joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b1880
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x1401b18b8
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call fcn.1401b18d0
nop
add rsp, 0x38
ret

Function at 0x1401b18d0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x1401b1913
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [fcn.1401aa0e0]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syspalwindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.1401d40f0
ud2

Function at 0x1401b1fd0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x1402b2301]
mov ecx, 0x10
mov edx, 8
call fcn.140007e80
test rax, rax
je 0x1401b20af
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1401b2160]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1401b20a1
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x10], rax
call qword [rax]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1401b2078
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp - 0x20]
call fcn.140007e90
mov edx, 0x10
mov r8d, 8
mov rcx, qword [rbp - 0x18]
call fcn.140007e90
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], rdi
mov ecx, 8
mov edx, 0x10
call fcn.1401d3ed0
ud2
Function at 0x1401b39a0
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1f0
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x1402b2420]
cmp rax, 3
jne 0x1401b3a96
cmp rbx, 0x17f
ja 0x1401b3aa8
lea r15, [rsp + 0x70]
mov rcx, r15
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x70], 0
inc rbx
lea rcx, [rsp + 0x28]
mov rdx, r15
mov r8, rbx
call fcn.1401c0460
cmp qword [rsp + 0x28], 0
je 0x1401b3a24
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1401b3ab9
mov rcx, qword [rsp + 0x30]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x40]
lea r9, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1401b3a7e
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
jmp 0x1401b3ab9
mov rax, qword [rsp + 0x20]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
jmp 0x1401b3ab9
call fcn.1401d3400
cmp rbx, 0x17f
jbe 0x1401b39da
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, edi
call fcn.1401d3470
mov rax, rsi
add rsp, 0x1f0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1401b3c10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
sub rsp, 0xb0
mov rax, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x2c], 0x80
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1401b3cc0
mov eax, dword [rsp + 0x2c]
movzx ecx, word [rsp + 0x30]
cmp ecx, 2
je 0x1401b3cd0
cmp ecx, 0x17
jne 0x1401b3cf7
cmp eax, 0x1b
jbe 0x1401b3d10
movzx eax, word [rsp + 0x32]
rol ax, 8
movups xmm0, xmmword [rsp + 0x38]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x48]
mov word [rsi], 1
movups xmmword [rsi + 4], xmm0
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x18], edx
mov word [rsi + 0x1c], ax
add rsp, 0xb0
pop rsi
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
jmp 0x1401b3cfe
cmp eax, 0xf
jbe 0x1401b3d28
movzx eax, word [rsp + 0x32]
rol ax, 8
mov ecx, dword [rsp + 0x34]
mov word [rsi], 0
mov word [rsi + 6], ax
mov dword [rsi + 2], ecx
add rsp, 0xb0
pop rsi
ret
lea rax, str.invalid_argument__
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xb0
pop rsi
ret
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in6___
lea r8, [0x14025b5c0]
mov edx, 0x43
call fcn.1401d41c0
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in___library_std_src_sys_common_net.rs
lea r8, [0x14025b560]
mov edx, 0x42
call fcn.1401d41c0
int3
Function at 0x1401c8ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x1401c8b5a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x1401c8b50
cmp r11, r10
ja 0x1401c8be5
cmp r10, rdx
ja 0x1401c8bf7
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x1401c8b52
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1401c8b30
jmp 0x1401c8bc7
ja 0x1401c8b5a
mov r11, r10
cmp rax, r8
jne 0x1401c8b02
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1401c8bcb
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1401c8ba0
mov r8, r10
sub ecx, r9d
jns 0x1401c8bbe
jmp 0x1401c8bcd
cmp r10, rdx
je 0x1401c8bd9
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x1401c8bcd
xor al, 1
cmp r8, rdx
jne 0x1401c8b80
jmp 0x1401c8bcd
xor eax, eax
jmp 0x1401c8bcd
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.1401d40b0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1401d4650
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1401d4640
int3

Function at 0x1401cb33c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x1401cb386
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401cb386
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401cb386
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401cb386
cmp dword [rcx + 0x84], 0xe
jbe 0x1401cb386
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401cb388
xor al, al
add rsp, 0x28
ret
Function at 0x1401d3470
Capabilities:
Resolve dns

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov ebp, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.1401bbda0
mov rdx, qword [rsp + 0x30]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x1401d3509
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1401d352d
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
jne 0x1401d354b
jmp 0x1401d355c
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
test rdx, rdx
je 0x1401d355c
mov rcx, qword [rsp + 0x38]
mov r8d, 1
jmp 0x1401d3557
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bp
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
je 0x1401d355c
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.140007e90
nop
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1800111c7
Capabilities:
Print debug messages

Disassembly:
jmp 0x180012bd0
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x20]
lea rcx, [0x180024004]
call fcn.180011366
mov eax, dword [rbp + 0xf8]
mov dword [rbp + 0xc0], eax
cmp dword [rbp + 0xc0], 1
je 0x180012c0f
jmp 0x180012c1c
lea rcx, str.DllMain
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret

Function at 0x180011208
Capabilities:
Terminate process

Disassembly:
jmp 0x180014520
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1800113a2
Capabilities:
Parse pe header

Disassembly:
jmp 0x180011fc0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x3b0
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x84
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x3d8]
mov rax, qword [0x18001f0c0]
xor rax, rbp
mov qword [rbp + 0x388], rax
lea rcx, [0x180024004]
call fcn.180011366
mov qword [rbp + 8], 0
mov rax, qword [rbp + 0x3b0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180012037
xor eax, eax
jmp 0x1800121a9
mov rax, qword [rbp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x3b0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
cmp dword [rax], 0x4550
je 0x180012065
mov rax, qword [rbp + 8]
jmp 0x1800121a9
lea rax, [rbp + 0x70]
mov rcx, qword [rbp + 0x48]
mov rdi, rax
lea rsi, [rcx + 0x18]
mov ecx, 0xf0
rep movsb byte [rdi], byte [rsi]
mov eax, 8
imul rax, rax, 0
cmp dword [rbp + rax + 0xe0], 0
jne 0x180012097
mov rax, qword [rbp + 8]
jmp 0x1800121a9
mov eax, 8
imul rax, rax, 0
mov eax, dword [rbp + rax + 0xe0]
mov rcx, qword [rbp + 0x3b0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x178], rax
mov rax, qword [rbp + 0x178]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 0x3b0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x198], rax
mov rax, qword [rbp + 0x178]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 0x3b0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x1b8], rax
mov rax, qword [rbp + 0x178]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 0x3b0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x1d8], rax
mov dword [rbp + 0x1f4], 0
jmp 0x18001212f
mov eax, dword [rbp + 0x1f4]
inc eax
mov dword [rbp + 0x1f4], eax
mov rax, qword [rbp + 0x178]
mov eax, dword [rax + 0x18]
cmp dword [rbp + 0x1f4], eax
jae 0x1800121a5
mov eax, dword [rbp + 0x1f4]
mov rcx, qword [rbp + 0x1d8]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 0x3b0]
add rcx, rax
mov rax, rcx
mov rdx, qword [rbp + 0x3b8]
mov rcx, rax
call qword [sym.imp.ucrtbased.dll__stricmp]
test eax, eax
jne 0x1800121a0
mov eax, dword [rbp + 0x1f4]
mov rcx, qword [rbp + 0x1b8]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rbp + 0x198]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 0x3b0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
jmp 0x1800121a5
jmp 0x180012121
mov rax, qword [rbp + 8]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x18001b8d0]
call fcn.18001130c
mov rax, rdi
mov rcx, qword [rbp + 0x388]
xor rcx, rbp
call fcn.1800111b8
lea rsp, [rbp + 0x390]
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002570
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [0x140058a08], 0
mov rbx, rcx
je 0x14000259a
mov rcx, qword [0x140058600]
movzx r8d, byte [rbx + 9]
mov rax, qword [rcx]
add rsp, 0x30
pop rbx
jmp qword [rax + 0x38]
mov rcx, rdx
call qword [sym.imp.accore.dll_public:_enum_AcApMessageLoopParams::InputWaitFlags___cdecl_AcApMessageLoopParams::waitFlags_void____ptr64]
test eax, eax
je 0x140002665
call qword [sym.imp.accore.dll_class_AcApDocManager____ptr64___cdecl_acDocManagerPtr_void_]
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x38]
test rax, rax
je 0x1400025f6
cmp byte [rbx + 8], 0
je 0x1400025fe
call qword [sym.imp.accore.dll_class_AcApDocManager____ptr64___cdecl_acDocManagerPtr_void_]
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x38]
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x70]
test al, al
je 0x1400025fe
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [rbx + 8], 0
xor al, al
add rsp, 0x30
pop rbx
ret
cmp byte [0x1400589f9], 0
je 0x14000260f
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getwchar]
jmp 0x140002615
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getwch]
movzx eax, ax
mov dword [0x140058a0c], eax
call qword [sym.imp.accore.dll_class_AcApDocManager____ptr64___cdecl_acDocManagerPtr_void_]
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x38]
mov rcx, rax
call qword [sym.imp.accore.dll_public:_class_AcApCommandLineEditor____ptr64___cdecl_AcApDocument::commandLineEditor_void_const___ptr64]
mov rcx, rax
call qword [sym.imp.accore.dll_public:_class_AcApPromptAndInput____ptr64___cdecl_AcApCommandLineEditor::promptAndInput_void_const___ptr64]
mov rcx, rax
call qword [sym.imp.accore.dll_public:_class_AcApInputBuffer____ptr64___cdecl_AcApPromptAndInput::inputBuffer_void_const___ptr64]
mov r8d, dword [0x140058a0c]
xor r9d, r9d
mov rcx, rax
mov dword [rsp + 0x20], 0
xor edx, edx
call qword [sym.imp.accore.dll_public:_bool___cdecl_AcApInputBuffer::onCharQueue_struct_HWND______ptr64__unsigned_int__unsigned_int__unsigned_int____ptr64]
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x140005390
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140058a44], eax
jg 0x1400053cf
cmp byte [0x140058a48], 0
je 0x1400053c0
mov al, 1
add rsp, 0x28
ret
cmp dword [0x1400585f8], 1
sete al
add rsp, 0x28
ret
lea rcx, [0x140058a44]
call fcn.140031050
cmp dword [0x140058a44], 0xffffffff
jne 0x1400053b0
lea rcx, str.FUSION_DOC_BUILD
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
lea rcx, [0x140058a44]
setne byte [0x140058a48]
call fcn.140030ff0
jmp 0x1400053b0

Function at 0x14000cb40
Capabilities:
Hide graphical window

Disassembly:
push rbx
push rbp
push rsi
push r14
sub rsp, 0x68
mov rax, qword [0x140055058]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov esi, dword [rsp + 0xb8]
mov r14d, r9d
movzx ebp, r8b
mov rbx, rcx
test esi, esi
je 0x14000ccb6
mov qword [rsp + 0x98], rdi
mov edi, dword [rsp + 0xc0]
test edi, edi
je 0x14000ccae
cmp byte [rcx + 0x49], 0
je 0x14000cbc0
mov eax, dword [rsp + 0xb0]
mov dword [rcx + 0x30], eax
mov rax, qword [rsp + 0xc8]
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x20], rdx
mov byte [rcx + 0x28], bpl
mov dword [rcx + 0x2c], r9d
mov dword [rcx + 0x34], esi
mov dword [rcx + 0x38], edi
mov byte [rcx + 0x48], 1
jmp 0x14000ccae
mov rcx, qword [rcx - 0x10]
mov qword [rsp + 0x60], r15
mov r15d, dword [rsp + 0xb0]
test rcx, rcx
jne 0x14000cc35
test r8b, r8b
je 0x14000cca9
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rbx - 8], rax
mov byte [rbx + 0x49], 1
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x4c], edi
call qword [sym.imp.accore.dll_class_AcApDocManager____ptr64___cdecl_acDocManagerPtr_void_]
lea rdx, str.acad.dwt
mov rcx, rax
mov r8, qword [rax]
call qword [r8 + 0xa8]
mov rcx, qword [rbx - 0x10]
mov qword [rbx - 8], 0
mov byte [rbx + 0x49], 0
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14000cca9
mov rcx, qword [rbx - 0x10]
mov r9d, esi
mov dword [rsp + 0x28], 1
mov r8d, r15d
mov edx, r14d
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_MoveWindow]
mov rcx, qword [rbx - 0x10]
mov edx, ebp
call qword [sym.imp.USER32.dll_ShowWindow]
cmp byte [rbx + 0x48], 0
je 0x14000cca9
mov rax, qword [rbx + 0x40]
mov rcx, rbx
mov r10, qword [rbx]
mov r9d, dword [rbx + 0x2c]
movzx r8d, byte [rbx + 0x28]
mov rdx, qword [rbx + 0x20]
mov qword [rsp + 0x38], rax
mov eax, dword [rbx + 0x38]
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0x34]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0x30]
mov dword [rsp + 0x20], eax
mov byte [rbx + 0x48], 0
call qword [r10 + 0x28]
mov r15, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140030ea0
add rsp, 0x68
pop r14
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000fc80
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140055058]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, 0xffff
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x14000fcb1
xor eax, eax
jmp 0x14000fdf4
mov rdx, qword [rcx + 0x40]
mov rcx, qword [rdx]
test rcx, rcx
je 0x14000fce1
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rdx, [rcx + r8*2]
cmp rcx, rdx
jae 0x14000fce1
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_protected:_wchar_t____ptr64___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::_Pninc_void____ptr64]
mov word [rax], si
movzx eax, si
jmp 0x14000fdf4
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x14000fde9
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000fd28
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000fd52
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, di
je 0x14000fde9
movzx edi, si
jmp 0x14000fde9
lea rax, [rsp + 0x40]
mov word [rsp + 0x50], si
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x52]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000fda8
sub eax, 1
je 0x14000fda8
cmp eax, 2
jne 0x14000fde9
movzx ecx, word [rsp + 0x50]
jmp 0x14000fd34
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x14000fdd6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbp, rax
jne 0x14000fde9
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
movzx eax, si
jne 0x14000fdec
movzx eax, di
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140030ea0
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400101b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140055058]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140010285
cmp byte [rcx + 0x72], 0
je 0x140010285
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140010281
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140010246
sub eax, 1
je 0x14001024a
cmp eax, 2
jne 0x140010281
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140030ea0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140010278
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140010281
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14001022e
xor al, al
jmp 0x14001022e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140030ea0
add rsp, 0x60
pop rbx
ret
Function at 0x140016da0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140016dd3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140016e1a
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140016e15
nop
cmp rbx, rcx
jae 0x140016e1a
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140016e00
cmp rbx, rcx
jb 0x140016e1e
xor eax, eax
jmp 0x140016e2a
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret