joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800179e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180087010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x180017a0d
xor eax, eax
jmp 0x180017b59
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180017a47
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x180017a47
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x180017b59
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x180017b4c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180017a8a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180017a99
movsx ecx, dil
jmp 0x180017af0
lea r8, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x41]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
call qword [rax + 0x38]
test eax, eax
js 0x180017b4c
cmp eax, 1
jle 0x180017b0a
cmp eax, 3
jne 0x180017b4c
lfence
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call fcn.18003e4d8
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180017b51
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180017b3a
lfence
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.180049390
cmp rsi, rax
jne 0x180017b4c
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov eax, edi
jne 0x180017b51
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18000d430
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180018c10
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x180018c32
xor eax, eax
add rsp, 0x20
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
je 0x180018cb6
lfence
mov rdi, r14
nop dword [rax]
mov rcx, rbx
call fcn.180016c50
test rax, rax
jle 0x180018c8e
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.180033050
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x180018ca6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x180018cae
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x180018c50
sub r14, rdi
jmp 0x180018db3
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov qword [rsp + 0x50], r14
mov rdx, qword [rax]
test rdx, rdx
je 0x180018cd2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180018cd4
xor ecx, ecx
movsxd rax, ecx
mov rdi, r14
test ecx, ecx
je 0x180018d0e
cmp rax, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.180033050
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov qword [rsp + 0x50], rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
mov rdi, rbp
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x180018dab
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180018d49
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rdi, 0xfff
jbe 0x180018d87
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.180048e28
sub rbp, rax
add rsi, rax
mov qword [rsp + 0x50], rbp
mov rdi, rbp
cmp rax, 0xfff
jne 0x180018dab
cmp rbp, rax
ja 0x180018d52
test rdi, rdi
je 0x180018dab
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.180048e28
sub rdi, rax
mov qword [rsp + 0x50], rdi
lfence
sub r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x40]
mov rax, r14
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rsi
pop rbx
ret
Function at 0x180018e80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rbx, rcx
mov rdi, r8
je 0x180018f1a
test r8, r8
jle 0x180018f12
mov rcx, rbx
call fcn.180017160
test rax, rax
jle 0x180018ef0
mov rcx, qword [rbx + 0x40]
cmp rdi, rax
mov rsi, rdi
mov rdx, rbp
cmovge rsi, rax
mov r8, rsi
mov rcx, qword [rcx]
call fcn.180033050
mov rax, qword [rbx + 0x58]
sub rdi, rsi
sub dword [rax], esi
mov rcx, qword [rbx + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x180018f0a
mov rax, qword [rbx]
mov rcx, rbx
movzx edx, byte [rbp]
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180018f12
dec rdi
mov esi, 1
add rbp, rsi
test rdi, rdi
jg 0x180018eb2
sub r14, rdi
mov rax, r14
jmp 0x180018f96
mov rax, qword [rcx + 0x40]
mov r9, qword [rax]
test r9, r9
je 0x180018f2e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180018f30
xor ecx, ecx
movsxd rsi, ecx
test r14, r14
jle 0x180018f90
test ecx, ecx
jle 0x180018f69
cmp r14, rsi
mov rcx, r9
cmovl rsi, r14
mov r8, rsi
call fcn.180033050
mov rax, qword [rbx + 0x58]
sub r14, rsi
add rbp, rsi
sub dword [rax], esi
mov rcx, qword [rbx + 0x40]
movsxd rax, esi
add qword [rcx], rax
test r14, r14
jle 0x180018f90
cmp qword [rbx + 0x80], 0
je 0x180018f90
lfence
mov r9, qword [rbx + 0x80]
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.180049390
sub r14, rax
sub rdi, r14
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140001000
Capabilities:
Set file attributes
Timestomp file

