joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021b40
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
test r8d, r8d
je 0x140021cf5
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x28], 0
mov rsi, rdx
mov edi, r8d
mov rbx, rcx
jne 0x140021ce6
test byte [rcx], 0x10
je 0x140021c77
mov rcx, qword [rcx + 0x58]
mov rax, rcx
test rcx, rcx
je 0x140021b95
cmp dword [rbx + 0x60], edi
jae 0x140021b95
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
mov qword [rbx + 0x58], 0
test rax, rax
jne 0x140021bbf
lea eax, [rdi + rdi]
xor ecx, ecx
mov edx, eax
mov dword [rbx + 0x60], eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rbx + 0x58], rax
test rax, rax
jne 0x140021bbf
mov dword [rbx + 0x28], 2
jmp 0x140021cd7
mov qword [rsp + 0x40], rbp
mov r8, rdi
mov rdx, rsi
mov rcx, rax
mov rbp, rdi
call sub.VCRUNTIME140.dll_memcpy
test edi, edi
je 0x140021c6e
xor r11d, r11d
lea rsi, [0x1400cf5d0]
nop word [rax + rax]
mov rax, qword [rbx + 0x58]
lea r11, [r11 + 1]
mov r8d, dword [rbx + 0x50]
mov edx, dword [rbx + 0x48]
mov r9d, r8d
mov ecx, edx
and r9d, 0xfffd
movsx r10, byte [r11 + rax - 1]
or r9d, 2
xor rcx, r10
shr edx, 8
movzx eax, cl
mov ecx, dword [rsi + rax*4]
xor ecx, edx
movzx eax, cl
add eax, dword [rbx + 0x4c]
mov dword [rbx + 0x48], ecx
imul eax, eax, 0x8088405
movzx ecx, r8b
shr r8d, 8
inc eax
mov dword [rbx + 0x4c], eax
shr rax, 0x18
xor rcx, rax
mov eax, dword [rsi + rcx*4]
mov ecx, r9d
xor ecx, 1
xor eax, r8d
imul ecx, r9d
mov dword [rbx + 0x50], eax
mov rax, qword [rbx + 0x58]
shr ecx, 8
xor cl, r10b
mov byte [r11 + rax - 1], cl
sub rbp, 1
jne 0x140021bf0
mov rsi, qword [rbx + 0x58]
mov rbp, qword [rsp + 0x40]
test byte [rbx], 1
je 0x140021ca8
mov rcx, qword [rbx + 0x38]
lea rax, [rcx + rdi]
cmp rax, qword [rbx + 0x40]
jb 0x140021c93
mov dword [rbx + 0x28], reloc.WSOCK32.dll_inet_ntoa
jmp 0x140021cd7
add rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx + 0x38], rdi
jmp 0x140021cd7
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x50]
mov r8d, edi
mov qword [rsp + 0x20], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140021cd0
cmp dword [rsp + 0x50], edi
je 0x140021cd7
mov dword [rbx + 0x28], 3
test dword [rbx], 0x40000000
je 0x140021ce6
mov dword [rbx + 0x28], reloc.OLEAUT32.dll_SafeArrayLock
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140021e30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov eax, dword [rcx]
mov rbp, rdx
mov rdi, rcx
bt eax, 0x1e
jae 0x140021e66
mov dword [rcx + 0x28], reloc.OLEAUT32.dll_SafeArrayLock
xor eax, eax
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test al, al
jns 0x140021ebf
mov rcx, qword [rcx + 0x98]
mov rsi, qword [rdi + 0x90]
cmp rcx, rsi
jae 0x140021ee5
sub esi, ecx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], esi
mov eax, esi
cmp esi, r8d
jbe 0x140021e9a
mov esi, r8d
mov dword [rsp + 0x40], r8d
mov eax, r8d
mov rdx, qword [rdi + 0x88]
add rdx, rcx
mov r8d, eax
mov rcx, rbp
mov ebx, eax
call sub.VCRUNTIME140.dll_memcpy
add qword [rdi + 0x98], rbx
mov rbx, qword [rsp + 0x48]
jmp 0x140021efb
mov rcx, qword [rcx + 0x88]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140021ef7
mov dword [rdi + 0x28], 7
xor eax, eax
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov esi, dword [rsp + 0x40]
mov ecx, esi
mov r8d, esi
add qword [rdi + 0x78], rcx
mov rdx, rbp
mov ecx, dword [rdi + 0x80]
call fcn.140021860
mov rbp, qword [rsp + 0x50]
mov dword [rdi + 0x80], eax
mov eax, esi
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400238f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov r8, qword [rcx]
mov r14, rcx
movabs rcx, 0xffffffff00000000
movzx eax, word [r8 + 0x14]
mov r12, qword [r8 + 0x30]
mov r9d, dword [r14 + 0x70]
and r12, rcx
dec r9
mov r11d, dword [rax + r8 + 0x20]
not r9
mov ecx, dword [rax + r8 + 0x28]
or r11, r12
and r9, r11
mov qword [rsp + 0x20], r11
mov qword [rsp + 0x28], r9
test ecx, ecx
jne 0x140023958
mov edx, dword [rax + r8 + 0x3c]
test dl, 0x40
je 0x140023950
mov ecx, dword [r8 + 0x20]
jmp 0x140023958
test dl, dl
jns 0x140023958
mov ecx, dword [r8 + 0x24]
mov edx, dword [rax + r8 + 0x3c]
mov r13d, 1
mov r15d, r13d
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbp
mov r10d, ecx
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], 0
cmp r13w, word [r8 + 6]
jae 0x140023a59
lea rdi, [r8 + 0x64]
add rdi, rax
nop word [rax + rax]
mov esi, dword [rdi - 0x1c]
mov ebx, dword [r14 + 0x70]
or rsi, r12
mov eax, dword [rdi - 0x14]
neg rbx
and rbx, rsi
test eax, eax
jne 0x1400239dc
mov ecx, dword [rdi]
test cl, 0x40
je 0x1400239d4
mov eax, dword [r8 + 0x20]
jmp 0x1400239dc
test cl, cl
jns 0x1400239dc
mov eax, dword [r8 + 0x24]
mov ebp, eax
cmp r9, rbx
je 0x140023a20
lea rax, [r10 + r11]
cmp rax, rbx
ja 0x140023a20
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.140023830
test eax, eax
je 0x140023afc
mov edx, dword [rdi]
mov r11, rsi
mov r8, qword [r14]
mov r9, rbx
mov qword [rsp + 0x20], rsi
mov r10d, ebp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rbp
jmp 0x140023a40
mov ecx, dword [rdi]
mov eax, ecx
and eax, edx
or edx, ecx
bt eax, 0x19
jb 0x140023a32
btr edx, 0x19
mov r10, rbp
sub r10, r11
add r10, rsi
mov qword [rsp + 0x30], r10
movzx eax, word [r8 + 6]
inc r15d
add rdi, 0x28
mov dword [rsp + 0x38], edx
cmp r15d, eax
jl 0x1400239b0
test r10, r10
je 0x140023a7d
bt edx, 0x19
jae 0x140023aa7
cmp r11, r9
jne 0x140023a7d
mov r9, qword [r14 + 0x60]
mov r8d, 0x4000
mov rdx, r10
mov rcx, r11
call qword [r14 + gethostname]
mov eax, r13d
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
ret
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x70]
mov rax, rcx
shr rcx, 0x1e
shr rax, 0x1d
and ecx, r13d
and eax, r13d
lea rcx, [rcx + rax*2]
mov eax, edx
shr rax, 0x1f
lea rcx, [rax + rcx*2]
lea rax, [0x1400cdd18]
mov eax, dword [rax + rcx*4]
mov r8d, eax
bts r8d, 9
mov rcx, r11
and edx, 0x4000000
mov rdx, r10
cmove r8d, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140023a7d
xor eax, eax
jmp 0x140023a80
Function at 0x140024ab0
Capabilities:
Accept command line arguments
Create thread

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x20], rdi
mov rdi, rdx
mov qword [rbp + 0x28], r14
mov r14, rcx
test rcx, rcx
je 0x140024c9d
cmp dword [rcx + 0x28], 0
jne 0x140024c9d
cmp qword [rcx + 0x68], 0
je 0x140024c9d
cmp dword [rcx + 0x2c], 0
je 0x140024c9d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r8, 0xffffffffffffffff
mov rbx, rax
mov rax, r8
nop dword [rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140024b10
xor edx, edx
lea rax, [rax*2 + 2]
lea rcx, [rax + 0x10]
cmp rcx, rax
cmova rdx, rcx
test rdx, rdx
je 0x140024bef
mov rax, r8
nop dword [rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140024b40
lea rdx, [rax*2 + 2]
lea rcx, [rdx + 0x10]
nop dword [rax + rax]
cmp word [rbx + r8*2 + 2], 0
lea r8, [r8 + 1]
jne 0x140024b60
xor eax, eax
cmp rcx, rdx
cmova rax, rcx
cmp rax, 0x400
lea rax, [r8*2 + 2]
ja 0x140024bc8
lea rcx, [rax + 0x10]
xor edx, edx
cmp rcx, rax
cmova rdx, rcx
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x140024ba6
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400c8fe0
sub rsp, rax
lea rsi, [rsp + 0x30]
test rsi, rsi
je 0x140024bf1
mov dword [rsi], 0xcccc
add rsi, 0x10
jmp 0x140024bf1
lea rdx, [rax + 0x10]
xor ecx, ecx
cmp rdx, rax
cmova rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140024bf1
mov dword [rax], 0xdddd
add rsi, 0x10
jmp 0x140024bf1
xor esi, esi
mov rdx, rsi
mov rcx, rbx
sub rdx, rbx
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140024c00
mov rcx, rbx
sub rcx, rdi
nop word [rax + rax]
movzx eax, word [rdi]
mov word [rcx + rdi], ax
lea rdi, [rdi + 2]
test ax, ax
jne 0x140024c20
mov r8, qword [r14 + 0x68]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, rax
mov edx, 0x64
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, rsi
sub rbx, rsi
nop dword [rax]
movzx ecx, word [rdx]
mov word [rbx + rdx], cx
lea rdx, [rdx + 2]
test cx, cx
jne 0x140024c70
test rsi, rsi
je 0x140024c98
cmp dword [rsi - 0x10], 0xdddd
lea rcx, [rsi - 0x10]
jne 0x140024c98
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rdi
jmp 0x140024c9f
xor eax, eax
mov rbx, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x18]
mov rdi, qword [rbp + 0x20]
mov r14, qword [rbp + 0x28]
mov rsp, rbp
pop rbp
ret
Function at 0x140025070
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x28]
cmp rdi, 0x40000000
jbe 0x1400250ab
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x140102c48]
lea r15, [rdi + 0x40000000]
cmp qword [rsp + 0x30], r15
cmovbe r15, qword [rsp + 0x30]
sub r15, 0xfff
test rsi, rsi
je 0x1400250ed
cmp rsi, r14
jb 0x1400250e5
cmp rsi, r15
jae 0x1400250e5
cmp qword [rsi + 8], 0
jne 0x1400252b5
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1400250d0
mov qword [rsp + 0xa0], rbx
mov rbx, rdi
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb0], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x140025179
nop dword [rax]
nop word [rax + rax]
mov ebp, dword [rsp + 0x48]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x140025179
nop word [rax + rax]
mov r8d, gethostbyname
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140025179
cmp dword [rsp + 0x70], 0x10000
je 0x1400251fb
mov rbx, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x140025179
sub rbx, rbp
cmp rbx, r14
jae 0x140025140
test rsi, rsi
jne 0x140025260
cmp rdi, r15
ja 0x14002529d
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x14002529d
mov r8d, gethostbyname
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14002529d
cmp dword [rsp + 0x70], 0x10000
je 0x140025231
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x68]
add rdi, qword [rsp + 0x50]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x1400251b2
jmp 0x14002529d
test rbx, rbx
je 0x140025179
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x140025260
cmp rbx, r14
jae 0x140025120
jmp 0x140025182
test rdi, rdi
je 0x14002529d
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x140025260
cmp rdi, r15
jbe 0x140025190
jmp 0x14002529d
xor eax, eax
lea rcx, [rsi + 0x40]
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], eax
nop dword [rax]
mov rax, qword [rsi + 8]
add r12, 0x40
mov qword [rcx], rax
mov qword [rsi + 8], rcx
add rcx, 0x40
cmp r12, 0xfc0
jbe 0x140025270
mov rax, qword [0x140102c48]
mov qword [rsi], rax
mov qword [0x140102c48], rsi
mov r12, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rax, rsi
mov rsi, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
ret
Function at 0x140025760
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x1401060b0], ecx
lea rax, [0x1401060b4]
mov r8d, 1
mov edx, dword [rax - 4]
lea rax, [rax + 4]
shr edx, 0x1e
xor edx, dword [rax - 8]
imul ecx, edx, 0x6c078965
add ecx, r8d
inc r8d
mov dword [rax - 4], ecx
cmp r8d, 0x270
jl 0x140025773
mov dword [0x140100798], 1
mov dword [0x140106a70], 1
ret

Function at 0x1400257b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x140106a70], 0
lea rbx, [0x1401060b0]
jne 0x14002580f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401060b0], eax
mov edx, 1
lea r8, [0x1401060b4]
nop
mov ecx, dword [r8 - 4]
lea r8, [r8 + 4]
shr ecx, 0x1e
xor ecx, dword [r8 - 8]
imul eax, ecx, 0x6c078965
add eax, edx
inc edx
mov dword [r8 - 4], eax
cmp edx, 0x270
jl 0x1400257e0
mov dword [0x140106a70], 1
mov eax, dword [0x1401060b0]
mov r10d, 0xe3
mov dword [0x140100798], 0x270
mov qword [0x140106a78], rbx
nop dword [rax]
mov r9d, dword [rbx + 4]
mov edx, r9d
xor edx, eax
and edx, 0x7ffffffe
xor edx, eax
mov eax, r9d
shr edx, 1
and al, 1
neg al
mov eax, r9d
sbb ecx, ecx
and ecx, 0x9908b0df
xor edx, ecx
xor edx, dword [rbx + 0x634]
mov dword [rbx], edx
add rbx, 4
sub r10d, 1
jne 0x140025830
mov r11d, 0x18c
nop
mov r10d, dword [rbx + 4]
lea r8, [rbx + 4]
mov edx, r10d
mov eax, r10d
xor edx, r9d
and al, 1
and edx, 0x7ffffffe
xor edx, r9d
mov r9d, r10d
shr edx, 1
neg al
sbb ecx, ecx
and ecx, 0x9908b0df
xor edx, ecx
xor edx, dword [rbx - 0x38c]
mov dword [rbx], edx
lea rbx, [r8]
sub r11d, 1
jne 0x140025870
mov eax, dword [0x1401060b0]
mov ecx, r10d
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
xor ecx, r10d
shr ecx, 1
neg al
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [r8 - 0x38c]
mov dword [r8], ecx
add rsp, 0x20
pop rbx
ret

Function at 0x1400258f0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
sub dword [0x140100798], 1
jne 0x140025902
call fcn.1400257b0
mov rax, qword [0x140106a78]
mov ecx, dword [rax]
add rax, 4
mov qword [0x140106a78], rax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
add rsp, 0x28
ret

Function at 0x140025950
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
sub dword [0x140100798], 1
jne 0x140025962
call fcn.1400257b0
mov rax, qword [0x140106a78]
xorps xmm0, xmm0
mov ecx, dword [rax]
add rax, 4
mov qword [0x140106a78], rax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [0x1400ee0a8]
add rsp, 0x28
ret
Function at 0x1400262d0
Capabilities:
Write clipboard data

Disassembly:
cmp byte [rcx + 0x23], 0
jne 0x1400262da
mov rcx, qword [rcx + 0x10]
cmp byte [rcx + 0x23], 2
jne 0x1400262f6
cmp qword [0x140105dd8], 0
je 0x1400262f6
lea rcx, [0x140105dc0]
jmp fcn.140005fa0
movzx eax, byte [rcx + 0x21]
and al, 0x86
mov byte [rcx + 0x21], al
test dl, dl
je 0x140026308
or al, 1
mov byte [rcx + 0x21], al
mov eax, 1
ret
Function at 0x140029e70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
xor r12d, r12d
mov rbx, r8
mov r14, rdx
mov qword [rsp + 0x30], r12
mov r15, rcx
mov dword [rsp + 0x38], r12d
lea rdx, str.E4847ED08866458F8DD35F94B37001C0
mov byte [rsp + 0x3c], r12b
lea r8d, [r12 + 0xa]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x14002a026
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x38], eax
test eax, eax
je 0x14002a026
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14002a026
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14002a026
cmp dword [rax], 0x4034b50
jne 0x140029ff2
call fcn.140004ed0
test al, al
je 0x14002a03f
mov edx, r12d
lea rdi, [0x1400ff940]
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rdi]
lea ecx, [rdx + 1]
inc edx
lea rdi, [rdi + 8]
mov word [rax], cx
cmp edx, 0xa
jl 0x140029f30
mov r8d, dword [rsp + 0x38]
lea r9, [0x1400ff940]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x88]
call fcn.1400aef50
mov edi, eax
test eax, eax
je 0x140029ff2
mov qword [rsp + 0x60], rbp
lea ebp, [rdi + 2]
mov ecx, ebp
mov qword [rsp + 0x68], rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, qword [rsp + 0x88]
mov r8d, edi
mov rdx, rbx
mov qword [rsp + 0x30], rax
mov rcx, rax
mov byte [rsp + 0x3c], 1
mov esi, edi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x30]
mov word [rdi + rax], r12w
test edi, edi
je 0x140029fba
mov rdi, rbx
xor eax, eax
mov ecx, esi
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [rsp + 0x38], ebp
call fcn.140004ed0
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
test al, al
je 0x14002a03f
mov rcx, qword [0x140101d08]
call fcn.140024970
mov rcx, qword [0x140101d00]
call fcn.140024970
mov r9d, 0xfde9
lea rdx, [rsp + 0x30]
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov rcx, r14
call fcn.1400a8b50
mov rax, qword [r15 + 0xbb0]
inc dword [0x140102c68]
mov qword [0x140103fd0], rax
mov eax, 3
jmp 0x14002a041
xorps xmm3, xmm3
mov qword [rsp + 0x20], r12
mov r8, rbx
lea rcx, str.Could_not_extract_script_from_EXE.
xor edx, edx
call fcn.1400b1f70
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x140031d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
movzx eax, word [0x1400ffa80]
xor ebp, ebp
mov word [rsp + 0x22], ax
mov eax, 0x7b
mov dword [rsp + 0x48], eax
mov ebx, SafeArrayAllocDescriptor
mov word [rsp + 0x20], bx
mov r10, r8
mov dword [rsp + 0x24], 0x90028
mov rsi, rdx
mov dword [rsp + 0x28], 0x3e003c
mov r11, rcx
mov dword [rsp + 0x2c], 0x3d003a
mov dword [rsp + 0x30], 0x2d002b
mov dword [rsp + 0x34], 0x2f002a
mov dword [rsp + 0x38], 0x7e0021
mov dword [rsp + 0x3c], 0x7c0026
mov dword [rsp + 0x40], 0x5b005e
mov dword [rsp + 0x44], 0x3f002e
test r8, r8
je 0x140031e08
movzx edx, word [r8]
test dx, dx
je 0x140031e1d
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x20]
movzx eax, bx
cmp dx, ax
je 0x140031e0b
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x140031de8
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x140031de0
mov r8, rbp
test r8, r8
je 0x140031e1d
cmp r8, r10
lea rbx, [r8 - 2]
cmovbe rbx, r8
jmp 0x140031e36
mov rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], bp
jne 0x140031e24
lea rbx, [r10 - 2]
lea rbx, [rbx + rax*2]
cmp rbx, r10
jbe 0x140031e58
nop dword [rax + rax]
movzx eax, word [rbx]
cmp ax, 0x20
je 0x140031e4f
cmp ax, 9
jne 0x140031e58
sub rbx, 2
cmp rbx, r10
ja 0x140031e40
mov rdi, rbx
sub rdi, r10
sar rdi, 1
inc rdi
cmp rdi, 0xfd
jbe 0x140031e88
test r9b, r9b
je 0x140031e84
mov r8, r10
lea rdx, str.This_line_does_not_contain_a_recognized_action.
mov rcx, r11
call fcn.140046d70
xor eax, eax
jmp 0x140031e9e
mov r8, rdi
mov rdx, r10
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov rax, rbx
mov word [rsi + rdi*2], bp
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140045c00
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea r8, str.Script_lines_most_recently_executed__oldest_first_.__Press__F5__to_refresh.__The_seconds_elapsed_between_a_line_and_the_one_after_it_is_in_parentheses_to_the_right__if_not_0_.__The_bottommost_lines_elapsed_time_is_the_number_of_seconds_since_it_executed._r_n_r_n
mov edx, 0xfffe
mov r14, rcx
call fcn.1400ab290
mov r8d, dword [0x140102c54]
lea r9, [0x140000000]
movsxd rdx, eax
mov esi, 0x190
mov eax, r8d
mov r10d, 2
lea rcx, [r14 + rdx*2]
mov qword [rsp + 0x80], rcx
nop dword [rax + rax]
xor r15b, r15b
mov r13, rcx
test esi, esi
jle 0x140045daa
movsxd rcx, eax
mov edi, r10d
mov r12d, esi
nop word [rax + rax]
cmp eax, 0x190
lea rbx, [rcx - 0x190]
lea ebp, [rax - 0x190]
cmovl rbx, rcx
cmovl ebp, eax
cmp qword [r9 + rbx*8 + 0x1032b0], 0
je 0x140045d83
movzx r14d, r15b
lea eax, [rdi - 1]
xor r15b, r15b
cmp eax, esi
jge 0x140045dd6
test r14b, r14b
jne 0x140045d83
mov r8d, dword [r9 + rbx*4 + 0x102c70]
lea eax, [rbp + 1]
xor edx, edx
lea rcx, [rbx + 1]
cmp eax, 0x190
cmovl rdx, rcx
mov eax, dword [r9 + rdx*4 + 0x102c70]
sub eax, r8d
cmp eax, 0x7fffffff
jbe 0x140045d2f
mov r15b, 1
cmp edi, esi
jne 0x140045d0c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [0x140000000]
sub eax, dword [rcx + rbx*4 + 0x102c70]
jmp 0x140045d36
lea rax, [rbx + 2]
mov rcx, 0xfffffffffffffe72
cmp rax, 0x190
cmovl rcx, r10
add rcx, rbx
mov eax, dword [r9 + rcx*4 + 0x102c70]
sub eax, r8d
lea rcx, [0x140000000]
mov rcx, qword [rcx + rbx*8 + 0x1032b0]
mov r9d, 0xfffe
mov r8, r13
mov byte [rsp + 0x28], r14b
sub r8, qword [rsp + 0x70]
mov rdx, r13
sar r8, 1
sub r9d, r8d
mov dword [rsp + 0x20], eax
mov r8d, 0xc8
cmp r9d, r8d
cmovl r8d, r9d
mov r9b, 1
call fcn.140045e30
mov r13, rax
lea r9, [0x140000000]
mov r10d, 2
inc edi
lea eax, [rbp + 1]
lea rcx, [rbx + 1]
sub r12, 1
jne 0x140045c80
mov r8d, dword [0x140102c54]
mov r14, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x80]
mov rax, r13
mov edx, 0xfffe
sub rax, r14
sar rax, 1
sub edx, eax
cmp edx, 0x18
jg 0x140045def
cmp esi, 0x78
jl 0x140045def
sub esi, 0x64
mov eax, r8d
sub eax, esi
add eax, 0x190
jmp 0x140045c60
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [0x140000000]
sub eax, dword [rcx + rbx*4 + 0x102c70]
jmp 0x140045d36
lea r8, str._r_nPress__F5__to_refresh.
mov rcx, r13
call fcn.1400ab290
mov rbx, qword [rsp + 0x78]
movsxd rcx, eax
lea rax, [rcx*2]
add rax, r13
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400476e0
Capabilities:
Print debug messages

Disassembly:
test edx, edx
je 0x14004782b
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x4030
call fcn.1400c8fe0
sub rsp, rax
mov qword [rsp + 0x4050], rbx
mov rbp, r9
mov rbx, qword [rsp + 0x4070]
mov r14, r8
mov qword [rsp + 0x4058], r15
mov esi, edx
mov rdi, rcx
test rbx, rbx
jne 0x140047741
mov rbx, qword [rcx + 0x6d0]
test rbx, rbx
jne 0x140047741
mov ecx, dword [rcx + 0x288]
movzx eax, word [rdi + 0x28c]
jmp 0x140047749
movzx ecx, word [rbx + 2]
movzx eax, word [rbx + 4]
movsxd r9, ecx
lea r8, str._s___d__:___Warning:__s_n
lea rcx, [0x140103fd0]
movzx eax, ax
mov r15d, 0x2000
mov qword [rsp + 0x28], r14
mov edx, r15d
mov dword [rsp + 0x20], eax
mov r9, qword [rcx + r9*8]
lea rcx, [rsp + 0x30]
call fcn.1400ab290
cmp word [rbp], 0
movsxd rcx, eax
je 0x1400477a5
sub r15d, ecx
lea rax, [rsp + 0x30]
lea rcx, [rax + rcx*2]
mov edx, r15d
mov r9, rbp
lea r8, str._____Specifically:__s_n
call fcn.1400ab290
mov r15, qword [rsp + 0x4058]
cmp esi, 3
jne 0x1400477cb
lea ecx, [rsi - 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
jmp 0x140047810
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, 2
jne 0x140047810
test rbx, rbx
jne 0x1400477fc
mov rbx, qword [rdi + 0x6d0]
test rbx, rbx
jne 0x1400477fc
mov r8, rbp
mov rdx, r14
mov rcx, rdi
call fcn.140046d70
jmp 0x140047810
mov r9, rbp
mov r8d, 1
mov rdx, r14
mov rcx, rbx
call fcn.1400468a0
mov rbx, qword [rsp + 0x4050]
mov rbp, qword [rsp + 0x4060]
add rsp, 0x4030
pop r14
pop rdi
pop rsi
ret