joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400157a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov esi, dword [rcx + 8]
xor ebx, ebx
cmp esi, dword [r8 + 8]
mov r14, r8
mov rdi, rdx
mov r15, rcx
cmovae esi, dword [r8 + 8]
mov dword [rdx + 8], esi
test esi, esi
je 0x140015971
xorps xmm0, xmm0
mov eax, esi
cvtsi2sd xmm0, rax
mulsd xmm0, qword [0x14003bbf8]
call fcn.1400244dc
cvttsd2si rcx, xmm0
shl ecx, 8
mov dword [rdi + 0xc], ecx
call fcn.1400193b0
mov r8d, dword [rdi + 0xc]
xor edx, edx
mov rcx, rax
mov qword [rdi], rax
call fcn.140037f00
cmp esi, 8
jb 0x140015950
mov rdx, qword [rdi]
lea eax, [rsi - 1]
mov r10, qword [r15]
mov r9, qword [r14]
mov r8d, eax
lea rcx, [rax + rdx]
add rax, r10
cmp rdx, rax
ja 0x14001583a
cmp rcx, r10
jae 0x140015950
lea rax, [r8 + r9]
cmp rdx, rax
ja 0x14001584c
cmp rcx, r9
jae 0x140015950
cmp rdx, r15
ja 0x14001585a
cmp rcx, r15
jae 0x140015950
cmp rdx, r14
ja 0x140015868
cmp rcx, r14
jae 0x140015950
cmp rdx, rdi
ja 0x140015876
cmp rcx, rdi
jae 0x140015950
cmp esi, 0x40
jb 0x140015910
mov r8d, esi
mov qword [rsp + 0x50], rbp
and r8d, 0x3f
mov r11d, esi
sub r11d, r8d
mov ebp, 0x20
nop word [rax + rax]
mov eax, ebx
add ebx, 0x40
movdqu xmm0, xmmword [rax + r9]
movdqu xmm1, xmmword [rax + r10]
xorps xmm1, xmm0
movdqu xmmword [rdx + rax], xmm1
lea eax, [rbp - 0x10]
movdqu xmm0, xmmword [rax + r9]
movdqu xmm1, xmmword [rax + r10]
xorps xmm1, xmm0
movdqu xmmword [rdx + rax], xmm1
mov eax, ebp
movdqu xmm0, xmmword [rax + r9]
movdqu xmm1, xmmword [rax + r10]
xorps xmm1, xmm0
movdqu xmmword [rdx + rax], xmm1
lea eax, [rbp + 0x10]
add ebp, 0x40
movdqu xmm1, xmmword [rax + r10]
movdqu xmm0, xmmword [rax + r9]
xorps xmm1, xmm0
movdqu xmmword [rdx + rax], xmm1
cmp ebx, r11d
jb 0x1400158a0
mov rbp, qword [rsp + 0x50]
cmp r8d, 8
jb 0x14001593d
mov rdx, qword [r15]
mov ecx, esi
mov r8, qword [r14]
and ecx, 0xfffffff8
mov r9, qword [rdi]
nop
mov eax, ebx
add ebx, 8
movq xmm1, qword [rax + r8]
movq xmm0, qword [rax + rdx]
xorps xmm1, xmm0
movq qword [rax + r9], xmm1
cmp ebx, ecx
jb 0x140015920
cmp ebx, esi
jae 0x140015978
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r14]
mov rcx, qword [r15]
mov r8d, ebx
inc ebx
movzx edx, byte [r8 + rcx]
xor dl, byte [r8 + rax]
mov rax, qword [rdi]
mov byte [r8 + rax], dl
cmp ebx, esi
jb 0x140015950
jmp 0x140015978
mov qword [rdx], rbx
mov qword [rdx + 8], rbx
mov rbx, qword [rsp + 0x58]
mov rax, rdi
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140019d5c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140019da6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140019da6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140019da6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140019da6
cmp dword [rcx + 0x84], 0xe
jbe 0x140019da6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140019da8
xor al, al
add rsp, 0x28
ret
Function at 0x1400250ac
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002511b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002511b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002511b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002511b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002511b
cmp dword [rcx + 0x84], 0xe
jbe 0x14002511b
cmp dword [rcx + 0xf8], 0
je 0x14002511b
mov ecx, ebx
call fcn.1400251d8
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140024fa8
nop
cmp dword [rbp + 0x20], 0
je 0x140025169
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140025174
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1400250ac

Function at 0x1400252bc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400250ac
Function at 0x14002d864
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14002d894
xor eax, eax
jmp 0x14002d957
mov rbp, rbx
cmp word [rax], si
je 0x14002d8b9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14002d8a0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14002d89c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140029d24
movsxd r14, eax
test eax, eax
jne 0x14002d8f7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14002d88d
mov rcx, r14
call fcn.140029890
mov rdi, rax
test rax, rax
jne 0x14002d910
xor ecx, ecx
call fcn.140029854
jmp 0x14002d8ec
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140029d24
test eax, eax
jne 0x14002d941
mov rcx, rdi
call fcn.140029854
jmp 0x14002d94b
xor ecx, ecx
call fcn.140029854
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140034a74
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400207e0
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140034afe
cmp byte [rbp - 0x21], r15b
je 0x140034af9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140034b34
call fcn.140030e30
test eax, eax
jne 0x140034b20
cmp byte [rbp - 0x21], r15b
je 0x140034b18
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140034b34
cmp byte [rbp - 0x21], r15b
je 0x140034b31
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14002881c
test eax, eax
jne 0x140034bd4
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400207e0
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140034b73
cmp byte [rbp - 0x21], r15b
je 0x140034ba8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140034ba8
call fcn.140030e30
test eax, eax
jne 0x140034b94
cmp byte [rbp - 0x21], r15b
je 0x140034b8d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140034ba8
cmp byte [rbp - 0x21], r15b
je 0x140034ba5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14002881c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140034bd4
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140034bd7
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140034be5
mov rcx, rdi
call fcn.140029854
cmp byte [rbp + 0x3f], r15b
je 0x140034bf4
mov rcx, qword [rbp + 0x27]
call fcn.140029854
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140037440
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140037468
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140037468
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x4863c0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
sub rsp, 0xc8
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x78]
call qword [0x004873d8]
nop
cmp word [0x00400000], 0x5a4d
je 0x4863fd
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
lea rdi, [0x00400000]
jmp 0x48648b
movsxd rax, dword [0x0040003c]
lea rdi, [0x00400000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x486421
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x48648b
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x486468
cmp ecx, 0x20b
je 0x486440
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x48648b
cmp dword [rax + 0x84], 0xe
ja 0x486454
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x48648b
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
jmp 0x48648b
cmp dword [rax + 0x74], 0xe
ja 0x486479
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x48648b
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
mov ecx, 2
call qword [0x00487810]
mov qword [0x004bc360], 0xffffffffffffffff
mov qword [0x004bc368], 0xffffffffffffffff
mov rcx, qword [0x004877b0]
mov eax, dword [0x004bbde4]
mov dword [rcx], eax
mov rcx, qword [0x004877b8]
mov eax, dword [0x004bbde0]
mov dword [rcx], eax
call fcn.00486670
cmp dword [0x004bb0f0], 0
jne 0x4864e5
lea rcx, [fcn.00486670]
call qword [0x004877c0]
lea rdx, [0x004879e8]
lea rcx, [0x004879e0]
call 0x564000
mov r11d, dword [0x004bbddc]
mov dword [rsp + 0xd8], r11d
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x004bbdd8]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3c]
call qword [0x004877d0]
lea rdx, [0x004879d8]
lea rcx, [0x00487930]
call fcn.00486664
mov r11, qword [0x004877d8]
mov r8, qword [r11]
mov qword [rsp + 0x30], r8
cmp byte [r8], 0x22
jne 0x486586
nop
nop
inc r8
mov qword [rsp + 0x30], r8
movzx eax, byte [r8]
test al, al
je 0x486576
cmp al, 0x22
je 0x486576
jmp 0x486560
cmp byte [r8], 0x22
jne 0x486596
inc r8
mov qword [rsp + 0x30], r8
jmp 0x486596
cmp byte [r8], 0x20
jbe 0x486596
inc r8
mov qword [rsp + 0x30], r8
jmp 0x486586
movzx eax, byte [r8]
test al, al
je 0x4865ac
cmp al, 0x20
ja 0x4865ac
inc r8
mov qword [rsp + 0x30], r8
jmp 0x486596
test byte [rsp + 0x8c], 1
je 0x4865c1
movzx r9d, word [rsp + 0x90]
jmp 0x4865c7
mov r9d, 0xa
xor edx, edx
mov rcx, rdi
call fcn.0044a454
mov edi, eax
mov dword [rsp + 0x38], eax
test ebx, ebx
jne 0x4865e3
mov ecx, eax
call qword [0x004877e0]
call qword [0x004877e8]
jmp 0x486607
mov eax, edi
jmp 0x486610
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
add rsp, 0xc8
ret
Function at 0x18079a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.18079a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x18079a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18079a06f
add dl, dl
jne 0x18079a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18079a0f6
xor eax, eax
add dl, dl
jne 0x18079a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18079a1ad
add dl, dl
jne 0x18079a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18079a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18079a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18079a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x18079a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18079a07e
mov eax, 1
add dl, dl
jne 0x18079a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18079a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18079a0fb
sub eax, ebx
mov ebx, 1
jne 0x18079a14c
mov ecx, 1
add dl, dl
jne 0x18079a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18079a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18079a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18079a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x18079a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18079a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18079a15d
cmp eax, 0x7d00
jae 0x18079a19b
cmp eax, 0x500
jb 0x18079a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18079a07e
cmp eax, 0x7f
ja 0x18079a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18079a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x18079a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18079a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001000
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
jne 0x1400010ca
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rdi
sub rsp, 0x848
mov rax, qword [0x1400133c8]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov r9, rdx
mov edx, 0x400
lea rax, [r11 + 0x18]
lea rcx, [rsp + 0x30]
lea r8d, [rdx - 1]
xor edi, edi
mov qword [rsp + 0x20], rax
call fcn.140003e90
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov rax, qword [0x140015eb8]
test rax, rax
jne 0x14000109b
test rbx, rbx
je 0x1400010be
lea rdx, str.MessageBoxTimeoutW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140015eb8], rax
test rax, rax
jne 0x14000109b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400010be
lea r8, [0x140010dd0]
lea rdx, [rsp + 0x30]
mov r9d, 0x10010
xor ecx, ecx
mov dword [rsp + 0x28], 0xbb8
mov word [rsp + 0x20], di
call rax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
ret

Function at 0x140001008
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
jne 0x1400010ca
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rdi
sub rsp, 0x848
mov rax, qword [0x1400133c8]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov r9, rdx
mov edx, 0x400
lea rax, [r11 + 0x18]
lea rcx, [rsp + 0x30]
lea r8d, [rdx - 1]
xor edi, edi
mov qword [rsp + 0x20], rax
call fcn.140003e90
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov rax, qword [0x140015eb8]
test rax, rax
jne 0x14000109b
test rbx, rbx
je 0x1400010be
lea rdx, str.MessageBoxTimeoutW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140015eb8], rax
test rax, rax
jne 0x14000109b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400010be
lea r8, [0x140010dd0]
lea rdx, [rsp + 0x30]
mov r9d, 0x10010
xor ecx, ecx
mov dword [rsp + 0x28], 0xbb8
mov word [rsp + 0x20], di
call rax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
ret

Function at 0x1400010cc
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
jne 0x140001196
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rdi
sub rsp, 0x448
mov rax, qword [0x1400133c8]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov r9, rdx
mov edx, 0x400
lea rax, [r11 + 0x18]
lea rcx, [rsp + 0x30]
lea r8d, [rdx - 1]
xor edi, edi
mov qword [rsp + 0x20], rax
call fcn.140007448
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov rax, qword [0x140015eb0]
test rax, rax
jne 0x140001167
test rbx, rbx
je 0x14000118a
lea rdx, str.MessageBoxTimeoutA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140015eb0], rax
test rax, rax
jne 0x140001167
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14000118a
lea r8, str.Fatal_Error_in_Launcher
lea rdx, [rsp + 0x30]
mov r9d, 0x10010
xor ecx, ecx
invalid
and al, 0x28
invalid
invalid
Function at 0x1400010d4
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
jne 0x140001196
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rdi
sub rsp, 0x448
mov rax, qword [0x1400133c8]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov r9, rdx
mov edx, 0x400
lea rax, [r11 + 0x18]
lea rcx, [rsp + 0x30]
lea r8d, [rdx - 1]
xor edi, edi
mov qword [rsp + 0x20], rax
call fcn.140007448
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov rax, qword [0x140015eb0]
test rax, rax
jne 0x140001167
test rbx, rbx
je 0x14000118a
lea rdx, str.MessageBoxTimeoutA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140015eb0], rax
test rax, rax
jne 0x140001167
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14000118a
lea r8, str.Fatal_Error_in_Launcher
lea rdx, [rsp + 0x30]
mov r9d, 0x10010
xor ecx, ecx
invalid
and al, 0x28
invalid
invalid
Function at 0x140004884
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012b50
mov r15, qword [0x140020504]
cmp r15, 1
jne 0x140004953
push qword [0x1400205f4]
pop rcx
call fcn.14000dd04
mov r15, rax
and r15, r15
jle 0x1400048e9
mov rcx, qword [0x1400205f4]
call fcn.14000dd0c
mov rcx, qword [0x1400205f4]
call fcn.14000dd20
or rax, rax
je 0x1400048e9
mov rbp, qword [0x1400205fc]
push qword [rbp + 0x10]
pop rcx
call fcn.14000e1bc
jmp 0x1400048c6
push qword [0x1400205e4]
pop rcx
call fcn.14000dd04
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004953
push 5
push 0
push 1
push qword [0x1400205e4]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009060
mov rcx, qword [0x1400205e4]
call fcn.14000dd0c
mov rcx, qword [0x1400205e4]
call fcn.14000dd20
or rax, rax
je 0x140004953
mov rbp, qword [0x1400205ec]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x140004930
mov rax, 1
jmp 0x14000495f
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006b38
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f180]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021200]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020630]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020630]
call fcn.1400123b8
lea rcx, [0x140021200]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
and edi, ebx
and eax, 0x61be015d
adc byte [rax + 0x6aa05324], bh
imul byte [rdx + 0x1f]
add edx, edi
invalid
in al, 0x33
push rdx
cwde
mov al, 0x12
sub dh, byte [rcx + 0x3a]
pop rcx
sbb dword [rcx + riz - 0x2b], 0x62
invalid
outsd dx, dword [rsi]
invalid
sbb eax, 0xbaada5af
xchg ecx, eax
retf 0xbbd
invalid
add byte cs:[rdx], dl
pop rcx
lea ecx, [rbx - 0x465f7b45]
test byte [rax + 0x128045b9], ah
or dword [rcx], 0x667540f9
test byte [rax + 0x128045b9], ah
or dword [rcx], 0x667540f9
fld st(7)
ret 0x1ea8
invalid
mov bl, 5
invalid
pop rbp
sbb ch, byte [rcx]
add eax, 0x7451346
out 0xb5, al
and dword [rdx - 0xf], edi
add dh, ch
sbb ebx, edi
movabs byte [0xc8dfb9800aba6a93], al
enter 0x2080, 0x3f
or bl, bl
mov fs, word [rbx - 0x25]
in eax, 0x4c
invalid
Function at 0x1400031c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
movaps xmmword [rax - 0x28], xmm6
mov rsi, rdx
movsxd rdx, dword [0x1400d1fd4]
mov rdi, rcx
movaps xmmword [rax - 0x38], xmm7
lea rcx, [0x1400d1ff0]
movaps xmmword [rax - 0x48], xmm8
mov rbx, r9
shl rdx, 5
mov rbp, r8
add rdx, qword [0x1400d1fd8]
movaps xmmword [rax - 0x58], xmm9
movaps xmmword [rax - 0x68], xmm10
call fcn.140003cd0
mov r9d, 0xc
lea r8, [rsp + 0x30]
xorps xmm9, xmm9
mov ecx, dword [rax]
shl ecx, 5
movsxd rdx, ecx
mov rcx, qword [0x1400d1e28]
add rdx, rbx
xor ebx, ebx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm8, dword [rsp + 0x30]
movss xmm7, dword [rsp + 0x34]
subss xmm8, dword [rdi + 0x20]
subss xmm7, dword [rdi + 0x24]
movss xmm6, dword [rsp + 0x38]
subss xmm6, dword [rdi + 0x28]
movaps xmm0, xmm8
movaps xmm1, xmm7
xorps xmm6, xmmword [0x1400beab0]
call fcn.1400836bc
movaps xmm1, xmm0
movaps xmm0, xmm6
call fcn.140083a0c
movaps xmm10, xmm0
movaps xmm1, xmm8
mulss xmm10, dword [0x1400be630]
movaps xmm0, xmm7
subss xmm10, dword [rdi + 0x38]
call fcn.140083a0c
movaps xmm8, xmm0
xorps xmm6, xmm6
mulss xmm8, dword [0x1400be630]
movaps xmm0, xmm10
xorps xmm7, xmm7
subss xmm8, dword [rdi + 0x3c]
movaps xmm1, xmm8
call fcn.1400836bc
movss xmm1, dword [0x1400d1fc8]
comiss xmm1, xmm0
jbe 0x1400032ec
movaps xmm6, xmm10
movaps xmm7, xmm8
movss xmm2, dword [0x1400be63c]
comiss xmm6, xmm2
movss xmm1, dword [0x1400be658]
movss xmm0, dword [0x1400be64c]
jbe 0x14000330e
comiss xmm0, xmm6
jae 0x140003324
comiss xmm6, xmm0
jbe 0x140003317
subss xmm6, xmm1
movss xmm2, dword [0x1400be68c]
comiss xmm2, xmm6
jbe 0x140003327
movaps xmm6, xmm2
comiss xmm7, xmm0
jbe 0x140003330
subss xmm7, xmm1
movss xmm0, dword [0x1400be690]
comiss xmm0, xmm7
jbe 0x140003341
addss xmm7, xmm1
divss xmm6, dword [0x1400d1fc4]
divss xmm7, dword [0x1400d1fc4]
ucomiss xmm6, xmm9
jp 0x140003372
jne 0x140003372
ucomiss xmm7, xmm9
jp 0x140003372
jne 0x140003372
ucomiss xmm9, xmm9
jp 0x140003372
jne 0x140003372
mov qword [0x1400d1e10], rbx
jmp 0x1400033e7
cmp byte [0x1400d2000], bl
je 0x1400033a5
movsxd rdx, dword [0x1400d2004]
lea rcx, [0x1400d2038]
shl rdx, 5
add rdx, qword [0x1400d2020]
call fcn.140003cd0
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400033e7
addss xmm6, dword [rsi]
addss xmm7, dword [rsi + 4]
movss xmm1, dword [rsi + 8]
lea r8, [rsp + 0x30]
mov rcx, qword [0x1400d1e28]
addss xmm1, xmm9
mov r9d, 0xc
mov qword [rsp + 0x20], rbx
mov rdx, rbp
unpcklps xmm6, xmm7
movsd qword [rsp + 0x30], xmm6
movss dword [rsp + 0x38], xmm1
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop rdi
pop rsi
pop rbp
ret