Disassembly:
sub rsp, 0x78
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp ecx, 2
je 0x14000104b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001190
mov rcx, rax
lea rdx, [0x140001340]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140001400
add rsp, 0x78
ret
mov qword [rsp + 0x80], rbx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x70], rdi
mov rdi, qword [rdx + 8]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
add dword [rsp + 0x40], ebx
lea rcx, [rsp + 0x58]
add dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
add dword [rsp + 0x40], ebx
mov edx, 0x80
add dword [rsp + 0x44], eax
mov rcx, rdi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rbx, qword [rsp + 0x80]
test eax, eax
je 0x140001172
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000100
mov dword [rsp + 0x20], 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov rcx, rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x140001172
xor r9d, r9d
lea r8, [0x140003344]
lea rdx, [0x140003344]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x140001177
mov eax, 1
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140001400
add rsp, 0x78
ret
Function at 0x140001cdc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001d26
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d26
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001d26
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d26
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d26
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001d28
xor al, al
add rsp, 0x28
ret
Function at 0x140001150
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor esi, esi
mov ebp, 1
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov edx, 0x40000000
mov r8d, ebp
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 2
xor bl, bl
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rsp + 0x58]
lea rdx, [0x140044010]
cmp rax, 0xffffffffffffffff
mov r8d, 0x418b2
mov rcx, rax
mov rdi, rax
mov qword [rsp + 0x20], rsi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
test eax, eax
cmovne ebx, ebp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov al, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400011e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor esi, esi
mov ebp, 1
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov edx, 0x40000000
mov r8d, ebp
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 2
xor bl, bl
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rsp + 0x58]
lea rdx, [0x1400858d0]
cmp rax, 0xffffffffffffffff
mov r8d, 0x29000
mov rcx, rax
mov rdi, rax
mov qword [rsp + 0x20], rsi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
test eax, eax
cmovne ebx, ebp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov al, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140001270
Capabilities:
Check for debugger via api

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
mov dword [rsp + 0x30], ebx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov r8d, eax
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x30], 1
sete bl
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140001550
Capabilities:
Create process on windows
Self delete
Terminate process

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1400afc50]
xor rax, rsp
mov qword [rsp + 0x140], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x100
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov r8, qword [0x1400b5180]
xor r9d, r9d
lea edx, [r9 + 1]
lea ecx, [rdx + 3]
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov r8, qword [0x1400b5180]
lea rdx, str._c_del__q__s
lea rcx, [rsp + 0x30]
call fcn.140019b00
xor r11d, r11d
lea r9, [rsp + 0x30]
mov dword [rsp + 0x28], r11d
lea r8, str.cmd.exe
lea rdx, str.open
xor ecx, ecx
mov qword [rsp + 0x20], r11
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1400056b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rdi
sub rsp, 0x90
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1400afc50]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov byte [rsp + 0x50], 0x43
mov byte [rsp + 0x51], 0x3a
mov byte [rsp + 0x52], 0x2f
mov byte [rsp + 0x53], 0x55
mov byte [rsp + 0x54], 0x73
mov byte [rsp + 0x55], 0x65
mov byte [rsp + 0x56], 0x72
mov byte [rsp + 0x57], 0x73
mov byte [rsp + 0x58], 0x2f
mov byte [rsp + 0x59], 0x50
mov byte [rsp + 0x5a], 0x75
mov byte [rsp + 0x5b], 0x62
mov byte [rsp + 0x5c], 0x6c
mov byte [rsp + 0x5d], 0x69
mov byte [rsp + 0x5e], 0x63
mov byte [rsp + 0x5f], 0x2f
mov byte [rsp + 0x60], 0x44
mov byte [rsp + 0x61], 0x6f
mov byte [rsp + 0x62], 0x77
mov byte [rsp + 0x63], 0x6e
mov byte [rsp + 0x64], 0x6c
mov byte [rsp + 0x65], 0x6f
mov byte [rsp + 0x66], 0x61
mov byte [rsp + 0x67], 0x64
mov byte [rsp + 0x68], 0x73
mov byte [rsp + 0x69], 0x2f
mov byte [rsp + 0x6a], 0x53
mov byte [rsp + 0x6b], 0x65
mov byte [rsp + 0x6c], 0x72
mov byte [rsp + 0x6d], 0x76
mov byte [rsp + 0x6e], 0x65
mov byte [rsp + 0x6f], 0x72
mov byte [rsp + 0x70], 0x68
mov byte [rsp + 0x71], 0x65
mov byte [rsp + 0x72], 0x6c
mov byte [rsp + 0x73], 0x70
mov byte [rsp + 0x74], 0x2e
mov byte [rsp + 0x75], 0x65
mov byte [rsp + 0x76], 0x78
mov byte [rsp + 0x77], 0x65
mov byte [rsp + 0x78], 0
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x30], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.140002d10
nop
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rcx, qword [rsp + 0x30]
xor edx, edx
call fcn.14001b6a4
cmp eax, 0xffffffff
jne 0x140005815
call fcn.140004a50
nop
cmp qword [rsp + 0x48], 0x10
jb 0x140005811
mov rcx, qword [rsp + 0x30]
call fcn.140006994
xor eax, eax
jmp 0x14000581b
call fcn.140001550
nop
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140019ae0
add rsp, 0x90
pop rdi
ret

Function at 0x140006050
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140006083
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400060c7
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x1400060c2
cmp rbx, r11
jae 0x1400060c7
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x1400060b0
cmp rbx, r11
jb 0x1400060cb
xor eax, eax
jmp 0x1400060d7
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000a78c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CAboutDlg.virtual_640
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xb0], rdx
test rdx, 0xffffffffffff0000
jne 0x14000a7cb
cmp dword [rcx + 0xa8], 0
jne 0x14000a7cb
movzx eax, dx
mov dword [rcx + 0xa8], eax
call fcn.140013834
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.14000a730
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b6d8
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.140014694
mov rsi, rax
test rax, rax
je 0x14000b754
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x14000b74f
cmp dword [rbx], 0x40
jb 0x14000b74f
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageA]
bt rax, 0xd
jb 0x14000b74f
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x14000b758
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140011c34
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x140011c9c
call fcn.140013834
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x140011c9c
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x140011cbe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.14001164c
mov esi, eax
test rdi, rdi
je 0x140011cbc
test rbx, rbx
je 0x140011cbc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x140019f2c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.14001ead4
nop
cmp dword [0x1400b5198], 1
je 0x140019ed8
mov dword [0x1400b5194], 1
mov byte [0x1400b5190], r12b
test ebx, ebx
jne 0x140019ec4
mov rcx, qword [0x1400b74c0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140019eb1
mov rcx, qword [0x1400b74b8]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140019e50
call fcn.14001e304
cmp qword [rdi], rax
jne 0x140019e50
jmp 0x140019e36
cmp rdi, rsi
jb 0x140019eb1
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.14001e304
mov qword [rdi], rax
call rbx
mov rcx, qword [0x1400b74c0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x1400b74b8]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140019e8f
cmp r13, rax
je 0x140019eaf
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140019e36
lea rdx, [0x140033a08]
lea rcx, [0x1400339f0]
call fcn.140019c80
lea rdx, [0x140033a18]
lea rcx, [0x140033a10]
call fcn.140019c80
nop
test r12d, r12d
je 0x140019ee7
mov ecx, 8
call fcn.14001e9d4
test r12d, r12d
jne 0x140019f12
mov dword [0x1400b5198], 1
lea ecx, [r12 + 8]
call fcn.14001e9d4
mov ecx, r15d
call fcn.140019c14
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140019da0

Function at 0x140019f38
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140019da0

Function at 0x14001b614
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
test rcx, rcx
jne 0x14001b64e
call fcn.14001c064
and dword [rax], 0
call fcn.14001c044
and qword [rsp + 0x20], 0
mov ebx, 0x16
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], ebx
call fcn.14001a764
mov eax, ebx
jmp 0x14001b69e
test edx, 0xfffffff9
jne 0x14001b621
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14001b677
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001c084
call fcn.14001c044
mov eax, dword [rax]
jmp 0x14001b69e
test al, 0x10
jne 0x14001b69c
test al, 1
je 0x14001b69c
test bl, 2
je 0x14001b69c
call fcn.14001c064
mov dword [rax], 5
call fcn.14001c044
mov dword [rax], 0xd
jmp 0x14001b66e
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x14001d597
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400afc50]
jne 0x140019afa
rol rcx, 0x10
test cx, 0xffff
jne 0x140019af6
repz ret
ror rcx, 0x10
jmp 0x14001d4f0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400b5270]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1400b5368]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14001d575
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400b5270]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14001d597
mov rax, qword [rsp + 0x88]
mov qword [0x1400b5368], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400b5308], rax
mov rax, qword [0x1400b5368]
mov qword [0x1400b51e0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400b52f0], rax
mov dword [0x1400b51d0], 0xc0000409
mov dword [0x1400b51d4], 1
mov rax, qword [0x1400afc50]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400afc58]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400b5268], eax
mov ecx, 1
call fcn.14002092c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400381c8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400b5268], 0
jne 0x14001d61e
mov ecx, 1
call fcn.14002092c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret