joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002dca0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x4a0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140126108]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rsi, rcx
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x30], 0x104
mov word [rsp + 0x70], 0
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x72]
call fcn.1400a0a70
mov word [rsp + 0x280], 0
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x282]
call fcn.1400a0a70
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20219
xor r8d, r8d
lea rdx, [rsp + 0x280]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002dd87
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Application_Path
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 7
mov qword [rsp + 0x58], rdx
xor r8d, r8d
mov qword [rsp + 0x50], r8
mov word [rsp + 0x40], r8w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbx, rcx
movabs rax, 0x7ffffffffffffffe
cmp rcx, rax
jbe 0x14002ddd5
call fcn.1400cbc00
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
cmp rdx, rbx
jae 0x14002ddee
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.14000f350
mov rdx, qword [rsp + 0x58]
jmp 0x14002de0c
test rbx, rbx
jne 0x14002de0c
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x40]
cmp rdx, 8
cmovae rax, qword [rsp + 0x40]
mov word [rax], bx
jmp 0x14002de50
test rbx, rbx
je 0x14002de50
lea rcx, [rsp + 0x40]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x40]
lea rdi, [rbx + rbx]
add rdx, rdx
mov r9, rdi
lea r8, [rsp + 0x70]
call fcn.14009d1a0
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rax, qword [rsp + 0x40]
mov word [rdi + rax], 0
mov r8d, send
lea rdx, str.wofielauncher.exe
lea rcx, [rsp + 0x38]
call fcn.140013670
mov qword [rsi + 0x20], 7
mov qword [rsi + 0x18], 0
mov word [rsi + 8], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call fcn.14000ef60
nop
cmp qword [rsp + 0x58], 8
jb 0x14002dea7
mov rcx, qword [rsp + 0x40]
call fcn.14006b8a0
mov rax, rsi
jmp 0x14002deaa
mov rax, rsi
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.14009cca0
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400393e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x38
lea rax, [rsp + 0x68]
xor ebx, ebx
lea rdx, str.SOFTWARETrendMicroPC_cillinNTCorpCurrentVersionMisc.
mov edi, 1
mov r9d, 0x20219
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x60], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003947c
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.HideNonThreatAlertsBehindFullScreen
xor r8d, r8d
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x50]
test eax, eax
cmovne ecx, edi
mov dword [rsp + 0x50], ecx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x50], ebx
setne bl
mov eax, ebx
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x140046220
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x38
movsxd rdi, dword [rcx + 0x18]
mov rbx, rcx
mov rbp, rdx
mov rcx, rdi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1400462f4
xor r9d, r9d
lea rdx, [rsp + 0x60]
mov rcx, rdi
lea r8d, [r9 + 4]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 4
jne 0x1400462f4
mov edx, dword [rsp + 0x60]
test edx, edx
je 0x1400462b0
cmp edx, 1
je 0x140046289
mov r9, qword [rbx + 0x20]
mov dword [rsp + 0x20], edx
xor edx, edx
lea ecx, [rdx + 1]
lea r8, str.ctx__p:_ctl_cmd__d
call fcn.1400488b0
jmp 0x1400462d6
xor r9d, r9d
lea rdx, [rsp + 0x70]
mov rcx, rdi
lea r8d, [r9 + 8]
call qword [sym.imp.WS2_32.dll_recv]
mov r11, qword [rsp + 0x70]
and dword [r11 + 0x1c8], 0x80
jmp 0x1400462d6
xor r9d, r9d
lea rdx, [rsp + 0x78]
mov rcx, rdi
lea r8d, [r9 + 8]
call qword [sym.imp.WS2_32.dll_recv]
mov r8d, dword [rsp + 0x7c]
mov edx, dword [rsp + 0x78]
mov rcx, rbx
call fcn.140044d10
xor r9d, r9d
lea rdx, [rsp + 0x60]
mov rcx, rdi
lea r8d, [r9 + 4]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 4
je 0x140046261
mov rax, qword [rbx + 0x30]
lea rdi, [rbx + 0x28]
cmp rax, rdi
mov rsi, qword [rax + 8]
je 0x14004638f
mov qword [rsp + 0x30], r12
lea r12, [0x1400ee870]
nop
nop
nop
mov qword [rsp + 0x70], rax
mov rcx, qword [rax + 0x1b8]
test rcx, rcx
je 0x140046359
test byte [rax + 0x1c8], 0x40
jne 0x140046352
cmp rcx, r12
jne 0x140046359
movsxd rcx, dword [rax + 0x170]
mov rdx, rbp
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x140046359
mov ebx, 1
jmp 0x14004635b
xor ebx, ebx
mov rax, qword [rsp + 0x70]
mov rdx, rbp
movsxd rcx, dword [rax + 0x1d8]
call sub.WS2_32.dll___WSAFDIsSet
mov rcx, qword [rsp + 0x70]
mov r8d, ebx
mov edx, eax
call fcn.140045950
mov rax, rsi
mov rsi, qword [rsi + 8]
cmp rax, rdi
jne 0x140046320
mov r12, qword [rsp + 0x30]
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400468c0
Capabilities:
Connect socket
Create raw socket
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140126108]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor eax, eax
or esi, 0xffffffff
mov rbx, rcx
mov dword [rcx + 4], esi
mov dword [rcx], esi
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov qword [rsp + 0x30], rax
mov word [rsp + 0x28], 2
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, 0x7f000001
mov word [rsp + 0x2a], ax
call qword [sym.imp.WS2_32.dll_htonl]
lea edx, [rsi + 2]
lea ecx, [rsi + 3]
xor r8d, r8d
mov dword [rsp + 0x2c], eax
call qword [sym.imp.WS2_32.dll_socket]
cmp eax, esi
mov rbp, rax
je 0x1400469cb
mov r8d, dword [rsp + 0x20]
movsxd rdi, eax
lea rdx, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x1400469cb
lea edx, [rsi + 2]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_listen]
test eax, eax
jne 0x1400469cb
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1400469cb
lea edx, [rsi + 2]
lea ecx, [rsi + 3]
lea r8d, [rsi + 7]
call qword [sym.imp.WS2_32.dll_socket]
cmp eax, esi
mov dword [rbx], eax
je 0x1400469d9
mov r8d, dword [rsp + 0x20]
lea rdx, [rsp + 0x28]
movsxd rcx, eax
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x1400469cb
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_accept]
cmp eax, esi
mov dword [rbx + 4], eax
je 0x1400469cb
xor esi, esi
jmp 0x1400469e8
movsxd rcx, dword [rbx]
cmp ecx, 0xffffffff
je 0x1400469d9
call qword [sym.imp.WS2_32.dll_closesocket]
movsxd rcx, dword [rbx + 4]
cmp ecx, 0xffffffff
je 0x1400469e8
call qword [sym.imp.WS2_32.dll_closesocket]
movsxd rcx, ebp
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14009cca0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140047c40
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push r12
sub rsp, 0x1d8
mov rax, qword [0x140126108]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0x1d0], r13
mov r13, rdx
mov ecx, 1
mov edx, 0x158
call fcn.1400a24a0
test rax, rax
mov rsi, rax
jne 0x140047c90
lea r8, str.cannot_allocate_shttpd_context
lea ecx, [rax + 1]
xor edx, edx
call fcn.1400488b0
lea rax, [rsi + 0x18]
lea rcx, [rsi + 8]
lea r12, [rsi + 0x58]
mov qword [rax], rax
mov qword [rsi + 0x20], rax
lea rax, [rsi + 0x28]
mov qword [rax], rax
mov qword [rsi + 0x30], rax
lea rax, [rsi + 0x38]
mov qword [rax], rax
mov qword [rsi + 0x40], rax
lea rax, [rsi + 0x48]
mov qword [rsi + 0x138], 0
mov qword [rsi + 0x148], 0
mov qword [rcx], rcx
mov qword [rax], rax
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x50], rax
mov qword [r12], r12
mov qword [rsi + 0x60], r12
cmp qword [str.root], 0
mov qword [rsp + 0x208], rdi
je 0x140047d8f
mov qword [rsp + 0x1f0], rbx
mov qword [rsp + 0x200], rbp
lea rbp, [0x1400ef028]
mov rbx, qword [rbp]
test rbx, rbx
je 0x140047d68
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
mov rdi, rcx
call fcn.1400a2590
test rax, rax
mov r11, rax
je 0x140047d6b
cmp byte [rbx], 0
mov rcx, rax
je 0x140047d63
sub rbx, rax
cmp rdi, 1
jbe 0x140047d63
movzx eax, byte [rbx + rcx]
add rcx, 1
sub rdi, 1
mov byte [rcx - 1], al
cmp byte [rbx + rcx], 0
jne 0x140047d48
mov byte [rcx], 0
jmp 0x140047d6b
xor r11d, r11d
movsxd rax, dword [rbp - 0x18]
add rbp, 0x28
mov qword [rsi + rax*8 + 0x78], r11
cmp qword [rbp - 0x10], 0
jne 0x140047d16
mov rbp, qword [rsp + 0x200]
mov rbx, qword [rsp + 0x1f0]
test r13, r13
je 0x140047d9f
mov rdx, r13
mov rcx, rsi
call fcn.140047800
cmp qword [str.root], 0
mov r13, qword [rsp + 0x1d0]
je 0x140047de9
lea rdi, [0x1400ef030]
mov rax, qword [rdi]
test rax, rax
je 0x140047dde
movsxd rdx, dword [rdi - 0x20]
cmp qword [rsi + rdx*8 + 0x78], 0
je 0x140047dde
mov rdx, qword [rsi + rdx*8 + 0x78]
mov rcx, rsi
call rax
test eax, eax
je 0x140047ead
add rdi, 0x28
cmp qword [rdi - 0x18], 0
jne 0x140047db8
xor ecx, ecx
call fcn.14009faa0
lea rcx, [0x14013d5b0]
mov qword [0x14013d5b0], rax
call fcn.1400a0750
mov rcx, qword [rsi + 0x130]
test rcx, rcx
mov dword [0x14013d5b8], 0
je 0x140047e23
call fcn.1400a2b50
cmp eax, 1
jne 0x140047e78
mov edx, gethostname
lea ecx, [rdx - 0x37]
call fcn.1400a24a0
test rax, rax
mov rdi, rax
jne 0x140047e49
lea r8, str.Cannot_allocate_worker
lea ecx, [rax + 1]
xor edx, edx
call fcn.1400488b0
lea rcx, [rdi + 0x28]
mov qword [rdi + 0x20], rsi
mov qword [rcx], rcx
mov qword [rdi + 0x30], rcx
lea rcx, [rdi + 0x18]
call fcn.1400468c0
mov rdx, qword [r12]
mov qword [rdx + 8], rdi
mov rax, qword [r12]
mov qword [rdi + 8], r12
mov qword [rdi], rax
mov qword [r12], rdi
lea rdx, [rsp + 0x20]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov rax, rsi
mov rdi, qword [rsp + 0x208]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14009cca0
add rsp, 0x1d8
pop r12
pop rsi
ret
mov rcx, rsi
call fcn.1400466c0
xor eax, eax
jmp 0x140047e8a
Function at 0x140053260
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x70
mov rbp, rdx
xor edx, edx
mov rsi, r8
mov rdi, rcx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x30]
call fcn.1400a0a70
xor r12d, r12d
lea r9, [rsp + 0xa8]
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0xa8], r12
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x44], r12d
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x4c], 6
call qword [sym.imp.WS2_32.dll_getaddrinfo]
cmp eax, 0x2af9
mov ebx, eax
je 0x140053324
test eax, eax
je 0x1400532ee
mov ecx, 8
mov eax, 0x2ee7
cmp ebx, ecx
cmove eax, ecx
mov ebx, eax
jmp 0x1400533c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [rsi]
cmp ecx, eax
jb 0x140053315
test rbp, rbp
je 0x140053315
mov rdx, rcx
mov r8, rdi
mov rcx, rbp
call fcn.1400a0d40
jmp 0x1400533c0
add eax, 1
mov ebx, 0x7a
mov dword [rsi], eax
jmp 0x1400533c0
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x14005333f
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov qword [rsp + 0xa8], r12
lea r9, [rsp + 0xa8]
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x40], r12d
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x140053371
mov ecx, 8
mov ebx, 0x2ee7
cmp eax, ecx
cmove ebx, ecx
jmp 0x1400533c0
mov rcx, qword [rsp + 0xa8]
cmp dword [rcx + 4], 2
je 0x14005338f
nop
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x1400533ea
cmp dword [rcx + 4], 2
jne 0x140053380
mov edx, dword [rcx + 0x10]
mov r9d, dword [rsi]
mov rcx, qword [rcx + 0x20]
mov dword [rsp + 0x30], 2
mov r8, rbp
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov ebx, eax
mov eax, 0x2ee7
test ebx, ebx
cmovne ebx, eax
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x1400533d3
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
mov ebx, 0x2ee7
jmp 0x1400533c0
Function at 0x140054860
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12d, ecx
lea rcx, [0x14013b220]
xor r13d, r13d
xor edx, edx
mov rbx, r13
call fcn.1400cb844
lea ebp, [r13 + 1]
test rax, rax
mov rsi, rax
je 0x140054966
nop
test rbx, rbx
jne 0x140054966
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, 1
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
mov rdi, rax
jne 0x1400548d3
mov rbx, r13
jmp 0x140054949
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1400548e9
mov rbx, r13
jmp 0x140054944
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
jne 0x1400548ff
mov rbx, r13
jmp 0x140054944
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rbx
and ecx, 0xf
jbe 0x140054932
nop
nop
cmp rbx, r11
jae 0x140054937
add ecx, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140054920
cmp rbx, r11
jb 0x14005493c
mov rbx, r13
jmp 0x140054944
cmp word [rbx], r13w
cmove rbx, r13
test rbx, rbx
jne 0x140054981
lea rcx, [0x14013b220]
mov edx, ebp
call fcn.1400cb844
add ebp, 1
test rax, rax
mov rsi, rax
jne 0x1400548a0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov rax, rsi
jmp 0x140054968
Function at 0x140056a00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov r8d, 6
add ax, 1
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x140056b62
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140056b62
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x140056b62
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x140056aa6
nop
cmp rdi, r11
jae 0x140056b62
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x140056a90
cmp rdi, r11
jae 0x140056b62
movzx eax, word [rdi]
test ax, ax
je 0x140056b62
movzx ebx, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x140056adc
mov edx, ebx
mov rcx, rsi
call fcn.140006b70
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x140056af9
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.14009d1a0
test eax, eax
je 0x140056b38
cmp eax, 0xc
je 0x140056b32
cmp eax, 0x16
je 0x140056b2c
cmp eax, 0x22
je 0x140056b2c
cmp eax, 0x50
je 0x140056b38
call fcn.140075030
int3
call fcn.140075030
int3
call fcn.140074fe8
int3
test ebx, ebx
js 0x140056b57
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x140056b57
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x140056b64
mov ecx, 0x80070057
call fcn.140001000
int3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x140058870
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x260
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x278], rbx
mov rax, qword [0x140126108]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
lea rcx, [rsp + 0x40]
call fcn.1400d3a30
nop
lea rdx, str.Log_ServerNamePipe
lea rcx, [rsp + 0x40]
call fcn.1400d3b40
test al, al
jne 0x14005892a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1400588fa
cmp byte [0x140136598], 0
jne 0x14005891c
mov dword [rsp + 0x20], eax
lea r9, str.Need_to_Start_LogServer_for_turn_on_debug_log.
lea r8d, [rax + 0x70]
lea rdx, str..logcl_Command.cpp
lea ecx, [rax + 3]
call fcn.140058130
mov byte [0x140136598], 1
jmp 0x14005891c
mov dword [rsp + 0x20], eax
lea r9, str.Initial_pipe_client_failed__err_d
mov r8d, 0x77
lea rdx, str..logcl_Command.cpp
lea ecx, [r8 - 0x72]
call fcn.140058130
nop
lea rcx, [rsp + 0x40]
call fcn.1400d3a40
xor al, al
jmp 0x140058998
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov dword [rsp + 0x30], eax
lea r8, [rsp + 0x30]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400d3a60
test al, al
jne 0x14005898c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.pipe_send_failed_._err_d
mov r8d, 0x7e
lea rdx, str..logcl_Command.cpp
lea ecx, [r8 - 0x79]
call fcn.140058130
nop
lea rcx, [rsp + 0x40]
call fcn.1400d3a40
xor al, al
jmp 0x140058998
lea rcx, [rsp + 0x40]
call fcn.1400d3a40
mov al, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14009cca0
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret
Function at 0x140060a00
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x450
mov rax, qword [0x140126108]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, qword [rsp + 0x4a0]
mov rdi, rcx
mov rbp, r8
mov rsi, rdx
lea rcx, [rsp + 0x32]
mov r8d, 0x40e
xor edx, edx
mov r12, r9
mov word [rsp + 0x30], 0
call fcn.1400a0a70
cmp qword [rdi + 0x20], 8
jb 0x140060a5a
mov rdi, qword [rdi + 8]
jmp 0x140060a5e
add rdi, 8
lea r9, [rsp + 0x30]
mov r8, r12
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x208
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rdx, qword [rbx + 0x20]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
cmp rdx, 8
lea rdi, [rbx + 8]
not rcx
lea rsi, [rcx - 1]
jb 0x140060aa7
mov rax, qword [rdi]
jmp 0x140060aaa
mov rax, rdi
lea rcx, [rsp + 0x30]
cmp rcx, rax
jb 0x140060b00
cmp rdx, 8
jb 0x140060abf
mov rcx, qword [rdi]
jmp 0x140060ac2
mov rcx, rdi
mov rax, qword [rbx + 0x18]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x30]
cmp rcx, rax
jbe 0x140060b00
cmp rdx, 8
jb 0x140060adf
mov rax, qword [rdi]
jmp 0x140060ae2
mov rax, rdi
lea r8, [rsp + 0x30]
mov r9, rsi
mov rdx, rbx
sub r8, rax
mov rcx, rbx
sar r8, 1
call fcn.14000ef60
jmp 0x140060b91
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
jbe 0x140060b14
call fcn.1400cbc00
mov rax, qword [rbx + 0x20]
cmp rax, rsi
jae 0x140060b40
mov r8, qword [rbx + 0x18]
mov rdx, rsi
mov rcx, rbx
call fcn.14000f350
test rsi, rsi
je 0x140060b91
mov rdx, qword [rbx + 0x20]
cmp rdx, 8
jb 0x140060b61
mov rcx, qword [rdi]
jmp 0x140060b64
test rsi, rsi
jne 0x140060b31
cmp rax, 8
mov qword [rbx + 0x18], rsi
jb 0x140060b57
mov rax, qword [rdi]
mov word [rax], si
jmp 0x140060b91
mov rax, rdi
mov word [rax], 0
jmp 0x140060b91
mov rcx, rdi
lea rbp, [rsi + rsi]
lea r8, [rsp + 0x30]
add rdx, rdx
mov r9, rbp
call fcn.14009d1a0
cmp qword [rbx + 0x20], 8
mov qword [rbx + 0x18], rsi
jb 0x140060b88
mov rax, qword [rdi]
jmp 0x140060b8b
mov rax, rdi
mov word [rax + rbp], 0
cmp qword [rbx + 0x20], 8
jb 0x140060b9b
mov rdi, qword [rdi]
mov r8d, 0x53
lea rax, str.GetEscapeValue
lea r9, str._s___Text___s
lea rdx, str..libTmProfileDocument.cpp
lea ecx, [r8 - 0xf]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.1400580a0
mov rcx, rbx
call fcn.14004e900
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14009cca0
add rsp, 0x450
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14006dfac
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
call fcn.140074ce4
mov rbx, rax
mov rax, qword [rax + 0x78]
test rax, rax
je 0x14006dfe3
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x14006dfe3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageW]
test edi, edi
mov rbx, qword [rbx + 0xa0]
je 0x14006e013
test rbx, rbx
je 0x14006e013
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14006e013
mov rax, qword [rbx]
or rdx, 0xffffffffffffffff
mov rcx, rbx
call qword [rax + 0x2d0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14007148c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0xa0], 0
mov rbx, rdx
mov rsi, rcx
jne 0x140071544
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov r8, qword [rbx]
mov edx, 1
mov ecx, dword [r8 - 0xc]
sub edx, dword [r8 - 8]
movsxd rdi, eax
sub ecx, edi
or edx, ecx
jge 0x1400714dc
mov edx, edi
mov rcx, rbx
call fcn.140006b70
test edi, edi
mov rdx, qword [rbx]
js 0x140071539
cmp edi, dword [rdx - 0xc]
jg 0x140071539
mov dword [rdx - 0x10], edi
mov rax, qword [rbx]
lea r8d, [rdi + 1]
and word [rax + rdi*2], 0
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14007150d
xor eax, eax
jmp 0x140071516
call fcn.1400a80d0
test eax, eax
js 0x14007152e
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14007152e
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
and word [rax + rcx*2], 0
jmp 0x140071554
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov rcx, qword [rcx + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0x118]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140073d88
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x140073df0
call fcn.140074c94
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140073df0
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x140073e12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.1400737e4
test rdi, rdi
mov esi, eax
je 0x140073e10
test rbx, rbx
je 0x140073e10
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret