joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4106f7c0
Capabilities:
Read .ini file

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x2e0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x300], rbx
mov rax, qword [0x41359af8]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x4106f803
xor al, al
jmp 0x4106fa43
mov rax, qword [0x4135c018]
test rax, rax
jne 0x4106f836
mov ecx, 0x2d0
call fcn.41211580
mov qword [rsp + 0x38], rax
test rax, rax
je 0x4106f82d
mov rcx, rax
call fcn.410228e0
jmp 0x4106f82f
xor eax, eax
mov qword [0x4135c018], rax
mov rcx, rax
call fcn.4102a770
lea rcx, str.vip.conf
mov qword [rsp + 0x20], rcx
lea r9, str.Config
mov r8, rax
lea rdx, [0x4129a308]
lea rsi, [0x41360510]
mov rcx, rsi
call fcn.412122b0
mov word [rsp + 0xc0], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xc2]
call fcn.412121c0
mov r8, rdi
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.4106f200
nop
lea rdx, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae rdx, qword [rsp + 0x70]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0xc0]
lea r8, [0x412a02a8]
lea rcx, str.user
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rsi, [rsp + 0xc0]
lea rdi, [0x412a02a8]
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
jne 0x4106f9c1
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], 0
mov word [rsp + 0x48], 0
lea r8, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae r8, qword [rsp + 0x70]
lea r9, [rsp + 0x40]
lea rdx, str.user
mov rcx, rbx
call fcn.4106eff0
test al, al
jne 0x4106f980
cmp qword [rsp + 0x60], 8
jb 0x4106f94b
mov rcx, qword [rsp + 0x48]
call fcn.41210d60
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], 0
mov word [rsp + 0x48], 0
cmp qword [rsp + 0x88], 8
jb 0x4106f979
mov rcx, qword [rsp + 0x70]
call fcn.41210d60
xor al, al
jmp 0x4106fa43
lea rdx, [rsp + 0x48]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x60]
cmp rdi, 8
cmovae rdx, rsi
lea rcx, [rsp + 0xc0]
nop
movzx eax, word [rdx]
mov word [rcx], ax
add rdx, 2
add rcx, 2
test ax, ax
jne 0x4106f9a0
cmp rdi, 8
jb 0x4106f9c1
mov rcx, rsi
call fcn.41210d60
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x90]
mov rcx, rbx
call fcn.4106f530
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x90]
mov rcx, rbp
call fcn.41022de0
nop
cmp qword [rsp + 0xb0], 8
jb 0x4106fa0a
mov rcx, qword [rsp + 0x98]
call fcn.41210d60
mov qword [rsp + 0xb0], 7
mov qword [rsp + 0xa8], 0
mov word [rsp + 0x98], 0
cmp qword [rsp + 0x88], 8
jb 0x4106fa41
mov rcx, qword [rsp + 0x70]
call fcn.41210d60
mov al, 1
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.41211b80
mov rbx, qword [rsp + 0x300]
add rsp, 0x2e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x4106fe00
Capabilities:
Read .ini file

Disassembly:
push rbx
sub rsp, 0x470
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x41359af8]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rax, qword [0x4135c018]
test rax, rax
jne 0x4106fe57
mov ecx, 0x2d0
call fcn.41211580
mov qword [rsp + 0x30], rax
test rax, rax
je 0x4106fe4e
mov rcx, rax
call fcn.410228e0
jmp 0x4106fe50
xor eax, eax
mov qword [0x4135c018], rax
mov rcx, rax
call fcn.4102a770
lea rcx, str.vip.conf
mov qword [rsp + 0x20], rcx
lea r9, str.Config
mov r8, rax
lea rdx, [0x4129a308]
lea rbx, [0x41360720]
mov rcx, rbx
call fcn.412122b0
mov word [rsp + 0x40], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x42]
call fcn.412121c0
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x40]
lea r8, [0x412a4910]
lea rdx, str.FirstInstallDate
lea rcx, [0x412a4a78]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov word [rsp + 0x250], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x252]
call fcn.412121c0
call fcn.410375d0
mov r8d, eax
lea rdx, [0x412a4ae8]
lea rcx, [rsp + 0x250]
call fcn.412122b0
lea r11, [rsp + 0x40]
lea rdx, [rsp + 0x250]
sub rdx, r11
nop
movzx ecx, word [r11]
movzx eax, word [r11 + rdx]
sub ecx, eax
jne 0x4106ff35
add r11, 2
test eax, eax
jne 0x4106ff20
test ecx, ecx
sete al
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.41211b80
add rsp, 0x470
pop rbx
ret
Function at 0x4106ff80
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rcx, qword [0x4135c008]
test rcx, rcx
jne 0x4106ffca
mov ecx, 8
call fcn.41211580
mov qword [rsp + 0x68], rax
test rax, rax
je 0x4106ffc1
mov rcx, rax
call fcn.41097220
mov rcx, rax
jmp 0x4106ffc3
xor ecx, ecx
mov qword [0x4135c008], rcx
mov rax, qword [rcx]
mov edx, 0x9f
call qword [rax]
test eax, eax
jg 0x4106ffdf
xor al, al
jmp 0x4107015a
lea rcx, [rsp + 0x58]
call fcn.4106efe0
nop
mov dword [rsp + 0x60], 0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
call fcn.4106fc20
test al, al
je 0x4107014e
cmp dword [rsp + 0x60], 1
jg 0x4107014e
mov rax, qword [0x4135c018]
test rax, rax
jne 0x41070047
mov ecx, 0x2d0
call fcn.41211580
mov qword [rsp + 0x68], rax
test rax, rax
je 0x4107003e
mov rcx, rax
call fcn.410228e0
jmp 0x41070040
xor eax, eax
mov qword [0x4135c018], rax
mov rcx, rax
call fcn.4102a770
lea rcx, str.vip.conf
mov qword [rsp + 0x20], rcx
lea r9, str.Config
mov r8, rax
lea rdx, [0x4129a308]
lea rcx, [0x41360720]
call fcn.412122b0
lea r9, [0x41360720]
xor r8d, r8d
lea rdx, str.ShowDay1
lea rcx, str.VipExpire
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, eax
lea r9, [0x41360720]
xor r8d, r8d
lea rdx, str.ShowDay2
lea rcx, str.VipExpire
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
lea r9, [0x41360720]
xor r8d, r8d
lea rdx, str.ShowDay3
lea rcx, str.VipExpire
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test ebx, ebx
jne 0x410700e8
lea rcx, [rsp + 0x58]
call fcn.410db8d0
mov al, 1
jmp 0x4107015a
test edi, edi
jne 0x41070114
call fcn.410375d0
sub eax, ebx
cmp eax, 3
jl 0x41070106
lea rcx, [rsp + 0x58]
call fcn.410db8d0
mov al, 1
jmp 0x4107015a
lea rcx, [rsp + 0x58]
call fcn.410db8d0
xor al, al
jmp 0x4107015a
test eax, eax
jne 0x41070140
call fcn.410375d0
sub eax, ebx
cmp eax, 7
jl 0x41070132
lea rcx, [rsp + 0x58]
call fcn.410db8d0
mov al, 1
jmp 0x4107015a
lea rcx, [rsp + 0x58]
call fcn.410db8d0
xor al, al
jmp 0x4107015a
lea rcx, [rsp + 0x58]
call fcn.410db8d0
xor al, al
jmp 0x4107015a
lea rcx, [rsp + 0x58]
call fcn.410db8d0
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x410701d0
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
call fcn.4106fe00
test al, al
je 0x410701ed
xor al, al
jmp 0x410702bc
mov rax, qword [0x4135c018]
test rax, rax
jne 0x41070220
mov ecx, 0x2d0
call fcn.41211580
mov qword [rsp + 0x58], rax
test rax, rax
je 0x41070217
mov rcx, rax
call fcn.410228e0
jmp 0x41070219
xor eax, eax
mov qword [0x4135c018], rax
mov rcx, rax
call fcn.4102a770
lea rcx, str.vip.conf
mov qword [rsp + 0x20], rcx
lea r9, str.Config
mov r8, rax
lea rdx, [0x4129a308]
lea rcx, [0x41360720]
call fcn.412122b0
lea r9, [0x41360720]
xor r8d, r8d
lea rdx, str.TipRegister
lea rcx, [0x412a4a78]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x41070277
xor al, al
jmp 0x410702bc
mov rcx, qword [0x4135c008]
test rcx, rcx
jne 0x410702ad
mov ecx, 8
call fcn.41211580
mov qword [rsp + 0x58], rax
test rax, rax
je 0x410702a4
mov rcx, rax
call fcn.41097220
mov rcx, rax
jmp 0x410702a6
xor ecx, ecx
mov qword [0x4135c008], rcx
mov rax, qword [rcx]
mov edx, 0x9f
call qword [rax]
test eax, eax
setg al
add rsp, 0x48
ret

Function at 0x410793c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x40
mov rdi, qword [rcx + 8]
mov r12, rcx
mov rbx, qword [rdi + 8]
cmp rbx, qword [rdi + 0x10]
jbe 0x410793f0
call fcn.41211d60
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rbx
movaps xmmword [rsp + 0x30], xmm6
nop
mov rsi, qword [r12 + 8]
mov rbp, qword [rsi + 0x10]
cmp qword [rsi + 8], rbp
jbe 0x41079414
call fcn.41211d60
test rdi, rdi
je 0x4107941e
cmp rdi, rsi
je 0x41079423
call fcn.41211d60
cmp rbx, rbp
je 0x410794ad
test rdi, rdi
jne 0x41079436
call fcn.41211d60
cmp rbx, qword [rdi + 0x10]
jb 0x41079441
call fcn.41211d60
mov ecx, dword [rbx]
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x41079494
mov rdi, qword [r12 + 8]
movaps xmm6, xmmword [rsp + 0x20]
lea r8, [rbx + 4]
mov rdx, qword [rdi + 0x10]
sub rdx, r8
sar rdx, 2
test rdx, rdx
jle 0x4107947a
shl rdx, 2
mov rcx, rbx
mov r9, rdx
call fcn.41211980
add qword [rdi + 0x10], 0xfffffffffffffffc
movdqa xmmword [rsp + 0x20], xmm6
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
jmp 0x41079400
cmp rbx, qword [rdi + 0x10]
jb 0x4107949f
call fcn.41211d60
add rbx, 4
mov qword [rsp + 0x28], rbx
jmp 0x41079400
movaps xmm6, xmmword [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x410800a0
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push r13
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx + 0x270]
mov edx, 0x55
mov rax, qword [rcx]
call qword [rax]
mov ecx, 0x12
mov r13d, eax
call qword [sym.imp.USER32.dll_GetKeyState]
lea ecx, [r13 - 1]
mov r11w, ax
shr r11d, 0xf
not r11d
and r11d, 1
cmp ecx, 2
ja 0x410802c8
test r11d, r11d
je 0x410802c8
cmp dword [rsi + 0xd0], 0
jne 0x410802c8
lea rdx, [0x412a02a8]
lea rcx, [rsi + 0x108]
xor r8d, r8d
mov qword [rsp + 0x20], r12
call fcn.41024690
mov rcx, qword [rsi + 0x270]
mov rax, qword [rcx]
mov edx, 9
call qword [rax]
test eax, eax
je 0x410801e0
mov rcx, qword [rsi + 0x158]
mov qword [rsp + 0x50], rdi
call fcn.410696a0
test rax, rax
mov rdi, rax
je 0x410801c4
mov rcx, rax
call fcn.410696d0
test rax, rax
je 0x410801c4
mov qword [rsp + 0x40], rbx
mov rbx, qword [rdi + 8]
mov qword [rsp + 0x48], rbp
cmp rbx, qword [rdi + 0x10]
jbe 0x41080170
call fcn.41211d60
nop
mov rbp, qword [rdi + 0x10]
cmp qword [rdi + 8], rbp
jbe 0x4108017f
call fcn.41211d60
cmp rbx, rbp
je 0x410801ba
cmp rbx, qword [rdi + 0x10]
jb 0x4108018f
call fcn.41211d60
lea rdx, [rbx + 0x28]
lea rcx, [rsi + 0x108]
or r9, 0xffffffffffffffff
xor r8d, r8d
call fcn.41022c90
cmp rbx, qword [rdi + 0x10]
jb 0x410801b1
call fcn.41211d60
add rbx, 0xa0
jmp 0x41080170
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rdx, [rsi + 0x30]
lea rcx, [rsi + 0x108]
or r9, 0xffffffffffffffff
xor r8d, r8d
call fcn.41022c90
mov rdi, qword [rsp + 0x50]
mov al, byte [rsi + 0x335]
mov cl, byte [rsi + 0x334]
and eax, 0x80
and ecx, 0x80
je 0x41080201
test eax, eax
jne 0x410802c3
cmp r13d, 1
jne 0x41080220
lea rdx, [0x412a02a8]
lea rcx, [rsi + 0x108]
call fcn.41038930
test al, al
je 0x41080263
jmp 0x41080245
cmp r13d, 2
jne 0x4108026d
test ecx, ecx
je 0x410802c3
lea rdx, [0x412a02a8]
lea rcx, [rsi + 0x108]
call fcn.41038930
test al, al
je 0x41080263
mov rcx, rsi
call fcn.4107eb00
lea rdx, [0x412a02a8]
lea rcx, [rsi + 0x108]
xor r8d, r8d
call fcn.41024690
cmp qword [rsi + 0x280], 0
jmp 0x410802b4
cmp r13d, 3
jne 0x410802c3
test eax, eax
je 0x410802c3
lea rdx, [0x412a02a8]
lea rcx, [rsi + 0x108]
call fcn.41038930
test al, al
je 0x410802ac
mov rcx, rsi
call fcn.4107eb00
lea rdx, [0x412a02a8]
lea rcx, [rsi + 0x108]
xor r8d, r8d
call fcn.41024690
cmp qword [rsi + 0x280], 0
je 0x410802c3
mov rcx, qword [rsi + 0x280]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r12, qword [rsp + 0x20]
add rsp, 0x28
pop r13
pop rsi
ret
Function at 0x4108f4f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x168]
movzx edi, dx
call fcn.41068f90
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
cmp al, 1
je 0x4108f624
cmp di, 0x3a
jne 0x4108f58c
mov rcx, qword [rbx + 0x270]
mov edx, 0x3c
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x4108f58c
cmp qword [rbx + 0x50], 8
jb 0x4108f547
mov rcx, qword [rbx + 0x38]
jmp 0x4108f54b
lea rcx, [rbx + 0x38]
call fcn.41052190
test eax, eax
je 0x4108f572
mov dx, 0x3a
mov rcx, rbx
call fcn.4107e910
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.410840d0
cmp qword [rbx + 0x50], 8
jb 0x4108f57f
mov rcx, qword [rbx + 0x38]
jmp 0x4108f583
lea rcx, [rbx + 0x38]
call fcn.41051f20
test eax, eax
jne 0x4108f554
cmp dword [rbx + 0x58], 0
jle 0x4108f5b2
mov rcx, qword [rbx + 0x270]
mov edx, 0x3c
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x4108f5b2
cmp di, 0x40
jne 0x4108f5b2
movzx edx, di
jmp 0x4108f558
mov rcx, qword [rbx + 0x270]
mov edx, 0x5d
mov rax, qword [rcx]
call qword [rax + 0x88]
test eax, eax
jne 0x4108f624
lea eax, [rdi - 0x61]
cmp ax, 0x19
ja 0x4108f5f1
movzx edx, di
mov rcx, rbx
call fcn.4107e910
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.4108a880
lea eax, [rdi - 0x41]
cmp ax, 0x19
ja 0x4108f624
mov rcx, qword [rbx + 0x270]
mov edx, 7
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x4108f624
movzx edx, di
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.41082e30
movzx edx, di
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.410848f0

Function at 0x4108f950
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x58], 0
mov rbx, rcx
jne 0x4108f96d
mov dx, 0x27
add rsp, 0x20
pop rbx
jmp fcn.410848f0
mov rcx, qword [rcx + 0x270]
mov edx, 0x57
mov rax, qword [rcx]
call qword [rax]
cmp eax, 2
jne 0x4108f9a9
mov rcx, qword [rbx + 0x160]
mov rax, qword [rcx]
call qword [rax + 0x58]
cmp eax, 3
jl 0x4108f9a9
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 3]
add rsp, 0x20
pop rbx
jmp fcn.4108dfd0
mov eax, dword [rbx + 0x5c]
mov qword [rsp + 0x38], rdi
mov edi, 1
test eax, eax
jle 0x4108f9f0
add eax, 0xffffffff
mov qword [rsp + 0x30], rsi
movsxd rsi, eax
cmp rsi, qword [rbx + 0x20]
jbe 0x4108f9d0
call fcn.41211d60
cmp qword [rbx + 0x28], 8
jb 0x4108f9dd
mov rax, qword [rbx + 0x10]
jmp 0x4108f9e1
lea rax, [rbx + 0x10]
xor ecx, ecx
cmp word [rax + rsi*2], 0x27
mov rsi, qword [rsp + 0x30]
cmove edi, ecx
cmp dword [rbx + 0x5c], 0
je 0x4108fa31
test edi, edi
je 0x4108fa31
mov dx, 0x27
mov rcx, rbx
call fcn.4107e910
cmp dword [rbx + 0x258], 0
jle 0x4108fa29
mov rcx, rbx
call fcn.410819f0
mov rcx, rbx
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp fcn.4107cf40
mov rcx, rbx
call fcn.4108a880
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x4108fa40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x270]
mov edx, 0x57
mov rax, qword [rcx]
call qword [rax]
cmp eax, 2
jne 0x4108fa85
mov rcx, qword [rbx + 0x160]
mov rax, qword [rcx]
call qword [rax + 0x58]
cmp eax, 1
jle 0x4108fa85
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 2]
add rsp, 0x20
pop rbx
jmp fcn.4108dfd0
mov dx, 0x3b
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.410848f0
Function at 0x41091bb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x208], 0
movzx edi, dx
mov rbx, rcx
mov dword [rcx + 0xf0], 1
jne 0x41091bfb
call fcn.4107e910
cmp dword [rbx + 0x258], 0
mov rcx, rbx
je 0x41091c42
call fcn.410819f0
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.4107cf40
mov rcx, qword [rcx + 0x160]
mov rax, qword [rcx]
call qword [rax + 0x60]
test eax, eax
jle 0x41091c34
cmp di, 0x31
jb 0x41091c34
movzx edx, di
add eax, 0x30
cmp edx, eax
jg 0x41091c34
add edx, 0xffffffd0
xor r8d, r8d
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.4108dfd0
movzx edx, di
mov rcx, rbx
call fcn.4107e910
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.4108a880
Function at 0x41092760
Capabilities:
Check for time delay via gettickcount
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
cmp dword [rcx + 0x58], 0
movzx esi, r8w
mov rbx, rcx
jne 0x4109279e
mov rcx, qword [rcx + 0x160]
mov rax, qword [rcx]
call qword [rax + 0x58]
test eax, eax
jne 0x4109279e
mov dx, 0x3d
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.410848f0
mov rcx, qword [rbx + 0x270]
mov edx, 0x1f
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x4109286e
cmp qword [rbx + 0x28], 8
jb 0x410927c4
mov rcx, qword [rbx + 0x10]
jmp 0x410927c8
lea rcx, [rbx + 0x10]
call fcn.41051270
test eax, eax
je 0x41092856
cmp dword [rbx + 0x208], 0
je 0x41092819
cmp dword [rbx + 0xf8], 0
je 0x41092807
mov dx, 0x3d
mov rcx, rbx
call fcn.410848f0
cmp qword [rbx + 0x28], 8
jb 0x410929a6
mov rcx, qword [rbx + 0x10]
jmp 0x410929aa
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.41082ca0
mov dx, 0x3d
mov rcx, rbx
mov dword [rbx + 0xf0], 1
call fcn.4107e910
cmp dword [rbx + 0x258], 0
je 0x41092a05
mov rcx, rbx
call fcn.410819f0
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.4107cf40
cmp dword [rbx + 0x58], 0
je 0x41092788
cmp dword [rbx + 0xf8], 0
je 0x41092807
jmp 0x41092788
mov rcx, qword [rbx + 0x270]
mov edx, 0x23
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x410927f3
cmp qword [rbx + 0x28], 8
jb 0x41092894
mov rcx, qword [rbx + 0x10]
jmp 0x41092898
lea rcx, [rbx + 0x10]
call fcn.41051270
test eax, eax
je 0x41092919
cmp dword [rbx + 0x208], 0
mov dword [rbx + 0xf0], 1
jne 0x410928df
mov dx, 0x3d
mov rcx, rbx
call fcn.4107e910
cmp dword [rbx + 0x258], 0
jne 0x4109283c
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.4108a880
mov rcx, qword [rbx + 0x160]
mov rax, qword [rcx]
call qword [rax + 0x60]
test eax, eax
jle 0x410929f9
add eax, 0x30
cmp eax, 0x3d
jl 0x410929f9
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 0xd]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.4108dfd0
cmp dword [rbx + 0xf8], 0
jne 0x41092788
cmp dword [rbx + 0x254], 3
jl 0x41092992
mov qword [rsp + 0x30], rdi
xor edi, edi
mov rcx, rbx
mov dword [rbx + 0x254], edi
call fcn.4108f640
cmp si, 0xbe
jne 0x4109296b
cmp dword [rbx + 0xe4], edi
sete dil
mov dword [rbx + 0xe4], edi
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
cmp si, 0xbc
jne 0x41092955
cmp dword [rbx + 0xe8], edi
sete dil
mov dword [rbx + 0xe8], edi
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
xor edx, edx
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.4108cd00
lea rcx, [rbx + 0x10]
call fcn.41051270
test eax, eax
je 0x41092788
cmp dword [rbx + 0x208], 0
mov dword [rbx + 0xf0], 1
jne 0x410928df
mov dx, 0x3d
mov rcx, rbx
call fcn.4107e910
cmp dword [rbx + 0x258], 0
jne 0x4109283c
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.4108a880
mov dx, 0x3d
mov rcx, rbx
call fcn.4107e910
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.4108a880
Function at 0x41092a20
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
cmp dword [rcx + 0x58], 0
movzx esi, r8w
mov rbx, rcx
jne 0x41092a4c
mov rcx, qword [rcx + 0x160]
mov rax, qword [rcx]
call qword [rax + 0x58]
test eax, eax
je 0x41092af9
mov rcx, qword [rbx + 0x270]
mov edx, 0x20
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x41092b0f
cmp qword [rbx + 0x28], 8
jb 0x41092a72
mov rcx, qword [rbx + 0x10]
jmp 0x41092a76
lea rcx, [rbx + 0x10]
call fcn.41051270
test eax, eax
je 0x41092ae0
cmp dword [rbx + 0x208], 0
je 0x41092aa3
cmp dword [rbx + 0xf8], 0
jne 0x41092af9
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.41082ab0
mov dx, 0x5b
mov rcx, rbx
mov dword [rbx + 0xf0], 1
call fcn.4107e910
cmp dword [rbx + 0x258], 0
je 0x41092cb6
mov rcx, rbx
call fcn.410819f0
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.4107cf40
cmp dword [rbx + 0xf8], 0
jne 0x41092af9
mov rcx, rbx
call fcn.41082ab0
test eax, eax
jne 0x41092c01
mov dx, 0x5b
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.410848f0
mov rcx, qword [rbx + 0x270]
mov edx, 0x24
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x41092c4a
cmp qword [rbx + 0x28], 8
jb 0x41092b35
mov rcx, qword [rbx + 0x10]
jmp 0x41092b39
lea rcx, [rbx + 0x10]
call fcn.41051270
test eax, eax
je 0x41092bba
cmp dword [rbx + 0x208], 0
mov dword [rbx + 0xf0], 1
jne 0x41092b80
mov dx, 0x5b
mov rcx, rbx
call fcn.4107e910
cmp dword [rbx + 0x258], 0
jne 0x41092ac6
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.4108a880
mov rcx, qword [rbx + 0x160]
mov rax, qword [rcx]
call qword [rax + 0x60]
test eax, eax
jle 0x41092caa
add eax, 0x30
cmp eax, 0x5b
jl 0x41092caa
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 0x2b]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.4108dfd0
cmp dword [rbx + 0xf8], 0
jne 0x41092af9
cmp dword [rbx + 0x254], 3
jl 0x41092c33
mov qword [rsp + 0x30], rdi
xor edi, edi
mov rcx, rbx
mov dword [rbx + 0x254], edi
call fcn.4108f640
cmp si, 0xbe
jne 0x41092c0c
cmp dword [rbx + 0xe4], edi
sete dil
mov dword [rbx + 0xe4], edi
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
cmp si, 0xbc
jne 0x41092bf6
cmp dword [rbx + 0xe8], edi
sete dil
mov dword [rbx + 0xe8], edi
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov edx, 1
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.4108cd00
cmp qword [rbx + 0x28], 8
jb 0x41092c57
mov rcx, qword [rbx + 0x10]
jmp 0x41092c5b
lea rcx, [rbx + 0x10]
call fcn.41051270
test eax, eax
je 0x41092af9
cmp dword [rbx + 0x208], 0
mov dword [rbx + 0xf0], 1
jne 0x41092b80
mov dx, 0x5b
mov rcx, rbx
call fcn.4107e910
cmp dword [rbx + 0x258], 0
jne 0x41092ac6
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.4108a880
mov dx, 0x5b
mov rcx, rbx
call fcn.4107e910
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.4108a880