joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c1420
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov ebp, r9d
mov r14d, r8d
mov esi, edx
mov rbx, rcx
xor edi, edi
cmp qword [rcx - reloc.mfc140u.dll_AFX_DDPDATA::AFX_DDPDATA], rdi
jne 0x1400c144f
xor eax, eax
jmp 0x1400c15ba
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jb 0x1400c15aa
mov eax, esi
sub eax, 0x20
je 0x1400c14fb
sub eax, 3
je 0x1400c147e
cmp eax, 1
jne 0x1400c15aa
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x68]
test eax, eax
je 0x1400c15aa
mov rcx, rbx
call fcn.140089d14
test eax, eax
jne 0x1400c14ab
mov rax, qword [rbx]
mov r8d, dword [rbx + 0x1c]
mov edx, dword [rbx + 0x18]
mov rcx, rbx
call qword [rax + 0x48]
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax + 0x20]
mov rcx, rbx
call fcn.14003ad38
mov rcx, qword [rax]
mov r10, qword [rcx + 0x600]
mov dword [rsp + 0x20], edi
mov r9d, 2
mov r8d, dword [rbx + 0x1c]
mov edx, dword [rbx + 0x18]
mov rcx, rax
call r10
test eax, eax
jne 0x1400c15a3
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x138]
jmp 0x1400c15a3
mov rcx, rbx
call fcn.14003ad38
mov r8d, dword [rbx + 0x1c]
mov edx, dword [rbx + 0x18]
mov rcx, rax
call fcn.1400444b4
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
nop
mov rcx, qword [rbx - 0x28]
mov rax, qword [rcx]
lea rsi, [rbx - 0x60]
mov r9, rsi
lea r8, [rbx - 0x30]
mov rdx, qword [rsp + 0x30]
call qword [rax + VariantCopy]
test eax, eax
je 0x1400c1598
mov rax, qword [rbx + 0x20]
test byte [rax + 8], 4
je 0x1400c154f
test byte [rax + 0x20], 4
jne 0x1400c1598
cmp dword [rsi], edi
sete dil
mov dword [rsi], edi
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov rcx, qword [rbx - 0x28]
mov rax, qword [rcx]
mov r9d, dword [rsi]
lea r8, [rsp + 0x60]
movsd xmm1, qword [rbx - 0x30]
call qword [rax + InitCommonControls]
lea rcx, [rbx - 0x180]
mov rdx, qword [rsp + 0x60]
call fcn.1400e49e0
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov eax, 1
jmp 0x1400c15ba
mov r9d, ebp
mov r8d, r14d
mov edx, esi
mov rcx, rbx
call fcn.140007d00
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400c5440
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
lea r8d, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x1400c54cc
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rbp
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov edx, ebx
lea ecx, [rsi + 0x42]
mov rbp, rax
mov edi, ebx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400c54c0
mov r8d, edi
mov rdx, rbp
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rsi, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d69a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140164008]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, r8
mov rdi, rcx
call fcn.1400d5f44
cmp dword [rdi + 0x30], 0
je 0x1400d6a27
mov rax, qword [rdi]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [rax + InitCommonControls]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x1400d6a27
mov ebx, dword [rdi + 0x44]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [rdi + 0x40]
add edx, ebx
cmp eax, edx
jb 0x1400d6a27
mov eax, 0x96
cmp ebx, eax
ja 0x1400d6a0b
cmp ebx, 0x32
jbe 0x1400d6a0e
lea eax, [rbx - 5]
mov dword [rdi + 0x44], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rdi + 8]
mov rdx, rdi
mov dword [rdi + 0x40], eax
mov rax, qword [rcx]
call qword [rax + 0x250]
mov eax, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14002fdd0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400dbb90
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
cmp dword [rcx + 0x12c], 3
jne 0x1400dbbc0
lea rdx, [rcx + 0x130]
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
jmp 0x1400dbca8
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov ebp, eax
xor ebx, ebx
mov edx, dword [rdi + 0x12c]
test edx, edx
je 0x1400dbbf1
sub edx, 1
je 0x1400dbbe3
sub edx, 1
je 0x1400dbbea
cmp edx, 2
jne 0x1400dbbf6
mov ebx, 0x1f
jmp 0x1400dbbf6
mov ebx, 0x20
jmp 0x1400dbbf6
mov ebx, 0x1003
mov edx, CMapStringToOb::HashKey
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_Ordinal_4946]
mov r8, rax
mov r9d, CMapStringToOb::HashKey
mov edx, ebx
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
or ebx, 0xffffffff
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CDialogImpl::ProcessMouseClick]
cmp dword [rdi + 0x12c], 4
jne 0x1400dbca8
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov edx, CMapStringToOb::HashKey
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_4946]
mov r8, rax
mov edx, 0x1003
mov r9d, CMapStringToOb::HashKey
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edx, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDialogImpl::ProcessMouseClick]
lea r8, [rsp + 0x40]
lea rdx, [0x140115408]
lea rcx, [rsp + 0x50]
call fcn.1400057e0
nop
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_Ordinal_1667]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400dc984
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x188]
test rcx, rcx
jne 0x1400dc9b0
mov rcx, rbx
call sub.mfc140u.dll_CDHtmlDialog::DDX_DHtml_ElementText
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp edx, 0x25
jne 0x1400dca57
movsxd r8, dword [rbx + reloc.mfc140u.dll_AFX_DDPDATA::AFX_DDPDATA]
lea edi, [r8 - 1]
movsxd rdx, edi
test edi, edi
js 0x1400dc9a5
cmp rdx, rcx
jge 0x1400dcb2c
mov r9, qword [rbx + 0x180]
mov rax, qword [r9 + rdx*8]
test byte [rax + 0x1c], 1
jne 0x1400dc9ef
dec edi
sub rdx, 1
jns 0x1400dc9cb
jmp 0x1400dc9a5
mov rax, r8
test r8d, r8d
js 0x1400dcb2c
cmp rax, rcx
jge 0x1400dcb2c
mov rcx, qword [r9 + r8*8]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x38]
mov dword [rbx + reloc.mfc140u.dll_AFX_DDPDATA::AFX_DDPDATA], edi
movsxd rcx, edi
test edi, edi
js 0x1400dcb2c
cmp rcx, qword [rbx + 0x188]
jge 0x1400dcb2c
mov rax, qword [rbx + 0x180]
mov edx, 1
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov edx, dword [rbx + reloc.mfc140u.dll_AFX_DDPDATA::AFX_DDPDATA]
mov rcx, rbx
call fcn.1400d8f7c
jmp 0x1400dc9a5
cmp edx, 0x27
jne 0x1400dcaac
movsxd r8, dword [rbx + reloc.mfc140u.dll_AFX_DDPDATA::AFX_DDPDATA]
lea edi, [r8 + 1]
movsxd rdx, edi
cmp rdx, rcx
jge 0x1400dc9a5
test rdx, rdx
js 0x1400dcb2c
cmp rdx, rcx
jge 0x1400dcb2c
mov r9, qword [rbx + 0x180]
mov rax, qword [r9 + rdx*8]
test byte [rax + 0x1c], 1
jne 0x1400dc9ef
inc edi
inc rdx
movsxd rax, edi
cmp rax, rcx
jl 0x1400dca73
jmp 0x1400dc9a5
cmp edx, 0x73
jne 0x1400dcada
mov rcx, rbx
call sub.mfc140u.dll_Ordinal_6724
test al, 1
je 0x1400dc9a5
mov rax, qword [rbx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [rax + 0x310]
jmp 0x1400dc9a5
cmp edx, 9
jne 0x1400dcb05
lea ecx, [rdx + 7]
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, rbx
bt eax, 0xf
jae 0x1400dcafb
call fcn.1400de5dc
jmp 0x1400dc9a5
call fcn.1400d8ec4
jmp 0x1400dc9a5
movsxd r8, dword [rbx + reloc.mfc140u.dll_AFX_DDPDATA::AFX_DDPDATA]
test r8, r8
js 0x1400dcb2c
cmp r8, rcx
jge 0x1400dcb2c
mov rax, qword [rbx + 0x180]
mov rcx, qword [rax + r8*8]
mov rax, qword [rcx]
call qword [rax + 0x40]
jmp 0x1400dc9a5
call sub.mfc140u.dll_AfxRegDeleteKey
int3

Function at 0x1400e16cc
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x140164c80]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x1400e1734
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400e1734
mov ecx, dword [0x140164c80]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400e1734
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
jmp 0x1400e1736
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e1864
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, r8
mov edx, ecx
mov ebp, ecx
mov ecx, 0x400
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esi, eax
mov rcx, rbx
test eax, eax
jle 0x1400e18cf
mov edx, eax
call qword [sym.imp.mfc140u.dll_Ordinal_4946]
mov r9d, esi
mov edx, ebp
mov r8, rax
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CDialogImpl::ProcessMouseClick]
mov rax, qword [rbx]
cmp dword [rax - 0x10], 0
jne 0x1400e18d8
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400e2bc0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
cmp edx, 0x2e
ja 0x1400e2ca9
je 0x1400e2c7d
sub edx, 8
je 0x1400e2c6f
sub edx, 0x1b
je 0x1400e2c63
sub edx, 1
je 0x1400e2c5f
sub edx, 1
je 0x1400e2c47
sub edx, 2
je 0x1400e2c3d
cmp edx, 6
jne 0x1400e2d5d
lea ecx, [rdx + 0xb]
call qword [sym.imp.USER32.dll_GetKeyState]
bt eax, 0xf
jb 0x1400e2d48
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
bt eax, 0xf
jae 0x1400e2c2c
mov edx, 0x302
jmp 0x1400e2d4d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x358]
jmp 0x1400e2d5d
mov edx, dword [rcx + 0x168]
inc edx
jmp 0x1400e2c4f
mov edx, dword [rcx + 0x168]
dec edx
mov r8d, 1
call fcn.1400e23e8
jmp 0x1400e2d5d
xor edx, edx
jmp 0x1400e2c4f
call sub.mfc140u.dll_CMFCMousePropertyPage::GetMessageMap
mov edx, eax
mov rcx, rbx
jmp 0x1400e2c4f
mov rax, qword [rcx]
call qword [rax + 0x310]
jmp 0x1400e2d5d
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
bt eax, 0xf
jae 0x1400e2c98
mov edx, 0x300
jmp 0x1400e2d4d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x318]
jmp 0x1400e2d5d
cmp edx, 0x43
je 0x1400e2d37
cmp edx, 0x56
je 0x1400e2d21
cmp edx, 0x58
je 0x1400e2d0b
cmp edx, 0x5a
je 0x1400e2cf3
cmp edx, 0x71
jne 0x1400e2cdf
cmp qword [rcx + 0x100], 0
je 0x1400e2d5d
mov rax, qword [rcx]
call qword [rax + 0x2f0]
jmp 0x1400e2d5d
cmp edx, 0x73
jne 0x1400e2d5d
mov rax, qword [rcx]
add rsp, 0x20
pop rbx
jmp qword [rax + 0x2e0]
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
bt eax, 0xf
jae 0x1400e2d5d
mov edx, 0x304
jmp 0x1400e2d4d
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
bt eax, 0xf
jae 0x1400e2d5d
jmp 0x1400e2c8e
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
bt eax, 0xf
jae 0x1400e2d5d
jmp 0x1400e2c22
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
bt eax, 0xf
jae 0x1400e2d5d
mov edx, 0x301
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sub.mfc140u.dll_CDHtmlDialog::DDX_DHtml_ElementText
Function at 0x1400e39c4
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140164008]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
cmp edx, 0x79
jne 0x1400e3a60
lea ecx, [rdx - 0x69]
call qword [sym.imp.USER32.dll_GetKeyState]
bt eax, 0xf
jae 0x1400e3a45
mov rcx, qword [rbx + 0x40]
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x2c]
sub eax, dword [rsp + 0x24]
cdq
sub eax, edx
sar eax, 1
movzx r8d, ax
mov eax, dword [rsp + 0x28]
sub eax, dword [rsp + 0x20]
cdq
shl r8d, 0x10
sub eax, edx
mov edx, 0x205
sar eax, 1
movzx ecx, ax
or r8d, ecx
mov rcx, qword [rbx + 0x40]
movsxd r9, r8d
xor r8d, r8d
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, rbx
call sub.mfc140u.dll_CDHtmlDialog::DDX_DHtml_ElementText
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14002fdd0
add rsp, 0x40
pop rbx
ret
cmp edx, 8
jne 0x1400e3a73
mov rcx, qword [rcx + 0x40]
xor r9d, r9d
mov edx, 0x304
jmp 0x1400e3a3c
cmp edx, 0x28
jne 0x1400e3a45
mov rax, qword [rcx]
call qword [rax + 0x2e0]
jmp 0x1400e3a4d

Function at 0x1400e465c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rcx
test rcx, rcx
je 0x1400e4709
cmp word [rcx], si
je 0x1400e4709
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0x2042
lea eax, [rax*2 + 2]
movsxd rdx, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400e4709
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400e4709
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x1400e46f5
mov ecx, dword [0x140164c84]
mov rdx, rbx
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
jmp 0x1400e470b
call qword [sym.imp.USER32.dll_CloseClipboard]
test rbx, rbx
je 0x1400e46ee
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ede34
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x140164008]
xor rax, rsp
mov qword [rsp + 0xd0], rax
xor r12d, r12d
movsxd rsi, r9d
mov r10, rcx
mov edi, r12d
mov r15d, r12d
cmp esi, 0x64
jle 0x1400ede96
mov eax, dword [rcx + 0x12dc]
mov dword [rcx + 0x14bc], eax
mov dword [rcx + 0x14ac], 1
mov dword [rcx + 0x14b0], 0xe5
jmp 0x1400ee076
cmp dx, 0xffff
je 0x1400edebc
lea r9, [rsp]
movsx rax, dx
mov word [r9], dx
lea r9, [r9 + 2]
lea rcx, [rax + rax*2]
movzx edx, word [r10 + rcx*8 + 6]
cmp dx, 0xffff
jne 0x1400edea0
movsx rdx, word [r8 + 0x1a]
mov r9, rdx
test rdx, rdx
jle 0x1400edee6
lea r11, [r8 + 0x20]
mov eax, dword [r11]
lea ecx, [rdi + 1]
and al, 6
lea r11, [r11 + 8]
cmp al, 2
cmovne ecx, edi
mov edi, ecx
sub r9, 1
jne 0x1400edecd
mov r9d, r12d
cmp r12w, dx
jge 0x1400ee031
mov r11, r12
movzx ecx, dx
mov r13d, 0x400
movzx edx, cx
cmp r9d, esi
jge 0x1400ee031
movsxd rbx, r9d
mov edx, dword [r8 + rbx*8 + 0x20]
mov eax, edx
shr eax, 1
and eax, 3
je 0x1400edff7
sub eax, 1
je 0x1400edff7
cmp eax, 1
jne 0x1400ee01d
inc r15d
movsx eax, cx
dec eax
cmp r9d, eax
je 0x1400edfb9
movsxd rdx, eax
lea r9, [rsi - 1]
cmp rdx, rbx
je 0x1400edfeb
lea r14, [r8 + 0x1c]
lea r14, [r14 + rdx*8]
sub rdx, rbx
movsx rax, word [rsp + r9*2]
dec r9
lea rcx, [rax + rax*2]
mov eax, dword [r14 + 4]
shl eax, 0xa
xor eax, dword [r10 + rcx*8]
and eax, r13d
xor dword [r10 + rcx*8], eax
movzx eax, word [r14]
lea r14, [r14 - 8]
mov word [r10 + rcx*8 + 0xa], ax
sub rdx, 1
jne 0x1400edf5a
jmp 0x1400edfeb
movsx rax, word [rsp + r11*2]
lea rcx, [rax + rax*2]
mov eax, dword [r8 + rbx*8 + 0x20]
shl eax, 0xa
xor eax, dword [r10 + rcx*8]
and eax, r13d
xor dword [r10 + rcx*8], eax
movzx eax, word [r8 + rbx*8 + 0x1c]
inc r11
mov word [r10 + rcx*8 + 0xa], ax
cmp r11, rsi
jl 0x1400edf8e
jmp 0x1400ee01d
movsx rax, word [rsp + r9*2]
lea rcx, [rax + rax*2]
mov eax, dword [r8 + rbx*8 + 0x20]
shl eax, 0xa
xor eax, dword [r10 + rcx*8]
and eax, r13d
xor dword [r10 + rcx*8], eax
movzx eax, word [r8 + rbx*8 + 0x1c]
dec r9
mov word [r10 + rcx*8 + 0xa], ax
cmp r9, r11
jge 0x1400edfc0
movsx r9d, word [r8 + 0x1a]
jmp 0x1400ee01d
movsx rax, word [rsp + r11*2]
shl edx, 0xa
lea rcx, [rax + rax*2]
xor edx, dword [r10 + rcx*8]
and edx, r13d
xor dword [r10 + rcx*8], edx
movzx eax, word [r8 + rbx*8 + 0x1c]
inc r11
mov word [r10 + rcx*8 + 0xa], ax
movsx edx, word [r8 + 0x1a]
inc r9d
movzx ecx, dx
cmp r9d, edx
jl 0x1400edeff
movsx ecx, dx
mov eax, ecx
sub eax, edi
cmp esi, eax
jge 0x1400ee049
mov dword [r10 + 0x14b0], 0xe6
jmp 0x1400ee05d
cmp esi, ecx
jle 0x1400ee076
test r15d, r15d
jne 0x1400ee076
mov dword [r10 + 0x14b0], 0xe5
mov eax, dword [r10 + 0x12dc]
mov dword [r10 + 0x14bc], eax
mov dword [r10 + 0x14ac], 1
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14002fdd0
mov rbx, qword [rsp + 0x128]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400f128c
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x230
mov rax, qword [0x140164008]
xor rax, rsp
mov qword [rsp + reloc.mfc140u.dll_CInternetFile::CInternetFile], rax
mov rbx, rcx
movsxd rax, edx
neg r8d
mov r9d, CMapStringToOb::HashKey
lea r8, [rsp + 0x20]
sbb rcx, rcx
and ecx, 4
add rcx, 0xfffffffffffffff8
lea rdx, [rcx + rax*8]
mov ecx, dword [0x14016e450]
lea rax, [0x14012c5e8]
mov edx, dword [rdx + rax]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400f12f6
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
mov eax, 1
mov rcx, qword [rsp + reloc.mfc140u.dll_CInternetFile::CInternetFile]
xor rcx, rsp
call fcn.14002fdd0
add rsp, 0x230
pop rbx
ret

Function at 0x1400f13d4
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x230
mov rax, qword [0x140164008]
xor rax, rsp
mov qword [rsp + reloc.mfc140u.dll_CInternetFile::CInternetFile], rax
mov rbx, rcx
movsxd rax, edx
neg r8d
mov r9d, CMapStringToOb::HashKey
lea r8, [rsp + 0x20]
sbb rcx, rcx
and ecx, 4
add rcx, 0xfffffffffffffff8
lea rdx, [rcx + rax*8]
mov ecx, dword [0x14016e450]
lea rax, [0x14012c620]
mov edx, dword [rdx + rax]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400f143e
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
mov eax, 1
mov rcx, qword [rsp + reloc.mfc140u.dll_CInternetFile::CInternetFile]
xor rcx, rsp
call fcn.14002fdd0
add rsp, 0x230
pop rbx
ret

Function at 0x1400f9558
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x30
mov rbx, rdx
and dword [rsp + 0x20], 0
lea rdx, [0x140136fac]
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__12]
mov dword [rsp + 0x20], 1
mov edx, 3
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_Ordinal_4946]
mov r8, rax
mov edx, InitCommonControls
mov ecx, 0x400
lea r9d, [rdx - 0xc]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CDialogImpl::ProcessMouseClick]
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1400fb2a8
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14096bac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x40], 0x706a0870
jne 0x140970ace
ja 0x14096baf6
test dword [rcx + 0x36], 0x4cd0ff8a
mov ebx, eax
test r12d, r10d
test rax, rax
jmp 0x140ae2e44
call fcn.14095a1fb
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x50]
call fcn.140bc037b
int3
sub eax, eax
jmp 0x140ae2d9b
jmp 0x140ae2f94
je 0x140ae2d94
cmp r11, rsi
jne 0x140ae2ef1
cmp byte [rsp + 0x180], dil
jmp 0x140ae2e60
je 0x140ae2ed6
lea rax, [rsp + 0x40]
sar dh, cl
sub rbp, rax
clc
movsxd rax, edx
nop
cmc
setae cl
bts dx, r15w
lea rdx, [rsp + rdi + 0x40]
btc rcx, r12
rol ah, 0x6c
rcl ecx, 0x40
mov ecx, edi
movzx rax, bx
mov eax, 0x2db12324
rol eax, cl
cmp rbx, 0x2a0a095c
add al, dil
cmp di, bx
test r10w, 0x25b9
xor al, byte [rdx + rbp]
jmp 0x140ae2eb5
mov byte [rdx], al
je 0x140ae2ece
inc rdi
cmc
cmp rdi, 0x104
jb 0x140ae2e7e
lea rbp, [rsp + 0x40]
cqo
cwde
mov rdx, rbp
cmovns cx, bp
cwde
mov cl, 0xc6
mov rcx, rsi
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
jmp 0x140ae2f94
cmp byte [rbx + 1], 0x23
xchg dh, dh
not dl
lea rdx, [rbx + 1]
jmp 0x140ae2f02
jne 0x140ae2f6f
movzx edx, byte [rbx + 2]
stc
add rbx, 2
clc
test dl, dl
jmp 0x140ae2f19
je 0x140ae2f6c
nop
not rax
movsxd rax, r14d
dec ah
lea eax, [rdx - 0x30]
jmp 0x140ae2f30
inc rbx
cmp al, 9
jmp 0x140ae2f3a
ja 0x140ae2f6c
movsx eax, dl
movzx edx, byte [rbx]
or cl, r10b
sub ch, 0x31
lea ecx, [rdi + rdi*4]
sbb di, 0x36d0
shld di, di, 0x5d
lea edi, [rax + rcx*2 - 0x30]
cmc
clc
test dl, dl
jmp 0x140ae2f66
jne 0x140ae2f28
movsxd rdx, edi
xor r8d, r8d
movzx cx, sil
movzx ecx, r15w
mov rcx, r11
jmp 0x140ae2f83
call fcn.140ae29ec
jmp 0x140ae2f94
mov rbx, qword [rsp + 0x178]
mov rdi, qword [rsp + 0x150]
add rsp, 0x158
movsx si, r15b
pop rsi
pop rbp
jmp 0x140ae2fb7
ret
Function at 0x18000e450
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rsi
sub rsp, 0x80
xor ebx, ebx
cmp dword [0x180052be4], 0x40
mov esi, ebx
jae 0x18000e5a9
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rdi
lea rdi, [rcx + rdx]
mov eax, 0x80000000
cmp rdi, rax
jae 0x18000e48b
lea edi, [rbx + 1]
jmp 0x18000e492
sub rdi, 0x7fff0000
lea rbp, [rcx + r8]
cmp rbp, 0xffffffff80000000
jae 0x18000e4a8
add rbp, 0x7ff80000
jmp 0x18000e4af
mov rbp, 0xfffffffffff80000
xor edx, edx
lea rcx, [rsp + 0x54]
mov dword [rsp + 0x50], ebx
lea r8d, [rdx + 0x2c]
call fcn.180015840
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp rdi, rbp
jae 0x18000e577
nop word [rax + rax]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000e557
cmp dword [rsp + 0x40], 0x10000
jne 0x18000e545
mov rax, qword [rsp + 0x38]
cmp rax, 0x78
jb 0x18000e54a
mov edx, dword [rsp + 0x78]
mov ecx, edx
cmp rax, rdx
jb 0x18000e54a
lea eax, [rdx - 1]
xor edx, edx
mov r8d, 0x3000
add rax, rdi
div rcx
mov edx, 0x78
lea r9d, [rdx - 0x58]
imul rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18000e55c
mov rax, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x20]
add rdi, rax
cmp rdi, rbp
jb 0x18000e4e0
test rsi, rsi
je 0x18000e577
lea rcx, [0x1800528d0]
mov rax, rcx
cmp qword [rax], 0
je 0x18000e59b
inc ebx
add rax, 8
cmp ebx, 0x40
jb 0x18000e566
mov rbp, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov rax, rsi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rsi
ret
inc dword [0x180052be4]
mov eax, ebx
mov qword [rcx + rax*8], rsi
jmp 0x18000e577
mov rax, rbx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rsi
ret