joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400118d4
Capabilities:
Write file on windows

Disassembly:
jmp 0x140019130
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x14002d018]
xor rax, rbp
mov qword [rbp + 0x1a0], rax
lea rcx, [0x14003418f]
call fcn.1400118ed
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x140019196
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001919d
mov al, 1
jmp 0x1400192f7
call fcn.140011294
mov rcx, qword [rbp + 0x1d0]
mov rcx, qword [rcx]
mov qword [rbp + 0x198], rcx
mov edx, eax
mov rcx, qword [rbp + 0x1d0]
mov rax, qword [rbp + 0x198]
call qword [rax + 0x18]
mov dword [rbp + 0x164], eax
call fcn.140011294
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.140011785
movzx eax, al
test eax, eax
je 0x1400191f8
xor al, al
jmp 0x1400192f7
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x1d0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0
je 0x14001925d
cmp dword [rbp + 0x194], 1
je 0x140019268
cmp dword [rbp + 0x194], 3
je 0x1400192e6
jmp 0x1400192f5
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x1400192b8
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x1400192b8
xor al, al
jmp 0x1400192f7
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400192d3
mov dword [rbp + 0x194], 1
jmp 0x1400192dd
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x1400192f7
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1400192f7
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140027f30]
call fcn.140011767
mov rax, rdi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rbp
call fcn.14001146a
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x1400071e0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r14, r9
mov r15, r8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140035010]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rbp, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [rbp]
imul eax, eax, 0x2710
movzx ecx, word [rbp + 2]
imul ecx, ecx, 0x64
add ecx, eax
movzx ebx, word [rbp + 6]
add ebx, ecx
cmp ebx, dword [rsi + 0x24]
jne 0x140007249
mov eax, dword [rsi + 0x20]
cmp eax, 0xffffffff
je 0x140007249
mov ebp, 3
cmp dword [rsi + 0x28], eax
jge 0x140007318
mov rax, qword [rsp + 0xb0]
lea rcx, [rsp + 0x3c]
mov dword [rcx], 0
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, r15
mov r8, r14
xor r9d, r9d
call fcn.1400073c0
test al, al
je 0x140007287
cmp dword [rsi + 0x24], ebx
jne 0x14000729b
mov eax, dword [rsi + 0x28]
inc eax
jmp 0x1400072a3
mov eax, 0xfffffe70
add eax, dword [rsp + 0x3c]
xor ebp, ebp
cmp eax, 0x64
setb bpl
jmp 0x140007318
mov dword [rsi + 0x24], ebx
mov eax, 1
mov dword [rsi + 0x28], eax
cmp qword [rsi + 0x10], 0
je 0x140007313
cmp qword [rsi + 0x18], 8
mov rdx, rsi
jb 0x1400072ba
mov rdx, qword [rsi]
lea r8, [0x140030bb2]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
test eax, eax
jne 0x140007313
mov r9, qword [rsp + 0x40]
lea rcx, str.GBP1_n
mov edx, 5
mov r8d, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r8d, dword [rsi + 0x24]
mov rcx, qword [rsp + 0x40]
call fcn.140006300
mov r8d, dword [rsi + 0x28]
mov rcx, qword [rsp + 0x40]
call fcn.140006300
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ebp, 2
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140021700
mov eax, ebp
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14000ab40
Capabilities:
Delete file
Query environment variable

Disassembly:
push rsi
sub rsp, 0x50
mov rax, qword [0x140035010]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rcx, str.MOZ_CRASHREPORTER_NO_DELETE_DUMP
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14000ab6f
cmp byte [rax], 0
jne 0x14000ac82
cmp qword [0x1400352a8], 0
je 0x14000abcc
lea rdx, [0x140035298]
lea rsi, [rsp + 0x28]
mov rcx, rsi
call fcn.140019e70
cmp qword [rsi + 0x18], 8
jb 0x14000ab99
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rax, qword [rsp + 0x40]
cmp rax, 8
jb 0x14000abcc
mov rcx, qword [rsp + 0x28]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14000ac96
call fcn.140020668
cmp qword [0x1400352c8], 0
je 0x14000ac29
lea rdx, [0x1400352b8]
lea rsi, [rsp + 0x28]
mov rcx, rsi
call fcn.140019e70
cmp qword [rsi + 0x18], 8
jb 0x14000abf6
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rax, qword [rsp + 0x40]
cmp rax, 8
jb 0x14000ac29
mov rcx, qword [rsp + 0x28]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14000acb9
call fcn.140020668
cmp qword [0x1400352e8], 0
je 0x14000ac82
lea rdx, [0x1400352d8]
lea rsi, [rsp + 0x28]
mov rcx, rsi
call fcn.140019e70
cmp qword [rsi + 0x18], 8
jb 0x14000ac53
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rax, qword [rsp + 0x40]
cmp rax, 8
jb 0x14000ac82
mov rcx, qword [rsp + 0x28]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14000acdc
call fcn.140020668
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140021700
nop
add rsp, 0x50
pop rsi
ret
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jae 0x14000acfc
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rsi
jmp 0x14000abc7
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jae 0x14000acfc
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rsi
jmp 0x14000ac24
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jae 0x14000acfc
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rsi
jmp 0x14000ac7d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400161b0
Capabilities:
Create directory

Disassembly:
push rsi
sub rsp, 0x50
mov rdx, rcx
mov rax, qword [0x140035010]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rsi, [rsp + 0x28]
mov rcx, rsi
call fcn.140019e70
cmp qword [rsi + 0x18], 8
jb 0x1400161e0
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
mov rax, qword [rsp + 0x40]
cmp rax, 8
jb 0x140016213
mov rcx, qword [rsp + 0x28]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x140016240
call fcn.140020668
test esi, esi
jne 0x140016224
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14001623c
mov sil, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140021700
mov eax, esi
add rsp, 0x50
pop rsi
ret
xor esi, esi
jmp 0x140016227
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140016260
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
jmp 0x14001620e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14001a710
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, r8
mov r12, rdx
movzx edx, cx
cmp byte [0x140035430], 1
jne 0x14001a7cb
mov r8d, 5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov ecx, 0x40
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
mov rcx, rax
mov rdx, r15
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
or byte [rdi + 0xa], 0x40
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, rdi
mov r8, r12
mov r9, r14
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
mov rdi, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rax, rdi
jmp 0x14001a7e2
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov r8, r12
mov r9, r14
call qword [sym.imp.USER32.dll_DialogBoxParamW]
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14001c6b0
Capabilities:
Move file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140035010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r8, qword [rdx + 0x10]
cmp qword [rcx + 0x10], r8
jne 0x14001c6fd
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x14001c6e3
mov rcx, qword [rsi]
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x14001c6f0
mov rdx, qword [rdi]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001c795
lea rbx, [rsp + 0x48]
mov rcx, rbx
mov rdx, rdi
call fcn.140019e70
cmp qword [rbx + 0x18], 8
jb 0x14001c719
mov rbx, qword [rsp + 0x48]
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov rdx, rsi
call fcn.140019e70
cmp qword [rdi + 0x18], 8
jb 0x14001c735
mov rdi, qword [rsp + 0x28]
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, 1
sete bl
mov rax, qword [rsp + 0x40]
cmp rax, 8
jb 0x14001c76d
mov rcx, qword [rsp + 0x28]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14001c7ae
call fcn.140020668
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x14001c797
mov rcx, qword [rsp + 0x48]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14001c7ce
call fcn.140020668
jmp 0x14001c797
mov bl, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140021700
mov eax, ebx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14001c7ee
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rdi
jmp 0x14001c768
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14001c7ee
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rdi
jmp 0x14001c78e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14001cdf0
Capabilities:
Get graphical window text

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x850
mov r15d, r9d
mov rsi, r8
mov r14, rdx
mov rdi, rcx
mov rax, qword [0x140035010]
xor rax, rsp
mov qword [rsp + 0x848], rax
call qword [sym.imp.USER32.dll_GetDC]
mov rbp, rax
mov rcx, rdi
mov edx, 0x31
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x14001ce4d
mov rcx, rbp
mov rdx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x400
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r8d, dword [rsi + 0x10]
cmp qword [rsi + 0x18], 8
mov rdx, rsi
jb 0x14001ce72
mov rdx, qword [rsi]
lea r9, [rsp + 0x38]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
xor r12d, r12d
test eax, eax
je 0x14001cf12
lea rbx, [rsp + 0x40]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea r9, [rsp + 0x30]
mov rcx, rbp
mov rdx, rbx
mov r8d, eax
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
test eax, eax
je 0x14001cf12
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
sub eax, ecx
js 0x14001cf12
mov ebp, dword [rsp + 0x8b0]
mov edx, dword [r14]
mov r9d, dword [r14 + 8]
add ecx, edx
mov r12d, r9d
sub r12d, ecx
test ebp, ebp
cmovne r12d, ebp
add r12d, eax
test r15b, r15b
je 0x14001cee8
sub edx, r12d
mov dword [r14], edx
jmp 0x14001ceef
add r9d, r12d
mov dword [r14 + 8], r9d
mov r8d, dword [r14 + 4]
mov eax, dword [r14 + 0xc]
sub eax, r8d
sub r9d, edx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_MoveWindow]
mov rax, qword [rsi + 0x18]
cmp rax, 8
jb 0x14001cf35
mov rcx, qword [rsi]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14001cf6f
call fcn.140020668
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 7
mov word [rsi], 0
mov rcx, qword [rsp + 0x848]
xor rcx, rsp
call fcn.140021700
mov eax, r12d
add rsp, 0x850
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14001cf8f
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
jmp 0x14001cf30
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14001cfa0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov rax, qword [0x140035010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov byte [r8], 0
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000002
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14001cff9
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000001
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14001cff9
xor edi, edi
jmp 0x14001d04c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor edi, edi
lea r9, [rsp + 0x44]
mov rdx, rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d041
cmp dword [rsp + 0x44], 4
jne 0x14001d041
cmp dword [rsp + 0x34], 1
sete byte [rsi]
mov dil, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140021700
mov eax, edi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x14001d420
Capabilities:
Get graphical window text

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x870
mov r14, rcx
mov rax, qword [0x140035010]
xor rax, rsp
mov qword [rsp + 0x868], rax
mov edx, 0x3f6
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdi, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov rbx, rax
mov rcx, rdi
mov edx, 0x31
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x14001d485
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
lea rbp, [rsp + 0x38]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.USER32.dll_GetWindowRect]
xor ecx, ecx
mov rdx, r14
mov r8, rbp
mov r9d, 2
call qword [sym.imp.USER32.dll_MapWindowPoints]
lea rbp, [rsp + 0x60]
mov rcx, rdi
mov rdx, rbp
mov r8d, 0x400
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, rbp
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea r9, [rsp + 0x48]
mov rcx, rbx
mov rdx, rbp
mov r8d, eax
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
test eax, eax
je 0x14001d51f
mov eax, dword [rsp + 0x48]
mov ebp, dword [rsp + 0x38]
mov ebx, dword [rsp + 0x40]
sub ebx, ebp
cmp eax, ebx
jl 0x14001d51f
cvtsi2ss xmm0, eax
cvtsi2ss xmm1, ebx
divss xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
cvttss2si eax, xmm0
imul eax, dword [rsp + 0x4c]
mov r8d, dword [rsp + 0x3c]
mov esi, r8d
sub esi, dword [rsp + 0x44]
add esi, eax
test esi, esi
jg 0x14001d542
mov rcx, qword [rsp + 0x868]
xor rcx, rsp
call fcn.140021700
nop
add rsp, 0x870
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r12d, 1
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], eax
mov r15, qword [sym.imp.USER32.dll_MoveWindow]
mov rcx, rdi
mov edx, ebp
mov r9d, ebx
call r15
mov rdi, qword [0x140035420]
mov rcx, qword [rdi + 8]
call fcn.140025760
mov rax, qword [0x140035420]
mov qword [rax + 8], rdi
mov qword [rax], rdi
mov rax, qword [0x140035420]
mov qword [rax + 0x10], rdi
mov qword [0x140035428], 0
lea rdi, [rsp + 0x34]
mov dword [rdi], 0x3ed
lea rcx, [rsp + 0x50]
mov rdx, rdi
call fcn.14001e4d0
mov dword [rdi], 0x3f4
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x34]
call fcn.14001e4d0
lea rdi, [rsp + 0x50]
mov rcx, r14
mov rdx, rdi
call qword [sym.imp.USER32.dll_GetWindowRect]
add esi, dword [rdi + 0xc]
mov dword [rdi + 0xc], esi
mov edx, dword [rdi]
mov r8d, dword [rdi + 4]
sub esi, r8d
mov r9d, dword [rdi + 8]
sub r9d, edx
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], esi
mov rcx, r14
call r15
lea rdx, [0x14002e850]
lea rsi, [rsp + 0x50]
mov rcx, rsi
call fcn.140026c00
lea rdx, [0x14002e854]
mov rcx, rsi
call fcn.140026c00
lea rdx, [0x14002e858]
mov rcx, rsi
call fcn.140026c00
lea rdx, [0x14002e85c]
mov rcx, rsi
call fcn.140026c00
lea rdx, [0x14002e860]
mov rcx, rsi
call fcn.140026c00
lea rdx, [0x14002e864]
mov rcx, rsi
call fcn.140026c00
lea rdx, [0x14002e868]
mov rcx, rsi
call fcn.140026c00
lea rdx, [0x14002e86c]
mov rcx, rsi
call fcn.140026c00
jmp 0x14001d51f
Function at 0x14001e370
Capabilities:
Get graphical window text

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x9cc0
call fcn.140021740
sub rsp, rax
movaps xmmword [rsp + 0x9cb0], xmm6
mov r14, rdx
mov rdi, rcx
mov rax, qword [0x140035010]
xor rax, rsp
mov qword [rsp + 0x9ca8], rax
lea rdx, [rsp + 0x4e80]
mov r8d, 0x2711
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rbx, [rsp + 0x4c]
lea rsi, [rsp + 0x48]
mov rcx, rdi
mov edx, 0xb0
mov r8, rbx
mov r9, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9d, dword [rsi]
mov eax, dword [rbx]
mov edi, 0xfffffffe
cmp r9d, eax
je 0x14001e448
sub r9d, eax
lea r8, [rsp + rax*2]
add r8, 0x4e80
lea rsi, [rsp + 0x50]
mov edx, 0x2711
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov eax, dword [rsp + 0x48]
sub eax, dword [rsp + 0x4c]
mov word [rsp + rax*2 + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
not edi
xorps xmm6, xmm6
movups xmmword [rsp + 0x30], xmm6
xor ebx, ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r15, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r8, [rsp + 0x4e80]
mov ecx, 0xfde9
xor edx, edx
mov r9d, 0xffffffff
call r15
mov esi, eax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call r15
mov ebx, eax
add esi, edi
add ebx, esi
mov rcx, qword [rsp + 0x9ca8]
xor rcx, rsp
call fcn.140021700
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x9cb0]
add rsp, 0x9cc0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140023e40
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x140035010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x140023efc
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x140023efc
mov rax, qword [rsi]
mov rax, qword [rax + 0x18]
mov rcx, rsi
mov edx, 0xffffffff
call qword [case.0x14002093e.0]
cmp eax, 0xffffffff
je 0x140023efa
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
lea rbx, [rsp + 0x28]
mov qword [rsp + 0x20], rbx
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [case.0x14002093e.0]
cmp eax, 3
je 0x140023f13
cmp eax, 1
je 0x140023ec9
test eax, eax
jne 0x140023efa
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x140023ef0
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140023efa
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x140023efc
xor edi, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140021700
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov dil, 1
jmp 0x140023efc
Function at 0x140001154
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x1c], 0x30
mov eax, dword [rbp - 0x1c]
mov rax, qword gs:[rax]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov dword [rbp - 4], 0
jmp 0x1400011ac
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp - 0x18]
jne 0x14000119e
mov dword [rbp - 4], 1
jmp 0x1400011e3
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [0x1400ef490]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
lock cmpxchg qword [rdx], rcx
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000118b
mov rax, qword [0x1400ef4a0]
mov eax, dword [rax]
cmp eax, 1
jne 0x1400011fd
mov ecx, 0x1f
call fcn.1400d1c30
jmp 0x14000123c
mov rax, qword [0x1400ef4a0]
mov eax, dword [rax]
test eax, eax
jne 0x140001232
mov rax, qword [0x1400ef4a0]
mov dword [rax], 1
mov rax, qword [0x1400ef4e0]
mov rdx, rax
mov rax, qword [0x1400ef4d0]
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x14000123c
mov dword [0x1400f3024], 1
mov rax, qword [0x1400ef4a0]
mov eax, dword [rax]
cmp eax, 1
jne 0x140001270
mov rax, qword [0x1400ef4c0]
mov rdx, rax
mov rax, qword [0x1400ef4b0]
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov rax, qword [0x1400ef4a0]
mov dword [rax], 2
cmp dword [rbp - 4], 0
jne 0x140001294
mov rax, qword [0x1400ef490]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
xchg qword [rax], rdx
mov rax, qword [0x1400ef3e0]
mov rax, qword [rax]
test rax, rax
je 0x1400012bf
mov rax, qword [0x1400ef3e0]
mov rax, qword [rax]
mov r8d, 0
mov edx, 2
mov ecx, 0
call rax
call fcn.1400d0eb8
mov rax, qword [0x1400ef520]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov rdx, qword [0x1400ef480]
mov qword [rdx], rax
lea rax, section..text
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.1400d06b0
mov eax, dword [0x1400f3004]
lea rdx, [0x1400f3008]
mov ecx, eax
call fcn.14000147c
call fcn.1400d0447
mov rax, qword [0x1400ef410]
mov rax, qword [rax]
mov rdx, qword [0x1400f3010]
mov qword [rax], rdx
mov rcx, qword [0x1400f3010]
mov rdx, qword [0x1400f3008]
mov eax, dword [0x1400f3004]
mov r8, rcx
mov ecx, eax
call fcn.1400016d0
mov dword [0x1400f301c], eax
mov eax, dword [0x1400f3020]
test eax, eax
jne 0x14000135d
mov eax, dword [0x1400f301c]
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [0x1400f3024]
test eax, eax
jne 0x14000136c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x1400f301c]
add rsp, 0x70
pop rbp
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400ef440]
mov dword [rax], 1
mov rax, qword [0x1400ef450]
mov dword [rax], 1
mov rax, qword [0x1400ef460]
mov dword [rax], 1
mov rax, qword [0x1400ef400]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret