joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402170
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
mov r8, rdx
lea rdx, [rax + rcx]
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x4021bc
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov ecx, dword [rax + 0xc]
mov rdx, rcx
cmp rcx, r8
ja 0x4021b3
add edx, dword [rax + 8]
cmp rdx, r8
ja 0x4021be
add rax, 0x28
cmp rax, r9
jne 0x4021a0
xor eax, eax
ret

Function at 0x4021c0
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.strlen
cmp rax, 8
ja 0x402250
mov rdx, qword [0x0040d340]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x40223e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x40223e
cmp word [rax + 0x18], 0x20b
jne 0x40223e
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x402250
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x402229
add r12, 0x28
cmp r12, rsi
je 0x402250
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x402220
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x402260
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x0040d340]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x402280
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x402288
ret
cmp word [r8 + 0x18], 0x20b
jne 0x402280
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x4022d5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x4022cc
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402280
add rax, 0x28
cmp rax, r9
jne 0x4022b8
xor eax, eax
ret

Function at 0x4022e0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x0040d340]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x402300
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x402308
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x402300
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x402320
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x0040d340]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x402340
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x402348
ret
cmp word [rdx + 0x18], 0x20b
jne 0x402340
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x402388
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x40237f
test rcx, rcx
je 0x402340
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x402370
xor eax, eax
ret

Function at 0x402390
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x0040d340]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x4023b0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x4023b8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x4023d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x0040d340]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x4023f0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x4023f8
mov eax, r8d
ret
cmp word [rdx + 0x18], 0x20b
jne 0x4023f0
sub rcx, rax
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x4023f0
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x402434
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402448
add rax, 0x28
cmp r9, rax
jne 0x402420
xor r8d, r8d
mov eax, r8d
ret
mov r8d, dword [rax + 0x24]
not r8d
shr r8d, 0x1f
mov eax, r8d
ret

Function at 0x402460
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x0040d340]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x402482
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x402490
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x402482
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x402482
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x402482
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x4024dd
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x4024f0
add rdx, 0x28
cmp r10, rdx
jne 0x4024c8
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x4024ff
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x40250f
mov edx, dword [rax + 0xc]
test edx, edx
je 0x4024e6
test ecx, ecx
jg 0x4024f8
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140003e7c
Capabilities:
Acquire debug privileges

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x68], 0
mov dword [rsp + 0x58], 0
lea rax, [rsp + 0x5c]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x38], 0
call qword [0x140007388]
lea r8, [rsp + 0x40]
mov edx, 0x28
mov rcx, rax
call qword [0x1400072d0]
test eax, eax
je 0x140003f5a
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x64], 2
lea r8, [rsp + 0x5c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [0x1400072d8]
test eax, eax
je 0x140003f4f
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x58]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [0x1400072c8]
mov rcx, qword [rsp + 0x40]
call qword [0x140007110]
mov r8d, dword [rsp + 0x90]
xor edx, edx
mov ecx, 0x43a
call qword [0x1400073b8]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140003f86
mov dword [rsp + 0x4c], 0
jmp 0x140003fd4
xor r9d, r9d
mov r8d, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
call fcn.140002be0
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x140003fba
mov dword [rsp + 0x4c], 0
jmp 0x140003fd4
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [0x140007370]
xor eax, eax
test eax, eax
jne 0x140003ee3
cmp qword [rsp + 0x30], 0
je 0x140003fe7
mov rcx, qword [rsp + 0x30]
call qword [0x140007110]
mov eax, dword [rsp + 0x4c]
add rsp, 0x70
pop rdi
ret

Function at 0x1408c1768
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1408c1772
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1408c179b
pop rbp
sub rbp, 0x33
sub rbp, 0x8c1768
sub rsp, 0x20
jmp 0x1408c17ba
mov rax, 0x8c1768
add rax, rbp
add rax, 0x84
mov rcx, 0x647
mov rdx, 0x6e9c7ff2
xor byte [rax], dl
inc rax
dec rcx
jne 0x1408c17d9
jmp 0x1408c17f0
mov edx, 0x7b791b7b
invalid
Function at 0x1400116e0
Capabilities:
Hash data via bcrypt

Disassembly:
mov qword ss:[rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov eax, 0xffffffff
mov rbx, r8
mov rdi, rdx
mov rbp, rcx
cmp r8, rax
jb 0x140011750
mov qword [rsp + 0x30], rsi
mov esi, 0x40000
nop
mov rcx, qword [rbp + 0x10]
mov edx, ebx
mov eax, esi
cmp rax, rbx
cmovbe edx, esi
xor r9d, r9d
mov esi, edx
mov r8d, edx
mov rdx, rdi
call qword [sym.imp.bcrypt.dll_BCryptHashData]
test eax, eax
js 0x14001173b
add rdi, rsi
sub rbx, rsi
jne 0x140011710
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rcx + 0x10]
xor r9d, r9d
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.bcrypt.dll_BCryptHashData]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x68
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm3
mov rdx, rax
lea rcx, [0x140150c6c]
call fcn.1400c6650
movdqa xmm0, xmmword [rsp + 0x20]
movdqa xmm1, xmmword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x40]
movdqa xmm3, xmmword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
mov r9, qword [rsp + 0x88]
add rsp, 0x68
jmp 0x1400c5329
jmp rax
lea rax, sym.imp.bcrypt.dll_BCryptDestroyKey
jmp 0x1400c52b2
lea rax, sym.imp.bcrypt.dll_BCryptGetProperty
jmp 0x1400c52b2
lea rax, sym.imp.bcrypt.dll_BCryptHashData
jmp 0x1400c52b2
lea rax, sym.imp.bcrypt.dll_BCryptCreateHash
jmp 0x1400c52b2
Function at 0x14001dee0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x2d0
mov rax, qword [0x140155040]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov qword [r11 + 8], rbx
lea rcx, [r11 - 0x238]
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], r14
call fcn.140060380
mov rbx, qword [0x140159210]
lea r9, [rsp + 0x48]
mov edi, 3
mov qword [rsp + 0x58], 0x92
mov r14d, 5
lea rdx, [rsp + 0x50]
xor ebp, ebp
mov qword [rsp + 0x50], r14
mov r8d, edi
mov qword [rsp + 0x60], rbp
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x14001df94
lfence
mov rdx, qword [rsp + 0x48]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
js 0x14001df94
mov rdx, qword [rsp + 0x38]
lea r9, [0x14001f860]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rcx, rbx
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
jmp 0x14001df97
mov rax, rbp
mov qword [0x1401594f0], rax
lea rax, str.MainWindowState
mov qword ds:[rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], 0x1e
lock cmpxchg qword [0x1401591a0], r14
je 0x14001dfce
lea rcx, [0x1401591a0]
call fcn.140087fe0
lea rcx, ds:[rsp + 0x38]
mov qword [rsp + 0x2f0], rsi
call fcn.140067da0
mov rbx, rax
test rax, rax
je 0x14001dff7
cmp dword [rax], 1
jne 0x14001dff7
mov esi, dword [rax + 0x28]
jmp 0x14001dffe
mov esi, dword [rsp + 0x30]
mov rbx, rbp
mov rax, r14
mov r14, qword [rsp + 0x2f8]
lock cmpxchg qword [0x1401591a0], rbp
mov rbp, qword [rsp + 0x2e8]
je 0x14001e028
lea rcx, [0x1401591a0]
call fcn.140088180
test rbx, rbx
mov rbx, qword [rsp + 0x2e0]
jne 0x14001e047
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
cmp esi, edi
jne 0x14001e053
mov dword [0x140155ea0], edi
jmp 0x14001e059
mov edi, dword [0x140155ea0]
mov rcx, qword [0x1401594f0]
mov edx, edi
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1401594f0]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor r9d, r9d
lea rcx, [rsp + 0x68]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x14001e0ea
nop dword [rax]
cmp eax, 0xffffffff
je 0x14001e0ea
mov rcx, qword [0x1401594f0]
lea rdx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x14001e0c6
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, ds:[rsp + 0x68]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0xa0]
call fcn.140060560
xor r9d, r9d
lea rcx, [rsp + 0x68]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x14001e090
lea rcx, [rsp + 0xa0]
call fcn.140060460
mov rsi, qword [rsp + 0x2f0]
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1400c6a20
add rsp, 0x2d0
pop rdi
ret
Function at 0x140037860
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x80
mov rdi, rdx
cmp qword [rcx], rdx
jne 0x14003794f
cmp dword ds:[rcx + 0x10], 0xffffff65
jne 0x14003794f
movzx eax, word [rcx + 0x18]
cmp ax, 0x41
je 0x1400378bf
cmp ax, 0x43
jne 0x14003794f
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14003794f
mov rcx, rdi
add rsp, 0x80
pop rdi
jmp fcn.140037800
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14003794f
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x14003794f
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rsi
lfence
xor ebx, ebx
mov esi, eax
nop dword [rax]
nop word [rax + rax]
lea r9, [rsp + 0x20]
mov dword [rsp + 0x30], 2
mov r8, rbx
mov dword [rsp + 0x2c], 2
mov edx, 0x102b
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
inc rbx
sub rsi, 1
jne 0x140037910
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x140042ec0
Capabilities:
Get file attributes
Get graphical window text

Disassembly:
push rbp
push rbx
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x140155040]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rax, qword [0x1401590d8]
xor ebx, ebx
mov r14, rcx
test rax, rax
je 0x140042ef6
mov rdx, qword [rax + 8]
jmp 0x140042ef9
mov rdx, rbx
mov dword [rsp + 0x38], 0x20
lea rcx, [rbp - 0x61]
mov dword [rsp + 0x30], 1
mov r8d, 0x100080
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x80
call fcn.140076e00
test eax, eax
js 0x1400430b6
mov rcx, qword [rbp - 0x61]
lea r8, [rbp + 0x17]
mov r9d, 0x28
mov dword [rsp + 0x20], 4
lea rdx, [rbp + 7]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x1400430ac
mov qword [rsp + 0x128], rsi
mov esi, 0xffffffff
mov qword [rsp + 0x130], rdi
cmp qword [rbp + 0x17], rbx
je 0x140042fd1
lea rcx, [rbp + 0x17]
call fcn.140040c60
mov rdi, rax
test rax, rax
je 0x140042f8b
mov rax, qword [rax + 8]
jmp 0x140042f8e
mov rax, rbx
lea r9, [rbp - 0x59]
mov dword [rbp - 0x59], 1
xor r8d, r8d
mov dword [rbp - 0x55], 0xb
mov edx, 0x104c
mov dword [rbp - 0x51], 1
mov rcx, r14
mov qword [rbp - 0x41], rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rdi - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140042fd1
call fcn.1400602c0
cmp qword [rbp + 0x27], rbx
je 0x14004303b
lea rcx, ds:[rbp + 0x27]
call fcn.140040c60
mov rdi, rax
test rax, rax
je 0x140042ff3
mov rax, qword [rax + 8]
jmp 0x140042ff6
mov rax, rbx
lea r9, ds:[rbp - 0x59]
mov dword [rbp - 0x59], 1
xor r8d, r8d
mov dword [rbp - 0x55], 0xc
mov edx, 0x104c
mov dword [rbp - 0x51], 1
mov rcx, r14
mov qword [rbp - 0x41], rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rdi - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14004303b
call fcn.1400602c0
nop dword [rax + rax]
cmp qword [rbp + 0x2f], rbx
je 0x14004309c
lea rcx, [rbp + 0x2f]
call fcn.140040c60
mov rdi, rax
test rax, rax
je 0x14004305b
mov rbx, qword [rax + 8]
lea r9, [rbp - 0x59]
mov dword [rbp - 0x59], 1
xor r8d, r8d
mov dword [rbp - 0x55], 0xd
mov edx, 0x104c
mov dword [rbp - 0x51], 1
mov rcx, r14
mov qword [rbp - 0x41], rbx
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rdi - 0x10]
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x14004309c
call fcn.1400602c0
mov rdi, qword [rsp + 0x130]
mov rsi, qword [rsp + 0x128]
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword ds:[rbp + 0x3f]
xor rcx, rsp
call fcn.1400c6a20
add rsp, 0x100
pop r14
pop rbx
pop rbp
ret
Function at 0x1400515c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x48], rbp
mov rdi, rcx
mov rcx, qword [rcx + 8]
xor r9d, r9d
mov qword [rsp + 0x50], rsi
xor r8d, r8d
mov qword [rsp + 0x28], r14
mov edx, 0x41f
xor r14b, r14b
call qword [sym.imp.USER32.dll_SendMessageW]
lea rbp, [rdi + 0x108]
lock bts qword [rbp], 0
setb al
test al, al
je 0x14005160d
mov rcx, rbp
call fcn.140087e40
mov rax, qword ds:[rdi + 0x100]
mov esi, dword [rdi + 0xf8]
cmp esi, dword [rax]
jae 0x1400516e6
mov qword [rsp + 0x40], rbx
mov r14b, 1
mov qword [rsp + 0x20], r15
xor r15d, r15d
nop dword [rax + rax]
mov rax, qword [rax + 8]
xorps xmm0, xmm0
mov ecx, esi
mov rbx, qword [rax + rcx*8]
mov rdx, rbx
mov qword [rbx + 4], r15
lea rax, [rbx + 0x188]
mov qword [rbx + 0xc], r15
mov qword [rbx + 0x14], r15
mov dword [rbx + 0x1c], r15d
mov qword [rbx + 0x2c], r15
mov qword [rbx + 0x34], r15
mov dword [rbx + 0x3c], r15d
mov dword [rbx], 5
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
mov qword [rbx + 0x20], rax
mov dword [rbx + 0x28], 6
mov rcx, qword [rdi + 0xe0]
call fcn.1400626c0
cmp qword [rdi + 0x98], r15
je 0x1400516cb
lea rcx, [rdi + 0x88]
mov rdx, rbx
call fcn.140038ce0
mov edx, dword [rbx]
movzx eax, al
xor edx, eax
and edx, 1
xor dword [rbx], edx
mov rax, qword [rdi + 0x100]
inc esi
cmp esi, dword [rax]
jb 0x140051640
mov r15, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
mov dword [rdi + 0xf8], esi
mov rcx, 0xffffffffffffffff
lock xadd qword [rbp], rcx
mov rsi, qword [rsp + 0x50]
movzx eax, cl
and al, 6
cmp al, 2
jne 0x14005171f
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [rbp], rdx
jne 0x14005171f
mov rcx, rbp
call fcn.140087d60
mov rbp, qword [rsp + 0x48]
test r14b, r14b
mov r14, qword [rsp + 0x28]
je 0x140051746
mov rcx, qword ds:[rdi + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x404
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword ds:[rdi + 8]
xor r9d, r9d
mov edx, 0x41f
mov r8d, 1
add rsp, 0x30
pop rdi
jmp qword [sym.imp.USER32.dll_SendMessageW]
Function at 0x1400567e0
Capabilities:
Get graphical window text

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
je 0x140056898
mov rdx, qword [0x140159180]
mov qword [rsp + 0x48], rbx
mov ebx, eax
add rbx, rbx
mov qword [rsp + 0x50], rdi
lea rcx, [rbx + 0x12]
call fcn.1400601a0
mov rdi, rax
mov rcx, rsi
lea rdx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rdx
xor eax, eax
mov word [rdx + rbx], ax
mov r8d, dword [rdi]
mov rdx, qword [rdi + 8]
shr r8d, 1
inc r8d
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x14005685d
mov rax, rdi
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
nop dword [rax]
call fcn.140061980
mov rbx, rax
lea rcx, [rdi - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14005684d
nop dword [rax + rax]
call fcn.1400602c0
mov rdi, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
add rsp, 0x30
pop rsi
jmp fcn.140061980

Function at 0x140057160
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov ecx, 2
add rdx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, qword [rdi]
mov rcx, rax
mov rdx, qword [rdi + 8]
mov rbx, rax
call fcn.1400e6ce0
mov rcx, qword [rdi]
xor eax, eax
mov word [rbx + rcx], ax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rsi
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400571f3
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x1400571f3
mov rdx, rbp
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
je 0x1400571f3
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x1400571fc
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140057220
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rbx
push r14
sub rsp, 0x28
mov rbx, rcx
call fcn.140061980
mov ecx, 0xd
mov r14, rax
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
nop
test eax, eax
je 0x140057383
mov rcx, rbx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140057383
mov ecx, 0xd
mov qword [rsp + 0x40], rbp
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbp, rax
test rax, rax
je 0x140057378
mov rcx, rax
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x140057373
mov rdx, rax
mov qword [rsp + 0x20], rdi
and rdx, 0xfffffffffffffff1
mov ecx, esi
xorps xmm1, xmm1
and ecx, 0xf
je 0x1400572ca
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x48], ecx
je 0x1400572c6
mov edx, ecx
shr rdx, 1
jmp 0x140057308
add rdx, 0x10
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x48], ecx
jne 0x1400572fa
nop
movdqu xmm0, xmmword [rdx + 0x10]
add rdx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x48], ecx
je 0x1400572e0
sub rdx, rsi
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rbx, [rdx + rdx]
mov rdx, qword [0x140159180]
lea rcx, [rbx + 0x12]
call fcn.1400601a0
mov rdi, rax
mov r8, rbx
mov rdx, rsi
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + rbx], ax
mov rcx, qword [rdi + 8]
call fcn.1400e6ce0
mov rcx, r14
mov r14, rdi
mov rdi, qword [rsp + 0x20]
test rcx, rcx
je 0x14005736a
add rcx, 0xfffffffffffffff0
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14005736a
call fcn.1400602c0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rsi, qword [rsp + 0x50]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbp, qword [rsp + 0x40]
mov rax, r14
add rsp, 0x28
pop r14
pop rbx
ret

Function at 0x1400573a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword ss:[rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140155040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, qword [0x140159210]
mov rsi, r9
mov rbp, qword [rsp + 0xb0]
lea r9, [rsp + 0x38]
mov rdi, r8
mov qword [rsp + 0x50], rdx
mov rcx, rbx
mov qword [rsp + 0x48], 5
mov r8d, 3
mov qword [rsp + 0x58], 0
lea rdx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x140057448
lfence
mov rdx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
js 0x140057448
mov rdx, qword ds:[rsp + 0x40]
mov r9, rsi
mov r8, rdi
mov qword [rsp + 0x20], rbp
mov rcx, rbx
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
jmp 0x14005744f
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400c6a20
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400593e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov r9, rcx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], r8
cmp r8, 0x40
jae 0x1400593ff
mov eax, 0xc000001f
add rsp, 0x28
ret
lea rax, [rdx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140059512
lea rax, [rdx + 0x40]
cmp rax, rdx
jb 0x140059504
lea r10, ds:[rdx + r8]
cmp rax, r10
ja 0x140059504
mov eax, 0x5a4d
cmp word [rdx], ax
je 0x14005943d
mov eax, 0xc000012f
add rsp, 0x28
ret
lfence
movsxd rax, dword [rdx + 0x3c]
cmp rax, r8
jae 0x1400594fa
cmp rax, 0x10000000
jae 0x1400594fa
lea r8, [rax + rdx]
lea r11, [r8 + 0x18]
cmp r11, r8
jb 0x1400594ec
cmp r8, rdx
jb 0x1400594ec
cmp r11, r10
ja 0x1400594ec
movzx eax, word [r8 + 6]
lea rcx, [rax + rax*4]
movzx eax, word [r8 + 0x14]
lea rax, [rax + rcx*8]
add rax, 0x18
add rax, r8
cmp rax, r8
jb 0x1400594e1
cmp rax, r10
ja 0x1400594e1
cmp dword ds:[r8], 0x4550
jne 0x1400594fa
movzx eax, word [r11]
mov word [r9 + 0x30], ax
mov ecx, 0x10b
sub ax, cx
mov ecx, 0xfeff
test cx, ax
jne 0x1400594fa
mov qword [r9 + 0x18], r8
movzx eax, word [r8 + 6]
mov dword [r9 + 0x20], eax
movzx ecx, word [r8 + 0x14]
add rcx, 0x18
add rcx, r8
mov qword [r9 + 0x28], rcx
xor eax, eax
add rsp, 0x28
ret
mov ecx, 0xc0000005
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
mov ecx, 0xc0000005
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
nop
jmp 0x140059517
mov eax, 0xc000007b
add rsp, 0x28
ret
mov ecx, 0xc0000005
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
nop
jmp 0x140059517
mov eax, 0xc000000d
add rsp, 0x28
ret