joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002340
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140002358
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140002360
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140002370
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
mov r8, rdx
lea rdx, [rax + rcx]
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x1400023bc
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov ecx, dword [rax + 0xc]
mov rdx, rcx
cmp rcx, r8
ja 0x1400023b3
add edx, dword [rax + 8]
cmp rdx, r8
ja 0x1400023be
add rax, 0x28
cmp rax, r9
jne 0x1400023a0
xor eax, eax
ret

Function at 0x1400023c0
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.strlen
cmp rax, 8
ja 0x140002450
mov rdx, qword [0x140027390]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x14000243e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14000243e
cmp word [rax + 0x18], 0x20b
jne 0x14000243e
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x140002450
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x140002429
add r12, 0x28
cmp r12, rsi
je 0x140002450
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x140002420
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x140002460
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140027390]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002480
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002488
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002480
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x1400024d5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400024cc
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002480
add rax, 0x28
cmp rax, r9
jne 0x1400024b8
xor eax, eax
ret

Function at 0x1400024e0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140027390]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140002500
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002508
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x140002500
movzx r8d, word [rax + 6]
mov eax, r8d
ret
Function at 0x140002520
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x140027390]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140002540
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140002548
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140002540
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x140002588
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x14000257f
test rcx, rcx
je 0x140002540
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x140002570
xor eax, eax
ret

Function at 0x140002590
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140027390]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400025b0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1400025b8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x1400025d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x140027390]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400025f0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1400025f8
mov eax, r8d
ret
cmp word [rdx + 0x18], 0x20b
jne 0x1400025f0
sub rcx, rax
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x1400025f0
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002634
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002648
add rax, 0x28
cmp r9, rax
jne 0x140002620
xor r8d, r8d
mov eax, r8d
ret
mov r8d, dword [rax + 0x24]
not r8d
shr r8d, 0x1f
mov eax, r8d
ret

Function at 0x140002660
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x140027390]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002682
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002690
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002682
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002682
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x140002682
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x1400026dd
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x1400026f0
add rdx, 0x28
cmp r10, rdx
jne 0x1400026c8
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x1400026ff
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x14000270f
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400026e6
test ecx, ecx
jg 0x1400026f8
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140001000
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push rbx
mov eax, 0x1f60
call fcn.140001160
sub rsp, rax
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
test rax, rax
je 0x14000113b
mov qword [rsp + 0x1f78], rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdx, rax
mov rcx, rbx
mov rdi, rax
mov dword [rax], 0x130
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140001071
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140001061
xor ebx, ebx
lea r9, [rsp + 0x1f70]
mov r8d, 0x1f40
mov dword [rsp + 0x1f70], ebx
lea rdx, [rsp + 0x20]
lea rcx, [rbx - 1]
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
mov eax, dword [rsp + 0x1f70]
test rax, 0xfffffffffffffff8
jbe 0x1400010f5
lea rdi, [rsp + 0x20]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rdi]
mov r8d, 0x104
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [rsp + 0x1f70]
lea rdi, [rdi + 8]
inc ebx
shr rcx, 3
movsxd rax, ebx
cmp rax, rcx
jb 0x1400010b0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtReadFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, qword [rsp + 0x1f78]
lea rdx, [0x14000207c]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
cmp byte [rax], 0xe9
je 0x140001135
lea rdx, str.NOT_D
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
add rsp, 0x1f60
pop rbx
ret
Function at 0x140001d10
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140001d38
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140001d5e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140001d60
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140001db9
test ecx, ecx
jle 0x140001d99
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140001db9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140001db9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140001de0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140001e02
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140001e18
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140001e34
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140001e36
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140001e72
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140001f0e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140001ead
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140001eee
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140001f0e
cmp rbx, rax
ja 0x140001ec0
test rbx, rbx
je 0x140001f0e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140002340
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000a010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000236d
xor eax, eax
jmp 0x1400024d9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400023a7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400023a7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400024d9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400024cc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400023ea
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002415
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400024d1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002484
sub eax, 1
je 0x140002484
cmp eax, 2
jne 0x1400024cc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400024d1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400024b2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400024cc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400024d1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140004700
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140002670
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002743
cmp byte [rcx + 0x71], 0
je 0x140002743
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000273f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002704
sub eax, 1
je 0x140002708
cmp eax, 2
jne 0x14000273f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004700
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002736
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000273f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400026ec
xor al, al
jmp 0x1400026ec
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004700
add rsp, 0x60
pop rbx
ret
Function at 0x140002ea0
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x14000a010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xorps xmm0, xmm0
mov rdi, rdx
mov rdx, qword [rcx + 0x10]
mov esi, r8d
movups xmmword [rsp + 0x70], xmm0
mov rbx, rcx
lea r8, [r11 - 0x78]
mov rcx, rdi
movups xmmword [r11 - 0x68], xmm0
movups xmmword [r11 - 0x58], xmm0
movups xmmword [r11 - 0x48], xmm0
movups xmmword [r11 - 0x38], xmm0
call qword [sym.imp.USER32.dll_GetClassInfoExW]
xor ebp, ebp
test eax, eax
jne 0x140002fb7
lea rax, [0x140003100]
mov qword [rsp + 0x70], 0x50
mov edx, 0x7f00
mov qword [rsp + 0x78], rax
xor ecx, ecx
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rdi
call qword [sym.imp.USER32.dll_LoadIconW]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0x90], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
movdqa xmm0, xmmword [0x140006960]
mov edx, 0x7f00
mov qword [rsp + 0x98], rax
xor ecx, ecx
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0xb0], rax
movdqa xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.USER32.dll_LoadIconW]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0xb8], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x140002fb7
lea r9d, [rbp + 0x30]
xor ecx, ecx
lea r8, str.Error_
lea rdx, str.Window_Registration_Failed_
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8, qword [rbx + 0x18]
mov r9d, 0xca0000
mov rdx, qword [rbx + 0x10]
mov ecx, 0x200
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], 0x96
mov dword [rsp + 0x30], 0x12c
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rbx], rax
test rax, rax
jne 0x14000302f
lea r9d, [rax + 0x30]
xor ecx, ecx
lea r8, str.Error_
lea rdx, str.Window_Creation_Failed_
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClientRect]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9, qword [rbx]
mov rcx, rax
mov eax, dword [rsp + 0x6c]
sub eax, dword [rsp + 0x64]
sub eax, 0x1e
mov qword [rsp + 0x58], rbp
cdq
mov qword [rsp + 0x50], rcx
sub eax, edx
mov qword [rsp + 0x48], 0x2774
sar eax, 1
xor ecx, ecx
mov r8d, eax
mov qword [rsp + 0x40], r9
mov eax, dword [rsp + 0x68]
mov r9d, 0x50010001
sub eax, dword [rsp + 0x60]
sub eax, 0x64
mov dword [rsp + 0x38], 0x1e
cdq
mov dword [rsp + 0x30], 0x64
sub eax, edx
mov dword [rsp + 0x28], r8d
sar eax, 1
lea r8, str.Schlie
lea rdx, str.BUTTON
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, qword [rbx]
mov edx, esi
mov qword [rbx + 8], rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140004700
mov rbx, qword [rsp + 0x108]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000516c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400051b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400051b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400051b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400051b6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400051b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400051b8
xor al, al
add rsp, 0x28
ret
Function at 0x4175e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417786
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x0098b488]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433da0
xorps xmm15, xmm15
mov r14, qword [0x00a24340]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x41764b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417660
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x417685
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417699
cmp rbx, 0x1000
jae 0x417655
nop dword [rax]
jmp 0x417709
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x4176ad
xor edx, edx
jmp 0x417700
mov rcx, qword [0x0098b488]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433da0
xorps xmm15, xmm15
mov r14, qword [0x00a24340]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x41768f
jmp 0x417674
call fcn.004673e0
xorps xmm15, xmm15
mov r14, qword [0x00a24340]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438580
lea rax, [0x007674aa]
mov ebx, 0x18
call fcn.00438e80
mov rax, qword [rsp + 0x38]
call fcn.00438b80
lea rax, [0x007675fa]
mov ebx, 0x19
call fcn.00438e80
mov rax, qword [rsp + 0x30]
nop
call fcn.00438b80
call fcn.004387e0
call fcn.00438600
lea rax, [0x0076c7b9]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00436c40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463800
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004175e0
Function at 0x4177c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4179ea
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x0098b490]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00433e20
xorps xmm15, xmm15
mov r14, qword [0x00a24340]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x417839
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41784c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x417870
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x417884
cmp rbx, 0x1000
jae 0x417843
jmp 0x417905
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417896
xor esi, esi
jmp 0x4178f6
mov rax, qword [0x0098b490]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00433e20
xorps xmm15, xmm15
mov r14, qword [0x00a24340]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41787a
nop
jmp 0x417862
call fcn.004673e0
xorps xmm15, xmm15
mov r14, qword [0x00a24340]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417985
call fcn.00438580
lea rax, [0x00767e47]
mov ebx, 0x19
call fcn.00438e80
mov rax, qword [rsp + 0x68]
call fcn.00438b80
lea rax, [0x007675fa]
mov ebx, 0x19
call fcn.00438e80
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00438b80
call fcn.004387e0
call fcn.00438600
lea rax, [0x007613c1]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00436c40
cmp eax, 0x5af
je 0x417928
call fcn.00438580
lea rax, [0x00767e47]
mov ebx, 0x19
nop dword [rax]
call fcn.00438e80
mov rax, qword [rsp + 0x38]
call fcn.00438b80
lea rax, [0x007675fa]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00438e80
mov eax, dword [rsp + 0x34]
call fcn.00438b80
call fcn.004387e0
call fcn.00438600
lea rax, [0x0076b6bb]
mov ebx, 0x1f
call fcn.00436c40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463800
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004177c0