joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006dda0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14006de27
mov rsi, rbx
cmp word [rax], bp
je 0x14006dde6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14006ddd0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14006ddcc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140069458
mov rdi, rax
test rax, rax
je 0x14006de14
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140057c50
mov rbp, rdi
xor ecx, ecx
call fcn.140069e68
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14007199c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400719b2
mov al, 1
jmp 0x140071a12
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400719c3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140071a10
mov ecx, dword [rcx + 0x18]
nop
call fcn.14006e544
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140071a10
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140071a10
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140071a10
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140071a12
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140139ac0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140139acd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140139add
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140139ac5
lea eax, [rcx + 1]
jmp 0x140139aeb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140139afe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140139ae4
sub eax, 3
jb 0x140139b1e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140139b6d
sar eax, 1
movsxd rbp, eax
jb 0x140139b54
jmp 0x140139b2c
add ebx, ebx
jne 0x140139b2a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140139b54
inc ecx
add ebx, ebx
jne 0x140139b3a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140139b54
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140139b4d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140139b3c
add ecx, 2
jmp 0x140139b59
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140139a82
jmp 0x140139acd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xd8c00
mov dl, 0x28
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140139bbd
cmp rsi, rcx
jae 0x140139bc5
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140139ba4
cmp al, 0x8f
ja 0x140139ba4
cmp byte [rsi - 2], 0xf
je 0x140139baa
sub al, 0xe8
cmp al, 1
ja 0x140139b8e
cmp rsi, rcx
jae 0x140139bc5
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140139b94
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140139bc5
lodsb al, byte [rsi]
jmp 0x140139ba4
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x135000]
mov eax, dword [rdi]
or eax, eax
je 0x140139c22
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1394ec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140139bd2
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140139c1c
mov qword [rbx], rax
add rbx, 8
jmp 0x140139bf2
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140139c5c
cmp al, 0xef
ja 0x140139c4e
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140139c2e
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140139c3d
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140139cdb], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140139cdb
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140139ccb
sub rsp, 0xffffffffffffff80
jmp 0x1400013f0
Function at 0x140001e08
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001e52
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001e52
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], reloc.KERNEL32.dll_RtlCaptureContext
jne 0x140001e52
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001e52
cmp dword [rcx + 0x84], 0xe
jbe 0x140001e52
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e54
xor al, al
add rsp, 0x28
ret
Function at 0x140002b80
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140002bdd
lea rbx, [0x140042600]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002bc4
cmp r10, 2
jb 0x140002bc4
cmp byte [r9], r8b
jne 0x140002bc4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002ba0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140002c1f
lea rbx, [0x140042600]
cmp r8b, 0x23
jne 0x140002c03
cmp byte [r9], r8b
jne 0x140002c03
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140002bf0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140002de0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x140002e0f
mov r8d, 0x748
lea rdx, str.C:UsersujupDesktopclaritytipaimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x140002e1b
mov qword [rdi], 0
lea rdx, [0x140041eb8]
mov rcx, rbx
call fcn.140002c30
mov rbx, rax
test rax, rax
jne 0x140002e3d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140002f14
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002f14
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140002f14
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002f14
cmp rsi, 0xffffffffffffffff
je 0x140002f14
mov rax, qword [0x140099920]
test rax, rax
je 0x140002eb1
inc dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140002f14
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140002f01
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140099920]
test rax, rax
je 0x140002ef6
dec dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140002f1d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140002f0f
mov qword [rdi], rsi
mov rax, rbp
jmp 0x140002f1f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140005690
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xd0], 0
mov rbx, rcx
movsxd rdi, edx
jg 0x1400056c7
mov r8d, 0x702
lea rdx, str.C:UsersujupDesktopclaritytipaimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0xd8]
lea rdx, [0x140042600]
movsxd r8, dword [rbx + 0xd0]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [0x140099920]
not ebx
cmp dword [rcx + 0x3ec4], ebx
jne 0x140005746
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.14001b0f0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140013fe0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x140099920]
mov edi, ecx
cmp byte [rbx + 0x423d], 0
jne 0x140014032
cmp byte [rbx + 0x423e], 0
jne 0x140014032
movsx r9d, word [rbx + 0x5332]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140002a40
test dil, 1
je 0x140014158
jmp 0x1400140bb
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x140048f7c]
xor eax, eax
mulss xmm1, dword [0x140048f5c]
addss xmm0, dword [rbx + 0xdfc]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x3fa8], rax
mov dword [rbx + 0x3f94], 1
movss dword [rbx + 0x3fa0], xmm0
movss dword [rbx + 0x3fa4], xmm1
movss xmm0, dword [rbx + 0x38f4]
mulss xmm0, dword [0x140048ec4]
or dword [rbx + 0x3f90], 0x41
movss dword [rbx + 0x3ff0], xmm0
movsx r9d, word [rbx + 0x5332]
call fcn.140002a40
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140014110
lea r11, [0x140042600]
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x1400140f3
cmp byte [r8], r9b
jne 0x1400140f3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400140e0
not ecx
call fcn.14000b700
test rax, rax
je 0x140014158
cmp byte [rax + 0x96], 0
je 0x140014158
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5332]
mov edx, 0x10
movsx r9d, word [rbx + 0x5332]
call fcn.140002a40
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000e060
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140019980
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x53e0], 0
lea rbx, [rcx + 0x53e8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140019a23
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test ecx, ecx
jns 0x1400199d6
mov eax, ecx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.14001be20
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400032b0
mov eax, dword [rbx]
lea rcx, [0x140099918]
mov r9, qword [rdi + 0x53e0]
test eax, eax
lea edx, [rax - 1]
mov rax, qword [rdi + 0x53f0]
cmove edx, r14d
test rax, rax
movsxd r8, edx
mov edx, 1
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x140019a2b
mov rcx, rbx
call fcn.1400032b0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001a0d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x140099920]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x14001a134
lea r10, [0x140042600]
cmp r8b, 0x23
jne 0x14001a117
cmp byte [rdx], r8b
jne 0x14001a117
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14001a104
mov eax, dword [r14 + 0x5390]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x14001a195
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x14001a15a
cmp edi, eax
jl 0x14001a174
mov r8d, 0x6f9
lea rdx, str.C:UsersujupDesktopclaritytipaimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [r14 + 0x5398]
cmp dword [rax + rbp + 8], ebx
je 0x14001a1b2
mov eax, dword [r14 + 0x5390]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x14001a151
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x14001a1bf
cmp edi, dword [r14 + 0x5390]
jl 0x14001a1d9
mov r8d, 0x6f9
lea rdx, str.C:UsersujupDesktopclaritytipaimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rax, edi
lea rcx, [rax + rax*8]
mov rax, qword [r14 + 0x5398]
lea rax, [rax + rcx*8]
jmp 0x14001a197
Function at 0x140036170
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x210
call fcn.140011cd0
cmp byte [rax], 0
je 0x1400361f5
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1400361f5
mov rbx, qword [0x140099920]
test rbx, rbx
jne 0x1400361c4
mov r8d, 0xf0a
lea rdx, str.C:UsersujupDesktopclaritytipaimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x140099920]
cmp byte [rbx + 0x37a9], 0
je 0x1400361e1
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.140002460
mov dword [rbx + 0x380], 0x210
mov dword [rbx + 0x940], 0xa0
mov ecx, 0x214
call fcn.140011cd0
cmp byte [rax], 0
je 0x140036274
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x140036274
mov rbx, qword [0x140099920]
test rbx, rbx
jne 0x140036243
mov r8d, 0xf0a
lea rdx, str.C:UsersujupDesktopclaritytipaimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x140099920]
cmp byte [rbx + 0x37a9], 0
je 0x140036260
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.140002460
mov dword [rbx + 0x384], 0x214
mov dword [rbx + 0x950], 0xa1
mov ecx, 0x212
call fcn.140011cd0
cmp byte [rax], 0
je 0x1400362f3
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1400362f3
mov rbx, qword [0x140099920]
test rbx, rbx
jne 0x1400362c2
mov r8d, 0xf0a
lea rdx, str.C:UsersujupDesktopclaritytipaimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x140099920]
cmp byte [rbx + 0x37a9], 0
je 0x1400362df
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.140002460
mov dword [rbx + 0x26c], 0x212
mov dword [rbx + 0x948], 0x5b
mov ecx, 0x216
call fcn.140011cd0
cmp byte [rax], 0
je 0x140036372
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x140036372
mov rbx, qword [0x140099920]
test rbx, rbx
jne 0x140036341
mov r8d, 0xf0a
lea rdx, str.C:UsersujupDesktopclaritytipaimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x140099920]
cmp byte [rbx + 0x37a9], 0
je 0x14003635e
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.140002460
mov dword [rbx + 0x270], 0x216
mov dword [rbx + 0x958], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x10006ba04
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r12
push r13
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x100084ad0], rdi
je 0x10006ba5f
cmp rax, rdi
jne 0x10006ba52
mov r12d, 1
jmp 0x10006ba5f
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10006ba38
mov eax, dword [0x100084ac8]
cmp eax, 1
jne 0x10006ba74
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x10006bad9
mov eax, dword [0x100084ac8]
test eax, eax
jne 0x10006bacf
mov dword [0x100084ac8], 1
lea r13, [0x100001ca0]
lea rdi, [0x100001c88]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x24], eax
cmp rdi, r13
jae 0x10006bac1
test eax, eax
jne 0x10006bac1
mov rcx, qword [rdi]
test rcx, rcx
je 0x10006bab6
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x10006ba9f
test eax, eax
je 0x10006bad9
mov eax, 0xff
jmp 0x10006bc26
mov dword [0x100083a4c], 1
mov eax, dword [0x100084ac8]
cmp eax, 1
jne 0x10006bb01
lea rdx, [0x100001c80]
lea rcx, [0x100001b88]
call sub.msvcrt.dll__initterm
mov dword [0x100084ac8], 2
test r12d, r12d
jne 0x10006bb0f
xor eax, eax
xchg qword [0x100084ad0], rax
cmp qword [0x100084ae8], 0
je 0x10006bb38
lea rcx, [0x100084ae8]
call fcn.10006c530
test eax, eax
je 0x10006bb38
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100084ae8]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], 0
jne 0x10006bb4f
mov eax, 0xff
jmp 0x10006bc26
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x10006bbd8
cmp word [rcx], 0
je 0x10006bb6b
test edx, edx
jne 0x10006bbd8
cmp word [rcx], 0
je 0x10006bb82
cmp word [rcx], 0x20
ja 0x10006bb82
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x10006bb6b
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.100019410
mov dword [0x100083a48], eax
cmp dword [0x100083a2c], 0
jne 0x10006bbc1
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100083a4c], 0
jne 0x10006bbd6
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100083a48]
jmp 0x10006bc26
cmp word [rcx], 0x22
jne 0x10006bbeb
xor eax, eax
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x10006bb5b
lea r11, [rsp + 0xb0]
mov rdi, qword [r11 + 0x10]
mov r12, qword [r11 + 0x18]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.10006c674
add rsp, 0x28
jmp 0x10006ba04
Function at 0x140001000
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
xor eax, eax
lea r8, str.update_configurations.bat
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
add rsp, 0x38
ret

Function at 0x140001908
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001952
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001952
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001952
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001952
cmp dword [rcx + 0x84], 0xe
jbe 0x140001952
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001954
xor al, al
add rsp, 0x28
ret
Function at 0x1800012c0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x168
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180001311
xor eax, eax
jmp 0x18000146e
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4550
je 0x180001344
mov rax, qword [rsp + 0x30]
jmp 0x18000146e
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rcx + 0x18]
mov ecx, 0xf0
rep movsb byte [rdi], byte [rsi]
mov eax, 8
imul rax, rax, 0
cmp dword [rsp + rax + 0xd0], 0
jne 0x180001379
mov rax, qword [rsp + 0x30]
jmp 0x18000146e
mov eax, 8
imul rax, rax, 0
mov eax, dword [rsp + rax + 0xd0]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0
jmp 0x180001401
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x20], eax
jae 0x180001469
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov rdx, qword [rsp + 0x188]
mov rcx, rax
call fcn.180006330
test eax, eax
jne 0x180001467
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
jmp 0x180001469
jmp 0x1800013f7
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180002000
add rsp, 0x168
pop rdi
pop rsi
ret