joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10000f4cc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x10000f513
cmp rcx, 0xffffffffffffffff
je 0x10000f513
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10000f511
cmp dword [rcx + 0x3c], edx
jl 0x10000f511
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10000f511
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x10000f513
mov rax, rdx
add rsp, 0x18
ret

Function at 0x10000f5f0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x100090120]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call sub.msvcrt.dll_memset
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x100000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x100023aad
cmp dword [rsp + 0x24], 5
jb 0x10000f68b
jmp 0x10000f687
mov byte [rbx + 0x18], sil
lea rax, [0x10006aca0]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.100007da0
movzx ecx, byte [0x1000900e8]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x1000900e8], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.100001100
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
cmp dword [rsp + 0x30], esi
jne 0x10000f68b
cmp dword [rsp + 0x24], 4
ja 0x10000f687
jne 0x10000f68b
cmp dword [rsp + 0x28], 0
ja 0x10000f687
jmp 0x10000f68b
Function at 0x100016280
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x290
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x100090120]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, rdx
xor esi, esi
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x50], rsi
mov rax, qword [0x100091250]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x30]
call fcn.100016344
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.10000370c
nop
lea rcx, [rsp + 0x30]
call fcn.1000012a0
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, esi
je 0x1000224cc
lea rcx, [rsp + 0x40]
call fcn.1000012a0
mov al, 1
jmp 0x100016318
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.100001100
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov dword [rsp + 0x58], 0x208
lea rcx, [rsp + 0x30]
call fcn.10000581c
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x100022517
cmp dword [rsp + 0x38], 1
jne 0x100022517
mov bl, 1
jmp 0x10002251a
mov bl, sil
lea rcx, [rsp + 0x30]
call fcn.1000012a0
cmp bl, sil
je 0x1000225f4
mov word [rsp + 0x276], si
cmp word [rsp + 0x70], si
je 0x1000225f4
lea rcx, [rsp + 0x30]
call fcn.100007298
nop
lea rcx, [rsp + 0x30]
call fcn.100001674
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rcx, [rsp + 0x48]
call fcn.10000581c
nop
lea rcx, [rsp + 0x48]
call fcn.100001674
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.100010d50
mov rcx, rax
lea rdx, [rsp + 0x48]
call fcn.100011474
mov rbx, rax
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov r11d, 8
mov word [rbx], r11w
lea rcx, [rsp + 0x70]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx + 8], rax
cmp rax, rsi
jne 0x1000225df
mov eax, 0xa
mov word [rbx], ax
mov ecx, 0x8007000e
mov dword [rbx + 8], ecx
call fcn.1000242f0
nop
jmp 0x100023ea5
lea rcx, [rsp + 0x48]
call fcn.1000012a0
nop
lea rcx, [rsp + 0x30]
call fcn.1000012a0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x40]
call fcn.1000012a0
mov al, 1
jmp 0x100016318
Function at 0x100016498
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
cmp qword [rcx + 0x70], 0
lea rax, vtable.ATL::CThreadPool_class_CThreadPoolWorker__class_ATL::CRTThreadTraits__class_ATL::Win32WaitTraits_.0
mov rbx, rcx
mov qword [rcx], rax
je 0x100016512
add rcx, 0x28
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r8d, dword [rbx + 0x54]
xor edx, edx
mov rcx, rbx
call fcn.100001fc8
mov esi, dword [rbx + 0x18]
sub esi, 1
movsxd rdi, esi
jns 0x10001db65
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbx + 0x70], 0
lea rcx, [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
test rcx, rcx
jne 0x10001dbb1
mov rcx, qword [rbx + 0x10]
test rcx, rcx
jne 0x10001dbc1
and dword [rbx + 0x18], 0
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
test rdi, rdi
js 0x10001dbd1
cmp esi, dword [rbx + 0x18]
jge 0x10001dbd1
mov rax, qword [rbx + 0x10]
lea rdx, [rsp + 0x40]
mov rbp, qword [rax + rdi*8]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x40], 0x103
jne 0x10001db9a
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
dec esi
sub rdi, 1
js 0x1000164e5
jmp 0x10001db65
call qword [sym.imp.msvcrt.dll_free]
and qword [rbx + 8], 0
jmp 0x10001651f
call qword [sym.imp.msvcrt.dll_free]
and qword [rbx + 0x10], 0
jmp 0x10001652c
xor r9d, r9d
xor r8d, r8d
mov ecx, 0xc000008c
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]
Function at 0x100024bcc
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x30
cmp r9d, 0x1d
ja 0x100024c2a
je 0x100024d57
sub r9d, 0xf
je 0x100024c1f
sub r9d, 1
je 0x100024d57
sub r9d, 4
je 0x100024d57
sub r9d, 6
je 0x100024d57
cmp r9d, 1
jne 0x100024c60
add rcx, 0xffffffffffffff88
call fcn.100025a28
xor ebx, ebx
cmp al, bl
sete bl
mov eax, ebx
jmp 0x100024d5c
add rcx, 0xffffffffffffff88
call fcn.100025b90
jmp 0x100024c11
cmp r9d, 0x2b
je 0x100024d57
cmp r9d, 0x43
je 0x100024d57
cmp r9d, 0x8e9
jbe 0x100024c60
cmp r9d, 0x8eb
jbe 0x100024c59
cmp r9d, 0x8fc
jne 0x100024c60
xor eax, eax
jmp 0x100024d5c
movzx eax, word [rdx + 0x10]
cmp ax, 9
jne 0x100024cdf
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
cmp ax, bx
jge 0x100024d57
mov rcx, qword [0x100090140]
lea rdx, [rsp + 0x20]
call fcn.1000035f0
mov rcx, qword [rsp + 0x28]
cmp rcx, rbx
je 0x100024cb0
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x900
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x20]
lock add dword [rcx], 0xffffffff
jne 0x100024c59
mov rcx, qword [rsp + 0x28]
cmp rcx, rbx
je 0x100024cd0
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 8]
mov rcx, qword [rsp + 0x20]
call sub.msvcrt.dll_free
jmp 0x100024c59
cmp ax, 0x74
je 0x100024c59
cmp ax, 8
je 0x100024c59
cmp ax, 0x25
je 0x100024c59
cmp ax, 0x27
je 0x100024c59
cmp ax, 0x26
je 0x100024c59
cmp ax, 0x28
je 0x100024c59
cmp ax, 0x21
je 0x100024c59
cmp ax, 0x22
je 0x100024c59
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
cmp ax, bx
jl 0x100024c59
lea ecx, [rbx + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, bx
jl 0x100024c59
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x100028dc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12d, ecx
lea rcx, [0x1000921d0]
xor edx, edx
xor ebx, ebx
call fcn.100055ac0
lea r13d, [rbx + 1]
mov ebp, r13d
jmp 0x100028e9e
test rbx, rbx
jne 0x100028eaa
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, r13w
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rbx, rax
test rax, rax
je 0x100028e8d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100028e3a
xor ebx, ebx
jmp 0x100028e88
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x100028e36
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x100028e77
cmp rdi, r11
jae 0x100028e36
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x100028e65
cmp rdi, r11
jae 0x100028e36
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x100028eac
lea rcx, [0x1000921d0]
mov edx, ebp
call fcn.100055ac0
add ebp, r13d
mov rsi, rax
test rax, rax
jne 0x100028df7
xor esi, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rax, rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x10002d7ec
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x100090120]
xor rax, rsp
mov qword [rsp + 0x270], rax
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
mov rdi, rcx
mov rcx, qword [rcx]
lea rax, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x10002d8f0
test rcx, rcx
je 0x10002d866
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
test ebx, ebx
mov qword [rsp + 0x48], rcx
jmp 0x10002d88c
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.10002d7ec
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x10002d8f0
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10002d874
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x10002d8de
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x48], 0
mov rdx, rsi
mov rcx, rdi
call fcn.10002d950
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test rcx, rcx
je 0x10002d8fb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.100001100
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x10002e6a8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x100090120]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r12, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
cmp rax, rbx
jne 0x10002e71c
call fcn.10002c060
mov ebx, eax
jmp 0x10002e85d
mov r8, r12
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
cmp rax, rbx
jne 0x10002e73f
call fcn.10002c060
mov ebx, eax
jmp 0x10002e853
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rsp + 0x40], rax
cmp rax, rbx
jne 0x10002e764
call fcn.10002c060
mov ebx, eax
jmp 0x10002e853
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jae 0x10002e79d
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x10002e793
lea rcx, [rsp + 0x70]
call fcn.10002d264
nop
mov eax, 0x8007000e
jmp 0x10002e876
mov ecx, eax
cmp rcx, rbx
je 0x10002e7db
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x10002e7d1
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x10002e7db
lea rcx, [rsp + 0x70]
call fcn.10002ccd8
mov rax, qword [rsp + 0x70]
jmp 0x10002e7e5
mov ecx, 0x80070057
call fcn.1000242f0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x10002e7fc
cmp rax, rbx
jne 0x10002e808
mov ebx, 0x8007000e
jmp 0x10002e853
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
jne 0x10002e82f
call fcn.10002c060
mov ebx, eax
jmp 0x10002e853
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.10002e4e8
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x10002e874
lea rcx, [rsp + 0x70]
call fcn.10002d264
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.100001100
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret
Function at 0x1000341e0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x199], 0
mov rbx, rcx
je 0x10003421a
mov byte [rcx + 0x198], 1
xor edi, edi
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
ja 0x100034275
cmp byte [rbx + 0x199], 0
jne 0x1000341ff
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x10003427e
lea rdx, [rsp + 0x20]
call fcn.100035268
mov r8d, dword [rbx + 0x94]
lea rdx, str.X_a
mov rcx, qword [rax]
call fcn.100018160
mov rcx, qword [rsp + 0x20]
mov dword [rbx + 0x94], 0xfefefefe
test rcx, rcx
je 0x10003425d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x48]
mov dword [rax], 1
xor eax, eax
add rsp, 0x30
pop rdi
ret
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_exit]
int3
and dword [rsp + 0x40], 0
lea rdx, [0x1000788f0]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x1000347b0
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x30
mov r10, r8
mov rbx, rcx
test r9d, r9d
jne 0x10003484f
cmp byte [rcx + 0x198], r9b
jne 0x100034863
mov byte [rcx + 0x199], 1
mov rcx, qword [rcx + 0x98]
lea edx, [r9 + 5]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x138]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 8]
and dword [rsp + 0x20], 0
xor eax, eax
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], eax
call qword [sym.imp.USER32.dll_GetClientRect]
movzx eax, word [rsp + 0x28]
movzx r11d, word [rsp + 0x2c]
sub r11w, word [rsp + 0x24]
sub ax, word [rsp + 0x20]
mov rcx, qword [rbx + 8]
movzx r9d, r11w
movzx eax, ax
shl r9d, 0x10
or r9, rax
xor r8d, r8d
lea edx, [r8 + 5]
jmp 0x1000348c9
mov r8d, 0x64
cmp r9d, r8d
jne 0x100034863
mov byte [rcx + 0x199], 0
jmp 0x1000348ba
cmp byte [rcx + 0x199], 0
je 0x1000348b7
cmp byte [rcx + 0x198], 0
je 0x1000348b7
xor ecx, ecx
mov qword [rsp + 0x20], rcx
test r10, r10
je 0x10003489a
mov rax, qword [r10]
lea r8, [rsp + 0x20]
lea rdx, str.hX_a
mov rcx, r10
call qword [rax]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1000348cf
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1000348cf
movsxd r8, r9d
mov rcx, qword [rcx + 0x138]
mov edx, 0x402
xor r9d, r9d
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x10003ae08
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov rbx, r8
mov rsi, rcx
mov rdi, qword [rsp + 0x60]
and dword [rdi], 0
lea rdx, [0x100066a5c]
lea rcx, [rsp + 0x50]
call fcn.100001740
nop
movzx eax, bx
cmp eax, 9
je 0x10003aec7
cmp eax, 0xd
je 0x10003ae78
cmp eax, 0x26
je 0x10003ae6d
cmp eax, 0x28
je 0x10003ae62
cmp eax, 0x75
je 0x10003aec7
jmp 0x10003af01
mov dword [rdi], 1
jmp 0x10003af01
mov dword [rdi], 1
jmp 0x10003af01
mov edx, 0x9f
lea rcx, [rsp + 0x50]
call fcn.1000017cc
mov r9, rax
mov edx, 0xd
mov r8d, 0xa0
mov rcx, qword [rsi + 0x1c0]
call qword [sym.imp.USER32.dll_SendMessageW]
or edx, 0xffffffff
lea rcx, [rsp + 0x50]
call fcn.100001844
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, rsi
call 0x10003b2fc
mov dword [rdi], 1
jmp 0x10003af01
mov rax, qword [0x100090140]
mov rcx, qword [rax + 0x90]
test rcx, rcx
je 0x10003af13
call fcn.10000574c
test rax, rax
je 0x10003aefb
mov r9d, 1
xor r8d, r8d
mov edx, 0x900
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rdi], 1
movsxd rbx, dword [rdi]
lea rcx, [rsp + 0x50]
call fcn.1000012a0
mov rax, rbx
jmp 0x10003af2a
and dword [rsp + 0x60], 0
lea rdx, [0x1000788f0]
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll__CxxThrowException
nop
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x10003af40
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rsi, r8
mov rbp, rdx
mov r12, rcx
mov rcx, qword [r8 + 8]
test rcx, rcx
je 0x10003b0de
mov rcx, qword [rcx + 0x18]
test rcx, rcx
jne 0x10003af85
xor ebx, ebx
mov qword [rsp + 0x28], rbx
jmp 0x10003afa6
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x10003afa6
mov ecx, 0x8007000e
call fcn.1000242f0
nop
jmp 0x10003afa5
nop
test rbx, rbx
je 0x10003b073
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x10003b073
lea rdx, [0x100066a5c]
lea rcx, [rsp + 0x20]
call fcn.100001740
nop
mov edx, 0x9f
lea rcx, [rsp + 0x20]
call fcn.1000017cc
mov r9, rax
mov edx, 0xd
mov r8d, 0xa0
mov rcx, qword [r12 + 0x1c0]
call qword [sym.imp.USER32.dll_SendMessageW]
or edx, 0xffffffff
lea rcx, [rsp + 0x20]
call fcn.100001844
mov rdx, qword [rsp + 0x20]
mov rdi, rbx
sub rdi, rdx
movzx eax, word [rdx]
movzx ecx, word [rdx + rdi]
sub eax, ecx
jne 0x10003b028
add rdx, 2
test ecx, ecx
jne 0x10003b015
test eax, eax
je 0x10003b068
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rbx
lea rcx, [r12 + 0x220]
call fcn.100008590
mov r9, rbx
xor r8d, r8d
lea edx, [r8 + 0xc]
mov rcx, qword [r12 + 0x1c0]
call qword [sym.imp.USER32.dll_SendMessageW]
nop
lea rcx, [rsp + 0x20]
call fcn.1000012a0
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rax, qword [rbp]
lock add dword [rax], 0xffffffff
jne 0x10003b0ad
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x10003b09a
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
and qword [rbp + 8], 0
mov rcx, qword [rbp]
call sub.msvcrt.dll_free
and qword [rbp], 0
mov rax, qword [rsi]
lock add dword [rax], 0xffffffff
jne 0x10003b0da
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x10003b0c9
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
and qword [rsi + 8], 0
mov rcx, qword [rsi]
call sub.msvcrt.dll_free
and qword [rsi], 0
xor eax, eax
jmp 0x10003b0fb
and dword [rsp + 0x88], 0
lea rdx, [0x1000788f0]
lea rcx, [rsp + 0x88]
call sub.msvcrt.dll__CxxThrowException
nop
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x10003ba98
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
sub r8d, 0x4e
je 0x10003bad2
sub r8d, 0xc2
je 0x10003bac9
cmp r8d, 1
jne 0x10003bace
shr r9, 0x10
xor eax, eax
cmp r9w, ax
jne 0x10003bace
mov rdx, qword [rsp + 0x60]
call fcn.10003bcec
jmp 0x10003bace
call fcn.10003bb30
xor eax, eax
jmp 0x10003bb21
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x10], 0xffffff36
je 0x10003bb15
cmp dword [rax + 0x10], 0xfffffffc
je 0x10003baec
cmp dword [rax + 0x10], 0xfffffffe
jne 0x10003bace
mov r8, qword [rcx + 0x40]
mov rcx, qword [rcx + 0x38]
xor eax, eax
lea rdx, str.open
xor r9d, r9d
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10003bb1a
call fcn.10003bd7c
mov rax, 1
add rsp, 0x38
ret
Function at 0x10003eb3c
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x80
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x100090120]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
and dword [rsp + 0x20], 0
mov rax, qword [0x100091250]
mov qword [rcx], rax
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
mov r8d, 0x10
lea rdx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll__itow]
lea rdx, [0x10006e2b8]
mov rcx, rbx
call fcn.100002354
lea r8, [rsp + 0x40]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.10000592c
nop
mov rdx, rax
mov rcx, rbx
call fcn.10000370c
nop
lea rcx, [rsp + 0x28]
call fcn.1000012a0
mov rax, rbx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.100001100
add rsp, 0x80
pop rbx
ret

Function at 0x10003f3a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x50], rbx
mov rax, qword [0x100090120]
xor rax, rbp
mov qword [rbp + 0x10], rax
mov rsi, qword [rbp + 0x60]
mov eax, edx
mov rdi, rcx
test edx, edx
je 0x10003f3fe
mov ecx, 0x23
lea rdx, [rbp + 2]
lea r8d, [rcx - 0x19]
mov word [rbp], cx
mov ecx, eax
call qword [sym.imp.msvcrt.dll__itow]
lea r8, [0x10006de28]
lea rdx, [rbp]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
jmp 0x10003f499
lea rcx, [0x10006de28]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9d, [rax + 1]
cmp r9d, 0x3fffffff
jg 0x10003f486
movsxd rax, r9d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x10003f431
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.100002240
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x10003f486
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
lea eax, [r9 + r9]
xor edx, edx
mov dword [rsp + 0x28], eax
lea r8, [0x10006de28]
lea ecx, [rdx + 3]
or r9d, 0xffffffff
mov byte [rbx], 0
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb r8, r8
and r8, rbx
jmp 0x10003f489
xor r8d, r8d
lea rdx, [0x10006d542]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
test rax, rax
jne 0x10003f4a5
xor eax, eax
jmp 0x10003f4d1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsi], eax
test eax, eax
je 0x10003f4a1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x10003f4a1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, qword [rbp + 0x10]
xor rcx, rbp
call fcn.100001100
mov rbx, qword [rbp + 0x50]
lea rsp, [rbp + 0x20]
pop rdi
pop rsi
pop rbp
ret