joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006fc40
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
mov rdi, r9
mov ebp, r8d
mov ebx, edx
lea rcx, [rsp + 0x40]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14006fc8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14006fdc7
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x14006fcc9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x40]
xor edx, edx
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, ebx
jmp 0x14006fdc7
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x14006fd08
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, ebx
jmp 0x14006fdc7
mov rcx, qword [rsp + 0x38]
xor esi, esi
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
lea edx, [rsi + 4]
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, dword [rsp + 0x34]
lea rcx, [rsp + 0x48]
call fcn.1400632b0
mov r11d, dword [rsp + 0x34]
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
lea edx, [rsi + 2]
mov r8, rbx
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
lea rdx, [0x14013f310]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [rsp + 0x30], esi
jbe 0x14006fda3
nop dword [rax + rax]
movzx r8d, byte [rbx]
lea rdx, str._02X
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
inc esi
add rdi, 2
inc rbx
cmp esi, dword [rsp + 0x30]
jb 0x14006fd80
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rcx, [rsp + 0x48]
call fcn.14005b520
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x14006fde0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
nop word [rax + rax]
mov rcx, qword [0x14019c338]
xor edx, edx
mov r8d, 0x408
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x14006fe1a
lea ecx, [rax + 2]
call fcn.140063030
cmp eax, 4
je 0x14006fdf0
mov dword [rbx + 4], 0xaa55
mov dword [rbx], 0x400
add rbx, 8
mov qword [0x14019c6b8], rbx
xor edx, edx
mov eax, edx
mov ecx, 8
nop dword [rax + rax]
test al, 1
je 0x14006fe4d
shr eax, 1
xor eax, 0xedb88320
jmp 0x14006fe4f
shr eax, 1
sub rcx, 1
jne 0x14006fe40
inc edx
mov dword [rbx], eax
add rbx, 4
cmp edx, 0x100
jl 0x14006fe34
add rsp, 0x20
pop rbx
ret
Function at 0x14006fe70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rdx, qword [0x14019c6b8]
mov rbp, r8
mov rsi, rcx
test rdx, rdx
jne 0x14006fea4
call fcn.14006fde0
mov rdx, qword [0x14019c6b8]
or ebx, 0xffffffff
test edi, edi
je 0x14006fecb
nop dword [rax + rax]
movzx eax, byte [rsi]
movzx ecx, bl
inc rsi
xor rcx, rax
mov eax, ebx
mov ebx, dword [rdx + rcx*4]
shr eax, 8
xor ebx, eax
sub edi, 1
jne 0x14006feb0
not ebx
test rbp, rbp
je 0x14006fee5
lea rdx, str._08X
mov r8d, ebx
mov rcx, rbp
call qword [sym.imp.USER32.dll_wsprintfA]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140070240
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x20]
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov rcx, rdi
lea edx, [rax + 2]
mov ebx, eax
call fcn.1400635c0
mov r11, qword [rdi]
xor eax, eax
mov word [r11], ax
mov rdx, qword [rdi]
mov rcx, qword [rsi + 0x20]
lea r8d, [rbx + 1]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_GetWindowTextW]
Function at 0x140072ea0
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
or r8d, 0xffffffff
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.1400712d0
mov rbx, rax
or r8d, 0xffffffff
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.1400712d0
nop
mov r9, qword [rbx]
mov r8, qword [rax]
lea rdx, str._r_nRegSetDHCP__s__s__r_n
lea rcx, [0x14019c170]
call fcn.14002b694
nop
lea rcx, [rsp + 0x40]
call fcn.14005b520
nop
lea rcx, [rsp + 0x38]
call fcn.14005b520
lea r11, [rsp + 0x50]
mov rax, qword [str.0.0.0.0]
mov qword [r11], rax
movzx eax, byte [0x14014f7e8]
mov byte [r11 + 8], al
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.EnableDHCP
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x28], 9
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
lea rdx, str.IPAddress
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x28], 9
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
lea rdx, str.SubnetMask
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x28], 1
lea rax, [0x14014f7a8]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
lea rdx, str.DefaultGateway
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test rsi, rsi
je 0x14007303e
lea rbx, [0x14013f310]
cmp byte [rsi], 0x2d
cmovne rbx, rsi
cmp byte [rsi], 0
je 0x14007303e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.NameServer
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14010bcc0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x14007bb20
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
xor ecx, ecx
mov word [rax], cx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14007bb7b
mov ecx, 0xd
mov qword [rsp + 0x30], rdi
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x14007bb70
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rbx
mov rdx, rax
call fcn.140071360
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdi, qword [rsp + 0x30]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14007f3b0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx ebx, cx
call fcn.14006edd0
mov ecx, 0x20
mov edi, eax
mov eax, 0x2a
mov word [rsp + 0x28], cx
mov word [rsp + 0x2c], cx
xor ecx, ecx
mov word [rsp + 0x2a], ax
mov eax, 0x2c
mov edx, 0x3a
mov word [rsp + 0x34], cx
mov word [rsp + 0x26], cx
mov word [rsp + 0x32], ax
mov eax, 0x5c
lea rcx, [rsp + 0x20]
mov word [rsp + 0x2e], bx
mov word [rsp + 0x30], dx
mov word [rsp + 0x24], ax
mov word [rsp + 0x20], bx
mov word [rsp + 0x22], dx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
je 0x14007f43a
cmp edi, 2
je 0x14007f44e
lea rdx, [rsp + 0x28]
lea rcx, [0x14019c170]
xor r8d, r8d
call fcn.140077be0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14010bcc0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140081880
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rbx, r9
movzx esi, r8b
movzx ebp, dl
mov rdi, rcx
test rcx, rcx
jne 0x1400818ad
xor eax, eax
jmp 0x14008192f
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x3c], eax
movsx eax, sil
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x90]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x98]
mov byte [rsp + 0x38], bpl
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0xa0]
mov dword [rsp + 0x58], ecx
mov qword [rsp + 0x50], rax
test rbx, rbx
je 0x140081918
lea r8, [rsp + 0x20]
lea rdx, [0x140075e00]
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x14008192a
lea rdx, [rsp + 0x20]
lea rcx, [0x140075e00]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x140081950
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx + 0xa78]
cmp qword [0x14019c6e8], 0
mov rbx, rcx
jne 0x14008198e
xor edi, edi
xor eax, eax
mov qword [rcx + 0xa78], rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rcx + 0xa78]
test rax, rax
je 0x140081a7f
mov rcx, rsi
call qword [0x14019c6e0]
test eax, eax
je 0x1400819c6
xor edi, edi
xor eax, eax
mov qword [rbx + 0xa78], rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov dword [rbx + 0x844], 0x234
mov qword [rsp + 0x38], r12
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, [rbx + 0x844]
xor edi, edi
mov rcx, rsi
mov qword [rbx + 0xa78], rdi
lea ebp, [rax + 0x2710]
call qword [0x14019c6d0]
cmp eax, 6
je 0x140081a2e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp ebp, eax
jbe 0x140081a2e
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbx + 0x844]
mov rcx, rsi
call qword [0x14019c6d0]
cmp eax, 6
jne 0x140081a04
mov qword [rbx + 0xa78], rdi
mov rax, qword [0x14019cb38]
lea rdx, str.Connection_to
lea rcx, [0x14019cb38]
mov word [rax], di
call fcn.140071360
lea rdx, [rbx + 0xc]
lea rcx, [0x14019cb38]
call fcn.140063600
lea rdx, str._terminated._n
lea rcx, [0x14019cb38]
call fcn.140063600
mov r12, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140085180
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rsi, rcx
mov rax, qword [rcx + 0x38]
mov rdi, qword [rax + 0x20]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xe]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
lea edx, [rax + 2]
lea rcx, [rsp + 0x40]
call fcn.140063580
nop
lea eax, [rbx + 1]
movsxd r8, eax
mov rbx, qword [rsp + 0x40]
mov r9, rbx
mov edx, 0xd
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, qword [rsi + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14008521a
lea rdx, [rsp + 0x40]
lea rcx, [rsi + 0x20]
call fcn.1400713f0
mov rdx, qword [rsi + 0x10]
cmp word [rdx], 0
je 0x14008521a
mov r8, rbx
mov rcx, qword [rsi + 0x50]
call fcn.140081640
nop
lea rcx, [rsp + 0x40]
call fcn.14005b520
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140099b60
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rbp, rcx
xor ecx, ecx
mov dword [rax - 0x48], ecx
mov dword [rax + 0x20], ecx
mov qword [rax - 0x50], rcx
mov qword [rax - 0x58], rcx
mov qword [rax - 0x60], rcx
mov qword [rax - 0x68], rcx
mov qword [rax - 0x70], rcx
mov qword [rax - 0x78], rcx
lea rax, [rax + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
test eax, eax
jne 0x140099d46
mov edx, dword [rsp + 0xc8]
lea edx, [rdx*4 + 8]
lea rcx, [rsp + 0x78]
call fcn.140063580
nop
xor ecx, ecx
mov edi, ecx
cmp dword [rsp + 0x60], ecx
jle 0x140099d3a
mov rbx, qword [rsp + 0x78]
nop word [rax + rax]
mov qword [rsp + 0x70], rcx
mov eax, dword [rsp + 0xc8]
shl eax, 2
mov dword [rsp + 0x64], eax
mov word [rbx], cx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x64]
mov r8, rbx
mov edx, edi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test eax, eax
jne 0x140099d29
cmp word [rbx], ax
je 0x140099d29
mov rax, qword [rsp + 0xc0]
mov rdx, qword [rax]
lea rcx, [rsp + 0x68]
call fcn.140071240
nop
lea rdx, [0x14013fc88]
lea rcx, [rsp + 0x68]
call fcn.140063600
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140063600
xor ecx, ecx
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov edx, 4
mov r8d, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
lea r11, [rsp + 0x70]
mov qword [rsp + 0x20], r11
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
jne 0x140099cfa
lea rcx, [rsp + 0x68]
call fcn.14005b520
jmp 0x140099d29
lea r8, [rsp + 0x68]
mov rdx, qword [rsp + 0xb8]
call fcn.140099b60
mov esi, eax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140099d1f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x68]
call fcn.14005b520
inc edi
cmp edi, dword [rsp + 0x60]
mov ecx, 0
jl 0x140099c10
lea rcx, [rsp + 0x78]
call fcn.14005b520
mov eax, esi
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a4730
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x390
mov rdi, rcx
mov rcx, rdx
mov ebp, r9d
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x38]
mov ebx, eax
mov eax, 0xb4
mov r8d, 0x350
cmp ebx, eax
cmovg ebx, eax
xor r12d, r12d
xor edx, edx
mov qword [rsp + 0x30], r12
call fcn.14010c6c0
mov ecx, dword [rsp + 0x3c8]
mov rax, qword [rsp + 0x3c0]
mov dword [rsp + 0x2cc], ecx
movsxd rbx, ebx
lea rcx, [rsp + 0x114]
lea r8, [rbx + rbx]
mov rdx, rsi
mov byte [rsp + 0xd0], 0x40
mov qword [rsp + 0x360], rax
mov dword [rsp + 0x110], ebp
mov qword [rsp + 0x2b0], rdi
call fcn.14010cd30
lea rcx, [0x14019cae8]
mov word [rsp + rbx*2 + 0x114], r12w
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r11, [0x14019bc94]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x30]
lea r8, [0x1400a3a20]
mov edx, 0x20000
xor ecx, ecx
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x1400a485d
mov ebx, 0x270f
cmp dword [rsp + 0x110], ebp
jne 0x1400a4854
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
jns 0x1400a4821
cmp dword [rsp + 0x110], ebp
jne 0x1400a4854
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsp + 0x110], ebp
je 0x1400a4840
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14019cae8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r11, [rsp + 0x390]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x1400b9270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x38
cmp dword [0x14019c6a8], 0
je 0x1400b9287
cmp qword [0x14019c6f0], 0
jne 0x1400b92e5
mov rcx, qword [0x14019c040]
mov edx, 0x271b
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, qword [0x14019c040]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400b92e5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x1400b92e5
mov rcx, qword [0x14019c040]
lea r9, [0x1400b9210]
xor r8d, r8d
mov rdx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
add rsp, 0x38
ret
Function at 0x1400c8c34
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov r9, rdx
mov rbx, rcx
cmp rdx, rdi
je 0x1400c8cbf
cmp dword [rdx], edi
jge 0x1400c8c54
cmp dword [rdx + 4], edi
jl 0x1400c8cbf
movzx r10d, di
mov r11d, 1
movsx ecx, r10w
add r10w, r11w
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
movsxd r8, eax
mov eax, ecx
cdq
and eax, r11d
xor eax, edx
sub eax, edx
movsxd rcx, eax
mov eax, dword [r9]
add r9, 4
cmp r10w, 2
lea rdx, [rcx + r8*2]
mov dword [rbx + rdx*4 + 0x6c], eax
jl 0x1400c8c5e
mov ecx, dword [rbx + 0x70]
cmp ecx, edi
jl 0x1400c8ca7
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov qword [rbx + 0x88], rax
mov ecx, dword [rbx + 0x78]
cmp ecx, edi
jl 0x1400c8cbb
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov qword [rbx + 0x90], rax
mov byte [rbx + 0x6b], dil
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ceb38
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov r9, rdx
mov rbx, rcx
cmp rdx, rdi
je 0x1400cebdd
cmp dword [rdx], edi
jge 0x1400ceb6b
cmp dword [rdx + 4], edi
jge 0x1400ceb6b
cmp dword [rdx + 8], edi
jge 0x1400ceb6b
cmp dword [rdx + 0xc], edi
jl 0x1400cebdd
mov esi, 4
movzx r10d, di
lea r11d, [rsi - 3]
movsx ecx, r10w
add r10w, r11w
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
movsxd r8, eax
mov eax, ecx
cdq
and eax, r11d
xor eax, edx
sub eax, edx
movsxd rcx, eax
mov eax, dword [r9]
add r9, rsi
cmp r10w, si
lea rdx, [rcx + r8*2 + 0x1e]
mov dword [rbx + rdx*4], eax
jl 0x1400ceb78
mov ecx, dword [rbx + 0x7c]
cmp ecx, edi
jl 0x1400cebbf
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov qword [rbx + 0x98], rax
mov ecx, dword [rbx + 0x84]
cmp ecx, edi
jl 0x1400cebd6
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov qword [rbx + 0xa0], rax
mov byte [rbx + 0xa8], dil
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400cf2a0
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, 0xffdf
and cx, ax
mov eax, 0x41
cmp ax, cx
je 0x1400cf2e6
mov eax, 0x42
cmp ax, cx
je 0x1400cf2e6
mov eax, 0xfffffffe
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14010bcc0
add rsp, 0x38
ret
mov word [rsp + 0x20], cx
mov eax, 0x3a
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x20]
xor ebx, ebx
mov word [rsp + 0x22], ax
mov word [rsp + 0x24], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14010bcc0
add rsp, 0x38
ret

Function at 0x1400cf400
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x50], eax
jmp 0x1400cf467
add rsp, 0x78
ret
Function at 0x1400d12fc
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.1400f9aa8
mov rsi, rax
test rax, rax
je 0x1400d1378
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x1400d1373
cmp dword [rbx], 0x40
jb 0x1400d1373
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x1400d1373
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x1400d137c
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400d849c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x1400d8504
call fcn.1400dba80
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400d8504
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x1400d8526
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.1400d7eac
mov esi, eax
test rdi, rdi
je 0x1400d8524
test rbx, rbx
je 0x1400d8524
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1400d95e4
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xa0], 0
jne 0x1400d9622
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1400d96d6
call fcn.1400da76c
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1400d9641
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rbx + 0xa0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x118]
mov rdx, rsi
or rsi, 0xffffffffffffffff
mov r9, rsi
mov r8, qword [rsp + 0x40]
mov rcx, rdi
call fcn.140111b5c
test eax, eax
je 0x1400d96a9
cmp eax, 0xc
je 0x1400d96a3
cmp eax, 0x16
je 0x1400d969d
cmp eax, 0x22
je 0x1400d969d
cmp eax, 0x50
je 0x1400d96a9
call fcn.1400d020c
int3
call fcn.1400d020c
int3
call fcn.1400d01c4
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x1400d96d4
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400dc8b4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12, r8
mov rbx, rdx
mov r13, rcx
xor edi, edi
call fcn.1400dba80
lea r8d, [rdi + 5]
mov rbp, qword [rax + 0x18]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbp
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
cmp rax, rdi
je 0x1400dc910
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r12
mov rdx, rdi
mov rcx, r13
call fcn.1400dc344
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret