joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003f018
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
xor r14d, r14d
sub rax, 0x34
mov qword [rcx + 0x78], r14
mov qword [rcx + 0x28], rax
mov ebp, edx
mov rax, qword [rcx + 0x30]
mov rbx, rcx
mov word [rcx + 0x6a], r14w
lea r15d, [r14 + 1]
mov dword [rcx + 0x3c], r14d
mov esi, r14d
mov qword [rcx + 0x70], rax
mov qword [rax + 0x10], rax
mov word [rcx + 0x68], r14w
cmp r14w, word [rcx + 0xb8]
jge 0x18003f166
movzx r10d, r14w
mov edi, r14d
mov r8, qword [rbx + 0xd0]
mov r9d, ebp
mov dword [rbx + 0x88], r14d
movzx edx, r10w
mov qword [rbx + 0x80], r14
mov rcx, rbx
movzx r8d, word [rdi + r8]
call fcn.18003ed10
test al, al
jne 0x18003f1fe
mov rax, qword [rbx + 0xd0]
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 0x5c]
movzx r10d, word [rdi + rax]
lea eax, [r8 - 1]
test edx, eax
jne 0x18003f0f5
cmp edx, dword [rbx + 0x60]
jl 0x18003f0f5
cmp edx, dword [rbx + 0x64]
jg 0x18003f0f5
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x18003f0f5
mov rax, qword [rbx + 0x70]
mov cl, byte [rax + 0x18]
xor cl, byte [r9 + 0x18]
test cl, 8
jne 0x18003f0f5
add qword [rbx + 0x30], 0xfffffffffffffffc
mov r9, qword [rbx + 0x70]
mov rax, qword [r9 + 0x10]
cmp qword [rbx + 0x30], rax
je 0x18003f118
test byte [r9 + 0x18], 8
je 0x18003f118
neg r8d
and r8d, edx
sub edx, r8d
cmp edx, dword [rbx + 8]
jmp 0x18003f129
lea eax, [r8 - 1]
neg r8d
add eax, edx
and eax, r8d
sub eax, edx
cmp eax, dword [rbx + 8]
setge dl
mov rcx, rbx
call fcn.18003e248
test al, al
jne 0x18003f1fe
mov rax, qword [rbx + 0x80]
test rax, rax
je 0x18003f14c
mov qword [r9 + 0x28], rax
movsx eax, word [rbx + 0xb8]
add esi, r15d
add rdi, 2
add r10w, r15w
cmp esi, eax
jl 0x18003f07e
movzx r11d, word [rbx + 0x68]
mov rdx, qword [rbx + 0x78]
cmp r11w, r15w
jbe 0x18003f203
test rdx, rdx
je 0x18003f203
lea rdi, [rdx + 8]
cmp r11w, r15w
jbe 0x18003f19a
movsxd rcx, dword [rdx + 0x1c]
mov rax, qword [rdx + 0x10]
lea r10, [rax + rcx*4]
jmp 0x18003f19d
mov r10, r14
mov qword [rdi], r10
test byte [rdx + 0x18], 8
mov r10d, dword [rdx + 0x20]
mov r8d, r10d
mov eax, dword [rdx + 0x1c]
je 0x18003f1b8
dec r10d
add r10d, eax
jmp 0x18003f1cf
sub r8d, eax
add r8d, r15d
dec eax
mov dword [rdx + 0x20], r8d
movsxd rcx, eax
shl rcx, 2
add qword [rdx + 0x10], rcx
mov edx, r8d
mov rcx, rbx
call fcn.18003e2dc
test al, al
jne 0x18003f1fe
lea edx, [r10 + 1]
mov rcx, rbx
call fcn.18003e2dc
test al, al
jne 0x18003f1fe
mov rdx, qword [rdi]
mov eax, 0xffff
add r11w, ax
jne 0x18003f182
jmp 0x18003f207
mov al, r15b
jmp 0x18003f212
mov qword [rbx + 0x78], r14
mov rax, qword [rbx + 0x28]
cmp qword [rbx + 0x30], rax
setae al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x18008a704
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor r10d, r10d
mov r11, rdx
mov r9d, ecx
test rdx, rdx
je 0x18008a789
lea rdi, [0x1800b3210]
not r9d
cmp r8d, 8
jb 0x18008a760
mov edx, r8d
shr rdx, 3
add r8d, 0xfffffff8
mov ebx, 8
movzx ecx, byte [r11]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc r11
xor r9d, dword [rdi + rax*4]
sub rbx, 1
jne 0x18008a73c
sub rdx, 1
jne 0x18008a733
test r8d, r8d
je 0x18008a783
movzx ecx, byte [r11]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc r11
xor r9d, dword [rdi + rax*4]
add r8d, 0xffffffff
jne 0x18008a765
not r9d
mov r10d, r9d
mov rbx, qword [rsp + 8]
mov eax, r10d
mov rdi, qword [rsp + 0x10]
ret
Function at 0x1012f7c
Capabilities:
Capture webcam image

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
mov rdi, rcx
mov rcx, qword [rcx + 0x1b8]
lea r9, [rax - 0x28]
xor r8d, r8d
mov edx, 0x419
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, qword [rdi + 8]
mov rcx, qword [rdi + 0x1b8]
lea r8, [rsp + 0x20]
mov r9d, 2
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov r11d, dword [rsp + 0x24]
mov eax, dword [rsp + 0x2c]
mov rcx, qword [rdi + 0x380]
mov esi, dword [rsp + 0x28]
add eax, r11d
cdq
xor ebp, ebp
sub eax, edx
sar eax, 1
mov r12d, eax
cmp rcx, rbp
je 0x1013077
mov rcx, qword [rcx + 0x10]
mov edx, 0x130
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rdx, [rsp + 0x20]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov rdx, qword [rdi + 8]
lea r9d, [rbp + 2]
lea r8, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov ebp, dword [rsp + 0x28]
lea r9, [rsp + 0x20]
xor r8d, r8d
mov edx, 0x419
mov rcx, rbx
sub ebp, esi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov r9d, 2
mov rcx, rbx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [rsp + 0x28]
lea r11d, [rbp + rsi]
cmp r11d, eax
jle 0x1013077
sub eax, esi
mov ebp, eax
mov rcx, qword [rdi + 8]
mov edx, 0x19b
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov rdx, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov r9d, 2
mov rcx, rbx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [rsp + 0x38]
lea r11d, [rbp + rsi]
cmp r11d, eax
jle 0x10130c1
sub eax, esi
mov ebp, eax
cmp dword [rdi + 0x528], esi
jne 0x10130eb
cmp dword [rdi + 0x52c], r12d
jne 0x10130eb
lea eax, [r12 + 1]
cmp dword [rdi + 0x534], eax
jne 0x10130eb
lea eax, [rbp + rsi]
cmp dword [rdi + 0x530], eax
je 0x1013119
lea eax, [r12 - 1]
mov rcx, rdi
mov dword [rdi + 0x528], esi
mov dword [rdi + 0x52c], eax
lea eax, [r12 + 2]
mov dword [rdi + 0x534], eax
lea eax, [rbp + rsi]
mov dword [rdi + 0x530], eax
call fcn.01012f1c
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x10139dc
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [0x01031110]
call fcn.0101bb90
mov rcx, qword [rbx + 8]
cmp eax, 1
jbe 0x1013a2c
mov edx, 0x12f
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rdx, qword [rbx + 0x48]
test rdx, rdx
je 0x1013a25
mov rdx, qword [rdx + 0x20]
mov rcx, rbx
call fcn.01013e74
mov edx, 0x12d
jmp 0x1013a5c
mov edx, 0x12d
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rdx, qword [rbx + 0x48]
test rdx, rdx
je 0x1013a57
mov rdx, qword [rdx + 0x20]
mov rcx, rbx
call fcn.01013e74
mov edx, 0x12f
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [rsp + 0x50]
and dword [rax], 0
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1014bd0
Capabilities:
Capture webcam image

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov r12, rcx
mov rcx, qword [rcx + 8]
mov rbp, rdx
lea rdx, [rax - 0x68]
mov rdi, r9
mov rsi, r8
call qword [sym.imp.USER32.dll_GetClientRect]
mov r11d, dword [rsp + 0x58]
mov r14d, dword [rsp + 0x50]
sub r11d, r14d
test r11d, r11d
jle 0x1014de5
mov rdx, rsi
mov rcx, rbp
xor ebx, ebx
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, rdi
mov rcx, rbp
mov qword [rsp + 0xc0], rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [r12 + 0x48]
mov esi, dword [rsp + 0x58]
mov r15d, dword [rcx + 0x388]
mov qword [rsp + 0x40], rax
xor r13d, r13d
cmp ebx, r15d
jae 0x1014d3a
mov rcx, qword [r12 + 0x48]
xor r8d, r8d
test ebx, ebx
js 0x1014cb0
mov eax, dword [rcx + 0x388]
dec eax
cmp ebx, eax
jg 0x1014cb0
mov rdx, qword [rcx + 0x378]
xor r9d, r9d
lea eax, [r8 + 1]
xor ecx, ecx
cmp ecx, ebx
jg 0x1014ca8
mov rax, rdx
test rdx, rdx
je 0x1014ca2
mov r9, qword [rax + 0x10]
mov rdx, qword [rdx]
mov eax, 1
inc ecx
test eax, eax
jne 0x1014c8a
test eax, eax
cmovne r8, r9
jmp 0x1014cb2
xor eax, eax
test eax, eax
je 0x1014cca
mov rcx, qword [r8 + 8]
mov edx, 0x130
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdi, rax
jmp 0x1014ccc
xor edi, edi
test rdi, rdi
je 0x1014d1c
lea r9, [rsp + 0x60]
xor r8d, r8d
mov edx, 0x419
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, qword [r12 + 8]
lea r8, [rsp + 0x60]
mov r9d, 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_MapWindowPoints]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_IntersectRect]
test eax, eax
jne 0x1014d23
inc ebx
jmp 0x1014c59
mov eax, dword [rsp + 0x60]
mov esi, dword [rsp + 0x58]
mov r13d, dword [rsp + 0x68]
sub r13d, eax
cmp eax, esi
cmovl esi, eax
inc ebx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x70], xmm0
mov rcx, qword [0x01030268]
lea rax, [0x01030268]
cmp rcx, rax
je 0x1014d98
bt dword [rcx + 0x1c], 0x1d
jae 0x1014d98
cmp byte [rcx + 0x19], 4
jb 0x1014d98
mov eax, dword [rsp + 0x5c]
mov r9, qword [r12 + 8]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], eax
lea r8, [0x01006070]
mov edx, 0xe
mov dword [rsp + 0x20], r14d
call fcn.010121f4
mov eax, dword [rsp + 0x7c]
mov r8d, dword [rsp + 0x74]
mov r9d, esi
mov edx, r14d
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_Rectangle]
lea r14d, [r13 + rsi]
mov esi, dword [rsp + 0x58]
cmp r14d, esi
jl 0x1014c56
mov rdx, qword [rsp + 0xc0]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, qword [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_SelectObject]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x10150e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x190
mov rax, qword [0x01030138]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rbx, qword [0x01030980]
mov r12, rcx
movzx edx, dx
mov r8d, pe_nt_image_headers64
mov rcx, rbx
mov edi, 1
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r13d, r13d
cmp rax, r13
je 0x1015242
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, r13
je 0x1015242
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
cmp rax, r13
je 0x1015242
movzx esi, word [rbx]
cmp r13w, si
je 0x1015242
movzx eax, word [rbx + 2]
mov ebp, dword [rbx + 4]
mov ecx, 0x403
add rbx, 8
cmp cx, ax
jne 0x10151cb
lea rcx, [rsp + 0x70]
mov rdx, rbx
call fcn.01015274
mov rax, qword [rsp + 0x70]
mov rcx, qword [r12 + 8]
movzx edx, si
xor r9d, r9d
mov r8d, 0x143
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov rcx, qword [rsp + 0x70]
cmp rax, 0xffffffffffffffff
lea rax, [rsp + 0x78]
cmove edi, r13d
cmp rcx, rax
je 0x1015236
call qword [sym.imp.msvcrt.dll_free]
jmp 0x1015236
mov ecx, 0x1234
cmp cx, ax
jne 0x1015236
or qword [rsp + 0x38], 0xffffffffffffffff
lea rcx, [rsp + 0x70]
mov rdx, rbx
mov dword [rsp + 0x30], 1
call fcn.01015274
mov rcx, qword [rax]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x101520d
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [r12 + 8]
lea rax, [rsp + 0x30]
movzx edx, si
xor r9d, r9d
mov r8d, 0x40b
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp rax, 0xffffffffffffffff
cmove edi, r13d
add rbx, rbp
cmp edi, r13d
jne 0x101515c
mov eax, edi
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.01027250
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x190
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1015674
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov r13, r8
mov rbx, rdx
mov rbp, rcx
call fcn.01010cd0
xor r12d, r12d
mov rdx, rbx
lea r8d, [r12 + 5]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x1015775
mov r8d, pe_nt_image_headers64
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor esi, esi
test rax, rax
je 0x10156eb
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
mov rdx, rdi
mov rcx, rbp
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1015761
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x1015761
mov rdx, rsi
mov rcx, rax
call fcn.01010f64
and qword [rsp + 0x20], rbx
lea r9, [0x01009d1c]
mov rdx, rax
mov r8, r13
mov rcx, rbp
mov rsi, rax
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov r12, rax
test rax, rax
jne 0x1015748
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp rsi, rdi
je 0x1015769
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1015769
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x1015775
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rax, r12
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x1015820
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov r14d, 1
shr eax, 4
mov ebx, r8d
mov rsi, rcx
add ax, r14w
lea r8d, [r14 + 5]
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r13d, r13d
mov r12, rax
cmp rax, r13
je 0x1015996
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, r13
je 0x1015996
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
cmp rax, r13
je 0x1015996
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x10158cc
cmp rdi, r11
jae 0x1015996
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x10158b6
cmp rdi, r11
jae 0x1015996
cmp word [rdi], r13w
je 0x1015996
mov rax, qword [rsi]
movzx ebx, word [rdi]
mov ecx, r14d
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x10158fe
mov edx, ebx
mov rcx, rsi
call fcn.01015c10
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x101591f
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
add ecx, r14d
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call sub.msvcrt.dll_memcpy_s
cmp eax, r13d
je 0x101596e
cmp eax, 0xc
je 0x1015963
cmp eax, 0x16
je 0x1015958
cmp eax, 0x22
je 0x1015958
cmp eax, 0x50
je 0x101596e
mov ecx, 0x80004005
call fcn.010112f4
int3
mov ecx, 0x80070057
call fcn.010112f4
int3
mov ecx, 0x8007000e
call fcn.010112f4
int3
cmp ebx, r13d
jl 0x101598b
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x101598b
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, r14d
mov word [rdi + rcx], r13w
jmp 0x1015998
mov ecx, 0x80070057
call fcn.010112f4
int3
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x10159c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13, rcx
mov r12d, edx
lea rcx, [0x01030970]
xor edx, edx
xor ebx, ebx
call fcn.01026ae8
lea r14d, [rbx + 1]
mov ebp, r14d
jmp 0x1015aa6
test rbx, rbx
jne 0x1015ab2
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, r14w
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rbx, rax
test rax, rax
je 0x1015a95
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1015a42
xor ebx, ebx
jmp 0x1015a90
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x1015a3e
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x1015a7f
cmp rdi, r11
jae 0x1015a3e
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x1015a6d
cmp rdi, r11
jae 0x1015a3e
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x1015ab4
lea rcx, [0x01030970]
mov edx, ebp
call fcn.01026ae8
add ebp, r14d
mov rsi, rax
test rax, rax
jne 0x10159ff
xor esi, esi
test rsi, rsi
jne 0x1015abd
xor eax, eax
jmp 0x1015acb
mov r8d, r12d
mov rdx, rsi
mov rcx, r13
call fcn.01015820
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret

Function at 0x10166d4
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x300
mov rax, qword [0x01030138]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
xor edi, edi
mov rbx, rcx
lea rcx, [rsp + 0x78]
lea r8d, [rdi + 0x60]
xor edx, edx
mov dword [rsp + 0x70], edi
call sub.msvcrt.dll_memset
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rdi
call qword [sym.imp.USER32.dll_PostQuitMessage]
movzx ecx, word [0x01030274]
movzx eax, word [0x01030270]
mov bh, 5
cmp eax, 0x4800019b
mov edx, dword [rbx + 0x338]
Function at 0x1018a70
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rbx, rcx
lea rcx, [0x01030100]
mov rax, qword [0x01030100]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x48]
mov r8, qword [rax + 0x38]
lea rdx, [0x010070d8]
lea rcx, [rsp + 0x38]
call fcn.01016934
nop
jmp 0x1018abf
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
mov rbx, qword [rsp + 0x38]
mov r9, rbx
lea r8, [0x01007108]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1018aed
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1018b08
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor eax, eax
add rsp, 0x50
pop rbx
ret

Function at 0x1018b18
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0x1b8]
mov rdi, r8
xor r9d, r9d
xor r8d, r8d
mov edx, 0x400
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x64
mov rcx, rbx
sub edx, eax
mov rax, qword [rbx]
movd xmm0, edx
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x01007980]
movss dword [rbx + 0x2a4], xmm0
call qword [rax + 0x48]
mov rcx, qword [rbx + 0x1a0]
test rcx, rcx
je 0x1018b88
mov rax, qword [rcx]
movss xmm1, dword [rbx + 0x2a4]
lea r8, [0x01031140]
call qword [rax + 0x38]
cmp di, 8
jne 0x1018bde
cmp qword [rbx + 0x320], 0
je 0x1018baa
mov rcx, rbx
call fcn.01018c5c
cmp qword [rbx + 0x320], 0
jne 0x1018bde
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x01018cc0]
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 2
mov rcx, rax
mov qword [rbx + 0x320], rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x40]
and dword [rax], 0
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1019830
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x180
mov rax, qword [0x01030138]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbp, rcx
mov rcx, qword [rcx + 8]
mov r12d, 0x1ae
mov edx, r12d
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [rbp + 8]
mov edx, r12d
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, qword [rbp + 8]
lea r8, [rsp + 0x50]
mov rcx, rax
mov r9d, 2
call qword [sym.imp.USER32.dll_MapWindowPoints]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rcx, qword [rbp + 8]
mov edx, r12d
mov rdi, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [rbp + 8]
mov edx, r12d
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rdx, [rsp + 0x70]
mov r8d, 0x80
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [0x01007260]
xor ecx, ecx
call qword [sym.imp.UxTheme.dll_OpenThemeData]
mov rbx, rax
test rax, rax
je 0x101994a
lea rax, [rsp + 0x60]
mov r9d, 1
mov rdx, rdi
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
lea r8d, [r9 + 4]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov dword [rsp + 0x30], 0x8014
or dword [rsp + 0x28], 0xffffffff
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.UxTheme.dll_GetThemeTextExtent]
mov rcx, rbx
call qword [sym.imp.UxTheme.dll_CloseThemeData]
jmp 0x1019969
lea r9, [rsp + 0x60]
lea rdx, [rsp + 0x70]
or r8d, 0xffffffff
mov rcx, rdi
mov dword [rsp + 0x20], 0x8414
call qword [sym.imp.USER32.dll_DrawTextW]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteDC]
mov esi, dword [rsp + 0x54]
mov edi, dword [rsp + 0x6c]
movss xmm0, dword [0x0103027c]
mulss xmm0, dword [0x0100796c]
sub esi, dword [rsp + 0x5c]
sub edi, dword [rsp + 0x64]
mov rcx, qword [rbp + 8]
divss xmm0, dword [0x0100795c]
mov edx, r12d
add esi, edi
cvttss2si ebx, xmm0
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, dword [rsp + 0x58]
mov r8d, dword [rsp + 0x50]
mov r9d, dword [rsp + 0x54]
lea ecx, [rbx + rdi]
sub edx, r8d
mov dword [rsp + 0x30], 0x21c
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowPos]
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9d, esi
xor r8d, r8d
mov edx, 0x1af
mov rcx, rbp
call fcn.01019aa4
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9d, esi
xor r8d, r8d
mov edx, 0x1a9
mov rcx, rbp
call fcn.01019aa4
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9d, esi
xor r8d, r8d
mov edx, 0x1aa
mov rcx, rbp
call fcn.01019aa4
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9d, esi
xor r8d, r8d
mov edx, 0x1b0
mov rcx, rbp
call fcn.01019aa4
mov r11d, esi
mov r9d, esi
neg r11d
xor r8d, r8d
mov edx, 0x1ac
mov dword [rsp + 0x28], r11d
and dword [rsp + 0x20], 0
mov rcx, rbp
call fcn.01019aa4
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.01027250
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret