joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400fb880
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1400fb8dd
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
lea rdx, [0x140227270]
mov rcx, qword [rsp + 0x50]
call fcn.1400bc990
mov qword [rsp + 0x58], rax
mov edx, 0x26a
mov rcx, qword [rsp + 0x58]
call fcn.14013acd0
nop
mov rcx, qword [rsp + 0xb0]
call fcn.1400c12e0
jmp 0x1400fb9fe
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x60]
call fcn.1400bc870
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x68]
call fcn.1400e6240
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x28], 0xffffffffffffffff
inc qword [rsp + 0x28]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x28]
cmp byte [rax + rcx], 0
jne 0x1400fb929
mov rax, qword [rsp + 0x28]
inc rax
mov rdx, rax
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1400fb9ea
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x30]
movzx ecx, byte [rsp + 0x20]
mov byte [rax], cl
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
cmp byte [rsp + 0x20], 0
jne 0x1400fb996
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, qword [rsp + 0x38]
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
mov rcx, qword [rsp + 0xb0]
call fcn.1400c12e0
add rsp, 0xa8
ret
Function at 0x1400fba10
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1400fba59
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rdx, [0x1402271f8]
mov rcx, qword [rsp + 0x30]
call fcn.1400bc990
mov qword [rsp + 0x38], rax
mov edx, 0x24d
mov rcx, qword [rsp + 0x38]
call fcn.14013acd0
jmp 0x1400fbaf8
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, qword [rsp + 0x70]
call fcn.14006ea80
lea rax, [rax + rax + 2]
mov rdx, rax
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400fbaf2
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400fbaf2
mov rcx, qword [rsp + 0x70]
call fcn.140076650
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
call fcn.14006ea80
inc rax
mov qword [rsp + 0x48], rax
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, qword [rsp + 0x20]
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x68
ret
Function at 0x1400fe960
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x200f8
call fcn.1401b4a90
sub rsp, rax
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call fcn.1400bca90
nop
mov dword [rsp + 0x68], 0x10000
mov rcx, qword [rsp + 0x20108]
call fcn.1400b6dd0
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xd0]
call fcn.1400bf010
nop
mov r8, qword [rsp + 0x70]
mov edx, 0x10000
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
jle 0x1400feba7
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
test eax, eax
je 0x1400fea5e
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.1400bc990
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xd0]
call fcn.1400e52c0
nop
lea rcx, [rsp + 0x50]
call fcn.1400c12e0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x38], 0xffffffffffffffff
inc qword [rsp + 0x38]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x38]
cmp word [rax + rcx*2], 0
jne 0x1400fea32
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax*2 + 2]
mov qword [rsp + 0x28], rax
jmp 0x1400fe9e6
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.1400b6dd0
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x58]
call fcn.14004ce60
mov qword [rsp + 0x80], rax
jmp 0x1400fea9c
mov rax, qword [rsp + 0x40]
add rax, 8
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
cmp qword [rsp + 0x40], rax
je 0x1400feb30
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x88], rax
lea rdx, [0x140216990]
lea rcx, [rsp + 0x60]
call fcn.1400bc8d0
nop
mov r8, qword [rsp + 0x88]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xa0]
call fcn.1400c3ed0
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x98], rax
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0x30]
call fcn.1400c4ea0
nop
lea rcx, [rsp + 0xa0]
call fcn.1400c12e0
nop
lea rcx, [rsp + 0x60]
call fcn.1400c12e0
jmp 0x1400fea8e
lea rax, [rsp + 0xe8]
mov qword [rsp + 0xa8], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0xa8]
call fcn.1400bc870
mov qword [rsp + 0xb0], rax
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0xc8]
call fcn.1400ee0b0
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0xc0], rax
mov rdx, qword [rsp + 0xc0]
lea rcx, [rsp + 0x30]
call fcn.1400c2ca0
nop
lea rcx, [rsp + 0xc8]
call fcn.1400c12e0
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20100]
call fcn.1400bc870
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0xd0]
call fcn.1400c2210
nop
lea rcx, [rsp + 0x30]
call fcn.1400c12e0
nop
mov rcx, qword [rsp + 0x20108]
call fcn.1400c12e0
mov rax, qword [rsp + 0x20100]
add rsp, 0x200f8
ret
Function at 0x1400fec00
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x918
mov dword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
call fcn.1400bca90
nop
mov dword [rsp + 0x78], 0x400
mov rcx, qword [rsp + 0x930]
call fcn.1400b6dd0
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x928]
call fcn.1400b6dd0
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0xe8]
call fcn.1400bf010
nop
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x110]
lea r8, [0x1402136c5]
xor edx, edx
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
jle 0x1400fee80
lea rax, [rsp + 0x110]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
test eax, eax
je 0x1400fed37
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.1400bc990
nop
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xe8]
call fcn.1400e52c0
nop
lea rcx, [rsp + 0x60]
call fcn.1400c12e0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x48], 0xffffffffffffffff
inc qword [rsp + 0x48]
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x48]
cmp word [rax + rcx*2], 0
jne 0x1400fed08
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax*2 + 2]
mov qword [rsp + 0x38], rax
jmp 0x1400fecb9
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x68]
call fcn.1400b6dd0
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x68]
call fcn.14004ce60
mov qword [rsp + 0x98], rax
jmp 0x1400fed75
mov rax, qword [rsp + 0x50]
add rax, 8
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x98]
cmp qword [rsp + 0x50], rax
je 0x1400fee09
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0xa0], rax
lea rdx, [0x140216b18]
lea rcx, [rsp + 0x70]
call fcn.1400bc8d0
nop
mov r8, qword [rsp + 0xa0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xb8]
call fcn.1400c3ed0
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xb0], rax
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0x40]
call fcn.1400c4ea0
nop
lea rcx, [rsp + 0xb8]
call fcn.1400c12e0
nop
lea rcx, [rsp + 0x70]
call fcn.1400c12e0
jmp 0x1400fed67
lea rax, [rsp + 0x100]
mov qword [rsp + 0xc0], rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xc0]
call fcn.1400bc870
mov qword [rsp + 0xc8], rax
mov rdx, qword [rsp + 0xc8]
lea rcx, [rsp + 0xe0]
call fcn.1400ee0b0
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xd8], rax
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x40]
call fcn.1400c2ca0
nop
lea rcx, [rsp + 0xe0]
call fcn.1400c12e0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x920]
call fcn.1400bc870
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0xe8]
call fcn.1400c2210
nop
lea rcx, [rsp + 0x40]
call fcn.1400c12e0
nop
mov rcx, qword [rsp + 0x928]
call fcn.1400c12e0
nop
mov rcx, qword [rsp + 0x930]
call fcn.1400c12e0
mov rax, qword [rsp + 0x920]
add rsp, 0x918
ret
Function at 0x14010de90
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [0x140257980], 0
lea rdx, [0x140213b37]
lea rcx, [0x1404af4c0]
call fcn.1400c2cd0
lea rdx, [0x14021cb38]
mov rcx, qword [rsp + 0x60]
call fcn.1400b2830
movzx eax, al
test eax, eax
je 0x14010ded7
mov dword [rsp + 0x20], 0
lea rdx, [0x14021cb40]
mov rcx, qword [rsp + 0x60]
call fcn.1400b2830
movzx eax, al
test eax, eax
je 0x14010def7
mov dword [rsp + 0x20], 1
movsxd rax, dword [rsp + 0x20]
mov rdx, rax
lea rcx, [0x1400c87f0]
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x14010df49
cmp qword [0x140257980], 0
jne 0x14010df49
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [0x14021cb48]
mov rcx, qword [rsp + 0x28]
call fcn.1400bc990
mov qword [rsp + 0x30], rax
mov edx, 0x1368
mov rcx, qword [rsp + 0x30]
call fcn.14013acd0
mov rax, qword [0x140257980]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x60]
call fcn.140072130
mov rax, qword [rsp + 0x38]
add rsp, 0x58
ret
Function at 0x140111400
Capabilities:
Create thread

Disassembly:
sub rsp, 0x78
mov dword [rsp + 0x30], 0
jmp 0x140111418
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x14
jge 0x1401114a3
movsxd rax, dword [rsp + 0x30]
lea rcx, [0x140265c50]
cmp qword [rcx + rax*8], 0
jne 0x14011149e
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
mov edx, dword [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.1400df950
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov r8, qword [rsp + 0x40]
lea rdx, [0x140222058]
mov rcx, qword [rsp + 0x48]
call fcn.1400c4050
mov qword [rsp + 0x50], rax
mov edx, 0x16e5
mov rcx, qword [rsp + 0x50]
call fcn.14013acd0
nop
lea rcx, [rsp + 0x58]
call fcn.1400c12e0
mov eax, dword [rsp + 0x30]
mov dword [0x1402578e0], eax
jmp 0x1401114a3
jmp 0x14011140e
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400e0210]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x60], rax
movsxd rax, dword [0x1402578e0]
lea rcx, [0x140257990]
mov rdx, qword [rsp + 0x60]
mov qword [rcx + rax*8], rdx
add rsp, 0x78
ret
Function at 0x140130940
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov r8d, dword [rsp + 0x50]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1401309b3
lea rdx, str.OpenProcess_failed:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400b2440
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rsp + 0x38], rax
lea rdx, [0x1400bab00]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
jmp 0x1401309ea
mov edx, 1
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jne 0x1401309dd
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1401309ea
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x48
ret
Function at 0x1401366b0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x12a8
call fcn.1401b4a90
sub rsp, rax
lea r8, [rsp + 0x24]
mov edx, 0x1000
lea rcx, [rsp + 0x2a0]
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
jne 0x1401366e6
xor eax, eax
jmp 0x140136870
mov eax, dword [rsp + 0x24]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0
jmp 0x14013670c
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x20], eax
jae 0x14013686e
mov eax, dword [rsp + 0x20]
cmp dword [rsp + rax*4 + 0x2a0], 0
je 0x140136869
lea rax, [rsp + 0x90]
lea rcx, str._unknown_
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_sendto
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xa4]
mov rdi, rax
xor eax, eax
mov ecx, 0x1f4
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x20]
mov r8d, dword [rsp + rax*4 + 0x2a0]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140136869
mov dword [rsp + 0x2c], 0x104
lea r9, [rsp + 0x2c]
lea r8, [rsp + 0x90]
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x14013685e
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x48]
call fcn.1400be740
nop
mov r8, 0xffffffffffffffff
lea rdx, [0x140216b88]
lea rcx, [rsp + 0x48]
call fcn.1400dec10
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x140136854
mov rax, qword [rsp + 0x40]
inc rax
mov r9, 0xffffffffffffffff
mov r8, rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.1400e7e80
mov rdx, qword [rsp + 0x12c0]
lea rcx, [rsp + 0x68]
call fcn.1400dabb0
test eax, eax
jne 0x140136849
mov eax, dword [rsp + 0x20]
mov eax, dword [rsp + rax*4 + 0x2a0]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x68]
call fcn.1400c1ec0
nop
lea rcx, [rsp + 0x48]
call fcn.1400c1ec0
mov eax, dword [rsp + 0x30]
jmp 0x140136870
lea rcx, [rsp + 0x68]
call fcn.1400c1ec0
nop
lea rcx, [rsp + 0x48]
call fcn.1400c1ec0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140136702
xor eax, eax
add rsp, 0x12a8
pop rdi
pop rsi
ret
Function at 0x140138d20
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x34], 0
lea rdx, [0x140213a1f]
lea rcx, [rsp + 0x38]
call fcn.1400bc8d0
nop
mov dword [rsp + 0x30], 0x32000
mov rcx, qword [rsp + 0x88]
call fcn.1400b6dd0
mov qword [rsp + 0x40], rax
mov edx, dword [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.1400c9b60
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x80]
call fcn.1400b6dd0
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x78]
call fcn.1400b6dd0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x48]
lea r8, [0x14021a064]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edx, 0xffffffff
lea rcx, [rsp + 0x38]
call fcn.1400d0130
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.1400bc870
mov eax, dword [rsp + 0x34]
or eax, 1
mov dword [rsp + 0x34], eax
lea rcx, [rsp + 0x38]
call fcn.1400c12e0
nop
mov rcx, qword [rsp + 0x78]
call fcn.1400c12e0
nop
mov rcx, qword [rsp + 0x80]
call fcn.1400c12e0
nop
mov rcx, qword [rsp + 0x88]
call fcn.1400c12e0
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret

Function at 0x140139810
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x30]
call fcn.1400bca90
nop
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jle 0x1401398bf
mov eax, dword [rsp + 0x20]
inc eax
cdqe
mov qword [rsp + 0x38], rax
mov eax, 2
mov rcx, qword [rsp + 0x38]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1401b4b1c
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x20]
inc eax
mov r8d, eax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.1400c2d60
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.1401b46fc
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
call fcn.1400bc870
mov eax, dword [rsp + 0x24]
or eax, 1
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x30]
call fcn.1400c12e0
mov rax, qword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x14013ad40
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
mov dword [rsp + 0x40], reloc.WS2_32.dll_WSASetLastError
lea rax, [rsp + 0x44]
mov rdi, rax
xor eax, eax
mov ecx, WSASetLastError
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0xc0]
call fcn.1400b6dd0
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x70], 5
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14013ad98
jmp 0x14013adc7
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, [0x140216c10]
mov rcx, qword [rsp + 0x28]
call fcn.1400bc990
mov qword [rsp + 0x30], rax
mov edx, 0x496
mov rcx, qword [rsp + 0x30]
call fcn.14013acd0
xor eax, eax
add rsp, 0xb0
pop rdi
ret

Function at 0x14013ade0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x48
lea rdx, [0x1402605a0]
lea rcx, [rsp + 0x30]
call fcn.1400bc8d0
lea rcx, [rsp + 0x30]
call fcn.1400b6dd0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea r9, [0x140222e60]
mov r8, rax
lea rdx, [0x140222eb8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call fcn.1400c12e0
add rsp, 0x48
ret
Function at 0x14014a420
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2c8
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x20]
call fcn.1400bca90
nop
mov rdx, qword [rsp + 0x2d8]
lea rcx, [rsp + 0x38]
call fcn.1400bc870
nop
lea rdx, [0x140216bf8]
lea rcx, [rsp + 0x38]
call fcn.1400c4f30
lea rcx, [rsp + 0x38]
call fcn.1400b6dd0
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0xffffffffffffffff
je 0x14014a4dc
mov eax, dword [rsp + 0x70]
and eax, 0x10
test eax, eax
je 0x14014a49a
jmp 0x14014a4bd
lea rdx, [0x140216c00]
lea rcx, [rsp + 0x20]
call fcn.1400c4ed0
lea rdx, [rsp + 0x9c]
lea rcx, [rsp + 0x20]
call fcn.1400c4f30
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14014a48d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call fcn.1400bc870
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.1400ee0b0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x20]
call fcn.1400c2ca0
nop
lea rcx, [rsp + 0x60]
call fcn.1400c12e0
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x2d0]
call fcn.1400bc870
mov eax, dword [rsp + 0x28]
or eax, 1
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x38]
call fcn.1400c12e0
nop
lea rcx, [rsp + 0x20]
call fcn.1400c12e0
mov rax, qword [rsp + 0x2d0]
add rsp, 0x2c8
ret
Function at 0x14014eaf0
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0xa8
cmp dword [rsp + 0xb0], 0
jle 0x14014eb0a
jmp 0x14014ecb3
mov eax, 0x330
mov eax, eax
mov ecx, dword [0x1404bd600]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x1404b29c0], eax
jle 0x14014eb65
lea rcx, [0x1404b29c0]
call fcn.1401b49fc
cmp dword [0x1404b29c0], 0xffffffff
jne 0x14014eb65
mov edx, reloc.WLDAP32.dll_Ordinal_45
mov ecx, reloc.WLDAP32.dll_Ordinal_30
call fcn.14014e7e0
mov dword [0x1404b29bc], eax
lea rcx, [0x1404b29c0]
call fcn.1401b4990
mov eax, 0x330
mov eax, eax
mov ecx, dword [0x1404bd600]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x1404b29d0], eax
jle 0x14014ebbf
lea rcx, [0x1404b29d0]
call fcn.1401b49fc
cmp dword [0x1404b29d0], 0xffffffff
jne 0x14014ebbf
xor ecx, ecx
call fcn.140151580
sub rax, 0x3e8
mov qword [0x1404b29c8], rax
lea rcx, [0x1404b29d0]
call fcn.1401b4990
xor ecx, ecx
call fcn.140151580
mov qword [rsp + 0x30], rax
mov rax, qword [0x1404b29c8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea rdx, [0x14021c404]
mov rcx, qword [rsp + 0x20]
call fcn.1400bc8d0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.1400c7d20
cmp eax, dword [0x1404b29bc]
jl 0x14014ecb3
call fcn.14014f160
movzx eax, al
test eax, eax
je 0x14014ec5e
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rdx, [0x14021c408]
mov rcx, qword [rsp + 0x48]
call fcn.1400bc990
mov qword [rsp + 0x50], rax
mov edx, 0x796
mov rcx, qword [rsp + 0x50]
call fcn.14013acd0
jmp 0x14014ec90
lea rax, [rsp + 0x78]
mov qword [rsp + 0x58], rax
lea rdx, str.err1
mov rcx, qword [rsp + 0x58]
call fcn.140071e30
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1400fe530
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov edx, reloc.WLDAP32.dll_Ordinal_30
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.14014e7e0
mov dword [0x1404b29bc], eax
xor ecx, ecx
call fcn.140151580
mov qword [0x1404b29c8], rax
add rsp, 0xa8
ret