joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400056a4
Capabilities:
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1400056f4
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, rcx
call fcn.140002128
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov esi, eax
xor edi, edi
test eax, eax
je 0x1400057c5
mov eax, 2
mul rsi
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call fcn.140037304
mov rbx, rax
mov qword [rsp + 0x68], rax
mov rdx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebp, eax
test eax, eax
je 0x1400057ba
cmp eax, esi
ja 0x1400057ba
lea rcx, [rsp + 0x20]
call fcn.1400027fc
nop
mov r15d, edi
mov esi, edi
test ebp, ebp
je 0x1400057a8
mov r14, rbx
inc esi
cmp word [r14], di
jne 0x1400057a0
mov eax, r15d
lea rdx, [rbx + rax*2]
lea rcx, [rsp + 0x20]
call fcn.14000296c
mov r15d, esi
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.140001774
add r14, 2
cmp esi, ebp
jb 0x140005777
cmp r15d, ebp
sete dil
mov rcx, qword [rsp + 0x20]
call fcn.1400372fc
nop
mov rcx, rbx
call fcn.1400372fc
mov al, dil
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x140005acc
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [rcx]
mov rdi, rdx
and dword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140005b01
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140005b01
xor al, al
jmp 0x140005b11
mov ecx, dword [rsp + 0x30]
mov al, 1
shl rcx, 0x20
add rcx, rbx
mov qword [rdi], rcx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140005c34
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov rbx, r9
and dword [rsp + 0x58], 0
lea r9, [rsp + 0x58]
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x58]
test eax, eax
mov dword [rbx], ecx
setne al
add rsp, 0x30
pop rbx
ret
mov eax, r8d
mov r8d, 0x400000
cmp eax, r8d
cmovbe r8d, eax
jmp 0x140005c34

Function at 0x140005c68
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov rbx, r9
and dword [rsp + 0x58], 0
lea r9, [rsp + 0x58]
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x58]
test eax, eax
mov dword [rbx], ecx
setne al
add rsp, 0x30
pop rbx
ret
mov eax, r8d
mov r8d, 0x400000
cmp eax, r8d
cmovbe r8d, eax
jmp 0x140005c34
Function at 0x140005d3c
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rbx, rdx
mov rdi, rcx
call fcn.140005c80
test al, al
je 0x140005d74
cmp qword [rsp + 0x40], rbx
jne 0x140005d74
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
jmp 0x140005d76
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140005e8c
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
and dword [rsp + 0x50], 0
mov eax, r8d
mov rcx, qword [rcx]
mov r8d, 0x400000
cmp eax, r8d
mov rbx, r9
lea r9, [rsp + 0x50]
cmovbe r8d, eax
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x50]
test eax, eax
mov dword [rbx], ecx
setne al
add rsp, 0x30
pop rbx
ret

Function at 0x1400073ac
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
lea rcx, [rsp + 0x20]
call fcn.14000737c
xor edx, edx
test eax, eax
je 0x1400073e2
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x1400073e2
lea r8d, [rdx + 0x40]
mov ecx, eax
shr rax, 1
and ecx, 1
add edx, ecx
sub r8, 1
jne 0x1400073ce
mov eax, edx
jmp 0x1400073f1
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x50]
add rsp, 0x68
ret

Function at 0x1400073f8
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x60
movabs rax, 0x100000000
mov dword [rsp + 0x20], 0x40
mov qword [rcx], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x14000743a
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x48], rax
cmovb rax, qword [rsp + 0x48]
mov qword [rbx], rax
mov al, 1
add rsp, 0x60
pop rbx
ret

Function at 0x140007450
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rdx]
xor ebp, ebp
mov dword [rdx + 8], ebp
mov rsi, rcx
mov rbx, rdx
mov word [rax], bp
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
test eax, eax
jne 0x140007491
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
jmp 0x1400074d4
cmp edi, dword [rbx + 0xc]
jbe 0x1400074a0
mov edx, edi
mov rcx, rbx
call fcn.140003200
mov rdx, qword [rbx]
lea r8d, [rdi + 1]
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rdx, qword [rbx]
mov ecx, ebp
cmp edi, eax
cmova edi, eax
mov word [rdx + rdi*2], bp
cmp word [rdx], bp
je 0x1400074cb
inc ecx
cmp word [rdx + rcx*2], bp
jne 0x1400074c3
mov dword [rbx + 8], ecx
test edi, edi
je 0x140007484
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400132a4
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp word [rbx + 0x18], 8
je 0x1400132f5
cmp word [rbx + 0x18], 0x52
je 0x1400132e3
cmp word [rbx + 0x18], 0x76
jne 0x1400132f1
mov rcx, rdi
call fcn.140012bf4
jmp 0x1400132fd
test al, al
je 0x1400132f1
mov rcx, rdi
call fcn.140013d2c
jmp 0x1400132fd
xor al, al
jmp 0x1400132ff
mov rcx, rdi
call fcn.140013620
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400154c0
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rdi, r9
mov r14d, r8d
mov r15d, edx
mov rsi, rcx
lea rcx, [rsp + 0x60]
call fcn.1400027fc
nop
cmp byte [rdi], 0
je 0x140015540
mov rdx, qword [rdi + 8]
lea rcx, [rsp + 0x70]
call fcn.1400152d4
nop
mov r8, rax
mov edx, 0xdb0
lea rcx, [rbp - 0x80]
call fcn.140015290
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140002834
nop
mov rcx, qword [rbp - 0x80]
call fcn.1400372fc
nop
mov rcx, qword [rsp + 0x70]
call fcn.1400372fc
lea r12, [rdi + 0x18]
mov rcx, r12
call fcn.1400034a4
lea ebx, [rax + 1]
mov r8, r12
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.1400025f4
nop
mov rax, qword [r12]
lea rdx, [rax + rbx*2]
lea rcx, [rsp + 0x40]
call fcn.1400027a4
nop
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140015420
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140015420
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.1400026bc
nop
lea rcx, [rsp + 0x30]
call fcn.140002c2c
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140002a88
lea rcx, [rsp + 0x30]
call fcn.140002c2c
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140002a88
lea rcx, [rsp + 0x30]
call fcn.140002c2c
cmp byte [rdi + 1], 0
je 0x140015635
mov edx, 0x3f4
lea rcx, [rsp + 0x70]
call fcn.140006f70
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140002a88
nop
mov rcx, qword [rsp + 0x70]
call fcn.1400372fc
lea rdx, [0x14004eb00]
lea rcx, [rsp + 0x30]
call fcn.140002ad4
lea rcx, [rdi + 0x10]
xor r8d, r8d
lea rdx, [rbp - 0x70]
call fcn.140006e88
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x30]
call fcn.140002ad4
mov edx, r15d
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov dword [rsp + 0x20], pe_nt_image_headers64
mov r9d, 0x2b8
lea r8, [rbp - 0x30]
mov edx, 0x80
mov rcx, qword [r12]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x140015699
mov edx, r14d
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
mov r8, qword [rbp - 0x30]
mov edx, 0x170
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
nop
mov rcx, qword [rsp + 0x30]
call fcn.1400372fc
nop
mov rcx, qword [rsp + 0x40]
call fcn.1400372fc
nop
mov rcx, qword [rsp + 0x50]
call fcn.1400372fc
nop
mov rcx, qword [rsp + 0x60]
call fcn.1400372fc
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14001856c
Capabilities:
Get file system object information

Disassembly:
push rbx
sub rsp, 0x2f0
mov rbx, r8
mov dword [rsp + 0x20], 0x4010
lea r8, [rsp + 0x30]
bts edx, 7
mov r9d, 0x2b8
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [rsp + 0x38]
mov dword [rbx], ecx
add rsp, 0x2f0
pop rbx
ret

Function at 0x1400185a4
Capabilities:
Get file system object information

Disassembly:
sub rsp, 0x2f8
neg cl
lea r8, [rsp + 0x30]
mov r9d, 0x2b8
lea rcx, [0x14004dff8]
sbb eax, eax
mov edx, 0x90
and eax, 0xffffff01
add eax, 0x4110
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
add rsp, 0x2f8
ret

Function at 0x1400262a0
Capabilities:
Check os version
Get common file path

Disassembly:
sub rsp, 0x308
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x1400262e4
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.SetDefaultDllDirectories
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400262e4
mov ecx, 0xc00
call rax
test eax, eax
jne 0x1400263f0
mov edx, 0x106
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [rax - 1]
cmp ecx, 0x103
ja 0x1400263f0
lea ecx, [rax - 1]
mov qword [rsp + 0x310], rbx
cmp word [rsp + rcx*2 + 0x20], 0x5c
je 0x140026324
mov ecx, eax
mov edx, 0x5c
inc eax
mov word [rsp + rcx*2 + 0x20], dx
movzx edx, byte [str.userenv]
lea rbx, str.userenv
test dl, dl
je 0x1400263e8
mov qword [rsp + 0x318], rbp
mov qword [rsp + 0x320], rsi
mov qword [rsp + 0x300], rdi
lea rdi, [rsp + 0x20]
mov eax, eax
mov qword [rsp + 0x2f8], r14
mov qword [rsp + 0x2f0], r15
xor r15d, r15d
lea rdi, [rdi + rax*2]
mov rcx, rdi
inc rbx
nop word [rax + rax]
movzx eax, dl
movzx edx, byte [rbx]
inc rbx
mov word [rcx], ax
lea rcx, [rcx + 2]
test dl, dl
jne 0x140026380
mov dword [rcx], 0x64002e
xor edx, edx
mov dword [rcx + 4], 0x6c006c
mov r8d, 8
mov word [rcx + 8], r15w
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
movzx edx, byte [rbx]
test dl, dl
jne 0x140026370
mov r15, qword [rsp + 0x2f0]
mov r14, qword [rsp + 0x2f8]
mov rdi, qword [rsp + 0x300]
mov rsi, qword [rsp + 0x320]
mov rbp, qword [rsp + 0x318]
mov rbx, qword [rsp + 0x310]
add rsp, 0x308
ret
Function at 0x14002d020
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov ebx, r8d
lea r9, [rcx + 0x10]
shr ebx, 2
mov edi, 1
mov eax, ebx
mov r11d, ebx
shr eax, 1
add eax, 3
mov dword [rcx], eax
test ebx, ebx
je 0x14002d071
mov rcx, r9
mov r8d, r11d
nop dword [rax + rax]
mov eax, dword [rdx]
lea rdx, [rdx + 4]
mov dword [rcx], eax
lea rcx, [rcx + 4]
sub r8, rdi
jne 0x14002d060
mov eax, dword [r9 + rbx*4 - 4]
lea rsi, [rbx + 0xe]
lea rsi, [rbx + rsi*2]
xor r10d, r10d
lea rsi, [r9 + rsi*4]
mov r14d, 0x1b
lea rbp, str.cw
test r10d, r10d
jne 0x14002d0e6
mov r8d, eax
mov r10d, ebx
movzx eax, al
mov ecx, r8d
shr rcx, 0x18
movzx eax, byte [rax + rbp]
movzx ecx, byte [rcx + rbp]
shl eax, 8
or eax, ecx
mov ecx, r8d
shr rcx, 0x10
shl eax, 8
movzx edx, cl
shr r8, 8
movzx ecx, byte [rdx + rbp]
or eax, ecx
movzx ecx, r8b
shl eax, 8
movzx edx, byte [rcx + rbp]
xor edx, edi
add edi, edi
or eax, edx
bt edi, 8
cmovb edi, r14d
jmp 0x14002d12f
cmp r10d, 4
jne 0x14002d12f
cmp ebx, 6
jbe 0x14002d12f
mov r8d, eax
shr rax, 0x10
movzx ecx, al
movzx eax, byte [rcx + rbp]
mov ecx, r8d
shr rcx, 0x18
movzx ecx, byte [rcx + rbp]
shl ecx, 8
or eax, ecx
mov ecx, r8d
shr rcx, 8
movzx edx, cl
shl eax, 8
movzx ecx, byte [rdx + rbp]
or eax, ecx
movzx ecx, r8b
shl eax, 8
movzx edx, byte [rcx + rbp]
or eax, edx
xor eax, dword [r9]
dec r10d
mov dword [r9 + rbx*4], eax
add r9, 4
cmp r9, rsi
jne 0x14002d092
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x14002d2b0
Capabilities:
Encode data using xor

Disassembly:
lea r9, [0x1400674c0]
jmp 0x14002e630
push rbx
push rbp
push rsi
push rdi
mov eax, ecx
mov rbp, r9
mov rdi, r8
cmp rdi, 0x1f
jb 0x14002e7f3
test edx, 3
je 0x14002e665
movzx esi, byte [rdx]
movzx ebx, al
inc rdx
shr eax, 8
xor esi, ebx
xor eax, dword [rbp + rsi*4]
dec rdi
jmp 0x14002e646
xor eax, dword [rdx]
lea rdi, [rdx + rdi - 0x1b]
sub rdx, rdi
nop
mov ecx, dword [rdi + rdx + 0xc]
movzx ebx, word [rdi + rdx + 8]
movzx r9d, word [rdi + rdx + 0xa]
movzx esi, bl
shr ebx, 8
xor ecx, dword [rbp + rsi*4 + 0xc00]
movzx esi, r9b
shr r9d, 8
xor ecx, dword [rbp + rbx*4 + 0x800]
xor ecx, dword [rbp + rsi*4 + 0x400]
xor ecx, dword [rbp + r9*4]
movzx ebx, word [rdi + rdx + 4]
movzx r9d, word [rdi + rdx + 6]
movzx esi, bl
shr ebx, 8
xor ecx, dword [rbp + rsi*4 + 0x1c00]
movzx esi, r9b
shr r9d, 8
xor ecx, dword [rbp + rbx*4 + 0x1800]
xor ecx, dword [rbp + rsi*4 + 0x1400]
xor ecx, dword [rbp + r9*4 + 0x1000]
movzx esi, al
mov ebx, eax
shr ebx, 0x18
xor ecx, dword [rbp + rsi*4 + 0x2c00]
xor ecx, dword [rbp + rbx*4 + 0x2000]
ror eax, 0x10
movzx esi, al
shr eax, 0x18
xor ecx, dword [rbp + rsi*4 + 0x2400]
xor ecx, dword [rbp + rax*4 + 0x2800]
mov eax, dword [rdi + rdx + 0x18]
movzx ebx, word [rdi + rdx + 0x14]
movzx r9d, word [rdi + rdx + 0x16]
movzx esi, bl
shr ebx, 8
xor eax, dword [rbp + rsi*4 + 0xc00]
movzx esi, r9b
shr r9d, 8
xor eax, dword [rbp + rbx*4 + 0x800]
xor eax, dword [rbp + rsi*4 + 0x400]
xor eax, dword [rbp + r9*4]
movzx ebx, word [rdi + rdx + 0x10]
movzx r9d, word [rdi + rdx + 0x12]
movzx esi, bl
shr ebx, 8
xor eax, dword [rbp + rsi*4 + 0x1c00]
movzx esi, r9b
shr r9d, 8
xor eax, dword [rbp + rbx*4 + 0x1800]
xor eax, dword [rbp + rsi*4 + 0x1400]
xor eax, dword [rbp + r9*4 + 0x1000]
movzx esi, cl
mov ebx, ecx
shr ebx, 0x18
xor eax, dword [rbp + rsi*4 + 0x2c00]
xor eax, dword [rbp + rbx*4 + 0x2000]
ror ecx, 0x10
movzx esi, cl
shr ecx, 0x18
xor eax, dword [rbp + rsi*4 + 0x2400]
xor eax, dword [rbp + rcx*4 + 0x2800]
add rdx, 0x18
jae 0x14002e670
add rdi, 0x18
sub rdx, 0x18
movzx ebx, al
movzx ecx, ah
shr eax, 0x10
movzx esi, al
shr eax, 8
mov eax, dword [rbp + rax*4]
xor eax, dword [rbp + rbx*4 + 0xc00]
xor eax, dword [rbp + rcx*4 + 0x800]
xor eax, dword [rbp + rsi*4 + 0x400]
add rdx, 4
jb 0x14002e7e9
xor eax, dword [rdi + rdx]
jmp 0x14002e7b6
add rdx, rdi
add rdi, 3
sub rdi, rdx
test rdi, rdi
je 0x14002e80f
movzx esi, byte [rdx]
movzx ebx, al
inc rdx
shr eax, 8
xor esi, ebx
xor eax, dword [rbp + rsi*4]
dec rdi
jne 0x14002e7f8
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002d8f0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 8]
mov rdi, rdx
and eax, 0x3f
mov rbx, rcx
mov byte [rax + rcx + 0x40], 0x80
inc eax
cmp eax, 0x38
jbe 0x14002d947
cmp eax, 0x40
je 0x14002d92d
mov byte [rax + rcx + 0x40], 0
inc eax
cmp eax, 0x40
jne 0x14002d921
lea rbp, [rcx + 0x40]
mov r8d, 1
lea rsi, [rcx + 0x20]
mov rdx, rbp
mov rcx, rsi
call qword [rbx]
xor eax, eax
jmp 0x14002d94f
lea rbp, [rcx + 0x40]
lea rsi, [rcx + 0x20]
mov ecx, eax
mov r8d, 0x38
add rcx, 0x40
sub r8d, eax
add rcx, rbx
xor edx, edx
call fcn.140049780
mov rcx, qword [rbx + 8]
mov r8d, 1
shl rcx, 3
mov rdx, rbp
mov rax, rcx
bswap ecx
shr rax, 0x20
bswap eax
mov dword [rbx + 0x7c], ecx
mov rcx, rsi
mov dword [rbx + 0x78], eax
call qword [rbx]
mov rdx, rsi
mov r8d, 4
nop dword [rax + rax]
mov ecx, dword [rdx + 4]
lea rdi, [rdi + 8]
mov eax, dword [rdx]
lea rdx, [rdx + 8]
bswap eax
mov dword [rdi - 8], eax
bswap ecx
mov dword [rdi - 4], ecx
sub r8, 1
jne 0x14002d9a0
mov rbp, qword [rsp + 0x38]
mov qword [rbx + 8], r8
mov dword [rsi], 0x6a09e667
mov rsi, qword [rsp + 0x40]
mov dword [rbx + 0x24], 0xbb67ae85
mov dword [rbx + 0x28], 0x3c6ef372
mov dword [rbx + 0x2c], 0xa54ff53a
mov dword [rbx + 0x30], 0x510e527f
mov dword [rbx + 0x34], 0x9b05688c
mov dword [rbx + 0x38], 0x1f83d9ab
mov dword [rbx + 0x3c], 0x5be0cd19
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14002ebd8
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x20
and dword [rax + 0x18], 0
lea r9, [rax + 0x18]
mov rsi, rdx
mov rdi, rcx
mov edx, 8
lea r8d, [rdx - 4]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14002ec0d
xor eax, eax
jmp 0x14002ec2e
mov rbx, qword [rdi]
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x40]
mov edx, 8
mov rcx, rdi
mov qword [rdi], rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14002ec7c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rdx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [rcx + r8]
movabs r9, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, r9
cmp r8, 8
jb 0x14002ec89
mov rax, rdx
ret
Function at 0x14002f2a8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x14006a570], 0
jne 0x14002f4e9
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002f4e9
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002f4e9
lea r8, [0x14006a4d8]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call rax
mov ecx, dword [0x14006a4d8]
and ecx, 0xfffffff
cmp dword [rsp + 0x30], 0xa
mov dword [0x14006a4d8], ecx
jne 0x14002f4e9
cmp dword [rsp + 0x38], 0
jne 0x14002f4e9
cmp ecx, 0x4563
je 0x14002f34c
lea eax, [rcx - 0x47ba]
cmp eax, 1
jbe 0x14002f34c
cmp ecx, 0x4a61
je 0x14002f34c
cmp ecx, 0x4a62
jb 0x14002f4e9
xor edx, edx
lea rcx, str.uxtheme.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
je 0x14002f4e9
mov edx, 0x31
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002f387
mov qword [0x14006a520], rax
mov edx, 0x68
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002f3a1
mov qword [0x14006a508], rax
mov edx, 0x6a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002f3bb
mov qword [0x14006a518], rax
mov edx, 0x84
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002f3d5
mov qword [0x14006a4e8], rax
mov edx, 0x85
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002f3ef
mov qword [0x14006a4f0], rax
cmp dword [0x14006a4d8], 0x47ba
mov edx, 0x87
mov rcx, rbx
jae 0x14002f417
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002f429
mov qword [0x14006a4f8], rax
jmp 0x14002f429
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002f429
mov qword [0x14006a4d0], rax
mov edx, 0x88
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002f443
mov qword [0x14006a500], rax
mov edx, 0x89
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002f45d
mov qword [0x14006a510], rax
lea rcx, [0x14004ff18]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002f48b
lea rdx, str.SetWindowCompositionAttribute
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002f48b
mov qword [0x14006a4e0], rax
cmp qword [0x14006a520], 0
mov byte [0x14006a570], 1
je 0x14002f4e9
cmp qword [0x14006a508], 0
je 0x14002f4e9
cmp qword [0x14006a4e8], 0
je 0x14002f4e9
cmp qword [0x14006a4f0], 0
je 0x14002f4e9
cmp qword [0x14006a4f8], 0
jne 0x14002f4ce
cmp qword [0x14006a4d0], 0
je 0x14002f4e9
cmp qword [0x14006a500], 0
je 0x14002f4e9
cmp qword [0x14006a510], 0
je 0x14002f4e9
mov byte [0x14006a4dc], 1
add rsp, 0x20
pop rbx
ret
Function at 0x140034624
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x48
and dword [rsp + 0x50], 0
lea rax, [r11 + 0x10]
mov qword [r11 - 0x18], rax
lea r8, str.AppsUseLightTheme
lea rax, [r11 + 8]
mov dword [rsp + 0x58], 4
mov qword [r11 - 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemesPersonalize
and qword [r11 - 0x28], 0
mov r9d, 0x10
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140034676
xor al, al
jmp 0x14003467e
cmp dword [rsp + 0x50], 0
sete al
add rsp, 0x48
ret
Function at 0x140035264
Capabilities:
Read .ini file

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r12, r9
mov r14, r8
mov rdi, rdx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rax - 0x70], xmm0
mov rax, r8
cmp qword [r8 + 0x18], 7
jbe 0x1400352a2
mov rax, qword [r8]
cmp qword [rdx + 0x18], 7
jbe 0x1400352ac
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 7
jbe 0x1400352b6
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 7
lea r9, [rsp + 0x38]
lea r8, [0x14004dff8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x38]
call fcn.14003fb48
cmp rax, 6
jne 0x140035425
xor r13d, r13d
mov ebx, r13d
movzx ecx, word [rsp + rbx*2 + 0x38]
call fcn.14003fb3c
test eax, eax
je 0x140035425
inc rbx
cmp rbx, 6
jb 0x1400352ef
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
lea rax, [rsp + 0x38]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r13w
jne 0x140035324
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.14002f9d4
nop
call fcn.14003dbb4
mov r15, rax
lea rbx, [rsp + 0x48]
cmp qword [rsp + 0x60], 7
cmova rbx, qword [rsp + 0x48]
mov dword [rax], r13d
mov r8d, 0x10
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14003fa88
mov ecx, eax
cmp rbx, qword [rsp + 0x30]
je 0x140035451
cmp dword [r15], 0x22
je 0x14003545d
shr eax, 0x10
movzx ebx, al
movzx eax, cl
shl eax, 0x10
or ebx, eax
and ecx, 0xff00
or ebx, ecx
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x1400353dd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400353d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003546a
call fcn.1400372fc
nop
mov dword [r12], ebx
mov rcx, rsi
call fcn.1400324e4
nop
mov rcx, rdi
call fcn.1400324e4
nop
mov rcx, r14
call fcn.1400324e4
mov al, 1
jmp 0x140035441
mov rcx, rsi
call fcn.1400324e4
nop
mov rcx, rdi
call fcn.1400324e4
nop
mov rcx, r14
call fcn.1400324e4
xor al, al
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
lea rcx, str.invalid_stoi_argument
call fcn.1400364b8
lea rcx, str.stoi_argument_out_of_range
call fcn.140036500
nop
call fcn.14003d8c0
int3

Function at 0x140037f54
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140037f9e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140037f9e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140037f9e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140037f9e
cmp dword [rcx + 0x84], 0xe
jbe 0x140037f9e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140037fa0
xor al, al
add rsp, 0x28
ret