joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140030ac5
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp - 8], 0
mov eax, dword [rbp + 0x18]
cdqe
mov rcx, rax
call fcn.1400e6ff0
call fcn.1400e6a40
mov rax, qword [rbp + 0x10]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.1400e7040
mov qword [rbp - 0x70], 0
mov qword [rbp - 0x78], 0
mov qword [rbp - 0x10], 0
call fcn.1400e6ab0
call fcn.1400e6ab0
call fcn.1400e6b10
mov edx, eax
mov ecx, 0x3e8
call fcn.1400e4460
call fcn.1400e6b10
mov edx, eax
lea rax, [rbp - 0x70]
mov rcx, rax
call fcn.1400e6d60
mov rax, qword [rbp - 0x70]
mov qword [rbp - 0x18], rax
lea rax, str.WINDIR
mov rdx, qword [rbp - 0x18]
mov r8d, 0x3e8
mov rcx, rax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x78]
lea rdx, [0x140871c48]
mov rcx, rax
call fcn.1400e6e40
call fcn.1400e6ab0
call fcn.1400e6ab0
mov rax, qword [rbp - 0x70]
mov rcx, rax
call fcn.1400e6cf0
lea rax, str.System32
mov rcx, rax
call fcn.1400e6cf0
call fcn.1400e6f30
call fcn.1400e6ab0
lea rax, str.__c
mov rcx, rax
call fcn.1400e6cf0
mov rax, qword [rbp + 0x10]
mov rcx, rax
call fcn.1400e6cf0
call fcn.1400e6f30
call fcn.1400e6ab0
mov rax, qword [rbp - 0x70]
mov rcx, rax
call fcn.1400e6cf0
lea rax, str.System32cmd.exe
mov rcx, rax
call fcn.1400e6cf0
call fcn.1400e6c60
mov qword [rbp - 0x28], rax
call fcn.1400e6c60
mov qword [rbp - 0x30], rax
call fcn.1400e6c60
mov qword [rbp - 0x38], rax
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
mov r9d, SafeArrayGetLBound
mov r8, rcx
mov rcx, rax
call fcn.140093ae8
mov qword [rbp - 0x40], rax
call fcn.1400e6b80
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x140030d1d
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.1400940f4
mov qword [rbp - 0x48], rax
cmp qword [rbp - 0x48], 0
je 0x140030d0a
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.14009415c
mov qword [rbp - 0x50], rax
cmp qword [rbp - 0x50], 0
je 0x140030d04
call fcn.1400e6ab0
mov rax, qword [rbp - 0x78]
mov rcx, rax
call fcn.1400e6cf0
call fcn.1400e6ab0
call fcn.1400e6ab0
call fcn.1400e6ab0
call fcn.1400e6ab0
call fcn.1400e6b10
mov edx, eax
mov rax, qword [rbp - 0x10]
mov r8d, edx
mov edx, SafeArrayPutElement
mov rcx, rax
call fcn.1400942a8
call fcn.1400e6c60
mov qword [rbp - 0x58], rax
call fcn.1400e6b10
mov edx, eax
mov rax, qword [rbp - 0x58]
mov rcx, rax
call fcn.1400155f6
mov qword [rbp - 0x60], rax
call fcn.1400e6b10
lea rax, [0x1408657d0]
mov rcx, rax
call fcn.1400e6cf0
call fcn.1400e6b10
mov edx, eax
lea rax, [rbp - 0x78]
mov rcx, rax
call fcn.1400e6d60
jmp 0x140030c42
nop
jmp 0x140030c42
nop
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.140094238
mov qword [rbp - 0x68], rax
jmp 0x140030d1e
nop
call fcn.1400e6ab0
mov rax, qword [rbp - 0x78]
mov rcx, rax
call fcn.1400e6cf0
call fcn.1400e6c60
mov qword [rbp - 8], rax
nop
mov rax, qword [rbp + 0x10]
mov rcx, rax
call fcn.1400e6fc0
mov rax, qword [rbp - 0x70]
mov rcx, rax
call fcn.1400e6fc0
mov rax, qword [rbp - 0x78]
mov rcx, rax
call fcn.1400e6fc0
mov rax, qword [rbp - 8]
add rsp, 0xa0
pop rbp
ret
Function at 0x140035233
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
mov qword [rbp - 8], 0
call fcn.1400e6a40
mov qword [rbp - 0x58], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x18], 0
lea rax, str.Kernel32
mov rcx, rax
call sub.KERNEL32.dll_GetModuleHandleW
mov qword [rbp - 0x20], rax
lea rdx, [0x140863780]
mov rax, qword [rbp - 0x20]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x18], rax
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
call sub.KERNEL32.dll_CreateRemoteThread
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x1400352ef
mov qword [rbp - 8], 0
jmp 0x14003533c
nop
mov rax, qword [rbp - 0x10]
mov rdx, 0xffffffffffffffff
mov rcx, rax
call sub.KERNEL32.dll_WaitForSingleObject
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x58]
mov qword [rbp - 0x40], rax
mov rdx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sub.KERNEL32.dll_GetExitCodeThread
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sub.KERNEL32.dll_CloseHandle
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x58]
mov qword [rbp - 8], rax
nop
mov rax, qword [rbp - 8]
add rsp, 0xa0
pop rbp
ret
Function at 0x140036114
Capabilities:
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov qword [rbp - 8], 0
call fcn.1400e6a40
mov rdx, qword [rbp + 0x18]
lea rax, [rbp + 0x18]
mov rcx, rax
call fcn.1400e7040
mov rdx, qword [rbp + 0x20]
lea rax, [rbp + 0x20]
mov rcx, rax
call fcn.1400e7040
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x40]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x38]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 0x18]
mov qword [rsp + 0x40], rdx
mov rdx, qword [rbp - 0x10]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0xf003f
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rcx
mov rcx, rax
call sub.ADVAPI32.dll_RegCreateKeyExW
mov qword [rbp - 0x20], rax
cmp qword [rbp - 0x20], 0
jne 0x140036221
mov rax, qword [rbp + 0x20]
mov r10, rax
mov rax, qword [rbp - 0x40]
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov rdx, r10
mov rcx, rax
call sub.ADVAPI32.dll_RegSetValueExW
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x40]
mov rcx, rax
call sub.ADVAPI32.dll_RegCloseKey
mov qword [rbp - 0x30], rax
jmp 0x140036222
nop
mov qword [rbp - 8], 0
mov rax, qword [rbp + 0x20]
mov rcx, rax
call fcn.1400e6fc0
mov rax, qword [rbp + 0x18]
mov rcx, rax
call fcn.1400e6fc0
mov rax, qword [rbp - 8]
add rsp, 0x90
pop rbp
ret
Function at 0x140073e10
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
sub rsp, 0xc8
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
cmp word [0x140000000], 0x5a4d
je 0x140073e4d
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
lea rdi, [0x140000000]
jmp 0x140073edb
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x140073e71
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x140073edb
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x140073eb8
cmp ecx, 0x20b
je 0x140073e90
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x140073edb
cmp dword [rax + 0x84], 0xe
ja 0x140073ea4
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x140073edb
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
jmp 0x140073edb
cmp dword [rax + 0x74], 0xe
ja 0x140073ec9
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x140073edb
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
mov ecx, 2
call qword [sym.imp.msvcrt.dll___set_app_type]
mov qword [0x1408ec100], 0xffffffffffffffff
mov qword [0x1408ec120], 0xffffffffffffffff
mov rcx, qword [sym.imp.msvcrt.dll__fmode]
mov eax, dword [0x140871db0]
mov dword [rcx], eax
mov rcx, qword [sym.imp.msvcrt.dll__commode]
mov eax, dword [0x140871db4]
mov dword [rcx], eax
call fcn.140074100
cmp dword [0x1408ec140], 0
jne 0x140073f35
lea rcx, [0x140074110]
call qword [sym.imp.msvcrt.dll___setusermatherr]
lea rdx, [0x1401aa888]
lea rcx, [0x1401aa880]
call sub.msvcrt.dll__initterm
mov r11d, dword [0x140871db8]
mov dword [rsp + 0xd8], r11d
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x140871dbc]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3c]
call qword [sym.imp.msvcrt.dll___getmainargs]
lea rdx, [0x1401aa878]
lea rcx, [0x1401aa860]
call sub.msvcrt.dll__initterm
mov r11, qword [sym.imp.msvcrt.dll__acmdln]
mov r8, qword [r11]
mov qword [rsp + 0x30], r8
cmp byte [r8], 0x22
jne 0x140073fd6
nop
nop
inc r8
mov qword [rsp + 0x30], r8
movzx eax, byte [r8]
test al, al
je 0x140073fc6
cmp al, 0x22
je 0x140073fc6
jmp 0x140073fb0
cmp byte [r8], 0x22
jne 0x140073fe6
inc r8
mov qword [rsp + 0x30], r8
jmp 0x140073fe6
cmp byte [r8], 0x20
jbe 0x140073fe6
inc r8
mov qword [rsp + 0x30], r8
jmp 0x140073fd6
movzx eax, byte [r8]
test al, al
je 0x140073ffc
cmp al, 0x20
ja 0x140073ffc
inc r8
mov qword [rsp + 0x30], r8
jmp 0x140073fe6
test byte [rsp + 0x8c], 1
je 0x140074011
movzx r9d, word [rsp + 0x90]
jmp 0x140074017
mov r9d, 0xa
xor edx, edx
mov rcx, rdi
call fcn.140055bb1
mov edi, eax
mov dword [rsp + 0x38], eax
test ebx, ebx
jne 0x140074033
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
call qword [sym.imp.msvcrt.dll__cexit]
jmp 0x140074057
mov eax, edi
jmp 0x140074060
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
add rsp, 0xc8
ret
Function at 0x140074c0c
Capabilities:
Get file size
Read file on windows

Disassembly:
or r8d, 0xffffffff
jmp 0x140074c18
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov ebp, r8d
mov rax, rdx
mov r14, rcx
mov ebx, r13d
test rdx, rdx
je 0x140074e1d
cmp word [rdx], r13w
je 0x140074e1d
mov qword [r11 - 0x38], r13
lea r15d, [r13 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
mov r8d, r15d
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140074e18
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
movsxd rsi, eax
test eax, eax
jle 0x140074e0f
mov ecx, ebp
call fcn.1400753c4
mov rdi, rax
test rax, rax
je 0x140074e0f
mov rcx, r14
lea edx, [r13 + 2]
cmp ebp, 0xffffffff
je 0x140074cc6
mov edx, ebp
call fcn.1400759e8
mov rbx, rax
test rax, rax
je 0x140074e07
mov qword [rax + 0x40], rdi
mov qword [rbx + 0x60], r13
mov dword [rbx + 0x68], r13d
mov dword [rbx + 0x20], r13d
cmp r14, 0xffffffffffffffff
lea r8, [rsi + 0x10]
cmove r14, rax
xor edx, edx
mov qword [rax + 0x48], r14
mov rax, qword [rax + 8]
mov qword [rbx + 0x58], rax
mov rcx, qword [0x140871188]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx + 0x38], rax
test rax, rax
je 0x140074d30
lea ecx, [rsi + 0x10]
mov dword [rax + 8], ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], r13
mov rax, qword [rbx + 0x38]
add rax, 0x10
mov qword [rbx + 0x70], rax
cmp ebp, 0xffffffff
je 0x140074d39
mov dword [rbx + 0x50], r15d
mov rdx, rbx
mov rcx, rdi
call fcn.1400ef630
mov ebp, r13d
mov r14d, 0x4000
test esi, esi
jle 0x140074e03
lea eax, [r14 + rbp]
cmp eax, esi
jle 0x140074d63
mov r14d, esi
sub r14d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.1400ee980
mov r15, rax
test rax, rax
je 0x140074df1
lea r9, [rsp + 0x78]
mov r8d, r14d
mov rdx, rax
mov rcx, r12
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x78]
cmp edx, r14d
jne 0x140074ddd
add ebp, edx
cmp dword [rbx + 0x20], r13d
jne 0x140074daf
mov rcx, r15
call fcn.1400754a0
mov dword [rbx + 0x20], eax
mov edx, dword [rsp + 0x78]
mov rcx, rdi
cmp ebp, esi
jl 0x140074dbe
mov r8d, 1
jmp 0x140074dc1
xor r8d, r8d
call fcn.1400eee70
test eax, eax
je 0x140074dd0
cmp ebp, esi
jl 0x140074d55
jmp 0x140074e03
mov rcx, rdi
call fcn.1400eecb0
mov dword [rbx + 0x24], eax
jmp 0x140074df8
lea rax, [0x14017bbb8]
mov dword [rbx + 0x24], 0x100
mov qword [rbx + 0x30], rax
jmp 0x140074e03
mov dword [rbx + 0x24], 1
mov rdx, rdi
mov rcx, rbx
call fcn.14007559c
mov qword [rbx + 0x40], r13
mov rcx, rdi
call fcn.1400ef000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
jmp 0x140074e1f
xor eax, eax
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140074c18
Capabilities:
Get file size
Read file on windows

Disassembly:
or r8d, 0xffffffff
jmp 0x140074c18
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov ebp, r8d
mov rax, rdx
mov r14, rcx
mov ebx, r13d
test rdx, rdx
je 0x140074e1d
cmp word [rdx], r13w
je 0x140074e1d
mov qword [r11 - 0x38], r13
lea r15d, [r13 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
mov r8d, r15d
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140074e18
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
movsxd rsi, eax
test eax, eax
jle 0x140074e0f
mov ecx, ebp
call fcn.1400753c4
mov rdi, rax
test rax, rax
je 0x140074e0f
mov rcx, r14
lea edx, [r13 + 2]
cmp ebp, 0xffffffff
je 0x140074cc6
mov edx, ebp
call fcn.1400759e8
mov rbx, rax
test rax, rax
je 0x140074e07
mov qword [rax + 0x40], rdi
mov qword [rbx + 0x60], r13
mov dword [rbx + 0x68], r13d
mov dword [rbx + 0x20], r13d
cmp r14, 0xffffffffffffffff
lea r8, [rsi + 0x10]
cmove r14, rax
xor edx, edx
mov qword [rax + 0x48], r14
mov rax, qword [rax + 8]
mov qword [rbx + 0x58], rax
mov rcx, qword [0x140871188]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx + 0x38], rax
test rax, rax
je 0x140074d30
lea ecx, [rsi + 0x10]
mov dword [rax + 8], ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], r13
mov rax, qword [rbx + 0x38]
add rax, 0x10
mov qword [rbx + 0x70], rax
cmp ebp, 0xffffffff
je 0x140074d39
mov dword [rbx + 0x50], r15d
mov rdx, rbx
mov rcx, rdi
call fcn.1400ef630
mov ebp, r13d
mov r14d, 0x4000
test esi, esi
jle 0x140074e03
lea eax, [r14 + rbp]
cmp eax, esi
jle 0x140074d63
mov r14d, esi
sub r14d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.1400ee980
mov r15, rax
test rax, rax
je 0x140074df1
lea r9, [rsp + 0x78]
mov r8d, r14d
mov rdx, rax
mov rcx, r12
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x78]
cmp edx, r14d
jne 0x140074ddd
add ebp, edx
cmp dword [rbx + 0x20], r13d
jne 0x140074daf
mov rcx, r15
call fcn.1400754a0
mov dword [rbx + 0x20], eax
mov edx, dword [rsp + 0x78]
mov rcx, rdi
cmp ebp, esi
jl 0x140074dbe
mov r8d, 1
jmp 0x140074dc1
xor r8d, r8d
call fcn.1400eee70
test eax, eax
je 0x140074dd0
cmp ebp, esi
jl 0x140074d55
jmp 0x140074e03
mov rcx, rdi
call fcn.1400eecb0
mov dword [rbx + 0x24], eax
jmp 0x140074df8
lea rax, [0x14017bbb8]
mov dword [rbx + 0x24], 0x100
mov qword [rbx + 0x30], rax
jmp 0x140074e03
mov dword [rbx + 0x24], 1
mov rdx, rdi
mov rcx, rbx
call fcn.14007559c
mov qword [rbx + 0x40], r13
mov rcx, rdi
call fcn.1400ef000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
jmp 0x140074e1f
xor eax, eax
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140075bac
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x140075c72
lea rcx, [0x1408ec1e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140871dd0]
jmp 0x140075c36
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140075c33
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x140871dd0]
mov rdx, rsi
call fcn.1400e68b4
jmp 0x140075c36
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140075c03
mov rdx, qword [0x14086c188]
lea rcx, [0x140871dd0]
mov rdi, rdx
inc rdx
mov qword [0x14086c188], rdx
lea edx, [rbx + 0x20]
call fcn.1400e68fc
lea rcx, [0x1408ec1e0]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x1400760f4
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x14007616b
movsxd rdx, ecx
lea rcx, [0x140076050]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [0x140871de0]
test rbx, rbx
je 0x1400761de
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140076161
cmp byte [rbx + 0x20], 0
je 0x140076161
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
xor r8d, r8d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x140076127
jmp 0x1400761de
mov rbx, qword [0x140871de0]
test rbx, rbx
je 0x1400761de
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x1400761d6
cmp byte [rbx + 0x21], 0
je 0x14007619a
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x1400761c6
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x140871de0]
call fcn.1400e68b4
mov rbx, rdi
test rdi, rdi
jne 0x140076177
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140076790
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
mov rdx, rcx
mov rcx, qword [0x1408ec260]
call fcn.1400e5e8c
test rax, rax
je 0x1400767cd
cmp dword [rax + 0x28], 0
je 0x1400767cd
mov rcx, qword [rax + 0x18]
mov r9d, ebx
mov r8d, dword [rcx + 4]
mov edx, dword [rcx]
mov rcx, qword [rax + 0x10]
add rsp, 0x20
pop rbx
jmp fcn.1400763b0
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp fcn.1400e75e0
Function at 0x140094194
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
test r8d, r8d
jle 0x1400941fb
mov rcx, qword [rbp + 0x18]
and dword [rsp + 0x50], 0
and qword [rsp + 0x20], 0
mov r8d, edi
movsxd rdx, ebx
lea r9, [rsp + 0x50]
sub r8d, ebx
add rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400941ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x1400941f7
add ebx, dword [rsp + 0x50]
cmp ebx, edi
jge 0x1400941fb
jmp 0x1400941b8
add ebx, dword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
movsxd rax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400942a8
Capabilities:
Read file on windows

Disassembly:
mov rcx, qword [rcx + 0x18]
mov r9d, r8d
or r8d, 0xffffffff
jmp 0x140094670
mov rax, rsp
mov dword [rax + 0x20], r9d
mov dword [rax + 0x18], r8d
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
xor eax, eax
mov ecx, 0x1000
mov r15d, r9d
mov r13d, r8d
mov edi, ecx
mov esi, eax
mov r14d, eax
mov r12d, eax
cmp edx, 0x18
je 0x1400947af
cmp edx, 2
je 0x1400947af
mov rcx, qword [0x140871188]
xor edx, edx
mov r8d, 0x2000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor ecx, ecx
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x90]
lea r8d, [r12 + 2]
lea rdx, [rsp + 0x34]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
test eax, eax
je 0x140094798
mov r15, qword [rsp + 0x90]
mov ebp, edi
cmp dword [rsp + 0x38], 2
jne 0x140094790
cmp r13d, 0xffffffff
je 0x14009471d
cmp r14d, r13d
jae 0x140094790
add r14d, 2
test edi, edi
jne 0x140094748
mov rcx, qword [0x140871188]
movsxd r9, ebp
lea edx, [rdi + 8]
add r9, r9
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, 0x1000
xor ecx, ecx
mov rbx, rax
movzx eax, word [rsp + 0x34]
cmp ax, 0xa
je 0x140094790
cmp ax, 0xd
je 0x140094768
mov word [r12 + rbx], ax
inc esi
inc ebp
add r12, 2
dec edi
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x34]
mov r8d, 2
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
test eax, eax
jne 0x14009470b
mov r15d, dword [rsp + 0xa8]
movsxd rax, esi
mov edx, r15d
mov word [rbx + rax*2], cx
mov rcx, rbx
call fcn.140163060
jmp 0x140094878
mov r8, rcx
mov rcx, qword [0x140871188]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15d, dword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
mov rbx, rax
mov r13d, edi
cmp r15d, 0xffffffff
je 0x1400947e2
cmp r14d, r15d
jae 0x14009484c
xor ecx, ecx
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x30]
lea r8d, [rcx + 1]
mov qword [rsp + 0x20], rcx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14009484c
cmp dword [rsp + 0x38], 1
jne 0x14009484c
inc r14d
test edi, edi
jne 0x140094830
mov rcx, qword [0x140871188]
lea edx, [rdi + 8]
movsxd r9, r13d
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, 0x1000
mov rbx, rax
mov al, byte [rsp + 0x30]
cmp al, 0xa
je 0x14009484c
cmp al, 0xd
je 0x1400947d7
mov byte [r12 + rbx], al
inc esi
inc r13d
inc r12
dec edi
jmp 0x1400947d7
mov r15d, dword [rsp + 0xa8]
xor ecx, ecx
cmp dword [rsp + 0x98], 0x18
movsxd rax, esi
mov edx, r15d
mov byte [rax + rbx], cl
mov rcx, rbx
jne 0x140094873
call fcn.1401630c0
jmp 0x140094878
call fcn.140162e90
mov rcx, qword [0x140871188]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret