joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007bc28
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x28
mov r8, qword [0x14017d048]
mov rcx, qword [str.SFXDefault]
lea rdx, [0x1400e4068]
call fcn.14006d344
mov r11, qword [0x14017d048]
mov rcx, qword [str.SFXDefault]
mov r8d, dword [r11 + 0x1000]
lea rdx, str.PathType
call fcn.14006d35c
mov r11, qword [0x14017d048]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x1004]
lea rdx, str.SavePath
call fcn.14006d35c
mov r8, qword [0x14017d048]
mov rcx, qword [str.SFXDefault]
lea rdx, [0x1400e1358]
add r8, 0x1006
call fcn.14006d344
mov r8, qword [0x14017d048]
mov rcx, qword [str.SFXDefault]
lea rdx, str.Presetup
add r8, 0x11006
call fcn.14006d344
mov r11, qword [0x14017d048]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x21006]
lea rdx, str.SetupCode
call fcn.14006d35c
mov r11, qword [0x14017d048]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x21007]
lea rdx, str.TempMode
call fcn.14006d35c
mov r8, qword [0x14017d048]
mov rcx, qword [str.SFXDefault]
lea rdx, str.TempModeQuestion
add r8, 0x21008
call fcn.14006d344
mov r8, qword [0x14017d048]
mov rcx, qword [str.SFXDefault]
lea rdx, str.TempModeTitle
add r8, 0x21808
call fcn.14006d344
mov r11, qword [0x14017d048]
mov rcx, qword [str.SFXDefault]
mov r8d, dword [r11 + 0x21a08]
lea rdx, str.Silent
call fcn.14006d35c
mov r11, qword [0x14017d048]
mov rcx, qword [str.SFXDefault]
mov r8d, dword [r11 + 0x21a0c]
lea rdx, str.Overwrite
call fcn.14006d35c
mov r11, qword [0x14017d048]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x21a11]
lea rdx, str.UpdateFiles
call fcn.14006d35c
mov r11, qword [0x14017d048]
mov rcx, qword [str.SFXDefault]
movzx r8d, byte [r11 + 0x21a10]
lea rdx, str.FreshFiles
call fcn.14006d35c
mov r8, qword [0x14017d048]
mov rcx, qword [str.SFXDefault]
lea rdx, str.DelFiles
add r8, 0x21a12
call fcn.14006d344
mov r8, qword [0x14017d048]
mov rcx, qword [str.SFXDefault]
lea rdx, str.Title
add r8, 0x23a12
call fcn.14006d344
mov r8, qword [0x14017d048]
mov rcx, qword [str.SFXDefault]
lea rdx, [0x1400e7040]
add r8, 0x23c12
call fcn.14006d344
mov r8, qword [0x14017d048]
add r8, 0x43c12
mov rcx, qword [str.SFXDefault]
lea rdx, str.LicenseTitle
call fcn.14006d344
mov r8, qword [0x14017d048]
mov rcx, qword [str.SFXDefault]
lea rdx, str.LicenseText
add r8, 0x43e12
call fcn.14006d344
mov r8, qword [0x14017d048]
mov rcx, qword [str.SFXDefault]
lea rdx, str.ShortcutText
add r8, 0x63e12
call fcn.14006d344
mov rcx, qword [str.SFXDefault]
lea r8, [0x1401647a2]
lea rdx, str.SFXLogo
call fcn.14006d344
mov rcx, qword [str.SFXDefault]
lea r8, [0x1401637a2]
lea rdx, str.SFXIcon
call fcn.14006d344
movzx r8d, byte [0x1401657a2]
mov rcx, qword [str.SFXDefault]
lea rdx, str.SFXElevate
call fcn.14006d35c
mov rcx, qword [str.SFXDefault]
lea r8, [0x14015c3d8]
lea rdx, str.SFXModule
add rsp, 0x28
jmp fcn.14006d344
Function at 0x14007c060
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2030
call fcn.1400d8110
sub rsp, rax
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x2020], rax
lea rdx, [0x1400e3698]
call fcn.14003c204
mov rsi, rax
test rax, rax
je 0x14007c146
xor r12d, r12d
xor r13d, r13d
lea ebx, [r12 + 1]
lea rcx, [rsp + 0x20]
mov r9, rsi
mov r8d, 0x2000
mov rdx, rbx
call fcn.1400c9ab0
cmp eax, 0x20
mov r15, rax
jle 0x14007c13a
lea r14d, [rax - 0x20]
xor ebp, ebp
test r14d, r14d
jle 0x14007c11b
lea rdi, [rsp + 0x21]
cmp byte [rdi - 1], 0x72
jne 0x14007c111
cmp byte [rdi], 0x65
jne 0x14007c111
movsxd rax, ebp
lea rdx, str.quireAdministrator_
mov r8d, 0x14
lea rcx, [rsp + rax + 0x22]
call fcn.1400c84a0
test eax, eax
je 0x14007c13c
add ebp, ebx
add rdi, rbx
cmp ebp, r14d
jl 0x14007c0e8
lea r12d, [r12 + r15 - 0x20]
xor r8d, r8d
mov rcx, rsi
mov edx, r12d
call fcn.1400ca200
add r13d, ebx
cmp r13d, 0x80
jb 0x14007c0ba
xor bl, bl
mov rcx, rsi
call fcn.1400c8d40
mov al, bl
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400c6350
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14007f0c0
Capabilities:
Hash data using sha1

Disassembly:
and dword [rcx + 0x18], 0
and dword [rcx + 0x14], 0
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
ret

Function at 0x14007f358
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov r8, rcx
mov r10d, 0x10
lea rcx, [rsp]
lea r9, [r8 + 0x1c]
mov eax, dword [r9]
add r9, 4
mov edx, eax
ror edx, 8
and edx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or edx, eax
mov dword [rcx], edx
add rcx, 4
sub r10, 1
jne 0x14007f388
lea rcx, [rsp + 8]
lea edx, [r10 + 0x40]
mov eax, dword [rcx + 0x2c]
xor eax, dword [rcx + 0x18]
xor eax, dword [rcx - 8]
xor eax, dword [rcx]
add rcx, 4
rol eax, 1
sub rdx, 1
mov dword [rcx + 0x34], eax
jne 0x14007f3b9
mov r13d, dword [r8 + 8]
mov r14d, dword [r8 + 0xc]
mov r15d, dword [r8 + 0x10]
mov esi, dword [r8 + 0x14]
mov ebp, dword [r8 + 0x18]
lea r10d, [rdx + 0x14]
mov r9d, r13d
mov r12d, r14d
mov r11d, r15d
lea rbx, [rsp]
mov rdi, r10
mov edx, r9d
rol r9d, 5
mov eax, r11d
and eax, r12d
mov ecx, r12d
not ecx
and ecx, esi
xor ecx, eax
add r9d, ecx
add r9d, dword [rbx]
add rbx, 4
lea r9d, [r9 + rbp + 0x5a827999]
mov ebp, esi
mov esi, r11d
mov r11d, r12d
mov r12d, edx
ror r11d, 2
sub rdi, 1
jne 0x14007f3fb
lea rdx, [rsp + 0x50]
mov rbx, r10
mov ecx, r9d
rol r9d, 5
mov eax, esi
xor eax, r11d
xor eax, r12d
add r9d, eax
add r9d, dword [rdx]
add rdx, 4
lea r9d, [r9 + rbp + 0x6ed9eba1]
mov ebp, esi
mov esi, r11d
mov r11d, r12d
mov r12d, ecx
ror r11d, 2
sub rbx, 1
jne 0x14007f440
lea rbx, [rsp + 0xa0]
mov rdi, r10
mov edx, r9d
rol r9d, 5
mov ecx, r11d
xor ecx, r12d
add r9d, ebp
mov eax, r11d
and ecx, esi
and eax, r12d
mov ebp, esi
xor ecx, eax
mov esi, r11d
mov r11d, r12d
add ecx, dword [rbx]
ror r11d, 2
add rbx, 4
sub rdi, 1
mov r12d, edx
lea r9d, [rcx + r9 - 0x70e44324]
jne 0x14007f481
lea rcx, [rsp + 0xf0]
mov edx, r9d
rol r9d, 5
mov eax, esi
add r9d, dword [rcx]
xor eax, r11d
add rcx, 4
xor eax, r12d
add eax, ebp
mov ebp, esi
mov esi, r11d
mov r11d, r12d
lea r9d, [rax + r9 - 0x359d3e2a]
mov r12d, edx
ror r11d, 2
sub r10, 1
jne 0x14007f4c6
lea eax, [r13 + r9]
mov dword [r8 + 8], eax
lea eax, [r14 + rdx]
mov dword [r8 + 0xc], eax
lea eax, [r15 + r11]
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov dword [r8 + 0x10], eax
mov eax, dword [r8 + 0x14]
add eax, esi
mov rsi, qword [r11 + 0x40]
mov dword [r8 + 0x14], eax
mov eax, dword [r8 + 0x18]
add eax, ebp
mov rbp, qword [r11 + 0x38]
mov dword [r8 + 0x18], eax
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x14007f54c
Capabilities:
Hash data using sha1

Disassembly:
and dword [rcx + 4], 0
and dword [rcx], 0
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0xc3d2e1f0
ret
Function at 0x14007f768
Capabilities:
Hash data using sha256

Disassembly:
and qword [rcx + 0x20], 0
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
ret
Function at 0x14007fab8
Capabilities:
Hash data using sha256

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x140
mov rsi, qword [rcx + 0x20]
mov edi, dword [rcx + 0x20]
lea rbp, [rcx + 0x30]
shl rsi, 3
and edi, 0x3f
mov qword [rcx + 0x28], rbp
mov r12, rdx
mov rbx, rcx
mov byte [rdi + rcx + 0x30], 0x80
jmp 0x14007fb09
and edi, 0x3f
jne 0x14007fb04
mov rcx, rbx
call fcn.14007f7a8
mov byte [rdi + rbx + 0x30], 0
inc edi
cmp edi, 0x38
jne 0x14007faf7
movsxd rax, edi
lea edx, [rdi - 0x30]
lea rcx, [rax + rbx + 0x30]
mov rax, rsi
shl rsi, 8
shr rax, 0x38
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x14007fb1b
mov rcx, rbx
call fcn.14007f7a8
xor r11d, r11d
xor r8d, r8d
mov eax, r11d
mov ecx, 3
inc r11d
and eax, 3
sub ecx, eax
mov rax, r8
inc r8
shr rax, 2
shl ecx, 3
mov edx, dword [rbx + rax*4]
shr edx, cl
mov byte [r12], dl
inc r12
cmp r11d, 0x20
jb 0x14007fb3f
and qword [rbx + 0x20], 0
lea rcx, [rsp + 0x20]
mov edx, 0x20
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
call fcn.1400798a8
lea rcx, [rsp + 0x40]
mov edx, 0x100
call fcn.1400798a8
mov edx, 0x40
mov rcx, rbp
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
jmp fcn.1400798a8

Function at 0x140080924
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor ebp, ebp
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp qword [0x1400ff518], rbp
jne 0x140080999
lea r9d, [rbp + 0x64]
lea r8, [rsp + 0xa0]
lea edx, [rbp + 0xf]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movzx r11d, word [rsp + 0xa0]
lea rax, [0x140181074]
mov word [0x140181074], r11w
mov word [0x140181076], bp
mov qword [0x1400ff518], rax
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140080620
lea r9, [0x1400ff500]
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x400
mov dword [rsp + 0x28], edi
mov word [rbx], bp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov word [rbx + rdi*2 - 2], bp
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400c6350
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret
Function at 0x140081124
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x1400811a2
lea edi, [rax + 1]
mov eax, 2
movsxd rcx, edi
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400c61d4
mov rbx, rax
test rax, rax
je 0x1400811a2
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call fcn.140080fc8
mov rcx, rbx
call fcn.1400c72ec
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14008124c
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400812b2
lea r8, [rsp + 0x34]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
and qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x50]
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edx, 0x80000000
mov ecx, 0xd
call qword [sym.imp.USER32.dll_ExitWindowsEx]
add rsp, 0x48
ret
Function at 0x14008332c
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x80
mov edi, edx
mov rbx, rcx
cmp edx, 0xa8
jne 0x140083357
call fcn.1400832d4
mov al, 1
jmp 0x14008347b
cmp edx, 0xa9
jne 0x14008338f
mov ecx, 0x4f9
call fcn.140076080
xor r9d, r9d
xor edx, edx
mov r8, rax
lea rax, [0x1400e04f4]
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x140083350
call fcn.140081934
mov rsi, rax
cmp edi, 0xaa
jne 0x1400833af
or dword [rbx + 0x100], 0xffffffff
lea rax, [0x1400e04f4]
jmp 0x140083428
lea eax, [rdi - 0x3e8]
cmp eax, 0x7f
ja 0x140083479
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x50]
call fcn.1400c7170
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, edi
mov rcx, rsi
mov dword [rsp + 0x30], 0x50
mov dword [rsp + 0x34], 0x20
call qword [sym.imp.USER32.dll_GetMenuItemInfoW]
test eax, eax
je 0x140083479
mov rax, qword [rbx + 0xe8]
cmp qword [rsp + 0x60], rax
jae 0x140083479
movsxd rax, dword [rsp + 0x60]
mov rcx, rax
mov dword [rbx + 0x100], eax
imul rcx, rcx, 0x1304
add rcx, qword [rbx + 0xe0]
call fcn.1400615e8
lea rdx, str.ActivePath
lea rcx, str.InterfaceThemes
mov r8, rax
call fcn.14006d344
mov edx, dword [rbx + 0x1104]
cmp edx, 0xffffffff
je 0x140083455
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.USER32.dll_CheckMenuItem]
mov r8d, 8
mov edx, edi
mov rcx, rsi
call qword [sym.imp.USER32.dll_CheckMenuItem]
mov rcx, rbx
mov dword [rbx + 0x1104], edi
call fcn.1400829a0
jmp 0x140083350
xor al, al
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140083840
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
sub rsp, 0x30
mov r8d, 0x20
mov rbx, rcx
mov dword [rcx], edx
cmp edx, r8d
jbe 0x140083865
mov dword [rcx], r8d
cmp dword [rcx], 0
jne 0x140083870
mov dword [rcx], 1
cmp dword [rcx], r8d
jbe 0x140083878
mov dword [rcx], r8d
mov byte [rcx + 0x318], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
xor r9d, r9d
xor ecx, ecx
lea edx, [r9 + 1]
mov qword [rbx + 0x320], rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea rcx, [rbx + 0x330]
mov qword [rbx + 0x328], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp qword [rbx + 0x320], 0
lea r13, [0x140134b90]
je 0x1400838d4
cmp qword [rbx + 0x328], 0
jne 0x1400838f0
lea rdx, str._nThread_pool_initialization_failed.
mov rcx, r13
call fcn.14003347c
mov edx, 2
mov rcx, r13
call fcn.1400330f4
xor edi, edi
cmp dword [rbx], edi
jbe 0x14008396a
lea rsi, [rbx + 8]
lea rax, [rsp + 0x58]
lea r8, [0x1400837e8]
mov r9, rbx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov edx, 0x10000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
jne 0x14008394a
lea rdx, str.CreateThread_failed
mov rcx, r13
call fcn.14003347c
mov rcx, r13
call fcn.1400330fc
lea edx, [rbp + 2]
mov rcx, r13
call fcn.1400330f4
mov qword [rsi], rbp
mov edx, dword [0x14018109c]
test edx, edx
je 0x140083960
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc edi
add rsi, 8
cmp edi, dword [rbx]
jb 0x1400838fa
and dword [rbx + 0x310], 0
and dword [rbx + 0x314], 0
and dword [rbx + 0x108], 0
mov rbp, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r13
pop rdi
pop rsi
ret

Function at 0x140083f48
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov ecx, r9d
mov dil, r8b
mov ebx, edx
call qword [sym.imp.USER32.dll_GetSysColor]
and dword [rsp + 0x30], 0
lea rcx, [rbx + rbx*4]
add rcx, rcx
mov dword [rsp + 0x34], eax
lea rax, [0x1400ff570]
test dil, dil
je 0x140083f82
mov ebx, dword [rax + rcx*8 + 4]
jmp 0x140083f86
mov ebx, dword [rax + rcx*8 + 8]
test dil, dil
jne 0x140083fc5
mov rcx, qword [0x140134b88]
movsxd rdx, ebx
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, qword [0x140134b88]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140083fbd
cmp word [rax + 0xe], 8
je 0x140083fc5
mov dword [rsp + 0x30], 0x800080
mov rcx, qword [0x140134b88]
lea r9, [rsp + 0x30]
movsxd rdx, ebx
xor r8d, r8d
mov dword [rsp + 0x20], 1
call qword [sym.imp.COMCTL32.dll_CreateMappedBitmap]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140085ef0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0xf0
mov rdi, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140085f22
call qword [sym.imp.USER32.dll_DestroyWindow]
and qword [rdi + 8], 0
mov r14d, 1
lea rdx, str.ViewSmall
lea rcx, str.GeneralToolbar
mov r8d, r14d
call fcn.14006d3c4
test eax, eax
je 0x140086162
and qword [rsp + 0x58], 0
mov rax, qword [0x140134b80]
lea rdx, str.ToolbarWindow32
mov qword [rsp + 0x50], rax
mov rax, qword [0x14014aae0]
mov qword [rsp + 0x48], 0xd
mov qword [rsp + 0x40], rax
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9d, 0x56000944
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
lea r8d, [r14 + 0x1f]
xor r9d, r9d
mov rcx, rax
mov edx, 0x41e
mov qword [rdi + 8], rax
call qword [sym.imp.USER32.dll_SendMessageW]
call fcn.1400a2730
lea esi, [r14 + 0xf]
mov r12b, al
mov ebp, esi
test al, al
je 0x140085fd6
mov ecx, esi
call fcn.1400a2658
mov ecx, esi
mov ebp, eax
call fcn.1400a2658
mov esi, eax
movzx edx, si
movzx ecx, bp
xor r8d, r8d
shl edx, 0x10
or edx, ecx
mov rcx, qword [rdi + 8]
movsxd rbx, edx
mov edx, 0x41f
mov r9, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 8]
mov r9, rbx
xor r8d, r8d
mov edx, 0x420
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
lea rdx, str.FolderUp.bmp
lea r8d, [r9 + 0xf]
lea rcx, [0x14015a270]
call fcn.140082dc8
mov rbx, rax
test rax, rax
jne 0x140086034
mov rbx, qword [rdi + 0x30]
test r12b, r12b
je 0x140086058
mov r8d, esi
mov edx, ebp
mov rcx, rbx
call fcn.1400a1c04
lea rcx, [0x14015a270]
mov rdx, rax
mov rbx, rax
call fcn.140082be8
mov rcx, qword [rdi + 8]
and qword [rsp + 0x60], 0
lea r9, [rsp + 0x60]
mov r8, r14
mov edx, 0x413
mov qword [rsp + 0x68], rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 8]
lea r9, [0x1400ffbb0]
mov r8, r14
mov edx, 0x444
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebx, 2
lea r8, [rsp + 0x80]
mov edx, ebx
mov rcx, rdi
call fcn.1400850f4
mov eax, dword [rsp + 0x88]
lea ecx, [rbx + 0x10]
test eax, eax
mov dword [rsp + 0x80], 0x4c
mov dword [rsp + 0x84], 0x173
cmove eax, r14d
and dword [rsp + 0xb0], 0
mov dword [rsp + 0xc8], ebx
or eax, 4
mov dword [rsp + 0x88], eax
mov rax, qword [rdi + 8]
mov qword [rsp + 0xa8], rax
call qword [sym.imp.USER32.dll_GetSysColor]
lea ecx, [rbx + 0xd]
mov dword [rsp + 0x8c], eax
call qword [sym.imp.USER32.dll_GetSysColor]
lea ecx, [rbx + 0x26]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0xb8]
lea rdx, [rsp + 0x70]
test eax, eax
cmove eax, ecx
mov rcx, qword [0x14014aae8]
mov dword [rsp + 0xb8], eax
call qword [sym.imp.USER32.dll_GetClientRect]
mov r11d, dword [rsp + 0x7c]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x80]
or r8, 0xffffffffffffffff
mov edx, 0x40a
mov dword [rsp + 0xb4], r11d
call qword [sym.imp.USER32.dll_SendMessageW]
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x140087928
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov r8d, dword [0x1401486bc]
mov eax, ecx
mov r9d, ecx
mov edx, r8d
lea r10, [0x1401820c0]
shr r8d, 8
xor rdx, rax
movzx eax, dl
mov edx, dword [r10 + rax*4]
xor edx, r8d
movzx eax, dl
mov dword [0x1401486bc], edx
mov edx, dword [0x1401486c4]
add eax, dword [0x1401486c0]
imul eax, eax, 0x8088405
inc eax
mov ecx, eax
mov dword [0x1401486c0], eax
mov eax, edx
shr ecx, 0x18
shr edx, 8
xor rcx, rax
movzx eax, cl
mov eax, dword [r10 + rax*4]
xor eax, edx
mov dword [0x1401486c4], eax
mov eax, r9d
ret

Function at 0x1400879e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov rcx, rdx
call fcn.140087994
mov rax, qword [rbx]
lea r11, [rsp + 0x20]
mov qword [r11], rax
mov eax, dword [rbx + 8]
mov dword [r11 + 8], eax
xor r11d, r11d
mov ecx, dword [0x1401486c4]
and ecx, 0xfffd
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
shr eax, 8
xor byte [rsp + r11 + 0x20], al
movzx ecx, byte [rsp + r11 + 0x20]
call fcn.140087928
inc r11
cmp r11, 0xc
jl 0x140087a15
mov rax, qword [0x140137518]
movzx ecx, byte [0x1401475bf]
test byte [rax + 0x40], 2
movzx eax, byte [0x1401475b7]
cmovne ecx, eax
movzx eax, byte [rsp + 0x2b]
cmp eax, ecx
je 0x140087a72
or eax, 0xffffffff
jmp 0x140087ac5
mov r11, qword [0x140147540]
mov rax, qword [0x1401362f0]
mov rbx, qword [0x140147538]
movsxd rcx, r11d
cmp rcx, rax
cmovg r11d, eax
test r11d, r11d
je 0x140087ac3
mov ecx, dword [0x1401486c4]
and ecx, 0xfffd
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
shr eax, 8
xor byte [rbx], al
movzx ecx, byte [rbx]
call fcn.140087928
inc rbx
sub r11d, 1
jne 0x140087a96
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400c6350
add rsp, 0x40
pop rbx
ret

Function at 0x140095e70
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
jmp 0x140095eef
mov rcx, qword [rdi + 0x18]
lea rdx, [rsp + 0x90]
mov r8, qword [rcx]
call qword [r8 + 0x1c0]
cmp dword [rsp + 0x90], 4
je 0x140095efe
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140095eef
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x2710
jbe 0x140095e8a
lea rcx, [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword [rdi + 0x18]
and qword [rsp + 0x20], 0
mov r11d, 3
mov dword [rsp + 0x38], 0x96
lea r9, [rsp + 0x30]
mov word [rsp + 0x30], r11w
mov rax, qword [rcx]
lea edx, [r11 + 0x3c]
lea r8d, [r11 - 1]
call qword [rax + 0x1b0]
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret