joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800122a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
movdqa xmm14, xmm10
pxor xmm10, xmm15
movdqu xmm15, xmmword [rbx + r14]
pxor xmm11, xmm10
pxor xmm8, xmm2
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm8, xmm3
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm8, xmm4
pxor xmm4, xmm12
pxor xmm14, xmm13
pxor xmm8, xmm5
pxor xmm5, xmm13
pxor xmm15, xmm14
pxor xmm8, xmm6
pxor xmm6, xmm14
pxor xmm8, xmm7
pxor xmm7, xmm15
movups xmm0, xmmword [r11 + 0x20]
lea r12, [r8 + 1]
lea r13, [r8 + 3]
lea r14, [r8 + 5]
add r8, 6
pxor xmm10, xmm9
bsf r12, r12
bsf r13, r13
bsf r14, r14
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
pxor xmm11, xmm9
pxor xmm12, xmm9
aesenc xmm6, xmm1
pxor xmm13, xmm9
pxor xmm14, xmm9
aesenc xmm7, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm15, xmm9
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [r11 + 0x40]
shl r12, 4
shl r13, 4
jmp 0x1800123c0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1800123c0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [r11 + 0x10]
shl r14, 4
aesenclast xmm2, xmm10
movdqu xmm10, xmmword [rbx]
mov rax, r10
aesenclast xmm3, xmm11
aesenclast xmm4, xmm12
aesenclast xmm5, xmm13
aesenclast xmm6, xmm14
aesenclast xmm7, xmm15
repz ret

Function at 0x180012460
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm8, xmm2
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm8, xmm3
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm8, xmm4
pxor xmm4, xmm12
pxor xmm8, xmm5
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x180012500
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x180012500
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesenclast xmm2, xmm10
aesenclast xmm3, xmm11
aesenclast xmm4, xmm12
aesenclast xmm5, xmm13
repz ret
Function at 0x180012580
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm8, xmm2
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesenc xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x1800125c0
aesenc xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1800125c0
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesenclast xmm2, xmm7
repz ret

Function at 0x1800129c0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
movdqa xmm14, xmm10
pxor xmm10, xmm15
movdqu xmm15, xmmword [rbx + r14]
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm14, xmm13
pxor xmm5, xmm13
pxor xmm15, xmm14
pxor xmm6, xmm14
pxor xmm7, xmm15
movups xmm0, xmmword [r11 + 0x20]
lea r12, [r8 + 1]
lea r13, [r8 + 3]
lea r14, [r8 + 5]
add r8, 6
pxor xmm10, xmm9
bsf r12, r12
bsf r13, r13
bsf r14, r14
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
pxor xmm11, xmm9
pxor xmm12, xmm9
aesdec xmm6, xmm1
pxor xmm13, xmm9
pxor xmm14, xmm9
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm15, xmm9
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [r11 + 0x40]
shl r12, 4
shl r13, 4
jmp 0x180012ac0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x180012ac0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x10]
shl r14, 4
aesdeclast xmm2, xmm10
movdqu xmm10, xmmword [rbx]
mov rax, r10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
aesdeclast xmm6, xmm14
aesdeclast xmm7, xmm15
repz ret
Function at 0x180012b60
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x180012c00
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x180012c00
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
repz ret

Function at 0x180012c80
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesdec xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x180012cc0
aesdec xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x180012cc0
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm7
repz ret
Function at 0x180013730
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
call fcn.1800137a0
shl edx, 4
test eax, eax
jne 0x180013796
lea rcx, [r8 + rdx + 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
movups xmmword [rcx], xmm0
movups xmmword [r8], xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [r8 - 0x10], xmm1
cmp rcx, r8
ja 0x18001375b
movups xmm0, xmmword [r8]
aesimc xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [rcx], xmm0
pxor xmm0, xmm0
add rsp, 8
repz ret
Function at 0x180014880
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x1800149a0
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x1800148e0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x1800148e0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x1800148e0
Function at 0x180043e40
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x180043e75
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x180043e50
and r10, 0xf
je 0x180043ea5
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x180043e80
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x180043e99
mov rax, r8
repz ret

Function at 0x180043eb0
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x180043eed
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x180043ec0
pxor xmm1, xmm1
and r10, 0xf
je 0x180043f23
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x180043efb
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x180043f17
mov rax, r8
repz ret
Function at 0x180085e00
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
mov dword [rsp + 0x20], VarUI4FromDisp
mov r8d, VarUI4FromDisp
lea rcx, [rsp + 0x24]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180085e71
mov eax, dword [rsp + 0x24]
cmp eax, 5
jae 0x180085e57
cmp eax, 4
jne 0x180085e71
cmp dword [rsp + 0x28], 0x5a
jb 0x180085e71
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18042cdf0
add rsp, 0x158
ret
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18042cdf0
add rsp, 0x158
ret
Function at 0x180095d90
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x268
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rax, qword [rcx + 0x288]
mov rbp, rcx
mov r15, qword [rsp + 0x2d0]
xor r13d, r13d
mov r14, qword [rsp + 0x2d8]
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rcx, qword [rax + 0xa8]
mov edi, 0xffffffff
test rcx, rcx
je 0x180095e54
lea r9, vtable.type_info.0
mov dword [rsp + 0x20], r13d
lea r8, vtable.type_info.0
xor edx, edx
call sub.VCRUNTIME140.dll___RTDynamicCast
test rax, rax
je 0x180095e54
mov edx, 0x414
mov rcx, rax
call fcn.1800f29d0
mov rcx, rax
mov dword [rsp + 0x20], r13d
xor edx, edx
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
call sub.VCRUNTIME140.dll___RTDynamicCast
test rax, rax
je 0x180095e54
mov rax, qword [rax + 0x50]
mov ecx, edi
test rax, rax
je 0x180095e49
mov ecx, dword [rax + 0x40]
cmp ecx, 0x415
sete al
jmp 0x180095e56
xor al, al
mov byte [rbx], al
mov rcx, qword [rbp + 0x440]
mov eax, dword [rcx + 0x40]
add eax, dword [rcx + 0x38]
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov eax, dword [rcx + 0x44]
add eax, dword [rcx + 0x3c]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [rbp + 0x468]
add eax, dword [rbp + 0x460]
cdq
sub eax, edx
sar eax, 1
sub eax, r8d
mov dword [rsp + 0x30], eax
mov eax, dword [rbp + 0x46c]
add eax, dword [rbp + 0x464]
cdq
sub eax, edx
sar eax, 1
sub eax, ecx
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x30]
mov qword [rsi], rax
mov rax, qword [rbp + 0x288]
mov rcx, qword [rax + 0xa8]
test rcx, rcx
je 0x180095fbd
lea r9, vtable.type_info.0
mov dword [rsp + 0x20], r13d
lea r8, vtable.type_info.0
xor edx, edx
call sub.VCRUNTIME140.dll___RTDynamicCast
mov rbx, rax
test rax, rax
je 0x180095fbd
mov edx, 0x417
mov rcx, rax
call fcn.1800f29d0
mov rcx, rax
mov dword [rsp + 0x20], r13d
xor edx, edx
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
call sub.VCRUNTIME140.dll___RTDynamicCast
test rax, rax
je 0x180095fbd
mov rax, qword [rax + 0x50]
test rax, rax
je 0x180095f2d
mov edi, dword [rax + 0x40]
cmp edi, 0x418
sete sil
je 0x180095fc0
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x180095fc0
mov rcx, qword [rbx + 0x140]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x180095fc0
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x20a
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbx + 0x68]
lea rdx, [rsp + 0x40]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetWindowTextW]
movzx eax, word [rsp + 0x40]
lea rdx, [rsp + 0x40]
mov rcx, r13
cmp ax, 0x30
jb 0x180095fb8
cmp ax, 0x39
ja 0x180095fb8
movzx eax, ax
lea rcx, [rcx + rcx*4]
add rdx, 2
lea rcx, [rcx - 0x18]
lea rcx, [rax + rcx*2]
movzx eax, word [rdx]
cmp ax, 0x30
jae 0x180095f96
mov dword [r15], ecx
jmp 0x180095fc0
xor sil, sil
mov byte [r12], sil
mov rax, qword [rbp + 0x440]
test rax, rax
jne 0x180095fd5
mov dword [r14], r13d
jmp 0x180095fdd
cvttsd2si eax, qword [rax + 0x58]
mov dword [r14], eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18042cdf0
add rsp, 0x268
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18009d650
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor eax, eax
mov dword [rsp + 0x20], VarUI4FromDisp
mov qword [rcx], rax
mov rdi, r8
mov qword [rcx + 8], rax
mov rbx, rcx
mov qword [rcx + 0x10], rax
xor edx, edx
mov qword [rcx + 0x18], rax
mov r8d, VarUI4FromDisp
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
lea rcx, [rsp + 0x24]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x18009d6cf
cmp dword [rsp + 0x24], 6
mov eax, 0x48
jae 0x18009d6d4
mov eax, 0x40
mov rcx, rdi
mov dword [rbx], eax
mov dword [rbx + 4], 0
call qword [sym.imp.USER32.dll_GetParent]
or dword [rbx + 4], 1
mov qword [rbx + 8], rax
mov rax, rbx
mov qword [rbx + 0x10], rdi
mov rcx, qword [0x18067b990]
mov qword [rbx + 0x28], rcx
mov rcx, qword [rsp + 0x188]
mov qword [rbx + 0x30], rcx
mov qword [rbx + 0x38], 0
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18042cdf0
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x1800aee50
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x160
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x180], rbx
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x20], 0
mov rcx, qword [rcx + 0x160]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1800aeef6
xor edx, edx
mov r8d, 0x105
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx + 0x160]
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1800aeed6
add rbx, 0x240
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.18008c6f0
jmp 0x1800aeefd
add rbx, 0x240
mov rdx, rbx
mov rcx, rdi
call fcn.1800a5b10
nop
mov dword [rsp + 0x20], 1
mov rax, rdi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18042cdf0
mov rbx, qword [rsp + 0x180]
add rsp, 0x160
pop rdi
ret
Function at 0x1800b64f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x1800b6534
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1800b6520
ret
Function at 0x1800bd280
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
movss xmm0, dword [0x180670fc8]
mov rsi, rcx
comiss xmm0, dword [0x1805bec68]
mov eax, dword [rcx + 0x10]
jb 0x1800bd2ab
imul eax, eax, 0x64
jmp 0x1800bd2b9
comiss xmm0, dword [0x1805bec48]
jb 0x1800bd2b9
lea eax, [rax + rax*4]
add eax, eax
mov rbx, qword [0x18067c090]
lea r8, [0x1805a5ed8]
mov rcx, rbx
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x1800bd2e2
xor ebx, ebx
jmp 0x1800bd3da
mov rdx, rdi
mov qword [rsp + 0x48], rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test eax, eax
je 0x1800bd3d3
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1800bd3d3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1800bd3d3
mov edx, ebp
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x1800bd3d3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1800bd3ca
mov r8d, ebp
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x40], 0
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x1800bd3ca
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1800bd3ca
call fcn.1800f76c0
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
test rbx, rbx
je 0x1800bd3d5
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x10], 0
test ecx, ecx
je 0x1800bd3d5
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
jmp 0x1800bd3d3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor ebx, ebx
mov rbp, qword [rsp + 0x48]
mov rcx, qword [rsi + 8]
mov qword [rsi + 8], rbx
test rcx, rcx
je 0x1800bd3f5
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x1800bd475
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0
call qword [sym.imp.gdiplus.dll_GdipGetImageWidth]
test eax, eax
je 0x1800bd418
mov dword [rbx + 0x10], eax
mov eax, dword [rsp + 0x40]
xor edx, edx
div dword [rsi + 0x14]
mov rbx, qword [rsi + 8]
lea rdx, [rsp + 0x40]
mov edi, eax
mov dword [rsp + 0x40], 0
mov rcx, qword [rbx + 8]
call qword [sym.imp.gdiplus.dll_GdipGetImageHeight]
test eax, eax
je 0x1800bd445
mov dword [rbx + 0x10], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x2c], eax
mov al, 1
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], edi
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi + 0x18], xmm0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x50]
xor al, al
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1800bf1d0
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20a
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbx + 0x68]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetWindowTextW]
movzx edx, word [rsp + 0x20]
xor eax, eax
cmp dx, 0x2d
jne 0x1800bf259
movzx edx, word [rsp + 0x22]
lea r8, [rsp + 0x22]
cmp dx, 0x30
jb 0x1800bf255
cmp dx, 0x39
ja 0x1800bf255
lea rcx, [rax + rax*4]
add r8, 2
movzx eax, dx
movzx edx, word [r8]
lea rax, [rax + rcx*2]
add rax, 0xffffffffffffffd0
cmp dx, 0x30
jae 0x1800bf232
neg eax
jmp 0x1800bf287
lea r8, [rsp + 0x20]
cmp dx, 0x30
jb 0x1800bf287
cmp dx, 0x39
ja 0x1800bf287
lea rcx, [rax + rax*4]
add r8, 2
movzx eax, dx
movzx edx, word [r8]
lea rax, [rax + rcx*2]
add rax, 0xffffffffffffffd0
cmp dx, 0x30
jae 0x1800bf264
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18042cdf0
add rsp, 0x240
pop rbx
ret

Function at 0x1800c0050
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x18066dcd8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbx + 0x60]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetWindowTextW]
movzx edx, word [rsp + 0x20]
lea r8, [rsp + 0x20]
xor eax, eax
cmp dx, 0x30
jb 0x1800c00ca
cmp dx, 0x39
ja 0x1800c00ca
lea rcx, [rax + rax*4]
add r8, 2
movzx eax, dx
movzx edx, word [r8]
lea rax, [rax + rcx*2]
add rax, 0xffffffffffffffd0
cmp dx, 0x30
jae 0x1800c00a7
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18042cdf0
add rsp, 0x240
pop rbx
ret

Function at 0x1800c16b0
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 0xb0]
test rcx, rcx
je 0x1800c16fb
mov edx, 0x450
call fcn.1800f29d0
mov rcx, rax
mov dword [rsp + 0x20], 0
xor edx, edx
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
call sub.VCRUNTIME140.dll___RTDynamicCast
test rax, rax
je 0x1800c16fb
mov rcx, rax
add rsp, 0x38
jmp fcn.1800c0050
mov eax, 1
add rsp, 0x38
ret

Function at 0x1800c1770
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 0xa8]
test rcx, rcx
je 0x1800c17bb
mov edx, 0x420
call fcn.1800f29d0
mov rcx, rax
mov dword [rsp + 0x20], 0
xor edx, edx
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
call sub.VCRUNTIME140.dll___RTDynamicCast
test rax, rax
je 0x1800c17bb
mov rcx, rax
add rsp, 0x38
jmp fcn.1800bf1d0
xor eax, eax
add rsp, 0x38
ret