joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400206e0
Capabilities:
Get graphical window text

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rsi, rcx
mov rax, qword [0x140190038]
xor rax, rsp
mov qword [rsp + 0x90], rax
call fcn.14001b130
test rax, rax
je 0x1400208a6
mov rcx, rax
call fcn.14010a090
add rax, 0x18
lea rdi, [rsp + 0x88]
mov qword [rdi], rax
mov rcx, qword [rsi + 0x708]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebx, [rax + 1]
mov rcx, rdi
mov edx, ebx
call fcn.14010b310
mov rcx, qword [rsi + 0x708]
mov rdx, rax
mov r8d, ebx
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, rdi
mov edx, eax
call fcn.14010b2b0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [0x14016ceb0]
movaps xmmword [rsp + 0x70], xmm0
mov rcx, qword [rdi]
mov qword [rsp + 0x48], rcx
test rcx, rcx
je 0x14002087a
call fcn.1400f5ad8
lea rdx, [rsp + 0x48]
mov qword [rdx + 8], rax
lea rbx, [rsp + 0x58]
mov rcx, rbx
call fcn.14008bdf0
lea rdx, [0x14016dda8]
lea r14, [rsp + 0x30]
mov rcx, r14
call fcn.14010b190
mov rdx, qword [rsi + 8]
lea rdi, [rsp + 0x70]
mov rcx, rdi
mov r8, r14
mov r9, rbx
call fcn.140020480
cmp byte [r14 + 0x17], 0
jns 0x1400207e3
mov rcx, qword [rsp + 0x30]
call fcn.1400d0be4
cmp byte [rsp + 0x6f], 0
jns 0x1400207f4
mov rcx, qword [rsp + 0x58]
call fcn.1400d0be4
movzx eax, byte [rsp + 0x87]
test al, al
js 0x140020807
mov ecx, eax
and ecx, 0x7f
jmp 0x14002080c
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14002082a
test al, al
jns 0x14002081a
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rsi + 0x708]
mov rdx, rdi
call qword [sym.imp.USER32.dll_SetWindowTextW]
lea rcx, [rsp + 0x70]
call fcn.140090910
mov rdx, qword [rsp + 0x88]
mov eax, 0xffffffff
lock xadd dword [rdx - 8], eax
dec eax
test eax, eax
jle 0x14002086b
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400d2660
xor eax, eax
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [rdx - 0x18]
add rdx, 0xffffffffffffffe8
call fcn.14010a010
jmp 0x14002084c
lea rax, str.null_pointer_passed_to_non_null_argument_of_char_traits_..._::length
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__s___nullptr
mov r8d, 0x109
call fcn.14010d520
mov ecx, 0x80004005
call fcn.14001b100
int3
Function at 0x140020d70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov ebx, r8d
mov r15, rdx
mov rsi, rcx
mov eax, r8d
shr eax, 4
inc eax
movzx edx, ax
mov r8d, 6
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor edi, edi
test rax, rax
je 0x140020e1d
mov r12, rax
mov rcx, r15
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140020e1d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x140020e1d
mov r14, rax
mov rcx, r15
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
setne cl
and ebx, 0xf
je 0x140020e0c
test eax, eax
je 0x140020e0c
mov ecx, eax
mov rax, r14
add rax, rcx
dec ebx
movzx ecx, word [r14]
lea r14, [r14 + rcx*2]
add r14, 2
cmp r14, rax
setb cl
add ebx, 0xffffffff
jae 0x140020e0c
cmp r14, rax
jb 0x140020df0
test cl, cl
je 0x140020e1d
movzx ebx, word [r14]
test ebx, ebx
je 0x140020e1d
test r14, r14
jne 0x140020e2d
mov eax, edi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rdi, [r14 + 2]
mov rcx, rsi
mov edx, ebx
call fcn.14010b310
movzx r9d, word [r14]
mov rcx, rax
mov edx, ebx
mov r8, rdi
call fcn.140020fb0
mov rax, qword [rsi]
cmp dword [rax - 0xc], ebx
jl 0x140020e69
mov dword [rax - 0x10], ebx
mov rax, qword [rsi]
mov ecx, ebx
mov word [rax + rcx*2], 0
mov edi, 1
jmp 0x140020e1d
mov ecx, 0x80070057
call fcn.14001b100
int3

Function at 0x140020e80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov esi, edx
mov edi, ecx
lea rcx, [0x14019f7e0]
xor r14d, r14d
xor edx, edx
call fcn.1400d124c
test rax, rax
je 0x140020edf
mov ecx, edi
shr ecx, 4
inc ecx
movzx ebx, cx
and edi, 0xf
mov qword [rsp + 0x30], rdi
lea ecx, [rdi - 1]
mov dword [rsp + 0x2c], ecx
mov r12d, 1
mov rdi, qword [sym.imp.KERNEL32.dll_FindResourceExW]
lea r15, [0x14019f7e0]
mov r14, rax
jmp 0x140020f1f
xor r14d, r14d
mov rax, r14
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test cl, cl
je 0x140020f04
cmp word [r13], 0
je 0x140020f04
test r13, r13
jne 0x140020edf
lea ebp, [r12 + 1]
mov rcx, r15
mov edx, r12d
call fcn.1400d124c
mov r14, rax
mov r12d, ebp
test rax, rax
je 0x140020edc
mov edx, 6
mov rcx, r14
mov r8, rbx
mov r9d, esi
call rdi
test rax, rax
je 0x140020f04
mov rbp, rax
mov rcx, r14
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140020f04
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x140020f04
mov r13, rax
mov rcx, r14
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
setne cl
cmp dword [rsp + 0x30], 0
je 0x140020ef3
test eax, eax
je 0x140020ef3
mov ecx, eax
mov rax, r13
add rax, rcx
mov edx, dword [rsp + 0x2c]
movzx ecx, word [r13]
lea r13, [r13 + rcx*2 + 2]
cmp r13, rax
setb cl
add edx, 0xffffffff
jae 0x140020ef3
cmp r13, rax
jb 0x140020f85
jmp 0x140020ef3
Function at 0x140023bc0
Capabilities:
Get graphical window text

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rsi, rdx
mov r13, rcx
mov rax, qword [0x140190038]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rdi, qword [rcx + 8]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDC]
mov rbx, rax
lea r15, [rsp + 0x80]
mov qword [r15], 0
mov rcx, rax
mov rdx, r15
call sub.gdiplus.dll_GdipCreateFromHDC
mov r14, qword [r15]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x78], rax
lea rcx, [r13 + 0x60]
cmp byte [r13 + 0x77], 0
mov qword [rsp + 0x48], rdi
jns 0x140023c3a
mov rcx, qword [rcx]
xor edi, edi
lea r12, [rsp + 0x70]
mov qword [r12], rdi
xor edx, edx
mov r8, r12
call sub.gdiplus.dll_GdipCreateFontFamilyFromName
mov dword [r12 + 8], eax
mov r8d, dword [r13 + 0x7c]
movss xmm1, dword [r13 + 0x78]
mov qword [rsp + 0x80], rdi
mov rcx, qword [r12]
mov qword [rsp + 0x20], r15
mov r9d, 2
call sub.gdiplus.dll_GdipCreateFont
mov r12, qword [rsp + 0x80]
call fcn.14001b130
test rax, rax
je 0x140023dc1
mov rcx, rax
call fcn.14010a090
add rax, 0x18
lea rbp, [rsp + 0x68]
mov qword [rbp], rax
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [rax + 1]
mov rcx, rbp
mov edx, edi
call fcn.14010b310
mov rcx, qword [r13 + 8]
mov rdx, rax
mov r8d, edi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, rbp
mov edx, eax
call fcn.14010b2b0
xorps xmm0, xmm0
lea rdi, [rsp + 0x50]
movaps xmmword [rdi], xmm0
mov rdx, qword [rbp]
movaps xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], 0
mov r15d, 0xffffffff
mov rcx, r14
mov r8d, 0xffffffff
mov r9, r12
call sub.gdiplus.dll_GdipMeasureString
movss xmm0, dword [rdi + 0xc]
mulss xmm0, dword [0x14016e7e0]
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
mulsd xmm1, qword [0x14016e7e8]
cvttpd2dq xmm1, xmm1
cvtdq2ps xmm1, xmm1
addss xmm1, dword [rdi + 8]
cvttss2si eax, xmm0
cvttss2si ecx, xmm1
mov dword [rsi], ecx
mov dword [rsi + 4], eax
mov rdx, qword [rbp]
lock xadd dword [rdx - 8], r15d
dec r15d
test r15d, r15d
jle 0x140023db2
mov rcx, r12
call sub.gdiplus.dll_GdipDeleteFont
mov rcx, qword [rsp + 0x70]
call sub.gdiplus.dll_GdipDeleteFontFamily
mov rcx, r14
call sub.gdiplus.dll_GdipDeleteGraphics
mov rcx, qword [rsp + 0x48]
mov rdx, rbx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400d2660
mov rax, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rdx - 0x18]
add rdx, 0xffffffffffffffe8
call fcn.14010a010
jmp 0x140023d63
mov ecx, 0x80004005
call fcn.14001b100
int3
Function at 0x140025760
Capabilities:
Get graphical window text

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rsi, rdx
mov r13, rcx
mov rax, qword [0x140190038]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rdi, qword [rcx + 8]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDC]
mov rbx, rax
lea r15, [rsp + 0x80]
mov qword [r15], 0
mov rcx, rax
mov rdx, r15
call sub.gdiplus.dll_GdipCreateFromHDC
mov r14, qword [r15]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x78], rax
lea rcx, [r13 + 0x60]
cmp byte [r13 + 0x77], 0
mov qword [rsp + 0x48], rdi
jns 0x1400257da
mov rcx, qword [rcx]
xor edi, edi
lea r12, [rsp + 0x70]
mov qword [r12], rdi
xor edx, edx
mov r8, r12
call sub.gdiplus.dll_GdipCreateFontFamilyFromName
mov dword [r12 + 8], eax
mov r8d, dword [r13 + 0x78]
movss xmm1, dword [r13 + 0x58]
mov qword [rsp + 0x80], rdi
mov rcx, qword [r12]
mov qword [rsp + 0x20], r15
mov r9d, 2
call sub.gdiplus.dll_GdipCreateFont
mov r12, qword [rsp + 0x80]
call fcn.14001b130
test rax, rax
je 0x140025953
mov rcx, rax
call fcn.14010a090
add rax, 0x18
lea rbp, [rsp + 0x68]
mov qword [rbp], rax
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [rax + 1]
mov rcx, rbp
mov edx, edi
call fcn.14010b310
mov rcx, qword [r13 + 8]
mov rdx, rax
mov r8d, edi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, rbp
mov edx, eax
call fcn.14010b2b0
xorps xmm0, xmm0
lea rdi, [rsp + 0x50]
movaps xmmword [rdi], xmm0
mov rdx, qword [rbp]
movaps xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], 0
mov r15d, 0xffffffff
mov rcx, r14
mov r8d, 0xffffffff
mov r9, r12
call sub.gdiplus.dll_GdipMeasureString
movss xmm0, dword [rdi + 8]
movss xmm1, dword [rdi + 0xc]
addss xmm0, dword [0x14016e82c]
mulss xmm1, dword [0x14016e7e0]
cvttss2si eax, xmm1
cvttss2si ecx, xmm0
mov dword [rsi], ecx
mov dword [rsi + 4], eax
mov rdx, qword [rbp]
lock xadd dword [rdx - 8], r15d
dec r15d
test r15d, r15d
jle 0x140025944
mov rcx, r12
call sub.gdiplus.dll_GdipDeleteFont
mov rcx, qword [rsp + 0x70]
call sub.gdiplus.dll_GdipDeleteFontFamily
mov rcx, r14
call sub.gdiplus.dll_GdipDeleteGraphics
mov rcx, qword [rsp + 0x48]
mov rdx, rbx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400d2660
mov rax, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rdx - 0x18]
add rdx, 0xffffffffffffffe8
call fcn.14010a010
jmp 0x1400258f5
mov ecx, 0x80004005
call fcn.14001b100
int3
Function at 0x140025ea0
Capabilities:
Get graphical window text

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rsi, rdx
mov r13, rcx
mov rax, qword [0x140190038]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rdi, qword [rcx + 8]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDC]
mov rbx, rax
lea r15, [rsp + 0x80]
mov qword [r15], 0
mov rcx, rax
mov rdx, r15
call sub.gdiplus.dll_GdipCreateFromHDC
mov r14, qword [r15]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x78], rax
lea rcx, [r13 + 0x58]
cmp byte [r13 + 0x6f], 0
mov qword [rsp + 0x48], rdi
jns 0x140025f1a
mov rcx, qword [rcx]
xor edi, edi
lea r12, [rsp + 0x70]
mov qword [r12], rdi
xor edx, edx
mov r8, r12
call sub.gdiplus.dll_GdipCreateFontFamilyFromName
mov dword [r12 + 8], eax
movss xmm1, dword [r13 + 0x70]
mov qword [rsp + 0x80], rdi
mov rcx, qword [r12]
mov qword [rsp + 0x20], r15
mov r8d, 4
mov r9d, 2
call sub.gdiplus.dll_GdipCreateFont
mov r12, qword [rsp + 0x80]
call fcn.14001b130
test rax, rax
je 0x140026095
mov rcx, rax
call fcn.14010a090
add rax, 0x18
lea rbp, [rsp + 0x68]
mov qword [rbp], rax
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [rax + 1]
mov rcx, rbp
mov edx, edi
call fcn.14010b310
mov rcx, qword [r13 + 8]
mov rdx, rax
mov r8d, edi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, rbp
mov edx, eax
call fcn.14010b2b0
xorps xmm0, xmm0
lea rdi, [rsp + 0x50]
movaps xmmword [rdi], xmm0
mov rdx, qword [rbp]
movaps xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], 0
mov r15d, 0xffffffff
mov rcx, r14
mov r8d, 0xffffffff
mov r9, r12
call sub.gdiplus.dll_GdipMeasureString
movss xmm0, dword [rdi + 8]
movss xmm1, dword [rdi + 0xc]
addss xmm0, dword [0x14016e82c]
mulss xmm1, dword [0x14016e7e0]
cvttss2si eax, xmm1
cvttss2si ecx, xmm0
mov dword [rsi], ecx
mov dword [rsi + 4], eax
mov rdx, qword [rbp]
lock xadd dword [rdx - 8], r15d
dec r15d
test r15d, r15d
jle 0x140026086
mov rcx, r12
call sub.gdiplus.dll_GdipDeleteFont
mov rcx, qword [rsp + 0x70]
call sub.gdiplus.dll_GdipDeleteFontFamily
mov rcx, r14
call sub.gdiplus.dll_GdipDeleteGraphics
mov rcx, qword [rsp + 0x48]
mov rdx, rbx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400d2660
mov rax, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rdx - 0x18]
add rdx, 0xffffffffffffffe8
call fcn.14010a010
jmp 0x140026037
mov ecx, 0x80004005
call fcn.14001b100
int3
Function at 0x140026dd0
Capabilities:
Get graphical window text

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rsi, rdx
mov r13, rcx
mov rax, qword [0x140190038]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rdi, qword [rcx + 8]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDC]
mov rbx, rax
lea r15, [rsp + 0x80]
mov qword [r15], 0
mov rcx, rax
mov rdx, r15
call sub.gdiplus.dll_GdipCreateFromHDC
mov r14, qword [r15]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x78], rax
lea rcx, [r13 + 0x58]
cmp byte [r13 + 0x6f], 0
mov qword [rsp + 0x48], rdi
jns 0x140026e4a
mov rcx, qword [rcx]
xor edi, edi
lea r12, [rsp + 0x70]
mov qword [r12], rdi
xor edx, edx
mov r8, r12
call sub.gdiplus.dll_GdipCreateFontFamilyFromName
mov dword [r12 + 8], eax
mov r8d, dword [r13 + 0x74]
movss xmm1, dword [r13 + 0x70]
mov qword [rsp + 0x80], rdi
mov rcx, qword [r12]
mov qword [rsp + 0x20], r15
mov r9d, 2
call sub.gdiplus.dll_GdipCreateFont
mov r12, qword [rsp + 0x80]
call fcn.14001b130
test rax, rax
je 0x140026fc3
mov rcx, rax
call fcn.14010a090
add rax, 0x18
lea rbp, [rsp + 0x68]
mov qword [rbp], rax
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [rax + 1]
mov rcx, rbp
mov edx, edi
call fcn.14010b310
mov rcx, qword [r13 + 8]
mov rdx, rax
mov r8d, edi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, rbp
mov edx, eax
call fcn.14010b2b0
xorps xmm0, xmm0
lea rdi, [rsp + 0x50]
movaps xmmword [rdi], xmm0
mov rdx, qword [rbp]
movaps xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], 0
mov r15d, 0xffffffff
mov rcx, r14
mov r8d, 0xffffffff
mov r9, r12
call sub.gdiplus.dll_GdipMeasureString
movss xmm0, dword [rdi + 8]
movss xmm1, dword [rdi + 0xc]
addss xmm0, dword [0x14016e82c]
mulss xmm1, dword [0x14016e7e0]
cvttss2si eax, xmm1
cvttss2si ecx, xmm0
mov dword [rsi], ecx
mov dword [rsi + 4], eax
mov rdx, qword [rbp]
lock xadd dword [rdx - 8], r15d
dec r15d
test r15d, r15d
jle 0x140026fb4
mov rcx, r12
call sub.gdiplus.dll_GdipDeleteFont
mov rcx, qword [rsp + 0x70]
call sub.gdiplus.dll_GdipDeleteFontFamily
mov rcx, r14
call sub.gdiplus.dll_GdipDeleteGraphics
mov rcx, qword [rsp + 0x48]
mov rdx, rbx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400d2660
mov rax, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rdx - 0x18]
add rdx, 0xffffffffffffffe8
call fcn.14010a010
jmp 0x140026f65
mov ecx, 0x80004005
call fcn.14001b100
int3
Function at 0x140027160
Capabilities:
Capture screenshot

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
movaps xmmword [rsp + 0xa0], xmm6
mov rsi, rdx
mov r15, rcx
mov rax, qword [0x140190038]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rcx, rdx
call qword [sym.imp.USER32.dll_GetDC]
mov r13, rax
xorps xmm6, xmm6
lea r14, [rsp + 0x80]
movaps xmmword [r14], xmm6
mov rcx, rsi
mov rdx, r14
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rbp, qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rcx, r13
call rbp
mov rbx, rax
mov edx, dword [r14 + 8]
mov r8d, dword [r14 + 0xc]
sub r8d, dword [r14 + 4]
sub edx, dword [r14]
mov r12, qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rsp + 0x58], r13
mov rcx, r13
call r12
mov r14, rax
mov rdi, qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rbx
mov rdx, rax
call rdi
mov qword [rsp + 0x50], rax
mov rcx, rsi
mov edx, 0x14
mov r8, rbx
xor r9d, r9d
call qword [sym.imp.USER32.dll_SendMessageW]
lea r13, [rsp + 0x70]
movaps xmmword [r13], xmm6
mov rcx, r15
mov rdx, r13
call qword [sym.imp.USER32.dll_GetWindowRect]
xor ecx, ecx
call rbp
mov r15, rax
mov edx, dword [r13 + 8]
mov r8d, dword [r13 + 0xc]
sub r8d, dword [r13 + 4]
sub edx, dword [r13]
mov rcx, rbx
call r12
mov rbp, rax
mov rcx, r15
mov rdx, rax
call rdi
mov r12, rax
movaps xmm0, xmmword [r13]
lea rdi, [rsp + 0x60]
movaps xmmword [rdi], xmm0
xor ecx, ecx
mov rdx, rsi
mov r8, rdi
mov r9d, 2
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [rdi]
mov ecx, dword [rdi + 4]
mov r9d, dword [r13 + 8]
mov edx, dword [r13 + 0xc]
sub edx, dword [r13 + 4]
sub r9d, dword [r13]
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], edx
mov dword [rsp + 0x40], 0xcc0020
mov rcx, r15
xor edx, edx
xor r8d, r8d
call qword [sym.imp.GDI32.dll_BitBlt]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_CreatePatternBrush]
mov r13, rax
mov rcx, rbx
mov rdx, qword [rsp + 0x50]
mov rdi, qword [sym.imp.GDI32.dll_SelectObject]
call rdi
mov rcx, r15
mov rdx, r12
call rdi
test rbp, rbp
je 0x1400272e6
mov rcx, rbp
call qword [sym.imp.GDI32.dll_DeleteObject]
test r15, r15
je 0x1400272f4
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteDC]
test r14, r14
je 0x140027302
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
test rbx, rbx
je 0x140027310
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, rsi
mov rdx, qword [rsp + 0x58]
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400d2660
mov rax, r13
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140027350
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x140190038]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rcx, qword [0x14019f7f0]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140027463
mov rbx, rax
mov rcx, qword [0x14019f7f0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140027463
mov rdi, rax
mov rcx, qword [0x14019f7f0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r14d, eax
mov ecx, 2
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
je 0x14002745f
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r15, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, r15
mov rdx, rax
mov r8, r14
call fcn.1400d4120
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor r15d, r15d
lea r14, [rsp + 0x20]
mov qword [r14], r15
mov rcx, rbx
mov edx, 1
mov r8, r14
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, 0x18
call sub.gdiplus.dll_GdipAlloc
mov rbx, rax
mov rcx, qword [r14]
lea rax, fcn.140027490
mov qword [rbx], rax
lea rdx, [rbx + 8]
mov qword [rbx + 8], r15
call sub.gdiplus.dll_GdipLoadImageFromStream
mov dword [rbx + 0x10], eax
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1401bc008]
mov qword [rsi], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x14002746a
xor ebx, ebx
jmp 0x140027451
mov qword [rsi], 0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400d2660
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140028e20
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140190038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdx, qword [rcx]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140028f26
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x140028f26
mov rsi, rax
mov rdx, qword [rbx]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor ebx, ebx
mov rcx, rdi
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140028f28
mov rdi, rax
mov r15d, ebp
test r15, r15
je 0x140028f0d
xor r12d, r12d
mov r13d, 0x800000
lea rbx, [rsp + 0x3c]
mov rbp, qword [sym.imp.KERNEL32.dll_WriteFile]
mov r14, r15
sub r14, r12
cmp r14, r13
cmovae r14, r13
mov dword [rsp + 0x3c], 0
lea rdx, [rsi + r12]
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov r8d, r14d
mov r9, rbx
call rbp
test eax, eax
je 0x140028f1d
add r12, r14
cmp r12, r15
jb 0x140028ed4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
setne bl
jmp 0x140028f28
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400d2660
mov eax, ebx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14002ba00
Capabilities:
Reference processor manufacturer constants

Disassembly:
push rsi
push rdi
mov r8, rcx
xor edi, edi
xor ecx, ecx
xor eax, eax
xchg rbx, r9
cpuid
xchg rbx, r9
test eax, eax
jle 0x14002bb22
mov r10d, eax
xor ecx, ecx
mov eax, 1
xchg rbx, r9
cpuid
xchg rbx, r9
mov r9d, ecx
mov r11d, edx
mov esi, eax
cmp r10d, 7
jb 0x14002bb58
mov eax, 7
xor ecx, ecx
xchg rbx, rdi
cpuid
xchg rbx, rdi
mov r10d, ecx
and edi, 0x20
shr r10b, 4
and r10b, 1
mov dword [r8], esi
mov eax, esi
and eax, 0xf
mov dword [r8 + 8], eax
shr esi, 0xc
and esi, 3
mov dword [r8 + 4], esi
mov eax, r11d
shr eax, 0x17
and al, 1
mov byte [r8 + 0xc], al
mov eax, r11d
shr eax, 0x19
and al, 1
mov byte [r8 + 0xd], al
shr r11d, 0x1a
and r11b, 1
mov byte [r8 + 0xe], r11b
mov eax, r9d
and al, 1
mov byte [r8 + 0xf], al
mov eax, r9d
shr eax, 9
and al, 1
mov byte [r8 + 0x10], al
mov eax, r9d
shr eax, 0x13
and al, 1
mov byte [r8 + 0x11], al
mov eax, r9d
shr eax, 0x14
and al, 1
mov byte [r8 + 0x12], al
mov eax, r9d
shr eax, 0x17
and al, 1
mov byte [r8 + 0x13], al
mov eax, r9d
shr eax, 0x1f
mov byte [r8 + 0x1a], al
mov eax, r9d
not eax
test eax, 0x1c000000
jne 0x14002bb60
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
mov byte [r8 + 0x14], al
mov ecx, r9d
shr ecx, 0x19
and cl, 1
mov byte [r8 + 0x17], cl
shr r9d, 0xc
and r9b, 1
mov byte [r8 + 0x15], r9b
test al, al
setne al
test edi, edi
setne cl
and cl, al
mov byte [r8 + 0x16], cl
mov byte [r8 + 0x18], r10b
xor ecx, ecx
mov eax, 0x80000000
xchg rbx, r9
cpuid
xchg rbx, r9
cmp eax, 0x80000006
jle 0x14002bb64
mov eax, 0x80000007
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
shr edx, 8
and dl, 1
mov byte [r8 + 0x19], dl
test dl, dl
je 0x14002bb6a
pop rdi
pop rsi
ret
xor r10d, r10d
jmp 0x14002ba5c
xor eax, eax
jmp 0x14002baf1
mov dl, byte [r8 + 0x19]
jmp 0x14002bb51
cmp byte [r8 + 0x1a], 0
je 0x14002bb55
mov eax, 0x40000000
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
cmp r9d, 0x7263694d
jne 0x14002bb55
cmp ecx, 0x666f736f
jne 0x14002bb55
cmp edx, 0x76482074
jne 0x14002bb55
mov byte [r8 + 0x19], 1
jmp 0x14002bb55

Function at 0x14002bcd0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x14002bd0c
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14002bd16
add rdi, rbx
sub rsi, rbx
jne 0x14002bcea
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
int3