0x180013130]
jmp 0x1800070c9
mov rax, qword [0x180013130]
mov r11, qword [0x180013138]
cmp rax, rdi
je 0x180007130
cmp r11, rdi
je 0x180007130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x180013138]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x180007130
test rax, rax
je 0x180007130
call rsi
test rax, rax
je 0x18000712a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18000712a
test byte [rsp + 0x40], 1
jne 0x180007130
bts ebp, 0x15
jmp 0x180007170
mov rcx, qword [0x180013120]
cmp rcx, rdi
je 0x180007170
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180007170
call rax
mov rbx, rax
test rax, rax
je 0x180007170
mov rcx, qword [0x180013128]
cmp rcx, rdi
je 0x180007170
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180007170
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180013118]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180007192
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x180007194
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180002f90
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180008630
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbp
push rsi
push r12
push r13
lea rbp, [r11 - 0x4f]
sub rsp, 0xa8
mov rax, qword [0x180011020]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r13, r8
mov rsi, rdx
mov r12, rcx
test r8, r8
je 0x180008870
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
mov qword [rbp - 0x49], rax
mov rax, qword [rcx + 8]
mov qword [rbp - 0x41], rax
mov rax, qword [rcx + 0x10]
mov qword [rbp - 0x39], rax
mov rax, qword [rcx + 0x18]
mov qword [rbp - 0x31], rax
mov rax, qword [r9]
mov qword [rbp - 0x59], rax
mov rax, qword [rbp + 0x77]
mov byte [rbp - 0x51], al
shr rax, 8
mov byte [rbp - 0x50], al
shr rax, 8
mov byte [rbp - 0x4f], al
shr rax, 8
mov byte [rbp - 0x4e], al
shr rax, 8
mov byte [rbp - 0x4d], al
shr rax, 8
mov byte [rbp - 0x4c], al
shr rax, 8
mov byte [rbp - 0x4b], al
shr rax, 8
mov byte [rbp - 0x4a], al
cmp r8, 0x40
jb 0x180008805
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rdi
lea rax, [rbp - 0x29]
mov rbx, r12
mov qword [r11 - 0x28], r14
mov r14, r8
sub rbx, rax
shr r14, 6
lea rax, [rbp - 0x29]
mov rdi, rdx
add rbx, 2
sub rdi, rax
mov rax, r14
add rdi, 2
imul rax, rax, 0xffffffffffffffc0
add r13, rax
mov rax, r14
shl rax, 6
add rsi, rax
add r12, rax
nop word [rax + rax]
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x29]
xor r9d, r9d
call fcn.180009550
lea r11, [rbp - 0x29]
mov ecx, 0x10
nop dword [rax]
movzx eax, byte [r11 + rdi - 2]
add r11, 4
xor al, byte [r11 - 4]
mov byte [r11 + rbx - 6], al
movzx eax, byte [r11 + rdi - 5]
xor al, byte [r11 - 3]
mov byte [r11 + rbx - 5], al
movzx eax, byte [r11 + rdi - 4]
xor al, byte [r11 - 2]
mov byte [r11 + rbx - 4], al
movzx eax, byte [r11 + rdi - 3]
xor al, byte [r11 - 1]
dec rcx
mov byte [r11 + rbx - 3], al
jne 0x180008740
movzx eax, byte [rbp - 0x50]
movzx ecx, byte [rbp - 0x51]
add rbx, 0x40
inc ecx
add rdi, 0x40
mov byte [rbp - 0x51], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x4f]
mov byte [rbp - 0x50], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x4e]
mov byte [rbp - 0x4f], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x4d]
mov byte [rbp - 0x4e], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x4c]
mov byte [rbp - 0x4d], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x4b]
mov byte [rbp - 0x4c], cl
shr ecx, 8
add ecx, eax
mov byte [rbp - 0x4b], cl
shr ecx, 8
add byte [rbp - 0x4a], cl
dec r14
jne 0x180008720
mov r14, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xd8]
test r13, r13
je 0x180008854
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x29]
xor r9d, r9d
call fcn.180009550
test r13d, r13d
je 0x180008854
lea rax, [rbp - 0x29]
lea rcx, [rbp - 0x29]
mov edx, r13d
sub rsi, rax
lea rax, [rbp - 0x29]
sub r12, rax
nop dword [rax + rax]
movzx eax, byte [rsi + rcx]
inc rcx
xor al, byte [rcx - 1]
dec rdx
mov byte [r12 + rcx - 1], al
jne 0x180008840
lea rcx, [rbp - 0x29]
mov edx, 0x40
call fcn.180008890
lea rcx, [rbp - 0x49]
mov edx, 0x20
call fcn.180008890
xor eax, eax
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.180002f90
add rsp, 0xa8
pop r13
pop r12
pop rsi
pop rbp
ret
Function at 0x1800099b0
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9, rcx
lea r8, [rdx + 3]
lea r11d, [r10 + 4]
sub r9, rdx
movzx eax, byte [r8 - 3]
movzx edx, byte [r9 + r8 - 3]
movzx ecx, byte [r9 + r8 - 2]
xor edx, eax
movzx eax, byte [r8 - 2]
add r8, 4
xor ecx, eax
movzx eax, byte [r8 - 5]
or edx, ecx
movzx ecx, byte [r9 + r8 - 5]
xor ecx, eax
movzx eax, byte [r8 - 4]
or edx, ecx
movzx ecx, byte [r9 + r8 - 4]
xor ecx, eax
or edx, ecx
or r10d, edx
dec r11
jne 0x1800099c1
lea eax, [r10 - 1]
shr eax, 8
and eax, 1
dec eax
ret

Function at 0x180009a80
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.180009a40
mov edx, 0xffffffff
cmp rbx, rdx
jbe 0x180009aa4
call fcn.1800080e0
mov edx, ebx
mov rcx, rdi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x180009ab7
call fcn.1800080e0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400014e0
Capabilities:
Accept command line arguments

Disassembly:
jmp 0x140001510
mov dword [rsp + 0x10], edx
sub rsp, 0x58
cmp byte [0x140019908], 0
je 0x140001529
or eax, 0xffffffff
add rsp, 0x58
ret
xor ecx, ecx
mov qword [rsp + 0x50], rbx
call qword [sym.imp.ole32.dll_CoInitialize]
mov dword [rsp + 0x68], eax
mov ebx, eax
test eax, eax
jns 0x140001569
cmp eax, 0x80010106
jne 0x140001604
lea rcx, str.Mscoree.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140001570
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret
mov byte [0x140019c42], 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
lea r8, [rsp + 0x68]
call fcn.1400018b0
cmp al, 1
jne 0x1400015f1
call fcn.140001b90
mov ebx, eax
test eax, eax
jne 0x1400015e6
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x1400015e8
nop dword [rax]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jg 0x1400015b0
call fcn.140001b10
mov ebx, eax
jmp 0x1400015f5
js 0x1400015f5
call fcn.140001b10
mov ebx, eax
jmp 0x1400015f5
mov ebx, dword [rsp + 0x68]
cmp byte [0x140019c42], 0
je 0x140001604
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret

Function at 0x140001510
Capabilities:
Accept command line arguments

Disassembly:
jmp 0x140001510
mov dword [rsp + 0x10], edx
sub rsp, 0x58
cmp byte [0x140019908], 0
je 0x140001529
or eax, 0xffffffff
add rsp, 0x58
ret
xor ecx, ecx
mov qword [rsp + 0x50], rbx
call qword [sym.imp.ole32.dll_CoInitialize]
mov dword [rsp + 0x68], eax
mov ebx, eax
test eax, eax
jns 0x140001569
cmp eax, 0x80010106
jne 0x140001604
lea rcx, str.Mscoree.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140001570
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret
mov byte [0x140019c42], 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
lea r8, [rsp + 0x68]
call fcn.1400018b0
cmp al, 1
jne 0x1400015f1
call fcn.140001b90
mov ebx, eax
test eax, eax
jne 0x1400015e6
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x1400015e8
nop dword [rax]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jg 0x1400015b0
call fcn.140001b10
mov ebx, eax
jmp 0x1400015f5
js 0x1400015f5
call fcn.140001b10
mov ebx, eax
jmp 0x1400015f5
mov ebx, dword [rsp + 0x68]
cmp byte [0x140019c42], 0
je 0x140001604
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret
Function at 0x140001ce0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140019c30], rax
test rax, rax
jne 0x140001d0a
add rsp, 0x38
ret
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea r9, [0x140019be0]
lea r8, [0x140001e80]
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x140001d55
mov rcx, qword [0x140019c30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140019c30], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret

Function at 0x140002360
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140002393
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400023da
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400023d5
nop
cmp rbx, rcx
jae 0x1400023da
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1400023c0
cmp rbx, rcx
jb 0x1400023de
xor eax, eax
jmp 0x1400023ea
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140007860
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
xor ebx, ebx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x40], rbx
cmp dword [0x14001994c], ebx
jne 0x140007907
mov eax, dword [0x140019950]
test eax, eax
jne 0x140007907
mov ecx, dword [0x140019944]
test ecx, ecx
je 0x1400078b5
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140019950]
mov ecx, dword [0x140019944]
test eax, eax
jne 0x140007907
test ecx, ecx
jne 0x1400078c6
call fcn.140007690
test eax, eax
je 0x1400078dc
lea rdx, [rsp + 0x40]
mov rcx, qword [0x1400180f8]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x140007907
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x1400078fd
cmp eax, 0x78
je 0x1400078fd
cmp eax, 1
je 0x1400078fd
cmp eax, 0x32
je 0x1400078fd
xor eax, eax
jmp 0x14000795f
mov dword [0x140019950], 1
lea rcx, str.crlutl.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
mov qword [rsp + 0x20], rax
cmp dword [0x14001994c], 0
je 0x14000792e
cmp dword [0x140019950], 0
jne 0x14000795c
mov esi, ebx
test rdi, rdi
sete sil
test esi, esi
je 0x140007943
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test esi, esi
je 0x14000795c
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140007be0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x20], 0
mov rbx, rcx
jne 0x140007ca6
add rcx, 0x38
call fcn.140007cb0
cmp qword [rbx + 0x68], 0
jne 0x140007c40
mov rax, qword [rbx + 0x48]
cmp dword [rax - 0x10], 0
jne 0x140007c12
xor eax, eax
jmp 0x140007c37
mov rcx, qword [rbx + 8]
lea rdx, str.GetUILang
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007c37
call rax
mov rdx, qword [rbx + 0x48]
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x78]
mov qword [rbx + 0x68], rax
test rax, rax
je 0x140007ca6
lea rcx, [rbx + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::DrawButton]
movzx eax, byte [rbx + 0xb0]
xor r9d, r9d
xor r8d, r8d
mov byte [rbx + 0x10], al
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x28], rax
mov r9, rbx
lea r8, [0x140007d90]
xor edx, edx
lea rax, [rbx + 0x30]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbx + 0x28]
or edx, 0xffffffff
mov qword [rbx + 0x20], rax
add rsp, 0x30
pop rbx
jmp qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret
mov ebp, 0x1ebdccd9
jo case.0x14000315b.4
shr ah, 1
sbb ebp, dword [rdx + 0x34]
mov dword [rbx - 0x4d4010ea], 0x43b10d0e
invalid
out dx, eax
mov edi, 0xb10d0eb2
movsb byte [rdi], byte [rsi]
invalid
Function at 0x140009f90
Capabilities:
Get file size
Print debug messages
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x60
mov rax, qword [0x140018008]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov edx, 0x80000000
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x40], ebp
lea r8d, [rbp + 1]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000a108
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
lea r8d, [rbp + 0xe]
mov rcx, rax
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000a014
lea rcx, str.Error_reading_welcome_bitmap_file__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x14000a090
mov eax, dword [rsp + 0x4a]
test eax, eax
jne 0x14000a02b
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x4a], eax
cmp dword [rsp + 0x40], 0xe
jne 0x14000a0f7
mov ecx, 0x4d42
cmp word [rsp + 0x48], cx
jne 0x14000a0f7
mov qword [rsp + 0x78], rsi
mov edx, 1
lea esi, [rax - 0xe]
mov qword [rsp + 0x80], rdi
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdi, rax
test rax, rax
jne 0x14000a0ab
lea rcx, str.Out_of_memory_loading_welcome_bitmap_file__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000b2d0
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rbp
ret
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000a0e9
lea rcx, str.Error_reading_welcome_bitmap_file__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000a081
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
jmp 0x14000a083
lea rcx, str.Invalid_welcome_bitmap_file_format__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x14000a090
lea rcx, str.Welcome_bitmap_file_does_not_exist__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x14000a090
Function at 0x14000a190
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x40
mov rdi, r8
mov rsi, rcx
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x68], rbx
cmp dword [0x14001994c], ebx
jne 0x14000a23d
mov eax, dword [0x140019950]
test eax, eax
jne 0x14000a23d
mov edx, dword [0x140019944]
test edx, edx
je 0x14000a1eb
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140019950]
mov edx, dword [0x140019944]
test eax, eax
jne 0x14000a23d
test edx, edx
jne 0x14000a1fc
call fcn.140007690
test eax, eax
je 0x14000a212
lea rdx, [rsp + 0x68]
mov rcx, qword [0x1400180f8]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x14000a23d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x14000a233
cmp eax, 0x78
je 0x14000a233
cmp eax, 1
je 0x14000a233
cmp eax, 0x32
je 0x14000a233
xor eax, eax
jmp 0x14000a2a5
mov dword [0x140019950], 1
mov qword [rsp + 0x20], rbx
lea r9, [0x140008540]
mov r8, rdi
mov edx, 0x6d47
mov rcx, rsi
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov rsi, rax
mov qword [rsp + 0x30], rax
cmp dword [0x14001994c], 0
je 0x14000a274
cmp dword [0x140019950], 0
jne 0x14000a2a2
mov edi, ebx
test rsi, rsi
sete dil
test edi, edi
je 0x14000a289
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x14000a2a2
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140037e00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movzx eax, byte [rcx]
xor r9d, r9d
mov r10, rcx
test al, al
je 0x140037e45
nop dword [rax]
movzx r8d, al
lea r10, [r10 + 1]
sub al, 0x41
cmp al, 0x19
lea edx, [r8 + 0x20]
movzx ecx, dl
cmova ecx, r8d
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, byte [r10]
test al, al
jne 0x140037e10
lea eax, [r9 + r9*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
ret
Function at 0x140038c00
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
lea rdx, [rcx + 0x68]
mov qword [rcx + 8], rax
lea rax, [rcx + 0x10]
mov byte [rax + 0x41], 1
mov qword [rax + 0x50], rax
mov qword [rax + 0x48], reloc.WS2_32.dll_recv
mov rax, rdx
neg rax
mov byte [rdx + 0x49], 1
and eax, 0xf
mov qword [rdx + 0x50], reloc.WS2_32.dll_recv
add rax, rdx
mov qword [rdx + 0x58], rax
vmovups ymm0, ymmword [0x140137800]
mov rax, qword [rcx + 0xc0]
vmovups ymmword [rax], ymm0
lea rax, vtable.CryptoPP::SHA256.0
mov qword [rcx], rax
mov rax, rcx
vzeroupper
ret

Function at 0x14003a7a0
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0xc0
call fcn.1400bdd10
xor edx, edx
mov qword [rsp + 0x38], rax
mov r8d, 0xc0
mov rcx, rax
mov rbx, rax
call fcn.1400c0f70
xor eax, eax
lea rcx, [rbx + 0x10]
mov qword [rbx + 8], rax
lea rax, [rbx + 0x68]
mov byte [rcx + 0x41], 1
mov qword [rcx + 0x50], rcx
mov qword [rcx + 0x48], reloc.WS2_32.dll_recv
mov byte [rax + 0x41], 0
mov byte [rax + 0x41], 1
mov qword [rax + 0x50], rax
mov qword [rax + 0x48], reloc.WS2_32.dll_recv
mov rax, qword [rbx + 0xb8]
mov dword [rax], 0x67452301
mov dword [rax + 4], 0xefcdab89
mov dword [rax + 8], 0x98badcfe
mov dword [rax + 0xc], 0x10325476
mov dword [rax + 0x10], 0xc3d2e1f0
lea rax, vtable.CryptoPP::SHA1.0
mov qword [rbx], rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret