joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003a668
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x10003e888], rdi
je 0x10003a6c8
cmp rax, rdi
jne 0x10003a6bb
mov r12d, 1
jmp 0x10003a6c8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10003a6a1
mov eax, dword [0x10003e880]
cmp eax, 1
jne 0x10003a6dd
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x10003a744
mov eax, dword [0x10003e880]
cmp eax, ebx
jne 0x10003a73a
mov dword [0x10003e880], 1
lea r13, [0x100001540]
lea rdi, [0x100001528]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x10003a72c
cmp eax, ebx
jne 0x10003a72c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x10003a721
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x10003a70a
cmp eax, ebx
je 0x10003a744
mov eax, 0xff
jmp 0x10003a88c
mov dword [0x10003db84], 1
mov eax, dword [0x10003e880]
cmp eax, 1
jne 0x10003a76c
lea rdx, [0x100001520]
lea rcx, [0x1000014b0]
call sub.msvcrt.dll__initterm
mov dword [0x10003e880], 2
cmp r12d, ebx
jne 0x10003a77b
mov rax, rbx
xchg qword [0x10003e888], rax
cmp qword [0x10003e890], rbx
je 0x10003a7a3
lea rcx, [0x10003e890]
call fcn.10003ab1c
cmp eax, ebx
je 0x10003a7a3
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x10003e890]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x10003a7b9
mov eax, 0xff
jmp 0x10003a88c
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x10003a83e
cmp word [rcx], bx
je 0x10003a7d4
cmp edx, ebx
jne 0x10003a83e
cmp word [rcx], bx
je 0x10003a7ea
cmp word [rcx], 0x20
ja 0x10003a7ea
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x10003a7d4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.10002ef70
mov dword [0x10003db80], eax
cmp dword [0x10003db64], ebx
jne 0x10003a828
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x10003db84], ebx
jne 0x10003a83c
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x10003db80]
jmp 0x10003a88c
cmp word [rcx], 0x22
jne 0x10003a851
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x10003a7c5
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.10003acd0
add rsp, 0x28
jmp 0x10003a668
Function at 0x10003a9b0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x10003d110]
jne 0x10003a9cb
rol rcx, 0x10
test cx, 0xffff
jne 0x10003a9c7
ret 0
ror rcx, 0x10
jmp 0x10003ad8c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x10003dc40]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x10003dd38]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10003ae11
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x10003dc40]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x10003ae33
mov rax, qword [rsp + 0x88]
mov qword [0x10003dd38], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x10003dcd8], rax
mov rax, qword [0x10003dd38]
mov qword [0x10003dbb0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x10003dcc0], rax
mov dword [0x10003dba0], 0xc0000409
mov dword [0x10003dba4], 1
mov rax, qword [0x10003d110]
mov qword [rsp + 0x68], rax
mov rax, qword [0x10003d118]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100001570]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x10003ac28
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x10003ac75
cmp rcx, 0xffffffffffffffff
je 0x10003ac75
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10003ac6d
cmp dword [rcx + 0x3c], edx
jl 0x10003ac6d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10003ac6d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x10003ac75
mov rax, rdx
add rsp, 0x18
ret
Function at 0x141742058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1417421df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141742089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14174206f
add dl, dl
jne 0x141742096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1417420f6
xor eax, eax
add dl, dl
jne 0x1417420a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1417421ad
add dl, dl
jne 0x1417420b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1417420c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1417420d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1417420dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1417420ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14174207e
mov eax, 1
add dl, dl
jne 0x141742106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141742113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1417420fb
sub eax, ebx
mov ebx, 1
jne 0x14174214c
mov ecx, 1
add dl, dl
jne 0x14174212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14174213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141742123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14174207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141742168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141742175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14174215d
cmp eax, 0x7d00
jae 0x14174219b
cmp eax, 0x500
jb 0x141742196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14174207e
cmp eax, 0x7f
ja 0x14174219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14174207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1417421d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14174207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x140013800
Capabilities:
Listen for remote procedure calls

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0xc]
mov ecx, dword [rcx + 8]
mov r8d, 1
call qword [sym.imp.RPCRT4.dll_RpcServerListen]
mov ebx, eax
cmp eax, 0x6b1
je 0x140013871
test eax, eax
je 0x140013871
lea rcx, str...SwRpcServer.cpp
mov edx, 0x5c
call qword [sym.imp.MSVCR120.dll_strrchr]
test rax, rax
je 0x140013841
inc rax
jmp 0x140013848
lea rax, str...SwRpcServer.cpp
lea rcx, [0x140042858]
mov rdx, rax
call fcn.140001760
movabs rcx, 0x212500000000
shl rax, 0x34
or rax, rbx
or rax, rcx
add rsp, 0x20
pop rbx
ret
movabs rax, 0x8000000000
add rsp, 0x20
pop rbx
ret
Function at 0x14009ec60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.rr__f__4_WTTh_fT__3_X___tWh7_Xhg1XhnJ_Tx0_1a:_3g_1.virtual_720
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
cmp rdx, 0x10000
jae 0x140124793
cmp dword [rcx + 0xe8], 0
jne 0x140124793
movzx eax, dx
mov dword [rcx + 0xe8], eax
call fcn.14013a844
mov r8d, 5
mov rdx, rdi
mov rsi, qword [rax + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1401247d7
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1401247d7
mov r9, rsi
mov r8, rbp
mov rdx, rax
mov rcx, rbx
call fcn.140124b0c
jmp 0x1401247d9
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140124754
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.rr__f__4_WTTh_fT__3_X___tWh7_Xhg1XhnJ_Tx0_1a:_3g_1.virtual_720
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
cmp rdx, 0x10000
jae 0x140124793
cmp dword [rcx + 0xe8], 0
jne 0x140124793
movzx eax, dx
mov dword [rcx + 0xe8], eax
call fcn.14013a844
mov r8d, 5
mov rdx, rdi
mov rsi, qword [rax + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1401247d7
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1401247d7
mov r9, rsi
mov r8, rbp
mov rdx, rax
mov rcx, rbx
call fcn.140124b0c
jmp 0x1401247d9
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1401247f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rbx, rdx
mov rbp, rcx
call fcn.14013a844
mov r8d, 5
mov rdx, rbx
mov rdi, qword [rax + 0x18]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14012485a
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14012485a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r9, rdi
mov r8, rsi
mov rdx, rax
mov rcx, rbp
call fcn.140124874
jmp 0x14012485c
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14012c240
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x78
test rdx, rdx
je 0x14012c2a8
mov r10, qword [rcx + 0x10]
test r10, r10
je 0x14012c292
cmp qword [rcx + 0x18], 0
jne 0x14012c28d
mov eax, dword [rcx + 0xc]
cmp eax, dword [rcx + 0x30]
jae 0x14012c2ae
mov qword [rsp + 0x58], rdx
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0x50
mov edx, eax
mov dword [rsp + 0x24], 0x40
mov r8d, 1
mov rcx, qword [r10 + 8]
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
add rsp, 0x78
ret
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x14012c2a8
mov rcx, qword [rcx + 0x40]
add rsp, 0x78
jmp fcn.14013ffe8
call fcn.1401110a4
int3
call fcn.1401110a4
int3
Function at 0x140131ae0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140131b99
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x140131b99
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140131b99
test rdi, rdi
je 0x140131b99
xor r14d, r14d
xor esi, esi
call fcn.14013a844
lea r8, [0x1402f56a0]
mov rdx, rdi
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x140131b79
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rdi
mov rcx, rbp
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140131b99
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
mov r8d, r14d
mov rdx, rsi
mov rcx, rbx
call fcn.1401e9818
mov edi, eax
test eax, eax
je 0x140131b95
mov rcx, rbx
call fcn.1401317a8
mov eax, edi
jmp 0x140131b9b
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140132b10
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x40]
call fcn.14014034c
mov rdi, rax
test rax, rax
je 0x140132b8c
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x140132b87
cmp dword [rbx], 0x40
jb 0x140132b87
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
or dword [rbx + 4], 1
xor r8d, r8d
or qword [rbx + 0x30], 0xffffffffffffffff
mov edx, 0x87
mov qword [rbx + 8], rcx
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x140132b87
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x140132b90
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14015e044
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1403a73d0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
test ax, ax
js 0x14015e11b
mov rdi, qword [rsi + 0x248]
test rdi, rdi
jne 0x14015e0b1
mov rcx, qword [rsi + 0x130]
call fcn.140130d90
mov rdx, rax
lea rcx, vtable.UT__W__3.0
call fcn.14014d018
mov rdi, rax
test rax, rax
je 0x14015e114
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x28], rbx
call qword [sym.imp.USER32.dll_GetCursorPos]
xorps xmm0, xmm0
lea rcx, [rbp - 0x18]
movups xmmword [rbp - 0x18], xmm0
call qword [sym.imp.USER32.dll_SetRectEmpty]
mov r8, qword [rbp - 0x28]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x18]
lea rax, [rbp - 0x30]
mov dword [rbp - 0x30], ebx
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov qword [rbp - 0x20], rbx
call fcn.14016a210
lea rcx, [rbp - 0x18]
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x14015e114
cmp dword [rbp - 0x30], ebx
setne bl
mov eax, ebx
jmp 0x14015e11d
mov eax, 1
jmp 0x14015e11d
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14010f500
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1401e864c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, [rsp + 0x34]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x30], eax
cmp eax, 0xffffffff
jne 0x1401e8677
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1401e8682
mov rax, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 0x18]
call fcn.140026de0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, rbx
call fcn.1401eedb0
int3

Function at 0x1401e89ac
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test r8d, r8d
jne 0x1401e89be
xor eax, eax
jmp 0x1401e89db
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x50]
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401e89e1
mov eax, dword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret
lea rcx, [rbx + 0x18]
call fcn.140026de0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, rbx
call fcn.1401eedb0
int3

Function at 0x1401e8b34
Capabilities:
Write file on windows

Disassembly:
test r8d, r8d
je 0x1401e8b72
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov rdi, rcx
mov ebx, r8d
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1401e8b73
cmp dword [rsp + 0x50], ebx
jne 0x1401e8b90
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea rcx, [rdi + 0x18]
call fcn.140026de0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, rbx
call fcn.1401eedb0
int3
lea rcx, [rdi + 0x18]
call fcn.140026de0
or edx, 0xffffffff
mov r8, rax
lea ecx, [rdx + 0xe]
call fcn.1401ee904
int3

Function at 0x1401ebc48
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [rdx + 4], 1
mov esi, r8d
mov rbx, qword [rdx + 0x10]
mov rdi, rdx
mov rbp, rcx
jne 0x1401ebcbf
mov rcx, qword [rdi + 8]
mov r8d, 5
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x1401ebc8f
call fcn.140128b98
mov rcx, qword [rdi + 8]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
jne 0x1401ebca9
call fcn.140128b98
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x1401ebcbf
call fcn.140128b98
call fcn.14013a844
cmp qword [rax + 0x68], 0
je 0x1401ebcd9
mov rdx, rbx
mov rcx, rbp
call fcn.1401eb108
mov rbx, rax
mov edx, esi
mov rcx, rbx
call fcn.1401ebf38
mov rcx, qword [rbp + 0xf8]
mov rsi, rax
test rcx, rcx
je 0x1401ebd00
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rbp + 0xf8], 0
test rsi, rsi
je 0x1401ebd0f
mov rbx, rsi
mov qword [rbp + 0xf8], rsi
or dword [rdi + 4], 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rdi + 0x10], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401ed500
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
call fcn.1401ed640
xor r14d, r14d
mov esi, 1
mov rbp, rax
mov dword [rbx + 0x14], esi
mov rcx, rax
cmp dword [rbx], r14d
je 0x1401ed5b5
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
movsxd rbx, eax
test eax, eax
js 0x1401ed5d8
mov rcx, qword [rdi]
mov edx, dword [rcx - 0xc]
sub esi, dword [rcx - 8]
sub edx, ebx
or esi, edx
jge 0x1401ed564
mov edx, ebx
mov rcx, rdi
call fcn.1400939d0
mov rdx, qword [rdi]
cmp ebx, dword [rdx - 0xc]
jg 0x1401ed5d8
mov dword [rdx - 0x10], ebx
lea r8d, [rbx + 1]
mov rax, qword [rdi]
mov rcx, rbp
mov word [rax + rbx*2], r14w
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rdi]
test rcx, rcx
jne 0x1401ed591
mov eax, r14d
jmp 0x1401ed59e
movsxd rdx, dword [rcx - 0xc]
call fcn.1402b2570
test eax, eax
js 0x1401ed5d8
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x1401ed5d8
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rdi]
mov word [rax + rcx*2], r14w
jmp 0x1401ed5bd
mov rdx, qword [rdi]
call fcn.14013ffe8
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov ecx, 0x80070057
call fcn.14008b390
int3

Function at 0x1401ed694
Capabilities:
Get graphical window text

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0xd0
mov rax, qword [0x1403a73d0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbp, r8
lea r15, [r11 + 0x28]
mov rdi, rcx
call fcn.1401ed640
cmp dword [rdi], 0
mov rsi, rax
mov dword [rdi + 0x14], 1
je 0x1401ed729
mov rbx, qword [r15]
lea rdx, [rsp + 0x40]
mov r8d, 0x40
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r9, rbx
lea rcx, [rsp + 0x40]
mov r8, rbp
mov edx, 0x40
call fcn.1401ed7e4
cmp eax, 1
je 0x1401ed7a2
mov ecx, dword [rsp + 0x118]
or r8d, 0xffffffff
xor edx, edx
call fcn.140127b08
mov rcx, rdi
call fcn.1401ed5e4
jmp 0x1401ed7a2
call fcn.1402afe24
mov ebx, dword [rax]
call fcn.1402afe24
and dword [rax], 0
call fcn.140002820
mov r9d, 0x3f
mov qword [rsp + 0x30], r15
and qword [rsp + 0x28], 0
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov rcx, qword [rax]
lea r8d, [r9 + 1]
call fcn.1402a72e8
call fcn.1402afe24
cmp dword [rax], 0
je 0x1401ed78e
call fcn.1402afe24
cmp dword [rax], 0
je 0x1401ed795
cmp dword [rax], 0xc
je 0x1401ed7d6
cmp dword [rax], 0x16
je 0x1401ed7cb
cmp dword [rax], 0x22
je 0x1401ed7cb
cmp dword [rax], 0x50
jne 0x1401ed7c0
jmp 0x1401ed795
call fcn.1402afe24
mov dword [rax], ebx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14013ffe8
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14010f500
add rsp, 0xd0
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.14008b390
int3
mov ecx, 0x80070057
call fcn.14008b390
int3
mov ecx, 0x8007000e
call fcn.14008b390
int3
Function at 0x1401fee34
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x28]
xor ebx, ebx
cmp dword [rdi - 0x10], ebx
je 0x1401feeac
mov rsi, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
call fcn.14012c4e4
mov rcx, rax
test rax, rax
je 0x1401fee83
mov rax, qword [rax]
mov rax, qword [rax + 0xe8]
call qword [case.0x1401c0845.0]
test rax, rax
je 0x1401fee83
mov rcx, qword [rax + 0x40]
jmp 0x1401fee86
mov rcx, rbx
mov dword [rsp + 0x28], 1
mov r9, rbp
mov r8, rdi
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
setae bl
mov eax, ebx
jmp 0x1401feeae
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x411e40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x411fcb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004306c0
xorps xmm15, xmm15
mov r14, qword [0x0055d9a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x411ea5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x411eb4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x411ed3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x411ee3
cmp rbx, 0x1000
jae 0x411eab
jmp 0x411f4d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x411ef5
xor edx, edx
jmp 0x411f44
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004306c0
xorps xmm15, xmm15
mov r14, qword [0x0055d9a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x411ed9
jmp 0x411ec8
call fcn.0046af60
xorps xmm15, xmm15
mov r14, qword [0x0055d9a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00434e00
lea rax, [0x00492b12]
mov ebx, 0x18
nop dword [rax]
call fcn.00435680
mov rax, qword [rsp + 0x38]
call fcn.004353c0
lea rax, [0x00492e51]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00435680
mov rax, qword [rsp + 0x30]
call fcn.004353c0
call fcn.00435040
call fcn.00434e60
lea rax, [0x0049493c]
mov ebx, 0x21
call fcn.004628c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00467860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00411e40