joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140030160
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x20
mov rax, qword [0x140087b68]
mov rdi, rcx
test rax, rax
jne 0x1400301b2
lea edx, [rax + 0x11]
lea rcx, [0x140089818]
call fcn.14000a850
mov rcx, rax
call fcn.14000ff30
mov rcx, qword [0x140091f78]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140087b68], rax
test rax, rax
jne 0x1400301b2
add rsp, 0x20
pop rdi
jmp fcn.14002ffd0
xor r9d, r9d
mov qword [rsp + 0x30], rbx
lea rdx, [0x140094398]
lea r8d, [r9 + 0x20]
lea ecx, [r9 + 3]
call rax
mov r10, qword [0x140087b68]
lea rdx, [0x140094260]
xor r9d, r9d
mov r8d, 0x138
mov ebx, eax
lea ecx, [r9 + 2]
call r10
add eax, ebx
mov rbx, qword [rsp + 0x30]
jne 0x14003030f
mov rax, qword [0x1400943b8]
test rax, rax
je 0x1400302f3
mov ecx, dword [0x140094260]
xorps xmm0, xmm0
movsd xmm3, qword [0x140064508]
xorps xmm1, xmm1
cvtsi2sd xmm1, dword [0x1400943bc]
xorps xmm4, xmm4
xorps xmm2, xmm2
cvtsi2sd xmm4, dword [0x140094264]
cvtsi2sd xmm0, rcx
mov ecx, eax
mulsd xmm1, xmm3
mulsd xmm4, xmm3
addsd xmm4, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, rcx
addsd xmm1, xmm0
xorps xmm0, xmm0
subsd xmm4, xmm1
xorps xmm1, xmm1
cvtsi2sd xmm1, dword [0x1400943c4]
movsd qword [rdi], xmm4
cvtsi2sd xmm2, dword [0x1400943a4]
mov eax, dword [0x1400943a0]
mulsd xmm1, xmm3
cvtsi2sd xmm0, rax
mov eax, dword [0x1400943c0]
mulsd xmm2, xmm3
addsd xmm2, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
addsd xmm1, xmm0
xorps xmm0, xmm0
subsd xmm2, xmm1
movsd xmm1, qword [0x1400572e8]
divsd xmm4, xmm2
movsd qword [rdi], xmm4
mov eax, dword [0x14008fa60]
mulsd xmm4, xmm1
cvtsi2sd xmm0, rax
divsd xmm4, xmm0
xorps xmm0, xmm0
comisd xmm4, xmm0
subsd xmm1, xmm4
movsd qword [rdi], xmm1
jae 0x1400302e2
movabs rax, 0x4059000000000000
mov qword [rdi], rax
jmp 0x1400302f3
comisd xmm4, xmmword [0x1400644f8]
jbe 0x1400302f3
mov qword [rdi], 0
mov rax, qword [0x140094260]
mov qword [0x1400943b8], rax
mov rax, qword [0x1400943a0]
mov qword [0x1400943c0], rax
add rsp, 0x20
pop rdi
ret

Function at 0x140032770
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x14007c668]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
lea rcx, [0x140089728]
mov qword [rsp + 0x50], rbx
lea edx, [rbx + 0x53]
call fcn.14000a850
mov rcx, rax
call fcn.140009eb0
mov qword [rsp + 0x40], rbx
mov rdx, rax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20219
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14003281f
lea edx, [rbx + 0x4b]
mov dword [rsp + 0x58], ebx
lea rcx, [0x140089728]
call fcn.14000a850
mov rcx, rax
call fcn.140009eb0
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rcx
lea r9d, [rbx + 4]
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14003282f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14003e210
add rsp, 0x70
pop rbx
ret
Function at 0x140032850
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x48
mov r8d, dword [0x14008f288]
xor eax, eax
sub r8d, dword [0x14008f2f4]
sub r8d, dword [0x14008f270]
mov r9d, dword [0x14008f27c]
mov rcx, qword [0x14008f320]
lea edx, [rax + 1]
mov dword [rsp + 0x30], 0x4001
mov dword [rsp + 0x28], eax
mov dword [0x14008f274], r8d
mov dword [0x14008f294], r9d
mov dword [0x14008f47c], eax
mov dword [0x1400771b4], 1
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWindowPos]
add rsp, 0x48
jmp fcn.1400348e0
Function at 0x140036ac0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x14007c668]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsxd r8, r8d
lea rax, [0x14007c110]
mov rbx, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov r8, qword [rax + r8*8]
call fcn.1400457c8
test eax, eax
jne 0x140036b27
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rbx + r8*2], 0
jne 0x140036b00
mov r9, qword [rsp + 0x20]
mov edx, 2
mov rcx, rbx
call fcn.1400465f8
mov rcx, qword [rsp + 0x20]
call fcn.1400458a4
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14003e210
add rsp, 0x30
pop rbx
ret

Function at 0x14003acb0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp qword [0x14008f568], 0
jne 0x14003ad9a
lea rcx, str.Pdh.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x14008f568], rax
test rax, rax
je 0x14003ad9a
lea rdx, str.PdhCloseQuery
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14008f568]
lea rdx, str.PdhOpenQueryW
mov qword [0x140087c20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14008f568]
lea rdx, str.PdhAddCounterW
mov qword [0x140087c28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14008f568]
lea rdx, str.PdhCollectQueryData
mov qword [0x140087c30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14008f568]
lea rdx, str.PdhGetFormattedCounterValue
mov qword [0x140087c38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x140087c20], 0
mov qword [0x140087c40], rax
je 0x14003ad8f
cmp qword [0x140087c28], 0
je 0x14003ad8f
cmp qword [0x140087c30], 0
je 0x14003ad8f
cmp qword [0x140087c38], 0
je 0x14003ad8f
test rax, rax
jne 0x14003ad9a
mov qword [0x14008f568], 0
add rsp, 0x28
ret
Function at 0x140046b54
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400468b8

Function at 0x14004b17c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14004b01c
call fcn.14004285c
mov dword [rax], 0x16
call fcn.14004270c
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14004b004
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x14004b004
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x14004b04e
lock or dword [rax + 0x14], 0x10
jmp 0x14004b004
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x14004b06b
mov rcx, qword [rbp + 0x10]
call fcn.1400515ac
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14004942c
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.14004aa54
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x14004b0c2
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x14004b004
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14004b12e
mov rcx, qword [rbp + 0x10]
call fcn.14004942c
cmp eax, 0xffffffff
je 0x14004b115
mov rcx, qword [rbp + 0x10]
call fcn.14004942c
cmp eax, 0xfffffffe
je 0x14004b115
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14004942c
movsxd rdi, eax
lea rsi, [0x14009a370]
mov rcx, rbx
sar rdi, 6
call fcn.14004942c
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x14004b11c
lea rax, [0x14007c960]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14004b12e
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x14004b164
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x14004b160
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x14004b160
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14004b007
jmp 0x14004afd4
Function at 0x140019e70
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov r12, rdx
mov rsi, rcx
xor r13d, r13d
mov dword [rbp - 0x49], r13d
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x39], rcx
lea rdi, vtable.CVolObject.0
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], r13
mov qword [rbp - 0x29], r13
lea rax, vtable.CWString.0
mov qword [rbp - 0x39], rax
lea rax, [rbp - 0x19]
mov qword [rbp + 0x6f], rax
mov qword [rbp - 0x19], rcx
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], r13
lea rbx, vtable.CVolMem.0
mov qword [rbp - 0x19], rbx
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 7], r13
mov qword [rbp + 0x17], 0x40
mov qword [rbp - 0x21], r13
mov qword [rbp + 0x17], 0xfe
mov rcx, rdx
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov r14d, eax
test eax, eax
jne 0x140019f7a
mov rax, qword [rbp - 0x21]
test rax, rax
jne 0x140019f33
lea rax, [0x1401eac10]
cmp qword [rbp + 0xf], r13
cmovne rax, qword [rbp - 1]
mov rdx, rax
mov rcx, rsi
call fcn.140006be0
mov dword [rbp - 0x49], 1
lea rax, [rbp - 0x19]
mov qword [rbp + 0x6f], rax
mov qword [rbp - 0x19], rbx
mov rdx, qword [rbp - 1]
test rdx, rdx
je 0x140019f65
lea rcx, [rbp - 0x19]
mov rax, qword [rbp - 0x19]
call qword [rax + 0x18]
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 7], r13
mov qword [rbp - 0x19], rdi
jmp 0x14001a067
inc r14d
movsxd r15, r14d
mov eax, 2
mul r15
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1401b0f3c
mov rbx, rax
test r14d, r14d
je 0x140019fb7
movzx eax, r13w
mov rdi, rbx
mov rcx, r15
rep stosw word [rdi], ax
lea rdi, vtable.CVolObject.0
mov r8d, r14d
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov qword [rbp - 0x21], r13
mov rdx, qword [rbp - 1]
test rdx, rdx
je 0x140019fde
lea rcx, [rbp - 0x19]
mov rax, qword [rbp - 0x19]
call qword [rax + 0x18]
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 7], r13
cmp word [rbx], 0
je 0x140019ffc
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.1400c65f0
mov rcx, rbx
call fcn.1401b0f08
mov rax, qword [rbp - 0x21]
test rax, rax
jne 0x14001a01e
lea rax, [0x1401eac10]
cmp qword [rbp + 0xf], 0
cmovne rax, qword [rbp - 1]
mov rdx, rax
mov rcx, rsi
call fcn.140006be0
mov dword [rbp - 0x49], 1
lea rax, [rbp - 0x19]
mov qword [rbp + 0x6f], rax
lea rax, vtable.CVolMem.0
mov qword [rbp - 0x19], rax
mov rdx, qword [rbp - 1]
test rdx, rdx
je 0x14001a057
lea rcx, [rbp - 0x19]
mov rax, qword [rbp - 0x19]
call qword [rax + 0x18]
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 7], r13
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x39], rdi
mov rax, rsi
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001a2e0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov rcx, rbx
mov esi, eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, 1
mov edx, esi
mov ecx, eax
mov edi, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetActiveWindow]
xor r8d, r8d
mov edx, esi
mov ecx, edi
mov rbx, rax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001a730
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x14024e010]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rbx, rcx
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x20], rcx
lea r14, vtable.CVolObject.0
mov qword [rsp + 0x20], r14
xor esi, esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rsi
lea rax, vtable.CWString.0
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
lea r15, vtable.CVolMem.0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], 0x40
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x70], 0xfe
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0x6c]
call fcn.1401b2ee0
mov dword [rbp - 0x70], 0x238
xor edx, edx
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14001a8e7
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14001a8de
nop dword [rax + rax]
mov rax, rsi
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x14001a854
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x40]
call qword [rax + 0x18]
mov rax, qword [rsp + 0x38]
mov rcx, rsi
mov qword [rsp + 0x58], rcx
mov rdx, rsi
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x60], rsi
cmp word [rbp - 0x44], cx
je 0x14001a88c
lea rdx, [rbp - 0x44]
lea rcx, [rsp + 0x40]
call fcn.1400c65f0
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x14001a89f
lea rax, [0x1401eac10]
test rdx, rdx
cmovne rax, rcx
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jne 0x14001a8b9
cmp qword [rbx + 0x48], rcx
lea rcx, [0x1401eac10]
je 0x14001a8b9
mov rcx, qword [rbx + 0x38]
mov rdx, rax
call fcn.1401baff8
mov rcx, rdi
test eax, eax
je 0x14001a956
lea rdx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14001a830
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, esi
lea rax, [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], r15
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x14001a90f
lea rcx, [rsp + 0x40]
mov r8, qword [rsp + 0x40]
call qword [r8 + 0x18]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x20], r14
mov eax, ebx
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1401b0930
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ebx, dword [rbp - 0x68]
jmp 0x14001a8e9
Function at 0x14001b510
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov r15, rdx
mov r14, rcx
xor r12d, r12d
mov dword [rbp - 0x49], r12d
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x39], rcx
lea r13, vtable.CVolObject.0
mov qword [rbp - 0x39], r13
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], r12
lea rax, vtable.CWString.0
mov qword [rbp - 0x39], rax
lea rax, [rbp - 0x19]
mov qword [rbp + 0x6f], rax
mov qword [rbp - 0x19], rcx
mov qword [rbp - 0x19], r13
mov qword [rbp - 0x11], r12
mov qword [rbp - 9], r12
lea rdi, vtable.CVolMem.0
mov qword [rbp - 0x19], rdi
mov qword [rbp - 1], r12
mov qword [rbp + 0xf], r12
mov qword [rbp + 7], r12
mov qword [rbp + 0x17], 0x40
mov qword [rbp - 0x21], r12
mov qword [rbp + 0x17], 0xfe
xor r9d, r9d
xor r8d, r8d
lea edx, [r12 + 0xe]
mov rcx, r15
call qword [sym.imp.USER32.dll_SendMessageW]
lea rsi, [rax + 2]
mov eax, 2
mul rsi
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1401b0f3c
mov rbx, rax
test rsi, rsi
je 0x14001b5f9
movzx eax, r12w
mov rdi, rbx
mov rcx, rsi
rep stosw word [rdi], ax
lea rdi, vtable.CVolMem.0
mov r9, rbx
mov r8, rsi
mov edx, recv
mov rcx, r15
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rbp - 0x21], r12
mov rdx, qword [rbp - 1]
test rdx, rdx
je 0x14001b625
lea rcx, [rbp - 0x19]
mov rax, qword [rbp - 0x19]
call qword [rax + 0x18]
mov qword [rbp - 1], r12
mov qword [rbp + 0xf], r12
mov qword [rbp + 7], r12
cmp word [rbx], 0
je 0x14001b643
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.1400c65f0
mov rcx, rbx
call fcn.1401b0f08
mov rax, qword [rbp - 0x21]
test rax, rax
jne 0x14001b665
lea rax, [0x1401eac10]
cmp qword [rbp + 0xf], 0
cmovne rax, qword [rbp - 1]
mov rdx, rax
mov rcx, r14
call fcn.140006be0
mov dword [rbp - 0x49], 1
lea rax, [rbp - 0x19]
mov qword [rbp + 0x6f], rax
mov qword [rbp - 0x19], rdi
mov rdx, qword [rbp - 1]
test rdx, rdx
je 0x14001b697
lea rcx, [rbp - 0x19]
mov rax, qword [rbp - 0x19]
call qword [rax + 0x18]
mov qword [rbp - 1], r12
mov qword [rbp + 0xf], r12
mov qword [rbp + 7], r12
mov qword [rbp - 0x19], r13
mov qword [rbp - 0x39], r13
mov rax, r14
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a52b0
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
mov eax, 0x5068
call fcn.1401ccd80
sub rsp, rax
mov rax, qword [0x14024e010]
xor rax, rsp
mov qword [rsp + 0x5050], rax
mov r10, r9
mov r11, r8
mov r8, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rcx
mov rsi, qword [rsp + 0x50b0]
xor ebp, ebp
mov dword [rsp + 0x30], ebp
lea rcx, vtable.CVolObject.0
mov qword [rbx], rcx
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
lea rax, vtable.CWString.0
mov qword [rbx], rax
lea rdi, [rbx + 0x20]
mov qword [rsp + 0x40], rdi
mov qword [rdi], rcx
mov qword [rdi + 8], rbp
mov qword [rdi + 0x10], rbp
lea rax, vtable.CVolMem.0
mov qword [rdi], rax
mov qword [rdi + 0x18], rbp
mov qword [rdi + 0x28], rbp
mov qword [rdi + 0x20], rbp
mov qword [rdi + 0x30], 0x40
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x50], 0xfe
mov dword [rsp + 0x30], 1
mov r9, qword [rdx + 0x18]
mov eax, ebp
test r9, r9
je 0x1400a5369
cmp word [r9], bp
sete al
jmp 0x1400a5371
cmp qword [rdx + 0x48], 2
setle al
test eax, eax
jne 0x1400a54c4
mov rcx, qword [r11 + 0x18]
mov eax, ebp
test rcx, rcx
je 0x1400a538c
cmp word [rcx], bp
sete al
jmp 0x1400a5394
cmp qword [r11 + 0x48], 2
setle al
test eax, eax
jne 0x1400a54c4
mov rdx, qword [r10 + 0x18]
mov eax, ebp
test rdx, rdx
je 0x1400a53af
cmp word [rdx], bp
sete al
jmp 0x1400a53b7
cmp qword [r10 + 0x48], 2
setle al
test eax, eax
jne 0x1400a54c4
mov word [rsp + 0x50], bp
test r9, r9
jne 0x1400a53da
cmp qword [r8 + 0x48], r9
lea r9, [0x1401eac10]
je 0x1400a53da
mov r9, qword [r8 + 0x38]
mov r8, qword [rsi + 0x18]
test r8, r8
jne 0x1400a53f4
cmp qword [rsi + 0x48], r8
lea r8, [0x1401eac10]
je 0x1400a53f4
mov r8, qword [rsi + 0x38]
test rdx, rdx
jne 0x1400a540a
cmp qword [r10 + 0x48], rdx
lea rdx, [0x1401eac10]
je 0x1400a540a
mov rdx, qword [r10 + 0x38]
test rcx, rcx
jne 0x1400a5420
cmp qword [r11 + 0x48], rcx
lea rcx, [0x1401eac10]
je 0x1400a5420
mov rcx, qword [r11 + 0x38]
mov qword [rsp + 0x28], r9
mov dword [rsp + 0x20], 0x2800
lea r9, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x1400a5451
cmp qword [rbx + 0x48], rax
je 0x1400a545b
cmp qword [rdi + 0x28], rax
je 0x1400a545b
mov rax, qword [rdi + 0x18]
lea rcx, [rsp + 0x50]
cmp rcx, rax
je 0x1400a54c4
mov qword [rbx + 0x18], rbp
mov rdx, qword [rdi + 0x18]
test rdx, rdx
je 0x1400a5471
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
mov qword [rdi + 0x18], rbp
mov qword [rdi + 0x28], rbp
mov qword [rdi + 0x20], rbp
cmp word [rsp + 0x50], 0
je 0x1400a54c4
lea rcx, [rsp + 0x50]
mov rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x1400a5491
lea rsi, [rax*2 + 2]
test rsi, rsi
jle 0x1400a54c4
mov rdx, rsi
mov rcx, rdi
call fcn.1400c6510
mov r8, rsi
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1401b2830
mov rax, rbx
mov rcx, qword [rsp + 0x5050]
xor rcx, rsp
call fcn.1401b0930
add rsp, 0x5068
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400a6310
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14024e010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x20]
lea rbx, [rcx + 0x20]
lea rdx, [rcx + 0x18]
xor ebp, ebp
test rcx, rcx
mov esi, r8d
mov rcx, rbx
cmove rdx, rbp
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test eax, eax
je 0x1400a63e4
mov rdi, qword [0x140251cd8]
test rdi, rdi
jne 0x1400a6373
cmp qword [0x140251d08], rbp
lea rdi, [0x1401eac10]
cmovne rdi, qword [0x140251cf8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
test eax, eax
je 0x1400a63e4
mov r8d, esi
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.1400c9df0
test rax, rax
je 0x1400a63e4
mov rcx, qword [rbx + 0x20]
lea rdx, [rsp + 0x20]
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1400a63dc
mov rdx, qword [rbx + 0x10]
mov r9d, 0x21
mov rcx, qword [rbx + 0x20]
mov r8d, 0x8078
call qword [sym.imp.WS2_32.dll_WSAAsyncSelect]
cmp eax, 0xffffffff
je 0x1400a63dc
mov dword [rbx + 0x28], 1
mov eax, 1
jmp 0x1400a63e6
mov rcx, rbx
call fcn.1400ca050
mov eax, ebp
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401b0930
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400b8bc0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x30
mov rsi, rdx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov rdx, qword [rcx + 0x18]
mov rdi, qword [rdx + 0x80]
mov rdi, qword [rdi]
test rdi, rdi
je 0x1400b8cb3
call fcn.140006410
mov rcx, rax
test rax, rax
je 0x1400b8ce9
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebp, [rax + 1]
test ebp, ebp
js 0x1400b8cde
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, ebp
or eax, ecx
jge 0x1400b8c4f
mov edx, ebp
lea rcx, [rsp + 0x50]
call fcn.1400b2530
mov rbx, qword [rsp + 0x50]
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, 0xffffffff
jne 0x1400b8c6f
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1401bad08
test eax, eax
js 0x1400b8cde
cmp eax, dword [rbx - 0xc]
jg 0x1400b8cde
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r14w
mov rdx, rbx
mov rcx, rsi
call fcn.140006be0
mov dword [rsp + 0x20], 1
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400b8cc8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400b8cc8
add rdx, 0x10
mov rcx, rsi
call fcn.140006e10
nop
mov dword [rsp + 0x20], 1
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80070057
call fcn.1400b3000
nop
mov ecx, 0x80004005
call fcn.1400b3000
int3
Function at 0x1400b93c0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x60]
mov r10, r9
mov r11, rdx
cmp r8d, 4
jne 0x1400b93e0
lea rbx, str.open
jmp 0x1400b93f1
xor ebx, ebx
lea rdx, str.print
cmp r8d, 5
cmove rbx, rdx
mov rdx, qword [rax + 0x18]
test rdx, rdx
jne 0x1400b940b
cmp qword [rax + 0x48], rdx
lea rdx, [0x1401eac10]
je 0x1400b940b
mov rdx, qword [rax + 0x38]
mov r9, qword [r9 + 0x18]
test r9, r9
jne 0x1400b9425
cmp qword [r10 + 0x48], r9
lea r9, [0x1401eac10]
je 0x1400b9425
mov r9, qword [r10 + 0x38]
mov r8, qword [r11 + 0x18]
test r8, r8
jne 0x1400b943f
cmp qword [r11 + 0x48], r8
lea r8, [0x1401eac10]
je 0x1400b943f
mov r8, qword [r11 + 0x38]
mov rax, qword [rcx + 0x18]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rdx
mov rdx, rbx
mov rcx, qword [rax + 0x80]
mov rcx, qword [rcx]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
add rsp, 0x30
pop rbx
ret