joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002836f
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 8
push r12
push r13
push r14
push r15
push rbx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov r12, 3
mov r13, 1
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, r12
call fcn.1400284e1
add rsp, 0x20
rol eax, 8
sub rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp + 0x18]
call fcn.140028505
add rsp, 0x20
sub rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp + 0x20]
mov r8, r13
call fcn.1400284b6
add rsp, 0x20
inc r13
mov rbx, rax
mov r14, r12
sub r14, 3
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, r14
call fcn.1400284e1
add rsp, 0x20
xor rax, rbx
inc r12
sub rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp + 0x10]
mov r8, r12
call fcn.14002848a
add rsp, 0x20
mov r15, 3
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, r12
call fcn.1400284e1
add rsp, 0x20
mov rbx, rax
mov r14, r12
sub r14, 3
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, r14
call fcn.1400284e1
add rsp, 0x20
xor rax, rbx
inc r12
sub rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp + 0x10]
mov r8, r12
call fcn.14002848a
add rsp, 0x20
dec r15
jne 0x140028421
cmp r12, 0x2b
jne 0x14002839a
pop rbx
pop r15
pop r14
pop r13
pop r12
leave
ret

Function at 0x140028704
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
push r12
push rbx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rdx, qword [rbp + 0x10]
mov r12, 4
mov eax, dword [rdx]
bswap eax
mov rbx, qword [rbp + 0x18]
xlatb
mov cl, al
shr eax, 8
mov rbx, qword [rbp + 0x28]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x20]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x30]
xlatb
xor cl, al
mov dword [rbp - 0x10], ecx
mov eax, dword [rdx]
bswap eax
mov rbx, qword [rbp + 0x28]
xlatb
mov cl, al
shr eax, 8
mov rbx, qword [rbp + 0x20]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x30]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x18]
xlatb
xor cl, al
mov eax, dword [rbp - 0x10]
shl eax, 8
mov al, cl
mov dword [rbp - 0x10], eax
mov eax, dword [rdx]
bswap eax
mov rbx, qword [rbp + 0x20]
xlatb
mov cl, al
shr eax, 8
mov rbx, qword [rbp + 0x30]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x18]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x28]
xlatb
xor cl, al
mov eax, dword [rbp - 0x10]
shl eax, 8
mov al, cl
mov dword [rbp - 0x10], eax
mov eax, dword [rdx]
bswap eax
mov rbx, qword [rbp + 0x30]
xlatb
mov cl, al
shr eax, 8
mov rbx, qword [rbp + 0x18]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x28]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x20]
xlatb
xor cl, al
mov eax, dword [rbp - 0x10]
shl eax, 8
mov al, cl
bswap eax
mov dword [rdx], eax
add rdx, 4
dec r12
jne 0x14002872a
pop rbx
pop r12
leave
ret
Function at 0x140029451
Capabilities:
Inspect section memory permissions

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x110
push rbx
push r12
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rdx, qword [rbp + 0x10]
mov ebx, dword [rdx + 0x24]
and ebx, 0xe0000000
cmp ebx, 0xe0000000
jne 0x140029490
mov rax, 0x40
mov qword [rbp - 0x110], rax
jmp 0x140029501
mov ebx, dword [rdx + 0x24]
and ebx, 0x60000000
cmp ebx, 0x60000000
jne 0x1400294b1
mov rax, 0x20
mov qword [rbp - 0x110], rax
jmp 0x140029501
mov ebx, dword [rdx + 0x24]
and ebx, 0xc0000000
cmp ebx, 0xc0000000
jne 0x1400294d2
mov rax, 4
mov qword [rbp - 0x110], rax
jmp 0x140029501
mov ebx, dword [rdx + 0x24]
and ebx, 0x40000000
cmp ebx, 0x40000000
jne 0x1400294f3
mov rax, 2
mov qword [rbp - 0x110], rax
jmp 0x140029501
mov rax, 1
mov qword [rbp - 0x110], rax
mov eax, dword [rdx + 0xc]
add rax, qword [rbp + 0x18]
mov ebx, dword [rdx + 8]
lea r12, [rbp - 0x108]
sub rsp, 0x20
mov rcx, rax
mov rdx, rbx
mov r8, qword [rbp - 0x110]
mov r9, r12
call qword [sym.imp.KERNEL32.DLL_VirtualProtect]
add rsp, 0x20
test rax, rax
je 0x140029549
mov rdx, qword [rbp + 0x10]
mov eax, dword [rdx + 0xc]
add rax, qword [rbp + 0x18]
mov rax, 1
jmp 0x14002954c
sub rax, rax
pop r12
pop rbx
leave
ret

Function at 0x140029551
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
mov qword [rbp + 0x10], rcx
mov rcx, qword [rbp + 0x10]
mov ax, word [rcx]
cmp ax, 0x5a4d
jne 0x14002957e
mov eax, dword [rcx + 0x3c]
add rcx, rax
mov eax, dword [rcx]
cmp eax, 0x4550
jne 0x14002957e
add rcx, 4
mov rax, rcx
leave
ret
sub rax, rax
leave
ret

Function at 0x1400295c6
Capabilities:
Terminate process

Disassembly:
sub rsp, 8
sub rsp, 0x20
call fcn.1400295f7
add rsp, 0x20
test rax, rax
je 0x1400295e2
add rsp, 8
jmp rax
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x140003710
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov edi, edx
mov ecx, edx
call fcn.140030eec
mov rsi, rax
test rax, rax
jne 0x140003745
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov eax, edi
mov qword [rsp + 0x30], rbx
shr eax, 4
mov r8d, 6
inc ax
mov qword [rsp + 0x38], rbp
movzx edx, ax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x14000383d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000383d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14000383d
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400037ce
cmp rbx, rcx
jae 0x14000383d
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1400037b5
cmp rbx, rcx
jae 0x14000383d
movzx edi, word [rbx]
test di, di
je 0x14000383d
mov r10, qword [r14]
mov ebp, 1
mov ecx, ebp
movzx edx, di
mov eax, dword [r10 - 0xc]
sub ecx, dword [r10 - 8]
sub eax, edi
or ecx, eax
jge 0x140003806
mov edx, edi
mov rcx, r14
call fcn.140002c20
mov r10, qword [r14]
movzx edx, word [rbx]
movzx r9d, dx
lea r8, [rbx + 2]
mov rdx, rdi
mov rcx, r10
call fcn.1401c9a78
xor ecx, ecx
test eax, eax
je 0x140003829
cmp eax, 0xc
je 0x140003864
cmp eax, 0x50
jne 0x14000385e
mov rax, qword [r14]
cmp edi, dword [rax - 0xc]
jg 0x14000386a
mov dword [rax - 0x10], edi
mov rax, qword [r14]
mov word [rax + rdi*2], cx
jmp 0x140003841
xor ecx, ecx
mov ebp, ecx
mov rbx, qword [rsp + 0x30]
mov eax, ebp
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call fcn.140024678
int3
call fcn.14002469c
int3
mov ecx, 0x80070057
call fcn.140002970
int3
Function at 0x140004970
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x38
mov r15, rcx
mov rax, qword [rcx]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x1400049a7
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x1400049c1
call fcn.140025a68
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x140004b2d
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
mov esi, dword [rsp + 0x78]
mov ecx, esi
call fcn.140030eec
mov rbp, rax
test rax, rax
je 0x140004b22
mov ecx, esi
shr ecx, 4
inc cx
movzx edx, cx
mov r8d, 6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
je 0x140004b22
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140004b22
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x140004b22
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rdi
and esi, 0xf
jbe 0x140004a69
nop dword [rax]
cmp rdi, rcx
jae 0x140004b22
movzx eax, word [rdi]
lea rdi, [rdi + rax*2]
add rdi, 2
add esi, 0xffffffff
jne 0x140004a50
cmp rdi, rcx
jae 0x140004b22
movzx esi, word [rdi]
test si, si
je 0x140004b22
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
movzx edx, si
or eax, ecx
jge 0x140004aa6
mov edx, esi
lea rcx, [rsp + 0x20]
call fcn.140002c20
movzx edx, word [rdi]
mov rbx, qword [rsp + 0x20]
lea r8, [rdi + 2]
movzx r9d, dx
mov rdx, rsi
mov rcx, rbx
call fcn.1401c9a78
xor ecx, ecx
test eax, eax
je 0x140004ac9
cmp eax, 0xc
je 0x140004b3e
cmp eax, 0x50
jne 0x140004b38
cmp esi, dword [rbx - 0xc]
jg 0x140004b17
mov dword [rbx - 0x10], esi
mov word [rbx + rsi*2], cx
lea r8, [rsp + 0x80]
mov qword [rsp + 0x28], r8
mov rdx, rbx
mov rcx, r15
call fcn.140004b50
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004b0a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x38
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80070057
call fcn.140002970
int3
mov ecx, 0x80004005
call fcn.140002970
nop
mov ecx, 0x80004005
call fcn.140002970
nop
call fcn.140024678
int3
call fcn.14002469c
int3
Function at 0x140010fc0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rcx, qword [rcx + 0x40]
mov rsi, rdx
xor ebx, ebx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400110f3
lea ecx, [rbx + 1]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov r14, rax
test rax, rax
je 0x1400110ed
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r15, rax
test rax, rax
je 0x1400110ed
mov ebp, 0xffffffff
mov dword [rsp + 0x28], ebx
mov r9d, ebp
mov qword [rsp + 0x20], rbx
mov r8, rax
lea ecx, [rbx + 3]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r10, qword [rsi]
lea edi, [rax - 1]
test edi, edi
jle 0x140011099
mov edx, dword [r10 - 0xc]
mov r8d, 1
sub r8d, dword [r10 - 8]
sub edx, edi
or r8d, edx
jge 0x140011064
mov edx, edi
mov rcx, rsi
call fcn.140002c20
mov r10, qword [rsi]
xor edx, edx
mov dword [rsp + 0x28], edi
mov r9d, ebp
mov qword [rsp + 0x20], r10
mov r8, r15
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [rsi]
cmp edi, dword [rax - 0xc]
jg 0x14001110e
mov dword [rax - 0x10], edi
mov rax, qword [rsi]
movsxd rcx, edi
mov word [rax + rcx*2], bx
jmp 0x1400110df
lea rdx, [r10 - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], ebx
je 0x1400110df
cmp dword [rdx + 0x10], ebx
jge 0x1400110bc
cmp dword [r10 - 0xc], ebx
jl 0x14001110e
mov dword [r10 - 0x10], ebx
mov rax, qword [rsi]
mov word [rax], bx
jmp 0x1400110df
lock xadd dword [rdx + 0x10], ebp
sub ebp, 1
jg 0x1400110cf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ebx, 1
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
mov ecx, 0x80070057
call fcn.140002970
int3
Function at 0x140021560
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rdx]
sub rcx, 0x18
call fcn.140003500
lea rbx, [rax + 0x18]
test rdi, rdi
jne 0x14002158b
xor ecx, ecx
jmp 0x14002158f
mov rcx, qword [rdi + 0x40]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rbx
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, [rbx - 0x18]
mov ebx, 0xffffffff
cmp eax, 0x20
mov eax, ebx
jg 0x1400215fc
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400215d6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsi]
sub rcx, 0x18
call fcn.140003500
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.140020ea0
mov edi, eax
jmp 0x140021614
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002160f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, 1
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14002162e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x14002646c
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x78
test rdx, rdx
je 0x1400264d4
mov r10, qword [rcx + 0x10]
test r10, r10
je 0x1400264be
cmp qword [rcx + 0x18], 0
jne 0x1400264b9
mov eax, dword [rcx + 0xc]
cmp eax, dword [rcx + 0x30]
jae 0x1400264da
mov qword [rsp + 0x58], rdx
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0x50
mov edx, eax
mov dword [rsp + 0x24], 0x40
mov r8d, 1
mov rcx, qword [r10 + 8]
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
add rsp, 0x78
ret
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x1400264d4
mov rcx, qword [rcx + 0x40]
add rsp, 0x78
jmp fcn.14005c214
call fcn.140024678
int3
call fcn.140024678
int3

Function at 0x140028fb8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x140029016
call fcn.140031428
mov r8d, 0xf0
mov rdx, rdi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140029016
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140029021
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
mov rdx, rbx
mov rcx, rsi
call fcn.14005dff8
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140029dd4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140029e8d
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x140029e8d
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140029e8d
test rdi, rdi
je 0x140029e8d
xor r14d, r14d
xor esi, esi
call fcn.140031428
lea r8, str.AFX_DIALOG_LAYOUT
mov rdx, rdi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x140029e6d
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rdi
mov rcx, rbp
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140029e8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
mov r8d, r14d
mov rdx, rsi
mov rcx, rbx
call fcn.14005ebf0
mov edi, eax
test eax, eax
je 0x140029e89
mov rcx, rbx
call fcn.140029a9c
mov eax, edi
jmp 0x140029e8f
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14002ae00
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x40]
call fcn.14005c554
mov rdi, rax
test rax, rax
je 0x14002ae7c
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x14002ae77
cmp dword [rbx], 0x40
jb 0x14002ae77
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
or dword [rbx + 4], 1
xor r8d, r8d
or qword [rbx + 0x30], 0xffffffffffffffff
mov edx, 0x87
mov qword [rbx + 8], rcx
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x14002ae77
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x14002ae80
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14002f788
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movsxd rsi, r8d
mov rbx, rdx
mov rdi, rcx
xor ebp, ebp
cmp qword [rcx + 0xd0], rbp
jne 0x14002f7c2
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x14002f866
call fcn.140025a68
mov rcx, rax
test rax, rax
je 0x14002f881
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140084be2.0]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov rcx, qword [rdi + 0xd0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
mov rax, qword [rax + 0x118]
call qword [case.0x140084be2.0]
mov rdx, rsi
or rdi, 0xffffffffffffffff
mov r9, rdi
mov r8, qword [rsp + 0x30]
mov rcx, rbx
call fcn.1401dd448
test eax, eax
je 0x14002f82a
cmp eax, 0xc
je 0x14002f87b
cmp eax, 0x50
jne 0x14002f88c
test rbx, rbx
jne 0x14002f833
mov ebx, ebp
jmp 0x14002f83e
mov rcx, rbx
call fcn.1401cca60
mov rbx, rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
add ecx, edi
test ecx, ecx
jg 0x14002f864
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140084be2.0]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
call fcn.14002469c
nop
mov ecx, 0x80004005
call fcn.140002970
nop
call fcn.140024678
int3

Function at 0x14002ff24
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
cmp rdx, 0x10000
jae 0x14002ff63
cmp dword [rcx + 0xe8], 0
jne 0x14002ff63
movzx eax, si
mov dword [rcx + 0xe8], eax
call fcn.140031428
mov r8d, 5
mov rdx, rsi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x1400302c4
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rsi, r9
mov rcx, rdx
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rbx, rbx
jne 0x140030319
call fcn.14005236c
mov rdx, rax
test rax, rax
je 0x140030317
mov rcx, qword [rax]
mov rax, qword [rcx + 0xe8]
mov rcx, rdx
call qword [case.0x140084be2.0]
mov rbx, rax
jmp 0x140030319
xor ebx, ebx
and qword [rdi + 0x108], 0
mov r9, rsi
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.140030038
Function at 0x14002ffb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov rbx, rdx
mov r14, rcx
xor edi, edi
call fcn.140031428
lea r8d, [rdi + 5]
mov rdx, rbx
mov rsi, qword [rax + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14003000a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rsi
mov r8, rbp
mov rdx, rdi
mov rcx, r14
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.140030038

Function at 0x14004f438
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, rdx
mov rbp, rcx
call fcn.140031428
mov r8d, 0xf1
mov rdx, r14
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r15d, r15d
test rax, rax
je 0x14004f547
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14004f547
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14004f547
movzx ecx, word [rax + 6]
lea eax, [r15 + 4]
mul rcx
lea rcx, [r15 - 1]
cmovo rax, rcx
mov rcx, rax
call fcn.140024614
movzx ecx, word [rbx + 6]
mov rsi, rax
mov eax, r15d
cmp r15w, cx
jae 0x14004f4e9
mov rdx, rsi
lea r8, [rbx + 8]
movzx ecx, word [r8]
inc eax
mov dword [rdx], ecx
lea r8, [r8 + 2]
movzx ecx, word [rbx + 6]
lea rdx, [rdx + 4]
cmp eax, ecx
jl 0x14004f4d1
movzx r8d, cx
mov rdx, rsi
mov rcx, rbp
call fcn.14004fd50
mov rcx, rsi
mov edi, eax
call fcn.14002460c
test edi, edi
je 0x14004f543
movzx ecx, word [rbx + 4]
movzx eax, word [rbx + 2]
mov dword [rsp + 0x60], eax
add eax, 7
mov dword [rsp + 0x68], eax
lea eax, [rcx + 7]
mov dword [rsp + 0x64], ecx
mov r8, qword [rsp + 0x60]
mov rcx, rbp
mov dword [rsp + 0x6c], eax
mov rdx, qword [rsp + 0x68]
call fcn.14004ff58
mov rdx, r14
mov rcx, rbp
call fcn.14004f3bc
mov edi, eax
mov eax, edi
jmp 0x14004f549
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400515bc
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rdi, rdx
mov rbx, rcx
je 0x140051607
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140051618
lea rdx, str.DeleteFileTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140051618
mov rdx, qword [rbx]
mov rcx, rdi
call qword [case.0x140084be2.0]
jmp 0x14005161a
cmp dword [rcx + 8], 0
je 0x140051618
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14005161a
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret