joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021aa0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x14005ed40]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x140021b51
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.140030d6c
cmp rax, 1
jne 0x140021b87
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x140021b2d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x140021b20
cmp rcx, 1
jb 0x140021b87
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140021af0
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140021f70
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140030b18
int3
Function at 0x140021cb0
Capabilities:
Set environment variable

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0xb0
mov rax, qword [0x14005ed40]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, qword [0x140060a50]
mov rbx, r8
mov rdi, rdx
mov r15, rcx
test rax, rax
jne 0x140021d00
lea rcx, [0x140041edc]
call qword [sym.imp.python312.dll_PyImport_ImportModule]
mov qword [0x140060a50], rax
test rax, rax
je 0x140021edd
mov qword [rsp + 0xa8], rbp
lea rdx, str.environ
mov qword [rsp + 0xa0], rsi
mov rcx, rax
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r14
call qword [sym.imp.python312.dll_PyObject_GetAttrString]
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.python312.dll_PyUnicode_FromString]
mov r14, rax
test rbx, rbx
je 0x140021da7
mov rdx, rbx
mov rcx, rdi
call fcn.140021aa0
mov rdx, 0xffffffffffffffff
mov rcx, rbx
call qword [sym.imp.python312.dll_PyUnicode_FromWideChar]
mov rdx, r14
mov rcx, rbp
mov r8, rax
mov rbx, rax
call qword [sym.imp.python312.dll_PyObject_SetItem]
test eax, eax
je 0x140021d8c
mov ecx, 1
call qword [sym.imp.python312.dll_PyErr_PrintEx]
mov ecx, 1
call qword [sym.imp.python312.dll_Py_Exit]
int3
cmp dword [rbx], 0
jl 0x140021e70
sub qword [rbx], 1
jne 0x140021e70
mov rcx, rbx
jmp 0x140021e6a
movzx eax, byte [rdi]
lea rbx, [rsp + 0x30]
xor r12d, r12d
mov esi, 0x28
mov word [rsp + 0x30], r12w
test al, al
je 0x140021e35
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r12b
lea rcx, [rsp + 0x24]
call fcn.140030d6c
cmp rax, 1
jne 0x140021ed7
mov rcx, rsi
mov rax, rbx
cmp word [rbx], r12w
je 0x140021e0d
nop word [rax + rax]
add rax, 2
dec rcx
cmp word [rax], r12w
jne 0x140021e00
cmp rcx, 1
jb 0x140021ed7
movzx ecx, word [rsp + 0x24]
inc rdi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r12w
dec rsi
movzx eax, byte [rdi]
test al, al
jne 0x140021dc1
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.python312.dll_PyObject_DelItem]
test eax, eax
je 0x140021e70
mov rcx, qword [r15 + 0x60]
mov qword [r15 + 0x60], r12
test rcx, rcx
je 0x140021e70
cmp dword [rcx], r12d
jl 0x140021e70
sub qword [rcx], 1
jne 0x140021e70
call qword [sym.imp.python312.dll__Py_Dealloc]
cmp dword [r14], 0
jl 0x140021e85
sub qword [r14], 1
jne 0x140021e85
mov rcx, r14
call qword [sym.imp.python312.dll__Py_Dealloc]
cmp dword [rbp], 0
jl 0x140021e9b
sub qword [rbp], 1
jne 0x140021e9b
mov rcx, rbp
call qword [sym.imp.python312.dll__Py_Dealloc]
mov r12, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xa8]
mov r14, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140021f70
add rsp, 0xb0
pop r15
pop rdi
pop rbx
ret
call fcn.140030b18
int3
call fcn.140030b18
int3
Function at 0x1400229d8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140022a22
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140022a22
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140022a22
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140022a22
cmp dword [rcx + 0x84], 0xe
jbe 0x140022a22
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140022a24
xor al, al
add rsp, 0x28
ret

Function at 0x14002692c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002699b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002699b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002699b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002699b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002699b
cmp dword [rcx + 0x84], 0xe
jbe 0x14002699b
cmp dword [rcx + 0xf8], 0
je 0x14002699b
mov ecx, ebx
call fcn.140026a4c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140026828
nop
cmp dword [rbp + 0x20], 0
je 0x1400269e9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400269f4
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002692c

Function at 0x140026b30
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002699b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002699b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002699b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002699b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002699b
cmp dword [rcx + 0x84], 0xe
jbe 0x14002699b
cmp dword [rcx + 0xf8], 0
je 0x14002699b
mov ecx, ebx
call fcn.140026a4c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140026828
nop
cmp dword [rbp + 0x20], 0
je 0x1400269e9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400269f4
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002692c
Function at 0x1400385b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140038637
mov rsi, rbx
cmp word [rax], bp
je 0x1400385f6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400385e0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400385dc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140033960
mov rdi, rax
test rax, rax
je 0x140038624
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14003e270
mov rbp, rdi
xor ecx, ecx
call fcn.14003475c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003a8e0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14003a8f6
mov al, 1
jmp 0x14003a956
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14003a907
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14003a954
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400388f8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003a954
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14003a954
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14003a954
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14003a956
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14003e0c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14003e0e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14003e0e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140007e10
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14004c098]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x28]
call fcn.140017350
lea rcx, [rsp + 0x28]
call fcn.1400138a0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140007e55
mov byte [rsp + 0x20], 1
jmp 0x140007e5a
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x21], al
lea rcx, [rsp + 0x28]
call fcn.14000ece0
mov rcx, qword [rsp + 0x60]
call fcn.14000ecb0
movzx eax, byte [rsp + 0x21]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140019d30
add rsp, 0x58
ret

Function at 0x140007ef0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14004c098]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x28]
call fcn.140017350
lea rcx, [rsp + 0x28]
call fcn.1400138a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x28]
call fcn.14000ece0
mov rcx, qword [rsp + 0x60]
call fcn.14000ecb0
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140019d30
add rsp, 0x58
ret
Function at 0x1400080b0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push rdi
sub rsp, 0x5c0
mov rax, qword [0x14004c098]
xor rax, rsp
mov qword [rsp + 0x5b0], rax
xor r9d, r9d
mov r8d, 0x26
lea rdx, [rsp + 0x190]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1400081af
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x50]
call fcn.14000dd60
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.140007f60
lea rcx, [rsp + 0x50]
call fcn.14000ece0
lea rdx, [rsp + 0x90]
lea rcx, [0x14004d0a0]
call fcn.14000f220
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.14000fc80
mov rcx, rax
call fcn.14000f430
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14000d9f0
lea r8, [rsp + 0x70]
lea rdx, [0x14004d0a0]
lea rcx, [rsp + 0x110]
call fcn.14000ac70
mov rdx, rax
lea rcx, [0x14004d060]
call fcn.14000f1c0
lea rcx, [rsp + 0x110]
call fcn.14000ecb0
lea rcx, [rsp + 0x70]
call fcn.14000ecb0
lea rcx, [rsp + 0x90]
call fcn.14000ecb0
mov qword [rsp + 0x38], 0
lea r9, [rsp + 0x38]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400391f0]
call sub.SHELL32.dll_SHGetKnownFolderPath
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x140008229
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0xb0]
call fcn.14000dd60
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x130]
call fcn.140007f60
mov rdx, rax
lea rcx, [0x14004d000]
call fcn.14000f1c0
lea rcx, [rsp + 0x130]
call fcn.14000ecb0
lea rcx, [rsp + 0xb0]
call fcn.14000ece0
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x1400082a0
lea rdx, [rsp + 0x3a0]
lea rcx, [rsp + 0xd0]
call fcn.14000dd60
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x150]
call fcn.140007f60
mov rdx, rax
lea rcx, [0x14004cf50]
call fcn.14000f1c0
lea rcx, [rsp + 0x150]
call fcn.14000ecb0
lea rcx, [rsp + 0xd0]
call fcn.14000ece0
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x31]
call fcn.14000f9c0
mov rcx, rax
call fcn.14000f410
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.14000d9f0
lea r8, [rsp + 0xf0]
lea rdx, [0x14004cf50]
lea rcx, [rsp + 0x170]
call fcn.14000ac70
mov rdx, rax
lea rcx, [0x14004d020]
call fcn.14000f1c0
lea rcx, [rsp + 0x170]
call fcn.14000ecb0
lea rcx, [rsp + 0xf0]
call fcn.14000ecb0
mov rcx, qword [rsp + 0x5b0]
xor rcx, rsp
call fcn.140019d30
add rsp, 0x5c0
pop rdi
ret
Function at 0x140008940
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1b0
mov rax, qword [0x14004c098]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
lea rcx, [rsp + 0xa0]
call fcn.14000dc90
lea rdx, [0x1400374a7]
lea rcx, [rsp + 0xe0]
call fcn.14000d9f0
movzx eax, byte [rsp + 0x1c8]
test eax, eax
je 0x140008a8d
lea rdx, [0x1400374bb]
mov rcx, qword [rsp + 0x1d8]
call fcn.14000aad0
movzx eax, al
test eax, eax
je 0x1400089d0
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0xa0]
call fcn.14000f220
jmp 0x1400089e5
mov rdx, qword [rsp + 0x1d8]
lea rcx, [rsp + 0xa0]
call fcn.14000f220
mov r8, qword [rsp + 0x1c0]
lea rdx, [0x140037534]
lea rcx, [rsp + 0x160]
call fcn.14000ae10
lea r8, [0x140037504]
mov rdx, rax
lea rcx, [rsp + 0x140]
call fcn.14000abd0
lea r8, [rsp + 0xa0]
mov rdx, rax
lea rcx, [rsp + 0x120]
call fcn.14000ab80
lea r8, str._2_1
mov rdx, rax
lea rcx, [rsp + 0x100]
call fcn.14000abd0
mov rdx, rax
mov rcx, qword [rsp + 0x1c0]
call fcn.14000f1c0
lea rcx, [rsp + 0x100]
call fcn.14000ecb0
lea rcx, [rsp + 0x120]
call fcn.14000ecb0
lea rcx, [rsp + 0x140]
call fcn.14000ecb0
lea rcx, [rsp + 0x160]
call fcn.14000ecb0
jmp 0x140008ac6
mov r8, qword [rsp + 0x1c0]
lea rdx, [0x140037544]
lea rcx, [rsp + 0x180]
call fcn.14000ae10
mov rdx, rax
mov rcx, qword [rsp + 0x1c0]
call fcn.14000f1c0
lea rcx, [rsp + 0x180]
call fcn.14000ecb0
mov rdx, qword [rsp + 0x1c0]
lea rcx, [rsp + 0xc0]
call fcn.140017350
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x70
rep stosb byte [rdi], al
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x34], 0x40
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
lea rax, str.cmd.exe
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0xc0]
call fcn.1400138a0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
movzx eax, byte [rsp + 0x1d0]
test eax, eax
je 0x140008b70
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0xc0]
call fcn.14000ece0
lea rcx, [rsp + 0xe0]
call fcn.14000ecb0
lea rcx, [rsp + 0xa0]
call fcn.14000ecb0
mov rcx, qword [rsp + 0x1c0]
call fcn.14000ecb0
mov rcx, qword [rsp + 0x1d8]
call fcn.14000ecb0
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140019d30
add rsp, 0x1b0
pop rdi
ret
Function at 0x140008e20
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [0x14004c098]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x50]
call fcn.140017350
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0x30]
call fcn.140017350
lea rcx, [rsp + 0x30]
call fcn.1400138a0
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x50]
call fcn.1400138a0
xor r8d, r8d
mov rcx, qword [rsp + 0x28]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140008e9c
mov byte [rsp + 0x20], 1
jmp 0x140008ea1
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x21], al
lea rcx, [rsp + 0x30]
call fcn.14000ece0
lea rcx, [rsp + 0x50]
call fcn.14000ece0
mov rcx, qword [rsp + 0x90]
call fcn.14000ecb0
mov rcx, qword [rsp + 0x98]
call fcn.14000ecb0
movzx eax, byte [rsp + 0x21]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140019d30
add rsp, 0x88
ret

Function at 0x140009fc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
movzx eax, word [rsp + 0x50]
mov r8d, 0xa
mov edx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14000a001
jmp 0x14000a048
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14000a020
jmp 0x14000a048
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x14004cf10], rax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x14004cf18], eax
add rsp, 0x48
ret

Function at 0x14000a080
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x288
mov rax, qword [0x14004c098]
xor rax, rsp
mov qword [rsp + 0x270], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x20], rax
mov r8d, 0x100
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14000dd60
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.140007f60
lea rcx, [rsp + 0x48]
call fcn.14000ece0
cmp qword [rsp + 0x20], 0
je 0x14000a117
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x290]
call fcn.14000d860
lea rcx, [rsp + 0x28]
call fcn.14000ecb0
mov rax, qword [rsp + 0x290]
jmp 0x14000a149
lea rdx, [0x1400374bf]
mov rcx, qword [rsp + 0x290]
call fcn.14000d9f0
lea rcx, [rsp + 0x28]
call fcn.14000ecb0
mov rax, qword [rsp + 0x290]
jmp 0x14000a149
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140019d30
add rsp, 0x288
ret
Function at 0x14000a290
Capabilities:
Encrypt data using xtea

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x28
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax]
mov dword [rsp + 4], eax
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax]
mov dword [rsp + 8], eax
mov dword [rsp + 0x10], 0x9e3779b9
mov eax, dword [rsp + 0x10]
imul eax, dword [rsp + 0x30]
mov dword [rsp], eax
mov dword [rsp + 0xc], 0
jmp 0x14000a2f4
mov eax, dword [rsp + 0xc]
inc eax
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0xc], eax
jae 0x14000a38a
mov eax, dword [rsp + 4]
shl eax, 4
mov ecx, dword [rsp + 4]
shr ecx, 5
xor eax, ecx
add eax, dword [rsp + 4]
mov ecx, dword [rsp]
shr ecx, 0xb
and ecx, 3
mov ecx, ecx
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rdx + rcx*4]
mov edx, dword [rsp]
add edx, ecx
mov ecx, edx
xor eax, ecx
mov ecx, dword [rsp + 8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 8], eax
mov eax, dword [rsp + 0x10]
mov ecx, dword [rsp]
sub ecx, eax
mov eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp + 8]
shl eax, 4
mov ecx, dword [rsp + 8]
shr ecx, 5
xor eax, ecx
add eax, dword [rsp + 8]
mov ecx, dword [rsp]
and ecx, 3
mov ecx, ecx
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rdx + rcx*4]
mov edx, dword [rsp]
add edx, ecx
mov ecx, edx
xor eax, ecx
mov ecx, dword [rsp + 4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 4], eax
jmp 0x14000a2ea
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x38]
mov edx, dword [rsp + 4]
mov dword [rcx + rax], edx
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x38]
mov edx, dword [rsp + 8]
mov dword [rcx + rax], edx
add rsp, 0x28
ret

Function at 0x14000e050
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.14000e000
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x1400103a0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x1400103c2
mov rcx, qword [rsp + 0x40]
call fcn.1400129d0
jmp 0x1400103d9
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x1400103d9
mov rcx, qword [rsp + 0x40]
call fcn.140012800
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x140011570
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x14004c098]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xa0]
cmp qword [rax + 0x68], 0
je 0x1400115ad
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400115b4
mov al, 1
jmp 0x1400116fc
call fcn.1400151b0
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rcx
mov edx, eax
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x48]
call qword [rax + 0x18]
mov dword [rsp + 0x38], eax
call fcn.1400151b0
mov dword [rsp + 0x3c], eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x3c]
call fcn.140015230
movzx eax, al
test eax, eax
je 0x140011605
xor al, al
jmp 0x1400116fc
mov qword [rsp + 0x58], 0x20
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0xa0]
add rcx, 0x74
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x60]
mov rdx, rcx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax + 0x68]
call fcn.140017a80
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14001166a
cmp dword [rsp + 0x30], 1
je 0x140011676
cmp dword [rsp + 0x30], 3
je 0x1400116ea
jmp 0x1400116fa
mov rax, qword [rsp + 0xa0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jbe 0x1400116c1
mov rax, qword [rsp + 0xa0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.14002151c
cmp qword [rsp + 0x40], rax
je 0x1400116c1
xor al, al
jmp 0x1400116fc
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400116db
mov dword [rsp + 0x34], 1
jmp 0x1400116e3
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x1400116fc
mov rax, qword [rsp + 0xa0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1400116fc
xor al, al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140019d30
add rsp, 0x98
ret