joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f552c
Capabilities:
Copy file

Disassembly:
sub rsp, 0x28
xor eax, eax
cmp word [0x1401937e0], ax
je 0x1400e5111
cmp word [0x140192f98], ax
je 0x1400e5111
add rsp, 0x28
jmp fcn.1400e5008
cmp word [0x1401935d0], ax
je 0x1400e511f
call fcn.1400e4e20
add rsp, 0x28
ret
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x14017da30]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov rbx, rcx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x98
call sub.MSVCR120.dll_memset
test byte [0x1401931a8], 1
lea rax, [rbp - 0x30]
mov r9d, 0x104
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x30], 0x98
mov qword [rsp + 0x38], rbx
mov dword [rbp - 0x70], 0x806
mov dword [rsp + 0x68], r9d
je 0x1400f55a8
lea rax, str.Zip_Archives
lea rdx, [0x140139b10]
jmp 0x1400f55d6
mov eax, dword [0x14017d968]
cmp eax, 2
jne 0x1400f55c3
lea rax, str.Log_Files
lea rdx, [0x140138350]
jmp 0x1400f55d6
cmp eax, 1
jne 0x1400f563b
lea rax, str.Xml_Files
lea rdx, [0x140139b08]
mov rcx, qword [0x140194438]
lea r8, [rbp - 0x30]
mov qword [rsp + 0x48], rax
mov qword [rbp - 0x68], rdx
call fcn.1400f18f0
lea rcx, [rsp + 0x30]
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
je 0x1400f563b
mov rcx, rbx
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [0x140194018]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SetCursor]
lea rdx, [rbp - 0x30]
lea rcx, [0x140194440]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [rsp + 0x20]
call fcn.1400f547c
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.14010a480
mov rbx, qword [rsp + 0x308]
add rsp, 0x2f0
pop rbp
ret
sub rsp, 0x38
sub edx, 2
je 0x1400f5b01
sub edx, 0x3e7
je 0x1400f5af3
dec edx
je 0x1400f5aea
sub edx, 5
je 0x1400f5adc
dec edx
je 0x1400f5ab5
sub edx, 4
je 0x1400f5aac
dec edx
jne 0x1400f5b09
add rsp, 0x38
jmp 0x1400e50f0
add rsp, 0x38
jmp fcn.1400e4e20
lea r9, [0x1400fe4e8]
mov edx, 0x68
and qword [rsp + 0x20], 0
mov r8, rcx
mov rcx, qword [0x140192f90]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
add rsp, 0x38
ret
lea r9, [0x1400fecd8]
mov edx, 0x67
jmp 0x1400f5ac1
add rsp, 0x38
jmp 0x1400f552c
lea r9, [0x1400fefd4]
mov edx, pe_nt_image_headers64
jmp 0x1400f5ac1
xor edx, edx
call qword [sym.imp.USER32.dll_EndDialog]
add rsp, 0x38
ret
Function at 0x1400f5a7c
Capabilities:
Copy file

Disassembly:
sub rsp, 0x28
xor eax, eax
cmp word [0x1401937e0], ax
je 0x1400e5111
cmp word [0x140192f98], ax
je 0x1400e5111
add rsp, 0x28
jmp fcn.1400e5008
cmp word [0x1401935d0], ax
je 0x1400e511f
call fcn.1400e4e20
add rsp, 0x28
ret
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x14017da30]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov rbx, rcx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x98
call sub.MSVCR120.dll_memset
test byte [0x1401931a8], 1
lea rax, [rbp - 0x30]
mov r9d, 0x104
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x30], 0x98
mov qword [rsp + 0x38], rbx
mov dword [rbp - 0x70], 0x806
mov dword [rsp + 0x68], r9d
je 0x1400f55a8
lea rax, str.Zip_Archives
lea rdx, [0x140139b10]
jmp 0x1400f55d6
mov eax, dword [0x14017d968]
cmp eax, 2
jne 0x1400f55c3
lea rax, str.Log_Files
lea rdx, [0x140138350]
jmp 0x1400f55d6
cmp eax, 1
jne 0x1400f563b
lea rax, str.Xml_Files
lea rdx, [0x140139b08]
mov rcx, qword [0x140194438]
lea r8, [rbp - 0x30]
mov qword [rsp + 0x48], rax
mov qword [rbp - 0x68], rdx
call fcn.1400f18f0
lea rcx, [rsp + 0x30]
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
je 0x1400f563b
mov rcx, rbx
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [0x140194018]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SetCursor]
lea rdx, [rbp - 0x30]
lea rcx, [0x140194440]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [rsp + 0x20]
call fcn.1400f547c
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.14010a480
mov rbx, qword [rsp + 0x308]
add rsp, 0x2f0
pop rbp
ret
sub rsp, 0x38
sub edx, 2
je 0x1400f5b01
sub edx, 0x3e7
je 0x1400f5af3
dec edx
je 0x1400f5aea
sub edx, 5
je 0x1400f5adc
dec edx
je 0x1400f5ab5
sub edx, 4
je 0x1400f5aac
dec edx
jne 0x1400f5b09
add rsp, 0x38
jmp 0x1400e50f0
add rsp, 0x38
jmp fcn.1400e4e20
lea r9, [0x1400fe4e8]
mov edx, 0x68
and qword [rsp + 0x20], 0
mov r8, rcx
mov rcx, qword [0x140192f90]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
add rsp, 0x38
ret
lea r9, [0x1400fecd8]
mov edx, 0x67
jmp 0x1400f5ac1
add rsp, 0x38
jmp 0x1400f552c
lea r9, [0x1400fefd4]
mov edx, pe_nt_image_headers64
jmp 0x1400f5ac1
xor edx, edx
call qword [sym.imp.USER32.dll_EndDialog]
add rsp, 0x38
ret

Function at 0x1400f5ff4
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x28
sub edx, 2
je 0x1400f6027
sub edx, 0x3f2
je 0x1400f601e
dec edx
je 0x1400f6015
cmp edx, 0xe
jne 0x1400f602f
mov edx, 1
jmp 0x1400f6029
add rsp, 0x28
jmp 0x1400e50f0
add rsp, 0x28
jmp fcn.1400e4e20
xor edx, edx
call qword [sym.imp.USER32.dll_EndDialog]
add rsp, 0x28
ret
Function at 0x1400f6434
Capabilities:
Get graphical window text

Disassembly:
test r9d, r9d
jne 0x1400f65e1
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x170
mov rax, qword [0x14017da30]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
dec edx
je 0x1400f6486
dec edx
jne 0x1400f65b5
xor edx, edx
call qword [sym.imp.USER32.dll_EndDialog]
jmp 0x1400f65b5
mov edx, 0x3f8
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov rbp, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov r12, 0xffffffffffffffff
lea esi, [rax + 1]
mov eax, 2
movsxd rcx, esi
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.140109e80
mov rdi, rax
test rax, rax
je 0x1400f65b5
mov r8d, esi
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, 0x3fb
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov r14, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebp, [rax + 1]
lea eax, [r12 + 3]
movsxd rcx, ebp
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.140109e80
mov rsi, rax
test rax, rax
jne 0x1400f651d
mov rcx, rdi
jmp 0x1400f65b0
mov r8d, ebp
mov rdx, rax
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.1400e4b70
mov rcx, rbx
test eax, eax
jne 0x1400f659a
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [0x140192f90]
mov r9d, 0x20
lea edx, [r9 + 0x50]
lea r8, [rsp + 0x20]
push rsi
call 0x14040297e
mov rcx, qword [0x140192f90]
mov r9d, pe_nt_image_headers64
lea edx, [r9 + 2]
lea r8, [rsp + 0x60]
call 0x14022f6fb
int3
mov edx, 1
call qword [sym.imp.USER32.dll_EndDialog]
mov rcx, rdi
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, rsi
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14010a480
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x1400f643d
Capabilities:
Get graphical window text

Disassembly:
test r9d, r9d
jne 0x1400f65e1
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x170
mov rax, qword [0x14017da30]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
dec edx
je 0x1400f6486
dec edx
jne 0x1400f65b5
xor edx, edx
call qword [sym.imp.USER32.dll_EndDialog]
jmp 0x1400f65b5
mov edx, 0x3f8
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov rbp, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov r12, 0xffffffffffffffff
lea esi, [rax + 1]
mov eax, 2
movsxd rcx, esi
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.140109e80
mov rdi, rax
test rax, rax
je 0x1400f65b5
mov r8d, esi
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, 0x3fb
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov r14, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebp, [rax + 1]
lea eax, [r12 + 3]
movsxd rcx, ebp
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.140109e80
mov rsi, rax
test rax, rax
jne 0x1400f651d
mov rcx, rdi
jmp 0x1400f65b0
mov r8d, ebp
mov rdx, rax
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.1400e4b70
mov rcx, rbx
test eax, eax
jne 0x1400f659a
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [0x140192f90]
mov r9d, 0x20
lea edx, [r9 + 0x50]
lea r8, [rsp + 0x20]
push rsi
call 0x14040297e
mov rcx, qword [0x140192f90]
mov r9d, pe_nt_image_headers64
lea edx, [r9 + 2]
lea r8, [rsp + 0x60]
call 0x14022f6fb
int3
mov edx, 1
call qword [sym.imp.USER32.dll_EndDialog]
mov rcx, rdi
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, rsi
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14010a480
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x1400f6810
Capabilities:
Get graphical window text
Write file on windows

Disassembly:
test r9d, r9d
jne 0x1400f6a49
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x14017da30]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
xor r12d, r12d
mov rdi, rcx
dec edx
je 0x1400f686a
dec edx
jne 0x1400f6a1f
xor edx, edx
call qword [sym.imp.USER32.dll_EndDialog]
jmp 0x1400f6a1f
mov rcx, qword [0x140194018]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SetCursor]
mov edx, 0x41b
mov rcx, rdi
mov qword [rsp + 0x48], rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov r14, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov rcx, 0xffffffffffffffff
lea esi, [rax + 1]
mov eax, 2
movsxd r15, esi
mul r15
cmovo rax, rcx
mov rcx, rax
call fcn.140109e80
mov rbx, rax
test rax, rax
je 0x1400f6a15
mov r8d, esi
mov rdx, rax
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [rbx], r12w
je 0x1400f69ff
lea r8, str.message.txt
lea rdx, [0x140194230]
lea rcx, [rbp - 0x50]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
mov qword [rsp + 0x30], r12
lea rcx, [rbp - 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400f69ff
lea r9, [rsp + 0x40]
lea rdx, [0x140139d54]
mov r8d, 3
mov rcx, rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rsp + 0x60]
mov r8d, 1
mov rdx, r15
call fcn.1400e2544
lea rax, [rsp + 0x60]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x70]
mov rdx, rbx
mov qword [rsp + 0x58], rax
call fcn.1400f2ddc
mov r8d, dword [rbp - 0x80]
mov rdx, qword [rbp - 0x68]
lea r9, [rsp + 0x40]
mov rcx, rsi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [0x14011e328]
lea rdx, [rbp - 0x50]
lea rcx, [0x140194440]
call fcn.1400f148c
lea rax, [0x1401371f8]
mov qword [rsp + 0x60], rax
lea rax, [0x140137210]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x68]
movsxd rcx, dword [rax + 4]
lea rax, [0x140137238]
mov qword [rsp + rcx + 0x68], rax
mov rax, qword [rsp + 0x68]
movsxd rcx, dword [rax + 4]
lea r8d, [rcx - 0x40]
mov dword [rsp + rcx + 0x64], r8d
mov rcx, qword [rbp - 0x68]
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, rbx
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov edx, 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_EndDialog]
lea rcx, [rsp + 0x48]
call fcn.1400f547c
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.14010a480
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400f6819
Capabilities:
Get graphical window text
Write file on windows

Disassembly:
test r9d, r9d
jne 0x1400f6a49
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x14017da30]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
xor r12d, r12d
mov rdi, rcx
dec edx
je 0x1400f686a
dec edx
jne 0x1400f6a1f
xor edx, edx
call qword [sym.imp.USER32.dll_EndDialog]
jmp 0x1400f6a1f
mov rcx, qword [0x140194018]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SetCursor]
mov edx, 0x41b
mov rcx, rdi
mov qword [rsp + 0x48], rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov r14, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov rcx, 0xffffffffffffffff
lea esi, [rax + 1]
mov eax, 2
movsxd r15, esi
mul r15
cmovo rax, rcx
mov rcx, rax
call fcn.140109e80
mov rbx, rax
test rax, rax
je 0x1400f6a15
mov r8d, esi
mov rdx, rax
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [rbx], r12w
je 0x1400f69ff
lea r8, str.message.txt
lea rdx, [0x140194230]
lea rcx, [rbp - 0x50]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
mov qword [rsp + 0x30], r12
lea rcx, [rbp - 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400f69ff
lea r9, [rsp + 0x40]
lea rdx, [0x140139d54]
mov r8d, 3
mov rcx, rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rsp + 0x60]
mov r8d, 1
mov rdx, r15
call fcn.1400e2544
lea rax, [rsp + 0x60]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x70]
mov rdx, rbx
mov qword [rsp + 0x58], rax
call fcn.1400f2ddc
mov r8d, dword [rbp - 0x80]
mov rdx, qword [rbp - 0x68]
lea r9, [rsp + 0x40]
mov rcx, rsi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [0x14011e328]
lea rdx, [rbp - 0x50]
lea rcx, [0x140194440]
call fcn.1400f148c
lea rax, [0x1401371f8]
mov qword [rsp + 0x60], rax
lea rax, [0x140137210]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x68]
movsxd rcx, dword [rax + 4]
lea rax, [0x140137238]
mov qword [rsp + rcx + 0x68], rax
mov rax, qword [rsp + 0x68]
movsxd rcx, dword [rax + 4]
lea r8d, [rcx - 0x40]
mov dword [rsp + rcx + 0x64], r8d
mov rcx, qword [rbp - 0x68]
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, rbx
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov edx, 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_EndDialog]
lea rcx, [rsp + 0x48]
call fcn.1400f547c
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.14010a480
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400f6c58
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx - 0x40]
cmp rcx, 0xffffffffffffffff
jne 0x1400f6c7c
mov dword [rbx - 0x38], 0x649
or rax, 0xffffffffffffffff
jmp 0x1400f6caa
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [rbx - 0x260]
movsxd rdx, dword [rcx + 4]
lea rcx, [rbx - 0x260]
mov edi, eax
add rcx, rdx
mov rdx, qword [rcx]
call qword [rdx + 0x28]
mov dword [rbx - 0x38], eax
test eax, eax
jne 0x1400f6c76
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400f73d8
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 0x258], 2
mov rbx, rcx
jne 0x1400f744a
cmp qword [rcx + 0x248], 0
jbe 0x1400f7442
mov r8d, dword [rcx + 0x248]
mov rdx, qword [rcx + 0x238]
mov rcx, qword [rcx + 0x228]
and dword [rsp + 0x40], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [rbx + 8]
movsxd rcx, dword [rax + 4]
add rcx, 8
add rcx, rbx
mov rax, qword [rcx]
call qword [rax + 0x28]
mov dword [rbx + 0x230], eax
test eax, eax
je 0x1400f7442
xor al, al
jmp 0x1400f744c
mov rcx, rbx
call fcn.1400f733c
mov al, 1
add rsp, 0x30
pop rbx
ret

Function at 0x1400fd2d4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 8], rbx
mov r10d, dword [rcx]
mov rbx, rcx
mov eax, r8d
mov r9d, r10d
mov r11, rdx
shr r10d, 8
xor r9, rax
movzx eax, r9b
mov r9d, dword [rdx + rax*4]
mov edx, dword [rcx + 8]
xor r9d, r10d
mov dword [rcx], r9d
movzx eax, r9b
add eax, dword [rcx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [rcx + 4], eax
mov ecx, eax
shr ecx, 0x18
xor rcx, rdx
shr edx, 8
movzx eax, cl
mov eax, dword [r11 + rax*4]
xor eax, edx
mov dword [rbx + 8], eax
mov rbx, qword [rsp + 8]
mov eax, r8d
ret
Function at 0x1400fd398
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x14017da30]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, qword [rsp + 0xa0]
mov rbp, r9
mov r13, rdx
mov r15, rcx
cmp r8d, 0xc
jge 0x1400fd3d4
xor eax, eax
jmp 0x1400fd4de
mov eax, dword [0x1401951a8]
inc eax
mov dword [0x1401951a8], eax
cmp eax, 1
jne 0x1400fd3fc
xor ecx, ecx
call qword [sym.imp.MSVCR120.dll__time64]
xor eax, 0xbb40e64e
mov ecx, eax
call qword [sym.imp.MSVCR120.dll_srand]
mov r8, r14
mov rdx, rbp
mov rcx, r15
call fcn.1400fd338
xor esi, esi
mov edi, esi
call qword [sym.imp.MSVCR120.dll_rand]
mov rdx, r14
mov rcx, rbp
sar eax, 7
movzx r8d, al
call fcn.1400fd2b0
mov rdx, r14
mov ebx, eax
call fcn.1400fd2d4
xor r8b, bl
mov byte [rsp + rdi + 0x20], r8b
inc rdi
cmp rdi, 0xa
jl 0x1400fd40e
mov r8, r14
mov rdx, rbp
mov rcx, r15
call fcn.1400fd338
lea rax, [rsp + 0x20]
mov r15, r13
sub r15, rax
mov rdx, r14
mov rcx, rbp
call fcn.1400fd2b0
lea rdi, [rsp + 0x20]
mov rdx, r14
add rdi, rsi
mov ebx, eax
movzx r8d, byte [rdi]
call fcn.1400fd2d4
xor r8b, bl
inc rsi
mov byte [r15 + rdi], r8b
cmp rsi, 0xa
jl 0x1400fd45a
mov rdx, r14
mov rcx, rbp
call fcn.1400fd2b0
mov esi, dword [rsp + 0xa8]
mov rdx, r14
mov ebx, esi
mov edi, eax
shr ebx, 0x10
movzx r8d, bl
call fcn.1400fd2d4
xor bl, dil
mov rdx, r14
mov rcx, rbp
mov byte [r13 + 0xa], bl
call fcn.1400fd2b0
shr esi, 0x18
mov rdx, r14
mov r8d, esi
mov ebx, eax
call fcn.1400fd2d4
xor sil, bl
mov eax, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov byte [r13 + 0xb], sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14010a480
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400fda08
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
cmp dword [rcx + 0x40e8], 0
mov rsi, rcx
je 0x1400fda75
xor ebp, ebp
cmp dword [rcx + 0xbc], ebp
jbe 0x1400fda75
lea r14, [rcx + 0x40ec]
mov r9, qword [rsi + 0x40f8]
mov rcx, r14
mov rdx, r9
call fcn.1400fd2b0
movzx r8d, byte [rbp + rsi + 0xe0]
mov rdx, r9
mov edi, eax
call fcn.1400fd2d4
xor byte [rbp + rsi + 0xe0], dil
inc ebp
cmp ebp, dword [rsi + 0xbc]
jb 0x1400fda3e
mov r9d, dword [rsi + 0xbc]
mov rdx, qword [rsi + 0x40]
mov rcx, qword [rsi + 0x38]
lea r8, [rsi + 0xe0]
call qword [rsi + 0x10]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
xor ecx, ecx
or edx, 0xffffffff
cmp eax, dword [rsi + 0xbc]
cmovne ecx, edx
and dword [rsi + 0xbc], 0
mov rsi, qword [rsp + 0x40]
mov eax, ecx
add rsp, 0x20
pop r14
ret
Function at 0x14010017c
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x14017da30]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rbx
mov rdx, rax
call fcn.1400e3d0c
mov edx, 2
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
mov edx, 0x3fc
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rsp + 0x20]
lea rcx, [0x1401954e0]
call fcn.1400f403c
lea rcx, [0x1401954e0]
mov rdx, rbx
call fcn.1400f4064
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14010a480
add rsp, 0x240
pop rbx
ret
Function at 0x1401017b8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, dword [rcx + 0x44]
mov rbx, rcx
mov edx, dword [rbx + 0x94]
mov esi, dword [rbx + 0x58]
mov ecx, dword [rbx + 0x44]
sub esi, dword [rbx + 0x9c]
add ecx, 0xfffffefa
add ecx, edi
sub esi, edx
cmp edx, ecx
jb 0x14010186b
mov rcx, qword [rbx + 0x50]
mov r8, rdi
lea rdx, [rcx + rdi]
call sub.MSVCR120.dll_memcpy
mov r9d, dword [rbx + 0x74]
mov rax, qword [rbx + 0x68]
sub dword [rbx + 0x98], edi
sub dword [rbx + 0x94], edi
sub dword [rbx + 0x84], edi
lea r8, [rax + r9*2]
xor eax, eax
lea r8, [r8 - 2]
movzx edx, word [r8]
movzx ecx, dx
sub cx, di
cmp edx, edi
cmovae ax, cx
mov word [r8], ax
dec r9d
jne 0x140101820
mov rax, qword [rbx + 0x60]
mov r9d, edi
lea r8, [rax + rdi*2]
xor eax, eax
lea r8, [r8 - 2]
movzx edx, word [r8]
movzx ecx, dx
sub cx, di
cmp edx, edi
cmovae ax, cx
mov word [r8], ax
dec r9d
jne 0x14010184a
add esi, edi
mov rcx, qword [rbx]
cmp dword [rcx + 8], 0
je 0x1401018e5
mov edx, dword [rbx + 0x9c]
mov eax, dword [rbx + 0x94]
mov r8d, esi
add rdx, rax
add rdx, qword [rbx + 0x50]
call fcn.1401024f0
add dword [rbx + 0x9c], eax
mov r9d, dword [rbx + 0x9c]
cmp r9d, 3
jb 0x1401018cf
mov eax, dword [rbx + 0x94]
mov rdx, qword [rbx + 0x50]
mov ecx, dword [rbx + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rbx + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rbx + 0x7c]
mov dword [rbx + 0x70], r8d
cmp r9d, 0x106
jae 0x1401018e5
mov rax, qword [rbx]
cmp dword [rax + 8], 0
jne 0x1401017d2
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret