joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002fcd5
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp - 8], 0
mov eax, dword [rbp + 0x18]
cdqe
mov rcx, rax
call fcn.1400e5660
call fcn.1400e50b0
mov rax, qword [rbp + 0x10]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.1400e56b0
mov qword [rbp - 0x70], 0
mov qword [rbp - 0x78], 0
mov qword [rbp - 0x10], 0
call fcn.1400e5120
call fcn.1400e5120
call fcn.1400e5180
mov edx, eax
mov ecx, 0x3e8
call fcn.1400e2ad0
call fcn.1400e5180
mov edx, eax
lea rax, [rbp - 0x70]
mov rcx, rax
call fcn.1400e53d0
mov rax, qword [rbp - 0x70]
mov qword [rbp - 0x18], rax
lea rax, str.WINDIR
mov rdx, qword [rbp - 0x18]
mov r8d, 0x3e8
mov rcx, rax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x78]
lea rdx, [0x14086f928]
mov rcx, rax
call fcn.1400e54b0
call fcn.1400e5120
call fcn.1400e5120
mov rax, qword [rbp - 0x70]
mov rcx, rax
call fcn.1400e5360
lea rax, str.System32
mov rcx, rax
call fcn.1400e5360
call fcn.1400e55a0
call fcn.1400e5120
lea rax, str.__c
mov rcx, rax
call fcn.1400e5360
mov rax, qword [rbp + 0x10]
mov rcx, rax
call fcn.1400e5360
call fcn.1400e55a0
call fcn.1400e5120
mov rax, qword [rbp - 0x70]
mov rcx, rax
call fcn.1400e5360
lea rax, str.System32cmd.exe
mov rcx, rax
call fcn.1400e5360
call fcn.1400e52d0
mov qword [rbp - 0x28], rax
call fcn.1400e52d0
mov qword [rbp - 0x30], rax
call fcn.1400e52d0
mov qword [rbp - 0x38], rax
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
mov r9d, SafeArrayGetLBound
mov r8, rcx
mov rcx, rax
call fcn.140092158
mov qword [rbp - 0x40], rax
call fcn.1400e51f0
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x14002ff2d
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.140092764
mov qword [rbp - 0x48], rax
cmp qword [rbp - 0x48], 0
je 0x14002ff1a
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.1400927cc
mov qword [rbp - 0x50], rax
cmp qword [rbp - 0x50], 0
je 0x14002ff14
call fcn.1400e5120
mov rax, qword [rbp - 0x78]
mov rcx, rax
call fcn.1400e5360
call fcn.1400e5120
call fcn.1400e5120
call fcn.1400e5120
call fcn.1400e5120
call fcn.1400e5180
mov edx, eax
mov rax, qword [rbp - 0x10]
mov r8d, edx
mov edx, SafeArrayPutElement
mov rcx, rax
call fcn.140092918
call fcn.1400e52d0
mov qword [rbp - 0x58], rax
call fcn.1400e5180
mov edx, eax
mov rax, qword [rbp - 0x58]
mov rcx, rax
call fcn.1400153bc
mov qword [rbp - 0x60], rax
call fcn.1400e5180
lea rax, [0x140863550]
mov rcx, rax
call fcn.1400e5360
call fcn.1400e5180
mov edx, eax
lea rax, [rbp - 0x78]
mov rcx, rax
call fcn.1400e53d0
jmp 0x14002fe52
nop
jmp 0x14002fe52
nop
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.1400928a8
mov qword [rbp - 0x68], rax
jmp 0x14002ff2e
nop
call fcn.1400e5120
mov rax, qword [rbp - 0x78]
mov rcx, rax
call fcn.1400e5360
call fcn.1400e52d0
mov qword [rbp - 8], rax
nop
mov rax, qword [rbp + 0x10]
mov rcx, rax
call fcn.1400e5630
mov rax, qword [rbp - 0x70]
mov rcx, rax
call fcn.1400e5630
mov rax, qword [rbp - 0x78]
mov rcx, rax
call fcn.1400e5630
mov rax, qword [rbp - 8]
add rsp, 0xa0
pop rbp
ret
Function at 0x140034443
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
mov qword [rbp - 8], 0
call fcn.1400e50b0
mov qword [rbp - 0x58], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x18], 0
lea rax, str.Kernel32
mov rcx, rax
call sub.KERNEL32.dll_GetModuleHandleW
mov qword [rbp - 0x20], rax
lea rdx, [0x140861520]
mov rax, qword [rbp - 0x20]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x18], rax
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
call sub.KERNEL32.dll_CreateRemoteThread
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x1400344ff
mov qword [rbp - 8], 0
jmp 0x14003454c
nop
mov rax, qword [rbp - 0x10]
mov rdx, 0xffffffffffffffff
mov rcx, rax
call sub.KERNEL32.dll_WaitForSingleObject
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x58]
mov qword [rbp - 0x40], rax
mov rdx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sub.KERNEL32.dll_GetExitCodeThread
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sub.KERNEL32.dll_CloseHandle
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x58]
mov qword [rbp - 8], rax
nop
mov rax, qword [rbp - 8]
add rsp, 0xa0
pop rbp
ret
Function at 0x140035324
Capabilities:
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov qword [rbp - 8], 0
call fcn.1400e50b0
mov rdx, qword [rbp + 0x18]
lea rax, [rbp + 0x18]
mov rcx, rax
call fcn.1400e56b0
mov rdx, qword [rbp + 0x20]
lea rax, [rbp + 0x20]
mov rcx, rax
call fcn.1400e56b0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x40]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x38]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 0x18]
mov qword [rsp + 0x40], rdx
mov rdx, qword [rbp - 0x10]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0xf003f
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rcx
mov rcx, rax
call sub.ADVAPI32.dll_RegCreateKeyExW
mov qword [rbp - 0x20], rax
cmp qword [rbp - 0x20], 0
jne 0x140035431
mov rax, qword [rbp + 0x20]
mov r10, rax
mov rax, qword [rbp - 0x40]
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov rdx, r10
mov rcx, rax
call sub.ADVAPI32.dll_RegSetValueExW
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x40]
mov rcx, rax
call sub.ADVAPI32.dll_RegCloseKey
mov qword [rbp - 0x30], rax
jmp 0x140035432
nop
mov qword [rbp - 8], 0
mov rax, qword [rbp + 0x20]
mov rcx, rax
call fcn.1400e5630
mov rax, qword [rbp + 0x18]
mov rcx, rax
call fcn.1400e5630
mov rax, qword [rbp - 8]
add rsp, 0x90
pop rbp
ret
Function at 0x140072480
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
sub rsp, 0xc8
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
cmp word [0x140000000], 0x5a4d
je 0x1400724bd
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
lea rdi, [0x140000000]
jmp 0x14007254b
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x1400724e1
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x14007254b
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x140072528
cmp ecx, 0x20b
je 0x140072500
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x14007254b
cmp dword [rax + 0x84], 0xe
ja 0x140072514
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x14007254b
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
jmp 0x14007254b
cmp dword [rax + 0x74], 0xe
ja 0x140072539
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x14007254b
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
mov ecx, 2
call qword [sym.imp.msvcrt.dll___set_app_type]
mov qword [0x1408e9e00], 0xffffffffffffffff
mov qword [0x1408e9e20], 0xffffffffffffffff
mov rcx, qword [sym.imp.msvcrt.dll__fmode]
mov eax, dword [0x14086fab0]
mov dword [rcx], eax
mov rcx, qword [sym.imp.msvcrt.dll__commode]
mov eax, dword [0x14086fab4]
mov dword [rcx], eax
call fcn.140072770
cmp dword [0x1408e9e40], 0
jne 0x1400725a5
lea rcx, [0x140072780]
call qword [sym.imp.msvcrt.dll___setusermatherr]
lea rdx, [0x1401a8888]
lea rcx, [0x1401a8880]
call sub.msvcrt.dll__initterm
mov r11d, dword [0x14086fab8]
mov dword [rsp + 0xd8], r11d
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x14086fabc]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3c]
call qword [sym.imp.msvcrt.dll___getmainargs]
lea rdx, [0x1401a8878]
lea rcx, [0x1401a8860]
call sub.msvcrt.dll__initterm
mov r11, qword [sym.imp.msvcrt.dll__acmdln]
mov r8, qword [r11]
mov qword [rsp + 0x30], r8
cmp byte [r8], 0x22
jne 0x140072646
nop
nop
inc r8
mov qword [rsp + 0x30], r8
movzx eax, byte [r8]
test al, al
je 0x140072636
cmp al, 0x22
je 0x140072636
jmp 0x140072620
cmp byte [r8], 0x22
jne 0x140072656
inc r8
mov qword [rsp + 0x30], r8
jmp 0x140072656
cmp byte [r8], 0x20
jbe 0x140072656
inc r8
mov qword [rsp + 0x30], r8
jmp 0x140072646
movzx eax, byte [r8]
test al, al
je 0x14007266c
cmp al, 0x20
ja 0x14007266c
inc r8
mov qword [rsp + 0x30], r8
jmp 0x140072656
test byte [rsp + 0x8c], 1
je 0x140072681
movzx r9d, word [rsp + 0x90]
jmp 0x140072687
mov r9d, 0xa
xor edx, edx
mov rcx, rdi
call fcn.140054dc1
mov edi, eax
mov dword [rsp + 0x38], eax
test ebx, ebx
jne 0x1400726a3
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
call qword [sym.imp.msvcrt.dll__cexit]
jmp 0x1400726c7
mov eax, edi
jmp 0x1400726d0
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
add rsp, 0xc8
ret
Function at 0x14007327c
Capabilities:
Get file size
Read file on windows

Disassembly:
or r8d, 0xffffffff
jmp 0x140073288
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov ebp, r8d
mov rax, rdx
mov r14, rcx
mov ebx, r13d
test rdx, rdx
je 0x14007348d
cmp word [rdx], r13w
je 0x14007348d
mov qword [r11 - 0x38], r13
lea r15d, [r13 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
mov r8d, r15d
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140073488
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
movsxd rsi, eax
test eax, eax
jle 0x14007347f
mov ecx, ebp
call fcn.140073a34
mov rdi, rax
test rax, rax
je 0x14007347f
mov rcx, r14
lea edx, [r13 + 2]
cmp ebp, 0xffffffff
je 0x140073336
mov edx, ebp
call fcn.140074058
mov rbx, rax
test rax, rax
je 0x140073477
mov qword [rax + 0x40], rdi
mov qword [rbx + 0x60], r13
mov dword [rbx + 0x68], r13d
mov dword [rbx + 0x20], r13d
cmp r14, 0xffffffffffffffff
lea r8, [rsi + 0x10]
cmove r14, rax
xor edx, edx
mov qword [rax + 0x48], r14
mov rax, qword [rax + 8]
mov qword [rbx + 0x58], rax
mov rcx, qword [0x14086ee88]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx + 0x38], rax
test rax, rax
je 0x1400733a0
lea ecx, [rsi + 0x10]
mov dword [rax + 8], ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], r13
mov rax, qword [rbx + 0x38]
add rax, 0x10
mov qword [rbx + 0x70], rax
cmp ebp, 0xffffffff
je 0x1400733a9
mov dword [rbx + 0x50], r15d
mov rdx, rbx
mov rcx, rdi
call fcn.1400edca0
mov ebp, r13d
mov r14d, 0x4000
test esi, esi
jle 0x140073473
lea eax, [r14 + rbp]
cmp eax, esi
jle 0x1400733d3
mov r14d, esi
sub r14d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.1400ecff0
mov r15, rax
test rax, rax
je 0x140073461
lea r9, [rsp + 0x78]
mov r8d, r14d
mov rdx, rax
mov rcx, r12
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x78]
cmp edx, r14d
jne 0x14007344d
add ebp, edx
cmp dword [rbx + 0x20], r13d
jne 0x14007341f
mov rcx, r15
call fcn.140073b10
mov dword [rbx + 0x20], eax
mov edx, dword [rsp + 0x78]
mov rcx, rdi
cmp ebp, esi
jl 0x14007342e
mov r8d, 1
jmp 0x140073431
xor r8d, r8d
call fcn.1400ed4e0
test eax, eax
je 0x140073440
cmp ebp, esi
jl 0x1400733c5
jmp 0x140073473
mov rcx, rdi
call fcn.1400ed320
mov dword [rbx + 0x24], eax
jmp 0x140073468
lea rax, [0x140179bb8]
mov dword [rbx + 0x24], 0x100
mov qword [rbx + 0x30], rax
jmp 0x140073473
mov dword [rbx + 0x24], 1
mov rdx, rdi
mov rcx, rbx
call fcn.140073c0c
mov qword [rbx + 0x40], r13
mov rcx, rdi
call fcn.1400ed670
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
jmp 0x14007348f
xor eax, eax
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140073288
Capabilities:
Get file size
Read file on windows

Disassembly:
or r8d, 0xffffffff
jmp 0x140073288
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov ebp, r8d
mov rax, rdx
mov r14, rcx
mov ebx, r13d
test rdx, rdx
je 0x14007348d
cmp word [rdx], r13w
je 0x14007348d
mov qword [r11 - 0x38], r13
lea r15d, [r13 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
mov r8d, r15d
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140073488
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
movsxd rsi, eax
test eax, eax
jle 0x14007347f
mov ecx, ebp
call fcn.140073a34
mov rdi, rax
test rax, rax
je 0x14007347f
mov rcx, r14
lea edx, [r13 + 2]
cmp ebp, 0xffffffff
je 0x140073336
mov edx, ebp
call fcn.140074058
mov rbx, rax
test rax, rax
je 0x140073477
mov qword [rax + 0x40], rdi
mov qword [rbx + 0x60], r13
mov dword [rbx + 0x68], r13d
mov dword [rbx + 0x20], r13d
cmp r14, 0xffffffffffffffff
lea r8, [rsi + 0x10]
cmove r14, rax
xor edx, edx
mov qword [rax + 0x48], r14
mov rax, qword [rax + 8]
mov qword [rbx + 0x58], rax
mov rcx, qword [0x14086ee88]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx + 0x38], rax
test rax, rax
je 0x1400733a0
lea ecx, [rsi + 0x10]
mov dword [rax + 8], ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], r13
mov rax, qword [rbx + 0x38]
add rax, 0x10
mov qword [rbx + 0x70], rax
cmp ebp, 0xffffffff
je 0x1400733a9
mov dword [rbx + 0x50], r15d
mov rdx, rbx
mov rcx, rdi
call fcn.1400edca0
mov ebp, r13d
mov r14d, 0x4000
test esi, esi
jle 0x140073473
lea eax, [r14 + rbp]
cmp eax, esi
jle 0x1400733d3
mov r14d, esi
sub r14d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.1400ecff0
mov r15, rax
test rax, rax
je 0x140073461
lea r9, [rsp + 0x78]
mov r8d, r14d
mov rdx, rax
mov rcx, r12
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x78]
cmp edx, r14d
jne 0x14007344d
add ebp, edx
cmp dword [rbx + 0x20], r13d
jne 0x14007341f
mov rcx, r15
call fcn.140073b10
mov dword [rbx + 0x20], eax
mov edx, dword [rsp + 0x78]
mov rcx, rdi
cmp ebp, esi
jl 0x14007342e
mov r8d, 1
jmp 0x140073431
xor r8d, r8d
call fcn.1400ed4e0
test eax, eax
je 0x140073440
cmp ebp, esi
jl 0x1400733c5
jmp 0x140073473
mov rcx, rdi
call fcn.1400ed320
mov dword [rbx + 0x24], eax
jmp 0x140073468
lea rax, [0x140179bb8]
mov dword [rbx + 0x24], 0x100
mov qword [rbx + 0x30], rax
jmp 0x140073473
mov dword [rbx + 0x24], 1
mov rdx, rdi
mov rcx, rbx
call fcn.140073c0c
mov qword [rbx + 0x40], r13
mov rcx, rdi
call fcn.1400ed670
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
jmp 0x14007348f
xor eax, eax
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14007421c
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x1400742e2
lea rcx, [0x1408e9ee0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14086fad0]
jmp 0x1400742a6
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400742a3
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x14086fad0]
mov rdx, rsi
call fcn.1400e4f24
jmp 0x1400742a6
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140074273
mov rdx, qword [0x140869e88]
lea rcx, [0x14086fad0]
mov rdi, rdx
inc rdx
mov qword [0x140869e88], rdx
lea edx, [rbx + 0x20]
call fcn.1400e4f6c
lea rcx, [0x1408e9ee0]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x140074764
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x1400747db
movsxd rdx, ecx
lea rcx, [0x1400746c0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [0x14086fae0]
test rbx, rbx
je 0x14007484e
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x1400747d1
cmp byte [rbx + 0x20], 0
je 0x1400747d1
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
xor r8d, r8d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x140074797
jmp 0x14007484e
mov rbx, qword [0x14086fae0]
test rbx, rbx
je 0x14007484e
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140074846
cmp byte [rbx + 0x21], 0
je 0x14007480a
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x140074836
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x14086fae0]
call fcn.1400e4f24
mov rbx, rdi
test rdi, rdi
jne 0x1400747e7
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140074e00
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
mov rdx, rcx
mov rcx, qword [0x1408e9f60]
call fcn.1400e44fc
test rax, rax
je 0x140074e3d
cmp dword [rax + 0x28], 0
je 0x140074e3d
mov rcx, qword [rax + 0x18]
mov r9d, ebx
mov r8d, dword [rcx + 4]
mov edx, dword [rcx]
mov rcx, qword [rax + 0x10]
add rsp, 0x20
pop rbx
jmp fcn.140074a20
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp fcn.1400e5c50
Function at 0x140092804
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
test r8d, r8d
jle 0x14009286b
mov rcx, qword [rbp + 0x18]
and dword [rsp + 0x50], 0
and qword [rsp + 0x20], 0
mov r8d, edi
movsxd rdx, ebx
lea r9, [rsp + 0x50]
sub r8d, ebx
add rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14009285d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x140092867
add ebx, dword [rsp + 0x50]
cmp ebx, edi
jge 0x14009286b
jmp 0x140092828
add ebx, dword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
movsxd rax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140092918
Capabilities:
Read file on windows

Disassembly:
mov rcx, qword [rcx + 0x18]
mov r9d, r8d
or r8d, 0xffffffff
jmp 0x140092ce0
mov rax, rsp
mov dword [rax + 0x20], r9d
mov dword [rax + 0x18], r8d
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
xor eax, eax
mov ecx, 0x1000
mov r15d, r9d
mov r13d, r8d
mov edi, ecx
mov esi, eax
mov r14d, eax
mov r12d, eax
cmp edx, 0x18
je 0x140092e1f
cmp edx, 2
je 0x140092e1f
mov rcx, qword [0x14086ee88]
xor edx, edx
mov r8d, 0x2000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor ecx, ecx
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x90]
lea r8d, [r12 + 2]
lea rdx, [rsp + 0x34]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
test eax, eax
je 0x140092e08
mov r15, qword [rsp + 0x90]
mov ebp, edi
cmp dword [rsp + 0x38], 2
jne 0x140092e00
cmp r13d, 0xffffffff
je 0x140092d8d
cmp r14d, r13d
jae 0x140092e00
add r14d, 2
test edi, edi
jne 0x140092db8
mov rcx, qword [0x14086ee88]
movsxd r9, ebp
lea edx, [rdi + 8]
add r9, r9
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, 0x1000
xor ecx, ecx
mov rbx, rax
movzx eax, word [rsp + 0x34]
cmp ax, 0xa
je 0x140092e00
cmp ax, 0xd
je 0x140092dd8
mov word [r12 + rbx], ax
inc esi
inc ebp
add r12, 2
dec edi
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x34]
mov r8d, 2
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
test eax, eax
jne 0x140092d7b
mov r15d, dword [rsp + 0xa8]
movsxd rax, esi
mov edx, r15d
mov word [rbx + rax*2], cx
mov rcx, rbx
call fcn.1401616d0
jmp 0x140092ee8
mov r8, rcx
mov rcx, qword [0x14086ee88]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15d, dword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
mov rbx, rax
mov r13d, edi
cmp r15d, 0xffffffff
je 0x140092e52
cmp r14d, r15d
jae 0x140092ebc
xor ecx, ecx
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x30]
lea r8d, [rcx + 1]
mov qword [rsp + 0x20], rcx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140092ebc
cmp dword [rsp + 0x38], 1
jne 0x140092ebc
inc r14d
test edi, edi
jne 0x140092ea0
mov rcx, qword [0x14086ee88]
lea edx, [rdi + 8]
movsxd r9, r13d
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, 0x1000
mov rbx, rax
mov al, byte [rsp + 0x30]
cmp al, 0xa
je 0x140092ebc
cmp al, 0xd
je 0x140092e47
mov byte [r12 + rbx], al
inc esi
inc r13d
inc r12
dec edi
jmp 0x140092e47
mov r15d, dword [rsp + 0xa8]
xor ecx, ecx
cmp dword [rsp + 0x98], 0x18
movsxd rax, esi
mov edx, r15d
mov byte [rax + rbx], cl
mov rcx, rbx
jne 0x140092ee3
call fcn.140161730
jmp 0x140092ee8
call fcn.140161500
mov rcx, qword [0x14086ee88]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret