joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001fe74
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x140020001
cmp ecx, 0x7c
je 0x140020001
cmp ecx, 0x29
jne 0x14001feee
cmp dword [rdi + 0x1c], 0
jne 0x140020001
lea rbx, [rdi + 0x80]
test dword [rbx], 0x10000000
je 0x14002001a
cmp ecx, 0x5d
jne 0x14001fecb
test dword [rbx], 0x10000000
je 0x140020028
mov dl, byte [rdi + 0x78]
lea rcx, [rdi + 0x40]
call fcn.14001f468
mov rcx, rdi
call fcn.140023f38
mov rcx, rdi
call fcn.140023fac
mov ecx, dword [rdi + 0x7c]
mov al, 1
jmp 0x14001fe86
lea rbx, [rdi + 0x80]
cmp ecx, 0x2e
jne 0x14001ff05
lea rcx, [rdi + 0x40]
call fcn.14001f6f0
jmp 0x14001fed7
cmp ecx, 0x5c
jne 0x14001ff53
mov rcx, rdi
call fcn.140023f38
test byte [rbx], 0x80
je 0x14001ff49
mov al, byte [rdi + 0x78]
cmp al, 0x62
jne 0x14001ff31
lea rcx, [rdi + 0x40]
call fcn.14001fe68
mov rcx, rdi
call fcn.140023f38
jmp 0x14001fee7
cmp al, 0x42
jne 0x14001ff49
lea rcx, [rdi + 0x40]
call fcn.14001fe68
lea rcx, [rdi + 0x40]
call fcn.140023ed4
jmp 0x14001ff27
mov rcx, rdi
call fcn.140020044
jmp 0x14001fedf
cmp ecx, 0x5b
jne 0x14001ff7e
mov rcx, rdi
call fcn.140023f38
mov rcx, rdi
call fcn.140020a4c
mov edx, 0x5d
mov rcx, rdi
lea r8d, [rdx - 0x59]
call fcn.140022728
jmp 0x14001fedf
cmp ecx, 0x28
jne 0x14001ffb3
mov rcx, rdi
call fcn.140023f38
mov rcx, rdi
call fcn.140024774
mov edx, 0x29
mov rcx, rdi
mov bl, al
lea r8d, [rdx - 0x24]
call fcn.140022728
test bl, bl
je 0x14001fee7
jmp 0x14001fedf
cmp ecx, 0x5e
jne 0x14001ffc6
lea rcx, [rdi + 0x40]
call fcn.14001f45c
jmp 0x14001ff27
cmp ecx, 0x24
jne 0x14001ffd9
lea rcx, [rdi + 0x40]
call fcn.14001f7f0
jmp 0x14001ff27
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x140020036
cmp ecx, 0x3f
je 0x140020036
cmp ecx, 0x7b
je 0x140020036
cmp ecx, 0x7d
jne 0x14001feba
test dword [rbx], 0x10000000
je 0x14002000c
jmp 0x14001fecb
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 6
mov rcx, rdi
call fcn.14002271c
int3
mov edx, 5
mov rcx, rdi
call fcn.14002271c
int3
mov edx, 4
mov rcx, rdi
call fcn.14002271c
int3
mov edx, 0xa
mov rcx, rdi
call fcn.14002271c
int3
Function at 0x140025df4
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
and dword [rax - 0x38], 0
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
and qword [rcx + 0x10], 0
and qword [rcx + 0x10], 0
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], 0
mov dword [rax - 0x38], 1
mov rax, qword [rdx + 0x10]
cmp rax, 0xf
jbe 0x140025e60
mov r8b, byte [rsp + 0x60]
mov rdx, rax
call fcn.14000aec8
and qword [rbx + 0x10], 0
mov rax, qword [rdi + 0x10]
xor esi, esi
lea r14d, [rsi - 6]
cmp qword [rdi + 0x18], 0x10
jb 0x140025e78
mov rbp, qword [rdi]
mov rcx, rbp
mov rdi, rbp
jmp 0x140025e7e
mov rbp, rdi
mov rcx, rdi
lea r12, [rax + rcx]
cmp rdi, r12
je 0x140025fa3
lea r8, [0x14005c4b0]
shl esi, 8
movzx eax, byte [rbp]
add esi, eax
add r14d, 8
js 0x140025f1b
movsxd r13, esi
movsxd rdi, r14d
lea ecx, [r14 + 6]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 2
mov r15d, edx
imul eax, edx, 0xfffffffa
add r14d, eax
mov rax, r13
mov rcx, rdi
sar rax, cl
and eax, 0x3f
mov r9b, byte [rax + r8]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x140025ef8
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140025eed
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140025f11
mov r8b, byte [rsp + 0x60]
mov edx, 1
mov rcx, rbx
call fcn.140004840
lea r8, [0x14005c4b0]
sub rdi, 6
sub r15, 1
jne 0x140025ebe
inc rbp
cmp rbp, r12
jne 0x140025e92
cmp r14d, 0xfffffffa
jle 0x140025fa3
lea ecx, [r14 + 8]
shl esi, 8
movsxd rax, esi
sar rax, cl
and eax, 0x3f
mov r9b, byte [rax + r8]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x140025f91
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140025f60
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140025fa3
cmp rcx, qword [rbx + 0x18]
jae 0x140025f8e
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140025f86
mov rax, qword [rbx]
mov word [rax + rcx], 0x3d
jmp 0x140025fa3
mov r9b, 0x3d
mov r8b, byte [rsp + 0x60]
mov edx, 1
mov rcx, rbx
call fcn.140004840
mov rcx, qword [rbx + 0x10]
test cl, 3
jne 0x140025f6b
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140029874
Capabilities:
Resolve dns

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x470
mov rax, qword [0x140075180]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r14d, 2
mov rsi, r9
mov rdi, r8
mov ebp, edx
mov rbx, rcx
cmp word [rcx], r14w
je 0x1400298b5
cmp word [rcx], 0x17
jne 0x140029959
movzx ecx, word [rcx + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
xor edx, edx
mov dword [rsi], eax
lea rcx, [rsp + 0x50]
mov esi, 0x401
mov r8d, esi
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], r14d
lea r8, [rsp + 0x50]
xor r14d, r14d
mov r9d, esi
mov dword [rsp + 0x28], r14d
mov edx, ebp
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x140029959
lea rax, [rsp + 0x50]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r14b
jne 0x14002990a
cmp rbx, qword [rdi + 0x18]
ja 0x140029940
cmp qword [rdi + 0x18], 0x10
mov rsi, rdi
jb 0x140029926
mov rsi, qword [rdi]
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], r14b
jmp 0x140029955
mov r8b, byte [rsp + 0x40]
lea r9, [rsp + 0x50]
mov rdx, rbx
mov rcx, rdi
call fcn.14000a98c
mov al, 1
jmp 0x14002995b
xor al, al
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140054630
add rsp, 0x470
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14002997c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x140029988
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x140075180]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, r8
mov dword [rsp + 0x20], 0x80
mov rbx, rdx
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1400299dd
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov r8, rbx
call fcn.140029874
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140054630
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret

Function at 0x140029988
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x140029988
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x140075180]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, r8
mov dword [rsp + 0x20], 0x80
mov rbx, rdx
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1400299dd
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov r8, rbx
call fcn.140029874
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140054630
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret
Function at 0x14004ac50
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
xor r15d, r15d
lea r12, [0x140000000]
movzx eax, byte [r15 + r12 + 0x61eb0]
mov edi, eax
mov r8d, eax
shr edi, 5
mov r11d, eax
shr r8d, 6
mov ebp, edi
lea edx, [rax + rax]
shr r11d, 7
xor edx, eax
and ebp, 4
mov r10d, edi
mov r9d, r8d
and edi, 1
and r10d, 2
imul ecx, edi, 0x1b000000
and r8d, 1
lea ebx, [rdx + rdx]
and r9d, 2
lea edx, [rdx*4]
xor ebx, eax
xor edx, eax
shl ebx, 0x19
shl edx, 8
mov esi, eax
xor rbx, rcx
mov r14d, eax
imul ecx, r10d, 0x1b000000
xor rbx, rcx
imul ecx, r8d, 0x1b000000
xor rbx, rcx
imul ecx, r9d, 0x1b000000
xor rbx, rcx
imul ecx, ebp, 0x1b000000
xor rbx, rcx
imul ecx, r11d, 0x1b000000
xor rbx, rcx
imul ecx, edi, 0x11b00
xor rdx, rcx
imul ecx, r10d, 0x11b00
xor rdx, rcx
imul ecx, r8d, 0x11b00
xor rdx, rcx
imul ecx, r9d, 0x11b00
xor rdx, rcx
imul ecx, ebp, 0x11b00
xor rdx, rcx
imul ecx, edi, 0x11b0000
or rbx, rdx
lea edx, [rax*8]
xor edx, eax
lea eax, [rax*4]
shl edx, 0x10
xor eax, r14d
xor rdx, rcx
imul ecx, r10d, 0x11b0000
xor rdx, rcx
imul ecx, ebp, 0x11b0000
xor rdx, rcx
imul ecx, edi, 0x11b
or rbx, rdx
lea edx, [rax + rax]
xor rdx, rcx
imul ecx, r10d, 0x11b
xor rdx, rcx
imul ecx, ebp, 0x11b
xor rdx, rcx
imul ecx, r11d, 0x11b
xor rdx, rcx
xor rdx, rsi
or rdx, rbx
shl rdx, 0x20
or rdx, rbx
or rdx, rsi
mov qword [r12 + r15*8 + 0x7b6b0], rdx
inc r15
cmp r15, 0x100
jl 0x14004ac73
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov byte [0x14007beb1], 1
pop r15
pop r14
pop r12
ret

Function at 0x14004addc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, r11d
lea rbx, [0x140000000]
movzx r9d, byte [r11 + rbx + 0x61db0]
mov edx, r9d
shr edx, 7
imul r10d, edx, 0x1b000000
lea r8d, [r9 + r9]
imul ecx, edx, 0x11b
mov eax, r8d
shl eax, 0x18
xor r10, rax
mov eax, r9d
shl eax, 8
or eax, r9d
shl eax, 8
or r10, rax
mov eax, r8d
xor rcx, rax
xor rcx, r9
or rcx, r10
shl rcx, 0x20
or rcx, r10
mov qword [rbx + r11*8 + 0x7aea0], rcx
inc r11
cmp r11, 0x100
jl 0x14004adeb
and qword [0x14007b6a8], 0
and qword [0x14007b6a0], 0
mov rbx, qword [rsp + 8]
mov byte [0x14007beb0], 1
ret
Function at 0x14004c8a0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x140075180]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x14007bfb0]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x14007bec0], ecx
jg 0x14004c982
mov eax, ebx
cmp rbx, rax
jne 0x14004c944
xor ecx, ecx
test rbx, rbx
setne cl
xor eax, eax
test ebx, ebx
setne al
cmp ecx, eax
jne 0x14004c944
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rcx, qword [0x14007beb8]
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x14004c9c5
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140054630
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x20]
call fcn.140003920
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14004c5d0
lea rdx, [0x1400724f8]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [0x14007bec0]
call fcn.140054cf4
cmp dword [0x14007bec0], 0xffffffff
jne 0x14004c8ec
lea rcx, [0x14007beb8]
call fcn.14004c4e4
lea rcx, [0x140058224]
call fcn.140054c34
nop
lea rcx, [0x14007bec0]
call fcn.140054c88
jmp 0x14004c8ec
mov ecx, eax
call fcn.14004ca08
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [0x140060938]
lea rcx, [rsp + 0x20]
call fcn.140003920
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14004c5d0
lea rdx, [0x1400724f8]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x14004de0c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp r8, 8
jb 0x14004de7f
mov rbp, r8
shr rbp, 3
imul rax, rbp, 0xfffffffffffffff8
add rdi, rax
mov r8d, 8
lea rcx, [rsp + 0x58]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 8
lea rcx, [rsp + 0x50]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x50]
add rsi, 8
xor rax, qword [rsp + 0x58]
add rbx, 8
or r14, rax
sub rbp, 1
jne 0x14004de3e
mov rcx, r14
shr rcx, 0x20
or ecx, r14d
mov edx, ecx
mov eax, ecx
shr edx, 8
or edx, ecx
shr eax, 0x10
and edx, 0xff00
or edx, eax
movzx eax, cl
shr edx, 8
or edx, eax
test rdi, rdi
je 0x14004dec1
sub rsi, rbx
movzx ecx, byte [rsi + rbx]
movzx eax, byte [rbx]
inc rbx
xor ecx, eax
or edx, ecx
sub rdi, 1
jne 0x14004dead
mov rbx, qword [rsp + 0x40]
test edx, edx
mov rbp, qword [rsp + 0x48]
sete al
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14004dedc
Capabilities:
Encode data using xor

Disassembly:
test r9, r9
je 0x14004dfa2
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, r9
mov r15d, 4
mov rdi, r8
mov rsi, rdx
mov r14, rcx
cmp rbx, r15
jb 0x14004df6d
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r15
lea rcx, [rsp + 0x20]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r15
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x68]
lea rdx, [rsp + 0x24]
xor eax, dword [rsp + 0x20]
mov r8, r15
mov rcx, r14
mov dword [rsp + 0x24], eax
call sub.VCRUNTIME140.dll_memcpy
add r14, r15
add rsi, r15
add rdi, r15
sub rbp, 1
jne 0x14004df22
test rbx, rbx
je 0x14004df8a
sub rsi, rdi
sub r14, rdi
mov al, byte [rsi + rdi]
xor al, byte [rdi]
mov byte [r14 + rdi], al
inc rdi
sub rbx, 1
jne 0x14004df78
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x14004dfa4
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14004e051
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, r8
mov r14d, 4
mov rsi, rdx
mov rdi, rcx
cmp rbx, r14
jb 0x14004e029
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r14
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r14
lea rcx, [rsp + 0x60]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x60]
lea rdx, [rsp + 0x20]
xor eax, dword [rsp + 0x68]
mov r8, r14
mov rcx, rdi
mov dword [rsp + 0x20], eax
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
add rsi, r14
sub rbp, 1
jne 0x14004dfe1
test rbx, rbx
je 0x14004e03f
sub rsi, rdi
mov al, byte [rsi + rdi]
xor byte [rdi], al
inc rdi
sub rbx, 1
jne 0x14004e031
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140053f74
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm1, xmmword [rcx]
mov r9d, 4
shl edx, 2
mov r8, rcx
movdqu xmm0, xmmword [rcx + rdx*4]
movdqu xmmword [rcx], xmm0
movdqu xmmword [rcx + rdx*4], xmm1
add edx, 0xfffffffc
cmp edx, r9d
jbe 0x140053fc3
aesimc xmm0, xmmword [r8 + rdx*4]
mov ecx, r9d
add r9d, 4
aesimc xmm1, xmmword [r8 + rcx*4]
movdqu xmmword [r8 + rcx*4], xmm0
movdqu xmmword [r8 + rdx*4], xmm1
add edx, 0xfffffffc
cmp r9d, edx
jb 0x140053f9a
mov eax, r9d
aesimc xmm0, xmmword [r8 + rax*4]
movdqu xmmword [r8 + rax*4], xmm0
ret

Function at 0x140055500
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005554a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005554a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005554a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005554a
cmp dword [rcx + 0x84], 0xe
jbe 0x14005554a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005554c
xor al, al
add rsp, 0x28
ret
Function at 0x1400033b5
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
push rax
push rax
sub rsp, 0x28
push 0x400
pop rcx
call fcn.14000b140
mov qword [rsp + 0x28], rax
push qword [0x140015120]
sub rsp, 8
push qword [0x140015120]
pop rcx
sub rsp, 0x20
call fcn.14000b304
add rsp, 0x28
lea rcx, [rsp + 0x38]
pop rdx
call fcn.14000ee50
push qword [rsp + 0x28]
push 0
movabs rax, 0x14001301e
push rax
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
pop r9
call sub.KERNEL32.dll_GetTempFileNameA
push qword [0x140015120]
sub rsp, 8
push qword [0x140015120]
push qword [rsp + 0x40]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000b010
add rsp, 0x28
lea rcx, [0x140014b70]
pop rdx
call fcn.14000ee50
push qword [rsp + 0x28]
pop rcx
call fcn.14000b160
push qword [0x140014b70]
pop rcx
call fcn.14000b3d0
push qword [0x140014b70]
pop rcx
call fcn.14000b3d8
push qword [0x140015120]
sub rsp, 8
push qword [0x140015120]
pop rcx
sub rsp, 0x20
call fcn.14000b1ec
add rsp, 0x28
lea rcx, [0x140014aa8]
pop rdx
call fcn.14000ee50
push qword [rsp + 0x50]
pop rcx
call fcn.14000b180
mov rax, rax
push rax
xor r15, r15
cmp r15, qword [rsp]
jne 0x1400034f0
mov rcx, qword [0x140014b70]
push qword [0x140015120]
sub rsp, 0x20
call fcn.14000ef70
add rsp, 0x20
lea rcx, [0x140014aa8]
pop rdx
sub rsp, 0x28
call fcn.14000ee50
add rsp, 0x28
mov qword [rsp + 0x40], 2
jmp 0x140003506
mov r15, 1
cmp r15, qword [rsp]
jne 0x140003506
mov qword [rsp + 0x40], 1
pop rax
mov r15, qword [rsp + 0x50]
add r15, qword [rsp + 0x38]
mov rax, r15
push rax
pop rcx
call fcn.14000b180
mov qword [0x140014b08], rax
mov r15, qword [rsp + 0x50]
add r15, qword [rsp + 0x38]
inc r15
mov rax, r15
push rax
pop rcx
call fcn.14000b180
mov qword [0x1400149d0], rax
mov rax, 1
jmp 0x14000354c
push rax
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.14000f050
add rsp, 0x28
pop rax
add rsp, 0x40
pop r15
ret
Function at 0x140003b89
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
xor rax, rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.14000efe0
add rsp, 0x10
push 0xa
push qword [rsp + 0x30]
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_FindResourceA
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140003c04
push qword [rsp + 0x30]
push qword [rsp + 0x58]
pop rcx
pop rdx
call sub.KERNEL32.dll_LoadResource
mov qword [0x1400149d8], rax
push qword [rsp + 0x30]
push qword [rsp + 0x58]
pop rcx
pop rdx
call sub.KERNEL32.dll_SizeofResource
mov qword [0x140014a00], rax
push qword [0x140014a00]
pop rcx
call fcn.14000b140
mov qword [rsp + 0x38], rax
push qword [0x140014a00]
push qword [0x1400149d8]
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
call sub.msvcrt.dll_memcpy
push qword [rsp + 0x38]
pop rax
mov qword [0x1400149d8], rax
mov rax, qword [rsp + 0x30]
jmp 0x140003c44
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.14000f050
add rsp, 0x28
pop rax
add rsp, 0x48
ret
Function at 0x140005b8c
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x140005c03
movsxd rdx, ecx
lea rcx, [0x140005ae8]
call qword [sym.imp.USER32.DLL_EnumWindows]
mov rbx, qword [0x140014bc8]
test rbx, rbx
je 0x140005c76
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140005bf9
cmp byte [rbx + 0x20], 0
je 0x140005bf9
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
xor r8d, r8d
call qword [sym.imp.USER32.DLL_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x140005bbf
jmp 0x140005c76
mov rbx, qword [0x140014bc8]
test rbx, rbx
je 0x140005c76
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140005c6e
cmp byte [rbx + 0x21], 0
je 0x140005c32
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x140005c5e
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.DLL_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x140014bc8]
call fcn.14000e954
mov rbx, rdi
test rdi, rdi
jne 0x140005c0f
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140005d50
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [0x140015150]
call fcn.14000e0fc
xor ebx, ebx
or esi, 0xffffffff
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dl, byte [rax]
test dl, dl
je 0x140005e16
mov rcx, qword [rsp + 0x30]
mov r10b, 0x20
lea r9d, [rbx + 1]
cmp dl, r10b
jne 0x140005da4
add rax, r9
cmp byte [rax], r10b
je 0x140005d9c
mov dl, byte [rax]
mov r8d, r9d
cmp dl, 0x22
jne 0x140005dda
add rax, r9
mov rbx, rax
mov cl, byte [rax]
test cl, cl
je 0x140005dd5
cmp cl, 0x22
je 0x140005dc8
add rax, r9
mov cl, byte [rax]
test cl, cl
jne 0x140005dba
cmp byte [rax], 0
je 0x140005dd5
mov rcx, rax
add rax, r9
jmp 0x140005dfc
mov rcx, rax
jmp 0x140005dfc
test dl, dl
je 0x140005df9
mov rbx, rax
cmp dl, r10b
je 0x140005def
add rax, r9
mov dl, byte [rax]
test dl, dl
jne 0x140005de1
cmp byte [rax], 0
mov rcx, rax
je 0x140005dfc
jmp 0x140005dd0
xor r8d, r8d
cmp dword [rbp], esi
jne 0x140005e06
test rdi, rdi
jne 0x140005e20
test r8d, r8d
je 0x140005e0e
add esi, r9d
mov dl, byte [rax]
xor ebx, ebx
test dl, dl
jne 0x140005d97
test rdi, rdi
jne 0x140005e32
movsxd rax, esi
jmp 0x140005e35
test rbx, rbx
je 0x140005e32
sub ecx, ebx
mov rax, rbx
mov dword [rdi], ecx
add dword [rbp], r9d
jmp 0x140005e35
and dword [rdi], 0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140005f10
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x140015150]
call fcn.14000e0fc
xor ecx, ecx
add rsp, 0x28
jmp fcn.140005d50
Function at 0x140006004
Capabilities:
Set environment variable

Disassembly:
sub rsp, 0x28
mov rax, rdx
test rcx, rcx
je 0x140006024
test rax, rax
lea rdx, [0x140011d76]
cmovne rdx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
add rsp, 0x28
ret
Function at 0x140007ae4
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdx, rcx
mov rcx, qword [0x140015290]
call fcn.14000e014
mov rsi, rax
test rax, rax
je 0x140007b5d
mov rcx, qword [rax + 8]
mov rax, qword [rcx + 0x28]
test rax, rax
je 0x140007b22
mov edx, ebx
mov rcx, rsi
call rax
jmp 0x140007b5d
mov rcx, qword [rsi]
call qword [sym.imp.USER32.DLL_GetWindowTextLengthA]
mov edx, ebx
mov ecx, eax
mov edi, eax
call fcn.14000f080
lea r8d, [rdi + 1]
mov byte [rax], 0
mov rcx, qword [rsi]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.USER32.DLL_GetWindowTextA]
mov rcx, rbx
call sub.msvcrt.dll_strlen
sub edi, eax
mov ecx, edi
call fcn.14000f220
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000804c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
lea rcx, [rsp + 0x20]
mov ebx, 0xc8
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x140008161
mov eax, dword [rsp + 0x30]
dec eax
je 0x14000813e
dec eax
jne 0x140008161
lea rcx, [rsp + 0xc0]
xor edi, edi
mov dword [rsp + 0xc0], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1400080b9
lea eax, [rdi + 1]
cmp byte [rsp + 0x15a], al
cmove edi, eax
mov eax, dword [rsp + 0x24]
sub eax, 3
je 0x140008137
dec eax
je 0x140008130
dec eax
je 0x140008106
dec eax
jne 0x140008161
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x1400080fa
dec eax
je 0x1400080ee
dec eax
jne 0x140008161
neg edi
sbb ebx, ebx
and ebx, 0xfffffffb
add ebx, 0x5f
jmp 0x140008161
neg edi
sbb ebx, ebx
and ebx, 0xfffffffb
add ebx, 0x55
jmp 0x140008161
neg edi
sbb ebx, ebx
and ebx, 0xfffffffb
add ebx, 0x4b
jmp 0x140008161
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x140008129
dec eax
je 0x140008122
dec eax
jne 0x140008161
neg edi
sbb ebx, ebx
and ebx, 0xfffffffb
add ebx, 0x41
jmp 0x140008161
mov ebx, 0x3c
jmp 0x140008161
mov ebx, 0x32
jmp 0x140008161
mov ebx, 0x14
jmp 0x140008161
mov ebx, 5
jmp 0x140008161
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x14000815c
cmp eax, 0xa
je 0x140008155
cmp eax, 0x5a
jne 0x140008161
lea ebx, [rax - 0x32]
jmp 0x140008161
mov ebx, 0x1e
jmp 0x140008161
mov ebx, 0xa
movsxd rax, ebx
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret