joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a9560
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400a9612
call qword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x1400a9612
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a9612
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400a95a0
cmp rax, 2
jbe 0x1400a9612
movzx eax, word [0x140455b60]
cmp word [rbx], ax
je 0x1400a95d6
mov r8d, 1
lea rdx, str._USERPROFILE__:Users_
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
jne 0x1400a9612
test rdi, rdi
jne 0x1400a95f0
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14004d8f0
mov rcx, rax
call fcn.14007d390
mov r8, rdi
lea rdx, [0x14007d250]
mov rcx, rbx
call fcn.1400525e0
mov eax, 1
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400b0430
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
or rdi, 0xffffffffffffffff
mov rcx, qword [rcx + 0x440]
test rcx, rcx
je 0x1400b047e
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400b0450
test rax, rax
je 0x1400b047e
call fcn.14004baa0
mov rcx, rax
mov rbx, rax
call qword [sym.imp.SHLWAPI.dll_PathParseIconLocationW]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call fcn.1400b1fc0
xor esi, esi
test eax, eax
je 0x1400b0502
xor r8d, r8d
mov qword [rsp + 0x30], rbp
xor edx, edx
lea rcx, str.C:WindowsSystem32msiexec.exe
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebp, eax
test eax, eax
je 0x1400b04ea
mov eax, 2
mul rbp
cmovo rax, rdi
mov rcx, rax
call fcn.140125a94
lea r8, [rbp*2]
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.1402767a0
mov r8d, ebp
lea rcx, str.C:WindowsSystem32msiexec.exe
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rbp, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x428]
test rcx, rcx
je 0x1400b051f
mov rax, rdi
inc rax
cmp word [rcx + rax*2], si
jne 0x1400b0511
test rax, rax
jne 0x1400b053e
mov rcx, qword [rbx + 0x430]
test rcx, rcx
je 0x1400b0543
mov rax, rdi
nop
inc rax
cmp word [rcx + rax*2], si
jne 0x1400b0530
test rax, rax
je 0x1400b0543
mov rsi, rcx
jmp 0x1400b0560
mov rax, qword [rbx + 0x458]
test rax, rax
je 0x1400b0560
nop
inc rdi
cmp word [rax + rdi*2], si
jne 0x1400b0550
test rdi, rdi
cmovne rsi, rax
mov rcx, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.140054780
Function at 0x1400b2120
Capabilities:
Check if file exists

Disassembly:
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x488
mov rax, qword [0x1403a0088]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r15, qword [rsp + 0x4e0]
xor r14d, r14d
mov qword [rsp + 0x30], rcx
mov rdi, r9
mov r12, r8
mov r13, rdx
mov rbp, rcx
test rdx, rdx
je 0x1400b239a
test r8, r8
je 0x1400b239a
test r15, r15
je 0x1400b239a
mov rcx, r15
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400b239a
mov r8, r12
mov qword [rsp + 0x478], rsi
mov rdx, r13
mov rcx, rbp
call fcn.14005f970
mov rsi, rax
test rax, rax
je 0x1400b238d
mov rcx, rax
mov qword [rsp + 0x480], rbx
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
mov r9, rdi
lea r8, [0x140336574]
mov edx, 0x104
lea rcx, [rsp + 0x250]
call fcn.14004e9f0
mov eax, Ordinal_46
lea r8, [0x140336b18]
mov r9, rdi
mov word [rsp + 0x250], ax
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.14004e9f0
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
or rbx, 0xffffffffffffffff
test eax, eax
jne 0x1400b2253
mov rax, rbx
nop dword [rax]
cmp word [rdi + rax*2 + 2], r14w
lea rax, [rax + 1]
jne 0x1400b2220
lea r8, [0x140336b28]
lea rax, [rsi + rax*2]
mov r9, r15
mov edx, 0x104
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x40]
call fcn.14004e9f0
jmp 0x1400b234b
xor r8d, r8d
lea rdx, [rsp + 0x250]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
jne 0x1400b2289
mov r9, r15
lea r8, [0x140336be8]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.14004e9f0
jmp 0x1400b234b
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
jne 0x1400b22b9
mov rax, rbx
cmp word [rdi + rax*2 + 2], r14w
lea rax, [rax + 1]
jne 0x1400b22a1
lea r8, [0x140336bf0]
jmp 0x1400b2233
mov rcx, rsi
call fcn.14004baa0
mov rcx, rax
mov rbp, rax
call qword [sym.imp.SHLWAPI.dll_PathGetArgsW]
test rax, rax
je 0x1400b22db
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
jne 0x1400b2334
mov rax, rbx
nop dword [rax]
cmp word [rdi + rax*2 + 2], r14w
lea rax, [rax + 1]
jne 0x1400b2300
lea rax, [rsi + rax*2]
mov r9, r15
lea r8, [0x140336c00]
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.14004e9f0
mov r14d, 1
test rbp, rbp
je 0x1400b2341
mov rcx, rbp
call fcn.140125e14
test r14d, r14d
je 0x1400b237d
mov rbp, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
cmp word [rax + rbx*2 + 2], 0
lea rbx, [rbx + 1]
jne 0x1400b2350
lea eax, [rbx*2 + 2]
mov r8, r12
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov rdx, r13
mov rcx, rbp
call fcn.14005fce0
mov r14d, eax
mov rcx, rsi
call fcn.140125e14
mov rbx, qword [rsp + 0x480]
mov rsi, qword [rsp + 0x478]
mov eax, r14d
jmp 0x1400b239c
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140125a70
add rsp, 0x488
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x1400b23c0
Capabilities:
Check if file exists

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1403a0088]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400b24e0
test rdx, rdx
je 0x1400b24e0
test rbx, rbx
je 0x1400b24e0
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400b24e0
lea rax, [rdi + 0x210]
mov edx, 0x104
lea r9, [rdi + 8]
mov qword [rsp + 0x20], rax
lea r8, [0x140336c10]
lea rcx, [rsp + 0x30]
call fcn.14004e9f0
mov rcx, qword [rdi]
lea r8, str.DisplayIcon
mov r9, rsi
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x30]
call fcn.1400b2120
mov rcx, qword [rdi]
lea r8, str.InstallLocation
mov r9, rsi
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x30]
call fcn.1400b2120
mov rcx, qword [rdi]
lea r8, str.InstallSource
mov r9, rsi
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x30]
call fcn.1400b2120
mov rcx, qword [rdi]
lea r8, str.ModifyPath
mov r9, rsi
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x30]
call fcn.1400b2120
mov rcx, qword [rdi]
lea r8, str.UninstallString
mov r9, rsi
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x30]
call fcn.1400b2120
mov rcx, qword [rdi]
lea r8, str.QuietUninstallString
mov r9, rsi
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x30]
call fcn.1400b2120
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140125a70
add rsp, 0x250
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400b4430
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov dword [rcx + 0xae0], 1
mov rcx, qword [rcx + 0xae8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edi, edi
mov rcx, rbx
mov qword [rbx + 0xae8], rdi
mov dword [rbx + 0xae0], edi
call fcn.1400b4b00
test eax, eax
je 0x1400b44c6
cmp qword [rbx + 0xad0], rdi
je 0x1400b44c6
cmp qword [rbx + 0xab0], rdi
je 0x1400b44c6
cmp qword [0x140457e48], rdi
je 0x1400b44c6
mov rcx, rbx
call fcn.1400b5030
mov r9, rbx
mov qword [rsp + 0x28], rdi
lea r8, [0x1400b4ae0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0xae8], rax
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x402
call qword [sym.imp.USER32.dll_PostMessageW]
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1400b5cf0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1403a0088]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor ebx, ebx
lea rax, [rsp + 0x30]
movzx edi, cx
mov qword [rsp + 0x30], rbx
mov esi, 1
mov qword [rsp + 0x20], rax
mov r9d, esi
lea rdx, [0x140337c28]
lea r8d, [rbx + 4]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
je 0x1400b5d5b
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400b5d57
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1400b5d95
lea rcx, str.X:WindowsSystem32configCOMPONENTS
mov word [str.X:WindowsSystem32configCOMPONENTS], di
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400b5d93
lea r8, str.X:WindowsSystem32configCOMPONENTS
mov rcx, 0xffffffff80000002
lea rdx, [0x140337e48]
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
test eax, eax
cmove ebx, esi
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140125a70
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400b9cd0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
lea ecx, [rbx + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 8
test ax, ax
cmovs ebx, ecx
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400b9cff
or ebx, 1
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400b9d12
or ebx, 2
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400b9d25
or ebx, 4
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400b9d38
or ebx, 0x20
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1400bbbf0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
xor r12d, r12d
mov r15, r9
mov r14, r8
mov ebp, edx
mov rbx, rcx
mov edi, r12d
cmp dword [rcx + 0x548], r12d
jle 0x1400bbc79
mov esi, r12d
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbx + 0x540]
lea rdx, [rsp + 0x90]
mov byte [rsp + 0x90], r12b
mov r9, r15
mov qword [rsp + 0x20], rdx
mov r8, r14
mov edx, ebp
mov rcx, qword [rsi + rax]
mov rax, qword [rcx]
call qword [rax]
cmp byte [rsp + 0x90], r12b
jne 0x1400bbe46
inc edi
add rsi, 8
cmp edi, dword [rbx + 0x548]
jl 0x1400bbc30
sub ebp, 0x100
je 0x1400bbd77
sub ebp, 4
je 0x1400bbcf5
cmp ebp, 2
jne 0x1400bbd5c
mov ecx, r14d
mov dword [rsp + 0x90], r12d
call fcn.140289f78
mov rcx, qword [rbx + 0x160]
lea r8, [rsp + 0x90]
mov word [rsp + 0x90], ax
lea rdx, [0x1400c1b50]
mov r9d, 0x80000012
mov rax, qword [rcx]
call qword [rax + 0x268]
mov rbx, rax
test rax, rax
je 0x1400bbd5c
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x250]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x30]
mov al, 1
jmp 0x1400bbd5e
cmp qword [rbx + 0x168], r12
je 0x1400bbd5c
xor eax, eax
mov dword [rsp + 0x30], 6
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov rax, qword [rbx + 0x190]
mov qword [rsp + 0x44], rax
mov word [rsp + 0x4c], r14w
call fcn.1400b9cd0
mov word [rsp + 0x4e], ax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rbx + 0x168]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov rax, qword [rcx]
call qword [rax + 0x280]
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
cmp r14, 9
jne 0x1400bbd5c
mov rcx, qword [rbx + 0x168]
test rcx, rcx
je 0x1400bbddb
mov rax, qword [rcx]
call qword [rax + 0x200]
test al, al
je 0x1400bbddb
mov rcx, qword [rbx + 0x168]
mov rax, qword [rcx]
call qword [rax + 0x218]
test al, al
je 0x1400bbddb
mov rcx, qword [rbx + 0x168]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
mov rcx, rax
lea rdx, str.RichEditUI
call fcn.1402747e8
test rax, rax
je 0x1400bbddb
mov rax, qword [rbx + 0x168]
cmp byte [rax + 0x719], r12b
jne 0x1400bbd5c
mov rcx, qword [rbx + 0x168]
test rcx, rcx
je 0x1400bbe2d
mov rax, qword [rcx]
call qword [rax + 0x200]
test al, al
je 0x1400bbe2d
mov rcx, qword [rbx + 0x168]
mov rax, qword [rcx]
call qword [rax + 0x218]
test al, al
je 0x1400bbe2d
mov rcx, qword [rbx + 0x168]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
mov rcx, rax
lea rdx, str.WkeWebkitUI
call fcn.1402747e8
test rax, rax
jne 0x1400bbd5c
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov rcx, rbx
setns dl
call fcn.1400bf630
mov al, 1
jmp 0x1400bbd5e
Function at 0x1400bf000
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, qword [rdi + 0xc8]
cmp rax, rcx
je 0x1400bf031
cmp rbx, qword [rdi + 0x168]
je 0x1400bf031
call qword [sym.imp.USER32.dll_SetFocus]
mov rax, qword [rdi + 0x168]
cmp rbx, rax
je 0x1400bf169
test rax, rax
je 0x1400bf0ba
xor eax, eax
mov dword [rsp + 0x30], reloc.WS2_32.dll_socket
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x38], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rdi + 0x168]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov rax, qword [rcx]
call qword [rax + 0x280]
mov rdx, qword [rdi + 0x168]
lea r8, [0x14034b090]
xor r9d, r9d
mov byte [rsp + 0x28], 0
mov rcx, rdi
mov qword [rsp + 0x20], 0
call fcn.1400bfaa0
mov qword [rdi + 0x168], 0
test rbx, rbx
je 0x1400bf169
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp rax, rdi
jne 0x1400bf169
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x200]
test al, al
je 0x1400bf169
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x218]
test al, al
je 0x1400bf169
xor eax, eax
mov qword [rdi + 0x168], rbx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x30], Ordinal_27
mov qword [rsp + 0x38], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rdi + 0x168]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov rax, qword [rcx]
call qword [rax + 0x280]
mov rdx, qword [rdi + 0x168]
lea r8, str.setfocus
xor r9d, r9d
mov byte [rsp + 0x28], 0
mov rcx, rdi
mov qword [rsp + 0x20], 0
call fcn.1400bfaa0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1400c4f00
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x278]
sub rsp, 0x360
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1403a0088]
xor rax, rsp
mov qword [rbp + 0x250], rax
mov rdi, rcx
mov edx, 0xfffffff0
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xff3fffff
or eax, 0x6000000
mov r8d, eax
mov edx, 0xfffffff0
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SetWindowLongW]
lea rsi, [rdi + 0x58]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
mov r8, rax
mov rdx, qword [rdi + 8]
mov rcx, rsi
call fcn.1400bb790
lea rdx, [rdi + 0x40]
xor r14d, r14d
test rdi, rdi
cmove rdx, r14
lea rcx, [rdi + 0x598]
call fcn.1400c2b50
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x60], xmm0
mov dword [rbp + 0x70], r14d
mov byte [rbp + 0x1a4], 1
mov qword [rbp + 0x1a8], r14
movdqa xmmword [rbp + 0x1b0], xmm0
mov rax, qword [rdi]
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [rax + 0x50]
nop
mov rax, qword [rbp - 0x30]
lea rdx, [rsp + 0x40]
mov rcx, rdi
cmp word [rax], r14w
mov rax, qword [rdi]
je 0x1400c502c
call qword [rax + 0x58]
mov rcx, qword [rax]
call fcn.1402884cc
movzx ebx, ax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
cmp rcx, rax
je 0x1400c5002
call fcn.14027b988
lea r9, [rdi + 0x48]
test rdi, rdi
cmove r9, r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
mov r8, qword [rbp - 0x30]
mov rdx, rbx
lea rcx, [rbp + 0x60]
call fcn.1400e1090
mov rbx, rax
jmp 0x1400c506b
call qword [rax + 0x58]
nop
lea r9, [rdi + 0x48]
test rdi, rdi
cmove r9, r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, qword [rax]
lea rcx, [rbp + 0x60]
call fcn.1400e1090
mov rbx, rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
cmp rcx, rax
je 0x1400c506b
call fcn.14027b988
test rbx, rbx
jne 0x1400c50f5
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], r14w
or r8d, 0xffffffff
lea rdx, [0x14034b278]
lea rcx, [rsp + 0x40]
call fcn.1400c2e90
nop
mov rax, qword [rdi]
lea rdx, [rbp + 0x1c0]
mov rcx, rdi
call qword [rax + 0x58]
mov rdx, qword [rax]
lea rcx, [rsp + 0x40]
call fcn.1400c2d30
lea rax, [rbp + 0x1c8]
mov rcx, qword [rbp + 0x1c0]
cmp rcx, rax
je 0x1400c50cf
call fcn.14027b988
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Duilib
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdx, rbx
mov rcx, rsi
call fcn.1400be9c0
lea rdx, [rdi + 0x38]
test rdi, rdi
cmove rdx, r14
lea rcx, [rdi + 0x568]
call fcn.1400c2b50
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + gethostname]
nop
lea rax, [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
cmp rcx, rax
je 0x1400c5134
call fcn.14027b988
nop
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x1400c5142
call fcn.14027b988
mov rcx, qword [rbp + 0x68]
test rcx, rcx
je 0x1400c5150
call fcn.14027b988
xor eax, eax
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.140125a70
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400c70c0
Capabilities:
Get graphical window text

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rdi
mov rax, qword [0x1403a0088]
xor rax, rbp
mov qword [rbp], rax
cmp byte [rcx + 0x30], 0
mov rdi, rcx
je 0x1400c71a5
cmp qword [rcx + 0x20], 0
je 0x1400c71a5
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea r8d, [rax + 1]
movsxd rax, r8d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400c7120
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140126870
sub rsp, rcx
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x1400c71a5
mov rcx, qword [rdi + 8]
mov rdx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rdi + 0x20]
mov rdx, rbx
add rcx, 0x1f8
call fcn.1400c2fa0
mov rbx, qword [rdi + 0x20]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + gethostname]
mov byte [rsp + 0x28], 0
lea r8, str.textchanged
mov rcx, rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov rdx, rbx
call fcn.1400bfaa0
mov rcx, qword [rdi + 0x20]
mov rax, qword [rcx]
call qword [rax + gethostname]
cmp byte [rax + 0x1e1], 0
je 0x1400c71a5
mov rcx, qword [rdi + 0x20]
call fcn.1400db4e0
xor eax, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.140125a70
mov rbx, qword [rbp + 0x20]
mov rdi, qword [rbp + 0x28]
lea rsp, [rbp + 0x10]
pop rbp
ret

Function at 0x1400c7ae0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1400db2c0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x200]
test al, al
jne 0x1400c7b18
cmp qword [rbx + 0x5e0], 0
je 0x1400c7b18
mov rcx, qword [rbx + 0x58]
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.1400bf000
add rsp, 0x20
pop rbx
ret

Function at 0x1400c7b20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x200]
test al, al
jne 0x1400c7b50
cmp qword [rbx + 0x5e0], 0
je 0x1400c7b50
mov rcx, qword [rbx + 0x58]
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.1400bf000
add rsp, 0x20
pop rbx
ret
Function at 0x1400cf4d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r10d, r8d
mov r9, rdx
test rdx, rdx
jne 0x1400cf4e6
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rbx
lea rbx, [0x140338700]
not ecx
cmp r10d, 8
jb 0x1400cf5d8
mov r11, r10
shr r11, 3
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r10d, 0xfffffff8
mov edx, dword [rbx + rax*4]
xor edx, ecx
movzx ecx, byte [r9 + 1]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 2]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 3]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 4]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 5]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 6]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 7]
add r9, 8
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
sub r11, 1
jne 0x1400cf510
test r10d, r10d
je 0x1400cf600
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [rbx + r8*4]
xor ecx, eax
add r10d, 0xffffffff
jne 0x1400cf5e0
mov rbx, qword [rsp]
not ecx
mov eax, ecx
add rsp, 8
ret

Function at 0x1400cff90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov rdi, r9
imul esi, edx
mov rbp, rdx
cmp byte [r9], 0
mov r10, rcx
je 0x1400cffe0
mov rdx, rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x48]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400cffda
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
jmp 0x1400d0011
mov edx, dword [r9 + 0x2c]
mov ecx, dword [r9 + 0x28]
mov qword [rsp + 0x40], rbx
lea eax, [rdx + rsi]
cmp eax, ecx
jbe 0x1400cfff8
sub ecx, edx
mov esi, ecx
add rdx, qword [r9 + 0x20]
mov rcx, r10
mov r8d, esi
call fcn.1402743b0
add dword [rdi + 0x2c], esi
mov rbx, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x58]
xor edx, edx
div rbp
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400d0030
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
sub rsp, 0x38
cmp byte [rcx], 0
mov r14, rdx
mov qword [rsp + 0x58], rbp
mov rbx, rcx
mov qword [rsp + 0x30], rdi
mov edi, 1
je 0x1400d0080
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x60]
mov r8d, edi
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400d007a
mov byte [rbx + 0x10], dil
mov ebp, dword [rsp + 0x60]
jmp 0x1400d00b7
mov qword [rsp + 0x68], rsi
mov esi, dword [rcx + 0x2c]
mov ecx, dword [rcx + 0x28]
lea eax, [rsi + 1]
cmp eax, ecx
jbe 0x1400d0096
mov edi, ecx
sub edi, esi
mov rdx, rsi
mov r8d, edi
add rdx, qword [rbx + 0x20]
lea rcx, [rsp + 0x50]
mov ebp, edi
call fcn.1402743b0
lea eax, [rsi + rdi]
mov rsi, qword [rsp + 0x68]
mov dword [rbx + 0x2c], eax
mov rdi, qword [rsp + 0x30]
cmp ebp, 1
mov rbp, qword [rsp + 0x58]
jne 0x1400d00d8
movzx eax, byte [rsp + 0x50]
mov dword [r14], eax
xor eax, eax
add rsp, 0x38
pop r14
pop rbx
ret
cmp byte [rbx], 0
je 0x1400d00ce
cmp byte [rbx + 0x10], 0
je 0x1400d00ce
or eax, 0xffffffff
add rsp, 0x38
pop r14
pop rbx
ret