joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140086be0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
mov rax, qword [0x14025dcd8]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rax, qword [rdx]
mov qword [r11 + 0x18], rsi
mov rsi, rcx
mov qword [r11 - 0x10], rdi
mov rdi, rdx
mov qword [r11 - 0x18], r14
xor r14d, r14d
cmp r14w, word [rax]
jne 0x140086d2f
xor eax, eax
mov qword [r11 + 0x10], rbx
lea rdx, [rbp + 0x17]
mov dword [rbp + 8], eax
lea rcx, [rbp - 1]
mov word [rbp + 0xc], ax
mov byte [rbp + 0xe], al
mov dword [rbp - 1], 0x295d2d62
mov dword [rbp + 3], 0x32412f40
mov byte [rbp + 7], 0x32
mov qword [rbp + 0xf], 0x31b6
call fcn.140075cd0
mov rcx, rax
call fcn.14005d3b0
call fcn.140058f10
mov eax, dword [rsi + 0x6c]
lea rdx, [rbp - 1]
lea rcx, [0x140250330]
mov dword [rbp - 9], eax
call fcn.140075fa0
lea rdx, [rbp + 0x17]
mov rbx, rax
lea rcx, str.b_N6_2G_nf_tj
call fcn.14008b2e0
lea r9d, [r14 + 8]
mov dword [rsp + 0x28], r14d
lea r8d, [r14 + 3]
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 9]
mov rcx, rax
call fcn.140059a70
cmp byte [0x14025d3d0], r14b
jne 0x140086cc4
mov edx, dword [rbp - 9]
mov dword [rsi + 0x6c], edx
test al, al
je 0x140086cc4
mov byte [0x1402609d4], 1
mov eax, dword [rsi + 0x68]
lea rdx, [rbp - 1]
lea rcx, [0x140250330]
mov dword [rbp - 9], eax
call fcn.140075fa0
lea rdx, [rbp + 0x17]
mov rbx, rax
lea rcx, str.b7Y5Z9R_U2
call fcn.140080190
mov r9d, 0x14
mov dword [rsp + 0x28], r14d
lea rdx, [rbp - 9]
mov qword [rsp + 0x20], rbx
mov rcx, rax
lea r8d, [r9 - 0xf]
call fcn.140059a70
cmp byte [0x14025d3d0], r14b
mov rbx, qword [rsp + 0xa8]
jne 0x140086d2f
mov ecx, dword [rbp - 9]
mov dword [rsi + 0x68], ecx
test al, al
je 0x140086d2f
mov byte [0x1402609d4], 1
mov rax, qword [rdi]
mov ecx, 1
mov r14, qword [rsp + 0x80]
mov rsi, qword [rsp + 0xb0]
cmp cx, word [rax]
jne 0x140086d8c
xor eax, eax
mov dword [rbp - 1], 0x295d2d62
lea rdx, [rbp + 0x17]
mov dword [rbp + 8], eax
lea rcx, [rbp - 1]
mov word [rbp + 0xc], ax
mov byte [rbp + 0xe], al
mov dword [rbp + 3], 0x32412f40
mov byte [rbp + 7], 0x32
mov qword [rbp + 0xf], 0x31b6
call fcn.140075cd0
mov rcx, rax
call fcn.14005d3b0
call fcn.140058f10
mov rax, qword [rdi]
mov ecx, 2
mov rdi, qword [rsp + 0x88]
cmp cx, word [rax]
jne 0x140086de1
xor eax, eax
mov dword [rbp - 1], 0x295d2d62
lea rdx, [rbp + 0x17]
mov dword [rbp + 8], eax
lea rcx, [rbp - 1]
mov word [rbp + 0xc], ax
mov byte [rbp + 0xe], al
mov dword [rbp + 3], 0x32412f40
mov byte [rbp + 7], 0x32
mov qword [rbp + 0xf], 0x31b6
call fcn.140075cd0
mov rcx, rax
call fcn.14005d3b0
call fcn.140058f10
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14008fda0
add rsp, 0x90
pop rbp
ret
Function at 0x140087510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14025dcd8]
xor rax, rsp
mov qword [rbp - 0x10], rax
movzx eax, byte [0x14025d3d4]
mov rdi, r8
cmp rdx, rax
jne 0x1400876cd
mov qword [rsp + 0x98], rsi
xor esi, esi
cmp si, word [r8]
jne 0x140087591
xor eax, eax
mov dword [rbp - 0x48], 0x295d2d62
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x3f], eax
lea rcx, [rbp - 0x48]
mov word [rbp - 0x3b], ax
mov byte [rbp - 0x39], al
mov dword [rbp - 0x44], 0x32412f40
mov byte [rbp - 0x40], 0x32
mov qword [rbp - 0x38], 0x31b6
call fcn.140075cd0
mov rcx, rax
call fcn.14005d3b0
call fcn.140058f10
mov eax, 1
cmp ax, word [rdi]
jne 0x1400876c5
xor eax, eax
mov qword [rsp + 0x90], rbx
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x3f], eax
lea rcx, [rbp - 0x48]
mov word [rbp - 0x3b], ax
mov byte [rbp - 0x39], al
mov dword [rbp - 0x48], 0x295d2d62
mov dword [rbp - 0x44], 0x32412f40
mov byte [rbp - 0x40], 0x32
mov qword [rbp - 0x38], 0x31b6
call fcn.140075cd0
mov rcx, rax
call fcn.14005d3b0
call fcn.140058f10
movss xmm0, dword [rdi + 0xc]
lea rdx, [rbp - 0x48]
lea rcx, str.bGwYh
movss dword [rbp - 0x50], xmm0
call fcn.140075d40
lea rdx, [rbp - 0x30]
mov rbx, rax
lea rcx, [0x140250688]
call fcn.14008aeb0
movss xmm3, dword [0x140249ce0]
lea rdx, [rbp - 0x50]
xorps xmm2, xmm2
mov dword [rsp + 0x28], esi
mov rcx, rax
mov qword [rsp + 0x20], rbx
call fcn.140059a20
cmp byte [0x14025d3d0], sil
jne 0x140087652
movss xmm0, dword [rbp - 0x50]
movss dword [rdi + 0xc], xmm0
test al, al
je 0x140087652
mov byte [0x1402609d4], 1
movss xmm0, dword [rdi + 8]
lea rdx, [rbp - 0x48]
lea rcx, str.bGwYh
movss dword [rbp - 0x50], xmm0
call fcn.140075d40
lea rdx, [rbp - 0x30]
mov rbx, rax
lea rcx, [0x140250650]
call fcn.14008b0a0
movss xmm3, dword [0x140249ce0]
lea rdx, [rbp - 0x50]
xorps xmm2, xmm2
mov dword [rsp + 0x28], esi
mov rcx, rax
mov qword [rsp + 0x20], rbx
call fcn.140059a20
cmp byte [0x14025d3d0], sil
mov rbx, qword [rsp + 0x90]
jne 0x1400876c5
movss xmm0, dword [rbp - 0x50]
movss dword [rdi + 8], xmm0
test al, al
je 0x1400876c5
mov byte [0x1402609d4], 1
mov rsi, qword [rsp + 0x98]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14008fda0
mov rdi, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x140089790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x14025dcd8]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov dword [rsp + 0x40], 0x26553062
mov dword [rbp - 0x7e], eax
lea rdx, [rbp - 0x30]
mov word [rbp - 0x7a], ax
lea rcx, [rsp + 0x40]
movabs rax, 0x2aff3482bd799647
mov dword [rsp + 0x44], 0x22473143
mov qword [rbp - 0x78], rax
mov dword [rsp + 0x48], 0x6f006646
mov dword [rsp + 0x4c], 0x295c3d1d
mov dword [rsp + 0x50], 0x285a355d
mov dword [rsp + 0x54], 0x3a5e3b41
mov dword [rsp + 0x58], 0x7f12771a
mov dword [rsp + 0x5c], 0x790a781d
mov dword [rsp + 0x60], 0x34583659
mov dword [rsp + 0x64], 0x3141614d
mov dword [rsp + 0x68], 0x2a59385d
mov dword [rsp + 0x6c], 0x640b6f4f
mov dword [rsp + 0x70], 0x31452a44
mov dword [rsp + 0x74], 0x62066311
mov dword [rsp + 0x78], 0x7e0c780b
mov dword [rsp + 0x7c], 0x74007517
mov word [rbp - 0x80], 0x1111
call fcn.14008c230
movss xmm0, dword [0x140249d00]
lea rdx, [rbp - 0x30]
xor r9d, r9d
movss dword [rsp + 0x20], xmm0
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.14000ad30
movss xmm0, dword [0x1402509e8]
lea rcx, [rsp + 0x30]
subss xmm0, dword [rsp + 0x38]
mov dword [rsp + 0x34], 0
movss dword [rsp + 0x30], xmm0
call fcn.1400258f0
lea rcx, [rbp - 0x30]
call fcn.14005d3b0
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
call fcn.1400258f0
xor eax, eax
mov dword [rbp - 0x70], 0x23513462
mov word [rbp - 0x43], ax
lea rdx, [rsp + 0x40]
mov byte [rbp - 0x41], al
lea rcx, [rbp - 0x70]
movabs rax, 0x392c8df73b120
mov dword [rbp - 0x6c], 0x38563950
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x68], 0x34042a18
mov dword [rbp - 0x64], 0x69197514
mov dword [rbp - 0x60], 0x6d406001
mov dword [rbp - 0x5c], 0x2a4f3d4d
mov dword [rbp - 0x58], 0x2750355c
mov dword [rbp - 0x54], 0x70066307
mov dword [rbp - 0x50], 0x66167915
mov dword [rbp - 0x4c], 0x33517103
mov dword [rbp - 0x48], 0x27432f46
mov byte [rbp - 0x44], 0x27
call fcn.14008be00
mov rcx, rax
call fcn.14005d3b0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.14008fda0
add rsp, 0x130
pop rbp
ret
Function at 0x14008d900
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
xor esi, esi
mov rbx, qword [0x14025da30]
mov rdi, qword [0x14025da38]
cmp rbx, rdi
je 0x14008d9ab
mov rax, qword [rbx]
cmp byte [rax + 9], 0
je 0x14008d9a2
mov ecx, 8
call fcn.1400904d0
test rax, rax
je 0x14008d945
mov qword [rax], rbx
jmp 0x14008d948
mov rax, rsi
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x14008d760]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14008d9bb
cmp dword [rsp + 0x38], 0
je 0x14008d9ca
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14008d9ca
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
add rbx, 8
jmp 0x14008d91f
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov dword [rsp + 0x38], esi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14008e880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x14025dcd8]
xor rax, rsp
mov qword [rbp + 0x37], rax
movups xmm0, xmmword [0x14025e058]
xor r11d, r11d
mov dword [rbp - 0x59], 0x8b0048
mov dword [rbp - 0x55], 0x4800c4
mov r15d, 0xffff
movq rax, xmm0
mov dword [rbp - 0x51], 0x580089
psrldq xmm0, 8
movzx edx, r11w
movq r10, xmm0
mov dword [rbp - 0x4d], 0x55ffff
add r10, rax
mov dword [rbp - 0x49], 0x570056
mov dword [rbp - 0x45], 0x540041
mov dword [rbp - 0x41], 0x550041
mov dword [rbp - 0x3d], 0x560041
mov dword [rbp - 0x39], 0x570041
mov dword [rbp - 0x35], 0x8d0048
mov qword [rbp - 0x31], 0xffffffffffff00a8
mov dword [rbp - 0x29], 0x48ffff
mov dword [rbp - 0x25], 0xec0081
mov qword [rbp - 0x21], 0xffffffffffffffff
mov dword [rbp - 0x19], 0x29000f
mov dword [rbp - 0x15], 0xffff0070
mov dword [rbp - 0x11], 0x29000f
mov dword [rbp - 0xd], 0xffff0078
mov dword [rbp - 9], 0x8b0048
mov qword [rbp - 5], 0xffffffffffff0005
mov dword [rbp + 3], 0x48ffff
mov dword [rbp + 7], 0xc40033
mov dword [rbp + 0xb], 0x890048
mov qword [rbp + 0xf], 0xffffffffffff0085
mov dword [rbp + 0x17], 0x4cffff
mov dword [rbp + 0x1b], 0xffff008b
mov dword [rbp + 0x1f], 0x890048
mov dword [rbp + 0x23], 0x240054
mov dword [rbp + 0x27], 0x4cffff
cmp rax, r10
je 0x14008e9e4
mov r9, rax
nop dword [rax + rax]
movzx ecx, dx
movzx r8d, word [rbp + rcx*2 - 0x59]
movzx ecx, byte [rax]
cmp r8w, cx
je 0x14008e9d3
cmp r8w, r15w
je 0x14008e9d3
inc rax
mov edx, r11d
mov r9, rax
jmp 0x14008e9df
inc dx
cmp dx, 0x42
je 0x14008ea0f
inc rax
cmp rax, r10
jne 0x14008e9b0
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14008fda0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rax, r9
jmp 0x14008e9e6
Function at 0x14008fc90
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3f
syscall
ret

Function at 0x14008fc9b
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3a
syscall
ret

Function at 0x140090bc0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140090c0a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140090c0a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140090c0a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140090c0a
cmp dword [rcx + 0x84], 0xe
jbe 0x140090c0a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140090c0c
xor al, al
add rsp, 0x28
ret
Function at 0x141e5f058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x141e5f1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141e5f089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141e5f06f
add dl, dl
jne 0x141e5f096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141e5f0f6
xor eax, eax
add dl, dl
jne 0x141e5f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141e5f1ad
add dl, dl
jne 0x141e5f0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141e5f0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141e5f0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141e5f0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141e5f0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141e5f07e
mov eax, 1
add dl, dl
jne 0x141e5f106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141e5f113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141e5f0fb
sub eax, ebx
mov ebx, 1
jne 0x141e5f14c
mov ecx, 1
add dl, dl
jne 0x141e5f12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141e5f13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141e5f123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141e5f07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141e5f168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141e5f175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141e5f15d
cmp eax, 0x7d00
jae 0x141e5f19b
cmp eax, 0x500
jb 0x141e5f196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141e5f07e
cmp eax, 0x7f
ja 0x141e5f19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141e5f07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141e5f1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141e5f07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400185a0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rcx, qword [rcx]
mov rbx, r8
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rsi, rax
test rax, rax
je 0x140018658
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [rax + 1]
test edi, edi
js 0x1400186d9
mov rcx, qword [rbx]
mov edx, 1
mov eax, dword [rcx - 0xc]
sub edx, dword [rcx - 8]
sub eax, edi
or edx, eax
jge 0x1400185f9
mov edx, edi
mov rcx, rbx
call fcn.140018ea0
mov rdx, qword [rbx]
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor edi, edi
mov esi, eax
cmp eax, 0xffffffff
jne 0x140018626
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14001861d
mov eax, edi
jmp 0x14001862e
movsxd rdx, dword [rcx - 0xc]
call fcn.1401fe5d0
test eax, eax
js 0x1400186d9
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x1400186d9
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], di
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx]
cmp dword [rax - 0x10], 0
lea rdx, [rax - 0x18]
mov rdi, qword [rdx]
je 0x1400186c7
cmp dword [rdx + 0x10], 0
jge 0x140018691
cmp dword [rax - 0xc], 0
jl 0x1400186d9
xor edi, edi
mov dword [rax - 0x10], edi
mov rax, qword [rbx]
mov word [rax], di
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400186b0
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbx], rax
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80070057
call fcn.140019300
int3

Function at 0x140018b20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140018b98
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140018b98
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140018b85
nop
cmp rbx, rcx
jae 0x140018b98
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140018b70
cmp rbx, rcx
jae 0x140018b98
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x140018b9a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140019780
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
movsxd rbx, eax
test eax, eax
js 0x140019833
mov r8, qword [rdi]
mov r10d, 1
mov r9d, dword [r8 - 0xc]
sub r10d, dword [r8 - 8]
sub r9d, ebx
or r10d, r9d
jge 0x1400197ce
mov edx, ebx
mov rcx, rdi
call fcn.140018ea0
mov rdx, qword [rdi]
cmp ebx, dword [rdx - 0xc]
jg 0x140019833
mov dword [rdx - 0x10], ebx
lea r8d, [rbx + 1]
mov rax, qword [rdi]
xor ebp, ebp
mov rcx, rsi
mov word [rax + rbx*2], bp
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rdi]
test rcx, rcx
jne 0x1400197fb
mov eax, ebp
jmp 0x140019808
movsxd rdx, dword [rcx - 0xc]
call fcn.1401fe5d0
test eax, eax
js 0x140019833
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x140019833
mov rsi, qword [rsp + 0x40]
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rdi]
mov word [rax + rcx*2], bp
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80070057
call fcn.140019300
int3
Function at 0x14001b2d0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov rbp, rcx
call fcn.14001ad60
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x14001b4df
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rsp + 0x28], rax
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.140018bb0
xor r14d, r14d
lea rbx, [r14 - 1]
test al, al
jne 0x14001b36a
test rdi, rdi
jne 0x14001b34f
mov r8d, r14d
jmp 0x14001b35c
mov r8, rbx
inc r8
cmp word [rdi + r8*2], r14w
jne 0x14001b352
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.140018f50
nop
lea rcx, [rsp + 0x28]
call fcn.140027700
mov qword [rbp + 0xc8], rax
cmp rax, 0xffffffffffffffff
jne 0x14001b43c
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ARKERR_CANT_OPEN_FILE
call fcn.140048480
mov rsi, rax
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x14001b4d4
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rsp + 0x28], rax
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.140018bb0
test al, al
jne 0x14001b40b
test rsi, rsi
jne 0x14001b3ef
mov r8d, r14d
jmp 0x14001b3fd
mov r8, rbx
inc r8
cmp word [rsi + r8*2], 0
jne 0x14001b3f2
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.140018f50
nop
call fcn.14012bfe0
lea rcx, [0x1402670d8]
lea r8, [0x1402670e0]
cmp dword [rax + 0x88], 0
cmovne r8, rcx
xor r9d, r9d
lea rdx, [rsp + 0x28]
mov rcx, qword [rbp + 8]
call fcn.140061b80
jmp 0x14001b44e
mov r8, rdi
mov edx, 0x49b
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea rdx, [rsp + 0x28]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
jne 0x14001b476
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14001b476
mov rcx, rbx
jmp 0x14001b481
mov ecx, dword [rsp + 0x28]
shl rcx, 0x20
or rcx, rsi
mov qword [rbp + 0xe0], rcx
lea rcx, [rbp + 0xc0]
test rdi, rdi
je 0x14001b4a1
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x14001b494
mov r14, rbx
mov r8d, r14d
mov rdx, rdi
call fcn.140018f50
mov rcx, rbp
call fcn.14001a9b0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401f74b0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.140019300
int3
mov ecx, 0x80004005
call fcn.140019300
int3
Function at 0x14001e9d0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rbx, rdx
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [rax + 1]
test edi, edi
js 0x14001ea6f
mov rax, qword [rbx]
mov r9d, 1
mov r8d, dword [rax - 0xc]
sub r9d, dword [rax - 8]
sub r8d, edi
or r9d, r8d
jge 0x14001ea18
mov edx, edi
mov rcx, rbx
call fcn.140018ea0
mov rdx, qword [rbx]
mov r8d, edi
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor esi, esi
mov edi, eax
cmp eax, 0xffffffff
jne 0x14001ea45
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14001ea3c
mov eax, esi
jmp 0x14001ea49
movsxd rdx, dword [rcx - 0xc]
call fcn.1401fe5d0
test eax, eax
js 0x14001ea6f
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14001ea6f
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x30]
mov word [rax + rcx*2], si
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80070057
call fcn.140019300
int3

Function at 0x140021e60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
je 0x140021f6f
lea r11, [0x14026b380]
not ecx
cmp r8, 8
jb 0x140021f3d
mov r10, r8
shr r10, 3
imul rax, r10, 0xfffffffffffffff8
add r8, rax
nop dword [rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x140021e90
test r8, r8
je 0x140021f6d
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x140021f50
not ecx
mov eax, ecx
ret