joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14037f1e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140a8e940]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14037f200
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14037f208
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14037f200
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x14037f255
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14037f24c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14037f200
add rax, 0x28
cmp rax, r9
jne 0x14037f238
xor eax, eax
ret

Function at 0x14037f260
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140a8e940]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x14037f280
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14037f288
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x14037f280
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x14037f310
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140a8e940]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x14037f330
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x14037f338
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x14000265c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400026a6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400026a6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400026a6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400026a6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400026a6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400026a8
xor al, al
add rsp, 0x28
ret

Function at 0x140008618
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140008483
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140008483
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140008483
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140008483
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140008483
cmp dword [rcx + 0x84], 0xe
jbe 0x140008483
cmp dword [rcx + 0xf8], 0
je 0x140008483
mov ecx, ebx
call fcn.140008534
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140008310
nop
cmp dword [rbp + 0x20], 0
je 0x1400084d1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400084dc
int3
xor r8d, r8d
xor edx, edx
jmp 0x140008414
Function at 0x14000bb80
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14000bc07
mov rsi, rbx
cmp word [rax], bp
je 0x14000bbc6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14000bbb0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14000bbac
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000a560
mov rdi, rax
test rax, rax
je 0x14000bbf4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140011270
mov rbp, rdi
xor ecx, ecx
call fcn.14000a848
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140010bd0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140010bf8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140010bf8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400011c0
Capabilities:
Enumerate processes

Disassembly:
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.CreateToolhelp32Snapshot
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea ecx, [rdx + 2]
call rax
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
mov r13, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov qword [rsp + 0x2c0], rbx
xor r14d, r14d
mov qword [rsp + 0x2c8], rbp
mov r12d, r14d
mov r15d, 1
mov qword [rsp + 0x2d0], rsi
xorps xmm0, xmm0
lea rax, [rsp + 0x6c]
movups xmmword [rsp + 0x20], xmm0
mov r8d, 0xa
movabs rdx, 0x7fffffffffffffff
movabs rcx, 0x7ffffffffffffffe
inc r15d
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], r14w
jne 0x140001275
cmp rdi, rcx
ja 0x140001450
cmp rdi, 7
ja 0x1400012cc
lea rbx, [rdi + rdi]
mov qword [rsp + 0x30], rdi
mov r8, rbx
mov qword [rsp + 0x38], 7
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x20], r14w
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x20]
jmp 0x140001368
mov rbp, rdi
or rbp, 7
cmp rbp, rcx
jbe 0x1400012e1
mov rbp, rcx
lea rcx, [rdx + rdx]
jmp 0x140001302
cmp rbp, 0xa
cmovb rbp, r8
lea rcx, [rbp + 1]
cmp rcx, rdx
ja 0x14000144a
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000132e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000144a
mov rcx, rax
call fcn.140001510
test rax, rax
je 0x140001433
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001340
test rcx, rcx
je 0x14000133d
call fcn.140001510
mov rsi, rax
jmp 0x140001340
mov rsi, r14
lea rbx, [rdi + rdi]
mov qword [rsp + 0x20], rsi
mov r8, rbx
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x6c]
mov qword [rsp + 0x38], rbp
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rsi], r14w
cmp rbp, 7
lea r8, [rsp + 0x20]
cmova r8, rsi
cmp rdi, 0xa
jne 0x1400013a8
lea rbx, str.WeChat.exe
mov rdx, rdi
mov rax, rbx
sub r8, rbx
nop dword [rax + rax]
movzx ecx, word [rax]
cmp word [r8 + rax], cx
jne 0x1400013a8
add rax, 2
sub rdx, 1
jne 0x140001390
lea r12d, [rdx + 1]
cmp rbp, 7
jbe 0x1400013df
lea rdx, [rbp*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400013d7
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001433
mov rcx, rsi
call fcn.14000154c
lea rdx, [rsp + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001244
test r12d, r12d
jne 0x14000143a
mov rsi, qword [rsp + 0x2d0]
mov rbp, qword [rsp + 0x2c8]
mov rbx, qword [rsp + 0x2c0]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400014f0
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp r15d, 0xc8
setg r14b
mov eax, r14d
jmp 0x1400013fa
call fcn.140001100
int3
call fcn.1400011a0
int3
Function at 0x10acd30
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x10acd3d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x10acd4d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x10acd35
lea eax, [rcx + 1]
jmp 0x10acd5b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x10acd6e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x10acd54
sub eax, 3
jb 0x10acd8e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x10acddd
sar eax, 1
movsxd rbp, eax
jb 0x10acdc4
jmp 0x10acd9c
add ebx, ebx
jne 0x10acd9a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x10acdc4
inc ecx
add ebx, ebx
jne 0x10acdaa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x10acdc4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x10acdbd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x10acdac
add ecx, 2
jmp 0x10acdc9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.010accf2
jmp 0x10acd3d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2dc600
mov dl, 0x65
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x10ace29
cmp rsi, rcx
jae 0x10ace31
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x10ace10
cmp al, 0x8f
ja 0x10ace10
cmp byte [rsi - 2], 0xf
je 0x10ace16
sub al, 0xe8
cmp al, 1
ja 0x10acdfa
cmp rsi, rcx
jae 0x10ace31
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x10ace00
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x10ace31
lodsb al, byte [rsi]
jmp 0x10ace10
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xca4000]
mov eax, dword [rdi]
or eax, eax
je 0x10ace8e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xcb4cc4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x10ace3e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x10ace88
mov qword [rbx], rax
add rbx, 8
jmp 0x10ace5e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x10aced2
cmp al, 0xef
ja 0x10aceba
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x10ace9a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x10acea9
mov eax, dword [rdi]
add rdi, 4
jmp 0x10acea9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x10acf26
sub rsp, 0xffffffffffffff80
jmp 0x4671e0
Function at 0x140001020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140001053
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
je 0x140001097
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x140001092
cmp rbx, r11
jae 0x140001097
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140001080
cmp rbx, r11
jb 0x14000109b
xor eax, eax
jmp 0x1400010a7
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140001690
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x300
mov rax, qword [0x140126108]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
xor ebp, ebp
mov rsi, rcx
mov byte [rcx + 0x141], 1
cmp byte [rcx + 0x140], bpl
mov qword [rcx + 0x118], rbp
jne 0x14000174b
lea rcx, [rsp + 0x38]
xor edx, edx
mov r8d, 0x2b0
mov qword [rsp + 0x30], rbp
call fcn.1400a0a70
lea r8, [rsp + 0x30]
lea rcx, [0x1400e83e0]
mov r9d, 0x2b8
xor edx, edx
mov dword [rsp + 0x20], 0x4001
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea rbx, [rsi + 0x120]
mov rdx, rax
mov rcx, rbx
call fcn.14007677c
test rbx, rbx
mov r9, rbp
je 0x14000172a
mov r9, qword [rbx + 8]
mov rcx, qword [rsi + 0x40]
xor r8d, r8d
mov edx, 0x1109
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rax
call fcn.14007672c
mov byte [rsi + 0x140], 1
mov edx, reloc.WS2_32.dll_recv
lea r12, [rsi + 0x130]
mov dword [rsp + 0x28], ebp
lea r9d, [rdx - 8]
mov r8d, edx
mov rcx, r12
mov dword [rsp + 0x20], ebp
call fcn.140076844
call fcn.140074c94
call fcn.140074c94
mov edx, 0x8b
mov rcx, qword [rax + 0x18]
call qword [sym.imp.USER32.dll_LoadIconW]
mov rdi, qword [rsi + 0x138]
mov rbx, rax
call fcn.140074c94
mov r9, rbx
mov rcx, qword [rax + 0xc8]
or r8d, 0xffffffff
mov rdx, rdi
mov rcx, qword [rcx]
call fcn.1400010e0
call fcn.140074c94
call fcn.140074c94
mov rcx, qword [rax + 0x18]
mov edx, 0x8b
call qword [sym.imp.USER32.dll_LoadIconW]
mov rdi, qword [rsi + 0x138]
mov rbx, rax
call fcn.140074c94
mov r9, rbx
mov rcx, qword [rax + 0xc8]
or r8d, 0xffffffff
mov rdx, rdi
mov rcx, qword [rcx]
call fcn.1400010e0
call fcn.140074c94
call fcn.140074c94
mov rcx, qword [rax + 0x18]
mov edx, 0x8c
call qword [sym.imp.USER32.dll_LoadIconW]
mov rdi, qword [rsi + 0x138]
mov rbx, rax
call fcn.140074c94
mov r9, rbx
mov rcx, qword [rax + 0xc8]
or r8d, 0xffffffff
mov rdx, rdi
mov rcx, qword [rcx]
call fcn.1400010e0
call fcn.140074c94
call fcn.140074c94
mov rcx, qword [rax + 0x18]
mov edx, 0x8d
call qword [sym.imp.USER32.dll_LoadIconW]
mov rdi, qword [rsi + 0x138]
mov rbx, rax
call fcn.140074c94
mov r9, rbx
mov rcx, qword [rax + 0xc8]
or r8d, 0xffffffff
mov rdx, rdi
mov rcx, qword [rcx]
call fcn.1400010e0
test r12, r12
je 0x14000187c
mov rbp, qword [r12 + 8]
mov rcx, qword [rsi + 0x40]
mov r9, rbp
mov edx, 0x1109
mov r8d, 2
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rax
call fcn.14007672c
lea rcx, [rsi + 0xa8]
mov rdx, rsi
call fcn.140076c0c
mov qword [0x14013bac0], rsi
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.14009cca0
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140002ae0
Capabilities:
Encode data using xor

Disassembly:
push rbx
or r13, r11
sub rsp, 0x20
or r11, 0xe0
test r11, r10
mov rcx, r15
xchg rsi, r12
or rax, 0xa7
mov rdx, r14
xor rax, r10
test r11, rax
mov r8, rdi
add rax, rsi
lea r9, [rsp]
push rsi
pop rdi
call rbx
dec r12
add rsp, 0x20
sub rax, rbx
and r11, 0x5e
pop r10
lea r13, [r13 + 0x9f]
ror rbx, 0x18
pop r14
subps xmm13, xmm4
shr r15, 8
pop rdi
lea r12, [r12 + 0x1b]
xor rbx, rbx
and r11, 0xe6
shr r12, 0x2f
lea rax, [rdi + rbx]
xor r11, 0x91
mov r12b, byte [rax]
or r11, r15
ror r13, 0x2b
xor r12b, 0xf8
and r13, 0x3a
add r12b, 0x2c
lea r13, [r13 + 0xd1]
mov byte [rax], r12b
xor r11, 0xa1
xchg rsi, r15
inc rbx
xor r13, 0xfd
add rsi, r11
cmp rbx, r14
mov r11, r15
jne 0x140002b4e
xchg r15, rsi
pop r11
mov r15, r11
push r15
mov r12, 0xc7
inc r11
lea rsi, [rsi + 0x67]
mov rbx, 0xe7
add r11, 0x4c
ror rsi, 0x1a
xor r12, rbx
inc rsi
push rdi
and r11, 0x29
sub rsp, 0x20
add rax, 0xed
mov rcx, rdi
sub rax, r13
mov rdx, r14
dec r15
and r11, r13
mov r8, r12
push rdi
pop rbx
lea r9, [rsp]
mov r11, rax
add r15, 0x5d
call r10
sub r11, rbx
add rsp, 0x20
or rbx, 0xb1
push r13
pop r14
ret
Function at 0x140005640
Capabilities:
Get file system object information

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x360
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rsp + 0x3a8], rbx
mov rax, qword [0x140126108]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov r13, r8
mov r12, rdx
mov rbp, rcx
xor edi, edi
mov r9, qword [0x14013b820]
mov edx, 0x110a
lea r8d, [rdi + 4]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, rax
test rax, rax
je 0x1400057fe
nop
nop
nop
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x48], socket
lea r9, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x113e
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14000573e
mov r8, qword [rsp + 0x78]
test r8, r8
je 0x1400057b5
mov r8, qword [r8]
test r8, r8
je 0x1400057e1
mov rax, qword [r12]
sub r8, rax
nop
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140005734
add rax, 2
test ecx, ecx
jne 0x140005720
test edx, edx
je 0x1400057da
jmp 0x1400057b5
mov r8, rsi
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.1400768b8
nop
mov rdx, qword [rax]
mov eax, edi
test rdx, rdx
setne al
test eax, eax
je 0x1400057f3
mov rax, qword [r12]
sub rdx, rax
nop
nop
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x140005786
add rax, 2
test cx, cx
jne 0x140005770
mov eax, edi
jmp 0x14000578b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete bl
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400057b1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test bl, bl
jne 0x1400057ec
mov r9, rsi
mov edx, 0x110a
mov r8d, 1
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, rax
test rax, rax
je 0x1400057fe
jmp 0x1400056b0
xor eax, eax
jmp 0x1400058c2
mov ecx, 0x80004005
call fcn.140001000
int3
xor eax, eax
jmp 0x1400058c2
mov ecx, 0x80004005
call fcn.140001000
nop
mov qword [rsp + 0x90], rdi
xor edx, edx
mov r8d, 0x2b0
lea rcx, [rsp + 0x98]
call fcn.1400a0a70
mov dword [rsp + 0x20], 0xc00
mov r9d, 0x2b8
lea r8, [rsp + 0x90]
xor edx, edx
mov rcx, qword [r13]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x1400058c0
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x9c]
mov dword [rsp + 0x30], eax
mov rax, qword [r12]
mov qword [rsp + 0x28], rax
lea rbx, str.CFolderTreeCtrl::IsHiddenDrive
mov qword [rsp + 0x20], rbx
lea r9, str._s___path___s___attir:_0x_8x___type___s_
mov r8d, 0x336
lea rdx, str..CFolderTreeCtrl.cpp
mov ecx, 0x45
call fcn.1400580a0
bt dword [rsp + 0x9c], 0x14
jae 0x1400058c0
mov qword [rsp + 0x20], rbx
lea r9, str._s___Non_Enum
mov r8d, 0x339
lea rdx, str..CFolderTreeCtrl.cpp
mov ecx, 0x45
call fcn.1400580a0
mov edi, 1
mov eax, edi
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.14009cca0
mov rbx, qword [rsp + 0x3a8]
add rsp, 0x360
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002b5f0
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x140126108]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
lea r9, str.CuiMainConsoleApp::InitAppRunningLock
mov r8d, 0x65
lea rdx, str..uiMainConsole.cpp
lea rcx, [rsp + 0x20]
call fcn.1400583e0
nop
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], 0
mov word [rsp + 0x58], 0
mov r8d, 6
lea rdx, str.Local_
lea rcx, [rsp + 0x50]
call fcn.140013670
mov r8d, 9
lea rdx, [0x1400f0750]
lea rcx, [rsp + 0x50]
call fcn.140013670
lea r8, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae r8, qword [rsp + 0x58]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 0x160], rax
test rax, rax
je 0x14002b71d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14002b71d
mov dword [rsp + 0x2c], WSAStartup
mov dword [rsp + 0x28], 1
cmp qword [rsp + 0x70], 8
jb 0x14002b6d3
mov rcx, qword [rsp + 0x58]
call fcn.14006b8a0
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], 0
mov word [rsp + 0x58], 0
lea rax, [0x1400d8790]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
call fcn.140058360
nop
mov rcx, qword [rsp + 0x40]
call fcn.14006b8a0
nop
mov rcx, qword [rsp + 0x38]
call fcn.14006b8a0
nop
xor eax, eax
jmp 0x14002b788
mov dword [rsp + 0x2c], WSAStartup
mov dword [rsp + 0x28], 1
cmp qword [rsp + 0x70], 8
jb 0x14002b73f
mov rcx, qword [rsp + 0x58]
call fcn.14006b8a0
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], 0
mov word [rsp + 0x58], 0
lea rax, [0x1400d8790]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
call fcn.140058360
nop
mov rcx, qword [rsp + 0x40]
call fcn.14006b8a0
nop
mov rcx, qword [rsp + 0x38]
call fcn.14006b8a0
nop
or eax, 0xffffffff
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14009cca0
add rsp, 0x80
pop rbx
ret
Function at 0x14002dac0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x330
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x140126108]
xor rax, rsp
mov qword [rsp + 0x320], rax
lea rbx, str.LaunchMainConsoleByWofieLauncher
mov qword [rsp + 0x20], rbx
lea r9, [0x1400f0978]
mov r8d, 0x20c
lea rdx, str..uiMainConsole.cpp
mov ecx, 0x44
call fcn.1400580a0
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x110]
call fcn.1400a0a70
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x70]
call fcn.1400a0a70
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0xac], 1
mov word [rsp + 0xb0], 0
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0xe0]
call fcn.14002dca0
nop
lea r9, [rsp + 0xe8]
cmp qword [rsp + 0x100], 8
cmovae r9, qword [rsp + 0xe8]
lea r8, str._s__main__no_timeout
mov edx, 0x104
lea rcx, [rsp + 0x110]
call fcn.14009f090
lea r11, [rsp + 0x50]
mov qword [rsp + 0x48], r11
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x110]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14002dc12
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.CreateProcessW_failed._err:__u_
mov r8d, 0x225
lea rdx, str..uiMainConsole.cpp
mov ecx, 5
call fcn.1400580a0
jmp 0x14002dc28
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x20], rbx
lea r9, str._s______
mov r8d, 0x22c
lea rdx, str..uiMainConsole.cpp
mov ecx, 0x44
call fcn.1400580a0
nop
cmp qword [rsp + 0x100], 8
jb 0x14002dc64
mov rcx, qword [rsp + 0xe8]
call fcn.14006b8a0
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.14009cca0
add rsp, 0x330
pop rbx
ret