joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a1c0
Capabilities:
Read file on windows

Disassembly:
push r14
push r15
sub rsp, 0x68
mov r15, rdx
mov r14, rcx
mov eax, dword [r15 + 0x28c]
cmp eax, 1
jne 0x14001a208
mov rax, rsp
lea rdx, [rsp + 0x50]
mov rcx, qword [r15 + 0x290]
mov r8d, 9
lea r9, [rsp + 0x30]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop
jmp 0x14001a2b0
cmp eax, 2
jne 0x14001a2b0
lea rcx, [rsp + 0x50]
cmp rcx, qword [r15 + 0x30]
je 0x14001a3a0
mov eax, 9
mov qword [rsp + 0x48], rbx
mov rbx, rax
mov qword [rsp + 0x40], rsi
mov rsi, r15
mov qword [rsp + 0x38], rdi
mov r15, rcx
mov qword [rsp + 0x30], r12
mov rdx, qword [rsi + 0x38]
cmp rdx, rbx
cmovae rdx, rbx
mov r12d, edx
test r12, r12
je 0x14001a294
mov rdi, qword [rsi + 0x28]
mov dword [rdi], 1
mov dword [rdi + 4], r12d
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [rdi + 8], 0
jg 0x14001a285
jl 0x14001a29c
jmp 0x14001a294
mov rcx, r15
mov r8, r12
mov rdx, qword [rsi + 0x30]
call fcn.14002ef20
add r15, r12
sub rbx, r12
jne 0x14001a242
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov r12, qword [rsp + 0x30]
mov eax, dword [rsp + 0x50]
mov edx, eax
and edx, 0xf
mov ecx, eax
mov byte [r14 + 0x12], dl
mov edx, eax
mov r8d, eax
mov r9d, eax
mov r10d, eax
mov r11d, eax
shr ecx, 4
mov r15d, eax
shr edx, 0x1a
and ecx, 0xf
shr r8d, 8
and edx, 7
shr r9d, 0xc
and r8d, 0xf
shr r10d, 0x10
and r9d, 0xf
shr r11d, 0x14
and r10d, 0xf
mov byte [r14 + 0x16], cl
mov ecx, eax
mov byte [r14 + 0xe], dl
and r11d, 7
mov byte [r14 + 0x15], r8b
mov r8d, eax
shr eax, 0x1f
mov edx, dword [rsp + 0x54]
mov byte [r14 + 0x18], al
movzx eax, dl
mov byte [r14 + 0x14], r9b
mov r9d, edx
mov byte [r14 + 0x13], r10b
mov r10d, edx
mov byte [r14 + 0x11], r11b
mov r11d, edx
mov dword [r14 + 8], eax
mov eax, edx
shr ecx, 0x1d
shr r15d, 0x17
and ecx, 1
shr r8d, 0x1e
and r15d, 7
shr r9d, 8
and r8d, 1
shr r10d, 0xb
and r9d, 7
shr r11d, 0xd
and r10d, 3
shr eax, 0x14
and r11d, 0x7f
mov byte [r14 + 5], cl
and eax, 0xf
mov ecx, dword [rsp + 0x58]
shr edx, 0x18
and ecx, 7
mov byte [r14 + 0xf], r15b
mov byte [r14 + 4], r8b
mov byte [r14 + 0xd], r9b
mov byte [r14 + 0xc], r10b
mov dword [r14], r11d
mov byte [r14 + 0x19], al
mov dword [r14 + 0x1c], edx
mov byte [r14 + 0x10], cl
add rsp, 0x68
pop r15
pop r14
ret
mov rax, qword [r15 + 0x28]
mov dword [rax], 1
mov dword [rax + 4], 9
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [r15 + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x14001a2b0
Function at 0x401160
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
lea rdi, [0x00521050]
xor ebx, ebx
mov ecx, dword [rdi]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x4011a1
add ebx, 1
add rdi, 4
cmp ebx, 7
jb 0x401177
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x28
ret

Function at 0x401930
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov rbx, rcx
lea rcx, str.SynECR.dll
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rbx], rax
jne 0x401960
xor edi, edi
mov dword [rbx + 8], edi
jmp 0x401a37
lea rdx, str.SynCR_Init
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.SynCR_SetParam
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.SynCR_GetParam
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.SynCR_Recog
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.SynCR_CleanUp
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x30], rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x4019d2
call rax
mov dword [rbx + 8], eax
cmp qword [rbx + 0x10], 0
je 0x401a0f
cmp qword [rbx + 0x18], 0
je 0x401a0f
cmp qword [rbx + 0x20], 0
je 0x401a0f
cmp qword [rbx + 0x28], 0
je 0x401a0f
cmp qword [rbx + 0x30], 0
je 0x401a0f
cmp dword [rbx + 8], 0
je 0x401a0f
mov eax, 1
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
mov ecx, dword [rbx + 8]
xor edi, edi
test ecx, ecx
je 0x401a26
mov rax, qword [rbx + 0x30]
test rax, rax
je 0x401a23
call rax
mov dword [rbx + 8], edi
mov rcx, qword [rbx]
test rcx, rcx
je 0x401a37
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx], rdi
mov qword [rbx + 0x30], rdi
mov qword [rbx + 0x28], rdi
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x10], rdi
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x28
ret
Function at 0x4052e0
Capabilities:
Hide graphical window

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
movsxd rsi, r9d
mov r12, rdx
mov rbx, rcx
shr r8d, 0x10
and r8d, 1
cmp dword [rcx + 0x18c], esi
je 0x405523
cmp esi, 0xa
jne 0x405330
call fcn.00404f30
jmp 0x405523
cmp esi, 0xa
ja 0x405523
test r8d, r8d
je 0x40534d
mov rdi, rsi
lea rax, [rsi + rsi*2]
cmp qword [rcx + rax*8 + 0x70], 0
jne 0x40535c
mov rdi, rsi
cmp qword [rcx + rsi*8 + 0x10], 0
je 0x405523
test r8d, r8d
je 0x405423
mov rbp, qword [rcx + 0x170]
test rbp, rbp
je 0x4053b6
lea rax, [rdi + rdi*2]
mov edx, dword [rcx + rax*8 + 0x68]
cmp dword [rcx + 0x178], edx
je 0x4053b6
mov rcx, rbp
call fcn.004468a0
mov rcx, rbp
call fcn.004a6f90
mov qword [rbx + 0x170], 0
xor eax, eax
mov dword [rbx + 0x17c], eax
mov dword [rbx + 0x180], eax
mov dword [rbx + 0x184], eax
mov dword [rbx + 0x188], eax
cmp qword [rbx + 0x170], 0
jne 0x405423
mov ecx, 0x48
call fcn.004a7ed0
mov qword [rsp + 0x50], rax
test rax, rax
je 0x40540c
lea r9, [rdi + rdi*2]
mov dword [rsp + 0x30], 0x88
mov dword [rsp + 0x28], 0x80000000
lea rcx, [0x004e8940]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbx + r9*8 + 0x70]
mov r8, qword [0x00526768]
xor edx, edx
mov rcx, rax
call fcn.00446a30
jmp 0x40540e
xor eax, eax
mov qword [rbx + 0x170], rax
lea rax, [rdi + rdi*2]
mov ecx, dword [rbx + rax*8 + 0x68]
mov dword [rbx + 0x178], ecx
mov dword [rbx + 0x18c], esi
mov qword [rbx + 8], r12
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetCursorPos]
cmp qword [rbx + 8], 0
je 0x4054d8
mov rcx, qword [rbx + 0x170]
test rcx, rcx
je 0x4054a5
movsxd r9, dword [rbx + 0x18c]
lea rax, [r9 + r9*2]
mov r8d, dword [rsp + 0x44]
add r8d, dword [rbx + rax*8 + 0x7c]
lea rax, [r9 + r9*2 + 0xf]
mov edx, dword [rbx + rax*8]
mov eax, dword [rsp + 0x40]
add edx, eax
xor r9d, r9d
call fcn.00446da0
mov r11, qword [rsp + 0x40]
mov dword [rbx + 0x17c], r11d
mov ecx, dword [rsp + 0x44]
mov dword [rbx + 0x180], ecx
lea eax, [r11 + 1]
mov dword [rbx + 0x184], eax
lea eax, [rcx + 1]
mov dword [rbx + 0x188], eax
jmp 0x4054d8
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
mov r9d, 1
mov r8d, dword [rsp + 0x44]
mov edx, dword [rsp + 0x40]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_MoveWindow]
mov rcx, qword [rbx + 0x170]
test rcx, rcx
je 0x4054ed
mov dl, 1
call fcn.004468c0
jmp 0x405523
mov rcx, qword [rbx]
test rcx, rcx
je 0x405523
mov edx, 8
call qword [sym.imp.USER32.dll_ShowWindow]
cmp qword [rbx + 0x60], 0
jne 0x405518
mov rcx, qword [rbx + rdi*8 + 0x10]
call qword [sym.imp.USER32.dll_SetCursor]
mov qword [rbx + 0x60], rax
jmp 0x405523
mov rcx, qword [rbx + rdi*8 + 0x10]
call qword [sym.imp.USER32.dll_SetCursor]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov r12, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x405820
Capabilities:
Hide graphical window

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x50], rbx
mov rbx, rcx
mov qword [rsp + 0x58], rdi
mov rdi, rdx
mov edx, dword [rdx + 4]
mov ecx, dword [rdi]
call qword [sym.imp.USER32.dll_SetCursorPos]
test eax, eax
je 0x4052c6
cmp qword [rbx + 8], 0
je 0x4052b2
mov rcx, qword [rbx + 0x170]
test rcx, rcx
je 0x405282
movsxd rdx, dword [rbx + 0x18c]
xor r9d, r9d
lea rax, [rdx + rdx*2]
mov r8d, dword [rbx + rax*8 + 0x7c]
lea rax, [rdx + rdx*2 + 0xf]
mov edx, dword [rbx + rax*8]
add r8d, dword [rdi + 4]
add edx, dword [rdi]
call fcn.00446da0
mov r11d, dword [rdi]
mov dword [rbx + 0x17c], r11d
mov eax, dword [rdi + 4]
mov dword [rbx + 0x180], eax
mov eax, dword [rdi]
add eax, 1
mov dword [rbx + 0x184], eax
mov eax, dword [rdi + 4]
add eax, 1
mov dword [rbx + 0x188], eax
mov eax, 1
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
ret
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r8d, dword [rdi + 4]
mov edx, dword [rdi]
mov rcx, qword [rbx]
mov r9d, 1
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_MoveWindow]
mov eax, 1
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
ret
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x38
ret
jmp 0x4051e0

Function at 0x409680
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
sub rsp, 0x38
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r12d, ecx
mov qword [rax - 0x18], r14
movzx r13d, dx
lea rcx, [0x00527fd0]
xor r14d, r14d
xor edx, edx
mov rbx, r14
call fcn.004a5ad4
lea ebp, [r14 + 1]
test rax, rax
mov rsi, rax
je 0x409796
nop
test rbx, rbx
jne 0x409796
mov eax, r12d
lea edx, [rbx + 6]
movzx r9d, r13w
shr eax, 4
mov rcx, rsi
add ax, 1
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
mov rdi, rax
jne 0x409704
mov rbx, r14
jmp 0x409779
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x40971a
mov rbx, r14
jmp 0x409774
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
jne 0x409730
mov rbx, r14
jmp 0x409774
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rbx
and ecx, 0xf
jbe 0x409762
nop
nop
cmp rbx, r11
jae 0x409767
add ecx, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x409750
cmp rbx, r11
jb 0x40976c
mov rbx, r14
jmp 0x409774
cmp word [rbx], r14w
cmove rbx, r14
test rbx, rbx
jne 0x4097c0
lea rcx, [0x00527fd0]
mov edx, ebp
call fcn.004a5ad4
add ebp, 1
test rax, rax
mov rsi, rax
jne 0x4096d0
xor eax, eax
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret
mov rax, rsi
jmp 0x409798
Function at 0x40a230
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
sub rsp, 0x48
xor r9d, r9d
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x28], r12
mov dword [rdx], r9d
mov dword [r8], r9d
mov eax, dword [rcx + 0x84c]
test eax, eax
mov rbp, r8
mov r12, rdx
mov r10, rcx
jle 0x40a405
cmp eax, 3
jge 0x40a2b8
cmp dword [rcx + 0x850], 1
jne 0x40a2b8
mov eax, dword [rcx + 0x7ac]
sub eax, dword [rcx + 0x7a4]
cdq
xor eax, edx
sub eax, edx
cdq
sub eax, edx
sar eax, 1
mov dword [r12], eax
mov eax, dword [rcx + 0x7b0]
sub eax, dword [rcx + 0x7a8]
cdq
xor eax, edx
sub eax, edx
cdq
sub eax, edx
sar eax, 1
mov dword [r8], eax
mov r12, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp dword [rcx + 0x850], 1
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
mov esi, r9d
jne 0x40a2d3
lea edi, [rax - 2]
jmp 0x40a2d6
lea edi, [rax - 1]
mov qword [rsp + 0x18], r14
movsxd r11, edi
mov qword [rsp + 0x10], r15
cmp r11, 2
mov r14d, r9d
mov r15d, r9d
mov ecx, r9d
mov r8d, r9d
jl 0x40a39f
mov qword [rsp + 0x68], rbx
lea rbx, [r11 - 2]
mov qword [rsp + 0x20], r13
shr rbx, 1
lea r13, [r10 + r11*8 + 0x79c]
mov ebp, r9d
add rbx, 1
mov r12d, r9d
mov rax, rbx
neg rax
lea r11, [r11 + rax*2]
nop
nop
nop
mov r8d, dword [r13]
mov ecx, dword [r13 + 4]
mov eax, dword [r13 + 8]
sub eax, r8d
sub r8d, dword [r13 - 8]
sub r13, 0x10
cdq
xor eax, edx
sub eax, edx
add ebp, eax
mov eax, dword [r13 + 0x1c]
sub eax, ecx
sub ecx, dword [r13 + 0xc]
cdq
xor eax, edx
sub eax, edx
add r14d, eax
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
add r12d, eax
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
add r15d, eax
sub rbx, 1
jne 0x40a330
mov r13, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x68]
mov dword [rsp], r12d
mov r8d, dword [rsp]
mov r12, qword [rsp + 0x58]
mov dword [rsp + 0x50], ebp
mov ecx, dword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
test r11, r11
jle 0x40a3d5
mov eax, dword [r10 + r11*8 + 0x7a4]
sub eax, dword [r10 + r11*8 + 0x79c]
cdq
mov r9d, eax
mov eax, dword [r10 + r11*8 + 0x7a8]
sub eax, dword [r10 + r11*8 + 0x7a0]
xor r9d, edx
sub r9d, edx
cdq
mov esi, eax
xor esi, edx
sub esi, edx
xor edx, edx
lea eax, [r8 + rcx]
add eax, r9d
div edi
xor edx, edx
mov dword [r12], eax
lea eax, [r15 + r14]
mov r15, qword [rsp + 0x10]
mov r14, qword [rsp + 0x18]
add eax, esi
mov rsi, qword [rsp + 0x38]
div edi
mov rdi, qword [rsp + 0x30]
mov dword [rbp], eax
mov r12, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
Function at 0x4105d0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
cmp dword [rcx + 0x7f0], 0x12
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov rdi, rdx
mov rbx, rcx
jne 0x4107b6
mov rcx, qword [rdx]
mov dword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
mov rax, qword [rcx]
mov edx, 0x10000317
call qword [rax + 0x18]
cmp dword [rsp + 0x40], 0
jne 0x4107b6
mov ecx, 0x1b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x410655
mov rcx, qword [0x00526530]
lea rdx, [rbx + 0xa]
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, rbx
call fcn.0040ae50
mov dword [rbx + 0x7f0], eax
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
ret
mov rcx, qword [rdi]
lea r8, [rsp + 0x40]
mov edx, 0x10000312
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r11d, dword [rsp + 0x40]
shr r11d, 0x10
test r11b, 1
jne 0x4106bc
mov rcx, qword [rbx + 0x6d0]
lea r8, [rsp + 0x40]
mov edx, 0x10000312
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r11d, dword [rsp + 0x40]
shr r11d, 0x10
test r11b, 1
je 0x4106bc
mov rcx, qword [0x00526530]
lea rdx, [rbx + 0xa]
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, rbx
call fcn.0040ace0
mov dword [rbx + 0x7f0], eax
mov rcx, qword [rdi]
lea r8, [rsp + 0x40]
mov edx, 0x10000312
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r11d, dword [rsp + 0x40]
shr r11d, 0xd
test r11b, 1
jne 0x41072f
mov rcx, qword [rdi]
lea r8, [rsp + 0x20]
mov edx, 0x10000313
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r11d, dword [rsp + 0x20]
shr r11d, 8
test r11b, 1
jne 0x41072f
lea rcx, [rbx + 0x6d0]
call fcn.00404ad0
test al, al
je 0x41072f
mov r8d, dword [rbx + 0x88c]
mov rcx, qword [0x00526530]
lea rdx, [rbx + 0xa]
lea r9, [0x0040dab0]
call qword [sym.imp.USER32.dll_SetTimer]
mov rcx, qword [rdi]
lea r8, [rsp + 0x40]
mov edx, 0x10000312
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r11d, dword [rsp + 0x40]
shr r11d, 0xd
test r11b, 1
jne 0x410773
mov rcx, qword [rdi]
lea r8, [rsp + 0x20]
mov edx, 0x10000313
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r11d, dword [rsp + 0x20]
shr r11d, 8
test r11b, 1
je 0x4107b6
lea rcx, [rbx + 0x6d0]
call fcn.00404ad0
test al, al
jne 0x4107b6
mov rcx, qword [rdi]
lea r8, [rsp + 0x40]
mov edx, 0x10000312
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r11d, dword [rsp + 0x40]
shr r11d, 0x10
test r11b, 1
jne 0x4107b6
mov rcx, qword [0x00526530]
lea rdx, [rbx + 0xa]
call qword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [rbx + 0x7f0]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
ret
Function at 0x411fa0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov edi, edx
mov rbx, rcx
mov qword [r11 - 0x38], 0
mov eax, dword [0x005260a4]
test al, 1
jne 0x411ff5
or eax, 1
mov dword [0x005260a4], eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x005260a0], eax
jmp 0x411ffb
mov eax, dword [0x005260a0]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x412021
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov edx, 1
mov ecx, dword [0x005260a0]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rdx, [rsp + 0x40]
lea rcx, str.SynCom.SynPacket
call qword [sym.imp.ole32.dll_CLSIDFromProgID]
lea r11, [rsp + 0x30]
mov qword [rsp + 0x20], r11
lea r9, [0x004e7fa8]
xor edx, edx
lea r8d, [rdx + 0x15]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoCreateInstance]
nop
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x30]
call qword [rax + 0x30]
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov r8d, edi
mov edx, 0x10000317
call qword [rax + 0x20]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x412086
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.004a7100
mov rbx, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
add rsp, 0x68
ret

Function at 0x4152b0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov rbx, rcx
mov rcx, qword [rcx + 0x58]
mov qword [rsp + 0x68], rdi
xor edi, edi
test rcx, rcx
mov dword [rsp + 0x50], edi
je 0x4153a3
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
mov edx, 0x10000102
call qword [rax + 0x18]
cmp dword [rsp + 0x50], 2
jne 0x4153a3
mov rcx, qword [rbx + 0x58]
mov dword [rsp + 0x58], edi
test rcx, rcx
je 0x4153a3
mov rax, qword [rcx]
lea r8, [rsp + 0x58]
mov edx, 0x10000103
call qword [rax + 0x18]
cmp dword [rsp + 0x58], 3
jne 0x4153a3
mov rcx, qword [rbx + 0x58]
mov dword [rsp + 0x30], edi
test rcx, rcx
je 0x4153a3
mov rax, qword [rcx]
lea r8, [rsp + 0x30]
mov edx, 0x1000296
call qword [rax + 0x18]
cmp dword [rsp + 0x30], edi
je 0x4153a3
mov rcx, qword [rbx + 0x58]
mov dword [rsp + 0x34], edi
test rcx, rcx
je 0x4153a3
mov rax, qword [rcx]
lea r8, [rsp + 0x34]
mov edx, 0x1000297
call qword [rax + 0x18]
cmp dword [rsp + 0x34], 0xe
jne 0x4153a3
cmp qword [rbx + 0x738], rdi
jne 0x415394
lea rax, [rsp + 0x50]
lea r8, [0x004113b0]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x738], rax
mov rdx, qword [0x00526530]
mov rcx, rbx
call fcn.004151c0
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x48
ret
Function at 0x417140
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov eax, r8d
mov rbp, rdx
mov qword [rsp + 0x40], rsi
shr eax, 4
add ax, 1
mov ebx, r8d
mov rsi, rcx
movzx edx, ax
mov r8d, 6
mov rcx, rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x4172b4
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x4172b4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x4172b4
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x4171e6
nop
cmp rdi, r11
jae 0x4172b4
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x4171d0
cmp rdi, r11
jae 0x4172b4
movzx eax, word [rdi]
test ax, ax
je 0x4172b4
movzx ebx, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x41721c
mov edx, ebx
mov rcx, rsi
call fcn.00405890
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x41723c
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.004a7900
test eax, eax
je 0x41728a
cmp eax, 0xc
je 0x41727f
cmp eax, 0x16
je 0x417274
cmp eax, 0x22
je 0x417274
cmp eax, 0x50
je 0x41728a
mov ecx, 0x80004005
call fcn.00404e30
int3
mov ecx, 0x80070057
call fcn.00404e30
int3
mov ecx, 0x8007000e
call fcn.00404e30
int3
test ebx, ebx
js 0x4172a9
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x4172a9
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x4172b6
mov ecx, 0x80070057
call fcn.00404e30
int3
xor eax, eax
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x4245d0
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x30], r12
mov rbp, r8
mov rsi, rdx
mov r12, rcx
test rdx, rdx
je 0x424733
test r8, r8
je 0x42472f
mov rcx, rdx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42472b
xor eax, eax
mov rbx, 0xffffffffffffffff
mov rcx, rbx
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rsi
lea rcx, [r12 + 0x38]
call fcn.00416fd0
xor eax, eax
mov rcx, rbx
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rbp
lea rcx, [r12 + 0x30]
call fcn.00416fd0
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rsi, rax
lea rcx, [0x00522a28]
mov rdx, qword [0x00522a28]
call qword [rdx + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x20], rdi
test rsi, rsi
je 0x4246d7
test rsi, 0xffffffffffff0000
jne 0x4246c3
movzx esi, si
xor edx, edx
mov ecx, esi
call fcn.00409680
test rax, rax
je 0x4246ee
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.00417140
mov rdi, qword [rsp + 0x20]
jmp 0x4246ee
xor eax, eax
mov rcx, rbx
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
jmp 0x4246d9
xor ecx, ecx
mov r8d, ecx
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.00416fd0
mov rdi, qword [rsp + 0x20]
cmp dword [rdi - 0x10], 0
je 0x424704
lea rcx, [r12 + 0x40]
lea rdx, [rsp + 0x20]
call fcn.00424490
nop
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x424724
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
jmp 0x424735
mov eax, 1
jmp 0x424735
xor eax, eax
jmp 0x424735
xor eax, eax
jmp 0x424735
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov r12, qword [rsp + 0x30]
add rsp, 0x38
ret

Function at 0x425680
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
cmp dword [0x00526548], 0
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov esi, edx
mov rbx, rcx
mov edi, r8d
je 0x4256b1
mov ecx, 0x30
call qword [sym.imp.USER32.dll_MessageBeep]
jmp 0x42571f
mov ecx, 0x18
call fcn.004a7ed0
test rax, rax
mov r9, rax
je 0x4256d2
xor eax, eax
mov qword [r9], rax
mov qword [r9 + 8], rax
mov qword [r9 + 0x10], rax
jmp 0x4256d5
xor r9d, r9d
mov rax, qword [0x00526540]
xor ecx, ecx
mov qword [r9], rcx
mov qword [r9 + 8], rax
mov dword [r9], esi
mov dword [r9 + 4], edi
mov qword [r9 + 0x10], rbx
cmp qword [rbx + 0x70], rcx
jne 0x42571f
cmp dword [0x00526548], ecx
jne 0x42571f
lea rax, [rsp + 0x30]
lea r8, [0x00425310]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x70], rax
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x48
ret