joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013b990
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x400], 0
mov edi, r8d
mov esi, edx
mov rbx, rcx
je 0x14013b9c9
mov rcx, qword [rcx + 0x3d8]
mov edx, 1
call qword [sym.imp.USER32.dll_KillTimer]
mov byte [rbx + 0x400], 0
xor r9d, r9d
mov r8d, edi
mov edx, esi
mov rcx, rbx
call fcn.140138910
cmp eax, 0xffffffff
je 0x14013ba20
mov ecx, setsockopt
call fcn.1400da2e0
mov rcx, rbx
test eax, eax
je 0x14013ba08
mov edx, 0xa031
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.140108830
movsx eax, byte [0x14020ddf5]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
call fcn.140103b50
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14013bdb0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, rdx
movsx esi, dx
mov rbx, rcx
shr rax, 0x10
mov edx, esi
movsx edi, ax
mov r8d, edi
call fcn.140139070
test eax, eax
jne 0x14013bec2
movsx ecx, byte [0x14020ddd3]
sub ecx, 1
je 0x14013bec2
cmp ecx, 1
je 0x14013be49
cmp dword [rbx + 0x46c], 0xffffffff
jne 0x14013be40
mov dword [rbx + 0x46c], eax
mov rax, qword [0x14020e348]
test rax, rax
je 0x14013be2e
lea rcx, [rsp + 0x48]
mov edx, 0x80
call rax
test byte [rsp + 0x48], 0x20
jne 0x14013be2e
mov dword [rbx + 0x46c], 1
mov edx, dword [rbx + 0x46c]
lea rcx, str.cached_oneclickactivate__d_n
call fcn.1400b3fe0
cmp dword [rbx + 0x46c], 0
jne 0x14013bec2
cmp byte [rbx + 0x400], 0
je 0x14013be6b
mov rcx, qword [rbx + 0x3d8]
mov edx, 1
call qword [sym.imp.USER32.dll_KillTimer]
mov byte [rbx + 0x400], 0
xor r9d, r9d
mov r8d, edi
mov edx, esi
mov rcx, rbx
call fcn.140138910
cmp eax, 0xffffffff
je 0x14013bec2
mov ecx, setsockopt
call fcn.1400da2e0
mov rcx, rbx
test eax, eax
je 0x14013beaa
mov edx, 0xa031
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.140108830
movsx eax, byte [0x14020ddf5]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
call fcn.140103b50
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14013c650
Capabilities:
Change the wallpaper

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
movsxd rbx, edx
mov rdi, rcx
call fcn.14015f6c0
test eax, eax
je 0x14013c686
xor r9d, r9d
mov r8, rbx
mov rcx, rdi
lea edx, [r9 + 5]
call fcn.1400f9470
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
imul ebx, ebx, 0xfffffffb
mov eax, 0x88888889
add dword [rdi + 0x428], ebx
mov ecx, dword [rdi + 0x428]
imul ecx
lea ebx, [rcx + rdx]
sar ebx, 6
mov eax, ebx
shr eax, 0x1f
add ebx, eax
je 0x14013c7d8
mov eax, ebx
xor edx, edx
lea r8, [rsp + 0x80]
xor r9d, r9d
imul eax, eax, 0x78
sub ecx, eax
mov dword [rdi + 0x428], ecx
lea ecx, [rdx + 0x68]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov r11d, dword [rsp + 0x80]
mov rcx, qword [rdi + 0x3d8]
cmp r11d, 1
mov eax, 3
cmovb r11d, eax
mov dword [rsp + 0x80], r11d
call fcn.1400d8860
bt eax, 0x14
jae 0x14013c7d8
mov rcx, qword [rdi + 0x3d8]
xor eax, eax
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], rax
xor edx, edx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x20], 0x1c
mov dword [rsp + 0x24], 2
call qword [sym.imp.USER32.dll_GetScrollInfo]
mov esi, dword [rsp + 0x80]
mov eax, dword [rsp + 0x30]
cmp esi, eax
cmova esi, eax
cmp byte [rdi + 0x230], 0
mov dword [rsp + 0x80], esi
je 0x14013c765
neg ebx
mov rcx, qword [rdi + 0x3d8]
imul esi, ebx
call fcn.1400d8860
bt eax, 0x14
jae 0x14013c7bd
mov rcx, qword [rdi + 0x3d8]
xor eax, eax
lea r8, [rsp + 0x40]
mov qword [rsp + 0x40], rax
xor edx, edx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x40], 0x1c
mov dword [rsp + 0x44], 4
call qword [sym.imp.USER32.dll_GetScrollInfo]
test eax, eax
je 0x14013c7bd
mov eax, dword [rsp + 0x54]
jmp 0x14013c7bf
xor eax, eax
mov r9d, 1
lea edx, [rax + rsi]
mov rcx, rdi
mov r8d, r9d
call fcn.14013bee0
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140141bb0
Capabilities:
Capture webcam image

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x188
mov rbx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x1400d694c
xor r9d, r9d
xor r8d, r8d
mov edx, 0x186
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
add rsp, 0x20
pop rbx
ret
push rbx
sub rsp, 0x20
mov rbx, qword [rcx + 0x90]
mov edx, 0x40e
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov edx, 0x411
mov rcx, rbx
cmp eax, 1
jne 0x140141cb2
call fcn.1400d5ef0
mov edx, 0x412
mov rcx, rbx
call fcn.1400d5ef0
mov edx, 0x413
mov rcx, rbx
call fcn.1400d5ef0
mov edx, 0x414
mov rcx, rbx
call fcn.1400d5ef0
mov edx, 0x415
mov rcx, rbx
call fcn.1400d5ef0
mov edx, 0x416
mov rcx, rbx
call fcn.1400d5ef0
mov edx, 0x417
mov rcx, rbx
call fcn.1400d5ef0
mov edx, 0x418
mov rcx, rbx
call fcn.1400d5ef0
mov edx, 0x412
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x18b
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x419
mov rcx, rbx
test eax, eax
je 0x140141c8e
call fcn.1400d5ef0
mov edx, 0x41a
mov rcx, rbx
call fcn.1400d5ef0
mov edx, 0x412
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400d6910
call fcn.1400d5e50
mov edx, 0x41a
mov rcx, rbx
call fcn.1400d5e50
mov edx, 0x412
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400d6910
call fcn.1400d5e50
mov edx, 0x412
mov rcx, rbx
call fcn.1400d5e50
mov edx, 0x413
mov rcx, rbx
call fcn.1400d5e50
mov edx, 0x414
mov rcx, rbx
call fcn.1400d5e50
mov edx, 0x415
mov rcx, rbx
call fcn.1400d5e50
mov edx, 0x416
mov rcx, rbx
call fcn.1400d5e50
mov edx, 0x417
mov rcx, rbx
call fcn.1400d5e50
mov edx, 0x418
mov rcx, rbx
call fcn.1400d5e50
mov edx, 0x419
mov rcx, rbx
call fcn.1400d5e50
mov edx, 0x41a
mov rcx, rbx
call fcn.1400d5e50
mov edx, 0x412
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov rcx, rax
mov edx, 0x186
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_SendMessageW]
Function at 0x140143510
Capabilities:
Persist via run registry key

Disassembly:
push rbx
sub rsp, 0x390
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x380], rax
lea rcx, [rsp + 0x140]
call fcn.14017d460
lea r9, [rsp + 0x140]
lea r8, [0x1401b4940]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
xor ebx, ebx
call fcn.1400da6f0
test eax, eax
je 0x140143663
lea rcx, [rsp + 0x20]
call fcn.14017d460
lea rcx, [rsp + 0x260]
mov ebx, 2
call fcn.14017d460
lea rcx, [rsp + 0x260]
xor edx, edx
call fcn.1400d97c0
mov r8, qword [rsp + 0x268]
lea rdx, str.__s___startup
lea rcx, [rsp + 0x20]
call fcn.1401788c0
call fcn.1400ce420
test rax, rax
je 0x1401435cb
call fcn.1400ce420
lea rdx, str.__instance___s_
lea rcx, [rsp + 0x20]
mov r8, rax
call fcn.140178b10
mov r8, qword [0x14020e1d0]
cmp qword [r8 + 0x18], 0
je 0x1401435ee
mov r8, qword [r8 + 0x18]
lea rdx, str.__config___s_
lea rcx, [rsp + 0x20]
call fcn.140178b10
lea rcx, [rsp + 0x260]
call fcn.1400012c0
mov rdx, qword [rsp + 0x148]
lea rcx, str.reg:__s_n
call fcn.1400b3fe0
mov rdx, qword [rsp + 0x28]
lea rcx, str.set:__s_n
call fcn.1400b3fe0
mov r11, qword [rsp + 0x28]
mov rax, qword [rsp + 0x148]
movzx ecx, byte [r11]
cmp cl, byte [rax]
jne 0x140143649
test cl, cl
je 0x140143654
mov cl, byte [r11 + 1]
add r11, 1
add rax, 1
cmp cl, byte [rax]
je 0x140143635
movzx eax, byte [rax]
movzx ecx, byte [r11]
cmp ecx, eax
jne 0x140143659
mov ebx, 1
lea rcx, [rsp + 0x20]
call fcn.1400012c0
lea rcx, [rsp + 0x140]
call fcn.1400012c0
mov eax, ebx
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.1401a8ec0
add rsp, 0x390
pop rbx
ret

Function at 0x140148910
Capabilities:
Persist via run registry key

Disassembly:
sub rsp, 0x38
lea r8, [0x1401b4940]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call fcn.1400e2330
call fcn.1400ce420
test rax, rax
jne 0x140148993
call fcn.1400db2e0
test eax, eax
je 0x140148993
lea rax, [rsp + 0x40]
lea rdx, str.Software_voidtoolsEverything
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400da640
test eax, eax
je 0x140148993
lea r8, str.InstallRunOnStartup
lea rdx, str.Software_voidtoolsEverything
xor r9d, r9d
mov rcx, 0xffffffff80000002
call fcn.1400e2220
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
ret
Function at 0x14014c6b0
Capabilities:
Persist via run registry key

Disassembly:
sub rsp, 0x298
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea r8, [0x1401b4940]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call fcn.1400e2330
call fcn.1400ce420
test rax, rax
jne 0x14014c748
call fcn.1400db2e0
test eax, eax
je 0x14014c748
lea rax, [rsp + 0x30]
lea rdx, str.Software_voidtoolsEverything
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400da640
test eax, eax
je 0x14014c748
lea r8, str.InstallRunOnStartup
lea rdx, str.Software_voidtoolsEverything
xor r9d, r9d
mov rcx, 0xffffffff80000002
call fcn.1400e2220
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x40]
call fcn.14017d460
lea rcx, [rsp + 0x160]
call fcn.14017d460
lea rcx, [rsp + 0x160]
xor edx, edx
call fcn.1400d97c0
mov r8, qword [rsp + 0x168]
lea rdx, str.__s___startup
lea rcx, [rsp + 0x40]
call fcn.1401788c0
call fcn.1400ce420
test rax, rax
je 0x14014c7aa
call fcn.1400ce420
lea rdx, str.__instance___s_
lea rcx, [rsp + 0x40]
mov r8, rax
call fcn.140178b10
mov r8, qword [0x14020e1d0]
cmp qword [r8 + 0x18], 0
je 0x14014c7cd
mov r8, qword [r8 + 0x18]
lea rdx, str.__config___s_
lea rcx, [rsp + 0x40]
call fcn.140178b10
lea rcx, [rsp + 0x160]
call fcn.1400012c0
mov r9, qword [rsp + 0x48]
lea r8, [0x1401b4940]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call fcn.1400e20e0
call fcn.1400ce420
test rax, rax
jne 0x14014c861
call fcn.1400db2e0
test eax, eax
je 0x14014c861
lea rax, [rsp + 0x30]
lea rdx, str.Software_voidtoolsEverything
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.1400da640
test eax, eax
je 0x14014c861
lea r8, str.InstallRunOnStartup
lea rdx, str.Software_voidtoolsEverything
mov r9d, 1
mov rcx, 0xffffffff80000002
call fcn.1400e2220
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x40]
call fcn.1400012c0
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1401a8ec0
add rsp, 0x298
ret
Function at 0x140162440
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x170
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rdi, rcx
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x40]
call fcn.14017d460
mov rcx, qword [rdi + 0xa0]
xor r9d, r9d
lea edx, [r9 + 0xe]
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
add eax, 1
movsxd rbx, eax
lea rcx, [rbx + rbx]
call fcn.1400cf700
mov rcx, qword [rdi + 0xa0]
mov r8, rbx
mov r9, rax
mov edx, reloc.WS2_32.dll_listen
mov rsi, rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x28]
mov rbx, rsi
xor esi, esi
test rcx, rcx
mov edx, esi
mov qword [rsp + 0x28], rsi
mov r12, rsi
mov dword [rsp + 0x20], edx
je 0x1401624e6
call fcn.1400cf780
mov edx, esi
lea rbp, [rdi + 0x40]
mov r15, rsi
mov ecx, 0x100
mov qword [rsp + 0x1a8], r14
nop
nop
movzx eax, word [rbx]
mov r13, rbx
test ax, ax
je 0x14016252e
nop
nop
cmp ax, 0xd
jne 0x140162521
cmp word [rbx + 2], 0xa
je 0x1401625ba
mov ax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x140162510
mov rdi, rbx
sub rdi, r13
sar rdi, 1
cmp esi, edx
jl 0x140162585
lea esi, [rdx + rdx]
test esi, esi
cmove esi, ecx
movsxd rcx, esi
imul rcx, rcx, 0xd0
call fcn.1400cf700
movsxd r8, dword [rsp + 0x20]
mov rdx, r12
mov rcx, rax
mov r14, rax
imul r8, r8, 0xd0
call fcn.1401a8ef0
test r12, r12
je 0x140162579
mov rcx, r12
call fcn.1400cf780
mov dword [rsp + 0x20], esi
mov rsi, qword [rsp + 0x28]
mov r12, r14
lea rcx, [rsp + 0x40]
mov r8d, edi
mov rdx, r13
call fcn.1401781c0
mov eax, dword [rsp + 0x40]
mov dword [r15 + r12 + 0x10], eax
mov edx, dword [rsp + 0x40]
add edx, 1
cmp edx, 0x100
jle 0x1401625cc
mov rcx, rbp
call fcn.1400e47f0
mov rcx, rax
jmp 0x1401625f1
mov rdi, rbx
sub rdi, r13
sar rdi, 1
add rbx, 4
jmp 0x140162537
mov rax, qword [rbp + 0x10]
movsxd rdi, edx
lea rcx, [rdi + rax]
cmp rcx, qword [rbp + 0x18]
jb 0x1401625e5
mov rcx, rbp
call fcn.1400e4720
mov rcx, qword [rbp + 0x10]
lea rax, [rcx + rdi]
mov qword [rbp + 0x10], rax
mov qword [r15 + r12 + 8], rcx
movsxd r8, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
call fcn.1401a8ef0
mov rax, qword [r15 + r12 + 8]
movsxd r11, dword [rsp + 0x40]
mov edx, dword [rsp + 0x20]
add esi, 1
mov byte [r11 + rax], 0
add r15, 0x20
cmp word [rbx], 0
mov qword [rsp + 0x28], rsi
mov ecx, 0x100
jne 0x140162500
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x28], r12
mov dword [rax + 0x30], esi
call fcn.1400cf780
lea rcx, [rsp + 0x40]
call fcn.1400012c0
mov r14, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401a8ec0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140162aa0
Capabilities:
Get graphical window text

Disassembly:
mov r11, rsp
push rbx
push rdi
sub rsp, 0x5b8
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x5a0], rax
mov qword [r11 + 0x20], rbp
mov rdi, rcx
mov qword [r11 - 0x18], rsi
lea rcx, [r11 - 0x248]
mov rbp, r8
mov rsi, rdx
call fcn.14017d460
lea rcx, [rsp + 0x380]
mov rdx, rsi
call fcn.14017d760
test rbp, rbp
je 0x140162bf6
lea rcx, [rsp + 0x160]
call fcn.14017d460
lea rcx, [rsp + 0x40]
call fcn.14017d460
mov rcx, qword [rdi + 0x10]
mov edx, 0x3ea
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ebx, dword [rsp + 0x164]
add eax, 1
cmp eax, ebx
jle 0x140162b47
lea rcx, [rsp + 0x160]
mov edx, eax
call fcn.14017d470
mov ebx, dword [rsp + 0x164]
mov rcx, qword [rdi + 0x10]
mov edx, 0x3ea
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, qword [rsp + 0x168]
lea r8d, [rbx + 1]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rdi + 0x10]
mov edx, 0x3ea
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
mov rcx, rax
mov edx, 0xb0
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rsp + 0x34]
mov r11d, dword [rsp + 0x30]
mov rcx, rax
sub r11d, eax
mov rax, qword [rsp + 0x168]
lea r9, [rax + rcx*2]
lea rdx, str._s_T_s
lea rcx, [rsp + 0x40]
mov r8, rsi
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], r11d
call fcn.1401788c0
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x380]
call fcn.14017d760
lea rcx, [rsp + 0x40]
call fcn.1400012c0
lea rcx, [rsp + 0x160]
call fcn.1400012c0
jmp 0x140162c06
lea rcx, [rsp + 0x380]
mov rdx, rsi
call fcn.14017d760
mov rcx, qword [rdi + 0x10]
mov edx, 0x3ea
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r9, qword [rsp + 0x388]
mov edx, 0xc2
mov rcx, rax
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, qword [rsp + 0x5b0]
test rbp, rbp
mov rbp, qword [rsp + 0x5e8]
je 0x140162ccc
mov rcx, qword [rdi + 0x10]
mov edx, 0x3ea
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
mov rcx, rax
mov edx, 0xb0
call qword [sym.imp.USER32.dll_SendMessageW]
mov r11d, dword [rsp + 0x30]
mov rcx, qword [rdi + 0x10]
add r11d, 0xffffffff
mov edx, 0x3ea
mov dword [rsp + 0x30], r11d
mov ebx, r11d
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r9, rbx
xor r8d, r8d
mov edx, 0xb1
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x10]
mov ebx, dword [rsp + 0x30]
mov edx, 0x3ea
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r9, rbx
mov r8, rbx
mov rcx, rax
mov edx, 0xb1
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rsp + 0x380]
call fcn.1400012c0
mov rcx, qword [rdi + 0x10]
mov edx, 0x3ea
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [rsp + 0x5a0]
xor rcx, rsp
call fcn.1401a8ec0
add rsp, 0x5b8
pop rdi
pop rbx
ret
Function at 0x140162d10
Capabilities:
Get graphical window text

Disassembly:
mov r11, rsp
push rbx
push rdi
sub rsp, 0x5b8
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x5a0], rax
mov qword [r11 + 0x20], rbp
mov rdi, rcx
mov qword [r11 - 0x18], rsi
lea rcx, [r11 - 0x248]
mov rsi, r8
mov rbp, rdx
call fcn.14017d460
test rsi, rsi
je 0x140162e56
lea rcx, [rsp + 0x160]
call fcn.14017d460
lea rcx, [rsp + 0x40]
call fcn.14017d460
mov rcx, qword [rdi + 0x10]
mov edx, 0x3ef
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ebx, dword [rsp + 0x164]
add eax, 1
cmp eax, ebx
jle 0x140162da7
lea rcx, [rsp + 0x160]
mov edx, eax
call fcn.14017d470
mov ebx, dword [rsp + 0x164]
mov rcx, qword [rdi + 0x10]
mov edx, 0x3ef
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, qword [rsp + 0x168]
lea r8d, [rbx + 1]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rdi + 0x10]
mov edx, 0x3ef
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
mov rcx, rax
mov edx, 0xb0
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rsp + 0x34]
mov r11d, dword [rsp + 0x30]
mov rcx, rax
sub r11d, eax
mov rax, qword [rsp + 0x168]
lea r9, [rax + rcx*2]
lea rdx, str._s_T_s
lea rcx, [rsp + 0x40]
mov r8, rbp
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r11d
call fcn.1401788c0
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x380]
call fcn.14017d760
lea rcx, [rsp + 0x40]
call fcn.1400012c0
lea rcx, [rsp + 0x160]
call fcn.1400012c0
jmp 0x140162e66
lea rcx, [rsp + 0x380]
mov rdx, rbp
call fcn.14017d760
mov rcx, qword [rdi + 0x10]
mov edx, 0x3ef
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r9, qword [rsp + 0x388]
mov edx, 0xc2
mov rcx, rax
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbp, qword [rsp + 0x5e8]
test rsi, rsi
mov rsi, qword [rsp + 0x5b0]
je 0x140162f2c
mov rcx, qword [rdi + 0x10]
mov edx, 0x3ef
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
mov rcx, rax
mov edx, 0xb0
call qword [sym.imp.USER32.dll_SendMessageW]
mov r11d, dword [rsp + 0x30]
mov rcx, qword [rdi + 0x10]
add r11d, 0xffffffff
mov edx, 0x3ef
mov dword [rsp + 0x30], r11d
mov ebx, r11d
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r9, rbx
xor r8d, r8d
mov edx, 0xb1
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x10]
mov ebx, dword [rsp + 0x30]
mov edx, 0x3ef
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r9, rbx
mov r8, rbx
mov rcx, rax
mov edx, 0xb1
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rsp + 0x380]
call fcn.1400012c0
mov rcx, qword [rdi + 0x10]
mov edx, 0x3ef
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [rsp + 0x5a0]
xor rcx, rsp
call fcn.1401a8ec0
add rsp, 0x5b8
pop rdi
pop rbx
ret
Function at 0x140179b30
Capabilities:
Get geographical location

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
lea rcx, [rsp + 0x20]
mov esi, r8d
mov ebx, edx
call fcn.14017d460
mov r9d, dword [rsp + 0x24]
mov r8, qword [rsp + 0x28]
mov edx, esi
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x140179bc8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140179c12
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140179c12
mov r9d, dword [rsp + 0x24]
cmp eax, r9d
jle 0x140179bb5
lea rcx, [rsp + 0x20]
mov edx, eax
call fcn.14017d470
mov r9d, dword [rsp + 0x24]
mov r8, qword [rsp + 0x28]
mov edx, esi
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140179b77
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
call fcn.14016ecb0
mov dword [rdi], eax
lea ebx, [rax + 1]
mov eax, dword [rdi + 4]
cmp ebx, eax
jle 0x140179c57
cmp eax, 0x104
jle 0x140179bf1
mov rcx, qword [rdi + 8]
call fcn.1400cf780
cmp ebx, 0x104
jle 0x140179c48
add ebx, 0xffff
and ebx, 0xffff0000
movsxd rcx, ebx
call fcn.1400cf700
mov dword [rdi + 4], ebx
jmp 0x140179c53
mov eax, dword [rdi + 4]
cmp eax, 1
jge 0x140179c39
cmp eax, 0x104
jle 0x140179c2a
mov rcx, qword [rdi + 8]
call fcn.1400cf780
lea rax, [rdi + 0x10]
mov dword [rdi + 4], 0x104
mov qword [rdi + 8], rax
mov rax, qword [rdi + 8]
mov byte [rax], 0
mov dword [rdi], 0
jmp 0x140179c63
lea rax, [rdi + 0x10]
mov dword [rdi + 4], 0x104
mov qword [rdi + 8], rax
mov rcx, qword [rdi + 8]
mov rdx, rsi
call fcn.14016de40
lea rcx, [rsp + 0x20]
call fcn.1400012c0
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a8ec0
add rsp, 0x250
pop rdi
pop rsi
pop rbx
ret
Function at 0x14017a260
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, rdx
mov rbx, rcx
xor edi, edi
lea edx, [rdi + 1]
mov rcx, rax
call fcn.1400d5540
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x14017a34d
lea rdx, [rsp + 0x58]
mov rcx, rax
call fcn.1400d76a0
test eax, eax
je 0x14017a344
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x14017a30f
lea rcx, [rax + 1]
test rcx, rcx
je 0x14017a344
mov edx, 0x80000000
cmp rcx, rdx
jge 0x14017a344
lea edx, [rax + 1]
mov rcx, rbx
call fcn.140177260
test eax, eax
je 0x14017a344
mov rax, qword [rsp + 0x58]
mov rdx, qword [rbx + 8]
lea r9, [rsp + 0x50]
mov r8d, eax
mov rcx, rsi
mov dword [rbx], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14017a344
movsxd rax, dword [rbx]
cmp dword [rsp + 0x50], eax
jne 0x14017a344
mov rcx, rax
mov rax, qword [rbx + 8]
mov byte [rcx + rax], dil
jmp 0x14017a33f
mov eax, dword [rbx + 4]
cmp eax, 1
jge 0x14017a336
cmp eax, 0x104
jle 0x14017a327
mov rcx, qword [rbx + 8]
call fcn.1400cf780
lea rax, [rbx + 0x10]
mov dword [rbx + 4], 0x104
mov qword [rbx + 8], rax
mov rax, qword [rbx + 8]
mov byte [rax], dil
mov dword [rbx], edi
mov edi, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x140180330
Capabilities:
Encode data using xor

Disassembly:
movzx r9d, byte [rcx + 0x5c]
xor edx, edx
mov r8, rcx
cmp dword [rcx + 0x60], edx
jle 0x14018037a
movzx r10d, r9b
lea r11, [0x14020bf20]
nop
nop
mov ecx, dword [r8 + 0x288]
add edx, 1
mov rax, rcx
shl ecx, 8
shr rax, 0x18
xor rax, r10
mov eax, dword [r11 + rax*4]
xor eax, ecx
mov dword [r8 + 0x288], eax
cmp edx, dword [r8 + 0x60]
jl 0x140180350
mov eax, dword [r8 + 0x5c]
mov byte [rax + r8 + 0x80], 1
movsxd rdx, dword [r8 + 0x60]
mov ecx, edx
sub ecx, 1
je 0x140180425
sub ecx, 1
je 0x140180414
cmp ecx, 1
je 0x140180403
mov byte [rdx + r8 + 0x7c], 1
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], r9b
add dword [r8 + 0x6c], 1
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], r9b
add dword [r8 + 0x6c], 1
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], r9b
add dword [r8 + 0x6c], 1
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], r9b
add dword [r8 + 0x6c], 1
movzx edx, byte [r8 + 0x60]
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
sub dl, 4
mov byte [rcx + rax], dl
add dword [r8 + 0x6c], 1
ret
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], r9b
add dword [r8 + 0x6c], 1
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], r9b
add dword [r8 + 0x6c], 1
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], r9b
add dword [r8 + 0x6c], 1
ret