joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1405a5058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1405a51df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405a5089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405a506f
add dl, dl
jne 0x1405a5096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405a50f6
xor eax, eax
add dl, dl
jne 0x1405a50a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405a51ad
add dl, dl
jne 0x1405a50b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405a50c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405a50d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405a50dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405a50ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405a507e
mov eax, 1
add dl, dl
jne 0x1405a5106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405a5113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405a50fb
sub eax, ebx
mov ebx, 1
jne 0x1405a514c
mov ecx, 1
add dl, dl
jne 0x1405a512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405a513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405a5123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405a507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405a5168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405a5175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405a515d
cmp eax, 0x7d00
jae 0x1405a519b
cmp eax, 0x500
jb 0x1405a5196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405a507e
cmp eax, 0x7f
ja 0x1405a519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405a507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405a51d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405a507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180003920
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword gs:[0x60]
mov rbp, rdx
mov r14, rcx
mov rsi, qword [rax + 0x18]
add rsi, 0x10
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1800039c6
movzx ebx, word [rdi + 0x58]
xor eax, eax
shr rbx, 1
je 0x1800039b5
mov r10, qword [rdi + 0x60]
nop dword [rax]
nop dword [rax + rax]
movzx edx, word [r10]
movsx r11d, byte [rax + rbp]
movzx r9d, r11w
lea ecx, [rdx - 0x61]
cmp cx, 0x19
lea r8d, [rdx - 0x20]
lea ecx, [r9 - 0x61]
cmova r8w, dx
cmp cx, 0x19
lea edx, [r9 - 0x20]
cmova dx, r11w
cmp r8w, dx
jne 0x1800039be
test r11b, r11b
je 0x1800039be
inc rax
add r10, 2
cmp rax, rbx
jb 0x180003970
mov rax, qword [rdi + 0x30]
mov qword [r14], rax
jmp 0x1800039cd
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x180003955
mov qword [r14], 0
mov rbx, qword [rsp + 0x10]
mov rax, r14
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret

Function at 0x1800077a0
Capabilities:
Parse pe header

Disassembly:
push rbx
push r13
sub rsp, 0x18
mov r11, qword [rcx]
xor r9d, r9d
mov r13, r8
mov rbx, rdx
test r11, r11
je 0x1800078d9
mov qword [rsp + 0x30], rbp
mov eax, 0x5a4d
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x10], r12
mov qword [rsp + 8], r14
mov qword [rsp], r15
cmp word [r11], ax
jne 0x1800078ae
movsxd rax, dword [r11 + 0x3c]
add rax, r11
cmp dword [rax], 0x4550
cmovne rax, r9
test rax, rax
je 0x1800078ae
add rax, 0x18
mov ecx, 0x20b
cmp word [rax], cx
jne 0x1800078ae
test rax, rax
je 0x1800078ae
cmp dword [rax + 0x6c], r9d
jbe 0x1800078ae
lea r14, [rax + 0x70]
test r14, r14
je 0x1800078ae
mov r15d, dword [r14]
mov r10d, r9d
mov edi, dword [r11 + r15 + 0x18]
lea rsi, [r11 + r15]
test edi, edi
je 0x1800078ae
mov r12d, dword [rsi + 0x20]
nop dword [rax]
mov ebp, r10d
mov r8, r13
lea rax, [r12 + rbp*4]
mov eax, dword [rax + r11]
add rax, r11
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180007877
inc rax
test ecx, ecx
jne 0x180007864
test edx, edx
je 0x180007885
inc r10d
cmp r10d, edi
jb 0x180007850
jmp 0x1800078ae
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + rbp*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov r8d, dword [rcx + rdx*4]
cmp r8d, r15d
jb 0x1800078aa
mov eax, r8d
sub eax, r15d
cmp eax, dword [r14 + 4]
jb 0x1800078ae
lea r9, [r11 + r8]
mov qword [rbx], r9
mov rax, rbx
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r12, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
add rsp, 0x18
pop r13
pop rbx
ret
mov qword [rdx], r9
mov rax, rbx
add rsp, 0x18
pop r13
pop rbx
ret
Function at 0x180007cf0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r10, qword [rcx]
xor r8d, r8d
test r10, r10
je 0x180007d85
mov eax, 0x5a4d
cmp word [r10], ax
jne 0x180007d62
movsxd rcx, dword [r10 + 0x3c]
add rcx, r10
cmp dword [rcx], 0x4550
cmovne rcx, r8
test rcx, rcx
je 0x180007d62
movzx eax, word [rcx + 0x14]
add rax, 0x18
add rax, rcx
movzx ecx, word [rcx + 6]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8]
cmp rax, r9
je 0x180007d62
nop dword [rax]
test dword [rax + 0x24], 0x40000000
je 0x180007d59
cmp dword [rax], 0x6164722e
jne 0x180007d59
cmp word [rax + 4], 0x6174
je 0x180007d79
add rax, 0x28
cmp rax, r9
jne 0x180007d40
mov qword [rdx + 8], r8
mov rcx, r8
mov eax, 8
mov qword [rdx], rcx
mov qword [rax + rdx], r8
mov rax, rdx
ret
mov ecx, dword [rax + 0xc]
mov r8d, dword [rax + 8]
add rcx, r10
jmp 0x180007d69
mov qword [rdx], r8
mov rax, rdx
mov qword [rdx + 8], r8
ret
Function at 0x18000bea0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
xor ebx, ebx
cmp edx, 1
jne 0x18000bfe6
cmp qword [0x180013028], rbx
jne 0x18000bfe6
lea rax, [0x180013468]
mov qword [0x180013468], 0xf4240
mov qword [0x180013030], rax
lea rdx, str.SDL3.dll
lea rax, [0x180013030]
mov qword [0x180013470], rbx
lea rcx, [rsp + 0x68]
mov qword [0x180013028], rax
mov byte [0x180013460], bl
call fcn.180003920
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x18000bf7a
mov edx, 0x5a4d
mov rcx, rax
cmp word [rax], dx
cmovne rcx, rbx
test rcx, rcx
je 0x18000bf7a
movsxd r8, dword [rcx + 0x3c]
add r8, rax
cmp dword [r8], 0x4550
cmovne r8, rbx
test r8, r8
je 0x18000bf7a
movzx edx, word [r8 + 0x14]
movzx ecx, word [r8 + 6]
add rdx, 0x18
add rdx, r8
lea rcx, [rcx + rcx*4]
lea r8, [rdx + rcx*8]
cmp rdx, r8
je 0x18000bf7a
test dword [rdx + 0x24], 0x20000000
je 0x18000bf71
cmp dword [rdx], 0x7865742e
jne 0x18000bf71
cmp byte [rdx + 4], 0x74
je 0x18000c007
add rdx, 0x28
cmp rdx, r8
jne 0x18000bf56
mov rcx, rbx
mov rax, rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x28], rcx
lea rcx, [0x180013038]
mov qword [rsp + 0x20], rax
call fcn.180005ae0
lea r9, [rsp + 0x20]
mov byte [0x180013460], 0xff
lea r8, [rsp + 0x68]
xor edx, edx
lea rcx, [0x180013038]
call fcn.180001010
mov rcx, qword [0x180013038]
mov byte [0x180013460], 1
test rcx, rcx
je 0x18000bfe6
mov rax, qword [rcx]
mov qword [0x180013040], rax
lea rax, [0x18000d0c3]
mov qword [rcx], rax
lea rdx, [0x18000c304]
lea rcx, section..text
mov rax, rdx
sub rax, rcx
cmp rdx, rcx
cmovb rax, rbx
add rsp, 0x40
pop rbx
ret
mov ecx, dword [rdx + 0xc]
add rcx, rax
mov eax, dword [rdx + 8]
jmp 0x18000bf80
Function at 0x140001020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140001053
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140001097
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x140001092
cmp rbx, r11
jae 0x140001097
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140001080
cmp rbx, r11
jb 0x14000109b
xor eax, eax
jmp 0x1400010a7
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140001560
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rdi, rcx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
nop
xor ebx, ebx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x14004a9c0]
xor edx, edx
lea r8d, [rbx + 1]
lea rcx, [0x14004a9e0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x1400015c5
mov dword [rsp + 0x68], eax
lea rdx, [0x14005dbd0]
lea rcx, [rsp + 0x68]
call fcn.14002f6a0
nop
cmp qword [rdi + 0x20], 8
jb 0x1400015d2
mov rdx, qword [rdi + 8]
jmp 0x1400015d6
lea rdx, [rdi + 8]
lea rcx, [rsp + 0x40]
call fcn.140001680
mov r8, rax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x30]
call fcn.1400027f0
nop
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x14000163d
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
mov rdx, qword [rdi + 0x30]
call qword [rax + 0x38]
test eax, eax
jns 0x14000162a
mov dword [rsp + 0x70], eax
lea rdx, [0x14005dbd0]
lea rcx, [rsp + 0x70]
call fcn.14002f6a0
int3
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x14000163d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rdi + 0x20], rbx
xchg qword [rsp + 0x78], rbx
test rbx, rbx
je 0x140001651
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001662
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x140002490
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1400610b0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea r8, [rsp + 0x24]
lea rdx, [rsp + 0x30]
mov ecx, 2
mov dword [rsp + 0x24], 0x101
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x1400024ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x14005dc28]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
call fcn.14002f6a0
int3
mov rcx, qword [rbx + 0x20]
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0xf0]
test eax, eax
jns 0x140002519
lea rdx, [0x14005dbd0]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
call fcn.14002f6a0
int3
mov byte [rbx + 0x38], 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14002c2c0
add rsp, 0x250
pop rbx
ret
Function at 0x14000d7f0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push r13
sub rsp, 0x40
mov rsi, r8
mov r13, rdx
mov rdi, rcx
test r8, r8
jne 0x14000d822
xor eax, eax
mov dword [rcx], 1
mov dword [rcx + 0x10], eax
mov qword [rcx + 8], rax
mov rax, rcx
add rsp, 0x40
pop r13
pop rdi
pop rsi
ret
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x70], r12
lea r8d, [rdx + 2]
call fcn.14002d9c8
mov rcx, rsi
call fcn.14002d4bc
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov r12, rax
call fcn.14002d9c8
test r12, r12
jns 0x14000d87a
mov rcx, rsi
call fcn.14002e308
mov r12, qword [rsp + 0x70]
xor eax, eax
mov dword [rdi + 0x10], eax
mov qword [rdi + 8], rax
mov dword [rdi], 2
mov rax, rdi
add rsp, 0x40
pop r13
pop rdi
pop rsi
ret
mov ecx, 1
test r12, r12
mov qword [rsp + 0x68], rbp
cmovne rcx, r12
call qword [0x140062c08]
mov rbp, rax
test rax, rax
jne 0x14000d8b2
mov rcx, rsi
call fcn.14002e308
xor eax, eax
mov dword [rdi], 3
mov dword [rdi + 0x10], eax
mov qword [rdi + 8], rax
jmp 0x14000d922
mov r9, rsi
mov r8, r12
mov edx, 1
mov rcx, rax
mov qword [rsp + 0x60], rbx
call fcn.14002dee4
mov rcx, rsi
mov rbx, rax
call fcn.14002e308
cmp rbx, r12
mov rbx, qword [rsp + 0x60]
je 0x14000d8f9
mov rcx, rbp
call qword [0x140062c10]
xor eax, eax
mov dword [rdi], 2
mov dword [rdi + 0x10], eax
mov qword [rdi + 8], rax
jmp 0x14000d922
mov byte [rsp + 0x38], 1
xor eax, eax
mov byte [rsp + 0x30], 1
mov dword [rsp + 0x28], eax
mov r9, r12
mov r8, rbp
mov rdx, rdi
mov rcx, r13
mov dword [rsp + 0x20], 1
call fcn.14000da70
mov rbp, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov rax, rdi
add rsp, 0x40
pop r13
pop rdi
pop rsi
ret

Function at 0x140015340
Capabilities:
Encode data using xor

Disassembly:
mov r10, rdx
xor r8d, r8d
mov rdx, rcx
movzx eax, word [r10]
mov r9, r10
test ax, ax
je 0x140015378
movzx eax, ax
add r9, 2
add r8d, eax
imul r8d, r8d, 0x401
mov eax, r8d
shr eax, 6
xor r8d, eax
mov ax, word [r9]
test ax, ax
jne 0x140015355
lea eax, [r8 + r8*8]
mov ecx, eax
shr rax, 0xb
xor rax, rcx
and eax, 0x3f
mov rdx, qword [rdx + rax*8]
test rdx, rdx
je 0x1400153e5
mov ecx, dword [rdx]
sub ecx, 1
je 0x1400153b7
sub ecx, 1
je 0x1400153b1
sub ecx, 1
je 0x1400153b1
cmp ecx, 1
je 0x1400153ab
xor eax, eax
jmp 0x1400153bb
lea rax, [rdx + 0x12]
jmp 0x1400153bb
lea rax, [rdx + 0x18]
jmp 0x1400153bb
lea rax, [rdx + 0x38]
mov r9, r10
sub r9, rax
movzx r8d, word [rax]
movzx ecx, word [rax + r9]
sub r8d, ecx
jne 0x1400153d7
add rax, 2
test ecx, ecx
jne 0x1400153c1
test r8d, r8d
je 0x1400153e8
mov rdx, qword [rdx + 8]
test rdx, rdx
jne 0x140015391
xor eax, eax
ret
mov rax, rdx
ret
Function at 0x14001c740
Capabilities:
Get geographical location

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x2f0
mov rax, qword [0x1400610b0]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov eax, r8d
mov rsi, rdx
mov rbx, rcx
cmp r8d, 0x800
jne 0x14001c7b2
lea r8, [0x14004ae50]
lea rcx, [rsp + 0xa0]
mov edx, 4
call fcn.14002ef54
test eax, eax
je 0x14001c7d4
cmp eax, 0xc
je 0x14001c7ac
cmp eax, 0x16
je 0x14001c7a6
cmp eax, 0x22
je 0x14001c7a6
cmp eax, 0x50
je 0x14001c7d4
call fcn.14001d4e8
int3
call fcn.14001d4e8
int3
call fcn.14001d4a0
int3
mov r9d, 4
lea r8, [rsp + 0xa0]
mov ecx, eax
lea edx, [r9 - 1]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14001c8f7
call fcn.14002f4a0
mov edi, dword [rax]
call fcn.14002f4a0
lea rcx, [rsp + 0xb0]
and dword [rax], 0
lea rax, [rsp + 0xa0]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov esi, 0x112
lea r8d, [rsi - 1]
mov rdx, rsi
call fcn.14002f434
mov ebx, eax
call fcn.14002f4a0
cmp dword [rax], 0
je 0x14001c85c
call fcn.14002f4a0
cmp dword [rax], 0
je 0x14001c863
cmp dword [rax], 0xc
je 0x14001c851
cmp dword [rax], 0x16
je 0x14001c846
cmp dword [rax], 0x22
je 0x14001c846
cmp dword [rax], 0x50
je 0x14001c863
mov ecx, 0x80004005
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x8007000e
call fcn.140001000
int3
call fcn.14002f4a0
mov dword [rax], edi
cmp ebx, 0xffffffff
je 0x14001c8f7
cmp ebx, esi
jae 0x14001c8f7
lea rcx, [rsp + 0xb0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
xor edx, edx
lea rcx, [rsp + 0x34]
lea r8d, [rdx + 0x6c]
mov rbx, rax
mov dword [rsp + 0x30], 0x70
call fcn.14002f540
lea rcx, str.KERNEL32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001c8e2
lea rdx, str.FindActCtxSectionStringW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001c8e2
lea rcx, [rsp + 0x30]
xor edx, edx
mov r9, rbx
mov qword [rsp + 0x20], rcx
lea r8d, [rdx + 2]
xor ecx, ecx
call rax
mov rcx, rbx
test eax, eax
jne 0x14001c8ea
lea rcx, [rsp + 0xb0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x14001c8f9
xor eax, eax
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.14002c2c0
add rsp, 0x2f0
pop rdi
pop rsi
pop rbx
ret

Function at 0x140023998
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.140021410
mov rsi, rax
test rax, rax
je 0x140023a14
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x140023a0f
cmp dword [rbx], 0x40
jb 0x140023a0f
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x140023a0f
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x140023a18
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14002c9cc
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14002ca55
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x14002ca17
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x14002ca65
mov ecx, 0x20b
cmp word [rax + 0x18], cx
je 0x14002ca2d
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x14002ca65
cmp dword [rax + 0x84], 0xe
ja 0x14002ca41
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x14002ca65
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xb0], ebx
jmp 0x14002ca65
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
lea rdi, [0x140000000]
mov ecx, 1
call fcn.1400311d0
test eax, eax
jne 0x14002ca95
cmp dword [0x140066bd8], 1
jne 0x14002ca81
call fcn.14003167c
mov ecx, 0x1c
call fcn.140031454
mov ecx, 0xff
call fcn.14002ebd8
call fcn.140030e94
test eax, eax
jne 0x14002cac0
cmp dword [0x140066bd8], 1
jne 0x14002caac
call fcn.14003167c
mov ecx, 0x10
call fcn.140031454
mov ecx, 0xff
call fcn.14002ebd8
call fcn.1400321a8
nop
call fcn.140031eb8
test eax, eax
jns 0x14002cad9
mov ecx, 0x1b
call fcn.14002eb6c
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x140069448], rax
call fcn.140031d04
mov qword [0x140066bc8], rax
call fcn.140031c0c
test eax, eax
jns 0x14002cb05
mov ecx, 8
call fcn.14002eb6c
call fcn.14003190c
test eax, eax
jns 0x14002cb18
mov ecx, 9
call fcn.14002eb6c
mov ecx, 1
call fcn.14002ec78
test eax, eax
je 0x14002cb2d
mov ecx, eax
call fcn.14002eb6c
call fcn.140031890
test byte [rsp + 0x6c], 1
movzx edx, word [rsp + 0x70]
mov r9d, 0xa
cmovne r9d, edx
mov r8, rax
xor edx, edx
mov rcx, rdi
call fcn.140002b60
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x14002cb64
mov ecx, eax
call fcn.14002eeb4
call fcn.14002eecc
jmp 0x14002cb85
mov eax, edi
jmp 0x14002cb8e
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.140032218
add rsp, 0x28
jmp 0x14002c9cc

Function at 0x14002eec0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14002ed28
Function at 0x14002fd5f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400610b0]
jne 0x14002c2da
rol rcx, 0x10
test cx, 0xffff
jne 0x14002c2d6
repz ret
ror rcx, 0x10
jmp 0x14002fcb8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140066ce0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140066dd8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14002fd3d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140066ce0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14002fd5f
mov rax, qword [rsp + 0x88]
mov qword [0x140066dd8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140066d78], rax
mov rax, qword [0x140066dd8]
mov qword [0x140066c50], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140066d60], rax
mov dword [0x140066c40], 0xc0000409
mov dword [0x140066c44], 1
mov rax, qword [0x1400610b0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400610b8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140066cd8], eax
mov ecx, 1
call fcn.1400322cc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14004e368]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140066cd8], 0
jne 0x14002fde6
mov ecx, 1
call fcn.1400322cc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14003a6d8
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140030bc4
xor ebx, ebx
mov rdi, rax
cmp qword [0x140067a58], rbx
jne 0x14003a7de
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14003a8b3
lea rdx, [0x14004f570]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003a8b3
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x14004f560]
mov rcx, rsi
mov qword [0x140067a58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x14004f548]
mov rcx, rsi
mov qword [0x140067a60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140067a68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140067a78], rax
test rax, rax
je 0x14003a7d5
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140067a70], rax
jmp 0x14003a7e5
mov rax, qword [0x140067a70]
jmp 0x14003a7ec
mov rax, qword [0x140067a70]
mov r11, qword [0x140067a78]
cmp rax, rdi
je 0x14003a854
cmp r11, rdi
je 0x14003a854
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140067a78]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14003a854
test rax, rax
je 0x14003a854
call rsi
test rax, rax
je 0x14003a84e
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14003a84e
test byte [rsp + 0x38], 1
jne 0x14003a854
bts ebp, 0x15
jmp 0x14003a892
mov rcx, qword [0x140067a60]
cmp rcx, rdi
je 0x14003a892
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14003a892
call rax
mov rbx, rax
test rax, rax
je 0x14003a892
mov rcx, qword [0x140067a68]
cmp rcx, rdi
je 0x14003a892
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14003a892
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140067a58]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14003a8b3
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14003a8b5
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x140041c2c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x20], 8
mov rdi, r8
jb 0x140041c46
mov rdx, qword [rdx + 8]
jmp 0x140041c4a
add rdx, 8
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r9
mov r9, r8
xor ebx, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x140041c6c
mov dword [rdi], ebx
cmp eax, ebx
mov rbx, qword [rsp + 0x40]
sete al
add rsp, 0x30
pop rdi
ret