joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180141c00
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x2b8
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov edx, 8
lea rcx, [rsp + 0x30]
call fcn.1800341e0
mov rax, qword [rsp + 0x2d0]
add rax, 0x158
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180037ed0
nop
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x2d0]
cmp qword [rcx + rax + 0xc8], 0
jne 0x180141c92
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call fcn.180037f00
movzx eax, byte [rsp + 0x20]
jmp 0x180141d3e
mov rax, qword [rsp + 0x2d0]
cmp dword [rax + 0x18], 5
je 0x180141cb9
mov byte [rsp + 0x21], 0
lea rcx, [rsp + 0x30]
call fcn.180037f00
movzx eax, byte [rsp + 0x21]
jmp 0x180141d3e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov rax, qword [rsp + 0x2e0]
mov edx, dword [rax]
lea rcx, [0x180383378]
call fcn.18007db20
lea rcx, [rsp + 0x40]
call fcn.180140ed0
mov eax, dword [rsp + 0x2d8]
mov dword [rsp + 0x4c], eax
mov byte [rsp + 0x40], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x44], eax
mov byte [rsp + 0x48], 0
lea rax, [rsp + 0x50]
mov rdi, rax
mov rsi, qword [rsp + 0x2e0]
mov ecx, 0x250
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x2d0]
call fcn.180142990
mov byte [rsp + 0x22], 1
lea rcx, [rsp + 0x30]
call fcn.180037f00
movzx eax, byte [rsp + 0x22]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x2b8
pop rdi
pop rsi
ret
Function at 0x180142ef0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x3a8
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x390], rax
mov rax, qword [rsp + 0x3c0]
cmp dword [rax + 0x18], 5
je 0x180142f2c
jmp 0x180143167
mov edx, 8
lea rcx, [rsp + 0x68]
call fcn.1800341e0
mov rax, qword [rsp + 0x3c0]
add rax, 0x68
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.180037ed0
nop
mov dword [rsp + 0x20], 0
jmp 0x180142f69
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jae 0x18014315d
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x10
mov rcx, qword [rsp + 0x3c0]
lea rax, [rcx + rax + 0x58]
mov qword [rsp + 0x38], rax
mov edx, 8
lea rcx, [rsp + 0x60]
call fcn.1800341e0
lea rcx, [rsp + 0x60]
call fcn.180039510
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
call fcn.180048450
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
jmp 0x180142fd2
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.180144310
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
call fcn.180043230
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1800431c0
movzx eax, al
test eax, eax
je 0x180143158
lea rcx, [rsp + 0x60]
call fcn.180144380
movzx eax, byte [rax + 4]
test eax, eax
je 0x180143153
lea rcx, [rsp + 0x60]
call fcn.180144380
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x60]
call fcn.180144380
movzx eax, byte [rax + 0xc]
test eax, eax
jne 0x1801430f5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x60]
call fcn.180144380
mov ecx, dword [rsp + 0x2c]
mov r8d, ecx
mov edx, dword [rax + 0x14]
lea rcx, [0x1803833f8]
call fcn.18007db20
lea rcx, [rsp + 0x70]
call fcn.180140e70
mov rax, qword [rsp + 0x3c0]
mov eax, dword [rax + 0xe8]
mov dword [rsp + 0x71], eax
lea rcx, [rsp + 0x60]
call fcn.180144380
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x75], eax
mov byte [rsp + 0x70], 1
cmp dword [rsp + 0x28], 0
jne 0x1801430a3
mov dword [rsp + 0x24], 5
jmp 0x1801430ab
mov dword [rsp + 0x24], 4
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x79], eax
lea rcx, [rsp + 0x60]
call fcn.180144380
lea rcx, [rsp + 0x13f]
mov rdi, rcx
lea rsi, [rax + 0x14]
mov ecx, 0x250
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x3c0]
call fcn.180143a80
lea rcx, [rsp + 0x60]
call fcn.180144380
mov byte [rax + 0xc], 1
jmp 0x180143153
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x60]
call fcn.180144380
mov ecx, dword [rsp + 0x30]
sub ecx, dword [rax + 8]
mov eax, ecx
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0x9c4
jb 0x180143153
lea rcx, [rsp + 0x60]
call fcn.180144380
mov byte [rax + 4], 0
cmp dword [rsp + 0x28], 0
jne 0x180143153
lea rcx, [rsp + 0x60]
call fcn.180144380
add rax, 4
mov rdx, rax
mov rcx, qword [rsp + 0x3c0]
call fcn.180143190
jmp 0x180142fc0
jmp 0x180142f5f
lea rcx, [rsp + 0x68]
call fcn.180037f00
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x3a8
pop rdi
pop rsi
ret
Function at 0x180147200
Capabilities:
Copy file

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rbx, rcx
xor r15d, r15d
lea rcx, [rbp - 0x59]
call fcn.180088a70
nop
mov rdx, rax
lea rcx, [rbp - 0x19]
call fcn.180176910
nop
lea rcx, [rbp - 0x59]
call fcn.1800338a0
lea rcx, [rbp + 7]
call fcn.180176b50
nop
cmp qword [rbp + 0x17], r15
je 0x180147432
cmp qword [rbp - 9], r15
je 0x180147432
mov rax, qword [rbx + 8]
sub rax, qword [rbx]
sar rax, 5
test rax, rax
je 0x180147432
lea rcx, [rbp - 0x19]
call fcn.1801dbe90
test al, al
jne 0x1801472ab
lea rcx, [rbp - 0x19]
call fcn.1801dc660
test al, al
je 0x180147432
mov r14, r15
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
sub rax, rcx
sar rax, 5
test rax, rax
je 0x180147432
mov rdi, r15
mov r12d, 1
nop
lea r8, [rdi + rcx]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.1801480b0
nop
mov r8, qword [rbx]
add r8, rdi
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x39]
call fcn.1801480b0
nop
cmp qword [rbp - 0x49], 0
jbe 0x180147401
cmp qword [rbp - 0x29], 0
jbe 0x180147401
lea rcx, [rbp - 0x59]
call fcn.1801dbd90
test al, al
je 0x180147401
lea rcx, [rbp - 0x39]
call fcn.1801dbd90
test al, al
jne 0x180147401
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rdx, qword [rbp - 0x39]
lea rcx, [rbp - 0x59]
cmp qword [rbp - 0x41], 8
cmovae rcx, qword [rbp - 0x59]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x180147401
xor sil, sil
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x61], 7
mov word [rbp - 0x79], r15w
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x59]
call fcn.1801f0cb0
movzx esi, sil
test al, al
cmovne esi, r12d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r15w
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x39]
call fcn.1801f0cb0
test al, al
jne 0x1801473c3
test sil, sil
je 0x1801473ec
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
lea rcx, [rbp - 0x79]
cmp qword [rbp - 0x61], 8
cmovae rcx, qword [rbp - 0x79]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop
lea rcx, [rsp + 0x30]
call fcn.1800338a0
nop
lea rcx, [rbp - 0x79]
call fcn.1800338a0
nop
lea rcx, [rbp - 0x39]
call fcn.1800338a0
nop
lea rcx, [rbp - 0x59]
call fcn.1800338a0
inc r14
add rdi, 0x20
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
sub rax, rcx
sar rax, 5
cmp r14, rax
jb 0x1801472d0
lea rcx, [rbp + 7]
call fcn.1800338a0
nop
lea rcx, [rbp - 0x19]
call fcn.1800338a0
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1802994c0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x180147470
Capabilities:
Read .ini file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x320], rbx
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov r14, rdx
mov r12, rcx
lea rcx, [rsp + 0x50]
call fcn.180088a70
nop
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.180176910
nop
lea rcx, [rsp + 0x50]
call fcn.1800338a0
cmp qword [rsp + 0xa0], 0
jne 0x1801474e4
xor bl, bl
jmp 0x180147699
lea r8, str.ExtractedSkinsInfo.ini
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x70]
call fcn.18006c550
nop
lea rcx, [rsp + 0x70]
call fcn.1801dbd90
test al, al
je 0x18014768c
mov rcx, r14
call fcn.180148100
xor r13d, r13d
mov rbx, qword [r12]
mov rax, qword [r12 + 8]
sub rax, rbx
sar rax, 5
test rax, rax
je 0x180147681
xor r15d, r15d
nop word [rax + rax]
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0xb0]
call fcn.18029c350
lea rax, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae rax, qword [rsp + 0x70]
lea rdx, [r15 + rbx]
cmp qword [rdx + 0x18], 8
jb 0x180147577
mov rdx, qword [rdx]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0xb0]
lea r8, [0x1803722e0]
lea rcx, str.ChangeTime
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, [rsp + 0xb0]
xor ecx, ecx
movzx eax, word [rsp + 0xb0]
cmp ax, 0x30
jb 0x1801475da
cmp ax, 0x39
ja 0x1801475da
lea rcx, [rcx + rcx*4]
movzx eax, ax
lea rcx, [rcx - 0x18]
lea rcx, [rax + rcx*2]
add rdx, 2
movzx eax, word [rdx]
cmp ax, 0x30
jae 0x1801475b8
mov ebp, ecx
mov rsi, qword [r12]
add rsi, r15
mov rbx, qword [r14]
mov rdi, qword [rbx + 8]
mov rax, rbx
cmp byte [rdi + 0x19], 0
jne 0x180147618
lea rcx, [rdi + 0x20]
mov rdx, rsi
call fcn.180039700
test eax, eax
jns 0x180147609
mov rdi, qword [rdi + 0x10]
jmp 0x18014760f
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x1801475f3
mov rax, qword [r14]
cmp rbx, rax
je 0x18014762d
lea rdx, [rbx + 0x20]
mov rcx, rsi
call fcn.180039700
test eax, eax
jns 0x18014765d
mov qword [rsp + 0x38], rsi
lea r8, [rsp + 0x38]
mov rcx, r14
call fcn.180148250
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.1801482c0
mov rbx, qword [rsp + 0x40]
mov qword [rbx + 0x40], rbp
inc r13
add r15, 0x20
mov rbx, qword [r12]
mov rax, qword [r12 + 8]
sub rax, rbx
sar rax, 5
cmp r13, rax
jb 0x180147540
cmp qword [r14 + 8], 0
jbe 0x18014768c
mov bl, 1
jmp 0x18014768e
xor bl, bl
lea rcx, [rsp + 0x70]
call fcn.1800338a0
nop
lea rcx, [rsp + 0x90]
call fcn.1800338a0
movzx eax, bl
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1802994c0
mov rbx, qword [rsp + 0x320]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180150790
Capabilities:
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov qword [rbp - 0x80], rdx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
cmp byte [rcx + 0xc0], r12b
je 0x18015085b
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x60]
call fcn.18029c350
lea rax, [rsi + 0x78]
cmp qword [rax + 0x18], 8
jb 0x180150804
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rbp - 0x60]
xor r8d, r8d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], r12w
jne 0x180150840
lea rdx, [rbp - 0x60]
mov rcx, rbx
call fcn.180033930
jmp 0x180150974
lea rdi, [rcx + 0xc8]
cmp byte [rdi], r12b
jne 0x180150963
xor eax, eax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x180397e60]
movdqu xmmword [rsp + 0x48], xmm1
mov word [rsp + 0x38], r12w
lea r8d, [rax + 0x18]
lea rdx, str.RCIM_SKIN_RESOURCE_MUTEX
lea rcx, [rsp + 0x38]
call fcn.180033930
nop
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x78]
call fcn.18017f5d0
nop
lea rcx, [rsp + 0x38]
call fcn.1800338a0
mov dword [rsp + 0x34], r12d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x180397e60]
movdqu xmmword [rsp + 0x68], xmm1
mov word [rsp + 0x58], r12w
mov r8d, 0xc
lea rdx, str.2345Skin.ini
lea rcx, [rsp + 0x58]
call fcn.180033930
nop
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.180151190
mov rsi, rax
lea rcx, [rsp + 0x58]
call fcn.1800338a0
test rsi, rsi
jne 0x180150946
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov dword [rsp + 0x30], 1
lea rcx, [rbp - 0x78]
call fcn.18017f740
jmp 0x18015097c
mov r8d, dword [rsp + 0x34]
mov rdx, rsi
mov rcx, rdi
call fcn.18016cc50
test al, al
je 0x180150923
lea rcx, [rbp - 0x78]
call fcn.18017f740
mov r9, r15
mov r8, r14
mov rdx, rbx
mov rcx, rdi
call fcn.18016d180
mov dword [rsp + 0x30], 1
mov rax, rbx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x2c0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180162ef0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rsi, [rcx + 0x10]
movzx ebp, dl
mov rdx, qword [rsi]
mov rdi, rcx
test rdx, rdx
je 0x180162fb5
lea rdx, [rdx*2 + 2]
mov qword [rsp + 0x30], rbx
mov ecx, 0x2042
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x180162fb0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x180162fa7
cmp qword [rdi + 0x18], 8
jb 0x180162f4d
mov rdi, qword [rdi]
mov rdx, qword [rsi]
mov r8, rdi
inc rdx
mov rcx, rax
call fcn.180034ca0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x180162fa7
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rbx
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
test bpl, bpl
je 0x180162fa0
call fcn.180163690
jmp 0x180162fb0
call fcn.180163730
jmp 0x180162fb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180163690
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x138
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x120], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x100
call fcn.18029c350
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test byte [rsp + 0x30], 0x80
jne 0x1801636dd
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x10
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
mov cl, 0x2d
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
mov cl, 0x2d
lea r8d, [r9 + 3]
call qword [sym.imp.USER32.dll_keybd_event]
test byte [rsp + 0x30], 0x80
jne 0x180163717
xor r9d, r9d
xor edx, edx
mov cl, 0x10
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0x138
ret

Function at 0x180163730
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rbp + 0x110], rax
xor edx, edx
lea rcx, [rbp + 0x10]
mov r8d, 0x100
call fcn.18029c350
lea rcx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_GetKeyboardState]
xor ebx, ebx
lea rcx, [rsp + 0x28]
xor edx, edx
mov dword [rsp + 0x20], ebx
mov r8d, 0xe8
call fcn.18029c350
movzx edx, byte [rbp + 0x20]
lea r11d, [rbx + 0x10]
and dl, 0x80
je 0x1801637ac
mov dword [rsp + 0x20], 1
mov word [rsp + 0x28], r11w
mov dword [rsp + 0x2c], 2
movzx eax, dl
mov r10d, 0x11
neg al
mov r8d, 0x56
mov eax, ebx
sbb rcx, rcx
and ecx, 0x28
test dl, dl
setne al
mov dword [rsp + rcx + 0x20], 1
inc eax
mov word [rsp + rcx + 0x28], r10w
mov dword [rsp + rcx + 0x2c], ebx
mov r9d, eax
inc r9d
lea rax, [rax + rax*4]
mov dword [rsp + rax*8 + 0x20], 1
mov word [rsp + rax*8 + 0x28], r8w
mov dword [rsp + rax*8 + 0x2c], ebx
lea rcx, [r9 + r9*4]
inc r9d
mov dword [rsp + rcx*8 + 0x20], 1
mov word [rsp + rcx*8 + 0x28], r8w
mov dword [rsp + rcx*8 + 0x2c], 2
lea rcx, [r9 + r9*4]
inc r9d
mov dword [rsp + rcx*8 + 0x20], 1
mov word [rsp + rcx*8 + 0x28], r10w
mov dword [rsp + rcx*8 + 0x2c], 2
test dl, dl
je 0x180163851
lea rdx, [r9 + r9*4]
inc r9d
mov dword [rsp + rdx*8 + 0x20], 1
mov word [rsp + rdx*8 + 0x28], r11w
mov dword [rsp + rdx*8 + 0x2c], ebx
mov r8d, 0x28
lea rdx, [rsp + 0x20]
mov ecx, r9d
call qword [sym.imp.USER32.dll_SendInput]
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.1802994c0
mov rbx, qword [rsp + 0x230]
add rsp, 0x220
pop rbp
ret
Function at 0x180164be0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov rdi, rcx
mov ebx, edx
mov rcx, qword [r9]
mov r14, r9
mov rbp, r8
test rcx, rcx
je 0x180164c11
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [r14], 0
mov qword [rsp + 0x40], rsi
mov r8, rbp
movzx edx, bx
mov rcx, rdi
mov qword [rsp + 0x48], r15
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x180164ca7
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x180164ca7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x180164ca7
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsxd rdi, eax
mov rcx, rdi
call fcn.1802ad0a0
mov rbx, rax
test rax, rax
je 0x180164ca7
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.18029c510
mov rcx, rbp
call fcn.180165f80
mov r9d, 1
mov r8d, eax
mov edx, edi
mov rcx, rbx
call fcn.180164e80
test rax, rax
mov qword [r14], rax
setne al
jmp 0x180164ca9
xor al, al
mov r15, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x180164cd0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
cmp qword [rcx + 0x10], 0
je 0x180164e08
cmp qword [rcx + 0x18], 8
jb 0x180164d16
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180164e08
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test eax, eax
je 0x180164dff
mov ecx, esi
call fcn.1802ad0a0
mov rbp, rax
test rax, rax
je 0x180164e08
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, esi
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180164df7
cmp dword [rsp + 0x48], esi
jne 0x180164df7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1801dc8b0
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
call fcn.180165f80
mov r9d, 1
mov r8d, eax
mov edx, esi
mov rcx, rbp
call fcn.180164e80
mov rbx, rax
lea rcx, [rsp + 0x50]
call fcn.1800338a0
mov rax, rbx
jmp 0x180164e0a
mov rcx, rbp
call fcn.1802a92bc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1802994c0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1801692d0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xe0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
cmp qword [rsp + 0xf8], 0
jne 0x180169319
xor al, al
jmp 0x1801694ed
mov rdx, qword [rsp + 0xf8]
lea rcx, [rsp + 0x40]
call fcn.180033860
nop
lea rcx, [rsp + 0x40]
call fcn.1801dbd90
movzx eax, al
test eax, eax
jne 0x180169347
mov dword [rsp + 0x24], 1
jmp 0x18016934f
mov dword [rsp + 0x24], 0
movzx eax, byte [rsp + 0x24]
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0x40]
call fcn.180033840
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x180169372
xor al, al
jmp 0x1801694ed
movzx eax, byte [rsp + 0x118]
test eax, eax
je 0x1801693a1
call fcn.1801628e0
mov rdx, qword [rsp + 0xf8]
mov rcx, rax
call fcn.1801629b0
movzx eax, al
test eax, eax
jne 0x1801693a1
xor al, al
jmp 0x1801694ed
movzx eax, byte [rsp + 0x110]
test eax, eax
je 0x1801693be
mov eax, dword [rsp + 0x128]
or eax, 0x40
mov dword [rsp + 0x128], eax
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x70
rep stosb byte [rdi], al
mov dword [rsp + 0x60], 0x70
mov eax, dword [rsp + 0x128]
mov dword [rsp + 0x64], eax
cmp qword [rsp + 0x130], 0
je 0x1801693fc
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x30], rax
jmp 0x180169407
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x88], rax
mov eax, dword [rsp + 0x138]
mov dword [rsp + 0x90], eax
mov qword [rsp + 0xc8], 0
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x180169493
cmp qword [rsp + 0x120], 0
je 0x18016948f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x120]
mov dword [rcx], eax
xor al, al
jmp 0x1801694ed
movzx eax, byte [rsp + 0x110]
test eax, eax
je 0x1801694cb
cmp qword [rsp + 0xc8], 0
je 0x1801694cb
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x98], 0x20
jbe 0x1801694e0
mov dword [rsp + 0x28], 1
jmp 0x1801694e8
mov dword [rsp + 0x28], 0
movzx eax, byte [rsp + 0x28]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1802994c0
add rsp, 0xe0
pop rdi
ret