joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180011760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180071400]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
lea rcx, [rbp - 0x30]
xor ebx, ebx
mov r12, r9
mov r15, r8
mov r14d, edx
mov word [rbp - 0x2c], 0x3233
mov dword [rbp - 0x2a], 0x6c6c642e
mov word [rbp - 0x2f], 0x6573
mov byte [rbp - 0x26], bl
mov byte [rbp - 0x30], 0x55
mov byte [rbp - 0x2d], 0x72
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x18000ea4f
lea rdx, [rbp - 0x20]
mov rcx, rax
mov word [rbp - 0x14], 0x7845
mov byte [rbp - 0x12], bl
mov dword [rbp - 0x19], 0x6f6f4874
mov dword [rbp - 0x1d], 0x78654e6c
mov word [rbp - 0x1f], 0x6c61
mov byte [rbp - 0x15], 0x6b
mov byte [rbp - 0x20], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000ea46
mov r9, r12
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180012c90
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r9, r8
mov r8, rdx
mov edx, ecx
xor ecx, ecx
jmp 0x18000e9a0

Function at 0x180012150
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x500
mov rax, qword [0x180071400]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov ebp, r8d
mov rsi, rdx
mov r8d, ecx
mov ecx, 0x1fffff
xor edx, edx
call fcn.18000efa0
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x180012225
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, rbx
cmp eax, 0xffffffff
je 0x180012257
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x518], rdi
mov dword [rsp + 0x50], 0x100001
xor edi, edi
call fcn.18000ed70
test eax, eax
je 0x18001221a
nop
mov rcx, qword [rsp + 0x118]
cmp rcx, rsi
jb 0x18001221a
lea rax, [rsi + rbp]
cmp rcx, rax
jae 0x18001221a
mov rcx, rbx
call fcn.18000f300
cmp edi, 3
jge 0x18001224a
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SuspendThread]
lea rdx, [rsp + 0x20]
mov rcx, rbx
inc edi
call fcn.18000ed70
test eax, eax
jne 0x1800121d0
mov rax, rbx
mov rdi, qword [rsp + 0x518]
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.180012c90
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x18001221d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x180012225
Function at 0x14000bd20
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x1408
call fcn.140027e40
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1380], 0xfffffffffffffffe
mov edi, edx
mov rsi, rcx
mov rax, qword [0x1400551a0]
movabs rcx, 0x9c2bc6fc7fe47873
movabs r14, 0xc79b59d94b4588bb
mov rax, qword [rax + rcx]
add rax, r14
movabs rdx, 0x9c2bc6fc7fe47a33
add rdx, qword [0x1400551a8]
lea rbx, [0x140056f0e]
mov rcx, rbx
call rax
mov rax, qword [0x1400551a0]
movabs rcx, 0x9c2bc6fc7fe4787b
mov rax, qword [rax + rcx]
add rax, r14
lea rcx, [rbp + 0x1350]
mov rdx, rbx
call rax
mov rax, qword [0x1400551b8]
movabs rcx, 0xee08528600def64
movabs r10, 0x3b6b366487b3ec82
add r10, qword [rax + rcx]
lea rcx, [rbp - 0x50]
mov edx, edi
mov r8d, 0xffffffff
mov r9d, 0x6c078965
call r10
mov rax, qword [0x1400551a0]
movabs rcx, 0x9c2bc6fc7fe47883
mov rax, qword [rax + rcx]
movabs rbx, 0xc79b59d94b4588bb
add rax, rbx
lea rdi, [rbp + 0x1350]
lea rdx, [rbp + 0x1370]
mov rcx, rdi
call rax
mov rax, qword [0x1400551a0]
movabs rcx, 0x9c2bc6fc7fe4788b
mov rax, qword [rax + rcx]
add rax, rbx
lea rdx, [rbp + 0x1378]
mov rcx, rdi
call rax
mov rdi, qword [rbp + 0x1378]
mov rbx, qword [rbp + 0x1370]
mov rax, qword [0x1400551c0]
movabs rcx, 0x8b247c08cb28b0dd
movabs r15, 0x39de18812c7b3f96
mov r8, qword [rax + rcx]
add r8, r15
lea rcx, [rbp + 0x1338]
lea rdx, [rbp - 0x50]
call r8
mov rax, qword [0x1400551c0]
movabs rcx, 0x8b247c08cb28b0e5
add r15, qword [rax + rcx]
lea r14, [rbp + 0x1338]
mov rcx, rdi
mov rdx, rbx
mov r8, r14
call r15
mov rax, qword [0x1400551d8]
movabs rcx, 0x6aa1696a586d2ab5
movabs rdi, 0xff6f1c02d01e498e
mov rdx, qword [rax + rcx]
add rdx, rdi
mov rcx, r14
call rdx
mov rax, qword [0x1400551d8]
movabs rcx, 0x6aa1696a586d2abd
add rdi, qword [rax + rcx]
mov qword [rsp + 0x20], r14
lea rdx, [rbp + 0x1350]
mov r9d, 0x10
mov rcx, rsi
xor r8d, r8d
call rdi
mov rax, qword [0x1400551a0]
movabs rcx, 0x9c2bc6fc7fe47893
movabs rdx, 0xc79b59d94b4588bb
add rdx, qword [rax + rcx]
lea rcx, [rbp + 0x1350]
call rdx
mov rax, rsi
add rsp, 0x1408
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret

Function at 0x140028f1c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140028f66
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140028f66
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140028f66
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140028f66
cmp dword [rcx + 0x84], 0xe
jbe 0x140028f66
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140028f68
xor al, al
add rsp, 0x28
ret

Function at 0x14002d1a8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14002d2f0

Function at 0x14002f9f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002fa18
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002fa18
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140036304
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140036334
xor eax, eax
jmp 0x1400363f7
mov rbp, rbx
cmp word [rax], si
je 0x140036359
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140036340
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14003633c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140036224
movsxd r14, eax
test eax, eax
jne 0x140036397
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14003632d
mov rcx, r14
call fcn.140033f28
mov rdi, rax
test rax, rax
jne 0x1400363b0
xor ecx, ecx
call fcn.1400313f0
jmp 0x14003638c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140036224
test eax, eax
jne 0x1400363e1
mov rcx, rdi
call fcn.1400313f0
jmp 0x1400363eb
xor ecx, ecx
call fcn.1400313f0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140036414
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14003649b
mov rsi, rbx
cmp word [rax], bp
je 0x14003645a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140036444
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140036440
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140033f28
mov rdi, rax
test rax, rax
je 0x140036488
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14002a2c0
mov rbp, rdi
xor ecx, ecx
call fcn.1400313f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003a2a8
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14003a2be
mov al, 1
jmp 0x14003a31e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14003a2cf
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14003a31c
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400368f8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003a31c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14003a31c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14003a31c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14003a31e
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14003a9b8
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14002ecd4
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14003aa42
cmp byte [rbp - 0x21], r15b
je 0x14003aa3d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14003aa78
call fcn.1400321d0
test eax, eax
jne 0x14003aa64
cmp byte [rbp - 0x21], r15b
je 0x14003aa5c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14003aa78
cmp byte [rbp - 0x21], r15b
je 0x14003aa75
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140035e74
test eax, eax
jne 0x14003ab18
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14002ecd4
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14003aab7
cmp byte [rbp - 0x21], r15b
je 0x14003aaec
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14003aaec
call fcn.1400321d0
test eax, eax
jne 0x14003aad8
cmp byte [rbp - 0x21], r15b
je 0x14003aad1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14003aaec
cmp byte [rbp - 0x21], r15b
je 0x14003aae9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140035e74
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14003ab18
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14003ab1b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14003ab29
mov rcx, rdi
call fcn.1400313f0
cmp byte [rbp + 0x3f], r15b
je 0x14003ab38
mov rcx, qword [rbp + 0x27]
call fcn.1400313f0
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400085c4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rsi, rcx
call fcn.140015e24
mov rbx, qword [rax + 0x18]
xor r14d, r14d
cmp rbx, r14
jne 0x140008604
xor al, al
jmp 0x1400087c7
mov r8d, 0xf1
lea r12d, [r8 - 0x71]
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
cmp rax, r14
jne 0x140008626
xor al, al
jmp 0x1400087c7
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, r14
jne 0x14000863e
xor al, al
jmp 0x1400087c7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
cmp rax, r14
jne 0x140008656
xor al, al
jmp 0x1400087c7
movzx edx, word [rax + 2]
mov dword [rsi + 0x28], edx
movzx r8d, word [rax + 4]
mov dword [rsi + 0x2c], r8d
movzx eax, word [rax + 6]
lea rcx, [rsi + 0x30]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], eax
mov r9d, 5
call fcn.1400173a8
cmp eax, r14d
jne 0x14000868e
xor al, al
jmp 0x1400087c7
mov edi, dword [rsi + 0x58]
mov rbx, qword [rsi + 0x38]
call fcn.140015e24
mov rcx, qword [rax + 0xc8]
mov r8d, edi
mov rdx, rbx
mov rcx, qword [rcx]
call fcn.140008f50
mov qword [rsp + 0x40], r14
lea r15, vtable.CBitmap.0
mov qword [rsp + 0x38], r15
call fcn.140015e24
mov rdx, r12
mov rcx, qword [rax + 0x18]
call qword [sym.imp.USER32.dll_LoadBitmapW]
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140014b40
mov rbx, qword [rsi + 0x38]
call fcn.140015e24
mov rcx, qword [rax + 0xc8]
mov r9d, 0xc0c0c0
mov r8, qword [rsp + 0x40]
mov rdx, rbx
mov rcx, qword [rcx]
call fcn.140008e30
lea rcx, [rsp + 0x38]
call fcn.140014bc0
lea rbx, [rbp + 8]
mov r13d, r14d
mov edi, r14d
cmp r14w, word [rbp + 6]
jae 0x1400087b6
movzx r12d, word [rbx]
cmp r12w, r14w
je 0x1400087a4
mov eax, dword [rsi + 0x88]
cmp eax, r14d
jne 0x140008750
mov edx, 8
lea ecx, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsi + 0x90], rax
jmp 0x140008773
inc eax
movsxd rdx, eax
shl rdx, 3
mov r8d, 0x42
mov rcx, qword [rsi + 0x90]
call qword [sym.imp.KERNEL32.dll_GlobalReAlloc]
mov qword [rsi + 0x90], rax
movzx edx, r12w
movsxd rcx, dword [rsi + 0x88]
mov rax, qword [rsi + 0x90]
mov dword [rax + rcx*8 + 4], edx
movsxd rcx, dword [rsi + 0x88]
mov rax, qword [rsi + 0x90]
mov dword [rax + rcx*8], r13d
inc dword [rsi + 0x88]
inc r13d
inc edi
add rbx, 2
movzx ecx, word [rbp + 6]
cmp edi, ecx
jl 0x140008724
mov qword [rsp + 0x38], r15
lea rcx, [rsp + 0x38]
call fcn.1400076c0
mov al, 1
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140009958
Capabilities:
Enumerate pe sections

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rdx, qword [rcx]
mov esi, 1
xor ebx, ebx
movzx eax, word [rdx + 0x14]
mov r15, qword [rdx + 0x30]
mov r12, rcx
lea r9, [rax + rdx + 0x18]
movabs rax, 0xffffffff00000000
mov r10d, dword [r9 + 8]
and r15, rax
mov eax, dword [r9 + 0x10]
or r10, r15
mov qword [r11 - 0x48], r10
mov r11d, dword [rcx + 0x24]
sub r11d, esi
not r11d
and r11, r10
mov qword [rsp + 0x28], r11
cmp eax, ebx
jne 0x1400099d6
test byte [r9 + 0x24], 0x40
je 0x1400099cc
mov eax, dword [rdx + 0x20]
jmp 0x1400099d6
test byte [r9 + 0x24], 0x80
je 0x1400099d6
mov eax, dword [rdx + 0x24]
mov ecx, dword [r9 + 0x24]
mov r8d, eax
mov dword [rsp + 0x3c], ebx
mov qword [rsp + 0x30], r8
mov r13d, esi
mov dword [rsp + 0x38], ecx
cmp si, word [rdx + 6]
jae 0x140009aaa
lea rdi, [r9 + 0x4c]
mov eax, dword [r12 + 0x24]
mov r14d, dword [rdi - 0x1c]
mov ebp, dword [rdi - 0x14]
sub eax, esi
or r14, r15
not eax
mov esi, eax
and rsi, r14
cmp ebp, ebx
jne 0x140009a29
test byte [rdi], 0x40
je 0x140009a21
mov ebp, dword [rdx + 0x20]
jmp 0x140009a29
test byte [rdi], 0x80
je 0x140009a29
mov ebp, dword [rdx + 0x24]
cmp r11, rsi
je 0x140009a63
lea rax, [r8 + r10]
cmp rax, rsi
ja 0x140009a63
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.14000986c
cmp eax, ebx
je 0x140009ae0
mov ecx, dword [rdi]
mov r10, r14
mov qword [rsp + 0x20], r14
mov r11, rsi
mov qword [rsp + 0x28], rsi
mov r8d, ebp
jmp 0x140009a84
mov eax, dword [rdi]
bt eax, 0x19
jae 0x140009a75
bt ecx, 0x19
jae 0x140009a75
or ecx, eax
jmp 0x140009a7b
or ecx, eax
btr ecx, 0x19
mov r8d, ebp
sub r8, r10
add r8, r14
mov rdx, qword [r12]
mov esi, 1
add rdi, 0x28
movzx eax, word [rdx + 6]
add r13d, esi
mov dword [rsp + 0x38], ecx
cmp r13d, eax
mov qword [rsp + 0x30], r8
jl 0x1400099fb
lea rdx, [rsp + 0x20]
mov rcx, r12
mov dword [rsp + 0x3c], esi
call fcn.14000986c
cmp eax, ebx
setne bl
mov eax, ebx
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor eax, eax
jmp 0x140009ac2
Function at 0x14000a430
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x140062bf8]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rdi, rcx
call fcn.140012400
lea rcx, [rsp + 0x52]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], si
call fcn.140032db0
lea ebx, [rsi + 1]
lea r8d, [rsi + 0x23]
lea rdx, [rsp + 0x50]
mov r9d, ebx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, str.ckq
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov r8d, ebx
mov edx, 0x40000000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r9, [rsp + 0x40]
lea rdx, [0x140084180]
mov r8d, 0xc34b1d
mov rcx, rax
mov rbx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140064780]
mov edx, 0x1fa00
call fcn.140009be8
mov rbx, rax
cmp rax, rsi
je 0x14000a568
lea rdx, [0x1412f4cdc]
mov rcx, rax
call fcn.140009ae4
cmp rax, rsi
je 0x14000a522
call rax
cmp dword [rbx + 0x1c], esi
je 0x14000a53d
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
xor r8d, r8d
mov r9d, dword [rax + 0x28]
xor edx, edx
add r9, rcx
call r9
mov rcx, qword [rbx + 8]
cmp rcx, rsi
je 0x14000a554
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rdi + 0xe8]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400323f0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14000a594
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_640
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xb0], rdx
test rdx, 0xffffffffffff0000
jne 0x14001b2c3
cmp dword [rcx + 0xa8], 0
jne 0x14001b2c3
movzx eax, dx
mov dword [rcx + 0xa8], eax
call fcn.140015e24
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.14001b228
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000b5cc
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.14001c828
mov rsi, rax
test rax, rax
je 0x14000b648
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x14000b643
cmp dword [rbx], 0x40
jb 0x14000b643
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x14000b643
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x14000b64c
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140012120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x140012188
call fcn.140015e24
mov r8d, pe_nt_image_headers64
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140012188
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x1400121aa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.140011b30
mov esi, eax
test rdi, rdi
je 0x1400121a8
test rbx, rbx
je 0x1400121a8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x140012988
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xa0], 0
jne 0x1400129c6
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x140012a7a
call fcn.1400137dc
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1400129e5
mov ecx, 0x80004005
call fcn.140001b20
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rbx + 0xa0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x118]
mov rdx, rsi
or rsi, 0xffffffffffffffff
mov r9, rsi
mov r8, qword [rsp + 0x40]
mov rcx, rdi
call fcn.140033cb4
test eax, eax
je 0x140012a4d
cmp eax, 0xc
je 0x140012a47
cmp eax, 0x16
je 0x140012a41
cmp eax, 0x22
je 0x140012a41
cmp eax, 0x50
je 0x140012a4d
call fcn.140013b08
int3
call fcn.140013b08
int3
call fcn.140013ac0
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x140012a78
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400196c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
xor esi, esi
xor ebx, ebx
mov r12, r9
mov rdi, r8
mov rbp, rdx
mov r14, rcx
test r8, r8
je 0x140019732
call fcn.140015e24
mov r8d, pe_nt_image_headers64
mov rdx, rdi
mov r13, qword [rax + 0x18]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140019732
mov rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x14001977f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
mov edi, 1
test rsi, rsi
je 0x14001975f
mov r10, qword [r14]
mov r9, r12
mov r8, rsi
mov rdx, rbp
mov rcx, r14
call qword [r10 + 0x40]
mov edi, eax
test rbx, rbx
je 0x14001975f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
cmp qword [rbp + 0x98], 0
je 0x14001977d
mov rcx, qword [rbp + 0x98]
mov rdx, r12
mov r8, qword [rcx]
call qword [r8 + 0x140]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret