joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140032610
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [rcx + 0x1aa8]
mov r8d, r9d
mov r11d, 8
shl r8d, 8
lea ecx, [r8 + r8]
mov edx, r8d
mov eax, ecx
mov r8d, ecx
xor eax, 0x1021
and edx, 0x8000
cmovne r8d, eax
sub r11, 1
jne 0x140032627
mov dword [r10], r8d
inc r9d
add r10, 4
cmp r9d, 0x100
jb 0x14003261a
ret

Function at 0x14003ac0c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x1030
call fcn.1400fc480
sub rsp, rax
mov rax, qword [0x140160370]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov r15d, edx
lea rdx, [0x140120cd8]
call fcn.1400706c8
mov rbp, rax
xor eax, eax
test rbp, rbp
jne 0x14003ac5e
lea eax, [rbp + 0x32]
jmp 0x14003adb3
mov r14d, 0x1000
cmp r15d, 0x8000
jbe 0x14003ad6b
mov edx, r15d
xor r8d, r8d
shr edx, 3
mov rcx, rbp
add edx, r14d
call fcn.140107ce0
mov r12d, 1
lea rcx, [rsp + 0x20]
mov edx, r12d
mov r9, rbp
mov r8d, r14d
call fcn.1401079a4
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14003a99c
mov edx, r15d
xor r8d, r8d
shr edx, 2
mov rcx, rbp
add edx, r14d
mov esi, eax
call fcn.140107ce0
mov r9, rbp
lea rcx, [rsp + 0x20]
mov r8d, r14d
mov edx, r12d
call fcn.1401079a4
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14003a99c
lea edx, [r15 + r15]
xor r8d, r8d
shr edx, 2
mov rcx, rbp
add edx, r14d
mov edi, eax
call fcn.140107ce0
mov r9, rbp
lea rcx, [rsp + 0x20]
mov r8d, r14d
mov edx, r12d
call fcn.1401079a4
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14003a99c
lea edx, [r15 + r15*2]
xor r8d, r8d
shr edx, 2
mov rcx, rbp
add edx, r14d
mov ebx, eax
call fcn.140107ce0
mov r9, rbp
lea rcx, [rsp + 0x20]
mov r8d, r14d
mov edx, r12d
call fcn.1401079a4
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14003a99c
add eax, ebx
mov rcx, rbp
add eax, edi
add eax, esi
cdq
and edx, 3
lea ebx, [rdx + rax]
sar ebx, 2
call fcn.1401039c8
mov eax, ebx
jmp 0x14003adb3
cmp r15d, r14d
jbe 0x14003ad79
mov rax, r15
sub rax, r14
shr rax, 1
xor r8d, r8d
mov edx, eax
mov rcx, rbp
call fcn.140107ce0
mov r9, rbp
lea rcx, [rsp + 0x20]
mov r8, r14
mov edx, 1
call fcn.1401079a4
mov rcx, rbp
mov rbx, rax
call fcn.1401039c8
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14003a99c
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1400fc4f0
lea r11, [rsp + 0x1030]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14003e580
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
lea rbp, [rsp - 0x7230]
mov eax, 0x7330
call fcn.1400fc480
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x7348], rbx
mov qword [rsp + 0x7350], rsi
mov qword [rsp + 0x7358], rdi
mov rax, qword [0x140160370]
xor rax, rsp
mov qword [rbp + 0x7220], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x14003e6ff
mov ecx, eax
call fcn.14006f924
xor esi, esi
test al, al
je 0x14003e6ff
mov ecx, edi
call fcn.14006fb18
test al, al
jne 0x14003e6ff
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rbx + rdi*2], si
jne 0x14003e601
mov rcx, rbx
call fcn.1400803f0
cmp word [rax], si
je 0x14003e6ff
mov r9d, 0x800
lea r8, [rbp + 0x6220]
lea rdx, [0x14011c528]
mov rcx, rbx
call fcn.14007fe98
lea rcx, [rsp + 0x40]
call fcn.1400962cc
nop
lea rdx, [rbp + 0x6220]
lea rcx, [rsp + 0x40]
call fcn.140096308
mov r8d, 2
mov dword [rsp + 0x20], r8d
xor r9d, r9d
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x1050]
call fcn.14009266c
nop
mov qword [rbp + 0x1010], rsi
mov qword [rbp + 0x1018], rsi
mov qword [rbp + 0x1020], rsi
jmp 0x14003e6cb
mov r8, rdi
mov rdx, rbx
lea rcx, [rbp]
call fcn.1401038d0
test eax, eax
jne 0x14003e6df
mov rcx, rbx
call fcn.14006fde4
cmp byte [rbp + 0x100c], sil
je 0x14003e6c2
test byte [rbp + 0x1040], 1
je 0x14003e6cb
lea rcx, [rbp]
call fcn.14006f428
jmp 0x14003e6cb
lea rcx, [rbp]
call fcn.14006f4ac
lea rdx, [rbp]
lea rcx, [rbp + 0x1050]
call fcn.140093204
test eax, eax
je 0x14003e68a
mov rcx, rbx
call fcn.14006f428
nop
lea rcx, [rbp + 0x1050]
call fcn.14009273c
nop
lea rcx, [rsp + 0x40]
call fcn.140004acc
mov rcx, qword [rbp + 0x7220]
xor rcx, rsp
call fcn.1400fc4f0
lea r11, [rsp + 0x7330]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14003e728
Capabilities:
Get common file path

Disassembly:
mov r8d, 0x10
jmp fcn.14003e788

Function at 0x14003e788
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov eax, r8d
mov rdi, rdx
mov rsi, rcx
cmp rdx, 0x104
jb 0x14003e7c8
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor ecx, ecx
xor r8d, r8d
mov edx, eax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14003e7c8
mov bl, 1
jmp 0x14003e7da
mov r8, rdi
lea rdx, str.unknown_folder
mov rcx, rsi
call fcn.140096298
mov rsi, qword [rsp + 0x48]
mov al, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14003ecbc
Capabilities:
Enumerate pe sections
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdi, [0x140121048]
mov rbx, rcx
mov rdx, rdi
lea rcx, str.Setup.rar
call fcn.1400a84e8
movzx r8d, byte [rbx + 1]
lea rcx, str.Setup.zip
mov rdx, rdi
call fcn.1400a84e8
movzx r8d, byte [rbx + 2]
lea rcx, str.Setup.cab
mov rdx, rdi
call fcn.1400a84e8
movzx r8d, byte [rbx + 3]
lea rcx, str.Setup.arj
mov rdx, rdi
call fcn.1400a84e8
movzx r8d, byte [rbx + 4]
lea rcx, str.Setup.lz
mov rdx, rdi
call fcn.1400a84e8
movzx r8d, byte [rbx + 5]
lea rcx, str.Setup.lzh
mov rdx, rdi
call fcn.1400a84e8
movzx r8d, byte [rbx + 6]
lea rcx, str.Setup.7z
mov rdx, rdi
call fcn.1400a84e8
movzx r8d, byte [rbx + 7]
lea rcx, str.Setup.tar
mov rdx, rdi
call fcn.1400a84e8
movzx r8d, byte [rbx + 8]
lea rcx, str.Setup.gz
mov rdx, rdi
call fcn.1400a84e8
movzx r8d, byte [rbx + 9]
lea rcx, str.Setup.uue
mov rdx, rdi
call fcn.1400a84e8
movzx r8d, byte [rbx + 0xa]
lea rcx, str.Setup.bz2
mov rdx, rdi
call fcn.1400a84e8
movzx r8d, byte [rbx + 0xb]
lea rcx, str.Setup.jar
mov rdx, rdi
call fcn.1400a84e8
movzx r8d, byte [rbx + 0xc]
lea rcx, str.Setup.iso
mov rdx, rdi
call fcn.1400a84e8
movzx r8d, byte [rbx + 0xd]
lea rcx, str.Setup.z
mov rdx, rdi
call fcn.1400a84e8
movzx r8d, byte [rbx + 0xe]
lea rcx, str.Setup.xz
mov rdx, rdi
call fcn.1400a84e8
movzx r8d, byte [rbx + 0xf]
lea rcx, str.Setup.zipx
mov rdx, rdi
call fcn.1400a84e8
movzx r8d, byte [rbx + 0x10]
lea rcx, str.Setup.001
mov rdx, rdi
call fcn.1400a84e8
movzx r8d, byte [rbx + 0x14]
lea rdi, str.SetupLinks
mov rcx, rdi
lea rdx, [0x140121050]
call fcn.1400a84e8
movzx r8d, byte [rbx + 0x15]
lea rdx, str.StartMenu
mov rcx, rdi
call fcn.1400a84e8
movzx r8d, byte [rbx + 0x16]
lea rdx, str.Programs
mov rcx, rdi
call fcn.1400a84e8
movzx r8d, byte [rbx + 0x17]
lea rdi, [0x14011c660]
mov rcx, rdi
lea rdx, str.ShellExt
call fcn.1400a84e8
movzx r8d, byte [rbx + 0x18]
lea rdx, str.CascadedMenu
mov rcx, rdi
call fcn.1400a84e8
movzx r8d, byte [rbx + 0x19]
lea rdx, str.MenuIcons
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400a84e8
Function at 0x1400445c0
Capabilities:
Get common file path

Disassembly:
cmp dword [0x140167d48], 1
mov rax, rdx
jne 0x1400445d7
mov rdx, r8
mov rcx, rax
jmp fcn.1400cfe04
lea rdx, [rcx + 0x1080]
mov rcx, rax
jmp fcn.140096298

Function at 0x140044eec
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140160370]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rbx + 0x60]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rcx, qword [rbx + 0x60]
lea r9, [rsp + 0x20]
xor r8d, r8d
mov edx, 0x1012
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x12
movsx edi, ax
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x11
movsx ebx, ax
call qword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
mov eax, 1
test byte [rsp + 0x28], al
jne 0x140044f7f
mov edx, 0x8000
test edx, edi
jne 0x140044f7f
test edx, ebx
jne 0x140044f7f
test edx, ecx
je 0x140044f81
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400fc4f0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140045128
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x2250]
mov eax, 0x2350
call fcn.1400fc480
sub rsp, rax
mov rax, qword [0x140160370]
xor rax, rsp
mov qword [rbp + 0x2240], rax
mov rdi, rcx
mov ebx, 1
xor esi, esi
mov r14d, 0x800
mov ecx, 0x3d4
call fcn.1400901c8
mov rdx, rax
lea rcx, [rbp + 0x240]
mov r8, r14
call fcn.140096298
cmp ebx, 1
jbe 0x1400451be
lea rcx, [rbp + 0x240]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], si
jne 0x140045198
lea rcx, [rbp + 0x240]
mov r9d, ebx
lea rcx, [rcx + rax*2]
mov rdx, r14
lea r8, str.___u_
call fcn.140002810
cmp ebx, 0x3e8
ja 0x1400451dd
lea rdx, [rbp + 0x240]
mov rcx, rdi
call fcn.140044128
test al, al
je 0x1400451dd
inc ebx
jmp 0x14004516c
mov rcx, qword [rdi + 0x60]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
call qword [sym.imp.USER32.dll_SendMessageW]
xor r8d, r8d
lea rcx, [rbp + 0x1240]
mov rdx, r14
mov rbx, rax
call fcn.1400ce934
mov r9d, 0x2b8
mov dword [rsp + 0x20], 0x4001
lea r8, [rbp - 0x80]
xor edx, edx
lea rcx, [rbp + 0x1240]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x48]
call fcn.1400fd700
mov eax, dword [rbp - 0x78]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 0x60]
xor r8d, r8d
mov dword [rsp + 0x54], eax
mov edx, 0x104d
lea rax, [rbp + 0x240]
mov dword [rsp + 0x30], 3
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x38], esi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [rdi + 0x60]
xor r9d, r9d
movsxd r8, ebx
mov edx, 0x1076
mov byte [rdi + 0x7d], 1
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x2240]
xor rcx, rsp
call fcn.1400fc4f0
lea r11, [rsp + 0x2350]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14004894c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
mov eax, 0x2040
call fcn.1400fc480
sub rsp, rax
mov rax, qword [0x140160370]
xor rax, rsp
mov qword [rsp + 0x2030], rax
mov rbx, rcx
lea rdx, str.RestoreFolder
lea rcx, [0x14011c730]
mov r8d, 1
call fcn.1400a78ac
xor esi, esi
mov dword [rsp + 0x20], 0x800
lea r9, [0x14011bd58]
test eax, eax
je 0x1400489f3
lea r8, [rsp + 0x30]
lea rdx, str.LastFolder
lea rcx, [0x14011c730]
call fcn.1400a7a38
cmp word [rsp + 0x30], si
je 0x140048a79
lea rcx, [rsp + 0x30]
call fcn.14006f794
test al, al
je 0x140048a79
lea rcx, [rbx + 0x1080]
mov r8d, 0x800
lea rdx, [rsp + 0x30]
call fcn.140096298
jmp 0x140048a79
lea r8, [rsp + 0x1030]
lea rdx, str.StartFolder
lea rcx, [0x14011c5e0]
call fcn.1400a7a38
mov r8d, 0x800
mov word [rsp + 0x30], si
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x1030]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x7fe
ja 0x140048a79
movzx eax, word [rsp + 0x30]
test ax, ax
je 0x140048a79
cmp ax, word [0x14011c97c]
jne 0x140048a56
movzx eax, word [rsp + 0x32]
cmp ax, word [0x14011c97e]
je 0x140048a79
mov r8d, 0x800
lea rdx, [rsp + 0x30]
lea rcx, [rbx + 0x1080]
call fcn.140096298
lea rcx, [rbx + 0x1080]
call fcn.14000cca4
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.1400fc4f0
mov rbx, qword [rsp + 0x2058]
add rsp, 0x2040
pop rsi
ret
Function at 0x14004af90
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov rbx, rcx
test rcx, rcx
je 0x14004b0e3
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rcx + rdi*2], r15w
jne 0x14004afbb
test rdi, rdi
je 0x14004b0e3
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14004b0e8
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea rbp, [rdi*2 + 2]
mov ecx, 0x2002
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x14004b036
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14004b036
lea r8, [rdi + 1]
mov rdx, rax
mov rcx, rbx
call fcn.140099110
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rsi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rdx, rbp
mov ecx, 0x2002
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x14004b08f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r14, rax
test rax, rax
je 0x14004b08f
lea r8, [rdi + 1]
mov rdx, rax
mov rcx, rbx
call fcn.140099110
mov rdx, r14
mov rcx, r14
call qword [sym.imp.USER32.dll_CharToOemA]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rsi
mov ecx, 7
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rdx, rbp
mov ecx, 0x2002
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x14004b0dd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14004b0dd
sub rax, rbx
movzx ecx, word [rbx]
mov word [rax + rbx], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x14004b0b6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14004b42c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x140160370]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, rcx
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
inc eax
movsxd rdi, eax
lea rcx, [rdi + rdi]
call fcn.14010348c
xor r12d, r12d
mov rbx, rax
test rax, rax
je 0x14004b5fb
mov r8d, edi
mov word [rax], r12w
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowTextW]
or r13, 0xffffffffffffffff
mov rdi, r13
inc rdi
cmp word [rbx + rdi*2], r12w
jne 0x14004b497
lea rdx, [rsp + 0x28]
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetDC]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
mov r14, rax
lea edx, [r9 + 0x31]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
lea r9, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
mov rcx, r14
mov r15, rax
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov ecx, dword [rsp + 0x30]
cmp dword [rsp + 0x20], ecx
jl 0x14004b5db
mov rcx, rbx
call fcn.1400803f0
cmp rax, rbx
je 0x14004b539
mov r8, r13
inc r8
cmp word [rax + r8*2], r12w
jne 0x14004b50f
lea r8, [r8*2 + 2]
mov rdx, rax
mov rcx, rbx
call fcn.1400fd8b0
mov rdi, r13
inc rdi
cmp word [rbx + rdi*2], r12w
jne 0x14004b52f
mov rsi, rdi
lea r9, [rsp + 0x20]
shr rsi, 1
mov r8d, edi
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
lea rdi, [rbx + 4]
mov rcx, r13
lea rdi, [rdi + rsi*2]
inc rcx
cmp word [rdi + rcx*2], r12w
jne 0x14004b55e
jmp 0x14004b5c5
cmp rsi, 1
jb 0x14004b5cf
cmp rcx, 1
jb 0x14004b5cf
mov eax, 0x2026
lea r8, [rcx*2 + 2]
lea rcx, [rdi - 4]
mov word [rdi - 6], ax
mov rdx, rdi
call fcn.1400fd8b0
dec rsi
mov r8, r13
sub rdi, 2
inc r8
cmp word [rbx + r8*2], r12w
jne 0x14004b59d
lea r9, [rsp + 0x20]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov rcx, r13
inc rcx
cmp word [rdi + rcx*2], r12w
jne 0x14004b5bb
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x20], eax
jge 0x14004b56a
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rdx, r15
mov rcx, r14
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, rbx
call fcn.140103484
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400fc4f0
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14004bd6c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov bl, dl
mov rsi, rcx
call fcn.140072f20
cmp eax, 0x600
jb 0x14004bdb3
mov rsi, qword [rsi]
movzx ebx, bl
mov rax, qword [rsi]
mov rdi, qword [rax + 0x20]
mov rcx, rdi
call qword [fcn.1400fd580]
mov edx, ebx
mov rcx, rsi
call rdi
jmp 0x14004be41
mov rax, qword [rsi + 0x10]
mov byte [rax + 0xd0], bl
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14004be41
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov rbp, 0xffffffffffffffff
lea ebx, [rax + 1]
mov eax, 2
movsxd rcx, ebx
mul rcx
cmovo rax, rbp
mov rcx, rax
call fcn.1400fc594
mov rcx, qword [rsi + 0x18]
mov r8d, ebx
mov rdx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rsi + 0x18]
mov r9, rbp
xor r8d, r8d
mov edx, 0xb1
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsi + 0x18]
lea r9d, [rbp + 2]
mov edx, 0x102
lea r8d, [rbp + 9]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsi + 0x18]
mov rdx, rdi
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, rdi
call fcn.1400fc59c
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14004e240
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x140160370]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, rdx
lea r9, [0x14011bd58]
mov esi, ecx
lea rdx, [0x14012dbec]
mov rcx, qword [str.Passwords]
lea r8, [rbp + 0xa0]
mov r12d, 0x80
mov dword [rsp + 0x20], r12d
call fcn.1400a7a38
xor r15d, r15d
lea rcx, [rbp + 0xa0]
cmp word [rbp + 0xa0], r15w
mov r14d, 0x100
mov edx, r14d
setne bl
call fcn.140093940
test bl, bl
lea rcx, [rsp + 0x30]
lea ebx, [r12 - 0x4e]
mov r9d, esi
mov edx, ebx
je 0x14004e316
lea r8, [0x14012dbf8]
call fcn.140002810
mov rcx, qword [str.Passwords]
lea r9, [0x14011bd58]
mov r8, rdi
mov dword [rsp + 0x20], r12d
lea rdx, [rsp + 0x30]
call fcn.1400a7a38
cmp word [rdi], r15w
jne 0x14004e391
xor al, al
jmp 0x14004e466
lea r8, str.PE_d
call fcn.140002810
mov r8, r14
lea rcx, [rbp - 0x60]
xor edx, edx
call fcn.1400fd700
mov rcx, qword [str.Passwords]
lea r8, [rbp - 0x60]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
lea rdx, [rsp + 0x30]
call fcn.1400a78c4
mov r8d, eax
test eax, eax
je 0x14004e30f
mov edx, r15d
test eax, eax
jle 0x14004e36e
lea rcx, [rbp - 0x60]
lea eax, [rdx + 0x49]
inc edx
xor byte [rcx], al
inc rcx
cmp edx, r8d
jl 0x14004e35f
mov r8, r12
lea rcx, [rbp - 0x60]
mov rdx, rdi
call fcn.140098f34
mov rdx, r14
mov word [rdi + 0xfe], r15w
lea rcx, [rbp - 0x60]
call fcn.140093940
mov r9d, esi
lea r8, [0x14012dc10]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140002810
mov rcx, qword [str.Passwords]
lea r14, [rdi + 0x100]
mov r12d, 0xc8
lea r9, [0x14011bd58]
mov r8, r14
mov dword [rsp + 0x20], r12d
lea rdx, [rsp + 0x30]
call fcn.1400a7a38
mov r9d, esi
lea r8, [0x14012dc18]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140002810
mov rcx, qword [str.Passwords]
lea r8, [rdi + 0x290]
lea r9, [0x14011bd58]
mov dword [rsp + 0x20], 0x800
lea rdx, [rsp + 0x30]
call fcn.1400a7a38
mov r9d, esi
lea r8, [0x14012dc20]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140002810
mov rcx, qword [str.Passwords]
lea rdx, [rsp + 0x30]
xor r8d, r8d
call fcn.1400a78ac
test eax, eax
lea rcx, [rdi + 0x1290]
mov r8d, r12d
mov rdx, r14
setne al
mov byte [rdi + 0x1420], al
cmp word [r14], r15w
jne 0x14004e45f
mov rdx, rdi
call fcn.140096298
mov al, 1
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1400fc4f0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14005e724
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x1401a7414], 2
mov edi, r8d
mov esi, edx
mov rbx, rcx
jl 0x14005e784
movdqa xmm0, xmmword [0x14012e6c0]
movdqa xmm1, xmmword [0x14012e6b0]
movdqa xmmword [0x1401954b0], xmm0
movdqa xmm0, xmmword [0x14012e690]
movdqa xmmword [0x1401954c0], xmm1
movdqa xmm1, xmmword [0x14012e6a0]
movdqa xmmword [0x1401954d0], xmm0
movdqa xmmword [0x1401954e0], xmm1
xor edx, edx
mov r8d, 0xf0
call fcn.1400fd700
xor edx, edx
mov qword [rbx + 0x110], rdx
mov byte [rbx + 0x118], dl
mov rcx, qword [rbx + 0xf8]
lea rax, [0x14012e670]
mov eax, dword [rdx + rax]
mov dword [rdx + rcx], eax
add rdx, 4
cmp rdx, 0x20
jl 0x14005e7a0
mov rax, qword [rbx + 0xf8]
bts edi, 0xd
shl edi, 0x10
xor dword [rax], 0x2080020
mov rax, qword [rbx + 0xf8]
xor dword [rax + 8], esi
mov rax, qword [rbx + 0xf8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor dword [rax + 0xc], edi
add rsp, 0x20
pop rdi
ret

Function at 0x140062f9c
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov sil, dl
mov word [rcx + 0xa55a], r15w
mov rbx, rcx
mov byte [rcx + 0xa551], r15b
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
mov r14b, 1
jmp 0x140063003
test r14b, r14b
jne 0x140062ff3
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
test sil, sil
je 0x140062fee
call fcn.14006314c
jmp 0x140062ff3
call fcn.140062c70
mov rcx, qword [rsp + 0x40]
call fcn.140103484
mov rcx, rbp
mov r14b, r15b
lea rdx, [rsp + 0x40]
call fcn.140062464
mov rbp, rax
test rax, rax
jne 0x140062fd5
test sil, sil
jne 0x140063022
mov rcx, rbx
call fcn.140063038
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret