joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400fccd0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rax, [rdx - 1]
test rdx, rax
jne 0x1400fccf9
lea rax, [rcx + rdx]
add rax, 0xffffffffffffffff
neg rdx
and rdx, rax
mov rax, rdx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rsi, qword [0x14010d140]
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x1400fcd8f
lea rcx, [0x14010d140]
call fcn.1400db3d0
mov rcx, qword [0x14010d148]
cmp rcx, 0xffffffffffffffff
je 0x1400fcdd6
lea rax, [rcx - 1]
cmp rax, 1
ja 0x1400fcd4f
xor eax, eax
cmp rcx, 1
sete al
or eax, 0xfffffff4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
test rax, rax
je 0x1400fcd7a
mov qword [rsp + 0x20], 0
lea rdx, str.IsPowerOfTwo_boundary__n
lea r9, [rsp + 0x2c]
mov r8d, 0x17
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400fcd87
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.IsPowerOfTwo_boundary__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [rsi], 0
call fcn.1400b8e30
xor edi, edi
mov rbx, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1400fcda3
add edi, 1
cmp edi, 0x63
ja 0x1400fcdc0
pause
cmp byte [rsi], 0
jne 0x1400fcda0
jmp 0x1400fcdc9
xor ecx, ecx
call rbx
cmp byte [rsi], 0
jne 0x1400fcda0
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x1400fcda0
jmp 0x1400fcd0c
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__fd_____fd_t__1_______0_
mov edx, 0x24a7
xor r9d, r9d
call fcn.1400a50f0
int3

Function at 0x140100220
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov al, 1
xchg byte [rcx], al
test al, al
jne 0x14010029e
mov rax, qword [rsi + rdi*8 + 8]
test rax, rax
jne 0x140100291
mov rdx, qword [0x140cbd3d8]
test rdx, rdx
jne 0x140100263
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140cbd3d8], rdx
mov ecx, 0x100000
call fcn.1400fccd0
mov rbx, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x1401002cc
mov qword [rsi + rdi*8 + 8], rax
mov byte [rsi], 0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1401002ac
add ebx, 1
cmp ebx, 0x63
ja 0x1401002b5
pause
jmp 0x1401002ba
xor ecx, ecx
call r14
cmp byte [rsi], 0
jne 0x1401002a9
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x1401002a9
jmp 0x140100237
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.TwoLevelMap
lea r8, str.allocate
mov rcx, rbx
mov r9d, eax
call fcn.1400d19a0
int3
Function at 0x140100300
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov al, 1
xchg byte [rcx], al
test al, al
jne 0x14010037e
mov rax, qword [rsi + rdi*8 + 8]
test rax, rax
jne 0x140100371
mov rdx, qword [0x140cbd3d8]
test rdx, rdx
jne 0x140100343
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140cbd3d8], rdx
mov ecx, 0x40000
call fcn.1400fccd0
mov rbx, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x1401003ac
mov qword [rsi + rdi*8 + 8], rax
mov byte [rsi], 0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14010038c
add ebx, 1
cmp ebx, 0x63
ja 0x140100395
pause
jmp 0x14010039a
xor ecx, ecx
call r14
cmp byte [rsi], 0
jne 0x140100389
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x140100389
jmp 0x140100317
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.TwoLevelMap
lea r8, str.allocate
mov rcx, rbx
mov r9d, eax
call fcn.1400d19a0
int3

Function at 0x1401003e0
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov al, 1
xchg byte [rcx], al
test al, al
jne 0x14010045e
mov rax, qword [rsi + rdi*8 + 8]
test rax, rax
jne 0x140100451
mov rdx, qword [0x140cbd3d8]
test rdx, rdx
jne 0x140100423
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140cbd3d8], rdx
mov ecx, 0x1000
call fcn.1400fccd0
mov rbx, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14010048c
mov qword [rsi + rdi*8 + 8], rax
mov byte [rsi], 0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14010046c
add ebx, 1
cmp ebx, 0x63
ja 0x140100475
pause
jmp 0x14010047a
xor ecx, ecx
call r14
cmp byte [rsi], 0
jne 0x140100469
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x140100469
jmp 0x1401003f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.TwoLevelMap
lea r8, str.allocate
mov rcx, rbx
mov r9d, eax
call fcn.1400d19a0
int3
Function at 0x1401006b0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, rdx
mov r14, rcx
mov eax, dword [rdx + 0x400000]
mov qword [rcx], rax
xor esi, esi
lea r15, [rsp + 0x28]
mov r13, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ebx, ebx
jmp 0x14010070a
mov ecx, 0x100000
call fcn.1400fccd0
add rsi, rax
add rbx, 1
cmp rbx, 0x8000
je 0x140100736
mov rax, qword [rdi + rbx*8 + 0x400010]
test rax, rax
je 0x1401006fd
mov rdx, qword [0x140cbd3d8]
test rdx, rdx
jne 0x1401006f0
mov rcx, r15
call r13
mov edx, dword [rsp + 0x2c]
mov qword [0x140cbd3d8], rdx
jmp 0x1401006f0
mov r15, qword [0x140d27728]
xor edi, edi
lea rbx, [0x140ce7718]
lea r12, [rsp + 0x28]
xor ebp, ebp
jmp 0x14010076a
mov ecx, 0x40000
call fcn.1400fccd0
add rdi, rax
add rbp, 1
cmp rbp, 0x8000
je 0x140100793
mov rax, qword [rbx + rbp*8 + 8]
test rax, rax
je 0x14010075d
mov rdx, qword [0x140cbd3d8]
test rdx, rdx
jne 0x140100750
mov rcx, r12
call r13
mov edx, dword [rsp + 0x2c]
mov qword [0x140cbd3d8], rdx
jmp 0x140100750
add rsi, r15
lea rax, [rdi + rsi]
add rax, 0x10010
mov qword [r14 + 8], rax
mov rax, r14
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x402864
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rbx, rcx
and dword [rsp + 0x40], 0
xor edx, edx
lea r8d, [rdx + 0x20]
lea rcx, [rsp + 0x44]
call fcn.0041cbe0
and dword [rsp + 0x98], 0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x4028d6
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x4028cf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x402a61
mov r8d, 0x1d
mov rdx, qword [rbx]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x402944
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rbx]
sub rcx, 0x18
call fcn.004061a4
add rax, 0x18
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0xa0]
call fcn.004024f8
nop
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x40293d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x402a61
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4029b3
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rbx]
sub rcx, 0x18
call fcn.004061a4
add rax, 0x18
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0xa8]
call fcn.004024f8
nop
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x4029ac
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x402a61
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x402a2e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rbx]
sub rcx, 0x18
call fcn.004061a4
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
call fcn.004024f8
nop
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x402a2a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x402a61
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x402a5f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x402a6c
Capabilities:
Query service status
Stop service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x60
xor r13d, r13d
mov rbx, rcx
lea rcx, [rax - 0x44]
lea r8d, [r13 + 0x20]
xor edx, edx
mov dword [rax - 0x48], r13d
call fcn.0041cbe0
mov dword [rsp + 0x88], r13d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdx, qword [rbx]
mov rdi, rax
cmp rax, r13
jne 0x402ae9
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r13d
jg 0x402ae2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x402b87
mov r8d, 0x2d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
cmp rax, r13
jne 0x402b0e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, qword [rbx]
jmp 0x402ac6
mov r12d, 1
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.ADVAPI32.dll_ControlService]
lea r11, [rsp + 0x88]
lea r9d, [r12 + 0x23]
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
movzx ebp, r13b
cmp eax, r13d
mov rcx, rsi
cmovne ebp, r12d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, qword [rbx]
sub rdx, 0x18
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
cmp ecx, r13d
jg 0x402b84
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, bpl
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x402ba4
Capabilities:
Query service status

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x60
and dword [rax - 0x38], 0
mov rbx, rdx
xor edx, edx
mov rdi, rcx
lea rcx, [rax - 0x34]
lea r8d, [rdx + 0x20]
call fcn.0041cbe0
and dword [rsp + 0x78], 0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov byte [rbx], 0
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdx, qword [rdi]
mov rbp, rax
test rax, rax
jne 0x402c16
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x402c0f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x402ca2
mov r8d, 5
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x402c3b
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, qword [rdi]
jmp 0x402bf4
lea rax, [rsp + 0x78]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x402c63
xor bl, bl
jmp 0x402c6f
cmp dword [rsp + 0x34], 4
sete al
mov byte [rbx], al
mov bl, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, qword [rdi]
sub rdx, 0x18
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x402ca0
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, bl
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x407a80
Capabilities:
Create process on windows

Disassembly:
push rdi
sub rsp, 0x270
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x004402a0]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edi, edi
mov word [rsp + 0x50], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x52]
call fcn.0041cbe0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r8d, 0x103
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.00406688
nop
lea rcx, [rsp + 0x30]
call fcn.00405848
lea rdx, str.SolvusoftWMGameOptimizer.exe
lea rcx, [rsp + 0x38]
call fcn.00406688
mov dword [rsp + 0x28], 1
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x004340fc]
mov r8, qword [rsp + 0x38]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, edi
jg 0x407b5d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, edi
jg 0x407b7d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.0041af90
add rsp, 0x270
pop rdi
ret
Function at 0x4096b4
Capabilities:
Get common file path
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x4480
call fcn.0042aad0
sub rsp, rax
mov rax, qword [0x004402a0]
xor rax, rsp
mov qword [rsp + 0x4470], rax
mov ebx, 0x1000
lea rcx, [rsp + 0x2470]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, [rsp + 0x470]
mov r8d, ebx
xor ecx, ecx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
jmp 0x4097cc
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [rsp + 0x20]
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x4097c9
lea rcx, [rsp + 0x34]
xor edx, edx
mov r8d, 0x434
mov dword [rsp + 0x30], 0x438
call fcn.0041cbe0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.KERNEL32.dll_Module32FirstW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x470]
lea rcx, [rsp + 0x260]
call fcn.0041b170
test eax, eax
je 0x4097c9
lea rdx, [rsp + 0x2470]
lea rcx, [rsp + 0x260]
mov r8, rsi
call fcn.0041b330
test eax, eax
je 0x4097c9
mov r8d, dword [rsp + 0x20]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x4097c9
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rdi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rdi, rax
test rax, rax
jne 0x40970f
mov rcx, qword [rsp + 0x4470]
xor rcx, rsp
call fcn.0041af90
lea r11, [rsp + 0x4480]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x41232c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.0041038c
mov rsi, rax
test rax, rax
je 0x4123a8
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x4123a3
cmp dword [rbx], 0x40
jb 0x4123a3
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x4123a3
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x4123ac
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x41ea43
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x004402a0]
jne 0x41afaa
rol rcx, 0x10
test cx, 0xffff
jne 0x41afa6
repz ret
ror rcx, 0x10
jmp 0x41e99c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x004460c0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x004461b8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x41ea21
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x004460c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x41ea43
mov rax, qword [rsp + 0x88]
mov qword [0x004461b8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x00446158], rax
mov rax, qword [0x004461b8]
mov qword [0x00446030], rax
mov rax, qword [rsp + 0x90]
mov qword [0x00446140], rax
mov dword [0x00446020], 0xc0000409
mov dword [0x00446024], 1
mov rax, qword [0x004402a0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x004402a8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x004460b8], eax
mov ecx, 1
call fcn.0042486c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x00432b50]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x004460b8], 0
jne 0x41eaca
mov ecx, 1
call fcn.0042486c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x424394
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.0041e548
xor ebx, ebx
mov rdi, rax
cmp qword [0x00446950], rbx
jne 0x42449a
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x42456f
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x42456f
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x00432cb8]
mov rcx, rsi
mov qword [0x00446950], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x00432ca0]
mov rcx, rsi
mov qword [0x00446958], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x00446960], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x00446970], rax
test rax, rax
je 0x424491
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x00446968], rax
jmp 0x4244a1
mov rax, qword [0x00446968]
jmp 0x4244a8
mov rax, qword [0x00446968]
mov r11, qword [0x00446970]
cmp rax, rdi
je 0x424510
cmp r11, rdi
je 0x424510
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x00446970]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x424510
test rax, rax
je 0x424510
call rsi
test rax, rax
je 0x42450a
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x42450a
test byte [rsp + 0x38], 1
jne 0x424510
bts ebp, 0x15
jmp 0x42454e
mov rcx, qword [0x00446958]
cmp rcx, rdi
je 0x42454e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x42454e
call rax
mov rbx, rax
test rax, rax
je 0x42454e
mov rcx, qword [0x00446960]
cmp rcx, rdi
je 0x42454e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x42454e
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x00446950]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x42456f
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x424571
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180008d40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x18002f008]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, rdx
mov esi, ecx
movdqa xmm0, xmmword [0x18002a740]
mov word [rsp + 0x30], 0x3ca0
mov ecx, dword [0x180030258]
mov rax, qword gs:[0x58]
mov rdi, qword [rax + rcx*8]
mov ecx, 0xd50
mov eax, dword [rcx + rdi]
test al, 1
jne 0x180008de4
or eax, 1
mov dword [rcx + rdi], eax
mov eax, 0xd58
mov ebx, eax
lea rcx, [rax + rdi]
mov byte [rcx + 0x12], 1
lea rax, [rcx + 0x11]
lea rdx, [rsp + 0x31]
cmp rcx, rdx
ja 0x180008dc9
lea rdx, [rsp + 0x20]
cmp rax, rdx
jb 0x180008dc9
movups xmmword [rcx], xmm0
movzx eax, word [rsp + 0x30]
mov word [rcx + 0x10], ax
jmp 0x180008dd5
movups xmmword [rcx], xmm0
movzx eax, word [rsp + 0x30]
mov word [rcx + 0x10], ax
lea rcx, [0x180021d40]
call fcn.1800095b0
nop
jmp 0x180008de9
mov ebx, 0xd58
lea r8, [rdi + rbx]
xor ebx, ebx
cmp byte [r8 + 0x12], bl
je 0x180008e21
mov edx, ebx
movabs r9, 0x540bb27a5c53caa
movzx ecx, dl
and cl, 7
shl cl, 3
mov rax, r9
shr rax, cl
xor byte [rdx + r8], al
inc rdx
cmp rdx, 0x12
jb 0x180008e01
mov byte [r8 + 0x12], bl
mov rcx, r8
call fcn.180009270
cmp byte [0x180030e98], bl
jne 0x180008e36
call fcn.180007d90
mov rax, qword [0x180030ea8]
test rax, rax
je 0x180008e49
mov rdx, rbp
mov ecx, esi
call rax
movdqa xmm0, xmmword [0x18002a750]
mov word [rsp + 0x30], 0x68a5
mov ecx, 0xd6c
mov eax, dword [rcx + rdi]
test al, 1
jne 0x180008eba
or eax, 1
mov dword [rcx + rdi], eax
mov eax, 0xd70
mov esi, eax
lea rcx, [rax + rdi]
mov byte [rcx + 0x12], 1
lea rax, [rcx + 0x11]
lea rdx, [rsp + 0x31]
cmp rcx, rdx
ja 0x180008e9f
lea rdx, [rsp + 0x20]
cmp rax, rdx
jb 0x180008e9f
movups xmmword [rcx], xmm0
movzx eax, word [rsp + 0x30]
mov word [rcx + 0x10], ax
jmp 0x180008eab
movups xmmword [rcx], xmm0
movzx eax, word [rsp + 0x30]
mov word [rcx + 0x10], ax
lea rcx, [0x180021d10]
call fcn.1800095b0
nop
jmp 0x180008ebf
mov esi, 0xd70
lea rdx, [rdi + rsi]
cmp byte [rdx + 0x12], 0
je 0x180008eff
movabs r8, 0x5ea08b3e5dd68af
nop dword [rax]
nop word [rax + rax]
movzx ecx, bl
and cl, 7
shl cl, 3
mov rax, r8
shr rax, cl
xor byte [rbx + rdx], al
inc rbx
cmp rbx, 0x12
jb 0x180008ee0
mov byte [rdx + 0x12], 0
mov rcx, rdx
call fcn.180009270
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180009470
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret