joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003330
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rdx + 4]
mov rsi, rdx
call sub.WS2_32.dll_ntohl
mov rcx, qword [rbx]
xor r8d, r8d
add eax, dword [rbx + 8]
mov edx, eax
call fcn.14000a5b4
mov ecx, dword [rsi + 8]
call sub.WS2_32.dll_ntohl
mov ecx, eax
call fcn.1400082c0
mov rdi, rax
test rax, rax
jne 0x140003392
lea rcx, str.Could_not_allocate_read_buffer_n
call fcn.1400012f0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rsi + 8]
call sub.WS2_32.dll_ntohl
mov r9, qword [rbx]
mov r8d, 1
mov edx, eax
mov rcx, rdi
call fcn.140009a80
cmp rax, 1
jae 0x1400033d1
lea rcx, str.Could_not_read_from_file_n
call fcn.1400012f0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp byte [rsi + 0x10], 1
jne 0x140003417
mov rdx, rsi
mov rcx, rdi
call fcn.140003240
mov rcx, rdi
mov rbx, rax
call fcn.140008280
mov rdi, rbx
test rbx, rbx
jne 0x140003417
lea rdx, [rsi + 0x12]
lea rcx, str.Error_decompressing__s_n
call fcn.1400012f0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x140003430
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call fcn.140003330
mov rcx, rdi
mov rbp, rax
call fcn.140002350
cmp eax, 0xffffffff
jne 0x14000346c
or eax, eax
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, [rdi + 0x2078]
lea rdx, [rsi + 0x12]
mov qword [rsp + 0x30], rbx
call fcn.140002660
mov rdi, rax
test rax, rax
jne 0x14000349e
lea rdx, [rsi + 0x12]
lea rcx, str._s_could_not_be_extracted__n
call fcn.140001270
or eax, 0xffffffff
jmp 0x1400034cb
mov ecx, dword [rsi + 0xc]
call sub.WS2_32.dll_ntohl
mov r9, rdi
mov r8d, 1
mov edx, eax
mov rcx, rbp
call fcn.1400096c0
mov rcx, rdi
call fcn.14000940c
mov rcx, rbp
call fcn.140008280
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400034e0
Capabilities:
Read file on windows

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx]
add edx, 0xffffffa8
xor r8d, r8d
call fcn.14000a5b4
test eax, eax
je 0x140003504
or eax, 0xffffffff
add rsp, 0x20
pop rdi
ret
mov r9, qword [rdi]
mov edx, 0x58
lea rcx, [rdi + 0x20]
lea r8d, [rdx - 0x57]
mov qword [rsp + 0x30], rbx
call fcn.140009a80
cmp rax, 1
jae 0x140003532
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rdx, str.MEI_f_v_n_v
lea rcx, [rdi + 0x20]
mov r8d, 8
call fcn.14000a640
mov rbx, qword [rsp + 0x30]
neg eax
sbb eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140003560
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x40], 0
call fcn.14000a5b4
mov r9, qword [rbx]
mov edx, 1
lea r8d, [rdx + 1]
lea rcx, [rsp + 0x38]
call fcn.140009a80
cmp byte [rsp + 0x38], 0x4d
jne 0x140003651
cmp byte [rsp + 0x39], 0x5a
jne 0x140003651
mov rcx, qword [rbx]
xor r8d, r8d
lea edx, [r8 + 0x3c]
call fcn.14000a5b4
mov r9, qword [rbx]
mov edx, 4
lea r8d, [rdx - 3]
lea rcx, [rsp + 0x40]
call fcn.140009a80
mov edx, dword [rsp + 0x40]
mov rcx, qword [rbx]
add edx, 0x18
xor r8d, r8d
call fcn.14000a5b4
mov r9, qword [rbx]
mov edx, 2
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x38]
call fcn.140009a80
cmp byte [rsp + 0x38], 0xb
jne 0x140003651
movzx eax, byte [rsp + 0x39]
cmp al, 1
jne 0x14000360e
mov ecx, 0x98
jmp 0x140003617
cmp al, 2
jne 0x140003651
mov ecx, 0xa8
mov eax, dword [rsp + 0x40]
xor r8d, r8d
lea edx, [rcx + rax]
mov rcx, qword [rbx]
call fcn.14000a5b4
mov r9, qword [rbx]
mov edx, 4
lea r8d, [rdx - 3]
lea rcx, [rsp + 0x40]
call fcn.140009a80
mov eax, dword [rsp + 0x40]
or ecx, 0xffffffff
test eax, eax
cmove eax, ecx
add rsp, 0x20
pop rbx
ret
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
Function at 0x140003660
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
lea rdx, [0x14001c6d4]
add rcx, 0x78
call fcn.140004460
mov qword [rsi], rax
test rax, rax
jne 0x14000368a
or eax, 0xffffffff
add rsp, 0x20
pop rsi
ret
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x30], rbx
lea r8d, [rdx + 2]
call fcn.14000a5b4
mov rcx, qword [rsi]
call fcn.14000a8b0
mov rcx, rsi
mov edx, eax
mov ebx, eax
call fcn.1400034e0
test eax, eax
jns 0x1400036f5
mov rcx, rsi
call fcn.140003560
mov ebx, eax
cmp eax, 1
jl 0x1400037bd
mov qword [rsp + 0x38], rdi
xor edi, edi
nop
mov edx, ebx
mov rcx, rsi
call fcn.1400034e0
test eax, eax
jns 0x1400036e7
inc edi
dec ebx
cmp edi, 8
jl 0x1400036d0
cmp edi, 8
mov rdi, qword [rsp + 0x38]
je 0x1400037bd
mov ecx, dword [rsi + 0x28]
mov dword [rsi + 0x407c], 0
call sub.WS2_32.dll_ntohl
mov ecx, dword [rsi + 0x2c]
sub ebx, eax
mov dword [rsi + 8], ebx
call sub.WS2_32.dll_ntohl
mov rcx, qword [rsi]
add eax, dword [rsi + 8]
xor r8d, r8d
mov edx, eax
call fcn.14000a5b4
mov ecx, dword [rsi + 0x30]
call sub.WS2_32.dll_ntohl
mov ecx, eax
call fcn.1400082c0
mov qword [rsi + 0x10], rax
test rax, rax
jne 0x140003756
lea rcx, str.Could_not_allocate_buffer_for_TOC.
call fcn.140001270
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x20
pop rsi
ret
mov ecx, dword [rsi + 0x30]
call sub.WS2_32.dll_ntohl
mov r9, qword [rsi]
mov rcx, qword [rsi + 0x10]
mov edx, eax
mov r8d, 1
call fcn.140009a80
cmp rax, 1
jae 0x140003792
lea rcx, str.Could_not_read_from_file.
call fcn.140001270
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x20
pop rsi
ret
mov ecx, dword [rsi + 0x30]
call sub.WS2_32.dll_ntohl
mov rcx, qword [rsi]
mov r11d, eax
add r11, qword [rsi + 0x10]
mov qword [rsi + 0x18], r11
call fcn.140009778
test eax, eax
je 0x1400037cb
lea rcx, str.Error_on_file
call fcn.140001270
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret
Function at 0x140003f80
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r12
mov eax, 0x4030
call fcn.140007710
sub rsp, rax
mov rax, qword [0x1400241e0]
xor rax, rsp
mov qword [rsp + 0x4020], rax
mov r12d, dword [0x14002d9fc]
mov rbp, qword [0x14002da00]
mov ecx, 0x4080
call fcn.1400082c0
mov rbx, rax
test rax, rax
jne 0x140003fdf
lea rcx, str.Cannot_allocate_memory_for_ARCHIVE_STATUS_n
call fcn.140001270
or eax, 0xffffffff
jmp 0x1400041a8
mov rdx, qword [rbp]
lea rcx, [rsp + 0x1020]
mov qword [rsp + 0x4040], rsi
mov qword [rsp + 0x4048], rdi
call fcn.1400047d0
lea rdx, [rsp + 0x1020]
lea rcx, [rsp + 0x2020]
call fcn.140004a90
lea rdx, [rsp + 0x1020]
lea rcx, [rsp + 0x20]
call fcn.140004a30
lea rcx, str._MEIPASS2
call fcn.140002190
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
mov rsi, rax
xor eax, eax
lea rdx, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
lea r8, [rsp + rcx + 0x101f]
mov rcx, rbx
call fcn.140003890
test eax, eax
je 0x1400040ac
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x20]
not rcx
lea r8, [rsp + rcx + 0x201f]
mov rcx, rbx
call fcn.140003890
test eax, eax
je 0x1400040ac
lea r8, [rsp + 0x2020]
lea rdx, [rsp + 0x1020]
lea rcx, str.Cannot_open_self__s_or_archive__s_n
call fcn.140001270
or eax, 0xffffffff
jmp 0x140004198
test rsi, rsi
jne 0x1400040f7
mov rcx, rbx
call fcn.140001880
test eax, eax
jne 0x1400041ce
lea rsi, [rsp + 0x20]
xor edx, edx
nop dword [rax + rax]
movzx eax, byte [rsp + rdx + 0x20]
inc rdx
mov byte [rsp + rdx + 0x301f], al
test al, al
jne 0x1400040d0
lea rdx, [rsp + 0x3020]
lea rcx, str._MEIPASS2
call sub.KERNEL32.dll_SetEnvironmentVariableA
lea rax, [rsp + 0x20]
mov rdi, rsi
sub rdi, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + rdi]
sub edx, ecx
jne 0x140004114
inc rax
test ecx, ecx
jne 0x140004102
test edx, edx
je 0x14000416e
mov rdi, rbx
mov rdx, rsi
lea rcx, [rbx + 0x2078]
sub rdi, rsi
nop dword [rax + rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rdi + rdx + 0x2077], al
test al, al
jne 0x140004130
lea rdx, [rbx + 0x3078]
mov dword [rbx + 0x4078], 1
sub rdx, rcx
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rdx + rcx - 1], al
test al, al
jne 0x140004160
lea rcx, [rsp + 0x1020]
mov rdx, rsi
call fcn.140001ae0
mov r8, rbp
mov edx, r12d
mov rcx, rbx
call fcn.140001af0
mov rcx, rbx
mov esi, eax
call fcn.140001b70
mov eax, esi
mov rsi, qword [rsp + 0x4040]
mov rdi, qword [rsp + 0x4048]
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.1400075e0
lea r11, [rsp + 0x4030]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
mov rcx, rbx
call fcn.1400018d0
test eax, eax
jne 0x1400040a4
lea rdi, [rbx + 0x2078]
lea rdx, [rsp + 0x20]
lea rcx, str._MEIPASS2
cmp byte [rdi], al
cmovne rdx, rdi
call sub.KERNEL32.dll_SetEnvironmentVariableA
mov rcx, rbx
call fcn.1400028e0
cmp eax, 0xffffffff
je 0x1400040a4
lea rcx, [rsp + 0x1020]
mov rdx, rbp
call fcn.1400028f0
cmp dword [rbx + 0x4078], 1
mov esi, eax
jne 0x140004230
mov rcx, rdi
call fcn.1400023a0
mov rcx, rbx
call fcn.1400038c0
jmp 0x140004196
Function at 0x1400088c0
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1400088d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400088da
xor eax, eax
test eax, eax
je 0x1400088ea
mov ecx, eax
call fcn.14000c3f4
or eax, 0xffffffff
jmp 0x1400088ec
xor eax, eax
add rsp, 0x28
ret

Function at 0x140008bd0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140008be6
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140008be8
xor eax, eax
test eax, eax
je 0x140008bf8
mov ecx, eax
call fcn.14000c3f4
or eax, 0xffffffff
jmp 0x140008bfa
xor eax, eax
add rsp, 0x28
ret

Function at 0x140008c00
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x140008c16
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140008c18
xor eax, eax
test eax, eax
je 0x140008c28
mov ecx, eax
call fcn.14000c3f4
or eax, 0xffffffff
jmp 0x140008c2a
xor eax, eax
add rsp, 0x28
ret

Function at 0x14000aefc
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14000ad6c

Function at 0x14000bdcf
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400241e0]
jne 0x1400075fa
rol rcx, 0x10
test cx, 0xffff
jne 0x1400075f6
repz ret
ror rcx, 0x10
jmp 0x14000bd28
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14002db10]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14002dc08]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000bdad
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14002db10]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000bdcf
mov rax, qword [rsp + 0x88]
mov qword [0x14002dc08], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14002dba8], rax
mov rax, qword [0x14002dc08]
mov qword [0x14002da80], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14002db90], rax
mov dword [0x14002da70], 0xc0000409
mov dword [0x14002da74], 1
mov rax, qword [0x1400241e0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400241e8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14002db08], eax
mov ecx, 1
call fcn.1400155e4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140020018]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14002db08], 0
jne 0x14000be56
mov ecx, 1
call fcn.1400155e4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400103c8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
jne 0x1400103f2
call fcn.14000c3d4
and dword [rax], 0
call fcn.14000c3b4
mov ebx, 0x16
mov dword [rax], ebx
call fcn.14000c34c
mov eax, ebx
jmp 0x140010442
test edx, 0xfffffff9
jne 0x1400103d5
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14001041b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14000c3f4
call fcn.14000c3b4
mov eax, dword [rax]
jmp 0x140010442
test al, 0x10
jne 0x140010440
test al, 1
je 0x140010440
test bl, 2
je 0x140010440
call fcn.14000c3d4
mov dword [rax], 5
call fcn.14000c3b4
mov dword [rax], ntohl
jmp 0x140010412
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140016ca0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1400241e0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14000efb8
xor ebx, ebx
cmp qword [0x14002ea90], rbx
mov rdi, rax
jne 0x140016db3
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140016e8a
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140016e8a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14002ea90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14002ea98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14002eaa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14002eab0], rax
test rax, rax
je 0x140016daa
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14002eaa8], rax
jmp 0x140016dba
mov rax, qword [0x14002eaa8]
jmp 0x140016dc1
mov rax, qword [0x14002eaa8]
mov r11, qword [0x14002eab0]
cmp rax, rdi
je 0x140016e28
cmp r11, rdi
je 0x140016e28
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14002eab0]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140016e28
test rax, rax
je 0x140016e28
call rsi
test rax, rax
je 0x140016e22
lea rcx, [rsp + 0x30]
mov r9d, ntohl
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140016e22
test byte [rsp + 0x40], 1
jne 0x140016e28
bts ebp, 0x15
jmp 0x140016e68
mov rcx, qword [0x14002ea98]
cmp rcx, rdi
je 0x140016e68
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140016e68
call rax
mov rbx, rax
test rax, rax
je 0x140016e68
mov rcx, qword [0x14002eaa0]
cmp rcx, rdi
je 0x140016e68
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140016e68
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14002ea90]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140016e8a
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140016e8c
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400075e0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140aa8b72
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.14130d744

Function at 0x140ac7dc5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jno 0x140aedd69
jo 0x140bc3fc5
add di, word [rsp + 0x15]
cmp dil, bpl
ja 0x140bc3f9c
sub rdx, rbp
neg r15
jae 0x140beec58
movabs r10, 0x809731a5eea5361
neg r9d
add qword [rsp + 0x10], r10
mov rdi, qword [rsp + 0x88]
test r15, rdx
movsx bp, word [rsp + 0x39]
jl 0x140b27fc0
and dword [rsp + 0x20], 0x3bf1d34
add word [rsp + 0x20], 0x1b2d
test qword [rsp + 0x20], 0x50003e04

Function at 0x140ae78d8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test qword [rsp + 0x68], r9
jo 0x140aa8c25

Function at 0x140af50b0
Capabilities:
Encode data using xor

Disassembly:
or esi, dword [rsp + 0x5c]
add r8d, dword [rsp + 0x50]
cmovg si, word [rsp + 0x50]
or dword [rsp + 0x50], r8d
neg rsi
setg byte [rsp + 0x50]
jo 0x140c130f6
neg r8b
xor dword [rsp + 0x50], 0x7ac120e0
add rbx, 0x96a2a9f
mov r8, qword [rsp + 0x58]
sets dl
cmp rdx, 0x354e5530
call fcn.140c130e7
mov dl, 0x18
invalid
sub qword [rsp + 0x58], 0x1a1d019e
jne 0x140ac1b48
xor rcx, 0x61037242
and ecx, 0x57ca4ab7
call fcn.140be500a
invalid

Function at 0x140b38356
Capabilities:
Encode data using xor

Disassembly:
add byte [rsp + 0x30], 0xf4
add qword [rsp + 0x70], 0x4f441bc3
setl byte [rsp + 0x70]
jne 0x140b4fcc7
call fcn.1411c1241
setge byte [rsp + 0x48]
or dword [rsp + 0x30], 0x6bfc5599
mov rsi, qword [rsp + 0x88]
test qword [rsp + 0x30], 0x493429b1
mov dword [rsp + 0x70], 0x57c6942
mov byte [rsp + 0x48], 0x59
setae byte [rsp + 0x48]
mov word [rsp + 0x30], 0x7596
mov qword [rsp + 0x70], 0x1cd91916
xor dword [rsp + 0x30], 0x2bed064d
js 0x140b3836b
sub word [rsp + 0x70], 0x9b9
jg 0x140a9f422
call fcn.140be864b
xor edx, ebp
popfq
xchg edx, eax
mov bh, 0xf9
and ah, dl
invalid
invalid
int1
invalid
invalid

Function at 0x140bdb9ba
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
jle 0x140ada29f
not r14b
add r11d, dword [rsp + 0x39]
or bx, word [rsp + 0x3c]
bswap rbx
push rbp
push 0x4d02387e
sets byte [rsp]
mov r14, qword [rsp + 0x38]
call fcn.140ab6201
je 0x140bf2341
mov r12, qword [rsp]
jb 0x140ae085a
add ebp, ebp
invalid
not r14w
movsxd rdi, ebx
push rcx
push r8
js 0x140b22b85
Function at 0x140bebc64
Capabilities:
Resolve function by parsing pe exports

Disassembly:
setbe byte [rsp + 0x20]
call fcn.1411beba2
cmp dil, 0xf5
setg dil
sub rdi, 0x40166b82
setl dil
not edi
call fcn.140acde14
jmp 0x135fd7698
popfq
lea rsp, [rsp + 0x10]
call fcn.14129822c
not r10w
pop r10
xor rdx, qword [rsp + 0x20]
not r14
cmp dword [rsp + 0x20], edx
setne dl
mov byte [rsp + 0x20], r14b
not rdx
cmp dx, word [rsp + 0x25]
seto dl
or dx, 0x1459
or dword [rsp + 0x20], r14d
lea rdx, [r14*4 + 0x74c95bb5]
ja 0x140bee528
call fcn.140acd424
stc
jne 0x140bebc1c
xchg esp, eax
cdq
jae 0x140bebcd8
xor byte [rbx], 0xfe
sub ah, byte [rax]
mov gs, edx
loop 0x140bebc94
nop
invalid
invalid
test dword [rdi - 0x6b], 0x71eaf1d4
insb byte [rdi], dx
sahf
invalid
mov rdx, qword [rsp + 0x10]
and dword [rsp + 0x20], r14d
not word [rsp + 0x20]
neg byte [rsp + 0x20]
jne 0x1411c12f3
test word [rsp + 0x20], r14w
bswap r14d
not word [rsp + 0x20]
not byte [rsp + 0x20]
movsx r14d, word [rsp + 0x22]
ja 0x140b21e38
Function at 0x140006e2c
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140015150]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r15, rcx
xor ecx, ecx
mov ebp, r8d
mov r12, rdx
call qword [0x1400150e0]
xor edi, edi
mov rsi, rax
call fcn.140004528
cmp qword [0x140017b70], rdi
mov r14d, eax
jne 0x140006f6d
lea rcx, str.USER32.DLL
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x140006ebf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x140007081
lea rcx, str.USER32.DLL
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
je 0x140007081
lea rdx, [0x14000ed18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007081
mov rcx, rax
call qword [0x1400150e0]
lea rdx, str.GetActiveWindow
mov rcx, rbx
mov qword [0x140017b70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [0x1400150e0]
lea rdx, str.GetLastActivePopup
mov rcx, rbx
mov qword [0x140017b78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [0x1400150e0]
lea rdx, str.GetUserObjectInformationW
mov rcx, rbx
mov qword [0x140017b80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [0x1400150e0]
mov qword [0x140017b90], rax
test rax, rax
je 0x140006f6d
lea rdx, str.GetProcessWindowStation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [0x1400150e0]
mov qword [0x140017b88], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140006f94
test r15, r15
je 0x140006f85
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test r14d, r14d
je 0x140006fb0
mov eax, 4
jmp 0x140007083
test r14d, r14d
je 0x140006fb0
mov rcx, qword [0x140017b70]
call qword [0x1400150e8]
mov eax, 3
jmp 0x140007083
mov rcx, qword [0x140017b88]
cmp rcx, rsi
je 0x14000701f
cmp qword [0x140017b90], rsi
je 0x14000701f
call qword [0x1400150e8]
mov rcx, qword [0x140017b90]
mov rbx, rax
call qword [0x1400150e8]
mov r14, rax
test rbx, rbx
je 0x14000701f
test rax, rax
je 0x14000701f
call rbx
test rax, rax
je 0x140007019
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r14
test eax, eax
je 0x140007019
test byte [rsp + 0x40], 1
jne 0x14000701f
bts ebp, 0x15
jmp 0x14000705f
mov rcx, qword [0x140017b78]
cmp rcx, rsi
je 0x14000705f
call qword [0x1400150e8]
test rax, rax
je 0x14000705f
call rax
mov rdi, rax
test rax, rax
je 0x14000705f
mov rcx, qword [0x140017b80]
cmp rcx, rsi
je 0x14000705f
call qword [0x1400150e8]
test rax, rax
je 0x14000705f
mov rcx, rdi
call rax
mov rdi, rax
mov rcx, qword [0x140017b70]
call qword [0x1400150e8]
test rax, rax
je 0x140007081
mov r9d, ebp
mov r8, r12
mov rdx, r15
mov rcx, rdi
call rax
jmp 0x140007083
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140002510
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800113f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x20
xor esi, esi
mov r14, r9
mov qword [r8 + 0x28], rsi
mov rbx, r8
mov rbp, rdx
test rdx, rdx
jne 0x180011422
lea eax, [rdx + 1]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
mov rax, qword [rcx]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r15
call qword [rax]
movzx edx, bp
mov r8, r14
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x180011517
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x180011517
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x18001150e
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov qword [rbx + 0x28], rsi
cmp qword [rbx + 0x20], rdi
jl 0x1800114ec
cmp rdi, 1
jne 0x1800114aa
movzx ecx, byte [r14]
mov rax, qword [rbx + 0x18]
mov byte [rax], cl
inc qword [rbx + 0x28]
jmp 0x180011509
cmp rdi, 2
jne 0x1800114c1
movzx ecx, word [r14]
mov rax, qword [rbx + 0x18]
mov word [rax], cx
add qword [rbx + 0x28], rdi
jmp 0x180011509
cmp rdi, 4
jne 0x1800114d6
mov ecx, dword [r14]
mov rax, qword [rbx + 0x18]
mov dword [rax], ecx
add qword [rbx + 0x28], rdi
jmp 0x180011509
cmp rdi, 8
jne 0x1800114ec
mov rcx, qword [r14]
mov rax, qword [rbx + 0x18]
mov qword [rax], rcx
add qword [rbx + 0x28], rdi
jmp 0x180011509
test eax, eax
je 0x180011509
mov rdx, rdi
mov rcx, rbx
call fcn.180012c20
mov r8, rdi
mov rdx, r14
mov rcx, rax
call fcn.18001a8a0
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r15, qword [rsp + 0x48]
mov rax, rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret