joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800036cc
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rdx
xor r15d, r15d
xor edx, edx
mov rsi, r9
mov r13d, r8d
mov r12, rcx
mov rdi, r15
mov ebx, 8
call fcn.180003cc4
mov rbp, rax
cmp rax, r15
je 0x1800037b8
cmp rsi, r15
je 0x180003729
xor edx, edx
mov rcx, rsi
call fcn.180003cc4
mov rdi, rax
cmp rax, r15
je 0x1800037a6
mov rcx, r12
call fcn.1800032e0
mov rsi, rax
cmp rax, r15
je 0x180003761
mov r9d, 1
mov r8d, r13d
mov rdx, r14
mov rcx, rax
call fcn.180003470
mov rcx, qword [0x18000f730]
mov r8, rsi
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, r15d
jne 0x18000378f
lea rdx, [0x180011130]
mov r9, rdi
mov r8, rbp
xor ecx, ecx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, rax
cmp eax, 0x20
cmovg ebx, r15d
cmp rdi, r15
je 0x1800037a6
mov rcx, qword [0x18000f730]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x18000f730]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180003988
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, qword [0x18000f750]
movzx ebp, word [0x18000f738]
mov eax, 0xa04
movsxd rcx, dword [r14 + 0x3c]
xor bp, ax
mov r15, r8
add rcx, r14
xor edi, edi
movzx eax, word [rcx + 6]
lea r8, [rax + rax*4]
movzx eax, word [rcx + 0x14]
add rcx, rax
lea rbx, [rcx + r8*8 + 0x40]
jmp 0x1800039e9
cmp ax, bp
je 0x1800039fa
add rbx, 0x14
movzx eax, word [rbx]
cmp ax, di
jne 0x1800039e0
cmp ax, bp
jne 0x180003ab0
mov r13d, dword [rsp + 0x78]
mov r12d, dword [rsp + 0x70]
test dword [rbx + 4], r13d
je 0x180003a83
cmp r12d, edi
je 0x180003a15
cmp dword [rbx + 8], r12d
jne 0x180003a83
test byte [rbx + 4], 8
jne 0x180003a83
mov r8d, dword [rbx + 0x10]
mov rcx, qword [0x18000f730]
xor edx, edx
inc r8d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
cmp rax, rdi
je 0x180003a83
bt dword [rbx + 4], 0x10
jae 0x180003a53
mov ecx, dword [rbx + 0xc]
mov rdx, rax
add rcx, r14
call fcn.180007090
cmp eax, dword [rbx + 0x10]
je 0x180003a96
bt dword [rbx + 4], 0x10
jb 0x180003a71
mov edx, dword [rbx + 0xc]
mov r8d, dword [rbx + 0x10]
mov rcx, rsi
add rdx, r14
call sub.ntdll.dll_memcpy
cmp rax, rdi
jne 0x180003a96
mov rcx, qword [0x18000f730]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, word [rbx + 2]
lea rbx, [rbx + rax*4 + 0x14]
cmp word [rbx], bp
jne 0x180003ab0
jmp 0x180003a04
mov eax, dword [rbx + 0x10]
mov byte [rax + rsi], dil
mov rax, qword [rsp + 0x58]
mov edi, 1
mov qword [rax], rsi
mov eax, dword [rbx + 0x10]
mov dword [r15], eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov eax, edi
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x180003ad0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, [0x180011481]
xor r8d, r8d
xor edx, edx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov edi, eax
test eax, eax
je 0x180003b39
mov rcx, qword [0x18000f730]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x180003b39
lea rcx, [0x180011481]
mov r8d, edi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x180003b39
mov rcx, qword [0x18000f730]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800043a0
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [0x18000f730]
xor edx, edx
mov r8d, 0x1000
xor edi, edi
mov dword [rax + 0x10], 0x1000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x18000444e
lea r8, [rsp + 0x38]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov rsi, rax
test rax, rax
je 0x18000443c
mov edi, 1
mov rcx, qword [rbx + 8]
mov rdx, rbp
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x180004416
mov rcx, qword [rbx + 8]
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea r8, [rsp + 0x38]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x38], 0x1000
call qword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
jne 0x1800043fa
mov rcx, rsi
call qword [sym.imp.WININET.dll_FindCloseUrlCache]
mov rcx, qword [0x18000f730]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x1800049e8
Capabilities:
Connect to http server
Create http request

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov rbx, rcx
mov rcx, r8
mov r12, r9
mov rsi, r8
mov rbp, rdx
mov dword [rax + 0x30], 0xea60
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [0x18000f730]
xor edx, edx
add eax, eax
mov dword [rsp + 0x60], eax
lea r8d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x180004a52
lea r8, [rsp + 0x60]
xor r9d, r9d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
test eax, eax
cmovne rsi, rdi
mov rcx, qword [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0x10000000
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x180004b70
lea rdx, [0x18000494c]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetSetStatusCallback]
cmp rax, 0xffffffffffffffff
je 0x180004b70
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x38], rbx
and dword [rsp + 0x30], 0
mov r8d, 0x50
xor r9d, r9d
mov rdx, rbp
mov dword [rsp + 0x28], 3
and qword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_InternetConnectA]
mov qword [rbx + 0x20], rax
test rax, rax
jne 0x180004afb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x180004b70
mov rcx, qword [rbx + 0x30]
mov edx, 0xea60
call fcn.1800047c4
test eax, eax
jne 0x180004b70
mov rcx, qword [rbx + 0x20]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x84404000
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rsi
mov rdx, r12
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov qword [rbx + 0x28], rax
test rax, rax
je 0x180004b70
mov esi, 4
lea r8, [rsp + 0x88]
mov rcx, rax
lea edx, [rsi + 2]
mov r9d, esi
call qword [sym.imp.WININET.dll_InternetSetOptionA]
test eax, eax
je 0x180004b70
mov rcx, qword [rbx + 0x28]
lea r8, [rsp + 0x88]
lea edx, [rsi + 1]
mov r9d, esi
call qword [sym.imp.WININET.dll_InternetSetOptionA]
test eax, eax
je 0x180004b70
xor ebx, ebx
jmp 0x180004b78
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test rdi, rdi
je 0x180004b8f
mov rcx, qword [0x18000f730]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x180004d84
Capabilities:
Check http status code
Read data from internet
Receive data

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
sub rsp, 0xa0
and dword [rax + 8], 0
mov rdi, rcx
mov rcx, qword [rcx + 0x30]
mov edx, 0xea60
call fcn.1800047c4
mov ebx, eax
test eax, eax
jne 0x180004fa9
mov ebx, dword [rdi + 0x40]
test ebx, ebx
jne 0x180004f9f
cmp qword [rdi], 0
jne 0x180004f9f
lea r8, [rsp + 0x38]
lea edx, [rax + 1]
xor ecx, ecx
lea ebx, [rax + 8]
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x180004f9f
mov rcx, qword [0x18000f730]
xor edx, edx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x180004f94
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rdi + 0x28]
lea r9, [rsp + 0xc0]
mov r8d, 0x1000
mov rdx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x180004e52
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x3e5
jne 0x180004e74
mov rcx, qword [rdi + 0x30]
or edx, 0xffffffff
call fcn.1800047c4
mov ebx, eax
test eax, eax
jne 0x180004e74
mov ebx, dword [rdi + 0x40]
test ebx, ebx
jne 0x180004e74
mov r8d, dword [rsp + 0xc0]
test r8d, r8d
je 0x180004e72
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x20]
jmp 0x180004e01
xor ebx, ebx
mov rcx, qword [0x18000f730]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jne 0x180004f94
mov rcx, qword [rdi + 0x28]
and dword [rsp + 0xd0], ebx
and dword [rsp + 0xd8], ebx
lea rax, [rsp + 0xd8]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0xd0]
mov edx, 0x20000013
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x180004f8f
cmp dword [rsp + 0xd0], 0xc8
jne 0x180004f8f
mov rcx, qword [rsp + 0x38]
lea r8d, [rbx + 1]
lea rdx, [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov r11d, dword [rsp + 0x60]
mov dword [rsp + 0xc0], r11d
test r11d, r11d
je 0x180004f88
mov rcx, qword [rsp + 0x38]
and dword [rsp + 0x40], ebx
and dword [rsp + 0x44], ebx
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
call qword [rax + 0x28]
movsxd r8, dword [rsp + 0xc0]
mov rcx, qword [0x18000f730]
inc r8
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x180004f81
mov rcx, qword [rsp + 0x38]
mov r8d, dword [rsp + 0xc0]
xor r9d, r9d
mov r10, qword [rcx]
mov rdx, rax
call qword [r10 + 0x18]
movsxd r11, dword [rsp + 0xc0]
mov byte [r11 + rsi], bl
mov eax, dword [rsp + 0xc0]
mov qword [rdi], rsi
mov dword [rdi + 0x44], eax
jmp 0x180004f94
mov ebx, 8
jmp 0x180004f94
mov ebx, 0x10d2
jmp 0x180004f94
mov ebx, 0xe8
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, ebx
add rsp, 0xa0
pop rdi
pop rsi
pop rbx
ret
Function at 0x14002e5f6
Capabilities:
Identify system language via api

Disassembly:
push r15
xor rax, rax
push rax
sub rsp, 0x28
call fcn.1400ebc50
mov rcx, qword [rsp + 0x60]
call fcn.140066ed4
push rcx
sub rsp, 0x28
call fcn.1400eb920
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400eb920
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
sub rsp, 0x20
call sub.KERNEL32.dll_GetUserDefaultLangID
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400e9510
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.1400eb9e0
push qword [rsp + 0x28]
pop rcx
call fcn.1400e8f70
mov r15, rax
cmp r15, 3
jne 0x14002e6b9
push rcx
sub rsp, 0x28
call fcn.1400eb920
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401d80b6
sub rsp, 0x28
call fcn.1400eb970
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400eb970
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.1400eb9e0
mov rcx, qword [rsp + 0x28]
push rcx
sub rsp, 0x28
call fcn.1400eb920
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400eb970
add rsp, 0x28
pop rax
push rax
call fcn.1400ebb20
pop rdx
add rax, rdx
jmp 0x14002e6f2
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400ebcc0
add rsp, 0x28
pop rax
add rsp, 0x30
pop r15
ret
Function at 0x140049433
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
push r15
mov rax, 7
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140049446
sub rsp, 0x28
call fcn.1400ebc50
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400eb7c0
add rsp, 0x10
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.1400eb7c0
add rsp, 0x10
push qword [rsp + 0x28]
pop rcx
call fcn.140049e92
push qword [rsp + 0x30]
movabs rcx, 0x1401d8010
pop rdx
call fcn.1400ebac0
or rax, rax
je 0x140049577
cmp dword [0x1408803e4], 0
je 0x140049555
movabs rax, str.Advapi32.dll
push rax
push 0xffffffffffffffff
pop rcx
pop rdx
call fcn.1400ae5d0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140049553
movabs rax, str.RegDeleteKeyExA
push rax
push qword [rsp + 0x40]
pop rcx
pop rdx
call fcn.1400ae658
mov qword [rsp + 0x40], rax
sub rsp, 8
push 0
movsxd r15, dword [0x1408803ec]
or r15, 0xf003f
mov rax, r15
push rax
mov rax, qword [0x1408802d8]
mov rax, rax
push rax
push qword [0x140880300]
push qword [rsp + 0x68]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400afc84
add rsp, 0x30
mov qword [rsp + 0x48], rax
push qword [rsp + 0x38]
pop rcx
call fcn.1400ae4bc
jmp 0x140049572
mov rax, qword [0x1408802d8]
mov rax, rax
push rax
push qword [0x140880300]
pop rcx
pop rdx
call sub.ADVAPI32.dll_RegDeleteKeyW
mov qword [rsp + 0x48], rax
jmp 0x14004963c
lea rax, [rsp + 0x58]
mov rax, rax
push rax
push qword [0x140880300]
push qword [rsp + 0x40]
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.dll_RegConnectRegistryW
movsxd rax, eax
mov qword [rsp + 0x50], rax
cmp dword [0x1408803e4], 0
je 0x140049621
movabs rax, str.Advapi32.dll
push rax
push 0xffffffffffffffff
pop rcx
pop rdx
call fcn.1400ae5d0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14004961f
push 0
movsxd r15, dword [0x1408803ec]
or r15, 0xf003f
mov rax, r15
push rax
mov rax, qword [0x1408802d8]
mov rax, rax
push rax
push qword [rsp + 0x70]
movabs rax, str.RegDeleteKeyExA
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400af188
add rsp, 0x30
mov qword [rsp + 0x48], rax
push qword [rsp + 0x38]
pop rcx
call fcn.1400ae4bc
jmp 0x14004963c
mov rax, qword [0x1408802d8]
mov rax, rax
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
call sub.ADVAPI32.dll_RegDeleteKeyW
mov qword [rsp + 0x48], rax
mov r15, qword [rsp + 0x48]
and r15, r15
jne 0x14004964f
mov rax, 1
jmp 0x140049652
xor rax, rax
push rax
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400ebcc0
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400ebcc0
add rsp, 0x28
pop rax
add rsp, 0x60
pop r15
ret

Function at 0x140066ed4
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x140879c60]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret
Function at 0x140067e0c
Capabilities:
Get file size
Read file on windows

Disassembly:
or r8d, 0xffffffff
jmp 0x140067e18
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov ebp, r8d
mov rax, rdx
mov r14, rcx
mov ebx, r13d
test rdx, rdx
je 0x14006801d
cmp word [rdx], r13w
je 0x14006801d
mov qword [r11 - 0x38], r13
lea r15d, [r13 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
mov r8d, r15d
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140068018
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
movsxd rsi, eax
test eax, eax
jle 0x14006800f
mov ecx, ebp
call fcn.1400685c4
mov rdi, rax
test rax, rax
je 0x14006800f
mov rcx, r14
lea edx, [r13 + 2]
cmp ebp, 0xffffffff
je 0x140067ec6
mov edx, ebp
call fcn.140068be8
mov rbx, rax
test rax, rax
je 0x140068007
mov qword [rax + 0x40], rdi
mov qword [rbx + 0x60], r13
mov dword [rbx + 0x68], r13d
mov dword [rbx + 0x20], r13d
cmp r14, 0xffffffffffffffff
lea r8, [rsi + 0x10]
cmove r14, rax
xor edx, edx
mov qword [rax + 0x48], r14
mov rax, qword [rax + 8]
mov qword [rbx + 0x58], rax
mov rcx, qword [0x14087fe98]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx + 0x38], rax
test rax, rax
je 0x140067f30
lea ecx, [rsi + 0x10]
mov dword [rax + 8], ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], r13
mov rax, qword [rbx + 0x38]
add rax, 0x10
mov qword [rbx + 0x70], rax
cmp ebp, 0xffffffff
je 0x140067f39
mov dword [rbx + 0x50], r15d
mov rdx, rbx
mov rcx, rdi
call fcn.1400f43c0
mov ebp, r13d
mov r14d, 0x4000
test esi, esi
jle 0x140068003
lea eax, [r14 + rbp]
cmp eax, esi
jle 0x140067f63
mov r14d, esi
sub r14d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.1400f3710
mov r15, rax
test rax, rax
je 0x140067ff1
lea r9, [rsp + 0x78]
mov r8d, r14d
mov rdx, rax
mov rcx, r12
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x78]
cmp edx, r14d
jne 0x140067fdd
add ebp, edx
cmp dword [rbx + 0x20], r13d
jne 0x140067faf
mov rcx, r15
call fcn.1400686a0
mov dword [rbx + 0x20], eax
mov edx, dword [rsp + 0x78]
mov rcx, rdi
cmp ebp, esi
jl 0x140067fbe
mov r8d, 1
jmp 0x140067fc1
xor r8d, r8d
call fcn.1400f3c00
test eax, eax
je 0x140067fd0
cmp ebp, esi
jl 0x140067f55
jmp 0x140068003
mov rcx, rdi
call fcn.1400f3a40
mov dword [rbx + 0x24], eax
jmp 0x140067ff8
lea rax, [0x140197880]
mov dword [rbx + 0x24], 0x100
mov qword [rbx + 0x30], rax
jmp 0x140068003
mov dword [rbx + 0x24], 1
mov rdx, rdi
mov rcx, rbx
call fcn.14006879c
mov qword [rbx + 0x40], r13
mov rcx, rdi
call fcn.1400f3d90
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
jmp 0x14006801f
xor eax, eax
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140067e18
Capabilities:
Get file size
Read file on windows

Disassembly:
or r8d, 0xffffffff
jmp 0x140067e18
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov ebp, r8d
mov rax, rdx
mov r14, rcx
mov ebx, r13d
test rdx, rdx
je 0x14006801d
cmp word [rdx], r13w
je 0x14006801d
mov qword [r11 - 0x38], r13
lea r15d, [r13 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
mov r8d, r15d
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140068018
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
movsxd rsi, eax
test eax, eax
jle 0x14006800f
mov ecx, ebp
call fcn.1400685c4
mov rdi, rax
test rax, rax
je 0x14006800f
mov rcx, r14
lea edx, [r13 + 2]
cmp ebp, 0xffffffff
je 0x140067ec6
mov edx, ebp
call fcn.140068be8
mov rbx, rax
test rax, rax
je 0x140068007
mov qword [rax + 0x40], rdi
mov qword [rbx + 0x60], r13
mov dword [rbx + 0x68], r13d
mov dword [rbx + 0x20], r13d
cmp r14, 0xffffffffffffffff
lea r8, [rsi + 0x10]
cmove r14, rax
xor edx, edx
mov qword [rax + 0x48], r14
mov rax, qword [rax + 8]
mov qword [rbx + 0x58], rax
mov rcx, qword [0x14087fe98]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx + 0x38], rax
test rax, rax
je 0x140067f30
lea ecx, [rsi + 0x10]
mov dword [rax + 8], ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], r13
mov rax, qword [rbx + 0x38]
add rax, 0x10
mov qword [rbx + 0x70], rax
cmp ebp, 0xffffffff
je 0x140067f39
mov dword [rbx + 0x50], r15d
mov rdx, rbx
mov rcx, rdi
call fcn.1400f43c0
mov ebp, r13d
mov r14d, 0x4000
test esi, esi
jle 0x140068003
lea eax, [r14 + rbp]
cmp eax, esi
jle 0x140067f63
mov r14d, esi
sub r14d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.1400f3710
mov r15, rax
test rax, rax
je 0x140067ff1
lea r9, [rsp + 0x78]
mov r8d, r14d
mov rdx, rax
mov rcx, r12
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x78]
cmp edx, r14d
jne 0x140067fdd
add ebp, edx
cmp dword [rbx + 0x20], r13d
jne 0x140067faf
mov rcx, r15
call fcn.1400686a0
mov dword [rbx + 0x20], eax
mov edx, dword [rsp + 0x78]
mov rcx, rdi
cmp ebp, esi
jl 0x140067fbe
mov r8d, 1
jmp 0x140067fc1
xor r8d, r8d
call fcn.1400f3c00
test eax, eax
je 0x140067fd0
cmp ebp, esi
jl 0x140067f55
jmp 0x140068003
mov rcx, rdi
call fcn.1400f3a40
mov dword [rbx + 0x24], eax
jmp 0x140067ff8
lea rax, [0x140197880]
mov dword [rbx + 0x24], 0x100
mov qword [rbx + 0x30], rax
jmp 0x140068003
mov dword [rbx + 0x24], 1
mov rdx, rdi
mov rcx, rbx
call fcn.14006879c
mov qword [rbx + 0x40], r13
mov rcx, rdi
call fcn.1400f3d90
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
jmp 0x14006801f
xor eax, eax
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140068ea8
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x140068f6e
lea rcx, [0x1408fe300]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140880a10]
jmp 0x140068f32
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140068f2f
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x140880a10]
mov rdx, rsi
call fcn.1400eb654
jmp 0x140068f32
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140068eff
mov rdx, qword [0x1408799b0]
lea rcx, [0x140880a10]
mov rdi, rdx
inc rdx
mov qword [0x1408799b0], rdx
lea edx, [rbx + 0x20]
call fcn.1400eb69c
lea rcx, [0x1408fe300]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x1400692f4
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x14006936b
movsxd rdx, ecx
lea rcx, [0x140069250]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [0x140880a20]
test rbx, rbx
je 0x1400693de
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140069361
cmp byte [rbx + 0x20], 0
je 0x140069361
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
xor r8d, r8d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x140069327
jmp 0x1400693de
mov rbx, qword [0x140880a20]
test rbx, rbx
je 0x1400693de
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x1400693d6
cmp byte [rbx + 0x21], 0
je 0x14006939a
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x1400693c6
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x140880a20]
call fcn.1400eb654
mov rbx, rdi
test rdi, rdi
jne 0x140069377
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140069aa0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
mov rdx, rcx
mov rcx, qword [0x1408fe360]
call fcn.1400eb238
test rax, rax
je 0x140069add
cmp dword [rax + 0x28], 0
je 0x140069add
mov rcx, qword [rax + 0x18]
mov r9d, ebx
mov r8d, dword [rcx + 4]
mov edx, dword [rcx]
mov rcx, qword [rax + 0x10]
add rsp, 0x20
pop rbx
jmp fcn.1400696c0
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp fcn.1400ec380