joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100411cb0
Capabilities:
Encode data using xor

Disassembly:
push rdi
invalid
jo 0x100411be7
wait
xor edi, dword [rbx - 0x42]
iretd
push rdi
mov bl, 0x34
xor esi, dword [rbx]
jnp 0x100411b39
mul dword [rbx - 0x6fcccccc]
idiv byte [rbx - 0x44]
invalid
cmp edi, dword [rbx - 0x44]
scasd eax, dword [rdi]
push rdi
mov byte [r11 - 0x40], dil
fist word [rdi - 0x7d]
xor dh, byte [rdx]
xor bh, byte [rbx - 0x4c]
invalid
jnp 0x100411b77
mov eax, 0x333334ab
jg 0x100411b7e
add eax, 0x32fcb67b
js 0x100411c2d
xor bh, byte [rax + 0x66]
invalid
jnp 0x100411b90
hlt
test al, 0x2a
xor dh, bl
invalid
ror byte [rax + 0x7e], 0xf5
jle 0x100411bda
add eax, 0x3334eb33
xor esi, dword [rbx]
jmp 0x100411c1d
mov esp, 0x3333cbb8
xor edi, dword [rbx - 0x42]
mov eax, 0x333334a3
jnp 0x100411bb7
mov esi, 0x3334a3b8
xor edi, dword [rbx - 0x44]
enter 0x33c3, 0x33
xor esi, dword [rdi - 0x44]
ror bh, 1
xor esi, dword [rbx]
xor edi, dword [rbx - 0x42]
iretd
jnp 0x100411bc4
add eax, 0xbe7b43a7
jnp 0x100411bcf
hlt
ja 0x100411c82
xor rax, 0xfffffffff3322aa8
test al, 0x2a
xor dh, bl
invalid
jnp 0x100411be1
invalid
add eax, 0x3334eb33
xor esi, dword [rbx]
mov esp, 0x3333bbb8
xor edi, dword [rbx - 0x40]
xor edi, dword [rax + rdi*4 + 0x333333bb]
mov eax, 0x333333bb
mov ebx, 0x7b333333
rcl byte [rax + 0x2b], 0xf4
xor esi, dword [rbx]
jnp 0x100411bf3
push rax
sub esi, esp
hlt
add eax, 0xb8be7b33
wait
xor al, 0x33
xor esi, dword [rbx + rbp*8 + 0x35]
xor esi, dword [rbx]
xor edi, dword [rbx - 0x44]
mov eax, 0x3333349b
je 0x100411c2c
jmp 0x100411c77
xor eax, 0x7b333333
mov esp, 0xbe7ba378
jnp 0x100411c03
js 0x100411bec
jnp 0x100411c09
mov eax, 0x33333493
jnp 0x100411c0e
js 0x100411be7
jnp 0x100411c14
mov esi, 0x33348bb8
mov eax, 0x3333348b
xor edi, dword [rbx - 0x44]
jnp 0x100411c19
js 0x100411be2
jnp 0x100411c1f
mov eax, 0x33333483
jnp 0x100411c24
js 0x100411cdd
jnp 0x100411c2a
mov eax, 0x3333347b
jnp 0x100411c2f
js 0x100411cd8
jnp 0x100411c35
mov eax, 0x33333473
jnp 0x100411c3a
js 0x100411cd3
jnp 0x100411c40
mov eax, 0x3333346b
jnp 0x100411c45
js 0x100411cce
jnp 0x100411c4b
mov eax, 0x33333463
jnp 0x100411c50
js 0x100411cc9
jnp 0x100411c56
mov eax, 0x3333345b
jnp 0x100411c5b
enter 0x33b3, 0x33
xor esi, dword [rdi - 0x44]
sar byte [rdi + 0x7b333333], 1
cli
js 0x100411c5a
invalid
xor esi, dword [rbx]
xor edi, dword [rbx - 0x42]
jnp 0x100411cb2
js 0x100411c55
invalid
jnp 0x100411d02
invalid
xor esi, dword [rbx]
xor edi, dword [rbx - 6]
jnp 0x100411cca
xor esi, dword [rbx]
xor edi, dword [rbx - 6]
js 0x100411d39
xor esi, dword [rbx]
xor ebx, dword [rsi]
xor eax, 0x1e333333
cmp dword [rbx - 0x42], edi
invalid
Function at 0x140002520
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x1400055e0], rbx
je 0x14000256c
cmp rax, rbx
jne 0x14000255f
mov ebx, 1
mov esi, ebx
jmp 0x140002571
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002544
mov ebx, 1
mov eax, dword [0x1400055e8]
cmp eax, ebx
jne 0x140002587
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1400025ec
mov eax, dword [0x1400055e8]
test eax, eax
jne 0x1400025e6
mov dword [0x1400055e8], ebx
lea r15, [0x140003418]
lea rdi, [0x140003400]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x1400025d8
test eax, eax
jne 0x1400025dc
cmp qword [rdi], 0
je 0x1400025cd
mov rax, qword [rdi]
mov rcx, qword [0x1400033e0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x1400025ae
test eax, eax
je 0x1400025ec
mov eax, 0xff
jmp 0x1400026c8
mov dword [0x140005024], ebx
mov eax, dword [0x1400055e8]
cmp eax, ebx
jne 0x140002613
lea rdx, [0x1400033f8]
lea rcx, [0x1400033e8]
call sub.msvcrt.dll__initterm
mov dword [0x1400055e8], 2
test esi, esi
jne 0x140002620
xor eax, eax
xchg qword [0x1400055e0], rax
cmp qword [0x1400055f0], 0
je 0x140002654
lea rcx, [0x1400055f0]
call fcn.1400028d0
test eax, eax
je 0x140002654
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1400055f0]
mov r9, qword [0x1400033e0]
call r9
mov r8, qword [0x140005038]
mov rdx, qword [0x140005030]
mov ecx, dword [0x140005028]
call fcn.140001914
mov dword [0x140005020], eax
cmp dword [0x140005040], 0
jne 0x140002684
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140005024], 0
jne 0x140002699
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140005020]
jmp 0x1400026c8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140095000
add rsp, 0x28
jmp 0x140002520

Function at 0x1400027bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140002808
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140002800
cmp dword [rcx + 0x3c], edx
jl 0x140002800
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140002800
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140002808
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1400047e4
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1400128b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r14, str.en_US
mov rsi, rcx
mov qword [rcx], r14
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov word [rsp + 0x30], ax
mov ebx, 0x10
mov r9d, ebx
lea rdx, [0x140008110]
lea rax, [0x140004df0]
mov r8d, 0x1b3
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call sub.api_ms_win_crt_private_l1_1_0.dll__o_bsearch
xor ebp, ebp
test rax, rax
jne 0x14000485f
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400048e5
cmp dword [rax + 0xc], 0x7c
jne 0x14000486c
cmp word [rax + 8], 0x7f
jne 0x14000484f
mov r8, qword [rax]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r8 + rcx*2], bp
jne 0x140004873
inc rcx
cmp rcx, 0x7ffffffe
jbe 0x140004890
mov word [rsp + 0x38], bp
jmp 0x1400048d7
lea rax, [rsp + 0x38]
mov r9d, ebp
sub r8, rax
lea rdx, [rsp + 0x38]
lea rax, [rbx - 0x10]
add rax, rcx
je 0x1400048c0
movzx eax, word [r8 + rdx]
test ax, ax
je 0x1400048c0
mov word [rdx], ax
add rdx, 2
sub rbx, 1
jne 0x1400048a0
test rbx, rbx
jne 0x1400048cf
sub rdx, 2
mov r9d, 0x8007007a
mov word [rdx], bp
test r9d, r9d
jns 0x1400048e1
mov ecx, 0x7a
jmp 0x140004854
test ecx, ecx
jne 0x1400048f1
mov rcx, qword [rsp + 0x78]
call fcn.14000494c
jmp 0x14000492a
mov rbx, rbp
mov rdi, rbp
mov rdx, qword [rdi + r14]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
test eax, eax
je 0x14000491c
inc rbx
add rdi, 0x30
cmp rdi, 0x750
jb 0x1400048f7
jmp 0x14000492a
lea rax, [rbx + rbx*2]
shl rax, 4
add rax, r14
mov qword [rsi], rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400050e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140005104
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140012e60], eax
call fcn.1400056f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140012e60], 0
jne case.default.0x14000515a
mov ecx, 1
call fcn.1400056f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
push rbp
jne 0x14001ad17
test byte [rbx + 0x37788bc8], ch
xchg edi, eax
test byte [rsi + rbx], 0xc4
invalid
pushfq
inc dword [rdx + rdx*4 + 0x2b]
mov bl, 0xba
hlt
Function at 0x14003b840
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x30
mov rsi, rdx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov rdx, qword [rcx + 0x18]
mov rdi, qword [rdx + 0x80]
mov rdi, qword [rdi]
test rdi, rdi
je 0x14003b933
call fcn.140001dc0
mov rcx, rax
test rax, rax
je 0x14003b969
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebp, [rax + 1]
test ebp, ebp
js 0x14003b95e
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, ebp
or eax, ecx
jge 0x14003b8cf
mov edx, ebp
lea rcx, [rsp + 0x50]
call fcn.14003d280
mov rbx, qword [rsp + 0x50]
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, 0xffffffff
jne 0x14003b8ef
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140083790
test eax, eax
js 0x14003b95e
cmp eax, dword [rbx - 0xc]
jg 0x14003b95e
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r14w
mov rdx, rbx
mov rcx, rsi
call fcn.140024bf0
mov dword [rsp + 0x20], 1
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003b948
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x14003b948
add rdx, 0x10
mov rcx, rsi
call fcn.140024e80
nop
mov dword [rsp + 0x20], 1
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80070057
call fcn.140035220
nop
mov ecx, 0x80004005
call fcn.140035220
int3
Function at 0x14003d2e0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rbx, rdx
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [rax + 1]
test edi, edi
js 0x14003d37d
mov rdx, qword [rbx]
mov r8d, 1
mov eax, dword [rdx - 0xc]
sub r8d, dword [rdx - 8]
sub eax, edi
or r8d, eax
jge 0x14003d329
mov edx, edi
mov rcx, rbx
call fcn.14003d280
mov rdx, qword [rbx]
mov rcx, qword [rsi]
mov r8d, edi
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor esi, esi
mov edi, eax
cmp eax, 0xffffffff
jne 0x14003d353
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14003d34a
mov eax, esi
jmp 0x14003d357
movsxd rdx, dword [rcx - 0xc]
call fcn.140083790
test eax, eax
js 0x14003d37d
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14003d37d
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x30]
mov word [rax + rcx*2], si
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80070057
call fcn.140035220
int3
Function at 0x140045aa0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov r12, rdx
mov rsi, rcx
xor r13d, r13d
mov dword [rbp - 0x49], r13d
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x39], rcx
lea rdi, vtable.CVolObject.0
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], r13
mov qword [rbp - 0x29], r13
lea rax, vtable.CWString.0
mov qword [rbp - 0x39], rax
lea rax, [rbp - 0x19]
mov qword [rbp + 0x6f], rax
mov qword [rbp - 0x19], rcx
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], r13
lea rbx, vtable.CVolMem.0
mov qword [rbp - 0x19], rbx
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 7], r13
mov qword [rbp + 0x17], 0x40
mov qword [rbp - 0x21], r13
mov qword [rbp + 0x17], 0xfe
mov rcx, rdx
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov r14d, eax
test eax, eax
jne 0x140045baa
mov rax, qword [rbp - 0x21]
test rax, rax
jne 0x140045b63
lea rax, [0x1400a6e68]
cmp qword [rbp + 0xf], r13
cmovne rax, qword [rbp - 1]
mov rdx, rax
mov rcx, rsi
call fcn.140024bf0
mov dword [rbp - 0x49], 1
lea rax, [rbp - 0x19]
mov qword [rbp + 0x6f], rax
mov qword [rbp - 0x19], rbx
mov rdx, qword [rbp - 1]
test rdx, rdx
je 0x140045b95
lea rcx, [rbp - 0x19]
mov rax, qword [rbp - 0x19]
call qword [rax + 0x18]
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 7], r13
mov qword [rbp - 0x19], rdi
jmp 0x140045c97
inc r14d
movsxd r15, r14d
mov eax, 2
mul r15
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14007cea4
mov rbx, rax
test r14d, r14d
je 0x140045be7
movzx eax, r13w
mov rdi, rbx
mov rcx, r15
rep stosw word [rdi], ax
lea rdi, vtable.CVolObject.0
mov r8d, r14d
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov qword [rbp - 0x21], r13
mov rdx, qword [rbp - 1]
test rdx, rdx
je 0x140045c0e
lea rcx, [rbp - 0x19]
mov rax, qword [rbp - 0x19]
call qword [rax + 0x18]
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 7], r13
cmp word [rbx], 0
je 0x140045c2c
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.14006aaf0
mov rcx, rbx
call fcn.14007cb28
mov rax, qword [rbp - 0x21]
test rax, rax
jne 0x140045c4e
lea rax, [0x1400a6e68]
cmp qword [rbp + 0xf], 0
cmovne rax, qword [rbp - 1]
mov rdx, rax
mov rcx, rsi
call fcn.140024bf0
mov dword [rbp - 0x49], 1
lea rax, [rbp - 0x19]
mov qword [rbp + 0x6f], rax
lea rax, vtable.CVolMem.0
mov qword [rbp - 0x19], rax
mov rdx, qword [rbp - 1]
test rdx, rdx
je 0x140045c87
lea rcx, [rbp - 0x19]
mov rax, qword [rbp - 0x19]
call qword [rax + 0x18]
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 7], r13
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x39], rdi
mov rax, rsi
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140045cc0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov rcx, rbp
mov esi, eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, 1
mov edx, esi
mov ecx, eax
mov edi, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, rbp
call qword [sym.imp.USER32.dll_SetFocus]
xor r8d, r8d
mov edx, esi
mov ecx, edi
mov rbx, rax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rsi, qword [rsp + 0x40]
xor eax, eax
cmp rbx, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
sete al
add rsp, 0x20
pop rdi
ret
Function at 0x14004e610
Capabilities:
Check for time delay via gettickcount
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
movsxd r14, r9d
mov r12, r8
mov r13, rdx
mov rdi, rcx
xor esi, esi
cmp dword [rcx + 0x1888], esi
je 0x14004e68a
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x18], rax
lea rbx, vtable.CVolObject.0
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rsi
or qword [rbp - 0x10], 1
mov rdx, r14
add rcx, 0x1788
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
call fcn.14002bf00
nop
mov qword [rbp - 0x18], rbx
jmp 0x14004e804
cmp qword [rcx + 0x10b8], rsi
mov rbx, rsi
je 0x14004e69d
mov rbx, qword [rcx + 0x10a8]
mov qword [rbp - 0x20], r14
mov rbx, qword [rbx + r14*8]
add rcx, 0x750
call fcn.14003ba90
mov r15d, eax
mov rcx, rbx
call fcn.14003ba90
add r15d, eax
cmp qword [rdi + 0x10b8], rsi
mov rcx, rsi
je 0x14004e6d2
mov rcx, qword [rdi + 0x10a8]
mov rcx, qword [rcx + r14*8]
call fcn.14003bcc0
lea ebx, [r15 + rax]
test r15d, r15d
js 0x14004e7ef
lea rcx, [rdi + 0x3a8]
call fcn.14003bcc0
cmp ebx, eax
jg 0x14004e7ef
lea rcx, [rbp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rdi + 0x19c8]
sub eax, dword [rbp + 0x30]
cmp eax, 4
jge 0x14004e777
lea rcx, [rbp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rdi + 0x19c8]
sub eax, dword [rbp + 0x30]
cmp eax, 0xfffffffd
jle 0x14004e777
lea rcx, [rbp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rdi + 0x19cc]
sub eax, dword [rbp + 0x34]
cmp eax, 4
jge 0x14004e777
lea rcx, [rbp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rdi + 0x19cc]
sub eax, dword [rbp + 0x34]
cmp eax, 0xfffffffd
jle 0x14004e777
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
sub rax, qword [rdi + 0x19d0]
cmp rax, 0x14a
jl 0x14004e804
lea rcx, [rbp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rbp + 0x30]
mov dword [rdi + 0x19c8], eax
lea rcx, [rbp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rbp + 0x34]
mov dword [rdi + 0x19cc], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
mov qword [rdi + 0x19d0], rax
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x18], rax
lea rbx, vtable.CVolObject.0
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rsi
or qword [rbp - 0x10], 1
lea rcx, [rdi + 0x1788]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov rdx, qword [rbp - 0x20]
call fcn.14002bf00
nop
mov qword [rbp - 0x18], rbx
jmp 0x14004e804
mov dword [rsp + 0x20], r14d
mov r9, r12
mov r8, r13
xor edx, edx
mov rcx, rdi
call fcn.14004eb00
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140059870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.1400596b0
mov r8, qword [rbx]
mov rcx, rbx
mov rsi, rax
call qword [r8 + 0x28]
cmp rsi, rax
je 0x1400598cb
mov ecx, dword [rsi + 0x18]
cmp dword [rax + 0x18], ecx
jne 0x140059a32
mov r8, qword [rsi + 0x10]
cmp qword [rax + 0x10], r8
jne 0x140059a32
mov rdx, qword [rsi + 8]
mov rcx, qword [rax + 8]
call fcn.140082cd0
test eax, eax
jne 0x140059a32
movzx eax, byte [rbx + 8]
xor al, byte [rdi + 8]
test al, 1
jne 0x140059a32
mov rax, qword [rbx + 0x10]
cmp qword [rdi + 0x10], rax
jne 0x140059a32
mov eax, dword [rbx + 0x18]
cmp dword [rdi + 0x18], eax
jne 0x140059a32
mov r8, qword [rbx + 0x38]
test r8, r8
jne 0x14005990e
cmp qword [rbx + 0x68], r8
lea r8, [0x1400a6e68]
je 0x14005990e
mov r8, qword [rbx + 0x58]
mov rax, qword [rdi + 0x38]
test rax, rax
jne 0x140059928
cmp qword [rdi + 0x68], rax
lea rax, [0x1400a6e68]
je 0x140059928
mov rax, qword [rdi + 0x58]
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140059944
add rax, 2
test ecx, ecx
jne 0x140059930
test edx, edx
jne 0x140059a32
mov rax, qword [rbx + 0x78]
cmp qword [rdi + 0x78], rax
jne 0x140059a32
mov r8, qword [rbx + 0x98]
test r8, r8
jne 0x14005997d
cmp qword [rbx + 0xc8], r8
lea r8, [0x1400a6e68]
je 0x14005997d
mov r8, qword [rbx + 0xb8]
mov rax, qword [rdi + 0x98]
test rax, rax
jne 0x1400599a0
cmp qword [rdi + 0xc8], rax
lea rax, [0x1400a6e68]
je 0x1400599a0
mov rax, qword [rdi + 0xb8]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400599b7
add rax, 2
test ecx, ecx
jne 0x1400599a3
test edx, edx
jne 0x140059a32
mov eax, dword [rbx + 0xd8]
cmp dword [rdi + 0xd8], eax
jne 0x140059a32
mov eax, dword [rbx + 0xdc]
cmp dword [rdi + 0xdc], eax
jne 0x140059a32
mov eax, dword [rbx + 0xe0]
cmp dword [rdi + 0xe0], eax
jne 0x140059a32
mov rax, qword [rbx + 0xe8]
cmp qword [rdi + 0xe8], rax
jne 0x140059a32
mov eax, dword [rbx + 0xf0]
cmp dword [rdi + 0xf0], eax
jne 0x140059a32
mov eax, dword [rbx + 0xf4]
cmp dword [rdi + 0xf4], eax
jne 0x140059a32
mov eax, dword [rbx + 0xf8]
cmp dword [rdi + 0xf8], eax
jne 0x140059a32
lea eax, [rdx + 1]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400605f0
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
xor esi, esi
call fcn.140060650
test eax, eax
jle 0x140060642
mov qword [rsp + 0x30], rbx
lea ecx, [rsi + 1]
mov r8d, eax
mov qword [rsp + 0x38], rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
xor edx, edx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x38]
test ebx, ebx
mov rbx, qword [rsp + 0x30]
setne sil
mov eax, esi
add rsp, 0x20
pop rsi
ret
Function at 0x140061db0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [rcx + 0x30]
mov rbp, rcx
add rcx, 0x30
mov esi, r9d
mov edi, r8d
mov r14, rdx
call qword [rax + 0x88]
mov rdx, r14
lea rcx, [rbp + 0x30]
call fcn.140005500
lea rcx, [rsp + 0x50]
mov dword [rbp + 0x18], edi
mov dword [rbp + 0x1c], esi
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rsp + 0x50]
lea rcx, [rsp + 0x50]
mov dword [rbp + 0x20], eax
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rsp + 0x54]
mov dword [rbp + 0x24], eax
mov dword [rbp + 0x2c8], 0
mov ecx, dword [rbp + 0x2e8]
test ecx, ecx
je 0x140061e2c
call qword [sym.imp.WINMM.dll_timeKillEvent]
mov edx, 1
mov dword [rsp + 0x20], 1
lea r9, [rbp + 0x2d0]
lea r8, [0x140042840]
lea ecx, [rdx + 9]
call qword [sym.imp.WINMM.dll_timeSetEvent]
mov dword [rbp + 0x2e8], eax
mov r9d, 1
mov r8d, dword [rbp + 0x2c8]
mov rdx, r14
mov rcx, rbp
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
jmp fcn.140061e80
Function at 0x140065750
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rbx, r8
mov edi, edx
test r8, r8
je 0x140065920
mov rax, qword [rcx]
call qword [rax]
mov rbp, rax
test edi, edi
je 0x1400657c0
cmp edi, 3
je 0x1400657c0
sub edi, 1
je 0x1400657af
cmp edi, 1
jne 0x140065920
movzx edx, bx
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadIconW]
jmp 0x140065922
movzx edx, bx
mov rcx, rbp
call qword [sym.imp.USER32.dll_LoadCursorW]
jmp 0x140065922
movzx edx, bx
mov r8d, 0xa
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x140065920
xor ebx, ebx
mov esi, ebx
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x140065920
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x140065886
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.140063190
test rax, rax
je 0x14006585f
mov rsi, qword [rsp + 0x50]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140065886
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
test rsi, rsi
je 0x140065920
cmp edi, 3
jne 0x14006591b
lea r8, [rsp + 0x30]
lea edx, [rdi + 0x1d]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x14006590d
mov edx, dword [rsp + 0x38]
test edx, edx
je 0x14006590d
lea ecx, [rdx + 1]
and ecx, 0xfffffffe
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea r8d, [rdi + 0x1e]
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov rdi, rax
test rax, rax
je 0x14006590d
mov r8d, 0xff00ff
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
test eax, eax
jns 0x14006590a
mov rcx, rdi
call qword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x140065922
mov rbx, rdi
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x140065922
mov rax, rsi
jmp 0x140065922
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret