joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400505b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
movzx r9d, word [0x1400d0bc0]
mov r8, qword [rsp + 0x50]
mov edx, 5
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14005060c
mov r9w, 0x409
mov r8, qword [rsp + 0x50]
mov edx, 5
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14005062b
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x28], rax
jmp 0x140050634
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret

Function at 0x1400510d0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x298
mov rax, qword [0x1400ced18]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x2a0]
mov eax, dword [rax + 8]
or eax, 0x2001f
mov r9d, eax
mov r8, qword [rsp + 0x2a8]
mov rax, qword [rsp + 0x2a0]
mov rdx, qword [rax]
lea rcx, [rsp + 0x48]
call fcn.14002e680
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x140051163
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x60], eax
lea rcx, [rsp + 0x48]
call fcn.14002d920
mov eax, dword [rsp + 0x60]
jmp 0x140051247
mov dword [rsp + 0x44], 0x100
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400511f0
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x48]
call fcn.1400510d0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x1400511e3
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x64], eax
lea rcx, [rsp + 0x48]
call fcn.14002d920
mov eax, dword [rsp + 0x64]
jmp 0x140051247
mov dword [rsp + 0x44], 0x100
jmp 0x14005116b
mov dword [rsp + 0x68], 0
cmp qword [rsp + 0x48], 0
je 0x140051218
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2a0]
call fcn.14004ebf0
mov dword [rsp + 0x6c], eax
lea rcx, [rsp + 0x48]
call fcn.14002d920
mov eax, dword [rsp + 0x6c]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140082550
add rsp, 0x298
ret
Function at 0x1400513d0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
je 0x14005145c
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14005140f
mov eax, 1
jmp 0x14005147e
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14005145a
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x38]
jmp 0x14005147e
jmp 0x140051479
mov rax, qword [rsp + 0x50]
cmp dword [rax + 8], 0
je 0x140051479
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14005147e
mov eax, 1
add rsp, 0x48
ret
Function at 0x140052c90
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
xor eax, eax
test eax, eax
jne 0x140052ca3
cmp qword [rsp + 0x70], 0
je 0x140052cbb
mov dword [rsp + 0x38], 1
jmp 0x140052cc3
mov dword [rsp + 0x38], 0
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x140052cdc
mov eax, 0xd
jmp 0x140052d5c
xor eax, eax
test eax, eax
jne 0x140052ca9
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax*2]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
lea rax, [rcx + rax*2]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x30], 1
jne 0x140052cf4
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x58
ret

Function at 0x140052d70
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x140052d88
cmp qword [rsp + 0x60], 0
je 0x140052da0
mov dword [rsp + 0x30], 1
jmp 0x140052da8
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x140052dbe
mov eax, 0xd
jmp 0x140052dff
xor eax, eax
test eax, eax
jne 0x140052d8e
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
mov eax, eax
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x48
ret
Function at 0x140054dbc
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x20], 0x10000
je 0x140054e27
cmp dword [rcx + 0x28], 0x20000
je 0x140054e27
mov rsi, qword [rcx + 8]
mov edx, 0x40
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
xor ebx, ebx
test eax, eax
jne 0x140054e27
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x140054e27
movsxd rdi, dword [rsi + 0x3c]
mov edx, 0x108
add rdi, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140054e27
cmp dword [rdi], 0x4550
cmove rbx, rdi
mov rax, rbx
jmp 0x140054e29
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140055050
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push r13
push r14
sub rsp, 0x58
mov rax, qword [0x1400ced18]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [rsp + 0xa0]
mov r14, r9
mov r13, rdx
mov rbp, rcx
cmp r8d, 0xc
jge 0x140055088
xor eax, eax
jmp 0x1400551a7
mov eax, dword [0x1400d0e6c]
inc eax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r15
mov dword [0x1400d0e6c], eax
cmp eax, 1
jne 0x1400550bf
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
xor eax, 0xbb40e64e
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov r8, rbx
mov rdx, r14
mov rcx, rbp
call fcn.140055210
xor esi, esi
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
sar eax, 7
mov rdx, rbx
mov rcx, r14
movzx r8d, al
call fcn.1400551c0
mov rdx, rbx
mov edi, eax
call fcn.140055290
xor r8b, dil
mov byte [rsp + rsi + 0x20], r8b
inc rsi
cmp rsi, 0xa
jl 0x1400550d0
mov r8, rbx
mov rdx, r14
mov rcx, rbp
call fcn.140055210
lea r15, [rsp + 0x20]
mov rsi, r13
sub r15, r13
mov ebp, 0xa
mov rdx, rbx
mov rcx, r14
call fcn.1400551c0
movzx r8d, byte [r15 + rsi]
mov rdx, rbx
mov edi, eax
call fcn.140055290
xor r8b, dil
mov byte [rsi], r8b
lea rsi, [rsi + 1]
sub rbp, 1
jne 0x140055121
mov rcx, r14
call fcn.1400551c0
mov ebp, dword [rsp + 0xa8]
mov rdx, rbx
mov edi, ebp
mov esi, eax
shr edi, 0x10
movzx r8d, dil
call fcn.140055290
xor dil, sil
mov rcx, r14
mov byte [r13 + 0xa], dil
call fcn.1400551c0
shr ebp, 0x18
mov rdx, rbx
mov r8d, ebp
mov edi, eax
call fcn.140055290
mov r15, qword [rsp + 0x40]
xor bpl, dil
mov rdi, qword [rsp + 0x48]
mov eax, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov rsi, qword [rsp + 0x50]
mov byte [r13 + 0xb], bpl
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140082550
add rsp, 0x58
pop r14
pop r13
pop rbp
pop rbx
ret

Function at 0x140055290
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov r10d, dword [rcx]
mov r11, rcx
mov r9d, r10d
mov eax, r8d
xor r9, rax
shr r10d, 8
movzx eax, r9b
mov r9d, dword [rdx + rax*4]
xor r9d, r10d
mov dword [rcx], r9d
movzx eax, r9b
add eax, dword [rcx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [rcx + 4], eax
mov ecx, dword [rcx + 8]
shr rax, 0x18
xor rax, rcx
shr ecx, 8
movzx eax, al
mov eax, dword [rdx + rax*4]
xor eax, ecx
mov dword [r11 + 8], eax
mov eax, r8d
ret
Function at 0x140055790
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x40e8], 0
mov rbx, rcx
je 0x140055816
mov qword [rsp + 0x30], rbp
xor ebp, ebp
cmp dword [rcx + 0xbc], ebp
jbe 0x140055811
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r14
mov r9, qword [rbx + 0x40f8]
lea rcx, [rbx + 0x40ec]
mov rdx, r9
call fcn.1400551c0
movzx r8d, byte [rbp + rbx + 0xe0]
lea rcx, [rbx + 0x40ec]
mov rdx, r9
mov esi, eax
call fcn.140055290
xor byte [rbp + rbx + 0xe0], sil
inc ebp
cmp ebp, dword [rbx + 0xbc]
jb 0x1400557c0
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov r9d, dword [rbx + 0xbc]
lea r8, [rbx + 0xe0]
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbx + 0x38]
call qword [rbx + 0x10]
xor ecx, ecx
mov edx, 0xffffffff
cmp eax, dword [rbx + 0xbc]
mov dword [rbx + 0xbc], 0
cmovne ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x1400596e0
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rbx, r8
mov rbp, rdx
mov r14, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov r12, rax
mov qword [rsp + 0x58], rax
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rdi, rax
mov qword [rsp + 0xc8], rax
mov rcx, r12
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rsi, rax
mov qword [rsp + 0x60], rax
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rsp + 0x50], rax
mov rcx, r14
call fcn.1400702fc
sub ebx, ebp
mov r15d, dword [rsp + 0xc4]
mov r13d, dword [rsp + 0xbc]
sub r15d, r13d
test eax, eax
je 0x1400597ab
mov dword [rsp + 0xc8], ebx
mov dword [rsp + 0xcc], r15d
test ebx, ebx
jle 0x1400597a6
test r15d, r15d
jle 0x1400597a6
and qword [rsp + 0xc0], 0
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xc8]
call fcn.14005b228
jmp 0x1400597b9
xor r12d, r12d
jmp 0x1400597bc
mov r8d, r15d
mov edx, ebx
mov rcx, r12
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov r12, rax
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
mov r14, rax
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r15d
mov r9d, ebx
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.GDI32.dll_BitBlt]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
nop
test rsi, rsi
je 0x14005982e
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteDC]
nop
test rdi, rdi
je 0x14005983c
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rax, r12
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140059cd8
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x1400ced18]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov eax, dword [0x1400d0e78]
lea ecx, [rax - 1]
cmp ecx, 0x13
jbe 0x140059eb7
mov ebx, 0x11c
lea rcx, [rsp + 0x40]
mov r8d, ebx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ebx, eax
test eax, eax
jne 0x140059d54
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], VarUI4FromDisp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140059eb5
mov ecx, dword [rsp + 0x50]
sub ecx, 1
je 0x140059ed7
cmp ecx, 1
jne 0x140059eb5
mov eax, dword [rsp + 0x44]
cmp eax, 4
ja 0x140059d85
mov dword [0x1400d0e78], 2
lea eax, [rcx + 1]
jmp 0x140059eb7
mov ecx, dword [rsp + 0x48]
cmp eax, 5
jne 0x140059db7
test ecx, ecx
jne 0x140059da4
mov dword [0x1400d0e78], 6
lea eax, [rcx + 6]
jmp 0x140059eb7
cmp ecx, 2
jne 0x140059df9
lea eax, [rcx + 6]
mov dword [0x1400d0e78], eax
jmp 0x140059eb7
cmp eax, 6
jne 0x140059df0
mov eax, dword [rsp + 0x48]
test eax, eax
jne 0x140059dcb
mov eax, 9
jmp 0x140059dac
cmp eax, 1
jne 0x140059de4
mov dword [0x1400d0e78], 0xa
mov eax, 0xa
jmp 0x140059eb7
cmp eax, 2
jne 0x140059df2
mov eax, VariantTimeToDosDateTime
jmp 0x140059dac
jb 0x140059df9
mov eax, 0x14
jmp 0x140059dac
test ebx, ebx
je 0x140059e14
cmp eax, 5
jne 0x140059eb5
cmp ecx, 1
jne 0x140059eb5
lea eax, [rcx + 6]
jmp 0x140059dac
xor edx, edx
lea rcx, [rbp + 0x60]
mov r8d, 0xa0
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlProductOptions
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.ProductType
lea rax, [rbp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x60]
lea rcx, str.WINNT
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea rdx, [rbp + 0x60]
lea rcx, str.LANMANNT
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea rdx, [rbp + 0x60]
lea rcx, str.SERVERNT
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor eax, eax
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.140082550
mov rbx, qword [rsp + 0x220]
add rsp, 0x210
pop rbp
ret
cmp dword [rsp + 0x44], 4
jne 0x140059eb5
mov eax, dword [rsp + 0x48]
test eax, eax
jne 0x140059ef0
mov eax, 3
jmp 0x140059dac
cmp eax, 0xa
jne 0x140059f06
mov dword [0x1400d0e78], 4
mov eax, 4
jmp 0x140059eb7
cmp eax, 0x5a
jne 0x140059eb5
mov dword [0x1400d0e78], 5
mov eax, 5
jmp 0x140059eb7
Function at 0x14005a8a0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x160
mov rax, qword [0x1400ced18]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov rsi, rcx
mov dword [rsp + 0x20], VarUI4FromDisp
lea rcx, [rsp + 0x20]
mov r14d, edx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x30], 2
jne 0x14005a9f9
cmp dword [rsp + 0x24], 5
jb 0x14005a9f9
xor edi, edi
test rsi, rsi
je 0x14005a9f9
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14005a9f9
xorps xmm0, xmm0
lea r8d, [rdi + 0xa]
xor eax, eax
lea rdx, [rsp + 0x140]
mov rcx, rsi
mov dword [rsp + 0x150], eax
movups xmmword [rsp + 0x140], xmm0
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, str.32768
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ebx, edi
mov rcx, rsi
test eax, eax
sete bl
call fcn.14005a850
test eax, eax
je 0x14005a96f
test ebx, ebx
jne 0x14005a96f
lea eax, [rdi + 1]
jmp 0x14005a9fb
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005a9f5
lea rdx, str.SetLayeredWindowAttributes
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
test rax, rax
je 0x14005a9f5
mov ebx, 0xffffffec
mov rcx, rsi
mov edx, ebx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov edx, ebx
mov rcx, rsi
bts rax, 0x13
mov r8, rax
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
imul edx, r14d, 0xff
mov rcx, rsi
mov rbx, rax
mov eax, 0x51eb851f
imul edx
mov r8d, edx
sar r8d, 5
mov edx, r8d
shr edx, 0x1f
add r8d, edx
xor edx, edx
lea r9d, [rdx + 2]
call rbp
test ebx, ebx
je 0x14005a9f5
test eax, eax
je 0x14005a9f5
mov edi, 1
mov eax, edi
jmp 0x14005a9fb
xor eax, eax
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.140082550
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400613a0
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x1400ced18]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov rbx, r8
mov r14, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x40]
mov r15d, r9d
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x40]
mov r8d, 0x7f
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1400614f6
mov esi, 1
mov rcx, r14
mov edx, esi
call qword [sym.imp.GDI32.dll_SetBkMode]
mov rdx, qword [rdi + 0x90]
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov r8d, dword [rdi + 0xb8]
mov r12, rax
mov ecx, dword [rbx]
cmp r8d, 3
jne 0x140061440
add ecx, r8d
mov edx, dword [rbx + 4]
mov eax, dword [rbx + 8]
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x30], ecx
cmp r8d, 3
jne 0x140061457
add eax, 0xfffffffd
mov dword [rsp + 0x38], eax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x3c], eax
test r15d, r15d
je 0x140061475
add ecx, 2
lea eax, [rdx + 2]
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], eax
cmp dword [rbp + 0xb0], 0
jne 0x140061486
mov ebx, dword [rdi + 0x80]
jmp 0x14006148b
mov ebx, 0x99a8ac
call fcn.140070434
test eax, eax
je 0x140061499
test r15d, r15d
jne 0x14006149b
xor esi, esi
cmp dword [rdi + 0xd0], 0
jne 0x1400614a8
test esi, esi
je 0x1400614ad
mov ebx, 0xffffff
mov edx, ebx
mov rcx, r14
call qword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [rdi + 0x8c]
lea r9, [rsp + 0x30]
bts edx, 0xf
or r8d, 0xffffffff
mov dword [rsp + 0x20], edx
mov rcx, r14
lea rdx, [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.USER32.dll_DrawTextW]
mov edx, ebx
mov rcx, r14
call qword [sym.imp.GDI32.dll_SetTextColor]
mov rdx, r12
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.140082550
add rsp, 0x150
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14006a76d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test rdx, rdx
je 0x14006a923
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x1400ced18]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rdx
mov rbp, rcx
test rcx, rcx
je 0x14006a906
mov eax, dword [rdx + 4]
xor esi, esi
mov ecx, dword [rdx]
xor r14d, r14d
mov r12d, dword [rdx + 0xc]
mov r13d, dword [rdx + 8]
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x44], r12d
sub r12d, eax
mov eax, r8d
mov dword [rsp + 0x40], r13d
shr eax, 0x10
sub r13d, ecx
movzx r10d, al
mov eax, r9d
shr eax, 0x10
movzx r11d, al
movzx edx, r8w
shr edx, 8
movzx ecx, r9w
shr ecx, 8
movzx eax, r9b
xor r15d, r15d
movzx edi, r8b
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], edx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x2c], r10d
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x34], edi
imul ecx, esi
mov eax, edx
mov edx, dword [rsp + 0x20]
mov r9d, 0x40
sub r9d, esi
imul edx, esi
imul eax, r9d
add ecx, eax
mov eax, r10d
sar ecx, 6
movzx r8d, cl
mov ecx, r11d
imul ecx, esi
imul eax, r9d
shl r8d, 8
add ecx, eax
mov eax, edi
sar ecx, 6
movzx ecx, cl
imul eax, r9d
shl ecx, 0x10
or ecx, r8d
add edx, eax
sar edx, 6
movzx eax, dl
or ecx, eax
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
cmp dword [rsp + 0xc0], 0
mov rdi, rax
jne 0x14006a89a
mov edx, dword [rbx + 4]
lea r8d, [r15 + r12]
sar r8d, 6
mov r9d, r15d
sar r9d, 6
lea ecx, [r9 + rdx]
mov dword [rsp + 0x3c], ecx
lea ecx, [r8 + rdx]
sub r8d, r9d
mov dword [rsp + 0x44], ecx
test r8d, r8d
jmp 0x14006a8be
mov ecx, dword [rbx]
lea edx, [r14 + r13]
sar edx, 6
mov r8d, r14d
sar r8d, 6
lea eax, [r8 + rcx]
mov dword [rsp + 0x38], eax
lea eax, [rdx + rcx]
sub edx, r8d
mov dword [rsp + 0x40], eax
test edx, edx
jle 0x14006a8d1
mov r8, rdi
lea rdx, [rsp + 0x38]
mov rcx, rbp
call qword [sym.imp.USER32.dll_FillRect]
test rdi, rdi
je 0x14006a8df
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [rsp + 0x24]
inc esi
mov ecx, dword [rsp + 0x28]
add r15d, r12d
mov r10d, dword [rsp + 0x2c]
add r14d, r13d
mov r11d, dword [rsp + 0x30]
mov edi, dword [rsp + 0x34]
cmp esi, 0x40
jl 0x14006a80c
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140082550
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14006acbc
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r15, r8
mov r12, rdx
mov rbx, rcx
test rcx, rcx
je 0x14006ae9c
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x14006ae9c
and qword [rsp + 0x30], 0
xor r9d, r9d
and dword [rsp + 0x28], 0
xor r8d, r8d
and qword [rbp - 0x18], 0
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14006ae9c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
lea ecx, [r14 - 1]
cmp ecx, 0x63ffffe
ja 0x14006ae93
mov edx, r14d
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x14006ae8e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14006ae8e
and dword [rbp + 0x30], 0
lea r9, [rbp + 0x30]
and qword [rsp + 0x20], 0
mov r8d, r14d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test ebx, ebx
je 0x14006ae8e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbp - 0x10], 0
lea r8, [rbp - 0x10]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14006ae9c
lea rax, [rbp - 0x18]
xor r8d, r8d
lea r9, [0x1400b22f0]
mov qword [rsp + 0x20], rax
mov edx, r14d
call qword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov rcx, qword [rbp - 0x10]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14006ae9c
mov rax, qword [rcx]
lea rdx, [rbp + 0x48]
call qword [rax + 0x30]
mov rcx, qword [rbp - 0x18]
lea rdx, [rbp - 0x20]
mov rax, qword [rcx]
call qword [rax + 0x38]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov edx, 0x58
mov rdi, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, dword [rbp + 0x48]
mov ebx, 0x9ec
mov ecx, eax
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, 0x5a
mov rcx, rdi
mov dword [r12], eax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, dword [rbp - 0x20]
mov r8d, ebx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov rbx, qword [rbp - 0x18]
mov rdx, rdi
mov rcx, rsi
mov dword [r15], eax
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rax, rbx
jmp 0x14006ae9e
test rdi, rdi
je 0x14006ae9c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret